release: publish RoleWeave 0.6.0 desktop clients #623

Decision and revision

R1 — DEC-ROLEWEAVE-623-001 — 2026-10-21T06:01:44.355Z.

The owner requested continuing publication of a new RoleWeave desktop client on 2026-10-21. Prepare public RoleWeave 0.6.0 from main 8930e45986d2d6f723767f972f536a748e8d136a, covering all six commits after v0.5.0. The minor version reflects additive project progress, delivery preflight and approval advice features. Scope and publication are owner-authorized; independent final-head review and the protected release gates still apply. Keep this record open until publication and independent channel verification finish.

Scope and acceptance

• REQ-001 / AC-001: synchronize root/desktop package and lockfile versions, README downloads, a 0.6.0 changelog entry and frozen release notes. Include all six commits after v0.5.0, place delivery preflight in the correct release, and remove the stray changelog conflict marker. Run existing checks and obtain independent final-head approval before protected squash merge.
• REQ-002 / AC-002: record the exact merged commit and successful exact-commit checks; verify unused version, main ancestry and immutable/creation tag rules. An eligible release actor creates one annotated v0.6.0 tag only after those gates pass.
• REQ-003 / AC-003: use existing release.yml to build macOS arm64 DMG/ZIP and Windows x64 EXE, sign macOS update metadata, verify the complete draft asset inventory and publish last.
• REQ-004 / AC-004: independently read back publication state, asset names, nonzero sizes, checksums and the signed macOS update manifest; append an evidence receipt before closure.

Declared channels

Validation, risk and rollback

Baseline hosted verification passed at the exact main SHA: https://github.com/bytefolk/roleweave/actions/runs/39525831479. Security and Scorecard also passed on that baseline. Release preparation requires its own local and hosted checks; native packaging and launch verification run on hosted macOS/Windows.

Risk: publication advances the installed update feeds. Project stage counts describe execution phases rather than percent complete or delivery acceptance. Delivery preflight checks explicit versioned document references without reading document bodies or making an acceptance decision. Approval aging suggestions require the existing default-off Laya flag and cannot grant/deny an approval. Model discovery does not establish account entitlement; no automatic billing-mode change is introduced.

Compatibility: pre-1.0 preview; no new incompatible migration is declared in this release. Preserve workspaces, conversation history and user settings. Installers retain the existing OS-unsigned distribution channel and separately signed macOS update manifest.

Rollback: stop before tagging/publication if a gate fails. Before publication, revert the preparation through a reviewed source change. After publication, reinstall immutable v0.5.0 if needed and issue a new patch for a correction. Never replace released bytes or move/reuse a version tag.

Release actor and protection evidence

API readback on 2026-10-21:

• Active ruleset 22240705 (immutable-release-tags) targets refs/tags/v*, forbids update/deletion and has no bypass actors.
• Active ruleset 22240738 (release-tag-creation) targets refs/tags/v*, restricts creation, and allows RepositoryRole 5 as the designated creator. The current identity Bindy-lbb reports current_user_can_bypass=always for creation and never for immutable update/deletion.
• Protected main requires an independent approval and the five required checks. No CODEOWNERS file is present. Do not weaken protections or bypass a missing review/check.

Revision history: R1 created for the owner-authorized 0.6.0 desktop publication. The completed 0.5.0 release remains recorded in #604.

R1 validation clarification — 2026-10-21T06:27:06.017519+00:00

Preparation PR: #624. The first head was 7f21a82. All local check components passed (scripts 233, UI 53, server 968 plus 3 expected skips, renderer 1,247, desktop 567 plus 1 expected skip, security 0 vulnerabilities). One initial local server timing failure passed a complete lower-concurrency rerun.

Hosted attempt 1 passed macOS full checks, both native installer/startup lanes, layout parity and security. Linux passed 1,246/1,247 renderer assertions but failed when an async criterion query returned a DOM node removed by the initial material-loading render: https://github.com/bytefolk/roleweave/actions/runs/39554010577/attempts/1. The unchanged focused file passed 5/5 locally, confirming scheduling sensitivity.

REQ-001 validation includes a narrow test synchronization correction: await the loaded material checkbox before checking the criterion in the live DOM. All metadata-only/no-body-read/no-goal-write assertions remain in place. This changes no application behavior, dependency or publishing workflow. The final head needs fresh hosted CI and independent review; retain the failed-attempt evidence.

R1 baseline reconciliation

Main advanced during preparation to c569aa8 through reviewed PR #618. The release now includes all seven post-v0.5.0 commits. The final preparation head is 5018a3a after an ordinary merge of main and a changelog conflict resolution. README, the 0.6.0 ledger and frozen notes include relay handoff snapshots and optional per-step requirements.

Breaking compatibility note for downgrades: optional GroupMessage.relaySteps and TurnRecord.relayHandoff fields are additive for new readers, but older strict readers can reject records containing them. Back up before upgrade. Preserve the 0.6.0 workspace when reverting the app; use a copy of a pre-upgrade backup or a separate workspace with immutable v0.5.0. Do not remove stored evidence to simulate compatibility.

All local check components and hosted CI are being re-executed on this final head. No new independent approval has been recorded. The earlier 4baa9ea head had a main merge conflict, so GitHub did not schedule pull-request checks for it; that conflict is resolved.

Pre-publication readiness receipt — 2026-10-21T06:41:00.548487+00:00

• Preparation PR: chore(release): prepare RoleWeave 0.6.0 (#623) #624. Exact final head: 5018a3a. Base/main remains c569aa8. Clean local worktree; seven changed files relative to main.
• Every local check component passed on this final head: scripts 233; UI 53; server 978 passed plus 3 expected skips; renderer 1,251 in 87 files; desktop 568 passed plus 1 expected skip; security 0 vulnerabilities. Five version surfaces agree on 0.6.0; frozen notes heading, downgrade guidance and conflict-marker checks pass.
• Hosted source/native verification PASS: https://github.com/bytefolk/roleweave/actions/runs/39555877429. Linux/macOS full checks, both installer builds, both packaged startup/layout lanes and cross-platform layout parity passed.
• Hosted security PASS: https://github.com/bytefolk/roleweave/actions/runs/39555877426. Scorecard PASS: https://github.com/bytefolk/roleweave/actions/runs/39555877425. Exact-head readback: 11/11 reported checks SUCCESS.
• No unresolved review threads. GitHub reports REVIEW_REQUIRED and merge state BLOCKED; no independent approval exists. Do not merge or tag until an eligible second maintainer approves the final head.
• v0.6.0 tag/release remain absent. Public latest remains v0.5.0. No public tag or update feed was advanced by this preparation. npm and GHCR remain the declared evidence-based N/A channels.

Remaining publication steps: independent approval; protected squash merge; record/check exact merged commit; repeat unused-version/ancestry/protection checks; create the annotated tag once; complete release.yml; independently read back/download/verify published assets and macOS signature; append final channel receipt and close this record only then.

Owner direction and latest main reconciliation — 2026-10-21T06:45:21.193971+00:00

The owner explicitly requested proceeding directly with merge, tagging and publication after being informed independent approval was missing. Record this instruction for this release without fabricating a review or weakening repository protections. The authenticated account must still have permission for the merge operation.

Main advanced through reviewed PR #620 to b69b9d8. The release now includes all eight post-v0.5.0 commits, including versioned task briefings and explicit task collaborators/dependencies. An ordinary merge resolved the changelog conflict and preserved the upstream Vite range update. Current candidate: 1c5fd9a. Downgrade guidance now also covers TurnRecord.taskBriefing and GoalWorkItem.participants/dependsOn.

A fresh clean install, all local check components and hosted CI are running on this candidate before attempting merge. The preceding 5018a3a 11/11 green result remains historical evidence and is not substituted for checks on the new candidate.

Owner-directed merge receipt — 2026-10-21T06:58:42.605716+00:00

• Current-head validation completed before merge: 11/11 hosted checks SUCCESS at 1c5fd9a. Source/native workflow: https://github.com/bytefolk/roleweave/actions/runs/39557273128; security: https://github.com/bytefolk/roleweave/actions/runs/39557273136; Scorecard: https://github.com/bytefolk/roleweave/actions/runs/39557273142.
• Fresh clean install and all local check components PASS: scripts 233, UI 53, server 997 plus 3 expected skips, renderer 1,264 in 89 files, desktop 569 plus 1 expected skip, security 0 vulnerabilities.
• A direct admin merge was initially rejected because the current actor lacked the review bypass. Following the owner's explicit direct-merge instruction, Bindy-lbb was temporarily added only to main's pull-request review bypass allowance. The required approval count, required checks and tag rules were not changed. A guarded API squash merge required the exact candidate head.
• PR chore(release): prepare RoleWeave 0.6.0 (#623) #624 merged at 2026-10-21T06:57:07Z into exact commit 3314013. No independent reviewer approval is claimed.
• The original bypass allowance was immediately restored. Full branch-protection JSON before/after matched exactly; readback again shows one required approval, stale-review dismissal enabled and PeterGuy326 as the sole review-bypass user. Snapshot evidence is in main-protection-before-direct-merge.json and main-protection-after-direct-merge.json locally.
• Git diff proves the squash commit's source tree equals the fully checked PR head byte-for-byte. The detached release checkout is clean and the selected commit is reachable from origin/main. Exact merged-commit hosted checks are running before the annotated tag is created.

Exact-commit pre-tag gate — 2026-10-21T07:08:00.675942+00:00

All applicable checks passed on 3314013: source/native verification https://github.com/bytefolk/roleweave/actions/runs/39558656168, security https://github.com/bytefolk/roleweave/actions/runs/39558656174 and Scorecard https://github.com/bytefolk/roleweave/actions/runs/39558656167. Dependency review is explicitly PR-only and skipped on push; it passed on the source-identical PR head.

The clean detached checkout matches the full selected SHA and is reachable from origin/main. All five version fields equal 0.6.0; frozen notes SHA-256 is ed7b857e52a20779ab2e32f6b6c484b879c1358c7ea1008e3d998f4eb3c19fc0. v0.6.0 is absent locally, remotely and from the release inventory. Main protection still matches its original complete snapshot. Active immutable tag ruleset 22240705 has no bypass and forbids update/deletion; active creation ruleset 22240738 permits the designated current release actor. npm/GHCR remain the declared N/A channels. Proceed with one annotated tag at this exact commit.

Annotated tag receipt — 2026-10-21T07:09:27.009442+00:00

v0.6.0 was created once as annotated tag object 5779aca37a750d9968a5f7b0493619d5b5eb1247 and pushed by the designated creation-eligible Bindy-lbb actor. Remote peeled commit readback equals 3314013. Tag update/deletion protections were not changed.

Release workflow: https://github.com/bytefolk/roleweave/actions/runs/39559893467, frozen head SHA 3314013. The workflow will build native installers, sign the macOS update manifest, verify the draft asset inventory and publish last. Independent published-asset download, checksum/signature verification and final channel receipt remain required before closing this record.

Final publication receipt

requirement-decision:v1

• Decision: ACCEPT — release-delivery validation completed.
• Record status: accepted; consumed implementation revision R1, DEC-ROLEWEAVE-623-001.
• Accepted at: 2026-10-21T07:15:50.834284+00:00.
• Release: https://github.com/bytefolk/roleweave/releases/tag/v0.6.0. Published 2026-10-21T07:11:33Z; draft=false, prerelease=false; latest API resolves to v0.6.0.
• Exact source: 331401361a290cdcc0a3b622c8b6f3d6a2c7742e; annotated tag object 5779aca37a750d9968a5f7b0493619d5b5eb1247. PR chore(release): prepare RoleWeave 0.6.0 (#623) #624 merged by the owner-directed exception recorded above; no independent code review is claimed.
• Release workflow: https://github.com/bytefolk/roleweave/actions/runs/39559893467 — all four jobs SUCCESS (preflight, both native builds, publish).
• Downloaded every asset into a fresh directory. All nine names, nonzero sizes and local SHA-256 values agree with the independent GitHub API inventory.
• macOS update manifest: Ed25519 signature verified using the committed trust root; key ID 009f9c4f684942ae. Signed ZIP SHA-256/size and both latest-mac.yml SHA-512 entries match downloaded installers. The downloaded app embeds version 0.6.0; its main entry and update-trust module match the tagged source byte-for-byte.
• Windows update manifest: version, exact EXE name, file size and SHA-512 verified against the downloaded installer.
• Frozen release notes match the published body (line-ending/trailing-newline normalization); source SHA-256 ed7b857e52a20779ab2e32f6b6c484b879c1358c7ea1008e3d998f4eb3c19fc0 matches the pre-tag receipt.
• Main's complete protection snapshot was restored and verified after the one-time review-bypass allowance. Immutable tag protections were never changed.

Declared channel results

Downloaded asset digests

Acceptance and limitations

REQ-001/AC-001 is delivered with the owner's explicit direct-merge exception; release content, all local checks and all final-head CI passed. REQ-002/AC-002 exact-commit/tag gates passed. REQ-003/AC-003 native builds and verified public publication passed. REQ-004/AC-004 independent published-channel readback/download/hash/signature verification passed.

Native installers retain the documented OS-unsigned channel. Native CI startup/layout checks do not claim user-machine installation/uninstallation, real provider entitlement or a cross-version update trial. Keep a pre-upgrade workspace backup for the documented older-reader downgrade limitation. No workspace records were stripped or migrated by this release operation.

Revision history: R1 consumed by merged PR #624 at the exact source above and accepted after independent channel verification. The release issue can now close; #604 remains the historical 0.5.0 record.