Release Simulator Broker 0.1.0-alpha.4

[VladimirBrejcha]

Summary

• Bump the current CLI, npm, Homebrew, cask, install, support, and security surfaces to 0.1.0-alpha.4.
• Document exactly four custom GitHub Release assets: CLI archive, CLI checksum, npm tarball, and notarized app zip.
• Make the tag workflow and manual fallback agree about the checksum and operator app upload.
• Add exact-command front-door assertions that reject trailing or interspersed fourth workflow assets.
• Record the Alpha 4 install, upgrade, app, reliability, and UX changes.

Verification

• npm test
• npm run agent:verify -- --profile spec-only
• npm run verify:public-surface
• bounded public-source current-candidate audit and semantic diff review
• independent source and release-artifact audit
• exact CLI and npm Alpha 4 package checks
• Developer ID signature, accepted zero-issue notarization log, stapler validation, and Gatekeeper acceptance on the extracted app zip
• agent:complete

Retained release bytes

• CLI: 1e04e4e9f7c0b372722b80e057b63dda87e12d7d5cbf7043d084826f0ea57503
• CLI checksum asset: 3611dbd078456703d3e128ccc1de24e9f9f3194ce1e247926d41d0348e1e0c32
• npm: a0d365ede67bf0bcc0fcaf5f0c1a0895400b0c4e9561855613462de8ee3d49ff
• app: d44c4ba8318338c5e009ed2e71aa6fea03e6167698a4a60df7ce5b865f5e3963

If review feedback changes source, the affected bytes must be rebuilt, repinned, and re-audited before merge. GitHub generated source archives are separate from the four custom assets.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-08-31T07:38:39.478003Z	04c12f3	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[fiveonecode-autopilot]

Autopilot needs your choice — AD-20260831-001

Review finding (External review):
The active PR changes a guarded verifier or bootstrap implementation file.
Autopilot will not run HEAD verifier code or HEAD bootstrap until this exact implementation identity is authorized.
Keep-blocked does not run old product source; it refuses HEAD verifier/bootstrap and does not push.

Concrete operator choices:

• Authorize this contract change: accept HEAD implementation, then Autopilot may run HEAD verifier and HEAD bootstrap.
• Keep blocked until HEAD reverts: leave the PR blocked; Autopilot must not push, must not run HEAD bootstrap, and must not run HEAD verifier.

Implementation identity (paths and blob SHAs):
package-lock.json@31c34b5b2188de7a2200126c99cff3c678f43dbf..f96907ab5cdf0884985126f1da1d80a6c32fcc11;package.json@62cdcd5eaa10ecbea72208ace9e6ea8abbc519b3..277044cdf2d58a570c00a687eca19c0b6de110c6

Guarded hits:

• package-lock.json (base blob 31c34b5b2188de7a2200126c99cff3c678f43dbf, head blob f96907ab5cdf0884985126f1da1d80a6c32fcc11)
• package.json (base blob 62cdcd5eaa10ecbea72208ace9e6ea8abbc519b3, head blob 277044cdf2d58a570c00a687eca19c0b6de110c6)
  Release Simulator Broker 0.1.0-alpha.4 #34

Autopilot's assessment:
The active PR changes a guarded verifier or bootstrap implementation file.
Autopilot will not run HEAD verifier code or HEAD bootstrap until this exact implementation identity is authorized.
Keep-blocked does not run old product source; it refuses HEAD verifier/bootstrap and does not push.

Concrete operator choices:

• Authorize this contract change: accept HEAD implementation, then Autopilot may run HEAD verifier and HEAD bootstrap.
• Keep blocked until HEAD reverts: leave the PR blocked; Autopilot must not push, must not run HEAD bootstrap, and must not run HEAD verifier.

Implementation identity (paths and blob SHAs):
package-lock.json@31c34b5b2188de7a2200126c99cff3c678f43dbf..f96907ab5cdf0884985126f1da1d80a6c32fcc11;package.json@62cdcd5eaa10ecbea72208ace9e6ea8abbc519b3..277044cdf2d58a570c00a687eca19c0b6de110c6

Guarded hits:

• package-lock.json (base blob 31c34b5b2188de7a2200126c99cff3c678f43dbf, head blob f96907ab5cdf0884985126f1da1d80a6c32fcc11)
• package.json (base blob 62cdcd5eaa10ecbea72208ace9e6ea8abbc519b3, head blob 277044cdf2d58a570c00a687eca19c0b6de110c6)

Autopilot recommends:
Authorize this verifier implementation change — Autopilot will accept this exact HEAD verifier/bootstrap implementation identity, then may run HEAD verifier and HEAD bootstrap.

Choose what Autopilot should do next:

1. authorize-contract-change — Autopilot will accept this exact HEAD verifier/bootstrap implementation identity, then may run HEAD verifier and HEAD bootstrap.
2. keep-blocked-until-head-reverts — Autopilot will leave the PR blocked until HEAD reverts the guarded implementation. It will not push, will not run HEAD bootstrap, and will not run HEAD verifier.

Reply with exactly one:
Autopilot decision AD-20260831-001: choose authorize-contract-change
Autopilot decision AD-20260831-001: choose keep-blocked-until-head-reverts

Local artifact: job 20260831-153651-569827c8-5b52-4780-8acb-03a31d138e63/report.md

[fiveonecode-autopilot]

Autopilot recorded decision AD-20260831-001: selected authorize-contract-change.

Operator: @VladimirBrejcha

[fiveonecode-autopilot]

Reviewed top-level PR feedback and left the current code unchanged.

These items were posted as PR review bodies or conversation comments rather than unresolved review threads, so this acknowledgement is recorded on the PR timeline.

• Source: Release Simulator Broker 0.1.0-alpha.4 #34 (comment)
  This comment is Codex's review-status dashboard for HEAD 04c12f3. It reports that Code Review completed when the PR opened and lists no findings, defects, or requested changes. A completed no-findings Codex review does not require a repository change.