Repository navigation
release: deliver RoleWeave v0.4.0 desktop installers #582
Description
RoleWeave v0.4.0 delivery — R1
DEC-ROLEWEAVE-582-001 · 2026-10-09T08:47:05+00:00 · status=ready
Scope and decision
Publish RoleWeave 0.4.0 desktop installers from protected main. The maintainer explicitly requested publication after reviewing the packaging analysis on 2026-10-09. Candidate main baseline: 223add9b75c972e3c3aa05416286f261fb0ce95f (PR #581). The final release commit must be the independently reviewed release-preparation PR's squash commit, recorded before tag creation.
The candidate contains 96 commits since v0.3.0: v0.3.0...223add9. Highlights: persistent approvals and audit trails, project execution and human acceptance, goals/progress, connected drive browsing and workspace notes, organization/relationship graphs, Gemini host, attachment support, and Windows in-app updates. Move the entire Unreleased changelog into 0.4.0 without rewriting prior entries. Design-only memory proposals and mobile source clients are not additional shipped desktop runtime capabilities or mobile distributions.
Compatibility: this remains a pre-1.0 preview. The optional local inference integration now uses ROLEWEAVE_LAYA_; ROLEWEAVE_JEV_ is no longer read. Existing workspaces remain valid without work/; new roles default to read-only tools. v0.3.0 Windows clients with disabled in-app installation need one manual upgrade. Call these changes out in the frozen notes.
Declared channels
| Channel | Scope |
|---|---|
| GitHub Release | Stable v0.4.0: roleweave-0.4.0-arm64.dmg, roleweave-0.4.0-arm64.zip, roleweave-0.4.0-x64.exe, their blockmaps, latest-mac.yml, latest.yml, latest-mac.json. Read back the exact emitted inventory, nonzero sizes, digests, public state, and independently signed macOS update manifest. |
| npm | N/A: roleweave and @roleweave/desktop are private workspaces; release.yml distributes Electron installers and has no npm publication. |
| GHCR | N/A: release.yml declares no container build or registry publication. |
Supported architectures: macOS Apple Silicon arm64 and Windows x64. No Intel Mac, Linux, or mobile installers. The packages are not Apple Developer ID-signed/notarized or Windows Authenticode-signed. The macOS Ed25519 update manifest does not establish Apple code-signing trust. Windows checks HTTPS feed metadata and installer SHA-512 without publisher pinning.
Release gates and current evidence
- Candidate main verify run: https://github.com/bytefolk/roleweave/actions/runs/37898131296 (success, including both native installers and staging smoke legs). This is baseline evidence, not validation of the future release-preparation commit.
- Version 0.4.0 is unused as a tag at initial analysis; all channel/ref absence checks must be repeated immediately before tagging.
- Ruleset 22240705 immutable-release-tags: active, refs/tags/v*, update/deletion prohibited.
- Ruleset 22240738 release-tag-creation: active, refs/tags/v*, creation restricted. The active Bindy-lbb account has MAINTAIN permission and the API reports current_user_can_bypass=never. Bypass actors are not exposed to this account. A least-privileged eligible publisher must perform the final tag creation; do not weaken protections or use workflow_dispatch to evade this gate.
- Independent approval of the final preparation PR head is required by the ByteFolk release baseline. Do not claim older owner-bypass releases as approval precedent.
Acceptance and verification
- REQ-001 / AC-001: synchronize root/desktop package versions, lockfile, README download references, changelog, and frozen notes; retain the reviewed release workflow. Run all repository checks and obtain independent final-head review before protected squash merge.
- REQ-002 / AC-002: record the full squash commit and successful exact-commit checks; prove main reachability, unused version, tag protections, and eligible release identity before creating a single annotated v0.4.0 tag.
- REQ-003 / AC-003: release.yml on that tag passes preflight, both native build legs, draft asset readback, and publication; public release notes match the frozen file.
- REQ-004 / AC-004: verify the release/tag/source commit, exact nonempty assets and digests, downloaded installer metadata, and macOS signed manifest. Append the receipt before closing this issue.
Rollback: before publication, stop and keep the release record open; use a reviewed source revert if needed. After publication, repair with a new patch version. Never move/delete a published tag or replace published assets.
Revision history
- R1 · 2026-10-09T08:47:05+00:00: release authorized; preparation may proceed. Tagging/publication remain gated by independent review, exact-commit verification, and release-actor permissions. Preparation PR to follow.
Activity
Bindy-lbb commentedon Oct 9, 2026
Preparation progress — 2026-10-09
31f9d8cf100a53a880f55bbe6ad3c18abac315eb, based on main223add9b75c972e3c3aa05416286f261fb0ce95f. Six files, 57 insertions / 11 deletions; no runtime, dependency, workflow, or settings change.0.4.0, the exact head above, and notes SHA-256b4b4f192006062c5028d8726e20a7bd12b5d32b0924eb41df8ab819c01604f22.Bindy-lbb commentedon Oct 9, 2026
Preparation verified; publication gates remain open — 2026-10-09
Preparation PR #583 is ready for independent review, with exact head
31f9d8cf100a53a880f55bbe6ad3c18abac315eb. All 11 GitHub checks passed on that head:Local constituent checks also passed: scripts 229/229, shared UI 50/50, server 833 pass + 3 expected skips, renderer 1,121/1,121, desktop main 402/402; builds/typechecks passed and npm audit reports zero vulnerabilities. Server tests used an isolated namespace and an unprivileged user with an accessible PATH; renderer used two workers after initial resource-related failures. No test inputs/assertions or host network settings changed.
The committed notes passed the actual workflow preflight shell, with SHA-256
b4b4f192006062c5028d8726e20a7bd12b5d32b0924eb41df8ab819c01604f22. Lockfile dependency records and the full changelog history were verified unchanged apart from release version metadata/heading. The original development worktree was preserved.Publication is not complete. GitHub reports REVIEW_REQUIRED with no approving review, so the preparation PR has not merged. Bindy-lbb is MAINTAIN and release-tag-creation ruleset 22240738 reports current_user_can_bypass=never. No release tag or release dispatch has been created. A tag-eligible publisher must complete the post-review protected squash merge and exact-main checks, record the squash commit, repeat the absence/protection gates, create the annotated tag once, and verify the public release assets and signed manifest before this issue can close.
release: ship RoleWeave v0.4.0 (#582) (#583)
Bindy-lbb commentedon Oct 9, 2026
Reviewed preparation merged; pre-tag checks pending — 2026-10-10 (UTC+8)
31f9d8cf100a53a880f55bbe6ad3c18abac315ebat 2026-10-09T16:44:53Z.db027d41ed837f5aadbc500c07c8e9538244ec8f, currently main tip.git diff --exit-codepassed).b4b4f192006062c5028d8726e20a7bd12b5d32b0924eb41df8ab819c01604f22.PeterGuy326 commentedon Oct 14, 2026
发布核验收据 — 2026-10-15
v0.4.0 已公开发布，关闭为 completed。
资产清单与 SHA-256：
此收据核验既有公开版本，不重新打标签或替换资产。Apple Developer ID/Windows Authenticode 签名仍未声明完成；#136 与 #110 保持开放。核对记录见 PR #601。