20.0.1

Reusable compute-only 4D component, namespace cs.hash. Stable API: cs.hash.hash.new().sha256(file; {timeout: 300}). Use hash.zip for 4D dependencies.json or install its entire hash.4dbase folder under Components; do not install hash.4DZ alone.

Source: c0fc530. hash.zip SHA-256: 7fe55bf2f552e7c6441cff5079bad5c9f2513cf694563d8b2c4f76ba8a7d71d5.

Developer ID Application signatures (team Y69CWUC25B), secure timestamps and hardened runtime cover the actual compiled 4D library and both universal CLI slices. Both component and standalone ZIPs separately received Apple notarization Accepted results; downloaded ticketContents match all payload CDHashes. Both DMGs are separately signed, notarized, stapled, validated and Gatekeeper-assessed. Raw CLI/ZIP stapling is unsupported; ZIP delivery uses online ticket lookup. Raw non-app CLI spctl execute assessment is not an app assessment; strict notarized-code verification passes.

Validation: exact-source native CLI execution on macOS Intel/ARM and Windows x64/ARM (including x64-emulated Windows ARM selector), diagnostic-free actual 4D 20.8 component/host compilation, installed execution before and after signing/final ZIP extraction, signed CLI native ARM/Rosetta smoke. Evidence: https://github.com/miyako/hash/actions/runs/41659485571 plus attached provenance, native receipts, signed runtime report and notarization logs. SHA256SUMS describes final post-signing/stapling bytes; pre-sign provenance is separate.

Compatibility: declared 4D 20.7 LTS; exact 20.7 runtime unavailable and untested. Real 4D runtime exercised on macOS ARM with 20.8; Windows 4D execution is not claimed. macOS helper minimum 12.0, runtime tested on macOS 15 CI; Windows ARM requires Windows 11 with x64 emulation. No model/cache/provider/event dependencies.