Patchwright 0.2.0 community prerelease 2

Patchwright 0.2.0 community prerelease 2

Community evaluation build from exact main commit 1e30ff0679ec7adc6cb2d65c306ea1ddeaf1f1b5 (after OSS surface hardening in #22).

This is not an Apple Developer ID-signed or notarized release. Gatekeeper may block the app. Prefer building from source if you need a locally trusted copy. Official notarized downloads remain a separate release lane.

Contents

• Patchwright-0.2.0-community.2-macos-arm64.zip — ad-hoc signed macOS arm64 app archive
• SHA-256 sidecar, SBOM (SPDX), third-party notices, LICENSE, NOTICE, and release manifest

Verify

shasum -a 256 -c Patchwright-0.2.0-community.2-macos-arm64.zip.sha256

Expected archive SHA-256:
583646ab546f4b445f1061c9f95696cde21fd996da959115c453ed547a951de8

Maintained by RSI Tech. Contact: info@rsitech.ai.

Patchwright 0.2.0 community prerelease 1

Patchwright 0.2.0 community prerelease 1

Patchwright 0.2.0 moves the public project to the RSI Tech GitHub organization
and packages the latest source-ready app for community evaluation.

Highlights

• Revalidates exact approved commit identities immediately before supported
  pull-request mutations.
• Bounds GitHub snapshot fan-out and Codex protocol resources.
• Matches Codex responses and completion events to the active request, thread,
  and turn, and redacts credential-shaped durable content.
• Makes unsandboxed repository verification authority explicit immediately
  before execution.
• Uses rsitech-ai/patchwright as the canonical source and release location.

Download integrity

The release assets include:

• Patchwright-0.2.0-community.1-macos-arm64.zip
• Patchwright-0.2.0-community.1-macos-arm64.zip.sha256
• Patchwright-0.2.0-community.1-manifest.json
• Patchwright-0.2.0-community.1-sbom.spdx.json
• Patchwright-0.2.0-community.1-third-party-notices.md
• Patchwright-0.2.0-community.1-LICENSE.txt
• Patchwright-0.2.0-community.1-NOTICE.txt

Download the assets into the same directory and run:

shasum -a 256 -c Patchwright-0.2.0-community.1-macos-arm64.zip.sha256

The manifest binds the archive, source archive, SBOM, third-party notices,
Apache project license, project notice, and assembly evidence to the exact Git
commit. It also records the bundle version, build, architecture, signing class,
and notarization status.

Trust boundary

This community prerelease is ad-hoc signed and is not Developer ID signed or
Apple notarized. Gatekeeper may block it. Do not disable Gatekeeper or remove
quarantine metadata to bypass that decision; build the tagged source locally if
you require a locally trusted copy. This ZIP is not served through the signed
Sparkle update feed.

Compatibility

• Requires macOS 26 or newer on Apple silicon.
• GitHub CLI and Codex are optional, separately installed integrations.
• Repository-controlled verification commands are not OS-sandboxed and run as
  the current macOS user after an explicit warning and confirmation.
• This beta provides best-effort support without a service-level agreement.

Patchwright v0.1.0

Patchwright v0.1.0

Patchwright is a local-first, macOS-native engineering control plane for auditable GitHub and coding-agent workflows. This is the first public release.

Requirements

• Apple-silicon Mac
• macOS 26 or newer
• Git
• Optional: GitHub CLI for read-only GitHub sync
• Optional: Codex CLI for coding-agent sessions

Highlights

• Native SwiftUI task and review client
• Durable Rust engine with SQLite recovery and Unix-socket JSON-RPC
• Read-only GitHub workspace ingestion
• Exact-preview, short-lived approval, and exact-head-SHA controls for GitHub mutations
• Global mutation kill switch that preserves read-only inspection
• Signed Sparkle update metadata

Distribution integrity

The DMG and app are signed with Apple Developer ID, use Hardened Runtime, are notarized by Apple, and have stapled notarization tickets. The exact release passed Gatekeeper, installation, first-launch, and relaunch checks on a clean macOS 26.5 arm64 virtual machine.

DMG SHA-256:

4706e7b64a16a148061a47d9cdbc894e91018d9cabf5e45d8be5e00e0af145c7

The release includes a checksum, signed appcast, SPDX 2.3 SBOM, third-party notices, and digest-bound release evidence.

Open source

The complete source is public in this repository and is dual-licensed under MIT or Apache License 2.0. No publisher GitHub App key, Apple signing key, Codex credential, or user credential is bundled in the app or source.