CivicCast v1.0.0-rc18 — audit-remediation controlled beta

rc18 is the audit-remediation release on top of rc17. A full stage gate against
the rc17 line returned do not advance with sixteen findings (3 Critical,
8 Major, 5 Minor); rc18 fixes all sixteen. A gate against rc18 itself then
raised twenty more, and those are fixed too. The stage-gate re-run against this
candidate returned no blocker or critical findings. Every fix merged with
required checks green and none with an admin override.

What this fixes (the ones a records clerk cares about)

• Archive provenance. The simulated Internet Archive target produced a link
  that looked like a genuine archive.org permalink for an item that was never
  created. Fixed at every layer, and the publish dashboard now says plainly when
  nothing was actually archived.
• Public contributor uploads are no longer an open surface. The public
  upload endpoint had no sign-in, size limit, or rate limit. rc18 adds a per-file
  size ceiling, per-IP upload and submission rate limits, a per-IP and aggregate
  byte budget with race-safe accounting, single-use upload references (one upload
  backs at most one submission), and a reaper that reclaims stale uploads —
  returning clear, actionable errors at every limit instead of a bare failure.
• Playback fails gracefully. Recorded playback returned a bare server error
  when durable storage was briefly unreachable; it now returns an actionable
  status, and the connect attempt is time-bounded.

First run

• The first-run screen no longer names a button that isn't there. On a
  machine without WSL set up, it told the operator twice to choose "Set up
  Windows helper" while the only button on screen read "Resume after reboot".
  The bootstrap was reporting a pending reboot for a step that deliberately
  changes nothing, and that flag suppressed the control its own message named.

Operator experience

• The operator console now speaks one consistent readiness vocabulary across
  every screen — a city clerk never has to read a raw machine enum — including
  the live pre-flight checklist and notification-delivery status, with a
  screen-reader-announced readiness headline.

Under the hood (station-IT relevant)

• All ffmpeg invocation is routed through one audited adapter (ADR 0007), now
  enforced by a CI policy check that resolves import aliases instead of matching
  text.
• A contributor-upload directory that is misconfigured or unwritable now returns
  an actionable error rather than an unhandled failure.
• Two policy gates and a large-blob / Git-LFS guard now run on every pull
  request, instead of only when an agent remembered to run them.
• Documentation: the user manual, API reference, and OpenAPI contract are current
  with the shipped behavior.

Scope — what rc18 does NOT yet prove

The controlled beta proves one bounded local workflow: create or upload recorded
media, rehearse it privately, package it privately, approve Portal publication,
and play it in the resident portal. Live 24/7 ingest, physical hardware and
headend delivery, external providers, and app-store distribution still require
separate field proof. The clean-host proof covers packaging, lifecycle and the
installer wizard; it does not cover cold-reboot recovery or first-run station
setup.

Install

• Windows: download civiccast-1.0.0-rc18-windows-setup.exe (SHA-256
  af4d2017c6287eaed8cb4b1553d539281fc14c3e3863869c0ea5b8d2e73c311b, 243,742,408 bytes) from the assets below. Verify the
  SHA-256 against the attached .sidecar.json before running. The installer is
  Authenticode-signed (CN=Scott Converse) and Sigstore-verifiable, and its
  signing certificate binds it to this tag's commit.
• rc17 remains published as the rollback target. It carries all sixteen findings
  above, so rolling back is a deliberate trade, not a safe default.

Supersedes

Three earlier rc18 builds (SHA-256 25305a6c…, 900dd6d5…, 993d4b39…) were
never published, and each carries findings this release fixes. Discard them.

CivicCast v1.0.0-rc17 public beta

CivicCast v1.0.0-rc17 public beta

rc17 is the beta-blocker salvage release on top of the published rc16 beta. It fixes the six defects rc16's clean-run gauntlet exposed — installed-CLI relocation survival, installer-owned local Ollama 0.24.0 provisioning (detect-and-reuse, hardware-selected models only), rehearsal-recording file paths (with a repair migration for rc16-shaped rows), honest provider-readiness reporting, accurate UAC/returning-Setup guidance, and release-matched docs — plus a clean-machine proof-kit verifier fix (CC-RC17-004) proven on a pristine Windows 11 VM.

Download for Windows

⬇ Download CivicCast v1.0.0-rc17 for Windows

232 MB · Windows 10/11 (64-bit) · signed installer

Verify it before you run it. In PowerShell, from the folder you downloaded to:

Get-FileHash .\civiccast-1.0.0-rc17-windows-setup.exe -Algorithm SHA256

Expect exactly this, and stop if it differs:

• SHA-256: 600eaf5210a3b773fa0e22b459a10301fa68f8ec6121c6d324126ce7f1bbb9c4
• Size: 243,693,352 bytes
• Authenticode: Valid — Signature verified, Microsoft-timestamped
• Publisher: CN=Scott Converse, O=Scott Converse, L=Longmont, S=co, C=US

Attestations and supporting files

• Sidecar - civiccast-1.0.0-rc17-windows-setup.exe.sidecar.json
• Sigstore bundle - civiccast-1.0.0-rc17-windows-setup.exe.sigstore.json
• Complete manifest - civiccast-1.0.0-rc17-release-artifacts-manifest.json
• Manifest attestation - civiccast-1.0.0-rc17-release-artifacts-manifest.json.sigstore.json
• Clean-Windows proof kit - reproduce the clean-host verification yourself
• Windows tester package - for structured beta testing
• User manual (PDF)

The exact public installer was downloaded again after publication. Its local SHA-256, the GitHub asset digest, the sidecar digest, and the complete-manifest digest all match, and the manifest's recorded source state binds to the tagged merge commit with a clean tree.

Verification completed

• Source/tag commit: c2dfdfbd52f7a6f16d30766098c68c513381ba40 (merge of PR #299).
• Six independent review rounds recorded in the audit-control repository (verdicts/rc17-beta-blockers/): rounds 1/4/5 returned findings that were each fixed and re-reviewed; rounds 2, 3, and 6 passed — the final round at the exact pre-merge head d1f5d9c0.
• Required PR checks: 17/17 passed at the final head.
• Tag-triggered signed Windows/Linux artifact workflow: passed with 28 self-consistent assets.
• Release identity, proof boundary, and the completed clean-host walkthrough: docs/releases/v1.0.0-rc17-verification.md.
• No changes were made under program/native-windows.

Clean-host walkthrough — COMPLETED 2026-07-20

The exact public installer completed a full clean-host lifecycle walkthrough on real hardware (Windows 11 Pro, WSL/VirtualMachinePlatform features disabled, no prior state).

Verdict: PASSED. No blocker, no critical, no Major. (Residual: 1 Minor + 1 Nit, neither blocking.)

Proven: install from a clean baseline to the operator dashboard in ~6 minutes with zero restarts and zero terminal commands; first admin and one-time recovery kit; backup write/read/delete and a 95-table scoped database restore drill; private rehearsal and packaging; the publish privacy gate proven both ways (canonical URL 404 before approval, 200 after an explicit Portal-only approval) with resident playback confirmed; real local AI inference (summary and translation from installer-provisioned models); service relaunch and an unaided cold-reboot recovery; and a 42-second reinstall from the same installer. Captions were not exercised — captioning uses the faster-whisper runtime, not these models.

Uninstalling and your data

When you uninstall, the uninstaller shows a "Delete the application data" checkbox: check it to remove everything (including the ~19 GB Windows helper that holds your database and recordings), or leave it unchecked to keep your data for a later reinstall — the uninstaller then explains on screen what was kept. Two notes if you keep the data: a later reinstall makes previously published recordings public again without a new approval, and a command-line silent uninstall (/S) keeps the data by default (it never shows the checkbox). To remove kept data by hand, run wsl --unregister CivicCast-Ubuntu-24.04 and delete %USERPROFILE%\.civiccast.

(An earlier draft of these notes graded uninstall data-retention as a Major finding; a source review confirmed the uninstaller offers removal via the checkbox and downgraded it to non-blocking.)

Beta boundary

This is a public prerelease for bounded beta evaluation. rc16 remains published and immutable as the prior beta; if rc17 must be withdrawn, it will be marked withdrawn (as rc13 was) and testers directed back to rc16.

Report installation results through the in-product Report a beta issue link, and never include passwords, recovery codes, staff tokens, or private meeting material.

CivicCast v1.0.0-rc16 public beta candidate

CivicCast v1.0.0-rc16 public beta candidate

rc16 carries the post-rc15 UI/UX repair set: safer operator authentication recovery, normal navigation around direct resident previews, visible beta-feedback paths, clearer installer state, accurate short-duration labels, and a smaller initial operator-console bundle.

Download for Windows

rc16 is the previous beta. Unless you were sent here deliberately, use the
current public beta instead: CivicCast v1.0.0-rc17.
rc16 stays published and unchanged as the rollback target.

⬇ Download CivicCast 1.0.0-rc16 for Windows

232 MB · Windows 10/11 (64-bit) · signed installer

Verify it before you run it. In PowerShell, from the folder you downloaded to:

Get-FileHash .\civiccast-1.0.0-rc16-windows-setup.exe -Algorithm SHA256

Expect exactly this, and stop if it differs:

• SHA-256: 6c28e92630fd2fbeeb20022be3a2032547c59b8838ebdd901ea3fef571eb1d6f
• Size: 243,677,408 bytes
• Authenticode: Valid — Signature verified
• Publisher: CN=Scott Converse, O=Scott Converse, L=Longmont, S=co, C=US

Attestations and supporting files

• Sidecar - civiccast-1.0.0-rc16-windows-setup.exe.sidecar.json
• Sigstore bundle - civiccast-1.0.0-rc16-windows-setup.exe.sigstore.json
• Complete manifest - civiccast-1.0.0-rc16-release-artifacts-manifest.json
• Manifest attestation - civiccast-1.0.0-rc16-release-artifacts-manifest.json.sigstore.json

The exact public installer was downloaded again after publication. Its local SHA-256, GitHub asset digest, sidecar digest, and complete-manifest digest all match.

Verification completed

• Source/tag commit: 0deac05e935740cfd55c32a737cbd23eff6ea91a
• Required PR checks: 17/17 passed.
• Tag-triggered signed Windows/Linux artifact workflow: passed.
• Public release asset gate: passed with 28 self-consistent assets.
• Tag-triggered Docker cleanroom: passed.
• Authenticode and Sigstore verification: passed in the release workflow; Authenticode independently rechecked against the downloaded public installer.
• No changes were made under program/native-windows.

Beta boundary

This is a public prerelease for bounded beta evaluation. The exact-public rc16 Windows installer has not yet completed a new clean-Windows install/update/repair/uninstall walkthrough. rc15 remains the last candidate with that exact clean-host lifecycle evidence. Report rc16 installation results through the in-product Report a beta issue link, and never include passwords, recovery codes, staff tokens, or private meeting material.

CivicCast v1.0.0-rc15 — Public Beta

CivicCast v1.0.0-rc15 — Public Beta

rc15 is available for public beta testing. The exact public Windows installer has completed a genuine clean-Windows installation and lifecycle walkthrough from a WSL-disabled baseline through cold-reboot recovery.

Download for Windows

Download civiccast-1.0.0-rc15-windows-setup.exe from the Assets section below.

• Size: 243,670,360 bytes (232.38 MiB)
• SHA-256: ebdd8600c74734e23a4dc65f24b597085d3abe51f2f92e8f8d06f67c26fac751
• Windows Authenticode: Valid — signer Scott Converse
• Installer Sigstore bundle: Verified OK against the exact public EXE
• Complete release-manifest Sigstore attestation: Verified OK
• Public asset policy: PASS — 28 assets, complete and self-consistent
• Release workflow: SUCCESS

The published rc15 assets have not been replaced or modified.

Exact-public clean-Windows result

PASS for the bounded rc15 beta workflow. The exact public installer completed:

• Windows prerequisite setup from a WSL-disabled baseline;
• dedicated Ubuntu 24.04, TSDuck 3.44, offline Python wheelhouse, and systemd service provisioning;
• first-admin and recovery-kit setup;
• backup write/read/delete verification;
• a 95-table isolated database restore plus crash-recovery drill;
• exact-sample private rehearsal and private packaging;
• explicit Portal-only approval and resident HLS playback;
• redacted support-bundle generation and audit;
• app close/relaunch, service restart, and cold-reboot recovery.

After the cold reboot, civiccast.service was enabled and active, /health reported healthy and 1.0.0-rc15, setup state remained intact, and the published sample remained available and playable in the resident archive.

Known rc15 installer issue

A still-open installer can briefly show a stale restart screen after setup is already healthy. Close and reopen the installer; saved progress and the healthy runtime remain intact. The display-state race is fixed forward on main for the next candidate. rc15 assets remain immutable.

Current documentation

The README, Windows install/trust guides, tester packet, LPM handoff, technical and architecture references, landing page, discussion seed posts, and rendered PDF/DOCX manual have been updated on main with the completed post-publication result. The release-attached manual remains the immutable tag-time artifact covered by rc15's manifest and attestations; it is not silently replaced. Use the current documentation site for the post-publication result and the release assets for exact rc15 artifact provenance.

What rc15 fixes

• Long offline runtime staging remains visibly active with an indeterminate progress indicator and live elapsed time.
• After setup reaches Ready, CivicCast makes a real attempt to open the operator console.
• Healthy relaunches clear stale “finishing setup” copy and do not claim browser actions that did not occur.

Verification before publication

• 25 installer UI unit tests
• 82 installer browser cases
• 55 Rust installer tests before tag publication; the forward-fix branch expanded the suite to 57
• 284 Python installer tests, with three expected environment/network skips
• 15 Windows PowerShell bootstrap tests
• Full backend, Docker cleanroom, operator/public portal, accessibility, security, documentation-render, Windows compile, and policy gates

Deliberate beta limits

• Stock live ingest remains fail-closed without an integrator-supplied, separately proven server-side media probe.
• The accepted stock beta workflow is recorded media: validate, rehearse privately, package privately, approve only Portal, and verify resident playback.
• Database recovery proves the isolated CivicCast application database and crash recovery; it does not include media, configuration, or credentials.
• Hardware, cable-headend delivery, external providers, app stores, and unattended station operation require separate field acceptance.
• Keep at least 5 GB free for the base installation, plus separate capacity for media, recordings, backups, and downloaded caption models.

Published assets are immutable. Any additional defect will be fixed forward in a new candidate.

CivicCast v1.0.0-rc14 — Public beta

CivicCast v1.0.0-rc14 — Windows repair public beta

This prerelease supersedes the withdrawn rc13 build for Windows beta evaluation.

What changed

• Serializes Windows feature servicing and WSL/Ubuntu bootstrap so repeated clicks or relaunches cannot start competing elevated setup chains.
• Preserves reboot/resume state and shows the active phase, step count, elapsed time, and a live heartbeat during long setup operations.
• Repairs same-version runtime replacement, retry/recovery behavior, stale installer registration, and uninstall cleanup.
• Repairs first-admin setup, backup/restore rehearsal, exact-selected-sample private rehearsal, private packaging, explicit Portal approval, resident playback, and authenticated support-bundle download.
• Updates the README, Windows guide, user manual, technical/architecture material, landing pages, LPM handoff, and discussion seed copy for rc14.

Installation requirements

• Windows 11 x64
• Administrator access
• Internet access during initial Windows/Ubuntu provisioning
• At least 5 GB free disk space for installation, plus separate capacity for media, recordings, backups, and optional caption models
• One or more restarts may be required while Windows enables WSL and Virtual Machine Platform

Beta boundary

Use only civiccast-1.0.0-rc14-windows-setup.exe attached to this release, and verify it against its sidecar and release manifest. rc13 and earlier candidates are withdrawn from new installation.

By owner direction, rc14 was published before the exact public installer completed its post-publication clean-Windows walkthrough. That exact downloaded installer subsequently completed clean install, first setup, database recovery drill, private rehearsal, private packaging, explicit Portal approval, resident playback, support-bundle redaction audit, relaunch, uninstall, and clean reinstall. The walkthrough found installer progress/status defects that are being fixed forward in rc15; rc14 assets remain immutable.

Stock rc14 proves the recorded-media path: create or upload a sample, privately rehearse that exact sample, package it privately, approve the Portal surface, and verify resident playback. Live ingest remains fail-closed unless an integrator supplies and separately proves the required server-side media probe. Hardware, headend delivery, external providers, app stores, and unattended station operation require separate field acceptance.

Download ready

• Download civiccast-1.0.0-rc14-windows-setup.exe
• Size: 243,665,424 bytes
• SHA-256: d624f965cc82b9b93e3aa493463aba921dd476a4c695193d1c7d078584d8b5d7
• Authenticode: Valid
• Signer: CN=Scott Converse, O=Scott Converse, L=Longmont, S=co, C=US
• Sigstore: independently verified against the refs/tags/v1.0.0-rc14 release workflow identity

The public asset set contains 28 uploaded release assets and passes the public-beta consistency gate. The exact public installer completed its bounded clean-Windows acceptance path. rc15 is the forward-fix candidate for the progress/status defects found during that run.

CivicCast v1.0.0-rc13 — WITHDRAWN

Caution

WITHDRAWN — DO NOT INSTALL. A genuine clean-Windows test later exposed bootstrap failures that the earlier contaminated lab run did not catch. This release is retained only as incident history. The notes below preserve what was believed at publication time and are not current guidance. Use v1.0.0-rc14 or newer after the repository's current Windows installation page names it as approved.

---

CivicCast v1.0.0-rc13 — Windows runtime recovery candidate

This public prerelease supersedes rc12 for new Windows beta installs.

What changed

• Keeps the dedicated CivicCast WSL distribution alive with a per-user background runtime host.
• Recovers civiccast.service after WSL termination or a Windows sign-in restart.
• Updates installer readiness from live health, including revoking a stale Ready display when the service is unavailable.
• Uses the runtime host for repair/retry instead of rerunning full provisioning.
• Carries forward rc12's isolated TSDuck bootstrap verification.
• Updates the README, Windows installation guide, nontechnical/operator/records sections, technical reference, architecture drawings, landing pages, and discussion seed posts for rc13.

Clean-host evidence

An Explorer-launched clean Windows install completed successfully on the release candidate. Health, TSDuck 3.44-4676, bundled GStreamer 1.28.4, first-admin setup, recovery kit, sample media, backup verification, public portal, private rehearsal, daily self-check, and full restore rehearsal passed. Forced WSL termination recovered in about 11 seconds; simulated sign-in relaunch recovered in about 9 seconds.

GitHub gates also passed, including the full unit suite, Windows installer compile/tests, installer browser tests, accessibility, security scans, documentation rendering, and Docker cleanroom.

Installation requirement

Have at least 5 GB free disk space for installation, plus separate capacity for media and recordings.

Beta boundary

This is a controlled public-beta candidate, not production certification or headed LPM acceptance. Download only the exact assets attached to this release and verify them with the published sidecar/manifest and Sigstore bundles.

See docs/releases/v1.0.0-rc13-verification.md in the tagged source for the detailed evidence boundary.

CivicCast v1.0.0-rc12

Release candidate for controlled Windows beta testing.\n\n- Fixes the TSDuck bootstrap failure caused by protected Windows PATH entries inherited by WSL.\n- Requires 5 GB free disk for the base install; recordings and media need additional capacity.\n- Use only the matching installer, manifest, sidecar, and Sigstore attestation assets published with this release.

CivicCast 1.0.0-rc11

Corrective beta candidate with the current user manual, architecture diagrams, release manifest, and signed release assets. rc10 remains unchanged as historical public prerelease evidence.

CivicCast 1.0.0-rc10

CivicCast 1.0.0-rc10

1.0.0-rc10 is 1.0.0-rc9 with one release-build fix so the tag build completes
green and publishes the unified artifact manifest. No product or installer-behavior
change from rc9 — rc9's installer passed a full clean-Windows-VM fresh-tester
gauntlet (install → SmartScreen → reboot survival → WSL2 Ubuntu → service healthy →
Ready → uninstall, no "Not Responding" freeze), and rc10 rebuilds that same code.

The fix

rc9's action-pin fix let the manifest-merge run on a real tag for the first time, which
exposed that the release manifest listed the bundled Linux wheelhouse (a build
intermediate the installer consumes internally, not a published release asset) that the
Windows CI bundle omits — so the fail-closed merge errored. rc10's manifest lists only
top-level published artifacts.

Full evidence + honest gaps: docs/releases/v1.0.0-rc10-verification.md.
Prerelease — not the beta declaration; a 24-hour soak is the remaining step.

CivicCast 1.0.0-rc9

CivicCast 1.0.0-rc9

1.0.0-rc9 is 1.0.0-rc8's baseline taken through a clean-Windows-VM fresh-tester
gauntlet and a full five-role GauntletGate, with every finding driven to zero.
No product feature changed — functional behavior is byte-for-byte rc8's.

What changed since rc8

• The release build no longer ships broken. rc8's tag build went red on a
  nonexistent action version and never published its unified manifest; rc9 fixes the
  pin, attests the merged manifest, adds a CI guard that resolves every action pin,
  and a post-publish check that the released asset set is complete + self-consistent.
• A second UI-thread freeze (a health probe polled on the UI thread) is now off-thread.
• A post-reboot installer button race that could skip the WSL warning is fixed.
• Doc-honesty narrowing, honest panic diagnostics, install-page asset naming +
  up-front SmartScreen guidance, WCAG-AA contrast, standardized pins, and new tests.

Full evidence + honest gaps: docs/releases/v1.0.0-rc9-verification.md.
Windows tester start-here: docs/tester/START-HERE.md.

Prerelease — not the beta declaration. A 24-hour soak (MSI machine + VMs) and a fresh
clean-VM install of this exact rc9 binary are the remaining steps before that call.