feat(releases): ship MSI and reuse exact-source CI proof #40
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: KofTwentyTwo/MarkdownViewr.Windows#40
Reference in new issue
Block a user
Stable1.0.2 and dev1.0.2-beta.1 EXEs/ZIPs are public and their actual downloaded signatures, timestamps, payloads, hashes, SBOM/provenance and updater feeds verify. Complete the owner's renewed MSI request by pinning standards1.2.0 at0ef3d319, enabling signed per-user MSI alongside EXE/ZIP, preparing1.0.3 channel links and next development prefix1.0.4.
Stop duplicate release validation: a tag must be on main, have a verified source signature, match the entire genuinely merged PR Git tree, and reuse that head's latest successful required technical checks under their configured provider identities. Missing, failed, stale, pending or different-tree proof fails publication. All branch technical gates remain required; fresh release build/core coverage, signing, exact MSI payload/native lifecycle and distribution/SBOM/provenance checks remain required. Application behavior/dependencies/Azure trust are unchanged.
Validation: all8 script tests pass (including10 release-proof boundary cases), live source proof verifies all17 genuine checks on the actual published18d8ae9 tree, five actual documents pass canonical lint, actionlint/zizmor and signed commit hooks pass. Exact-head full CI starts with this PR; production signed MSI lifecycle is still required before delivery. No claim of published MSI yet.
Owner explicitly authorized release without further human-review requests. Record a truthful release-specific waiver; never fabricate personal-read acknowledgement; restore original rules immediately after the bounded merge. Substantial AI assistance: Codex GPT-6. Refs #33,#36,#38 and KofTwentyTwo/standards#47.
Automated review of exact4c0b99d65f11ef116e974c85a9ae71a9e0596013 (Codex): no findings identified. Pin published/verified standards1.2.1, enable native signed MSI, validate genuine exact-tree/provider-bound source CI and preserve fresh build/signing/MSI lifecycle/distribution gates. The observed test snapshot race now waits for the explicitly requested sibling ShowSource=true save before capturing the complete settings snapshot, retaining all equality assertions and the existing bounded deadline. npm actual lint/all8 tests and local test build0warnings/errors pass. Full exact-head source CI is running; no production MSI delivery claimed yet.
The maintainer explicitly instructed "no more human review re - get this released" and renewed EXE+MSI delivery. Record this as a release-specific waiver, not a personal-read claim. The bounded merge helper retains all17 technical checks and restores the complete18-check rule immediately afterward. Existing1.0.2 signed EXEs/ZIPs are public and actual downloads strictly verify. Live pipeline38568 will complete MSI publication only after source CI and actual signed MSI lifecycle/distribution proofs succeed.