fix(releases): pin corrected signing builder and prepare downloads (#39)

Both1.0.1 release candidates passed acceptance and Azure login but
stopped before signing because of the shared inline PowerShell wrapper.
Pin the corrected, personally approved standards1.1.2 builder at083d903.
Preserve failed tags; use new1.0.2 stable/dev refs, prepare direct
EXE/ZIP download links, correct portable-update guidance and developer
verification links, and set the next development prefix to1.0.3.
Application behavior remains the reviewed and fully accepted PR37
source.

Validation: five actual Markdown files pass canonical lint; actionlint
and signed-commit hooks pass. Exact-head full hosted checks are running.
Production publication and downloaded-artifact signature/provenance
verification remain required. MSI remains next release per the owner's
latest decision. OpenSSF remains70%, not passing.

The owner expressly authorized completion without further human-review
requests. This is a release-specific waiver, not a fabricated
personal-read acknowledgement. Preserve all technical/security/signature
gates. Substantial AI assistance: Codex GPT-6. Refs #33, #34 and
KofTwentyTwo/standards#45.

---------

Signed-off-by: James Maes <james@kof22.com>
Co-authored-by: Codex GPT-6 <noreply@openai.com>

.github/workflows/ci.yml

@@ -44,7 +44,7 @@ jobs:
         shell: pwsh
         run: >-
           dotnet test tests/MarkdownViewr.Windows.UiTests --no-build
-          --filter 'FullyQualifiedName~SourceHighlighting|FullyQualifiedName~Settings_NewWindowPanelDefaults|FullyQualifiedName~Settings_ContentsPresentation|FullyQualifiedName~Settings_ContentsTooltip|FullyQualifiedName~Themes_PalettePreviewAndDefaultChoice|FullyQualifiedName~Settings_PrintingDefaults|FullyQualifiedName~Settings_PrintingDraft|FullyQualifiedName~ThemeTransfer_NativePickerCancels|FullyQualifiedName~Print_UserWidthAndBorders|FullyQualifiedName~ReadingKeys_ScrollCommands|FullyQualifiedName~Source_ShowReloadAndHide|FullyQualifiedName~ThemeEditor_AllTypography|FullyQualifiedName~ThemeEditor_NewCustomTheme|FullyQualifiedName~Appearance_WidthCssAndPrint|FullyQualifiedName~Toolbar_ReadingCommandsAndMenus|FullyQualifiedName~Toolbar_EditorAndPrint|FullyQualifiedName~ThemeTransfer_BatchFutureInvalidAndDisabledExport|FullyQualifiedName~ReadingKeys_HeadingSequences|FullyQualifiedName~Source_BidirectionalScroll|FullyQualifiedName~Source_RawHtmlHeadingProvenance|FullyQualifiedName~Extensions_NativePreferences|FullyQualifiedName~Windows_LocalDocumentLinks|FullyQualifiedName~ActivationInboxTests|FullyQualifiedName~Outline_NestedCollapse'
+          --filter 'FullyQualifiedName~SourceHighlighting|FullyQualifiedName~Settings_NewWindowPanelDefaults|FullyQualifiedName~Settings_ContentsPresentation|FullyQualifiedName~Settings_ContentsTooltip|FullyQualifiedName~Themes_PalettePreviewAndDefaultChoice|FullyQualifiedName~Settings_PrintingDefaults|FullyQualifiedName~Settings_PrintingDraft|FullyQualifiedName~ThemeTransfer_NativePickerCancels|FullyQualifiedName~Print_UserWidthAndBorders|FullyQualifiedName~ReadingKeys_ScrollCommands|FullyQualifiedName~ReadingKeys_FindAndTextFocus|FullyQualifiedName~Source_ShowReloadAndHide|FullyQualifiedName~ThemeEditor_AllTypography|FullyQualifiedName~ThemeEditor_NewCustomTheme|FullyQualifiedName~Appearance_WidthCssAndPrint|FullyQualifiedName~Toolbar_ReadingCommandsAndMenus|FullyQualifiedName~Toolbar_EditorAndPrint|FullyQualifiedName~ThemeTransfer_BatchFutureInvalidAndDisabledExport|FullyQualifiedName~ReadingKeys_HeadingSequences|FullyQualifiedName~Source_BidirectionalScroll|FullyQualifiedName~Source_RawHtmlHeadingProvenance|FullyQualifiedName~Extensions_NativePreferences|FullyQualifiedName~Windows_LocalDocumentLinks|FullyQualifiedName~ActivationInboxTests|FullyQualifiedName~Outline_NestedCollapse'
           --logger 'trx;LogFileName=reader-regressions.trx'
           --results-directory artifacts/reader-regressions
       - name: Retain native regression evidence
@@ -63,7 +63,8 @@ jobs:
   installed-updates:
     name: installed-updates
     runs-on: windows-latest
-    timeout-minutes: 45
+    # Three complete UI suites plus packaging, installation and update probes.
+    timeout-minutes: 60
     permissions:
       contents: read
     steps:

.github/workflows/release.yml

@@ -95,7 +95,7 @@ jobs:
 
   release:
     needs: [verify, gates, security, codeql, scripts, fuzzing]
-    uses: KofTwentyTwo/standards/.github/workflows/release-velopack.yml@93b1d6163a4c466ae443e98b62786fc4d80d33bd # v1.1.0
+    uses: KofTwentyTwo/standards/.github/workflows/release-velopack.yml@083d90326a8f3b750d840b6180e00870ee1342f5 # v1.1.2
     permissions:
       contents: write      # create and publish the GitHub release
       id-token: write      # sign attestations; Azure OIDC when signing

Directory.Build.props

@@ -54,7 +54,7 @@
         commit as "+<sha>" on AssemblyInformationalVersion, which the About dialog and the
         CLI's version output show as a short hash. -->
    <PropertyGroup>
-      <VersionPrefix>1.0.0</VersionPrefix>
+      <VersionPrefix>1.0.3</VersionPrefix>
       <VersionSuffix>dev</VersionSuffix>
    </PropertyGroup>
 

README.md

@@ -4,9 +4,7 @@ Read Markdown comfortably, keep up with changes, and turn your notes into someth
 
 MarkdownViewr is a dedicated Windows reader for project documentation, notes, and README files. Open a document, choose a look you like, and focus on the words.
 
-**[Release downloads](https://github.com/KofTwentyTwo/MarkdownViewr.Windows/releases) · [User guide](docs/user-guide.md) · [Ask a question](https://github.com/KofTwentyTwo/MarkdownViewr.Windows/discussions)**
-
-> The first Windows release is being prepared. There are no published Windows downloads yet; the Releases page will contain the stable installer and development previews when publication completes.
+**[Download Windows installer](https://github.com/KofTwentyTwo/MarkdownViewr.Windows/releases/latest/download/markdownviewr-windows-stable-Setup.exe) · [User guide](docs/user-guide.md) · [Ask a question](https://github.com/KofTwentyTwo/MarkdownViewr.Windows/discussions)**
 
 [![License: MIT](https://img.shields.io/badge/license-MIT-green)](LICENSE)
 [![OpenSSF Best Practices](https://www.bestpractices.dev/projects/15417/badge)](https://www.bestpractices.dev/en/projects/15417)
@@ -29,17 +27,17 @@ Contents and Source start hidden. Turn them on when needed, or change their new-
 
 ## Download and install
 
-The planned Windows packages support **Windows 10 version 1809 or later and Windows 11, x64**. Microsoft Edge WebView2 Runtime is required. No .NET SDK is needed to use a release.
+Windows packages support **Windows 10 version 1809 or later and Windows 11, x64**. Microsoft Edge WebView2 Runtime is required. No .NET SDK is needed to use a release.
 
 | Edition | Choose it for | Package |
 | --- | --- | --- |
-| Stable | Everyday reading | `markdownviewr-windows-stable-Setup.exe` |
-| Development preview | Trying upcoming changes | `markdownviewr-windows-dev-Setup.exe` |
-| Portable | Running without installation | `markdownviewr-windows-stable-Portable.zip` |
+| Stable | Everyday reading | [Download EXE installer](https://github.com/KofTwentyTwo/MarkdownViewr.Windows/releases/latest/download/markdownviewr-windows-stable-Setup.exe) |
+| Development preview | Trying upcoming changes | [Download dev EXE installer](https://github.com/KofTwentyTwo/MarkdownViewr.Windows/releases/download/v1.0.2-beta.1/markdownviewr-windows-dev-dev-Setup.exe) |
+| Portable | Running without installation | [Download portable ZIP](https://github.com/KofTwentyTwo/MarkdownViewr.Windows/releases/latest/download/markdownviewr-windows-stable-Portable.zip) |
 
-Once available, download a package from [Releases](https://github.com/KofTwentyTwo/MarkdownViewr.Windows/releases). Run Setup for a per-user installation without administrator rights, or extract the portable ZIP before launching the app.
+Download a package from [Releases](https://github.com/KofTwentyTwo/MarkdownViewr.Windows/releases). Run Setup for a per-user installation without administrator rights, or extract the portable ZIP before launching the app.
 
-Installed editions check for updates through **Help → Check for updates**. Stable and development editions keep separate settings and update channels, so they can coexist. Portable copies do not self-update.
+Installed and portable editions check for updates through **Help → Check for updates**. Stable and development editions keep separate settings and update channels, so they can coexist.
 
 ## Quick start
 

SECURITY.md

@@ -50,11 +50,10 @@ minor receives security fixes for 6 months.
 
 Public Windows releases require Authenticode signing of the final shipped binaries
 and installers. Publication fails closed until the approved Azure signing identity
-and expected publisher, trust and timestamp are verified. No verified signed
-MarkdownViewr release has been published yet; unsigned test fixtures are not releases.
+and expected publisher, trust and timestamp are verified. Unsigned test fixtures are not releases.
 
 Verify final signatures, `SHA256SUMS` and provenance attestations as described in the
-[README](README.md#verifying-a-release) and
+[Developer Guide](DEVELOPERS.md#releases-and-verification) and
 [release signing instructions](docs/release-signing.md). No historical exception
 is claimed as permission to publish unsigned application releases.
 

build/GitHubRepository.Tests.ps1

@@ -47,17 +47,17 @@ Describe 'Required checks match standalone workflow jobs' `
 
 Describe 'Generated repository administration' `
 {
-   It 'allows the digest-pinned security containers without permitting arbitrary container actions' `
+   It 'allows the digest-pinned security and SBOM containers without permitting arbitrary container actions' `
    {
       $plan = Get-GitHubRepositoryPlan -Repository 'Example/Notes'
       $policy = ($plan.Requests | Where-Object Path -Like '*/actions/permissions/selected-actions').Body
-      $policy.patterns_allowed.Count | Should -Be 3
+      $policy.patterns_allowed.Count | Should -Be 4
       $policy.patterns_allowed | Should -Contain 'KofTwentyTwo/standards/*@*'
       $containers = @($policy.patterns_allowed | Where-Object { $_.StartsWith('docker://', [StringComparison]::Ordinal) })
-      $containers.Count | Should -Be 2
+      $containers.Count | Should -Be 3
       foreach($container in $containers)
       {
-         $container | Should -Match '^docker://ghcr\.io/(gitleaks/gitleaks:v8\.30\.1|aquasecurity/trivy:0\.75\.0)@sha256:[0-9a-f]{64}$'
+         $container | Should -Match '^docker://ghcr\.io/(gitleaks/gitleaks:v8\.30\.1|aquasecurity/trivy:0\.75\.0|anchore/syft:v1\.54\.1)@sha256:[0-9a-f]{64}$'
          $container | Should -Not -Match '\*'
       }
    }

build/GitHubRepository.psm1

@@ -79,7 +79,8 @@ function Get-GitHubRepositoryPlan
             # Exact container actions used by the published v0.1.2 security builder.
             patterns_allowed = @('KofTwentyTwo/standards/*@*',
                'docker://ghcr.io/gitleaks/gitleaks:v8.30.1@sha256:c00b6bd0aeb3071cbcb79009cb16a60dd9e0a7c60e2be9ab65d25e6bc8abbb7f',
-               'docker://ghcr.io/aquasecurity/trivy:0.75.0@sha256:af6acf9a6b85dfe389a1941505c0ce9efef52a4719635e1a962f022a3d855daa')
+               'docker://ghcr.io/aquasecurity/trivy:0.75.0@sha256:af6acf9a6b85dfe389a1941505c0ce9efef52a4719635e1a962f022a3d855daa',
+               'docker://ghcr.io/anchore/syft:v1.54.1@sha256:3eb5379ba7b409c3f4069b686110527af0c47df993fa5c10d13e7cf34f49b1aa')
          }
       },
       @{ Method = 'PUT'; Path = "$root/environments/release"; Body = @{ deployment_branch_policy = @{ protected_branches = $false; custom_branch_policies = $true } } },

build/InstalledUpdates.Tests.ps1

@@ -13,11 +13,27 @@ Describe 'Installed update smoke boundaries' `
       $script:SmokeArtifacts = Join-Path (Split-Path -Parent $PSScriptRoot) 'artifacts'
       $script:SmokeAppId = [regex]::Match((Get-Content -LiteralPath (Join-Path (Split-Path -Parent $PSScriptRoot) 'src/MarkdownViewr.Windows.Core/AppIdentity.cs') -Raw), '(?m)^\s*Id\s*=\s*"([a-z0-9][a-z0-9-]*)"').Groups[1].Value
       $ast = [Management.Automation.Language.Parser]::ParseFile($script:SmokeHarness, [ref]$null, [ref]$null)
-      foreach($name in @('Assert-SmokeCliVersion', 'Get-SmokeDefaultChoiceSnapshot', 'Get-SmokeFileRegistration', 'Assert-SmokeFileRegistrationRemoved', 'Assert-SmokeInstallationOwner'))
+      foreach($name in @('Assert-SmokeCliVersion', 'Get-SmokeDefaultChoiceSnapshot', 'Get-SmokeFileRegistration', 'Assert-SmokeFileRegistrationRemoved', 'Assert-SmokeInstallationOwner', 'Invoke-SmokeProcess'))
       {
          $function = $ast.Find({ param($node) $node -is [Management.Automation.Language.FunctionDefinitionAst] -and $node.Name -eq $name }, $true)
          . ([scriptblock]::Create($function.Extent.Text))
       }
+      $script:repositoryRoot = $TestDrive
+      $script:outputRoot = $TestDrive
+      $script:vpk = 'not-a-fixture-tool'
+      $script:smokeProcessNumber = 0
+   }
+
+   It 'terminates a hung child process and fails the smoke gate' `
+   {
+      $shell = (Get-Process -Id $PID).Path
+      { Invoke-SmokeProcess -File $shell -Arguments @('-NoProfile', '-Command', 'Start-Sleep -Seconds 30') -TimeoutSeconds 1 } | Should -Throw '*Process timed out*'
+   }
+
+   It 'rejects a failing child process and retains its output' `
+   {
+      $shell = (Get-Process -Id $PID).Path
+      { Invoke-SmokeProcess -File $shell -Arguments @('-NoProfile', '-Command', "Write-Output 'fixture failure'; exit 7") -TimeoutSeconds 10 } | Should -Throw '*Process failed (7)*fixture failure*'
    }
 
    It 'requires an actual matching manifest inside the resolved artifact boundary before uninstall' `

build/Test-InstalledUpdates.ps1

@@ -435,7 +435,9 @@ try
    $env:K22_UITEST_CHANNEL = 'stable'
    $env:K22_UITEST_INSTALLED = '0'
    $env:K22_UITEST_EXE = Join-Path $buildRoot "publish/0.1.0/$mainExe"
-   Invoke-SmokeProcess -File 'dotnet' -Arguments @('test', "$repositoryRoot/tests/$name.UiTests", '--no-build', '--logger', 'console;verbosity=normal', '--logger', 'trx;LogFileName=published-ui.trx', '--results-directory', $outputRoot) -TimeoutSeconds 600
+   # The full 111-test UI suite takes 572 seconds on a passing hosted runner.
+   # Allow bounded host variation without changing any individual test deadline.
+   Invoke-SmokeProcess -File 'dotnet' -Arguments @('test', "$repositoryRoot/tests/$name.UiTests", '--no-build', '--logger', 'console;verbosity=normal', '--logger', 'trx;LogFileName=published-ui.trx', '--results-directory', $outputRoot) -TimeoutSeconds 900
    foreach($initial in @($versions[0], $versions[2]))
    {
       $initialPackageId = $packageId + '-' + $initial.channel
@@ -500,7 +502,7 @@ try
          $updatedRegistration | ConvertTo-Json | Set-Content -LiteralPath (Join-Path $outputRoot "$channel-registration-after.json")
          $env:K22_UITEST_INSTALLED = '1'
          $env:K22_UITEST_EXE = $currentExe
-         Invoke-SmokeProcess -File 'dotnet' -Arguments @('test', "$repositoryRoot/tests/$name.UiTests", '--no-build', '--filter', 'FullyQualifiedName!~CheckForUpdates_InALooseBuild', '--logger', 'console;verbosity=normal', '--logger', "trx;LogFileName=installed-$channel-ui.trx", '--results-directory', $outputRoot) -TimeoutSeconds 600
+         Invoke-SmokeProcess -File 'dotnet' -Arguments @('test', "$repositoryRoot/tests/$name.UiTests", '--no-build', '--filter', 'FullyQualifiedName!~CheckForUpdates_InALooseBuild', '--logger', 'console;verbosity=normal', '--logger', "trx;LogFileName=installed-$channel-ui.trx", '--results-directory', $outputRoot) -TimeoutSeconds 900
          $records.Add(@{ kind = 'installed'; channel = $channel; before = $before; after = $after; restarted = $true; appSha256 = $installedHash })
       }
       finally

docs/RELEASING.md

@@ -7,7 +7,7 @@ which calls the shared `release-velopack.yml` workflow in KofTwentyTwo/standards
 
 ## Workflow baseline
 
-The signing release builder is pinned to standards v1.1.0 (`93b1d6163a4c466ae443e98b62786fc4d80d33bd`); other shared gates retain v0.1.2. The release caller checks main ancestry and reruns build, coverage, formatting, UI tests, security scans and CodeQL before publication.
+The signing release builder is pinned to standards v1.1.1 (`96cbdf208a15c9c524676bd15ff9e323228a952b`); other shared gates retain v0.1.2. The release caller checks main ancestry and reruns build, coverage, formatting, UI tests, security scans and CodeQL before publication.
 The AppKit dependency locks now match the published 0.1.0 packages. Before changing any package version, regenerate the affected locks and verify a locked restore with a clean package cache.
 
 ## Versioning and channels

docs/SESSION-STATE.md

@@ -1,6 +1,36 @@
 # Session State
 
-Updated: 2026-10-12
+Updated: 2026-10-13
+
+## Release source and verification
+
+Application behavior remains the owner-reviewed PR37 source at main4c0ccc7.
+Actual focused30, native111, published111 and installed stable/dev110 reports
+have zero failures/skips. Unchanged-source main validation38325540268 attempt2
+also passes published111 and installed stable/dev110 each. Update/restart,
+channel coexistence, registration and preservation of defaults are verified.
+
+The signing caller pins standards1.1.2 at
+083d90326a8f3b750d840b6180e00870ee1342f5. Personally approved PR45 corrects the
+GitHub pwsh bootstrap wrapper; all hosted signing checks pass. Caller NuGet
+mapping, Azure trust scopes and strict publisher/signature gates are unchanged.
+No new Azure administration is required.
+
+Preserve the failed1.0.0 and1.0.1 stable/dev tags. New candidates are
+1.0.2/stable and1.0.2-beta.1/dev. Production status and exact shipped-artifact
+proof belong in [release checklist](https://github.com/KofTwentyTwo/MarkdownViewr.Windows/issues/33)
+and [GitHub Releases](https://github.com/KofTwentyTwo/MarkdownViewr.Windows/releases).
+Require successful signing and verification of exact downloaded bytes before
+claiming a signed public release.
+
+The maintainer authorized release without further human-review requests on
+2026-10-13. Record this as an explicit release-specific waiver, never as a claim
+that an unseen change was personally read. Automated review and technical CI
+remain required. The next development prefix is1.0.3. EXE/ZIP publication comes
+first; MSI is tracked for the following release in issue36. OpenSSF15417 remains
+70%, not passing. Preserve original owner previews/profiles and unrelated work.
+
+## Historical release snapshots
 
 ## Current release status - 2026-10-12
 

docs/TODO.md

@@ -1,6 +1,20 @@
 # Development Tasks
 
-## Current release checklist
+## Release and follow-up work
+
+- [x] Merge reviewed PR37 at4c0ccc7; focused30/native111/published111/stable110/dev110 pass with no failures/skips.
+- [x] Merge personally approved signing-wrapper PR45 and metadata-only standards1.1.2 proposal; pin083d903 without changing NuGet mapping or Azure trust scopes.
+- [x] Preserve failed1.0.0 and1.0.1 stable/dev tags and prepare new1.0.2 candidates.
+- [x] Prepare direct download links, portable-update guidance and developer verification links.
+- [x] Set next development VersionPrefix to1.0.3.
+- [ ] Verify published standards1.1.2 bundle hashes/provenance and exact builder bytes.
+- [ ] Pass final exact-head CI, record automated review and the maintainer's explicit release-specific review waiver, and merge normally.
+- [ ] Publish signed stable/dev EXE installers and portable ZIPs; verify exact shipped signatures, publisher, trust, timestamps, checksums, SBOMs and provenance (#33).
+- Deliver signed, installed-acceptance-tested MSI installers next release (#36).
+- Reduce repeated validation while preserving trust and complete acceptance (#38).
+- Complete remaining OpenSSF evidence; saved70% is not a passing badge (#31).
+
+## Prior release checklist
 
 - [x] Correct the disabled-editor tooltip exception; accepted application code321816c.
 - [x] Final signing caller b1dc874 / CI38276579007 passes all hosted checks, including published111 and stable/dev110 acceptance each, zero failures/skips.

docs/release-signing.md

@@ -35,8 +35,8 @@ signing service. Never export a PFX or put administrative passwords in CI.
 
 ## Enable the reviewed builder
 
-The release caller pins standards v1.1.0 at
-`93b1d6163a4c466ae443e98b62786fc4d80d33bd`. Its reviewed builder supports the
+The release caller pins standards v1.1.1 at
+`96cbdf208a15c9c524676bd15ff9e323228a952b`. Its reviewed builder supports the
 explicit ownership catalog and verifies final shipped bytes/signatures. The
 configured catalog is:
 

docs/user-guide.md

@@ -60,7 +60,7 @@ The installer preserves your current defaults. Windows requires you to choose th
 
 ## Updates and local data
 
-Installed stable and development editions update within their own channels using **Help → Check for updates**. They have separate settings, recent files, and logs. Portable copies require a fresh download.
+Stable and development editions, including portable copies, update within their own channels using **Help → Check for updates**. They have separate settings, recent files, and logs.
 
 Settings and logs are stored locally under `%LOCALAPPDATA%\markdownviewr-windows` or `%LOCALAPPDATA%\markdownviewr-windows-dev`. **Help → Activity log** opens the log viewer and provides a shortcut to its folder.
 

tests/MarkdownViewr.Windows.UiTests/AppTests.cs

@@ -1032,6 +1032,8 @@ public partial class AppTests
       SendReadingKey(VirtualKeyShort.KEY_J);
       SendReadingKey(VirtualKeyShort.KEY_K);
       SendReadingKey(VirtualKeyShort.KEY_G);
+      // FlaUI's input helper sleeps briefly; it does not acknowledge native text processing.
+      session.WaitFor(() => string.Equals(query.AsTextBox().Text, "jkg", StringComparison.Ordinal) ? query : null, "the complete literal keyboard query 'jkg'");
       Assert.Equal("jkg", query.AsTextBox().Text);
       WaitForFindCount(session, "0 of 0");
       Assert.True(scroller.Patterns.Scroll.Pattern.VerticalScrollPercent.Value < 10);