v2.1.4

Retro Web UI v2.1.4

v2.1.4 is a backward-compatible release-integrity patch over v2.1.3.
It does not add a product feature, theme, framework claim, or
semantic-conversion behavior.

The public GitHub-enforced immutable v2.1.3 Release remains unchanged. Its
actual verified provenance correctly binds tag object
a5730ea775455db2f004a31c9db626c642f12510 and all 15 public assets. The
independent post-publication saturation review nevertheless found that the
local certification policy checked the tag string and asset digests without
explicitly requiring the release package subject's annotated-tag-object
SHA-1. Because an immutable Release cannot be repaired in place, this release
closes that generalized fail-closed gap in a new patch version.

Immutable publication gates

• A protected, manually approved pre-tag workflow uses a dedicated
  Administration-read credential to require the literal repository setting
  enabled: true, an unused version tag and Release, and the exact main
  commit.
• The annotated tag records the successful preflight run ID. The tag-triggered
  workflow resolves the authoritative remote annotated tag and that exact run,
  checks their identities and commit binding, and downloads the protected
  preflight evidence without forwarding repository credentials to signed
  artifact storage.
• Publication creates one draft Release through a create-only API path, retains
  its exact Release ID, uploads only the manifest-bound asset set, and verifies
  that same draft before making it public.
• Final certification requires the literal GitHub Release API boolean
  immutable: true, complete public re-downloads and SHA-256 matches, and
  verified Sigstore/DSSE statements containing exactly one
  pkg:github/ririri-rgb/retro-web-ui@v2.1.4 subject whose SHA-1 is the
  authoritative annotated tag object, plus every expected asset digest.
• Third-party GitHub Actions used by CI, native builds, preflight, and release
  publication are pinned by commit.

Distribution and compatibility

The release retains the v2.1.0 desktop workspace, Core, CLI, Skill,
framework, browser, privacy, and containment behavior. Assets include native
archives for macOS arm64, Windows x86_64, and Linux x86_64, plus the standalone
Skill ZIP, Python wheel, source distribution, SHA-256 sidecars, and
per-platform native reports. The tagged workflow rebuilds and exercises the
complete release set.

The macOS archive is ad-hoc signed, not Developer ID signed or notarized. The
Windows archive is unsigned and not Authenticode signed. Hosted native checks
use offscreen display environments and do not replace physical-device UX
evaluation. Codex remains an external prerequisite and is not bundled.

Install

Install and sign in to a compatible Codex first, then download the native
archive for your operating system and verify its adjacent SHA-256 file.

Install the matching Skill for standalone Codex use:

$skill-installer install https://github.com/ririri-rgb/retro-web-ui/tree/v2.1.4/skills/retro-web-ui

CLI-only users can install retro_web_ui_skill-2.1.4-py3-none-any.whl without
installing Qt. The historical v2.1.0 and immutable v2.1.3 Releases remain
unchanged.

v2.1.3

Retro Web UI v2.1.3

v2.1.3 is a backward-compatible release-engineering and
publication-integrity hardening release over v2.1.0. It does not add a
product feature, theme, framework claim, or semantic-conversion behavior.

The protected annotated v2.1.1 and v2.1.2 tags are retained as unpublished
failed candidates. Neither has a GitHub Release. The v2.1.1 workflow exposed
the runner-local peeled-tag identity issue corrected in v2.1.2. The
v2.1.2 workflow then passed metadata and stopped in immutable preflight before
native builds or publication when Python forwarded the repository bearer token
from the GitHub API to the cross-host signed artifact URL. This release strips
credentials on cross-host redirects, retains them on same-host redirects, and
rejects non-HTTPS destinations.

Immutable publication gates

• A protected, manually approved pre-tag workflow uses a dedicated
  Administration-read credential to require the literal repository setting
  enabled: true, an unused version tag and Release, and the exact main
  commit.
• The annotated tag records the successful preflight run ID. The tag-triggered
  workflow resolves the authoritative remote annotated tag and that exact run,
  checks their identities and commit binding, and downloads the protected
  preflight evidence without forwarding repository credentials to signed
  artifact storage.
• Publication creates one draft Release through a create-only API path, retains
  its exact Release ID, uploads only the manifest-bound asset set, and verifies
  that same draft before making it public.
• Final certification requires the literal GitHub Release API boolean
  immutable: true, complete public re-downloads and SHA-256 matches, and
  Sigstore/DSSE provenance covering the exact tag and every expected asset
  digest.
• Third-party GitHub Actions used by CI, native builds, preflight, and release
  publication are pinned by commit.

Distribution and compatibility

The release retains the v2.1.0 desktop workspace, Core, CLI, Skill, framework,
browser, privacy, and containment behavior. Assets include native archives for
macOS arm64, Windows x86_64, and Linux x86_64, plus the standalone Skill ZIP,
Python wheel, source distribution, SHA-256 sidecars, and per-platform native
reports. The tagged workflow rebuilds and exercises the complete release set.

The macOS archive is ad-hoc signed, not Developer ID signed or notarized. The
Windows archive is unsigned and not Authenticode signed. Hosted native checks
use offscreen display environments and do not replace physical-device UX
evaluation. Codex remains an external prerequisite and is not bundled.

Install

Install and sign in to a compatible Codex first, then download the native
archive for your operating system and verify its adjacent SHA-256 file.

Install the matching Skill for standalone Codex use:

$skill-installer install https://github.com/ririri-rgb/retro-web-ui/tree/v2.1.3/skills/retro-web-ui

CLI-only users can install retro_web_ui_skill-2.1.3-py3-none-any.whl without
installing Qt. The historical v2.1.0 Release remains unchanged.

v2.1.0

Retro Web UI v2.1.0

v2.1.0 adds a durable local workspace to the Retro Web UI desktop
application. Projects and conversion sessions now survive application restarts
without copying the selected source tree or changing the existing Core, CLI, or
Skill conversion contracts.

Persistent workspace

• Register canonical projects and keep independent conversion-session history.
• Restore project/session history after restart and classify interrupted remote
  work honestly instead of presenting it as complete.
• Preserve bounded behavior, Core, Git, assessment, screenshot, and artifact
  evidence with integrity metadata for later review and comparison.
• Recover a recorded Codex thread explicitly when the external App Server still
  has it; recovery is review-oriented and never rolls source back or silently
  resumes a turn.
• Continue conversion without history when local application-data storage is
  unavailable.

Containment and privacy

Workspace records use versioned, atomic persistence with bounded retention.
Project, session, and artifact paths are revalidated at every storage boundary;
traversal, symlinks, and Windows reparse-point escapes fail closed. Persisted
text excludes raw patches and redacts authorization values, tokens, login URLs,
device codes, and related credential-shaped data. Retro Web UI does not request
or persist an OpenAI API key, and Codex remains an external prerequisite rather
than part of the archives.

Distribution

Release assets include native archives for macOS arm64, Windows x86_64, and
Linux x86_64, plus the standalone Skill ZIP, Python wheel, source distribution,
SHA-256 files, and per-platform native reports. The tagged release rebuilds and
extracts each native archive, checks startup/version/Core/manifest/Skill/App
Server availability, runs an isolated create/restart/restore/artifact/privacy
lifecycle, and gates publication on the existing CLI/Core/Skill/framework and
browser regression suite.

The macOS archive is ad-hoc signed, not Developer ID signed or notarized. The
Windows archive is unsigned and not Authenticode signed. Hosted native checks
use offscreen display environments and are not evidence of physical Windows or
Linux desktop UX. Verify the matching SHA-256 file before opening an archive.

Install

Install and sign in to a compatible Codex first, then download the native
archive for your operating system. Python and Qt are included; Codex is not.

Install the versioned Skill for standalone Codex use:

$skill-installer install https://github.com/ririri-rgb/retro-web-ui/tree/v2.1.0/skills/retro-web-ui

CLI-only users can install retro_web_ui_skill-2.1.0-py3-none-any.whl without
installing Qt. Detailed Phase C scope, failure-driven corrections, provenance,
and evidence boundaries are in the tagged
workspace validation report.

v2.0.1

Retro Web UI v2.0.1

v2.0.1 is a backward-compatible distribution, safety, and result-classification
hardening release over the
public v2.0.0 desktop release. It does not add themes, framework support, or a
new semantic conversion engine.

User-visible fixes

• Codex readiness is checked automatically on first launch with actionable,
  redacted missing-launcher and App Server diagnostics.
• Desktop launches discover Codex from bounded platform locations, including
  the installed ChatGPT application on macOS and npm's user shim on Windows.
  Relative, current-directory, and selected-project launchers are rejected.
• App Server turns use a stable structured result schema. Missing runtime,
  browser, visual, accessibility, or target checks remain visible as review
  items and can no longer be hidden by a deterministic Complete result.
• Streaming token fragments no longer flood the event list; authoritative
  completed messages and bounded command/item history are shown instead.
• Frozen Core diagnostics distinguish a bundled Python runtime library from a
  runnable interpreter, and the conversion receives a precomputed canonical
  theme bundle without depending on a system Python installation.
• Every native archive contains an exact portable INSTALL.md.

Distribution gates

• Windows and Linux now join macOS in re-extracting and executing the final
  archive rather than only exercising the pre-archive build tree.
• Archive paths, roots, launchers, Windows case collisions, links/special files,
  notices, version output, smoke JSON, and checksums are validated.
• macOS has a stable bundle identifier plus aligned short/build versions before
  final ad-hoc signing and strict post-extraction verification.
• Linux builds on Ubuntu 22.04, records GNU ABI requirements, and rejects a
  required GLIBC newer than 2.35.

Compatibility and security

The application continues to use the user's own Codex and ChatGPT sign-in. It
does not request or persist an OpenAI API key, and Codex is not bundled in the
native archives. The selected frontend application remains the only agent write
root. Existing Git changes are never reverted automatically, and command/file/
permission requests retain explicit scope, risk, and default-Deny review.

The macOS arm64 package has a strictly verified ad-hoc signature but is not
Developer ID signed or notarized. The Windows x86_64 package is unsigned. The
Linux x86_64 package requires compatible desktop/EGL and libstdc++ components.
Verify the adjacent SHA-256 manifest before opening an archive.

Install

Install and sign in to a compatible Codex first, then download the native
archive for your operating system from this release. Python and Qt are bundled;
Codex remains external.

Install the matching Skill for standalone Codex use:

$skill-installer install https://github.com/ririri-rgb/retro-web-ui/tree/v2.0.1/skills/retro-web-ui

CLI-only users can install retro_web_ui_skill-2.0.1-py3-none-any.whl from the
release without installing Qt.

Validation

The tagged release rebuilds and re-extracts the final native archives on
macOS, Windows, and Ubuntu 22.04, runs the full CLI/Core/Skill/GUI suite, checks
all four themes, builds the framework fixtures, runs browser interaction/render
smokes, reproduces the wheel/sdist and Skill packages, audits production
dependencies, reconciles licenses and component inventories, and verifies every
published checksum before release creation.

See the tagged desktop distribution and clean-install guide
for verified support boundaries and uninstall/troubleshooting instructions.
The distribution hardening validation report
records the public-baseline replay, real installed App Server conversion,
independent browser verification, exact candidate evidence, and known limits.

v2.0.0

Retro Web UI v2.0.0

v2.0.0 adds the first public Retro Web UI desktop application. It is a
Windows XP-style orchestration layer over the existing deterministic Core/CLI,
the Retro Web UI Skill, and the user's local Codex App Server session. It does
not introduce a separate semantic-conversion engine or ask for an OpenAI API
key.

Desktop workflow

The GUI lets users select a project and, when analysis finds multiple frontend
applications, choose the exact application. It exposes all four themes,
captures the behavior baseline, streams Codex planning and edits, presents
command/file/permission approvals with scope and risk, supports interrupt and
reconnect, and finishes with behavior comparison, audit, target verification,
Git diff, result classification, and Before/After evidence.

Codex integration uses local stdio JSONL and the current App Server lifecycle:
availability and version discovery, initialize, account/config/model reads,
thread/turn creation, streamed item events, correlated approval responses,
interruption, durable thread resume, and shutdown. Authentication remains owned
by the installed Codex CLI and the user's ChatGPT sign-in. Credentials, device
codes, login URLs, and account identifiers are neither requested nor persisted
by Retro Web UI.

Safety and compatibility

• Core/CLI remains canonical for framework and monorepo detection, behavior
  artifacts, theme bundling, audit, verification, manifest compatibility, and
  shared contracts.
• The selected application is canonicalized as the only agent write root;
  symlink traversal and outside-root selection are rejected.
• Dirty Git state and modified files remain visible. Existing unrelated changes
  are never reverted automatically.
• Target commands require an explicit approval showing argv, working directory,
  reason, and risk. Development/watch servers are not inferred as finite
  verification.
• Complete, review-required, verification-failed, behavior-incompatible,
  interrupted, authentication-required, and unsupported states stay distinct.

The existing v1.1.0 Skill/CLI layouts and legacy helpers remain available. The
version increase reflects the new user-facing desktop product and App Server
contract, not a claim of universal framework support. Behavior hashes and
static audit remain review guardrails rather than proof of semantic equivalence.

Native packages

Release assets include:

• macOS arm64 application ZIP (strictly verified ad-hoc signature; not notarized)
• Windows x86_64 application ZIP (unsigned; not Authenticode signed)
• Linux x86_64 tarball (requires a normal desktop display stack, glibc,
  libstdc++, and libEGL)
• standalone Skill ZIP, Python wheel, and source distribution
• SHA-256 files and per-platform native build reports

Python and Qt are bundled in native packages; Codex is deliberately not
bundled. Install and sign in to a compatible Codex CLI first. Native archives
include project and third-party notices, GPLv3/LGPLv3 texts, corresponding Qt
source locations, and a machine-readable component inventory. There is no
auto-updater in this release.

Evidence

The final candidate is gated by Python 3.9 minimum support, three-OS CLI and GUI
tests, reproducible wheel/sdist and Skill packaging, four-theme validation,
framework fixture builds, browser interaction/render smokes, native compilation
and startup on Windows/macOS/Linux, local macOS native App Server startup, fake
failure streams, and two real App Server/Skill conversions including pinned
TodoMVC examples/javascript-es6.

The TodoMVC conversion retained its generated JavaScript hash, behavior signals,
hash route, and browser console cleanliness; an upstream baseline todo-entry
failure is explicitly excluded from the conversion pass. Detailed scope,
failure classification, package sizes, and limitations are in the
desktop GUI engineering report.

The locked SvelteKit fixture still carries one low-severity development-only
cookie@0.6.0 advisory. npm audit --omit=dev reports zero production
vulnerabilities, and the fixture dependency is absent from every release asset.

Install

Install Codex and sign in with ChatGPT, then download the native archive for
your operating system from this release. Extract it and run Retro Web UI GUI.
Unsigned/ad-hoc packages may require the operating system's explicit local-app
approval. Do not bypass warnings for an archive whose SHA-256 does not match the
published checksum.

Install the versioned Skill for Codex discovery:

$skill-installer install https://github.com/ririri-rgb/retro-web-ui/tree/v2.0.0/skills/retro-web-ui

CLI-only users can install the wheel without Qt:

python3 -m venv .venv
.venv/bin/python -m pip install retro_web_ui_skill-2.0.0-py3-none-any.whl
.venv/bin/retro-web-ui info --json

On Windows use .venv\Scripts\python and
.venv\Scripts\retro-web-ui. Installing the CLI wheel does not copy the Skill
into Codex's Skill directory.

v1.1.0

Retro Web UI v1.1.0

v1.1.0 adds an installable deterministic CLI around the proven v1.0.0 Skill helpers. The CLI supplies repeatable project evidence, explicit behavior artifacts, theme assets, diagnostics, and verification results; Codex still owns semantic conversion, application-specific repair, runtime interpretation, accessibility review, and visual judgment.

Included

• retro-web-ui Python CLI with info, analyze, doctor, behavior snapshot/compare, theme list/bundle, audit, and read-only verify commands.
• One versioned JSON envelope, stable diagnostic codes, and documented exit semantics for agent and CI use.
• A shared Python facade used by the CLI while retaining the standalone Skill layout and the v1.0.0 helper entry points.
• A machine-readable Skill manifest that checks CLI API compatibility, behavior snapshot schema/algorithm, and all four deterministic theme bundle digests.
• Monorepo-aware frontend selection and npm, pnpm, yarn, and Bun metadata detection without installing dependencies or executing target scripts.
• Reproducible Skill ZIP, wheel, and source distribution with clean-install and cross-platform CI gates.

Validation boundary

The existing four themes and v1.0.0 semantic/runtime evidence remain the regression baseline. The CLI workflow was exercised across static HTML, React/Vite, React/MUI/Emotion, Vue/Bootstrap, SvelteKit, Next App Router, and the pinned TodoMVC repository. This does not expand those bounded cases into a claim of universal framework or component-library support.

Static analysis and behavior-signal comparison are guardrails, not proof of semantic equivalence. The CLI deliberately has no universal convert command and never runs inferred package scripts. Vue and Next fixtures retain intentional static review findings that are resolved through their passing runtime evidence rather than hidden by suppressions.

The CLI and Skill artifacts have no third-party runtime dependencies. The repository's SvelteKit validation harness has one known low-severity development-only advisory (GHSA-pxg6-pf52-xh8x via cookie@0.6.0); npm offers only a breaking framework downgrade, and that dependency is not shipped in release artifacts.

See the CLI + Skill validation report, CLI boundary, and Compatibility evidence.

Install

Install the Skill:

$skill-installer install https://github.com/ririri-rgb/retro-web-ui/tree/v1.1.0/skills/retro-web-ui

Install the CLI release wheel in an isolated environment:

python3 -m venv .venv
.venv/bin/python -m pip install retro_web_ui_skill-1.1.0-py3-none-any.whl
.venv/bin/retro-web-ui info --json

On Windows, use .venv\Scripts\python and .venv\Scripts\retro-web-ui. Installing the CLI does not copy the Skill into Codex's Skill directory.

Release assets include the standalone Skill ZIP, Python wheel, source distribution, and SHA-256 files.

v1.0.0

Retro Web UI v1.0.0

v1.0.0 is the first stable release of the behavior-preserving Retro Web UI Codex Skill. It keeps the four existing themes and adopts the validation boundaries documented in the repository without expanding scope.

Included

• Windows 98, Windows XP, Windows 7, and Japanese Freeware 2000s UI languages.
• Repository inspection, framework/style/rendering-model evidence, a versioned behavior-signal guard, theme bundle generation, and modern-style residue auditing.
• Semantic conversion evidence for bounded static/vanilla, React/Vite, React/MUI/Emotion, Vue/Bootstrap, SvelteKit, Next App Router/Radix/Tailwind, TodoMVC, and naive-ui-admin authentication surfaces.
• Production builds, browser interactions, SSR/hydration checks, portal/modal behavior, console/runtime capture, visual review artifacts, reproducible standalone Skill packaging, and license/security gates.

Important boundaries

This release is not a universal converter and does not claim support for every component or version in a named framework. Meaning-dependent layout changes still require Codex review and target-native tests. Nuxt, Angular, Astro, other CSS-in-JS stacks, virtualized data grids, and chart-heavy dashboards remain best-effort. Closed Shadow DOM, cross-origin iframe contents, canvas/WebGL-only UI, binary/generated UI without source, and native desktop applications remain unsupported by the safe source-editing model.

See Compatibility evidence and the Final validation report for the exact evidence boundary.

Install

$skill-installer install https://github.com/ririri-rgb/retro-web-ui/tree/v1.0.0/skills/retro-web-ui

The release assets include a reproducible standalone Skill ZIP and its SHA-256 checksum.

Retro Web UI v0.1.0

Retro Web UI v0.1.0

First public OSS release of the retro-web-ui Codex Skill. It converts existing web-app interfaces toward one of four desktop-era UI languages while treating behavior preservation as a primary constraint.

Included

• Windows 98, Windows XP, Windows 7, and Japanese Freeware 2000s theme specifications and namespaced CSS primitives.
• Semantic mapping guidance for cards, toggles, tabs, settings pages, dialogs, tables, status feedback, and related desktop controls.
• Deterministic project inspection, theme bundling, hashed behavior comparison, and modern-style residue audit helpers.
• MIT-licensed standalone Skill archive and SHA-256 checksum.

Verified evidence

• React 19 / Vite 8: semantic Japanese Freeware 2000s conversion, production build, unchanged protected signals, real click interaction, aria-pressed, label/live-status transition, and screenshot inspection.
• TodoMVC Vanilla ES6: semantic Windows 98 conversion, original/themed builds, byte-identical generated JavaScript, unchanged behavior comparison, hash-route state, and screenshot inspection.
• Static HTML / Vanilla JS: real Chrome keyboard and interaction smoke plus all four rendered themes.
• Vue 3 / Vite, SvelteKit 2 / Svelte 5, and Next.js 16 App Router: locked integration fixtures, detection/protection checks, and production builds.

Boundaries

• Vue, SvelteKit, and Next evidence is integration-level; complete runtime semantic conversion is not claimed.
• One converted React fixture is not evidence for every React app or component library.
• Behavior hashes are guardrails, not proof of semantic equivalence. Target-app builds, tests, interactions, diff review, and visual inspection remain required.
• Closed Shadow DOM, canvas/WebGL-only UI, cross-origin iframe contents, binary/generated bundles without source, and native desktop apps are safely unsupported. Portals, virtualization, CSS-in-JS, component libraries, and SSR hydration require target-specific verification.

Install

$skill-installer install https://github.com/ririri-rgb/retro-web-ui/tree/v0.1.0/skills/retro-web-ui

See the README for manual and repository-scoped installation, screenshots, validation commands, compatibility evidence, and troubleshooting.

Full Changelog: https://github.com/ririri-rgb/retro-web-ui/commits/v0.1.0