FyAgent v0.4.3

FyAgent v0.4.3

FyAgent v0.4.3 strengthens the desktop Agent control plane. This release
focuses on safer configuration transactions, clearer install/update ownership,
and the native foundations required for managed Windows and macOS desktop
software lifecycles.

Highlights

• Safer configuration changes. SecretRef-backed boundaries and typed
  change plans keep sensitive values out of renderer-visible payloads while
  preserving validation, rollback, and readback semantics for provider and
  WorkBuddy changes.
• Desktop-first Agent lifecycle. Supported Agent software now follows the
  desktop application lifecycle by default. Grok Build remains the single
  CLI-managed Agent because it has no desktop application surface.
• Windows managed lifecycle groundwork. The closed Windows user helper now
  covers formal Grok Build install/update operations and the Agent inventory
  and readiness paths have stricter platform-owned state handling.
• macOS privileged-helper groundwork. FyAgent now packages the nested
  privileged helper/client architecture used for known /Applications
  targets and integrates it with the signed release build. Production
  system-scope commits remain fail-closed until the dedicated signed/notarized
  HIL gate is satisfied.
• Quieter Codex usage synchronization. Expected deferred usage-sync states
  no longer repeat noisy diagnostics during normal operation.
• Better cross-platform development diagnostics. macOS developers can run
  the explicit Windows-MSVC cross check to identify missing MSVC SDK/toolchain
  prerequisites without turning those optional prerequisites into a normal
  bootstrap failure.

Release artifacts

The formal v0.4.3 workflow publishes exactly seven non-empty attachments after
native build, verification, signing/notarization where configured, and
attestation succeed:

FyAgent-0.4.3-macOS.dmg
FyAgent-0.4.3-Windows-x64-setup.exe
FyAgent-0.4.3-Windows-arm64-setup.exe
download-manifest.json
build-metadata.json
signing-status.json
artifact-attestation.sigstore.json

Windows installers are produced natively for x64 and ARM64. The macOS release
is a universal DMG. The release workflow verifies the exact version, source
commit, installer inventory, platform metadata, and publication transaction
before making the GitHub Release public.

Upgrade notes

• Existing user data and configuration remain in place when upgrading.
• Agent install/update availability continues to depend on the product,
  platform, detected installation state, and the relevant native safety gate.
• macOS /Applications privileged commits must not be interpreted as generally
  enabled merely because the helper is packaged; the production gate remains
  intentionally closed until dedicated HIL evidence exists.

For implementation-level changes, see the 0.4.3 section in
CHANGELOG.md.

Windows installer signing status

Mode: unsigned; source: 13f7c5407bf2cc1911f6def612875e5c686043c7. The installer rows below are backed by the published signing-status.json and artifact-attestation.sigstore.json evidence.

Architecture	Installer	Authenticode	Publisher	Timestamp	SHA-256	Source SHA	Attestation
x64	FyAgent-0.4.3-Windows-x64-setup.exe	NotSigned	Not signed	None	a42ef57c520a40b8fa9919f386cf1b0fb6cdfd33fbd6db86ecd2ff39926e2178	13f7c5407bf2cc1911f6def612875e5c686043c7	artifact-attestation.sigstore.json subject FyAgent-0.4.3-Windows-x64-setup.exe digest sha256:a42ef57c520a40b8fa9919f386cf1b0fb6cdfd33fbd6db86ecd2ff39926e2178
arm64	FyAgent-0.4.3-Windows-arm64-setup.exe	NotSigned	Not signed	None	014e3d13a8cb547d4b3523dbdfd34f4353f4021b673a0a4f837b4aaf5a912967	13f7c5407bf2cc1911f6def612875e5c686043c7	artifact-attestation.sigstore.json subject FyAgent-0.4.3-Windows-arm64-setup.exe digest sha256:014e3d13a8cb547d4b3523dbdfd34f4353f4021b673a0a4f837b4aaf5a912967