fix(releases): await literal input and pin fixed signing builder

Keep the exact keyboard assertion and existing deadline while waiting for native text state. Add that case to focused hosted regression coverage, pin owner-reviewed standards1.1.1 and preserve the exact already-approved Syft entry in repository setup.

Co-Authored-By: Codex GPT-6 <noreply@openai.com>
Signed-off-by: James Maes <james@kof22.com>

.github/workflows/ci.yml

@@ -44,7 +44,7 @@ jobs:
         shell: pwsh
         run: >-
           dotnet test tests/MarkdownViewr.Windows.UiTests --no-build
-          --filter 'FullyQualifiedName~SourceHighlighting|FullyQualifiedName~Settings_NewWindowPanelDefaults|FullyQualifiedName~Settings_ContentsPresentation|FullyQualifiedName~Settings_ContentsTooltip|FullyQualifiedName~Themes_PalettePreviewAndDefaultChoice|FullyQualifiedName~Settings_PrintingDefaults|FullyQualifiedName~Settings_PrintingDraft|FullyQualifiedName~ThemeTransfer_NativePickerCancels|FullyQualifiedName~Print_UserWidthAndBorders|FullyQualifiedName~ReadingKeys_ScrollCommands|FullyQualifiedName~Source_ShowReloadAndHide|FullyQualifiedName~ThemeEditor_AllTypography|FullyQualifiedName~ThemeEditor_NewCustomTheme|FullyQualifiedName~Appearance_WidthCssAndPrint|FullyQualifiedName~Toolbar_ReadingCommandsAndMenus|FullyQualifiedName~Toolbar_EditorAndPrint|FullyQualifiedName~ThemeTransfer_BatchFutureInvalidAndDisabledExport|FullyQualifiedName~ReadingKeys_HeadingSequences|FullyQualifiedName~Source_BidirectionalScroll|FullyQualifiedName~Source_RawHtmlHeadingProvenance|FullyQualifiedName~Extensions_NativePreferences|FullyQualifiedName~Windows_LocalDocumentLinks|FullyQualifiedName~ActivationInboxTests|FullyQualifiedName~Outline_NestedCollapse'
+          --filter 'FullyQualifiedName~SourceHighlighting|FullyQualifiedName~Settings_NewWindowPanelDefaults|FullyQualifiedName~Settings_ContentsPresentation|FullyQualifiedName~Settings_ContentsTooltip|FullyQualifiedName~Themes_PalettePreviewAndDefaultChoice|FullyQualifiedName~Settings_PrintingDefaults|FullyQualifiedName~Settings_PrintingDraft|FullyQualifiedName~ThemeTransfer_NativePickerCancels|FullyQualifiedName~Print_UserWidthAndBorders|FullyQualifiedName~ReadingKeys_ScrollCommands|FullyQualifiedName~ReadingKeys_FindAndTextFocus|FullyQualifiedName~Source_ShowReloadAndHide|FullyQualifiedName~ThemeEditor_AllTypography|FullyQualifiedName~ThemeEditor_NewCustomTheme|FullyQualifiedName~Appearance_WidthCssAndPrint|FullyQualifiedName~Toolbar_ReadingCommandsAndMenus|FullyQualifiedName~Toolbar_EditorAndPrint|FullyQualifiedName~ThemeTransfer_BatchFutureInvalidAndDisabledExport|FullyQualifiedName~ReadingKeys_HeadingSequences|FullyQualifiedName~Source_BidirectionalScroll|FullyQualifiedName~Source_RawHtmlHeadingProvenance|FullyQualifiedName~Extensions_NativePreferences|FullyQualifiedName~Windows_LocalDocumentLinks|FullyQualifiedName~ActivationInboxTests|FullyQualifiedName~Outline_NestedCollapse'
           --logger 'trx;LogFileName=reader-regressions.trx'
           --results-directory artifacts/reader-regressions
       - name: Retain native regression evidence

.github/workflows/release.yml

@@ -95,7 +95,7 @@ jobs:
 
   release:
     needs: [verify, gates, security, codeql, scripts, fuzzing]
-    uses: KofTwentyTwo/standards/.github/workflows/release-velopack.yml@93b1d6163a4c466ae443e98b62786fc4d80d33bd # v1.1.0
+    uses: KofTwentyTwo/standards/.github/workflows/release-velopack.yml@96cbdf208a15c9c524676bd15ff9e323228a952b # v1.1.1
     permissions:
       contents: write      # create and publish the GitHub release
       id-token: write      # sign attestations; Azure OIDC when signing

build/GitHubRepository.Tests.ps1

@@ -47,17 +47,17 @@ Describe 'Required checks match standalone workflow jobs' `
 
 Describe 'Generated repository administration' `
 {
-   It 'allows the digest-pinned security containers without permitting arbitrary container actions' `
+   It 'allows the digest-pinned security and SBOM containers without permitting arbitrary container actions' `
    {
       $plan = Get-GitHubRepositoryPlan -Repository 'Example/Notes'
       $policy = ($plan.Requests | Where-Object Path -Like '*/actions/permissions/selected-actions').Body
-      $policy.patterns_allowed.Count | Should -Be 3
+      $policy.patterns_allowed.Count | Should -Be 4
       $policy.patterns_allowed | Should -Contain 'KofTwentyTwo/standards/*@*'
       $containers = @($policy.patterns_allowed | Where-Object { $_.StartsWith('docker://', [StringComparison]::Ordinal) })
-      $containers.Count | Should -Be 2
+      $containers.Count | Should -Be 3
       foreach($container in $containers)
       {
-         $container | Should -Match '^docker://ghcr\.io/(gitleaks/gitleaks:v8\.30\.1|aquasecurity/trivy:0\.75\.0)@sha256:[0-9a-f]{64}$'
+         $container | Should -Match '^docker://ghcr\.io/(gitleaks/gitleaks:v8\.30\.1|aquasecurity/trivy:0\.75\.0|anchore/syft:v1\.54\.1)@sha256:[0-9a-f]{64}$'
          $container | Should -Not -Match '\*'
       }
    }

build/GitHubRepository.psm1

@@ -79,7 +79,8 @@ function Get-GitHubRepositoryPlan
             # Exact container actions used by the published v0.1.2 security builder.
             patterns_allowed = @('KofTwentyTwo/standards/*@*',
                'docker://ghcr.io/gitleaks/gitleaks:v8.30.1@sha256:c00b6bd0aeb3071cbcb79009cb16a60dd9e0a7c60e2be9ab65d25e6bc8abbb7f',
-               'docker://ghcr.io/aquasecurity/trivy:0.75.0@sha256:af6acf9a6b85dfe389a1941505c0ce9efef52a4719635e1a962f022a3d855daa')
+               'docker://ghcr.io/aquasecurity/trivy:0.75.0@sha256:af6acf9a6b85dfe389a1941505c0ce9efef52a4719635e1a962f022a3d855daa',
+               'docker://ghcr.io/anchore/syft:v1.54.1@sha256:3eb5379ba7b409c3f4069b686110527af0c47df993fa5c10d13e7cf34f49b1aa')
          }
       },
       @{ Method = 'PUT'; Path = "$root/environments/release"; Body = @{ deployment_branch_policy = @{ protected_branches = $false; custom_branch_policies = $true } } },

docs/RELEASING.md

@@ -7,7 +7,7 @@ which calls the shared `release-velopack.yml` workflow in KofTwentyTwo/standards
 
 ## Workflow baseline
 
-The signing release builder is pinned to standards v1.1.0 (`93b1d6163a4c466ae443e98b62786fc4d80d33bd`); other shared gates retain v0.1.2. The release caller checks main ancestry and reruns build, coverage, formatting, UI tests, security scans and CodeQL before publication.
+The signing release builder is pinned to standards v1.1.1 (`96cbdf208a15c9c524676bd15ff9e323228a952b`); other shared gates retain v0.1.2. The release caller checks main ancestry and reruns build, coverage, formatting, UI tests, security scans and CodeQL before publication.
 The AppKit dependency locks now match the published 0.1.0 packages. Before changing any package version, regenerate the affected locks and verify a locked restore with a clean package cache.
 
 ## Versioning and channels

docs/SESSION-STATE.md

@@ -4,6 +4,21 @@ Updated: 2026-10-12
 
 ## Release blockers after main merge - 2026-10-12
 
+Standards PR44 was personally reviewed by the owner and merged atb3e4b49.
+Its version/changelog-only release PR42 merged at96cbdf2; signedv1.1.1 was pushed
+and release CI38322016784 is running. The app caller now pins that exact builder.
+No new Azure administration or credentials are required.
+
+App PR37's first hosted run completed111 published tests:110 passed, one literal
+keyboard assertion observedjk instead ofjkg. The test now waits for the exactjkg
+value within its existing10-second deadline before retaining the same assertion.
+FlaUI5.0.0's UntilInputIsProcessed is only a100ms sleep, not an acknowledgement.
+The exact test is also included in the focused hosted regression job. Builds and
+formatting pass; hosted verification remains required. Local baseline and changed
+runs both stopped earlier at missing FindText, so they do not verify thejkg fix.
+Temporary diagnostics were removed. Original preview processes/profiles remain
+untouched. Fresh exact-head hosted acceptance must pass before merge/publication.
+
 The owner-reviewed application merged through PR35 at38dd5c1. Main CI38294895221
 passed; retained published111 and installed stable/dev110 reports have zero
 failures/skips. OpenSSF project15417 assessment is saved at70%, not passing.

docs/TODO.md

@@ -9,7 +9,10 @@
 - [x] Reproduce signing dependency conflict; standards PR44 real package bootstrap and40 signing tests pass locally.
 - [x] Measure stable retry110/111 without reported test failures before600-second limit; prepare bounded900-second suite budget with unchanged assertions/deadlines.
 - [ ] Obtain genuine reviews, pass exact-head hosted checks and merge the release fixes.
-- [ ] Update the app caller to the reviewed fixed builder's immutable SHA.
+- [x] Owner personally reviewed standards PR44; merge the signing fix and version-only PR42 through normal protections, then push signedstandards1.1.1.
+- [x] Update the app caller to fixed builder96cbdf2; preserve caller NuGet mapping and strict signing verification.
+- [x] Keep the exactjkg assertion while awaiting native text processing within its existing deadline; add the case to focused hosted regressions.
+- [ ] Verify fresh full hosted acceptance and obtain genuine final-head app review before merge.
 - [ ] Publish stable/dev EXE and ZIP candidates; verify exact distributed signatures, timestamps, hashes, SBOMs and attestations (#33).
 - [ ] Update user download links only after actual verified publication.
 - [ ] Deliver signed and acceptance-tested MSI installers in the next release (#36), following the owner's latest decision.

docs/release-signing.md

@@ -35,8 +35,8 @@ signing service. Never export a PFX or put administrative passwords in CI.
 
 ## Enable the reviewed builder
 
-The release caller pins standards v1.1.0 at
-`93b1d6163a4c466ae443e98b62786fc4d80d33bd`. Its reviewed builder supports the
+The release caller pins standards v1.1.1 at
+`96cbdf208a15c9c524676bd15ff9e323228a952b`. Its reviewed builder supports the
 explicit ownership catalog and verifies final shipped bytes/signatures. The
 configured catalog is:
 

tests/MarkdownViewr.Windows.UiTests/AppTests.cs

@@ -1032,6 +1032,8 @@ public partial class AppTests
       SendReadingKey(VirtualKeyShort.KEY_J);
       SendReadingKey(VirtualKeyShort.KEY_K);
       SendReadingKey(VirtualKeyShort.KEY_G);
+      // FlaUI's input helper sleeps briefly; it does not acknowledge native text processing.
+      session.WaitFor(() => string.Equals(query.AsTextBox().Text, "jkg", StringComparison.Ordinal) ? query : null, "the complete literal keyboard query 'jkg'");
       Assert.Equal("jkg", query.AsTextBox().Text);
       WaitForFindCount(session, "0 of 0");
       Assert.True(scroller.Patterns.Scroll.Pattern.VerticalScrollPercent.Value < 10);