# Veritas Kanban v6 GA Checklist

This checklist contains the active stable-release gate for Veritas Kanban
6.1.0 and retains the completed 6.0.2 evidence below. Command results, platform
details, workflow links, limitations, and artifact hashes belong in
[v6 Release Candidate Evidence Packet](V6-RC-EVIDENCE-PACKET.md).

Documentation freshness: 2026-07-26 for Veritas Kanban 6.1.0.

## 6.1.0 Active Release Gate

- [x] Roadmap issues #855, #864, #865, #866, #867, #868, #871, #872, #873,
      #876, and #879 are closed through merged pull requests.
- [x] Root, shared, server, web, CLI, MCP, and desktop manifests are 6.1.0.
- [x] README, canonical agent instructions, API/MCP references, compatibility
      policy, upgrade guide, release notes, and changelog agree on 6.1.0.
- [x] The reviewed GitHub release body exists at `docs/releases/v6.1.0.md` and
      passes the full-width release-format gate.
- [x] Focused verification passed for each roadmap slice before merge.
- [x] The milestone workspace suite is green. `pnpm test:unit` completed
      successfully across every workspace on the consolidated candidate;
      server reported 3,234 passing and 5 skipped tests, web reported 469
      passing tests, and desktop reported 67 passing tests.
- [ ] Required release-PR CI, production audit, lint, typecheck, build,
      compatibility smoke, and packaging gates pass on the reviewed candidate.
- [ ] The release PR merges, annotated `v6.1.0` tag and GitHub release publish,
      and the desktop workflow uploads signed/notarized assets and updater
      metadata.
- [ ] Independent download, signature, Gatekeeper, stapling, readiness,
      updater, GitHub release-body, and Homebrew cask verification pass.

## Final Release Validation Commands

Run once from the clean 6.1.0 release candidate:

```bash
pnpm install --frozen-lockfile
pnpm check:pnpm-settings
pnpm audit --prod --audit-level=high
pnpm lint
pnpm lint:budget
pnpm qa:mantine
pnpm typecheck
pnpm build
pnpm test:unit
pnpm test:e2e
pnpm smoke:cli-mcp
pnpm test:buzz:compatibility
pnpm desktop:test
pnpm desktop:build
pnpm desktop:check:electron-artifacts
pnpm desktop:smoke:mac:local
pnpm desktop:package:mac:unsigned
pnpm validate:release -- --version 6.1.0
pnpm validate:release -- --version 6.1.0 --docker-build
```

## Distribution And Post-Publication

Publish only after every active 6.1.0 gate above is checked. The canonical
GitHub body is `docs/releases/v6.1.0.md`; post-publication validation must run
`pnpm validate:release -- --version 6.1.0 --github --repo BradGroux/veritas-kanban`.
Update the Homebrew cask only from the independently verified published ZIP
checksum.

## Historical 6.0.2 Source And Scope

- [x] The Buzz integration epic and every required child are closed through
      merged, focused pull requests.
- [x] The equal-footing harness epic and every required child are closed
      through merged, focused pull requests.
- [x] The release tracker lists the exact main baseline, release branch, release
      PR, deferred v6.x work, and no unresolved release blocker.
- [x] Root, shared, server, web, CLI, MCP, and desktop manifests are 6.0.2.
- [x] `AGENTS.md`, README badge, health, CLI, MCP, desktop bundle, artifact
      names, updater metadata, changelog, and current docs agree on 6.0.2.
- [x] The public API remains intentionally `v1`, with additive v6 contracts and
      tested CLI/MCP compatibility.

## 6.0.1 Stabilization

- [x] Task drawers, shared overlays, Archive cards, scoring profiles, and
      template authoring have focused scroll, resize, compact-window, and
      keyboard coverage (#935, #938, #939, #941).
- [x] Workflow loading, route/task/overlay history, and scoring-profile
      creation have focused recovery and state-transition coverage
      (#936, #937, #943).
- [x] Operations Digest inventory, filters, exclusions, source IDs, window
      semantics, run de-duplication, and data quality reconcile in JSON,
      Markdown, scheduled snapshots, and UI tests (#944).
- [x] Chat has visible, Escape, browser Back, persisted-state, compact-window,
      and native menu recovery coverage; the independently downloaded signed
      app passes the same recovery checks (#945).
- [x] Desktop setup is version-neutral and the bridge consumes Electron's
      application version; the published bundle, health endpoint, updater, and
      bridge all report 6.0.1 (#986).

## 6.0.2 Desktop Recovery Hotfix

- [x] Board Chat and Squad Chat default to a bounded right-side Workbench dock
      and can switch between Right and Bottom without remounting the active
      conversation (#1004).
- [x] Chat width and height clamp to the live viewport; scrolling, wheel input,
      Close, Escape, browser Back, Reset Layout, persisted-state recovery, and
      focus restoration have focused coverage (#1004).
- [x] Native About, copied support information, the desktop bridge, and updater
      fallback consume one authoritative version/build/channel/OS/architecture
      record (#1005).
- [x] Pull-request verification uses documentation-only, focused, or full test
      scope, while explicit and milestone release gates remain full (#1000).
- [x] Published release notes are sourced from
      `docs/releases/vX.Y.Z.md`, use one full-width Markdown line per paragraph
      or list item, reject blockquotes and overlong prose blocks, and are
      compared with GitHub during post-publication validation. Run
      `pnpm test:release-format`, `pnpm validate:release`, and the
      post-publication `pnpm validate:release -- --github` check.

## Provider Certification

- [x] Buzz Agent v0.4.24 / `buzz-agent 0.1.0` passes the composed
      credential-free compatibility gate at the pinned commit and fixture
      revision.
- [x] Grok Build v0.2.111 build `94172f2aa4e5` passes exact-version ACP,
      restrictive-policy, source-limitation, and deterministic fixtures.
- [x] Codex app-server 0.145.0 passes exact generated schemas, disabled remote
      control, lifecycle, approval, event, completion, and deterministic
      fixtures.
- [x] Codex CLI and `@openai/codex-sdk 0.144.3` pass their provider-runtime,
      launch, tool, event, credential, and completion gates.
- [x] Claude Code 2.1.218 passes bare-mode launch, permission, environment,
      stream, lifecycle, MCP, event, completion, and deterministic fixtures.
- [x] GitHub Copilot CLI 1.0.74 passes exact ACP handshake, restrictive launch,
      preview/source-limit, and deterministic fixtures.
- [x] Hermes v2026.7.7.2 and OpenClaw v2026.6.11 retain truthful existing
      support and explicit unsupported controls.
- [x] Settings, API, `vk doctor --json`, dispatch, and telemetry report the same
      Detected, Configured, Certified, Degraded, or Unsupported state.
- [x] Every Certified claim has exact runtime/build and passing deterministic
      evidence. Credential-gated smoke is recorded separately; unavailable
      credentials, quota, subscriptions, binaries, and upstream services are
      reported rather than inferred.

## Security, Migration, And Data Preservation

- [x] Legacy provider profiles normalize only through exact built-in
      type/command identity and never fall through to OpenClaw.
- [x] Claude Code permission bypass is absent and unsafe custom launch controls
      fail closed.
- [x] Approval decisions bind to exact action, attempt, reviewer, expiry, and
      authentication freshness; replay and drift tests pass.
- [x] Credential definitions, leases, run catalogs, the `veritas-run` bridge,
      logs, telemetry, fixtures, and APIs remain value-free outside the
      one-shot downstream call.
- [x] Provider protocol frames, stdout/stderr, events, retries, timeouts, and
      retained payloads are bounded and redacted.
- [x] Required unsupported sandbox, network, tool, MCP, credential, lifecycle,
      and provider controls block before attempt mutation.
- [x] A populated v5.2.5 desktop workspace upgrades through an isolated copy
      with matching representative counts, `PRAGMA quick_check=ok`, preserved
      owner/profile metadata, preserved registry absence, and a working v6
      runtime. A separate exact-format v5.2.5 registry fixture verifies populated
      registry compatibility.
- [x] File-backed migration and restore paths pass their seven-test portability
      fixture.
- [x] Rollback guidance has been tested against the actual schema/profile
      posture and does not promise destructive down migration.
- [x] Secret and tracked-runtime-security scans pass.

## Application And Runtime

- [x] A clean dependency install and build produce new shared, server, web, CLI,
      MCP, and desktop outputs without reused `dist`, staged desktop payloads,
      or prior release artifacts.
- [x] An isolated in-app Browser run verifies first-run, login, provider and Buzz
      Settings, degraded states, themes, command-palette focus, and a clean
      console. Deterministic and E2E suites verify task launch, causal events,
      approvals, cancellation, completion, MCP, worktrees, telemetry, and Buzz
      mapping/replay under the maintainer-approved release-evidence split
      recorded in the evidence packet.
- [x] Dark/light themes, keyboard flow, labels, and focus are inspected in the
      in-app Browser; compact layout and recoverable error states pass the E2E
      matrix under the same evidence split.
- [x] A fresh native macOS build verifies one instance, visible window, bundled
      server/web health, menus, shortcuts, window restoration, update check,
      clean close, reopen, and quit.
- [x] The unsigned DMG/ZIP is inspected and the packaged app launches from the
      packaged artifact with an isolated profile.

## Mantine component-system cleanup gate

- [x] Run `pnpm --filter @veritas-kanban/web build` before the bundle check.
- [x] Run `pnpm qa:mantine`.
- [x] Run `pnpm test:e2e -- e2e/mantine-qa-gate.spec.ts`.
- [x] Retain visual and accessibility evidence for current routes, dark/light
      themes, compact widths, keyboard navigation, focus, labels, and touch
      targets.
- [x] Track planned but unavailable surfaces as temporary holdouts instead of
      claiming coverage.
- [x] No active feature imports legacy primitive compatibility wrappers outside
      documented internals.
- [x] No direct shadcn/Radix dependency or vendor-radix bundle returns.
- [x] Bundle sizes remain within the recorded QA budgets or have an explicit
      release-risk acceptance.

## Historical 6.0.2 Final Release Validation Commands

Run from the clean release-candidate worktree:

```bash
node --version
pnpm --version
git --version
pnpm install --frozen-lockfile
pnpm check:pnpm-settings
pnpm audit --prod --audit-level=high
pnpm lint
pnpm lint:budget
pnpm qa:mantine
pnpm typecheck
pnpm build
pnpm test:unit
pnpm test:e2e
pnpm smoke:cli-mcp
pnpm test:buzz:compatibility
pnpm desktop:test
pnpm desktop:build
pnpm desktop:check:electron-artifacts
pnpm desktop:smoke:mac:local
pnpm desktop:package:mac:unsigned
pnpm validate:release -- --version 6.0.2
pnpm validate:release -- --version 6.0.2 --docker-build
```

Provider-specific deterministic suites are part of `pnpm test:unit`; record
their test counts and exact fixture baselines separately. Run credential-gated
provider smoke only when the exact binary, authentication, subscription, and
quota are available.

## Historical 6.0.2 Distribution And Post-Publication

- [x] The ready release PR passes required CI and the milestone-wide workspace
      suite, then merges to main.
- [x] Annotated tag `v6.0.2` peels to the exact release merge commit.
- [x] The GitHub release is published from reviewed
      `docs/releases/v6.0.2.md` without hard-wrapped prose.
- [x] Desktop Release completes with signed/notarized arm64 DMG and ZIP,
      blockmaps, `latest-mac.yml`, and SHA-256 sidecars.
- [x] Independent downloads match GitHub digests, sidecars, updater metadata,
      byte sizes, and SHA-256 values.
- [x] DMG and ZIP app signatures, hardened runtime, Gatekeeper, and notarization
      stapling pass.
- [x] The downloaded signed app launches with an isolated profile, reports
      6.0.2 through bundle, health, updater, native About, copied support
      information, and desktop bridge metadata; verifies Right and Bottom Chat
      recovery at the minimum supported window; executes a bounded task; and
      quits cleanly.
- [x] `pnpm validate:release -- --version 6.0.2 --github --repo BradGroux/veritas-kanban`
      passes.
- [x] The Homebrew cask PR uses the published ZIP checksum, merges, and the
      registered tap passes style, strict online audit, dry-run install, and
      livecheck.
- [x] The evidence packet contains release/workflow/asset/Homebrew links,
      exact hashes, runtime results, limitations, and deferred v6.x issues.
- [x] The release tracker closes only after every distribution surface above is
      independently verified.
