[Dunky13]

Summary

successful trusted-main CI
  exact original universal installer
    isolated signing, three ordered Apple submissions and bound receipts
      same-run automatic continuation using retained UUIDs
        ARM + Intel acceptance
          draft, exact remote readback, immutable publication
            exact-build Homebrew delivery

Retain the existing main-build prerelease/version policy, three-stage installer topology, main-only Apple secrets, quarantine, Gatekeeper and both-architecture acceptance. Add independent small receipts and diagnostics, build-qualified submission names, explicit fail-fast toolchain selection/records, verified legacy checkpoint binding, bounded automatic continuation and draft-first publication with byte readback. Successful releases carry permanent source/submission/final-hash evidence. The first finalization audit JSON is retained in the candidate checkpoint, so whole-workflow recovery reuses every public byte. Strict single-object and toolchain-schema checks reject altered retained evidence before publication.

The live main-ci ruleset now requires ci-required from GitHub Actions, and repository release immutability is enabled. Existing restrictions and bypass actors were preserved. This repository had no recurring signing/publication reviewers to remove.

Runtime, full tooling/installer, and native regression matrices are independently required on ARM and Intel. The runtime adapter enumerates the original Go package scope and excludes only exact internal/tooling; new packages remain covered. All race, worker, test-timeout and job-budget limits remain unchanged. This addresses the repeated Intel shared-job timeout without skipping tests.

Evidence

• Before: pending Apple submissions required a manual rerun; receipts required downloading large checkpoints; the publisher created a public release directly; the active required-check list was empty.
  After: executable failure tests cover exact-run recovery, rejection/mismatched custody, unsafe archives, bounded retries, draft interruption, conflicting assets, exact public readback, whole-workflow byte identity and duplicate/extra/malformed audit JSON refusal. The complete initial local batch passed through shared queue job 2019, including race, web/browser, native, universal packaging, private installation and mounted-DMG checks. Release lint and broader notarization/tooling race tests passed through queue jobs 2085 and 2126. Final focused race tests passed for evidence/publication (34.386s), and exact serialization checks (10.848s); final semantic publisher fixtures passed the race suite (29.774s); final lint passed. Signed head 13eb21036674d6d271ddc0b4883e0762c1258f99 includes accepted main 9c0d13b without conflicts. Final source rechecks resolved all findings at 00752b7; the merge preserves that release implementation and main’s backend/native source. Integrated workflow contracts (0.140s) and actionlint passed. Current signed repair head 21061a53e3f061e534f45dc6471f0717d55cd7f9 preserves that release implementation and adds independently required runtime/tooling budgets. Focused enumeration/workflow race tests passed (2.609s); frozen lint, actual runtime-adapter validation and the full tooling race profile passed through queue job 2136 on all 287 unchanged source files (tooling 348.507s). Independent Sol 6.1 high review of the repair is CLEAN, confirming complete package coverage on both architectures. Fresh hosted CI remains pending. The previous full source review at cc48258 was CLEAN for its scope.
• Local installer output uses development signatures. Hosted PR CI remains a merge gate. Real Apple acceptance/stapling, same-candidate provider recovery, public asset verification and Homebrew qualification remain separate operational gates after merge.
• Source contract and handoff: docs/apple-signing.md, docs/handoffs/unattended-apple-release.md.

Merge Danger

Door: one-way

Source changes can be reverted. Merging eligible main source automatically starts distribution, and newly published GitHub releases are immutable. Unknown uploads, expired/missing custody, rejection, cleanup failure or failed acceptance stop promotion; the observer cannot authorize a replacement upload.

Blast Radius: releases