FyAgent v0.4.2

FyAgent v0.4.2

Important

FyAgent remains under active development. Back up important configuration
before upgrading, and review the trust and verification boundaries below
before installing.

The v0.4.2 publication contract requires exactly seven non-empty attachments:
three installers, three release-evidence JSON files, and one Sigstore bundle.
The workflow verifies that exact set before publication. This document does
not by itself claim that an independent post-publication re-download review
has been completed.

Warning

Do not infer Windows installer signing from the Release title or file name.
The formal workflow appends an evidence-backed signing table to the end of
these notes from the published signing-status.json.

If an installer row reports NotSigned, expect Windows SmartScreen to warn
and do not treat the file as Authenticode-signed. If it reports a verified
signature, confirm the publisher and timestamp status in the appended table,
then inspect signing-status.json for the signer- and timestamp-certificate
evidence. Verify the SHA-256 digest, source SHA, and attestation as well. Do
not disable SmartScreen or weaken organization-managed security policy.

Highlights

• macOS Developer ID and one notarization: GitHub Actions signs the
  universal app with Developer ID Application: William Wang (HY446996QX),
  then notarizes only the signed DMG. The helper submits without --wait and
  polls notarytool info until Apple accepts or rejects that one submission,
  then staples the DMG and the app from the same ticket. The published macOS
  installer is a DMG with an Applications symlink; there is no ZIP. This avoids
  two serial Apple notarization waits and does not
  treat notarytool wait --timeout exit 124 as rejection.
• V2 setup UX: Skill and MCP actions stay on the header row. Opening the
  app lands on the Agent directory. Agent details show product intros without
  naming FyAgent. Qoder copy no longer mentions Hooks. Models warn on
  explicit Claude /v1 paths and probe draft service URLs before save.
• Installer and CI: Codex Desktop skips extra package-hash rereads. Formal
  sourceSha is the tag target commit, not live main HEAD. CI/Release cache
  ~/.cargo/registry and ~/.cargo/git from Cargo.lock.
• V2 desktop shell and catalogs from 0.4.0 remain the shipped product:
  Agent directory, Models, Skills, MCP, Prompts, and Memory.
• Shipped platforms: formal installers are Windows (x64 and ARM64 NSIS)
  and macOS Universal DMG. Current-host development checks are not a
  substitute for those installers.

Download and trust guidance

Windows

Choose the setup executable matching the machine architecture:

FyAgent-0.4.2-Windows-x64-setup.exe
FyAgent-0.4.2-Windows-arm64-setup.exe

Read the Windows installer signing status table appended to these notes and
verify the matching signing-status.json, SHA-256 digest, source SHA, and
attestation before installing.

macOS

Choose FyAgent-0.4.2-macOS.dmg. Open it, then drag FyAgent.app on the
left onto Applications on the right in the same window.

FyAgent-0.4.2-macOS.dmg

The universal app is signed with an Apple Developer ID and notarized by Apple.
The DMG container is signed, notarized, and stapled. Before opening it, verify
the exact Release's SHA-256, source SHA, and attestation. If Gatekeeper still
blocks the first launch, use System Settings → Privacy & Security → Open
Anyway only after checking the Release evidence. Do not disable Gatekeeper or
remove quarantine metadata.

Exact Release attachment contract

The formal Release must contain exactly these three installer assets:

FyAgent-0.4.2-macOS.dmg
FyAgent-0.4.2-Windows-x64-setup.exe
FyAgent-0.4.2-Windows-arm64-setup.exe

It must also contain exactly these four evidence attachments:

download-manifest.json
build-metadata.json
signing-status.json
artifact-attestation.sigstore.json

That is seven attachments total. The attestation has six subjects: the three
installers plus download-manifest.json, build-metadata.json, and
signing-status.json. The copied Sigstore bundle is the seventh attachment and
does not attest itself. A missing, duplicate, renamed, empty, stale, or extra
attachment blocks publication.

Compatibility and upgrade notes

• The database schema version is 19. Existing FyAgent databases migrate forward
  on first launch. Back up ~/.fyagent before upgrading.
• Existing provider, settings, Skills, backup, fyagent://v1/import, and
  third-party /v1 contracts remain owned by their current implementation.
• Installers from earlier 0.3.x and 0.4.0 Releases for operating systems
  outside this shipped pair are not part of this version and are not a
  supported upgrade path.
• The known v0.3.0 MSI product is still removed synchronously before the NSIS
  payload is written; unexpected migration results abort instead of continuing
  with a partially replaced installation.

See the
installation guide
for platform-specific installation steps.

Known verification and security boundaries

• No Windows HIL was run for this delivery. Available evidence covers
  executable contracts, portable tests, Windows-target compilation, native
  x64/ARM64 build and packaging, signing or unsigned proof, exact-asset
  verification, and review. It does not prove setup/uninstall behavior,
  Explorer/UAC token handling, WebView2 user-data paths, Windows registry
  behavior, PackageManager file-URI behavior, effective ACL enforcement or
  mutation denial, terminal cleanup, or orphan recovery on a real Windows
  10/11 x64 or ARM64 machine.
• The current-user helper is not a protected process. Code already running as
  the same Shell user can attempt memory, handle, or process manipulation within
  that user's existing PackageManager authority.
• The NSIS process lookup is a point-in-time safety check, not an atomic
  interlock against a new process launch immediately before filesystem
  mutation. Setup never force-terminates FyAgent or its helper.
• A NotSigned Windows result can trigger SmartScreen warnings. SHA-256,
  source-SHA binding, and attestation are not a substitute for Authenticode
  publisher trust.
• macOS Developer ID signing and Apple notarization are produced by the
  Release workflow. Local checks do not prove that a published artifact is
  signed or notarized.
• This Release does not claim independent post-publication re-download
  verification, administrator-enforced repository rulesets, or a separate Main
  Provenance attestation.

Version provenance

The annotated v0.3.0 through v0.4.1 tags remain at their original commits
and are not moved, deleted, or reused. The v0.4.1 Release run failed after a
serial app-then-DMG notarization wait and did not publish. FyAgent v0.4.2 is a
stable tag whose target commit is the frozen formal source. Exact-source push
CI is not a publication gate. If that formal run fails before a GitHub Release
exists, operators may force-update unpublished v0.4.2 onto a later SHA
instead of bumping the Cargo version. The workflow itself never moves or
deletes the tag.

Source and licensing

FyAgent-owned components and modifications remain under the repository's
published PolyForm Noncommercial terms. Upstream-derived material retains its
original notices and license ancestry.

See
LICENSE,
LICENSING.md,
and
THIRD_PARTY_NOTICES.md.

Windows installer signing status

Mode: unsigned; source: d8ab2a2228389fe41ff5c815ddccb3b5823bcaab. The installer rows below are backed by the published signing-status.json and artifact-attestation.sigstore.json evidence.

Architecture	Installer	Authenticode	Publisher	Timestamp	SHA-256	Source SHA	Attestation
x64	FyAgent-0.4.2-Windows-x64-setup.exe	NotSigned	Not signed	None	551b1eca82a4d07aba2017b3448293b17caafaef80b4fe8107ad5c38dffb0c14	d8ab2a2228389fe41ff5c815ddccb3b5823bcaab	artifact-attestation.sigstore.json subject FyAgent-0.4.2-Windows-x64-setup.exe digest sha256:551b1eca82a4d07aba2017b3448293b17caafaef80b4fe8107ad5c38dffb0c14
arm64	FyAgent-0.4.2-Windows-arm64-setup.exe	NotSigned	Not signed	None	7113b5cb44aa9e27b1aff5dc64f934d7e9cd8f72069b2078c58b25b7b07f63d7	d8ab2a2228389fe41ff5c815ddccb3b5823bcaab	artifact-attestation.sigstore.json subject FyAgent-0.4.2-Windows-arm64-setup.exe digest sha256:7113b5cb44aa9e27b1aff5dc64f934d7e9cd8f72069b2078c58b25b7b07f63d7