# Veritas Kanban v6 Release Candidate Evidence Packet

This packet records the active Veritas Kanban 6.1.2 audit release candidate and
retains historical evidence for the completed 6.1.1 and 6.1.0 releases, the quarantined 6.0.0 prerelease, the 6.0.1
stabilization release, and the 6.0.2 desktop recovery hotfix. It separates
merged implementation, deterministic conformance, local runtime proof, signed
publication, and Homebrew availability.

Veritas Kanban 6.1.1 remains the supported stable v6 release until 6.1.2 is
published and verified. Do not use 6.0.0 for installation or upgrade validation.

Documentation freshness: 2026-08-24 for the Veritas Kanban 6.1.2 candidate.

## 6.1.2 Audit Release Candidate

| Field                    | Value                                                                                                                                                                                                                                              |
| ------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Release version          | 6.1.2                                                                                                                                                                                                                                              |
| Source branch            | `release/6.1.2-audit`                                                                                                                                                                                                                              |
| Source baseline          | `3851fea93ecfe5119e4092739662443d29059ac7`, `main` after release-gate fix PR #1243                                                                                                                                                                 |
| Validated candidate      | `2a21178df97a00395cfc6c43774a57496a5c1f6a`, the frozen release PR head before this evidence-only update                                                                                                                                            |
| Included issues          | Audit tracker [#1174](https://github.com/BradGroux/veritas-kanban/issues/1174), findings #1162-#1173, and CodeQL baseline #1231                                                                                                                    |
| Public implementation    | #1162, #1163, and #1165-#1173 are closed through merged work; #1164 implementation is merged and remains open only for final regression evidence; coordinated remediation and release-gate fixes are merged through #1236, #1239, #1241, and #1243 |
| Private security blocker | Remediation is integrated into the candidate. Release verification and disclosure disposition remain pending, and no exploit-relevant detail is included here                                                                                      |
| Publication state        | Not published. The final matrix is complete on the frozen candidate; merge, tag, GitHub release, signed desktop workflow, Homebrew cask, and advisory disposition remain pending                                                                   |

### 6.1.2 issue and pull request traceability

| Phase                | Issue                                                           | Merged evidence            |
| -------------------- | --------------------------------------------------------------- | -------------------------- |
| Verification         | #1172 deterministic and milestone-scoped test gates             | #1175, #1177, #1181, #1228 |
| Verification         | #1171 native-loader Vite/Vitest configuration                   | #1178                      |
| Supply chain         | #1167 immutable actions                                         | #1179                      |
| Security gates       | #1168 continuous scanning                                       | #1180                      |
| Coverage             | #1169 critical-path baselines and ratchets                      | #1183                      |
| Runtime paths        | #1162 canonical `DATA_DIR` behavior                             | #1184                      |
| Persistence          | #1163 storage boundary restoration                              | #1190-#1220                |
| Provider runtime     | #1164 lifecycle and provider decomposition                      | #1223-#1230                |
| Frontend API         | #1165 credential-aware requests                                 | #1218                      |
| Dependencies         | #1170 unused direct dependencies                                | #1217                      |
| Container            | #1166 production runtime and size contract                      | #1222                      |
| Type safety          | #1173 lint-debt ratchet                                         | #1221                      |
| CodeQL baseline      | #1231 initial alert triage, remediation, and disposition        | #1232-#1235                |
| Coordinated security | Private release blocker integrated without premature disclosure | #1236                      |
| Release validation   | Recovery-key alphabet and WebSocket header forwarding           | #1238, #1239               |
| Release validation   | Same-task lifecycle invocation ordering                         | #1240, #1241               |
| Release validation   | Sanitized URI prefix validation                                 | #1242, #1243               |

The initial CodeQL baseline contained 195 open alerts. All were reviewed: 67
were closed through source remediation and 128 received specific,
evidence-backed dispositions. The post-merge default-branch Security Gates run
[`32700390853`](https://github.com/BradGroux/veritas-kanban/actions/runs/32700390853)
completed successfully at `1cdcd6ec60e3f48b6017146b2583fa82f7061c68`
with zero open alerts.

The 2026-08-24 pre-release GitHub security readback confirms Dependabot
vulnerability alerts and security updates are enabled, secret scanning and
push protection are enabled, and open Dependabot, secret-scanning, and
default-branch CodeQL alert counts are all zero. Every external workflow action
reference is pinned to a full commit SHA. These drift-prone settings are
rechecked against the final release merge before publication.

Final-milestone preflight on 2026-08-24 found local Node 26.7.0, pnpm 11.1.1,
Git 2.55.0, and an available Docker 29.2.1 server. The Node 22 floor remains
the `ci:full` runner gate; no separate local Node 22 installation is present.
The required macOS signing secret names and the complete App Store Connect
notarization secret-name set are configured, without reading their values. No
Veritas Kanban app or Homebrew cask is currently installed on the validation
host, so the post-publication installation will not replace an active install.

### 6.1.2 verification matrix

The final matrix ran once on the fully integrated candidate. The checked-in
evidence update is documentation-only and does not alter the validated runtime.

| Gate                                                                                      | Environment                                                                                                                       | Candidate result                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
| ----------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| Frozen install, package-manager, security-artifact, delivery-cadence, and CI-scope policy | Local Node 26.7.0 and CI Node 22; pnpm 11.1.1                                                                                     | Pass. Frozen install completed; package-manager, 1,864-file security-artifact, 18/18 delivery-cadence, and 18/18 CI-scope gates passed                                                                                                                                                                                                                                                                                                                             |
| Typecheck, lint, 458-warning budget, lint report, production/full audit, and gitleaks     | Local Node 26.7.0 and CI Node 22                                                                                                  | Pass. Typecheck and lint completed with zero errors and the exact 458-warning budget; production and full audits found no known vulnerabilities; gitleaks passed                                                                                                                                                                                                                                                                                                   |
| Workspace and orchestration units                                                         | Local clean worktree and [CI run 32732019845](https://github.com/BradGroux/veritas-kanban/actions/runs/32732019845)               | Pass. Local workspace packages reported 4,289 passed and 24 skipped, plus 3/3 root orchestration tests. CI independently reported server 3,376 passed/5 skipped, web 780 passed, CLI 62 passed, MCP 71 passed/19 skipped, and dual-storage parity 4/4                                                                                                                                                                                                              |
| Critical-path coverage ratchets                                                           | CI Node 22 on frozen candidate                                                                                                    | Pass. All seven boundaries passed: server dispatch 65.2% lines, auth 59.05%, storage 50.45%, web 55.25%, CLI 52.07%, MCP 52.39%, and desktop 66.24%; [coverage artifact](https://github.com/BradGroux/veritas-kanban/actions/runs/32732019845/artifacts/9521857932) SHA-256 `395ae4aef57b8dcb24eabe2ad2ac628f8bbe51564195b7525e5c2be57613a096`                                                                                                                     |
| Playwright Chromium and WebKit                                                            | [Scheduled QA run 32732019821](https://github.com/BradGroux/veritas-kanban/actions/runs/32732019821)                              | Pass. 37/37 cases passed in 3.6 minutes with zero retries; k6 completed 7/7 checks, 5 requests, zero request failures, and one uninterrupted smoke iteration                                                                                                                                                                                                                                                                                                       |
| Build, Mantine QA, CLI/MCP smoke                                                          | Local clean worktree and CI Node 22                                                                                               | Pass. Build and Mantine QA passed; initial JS/CSS were 242.3/53.7 KiB gzip. CLI/MCP compatibility had zero failures or warnings; two live read/write checks were explicitly skipped because the isolated profile had no `VK_API_KEY`                                                                                                                                                                                                                               |
| Desktop tests, build, readiness, native lifecycle, and unsigned package                   | macOS arm64 isolated profile and [artifact run 32732019898](https://github.com/BradGroux/veritas-kanban/actions/runs/32732019898) | Pass. Desktop 67/67, Electron artifacts 4/4, readiness 7/7, package smoke, visible setup/readiness, single-instance, close/reopen, and clean quit all passed. Mounted DMG and ZIP report 6.1.2 arm64. DMG: 265,821,857 bytes, SHA-256 `562aa08c1d93653227aa0deee7cc0020f42bfe4ead9e404005fbe67a87822d7a`; ZIP: 270,676,980 bytes, SHA-256 `e1dc99f95e1c3396cda78c5e38582cdc7554baf2757aa57cfee411ba6a94de60`. CI macOS/Linux/Windows unsigned artifacts all passed |
| Production Docker build, image-size contract, and runtime smoke                           | amd64 [Docker contract run 32732019831](https://github.com/BradGroux/veritas-kanban/actions/runs/32732019831)                     | Pass. Image size 571,628,184 bytes, below 600,000,000; non-root user, version, mounted paths, SQLite, backup, auth, static web, health, bcrypt, and clean shutdown passed                                                                                                                                                                                                                                                                                          |
| Release-format and release validators                                                     | Version 6.1.2                                                                                                                     | Pass with one classified host limitation. Canonical release format passed 3/3 and every source/build-output check passed. The local Docker-enabled wrapper reached image assembly before Docker Desktop returned an `overlayfs` containerd metadata I/O error on a full host filesystem; the clean CI Docker build and complete runtime contract passed on the same frozen source. Live GitHub/tag/body validation remains a post-publication gate                 |

## 6.1.1 Maintenance Release Candidate

| Field              | Value                                                                                                                                                                                                                                                                                                                      |
| ------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Release version    | 6.1.1                                                                                                                                                                                                                                                                                                                      |
| Source branch      | `fix/release-6-1-1-1156`                                                                                                                                                                                                                                                                                                   |
| Source baseline    | `main` after the audited task-drawer fix, dependency rollup, and Chalk 6 disposition (#1154, #1155, #1149)                                                                                                                                                                                                                 |
| Included issues    | [#1153](https://github.com/BradGroux/veritas-kanban/issues/1153) and release tracker [#1156](https://github.com/BradGroux/veritas-kanban/issues/1156)                                                                                                                                                                      |
| Pull-request audit | #1154 accepted and merged with browser proof; #1155 accepted with refreshed security floors; #1149 accepted after Node.js and test review; #1150 closed as unnecessary because `pnpm/action-setup@v6` already resolves to 6.0.9; #1148 rejected because its engine floor and 65 failing tests violate the release contract |
| Publication state  | Complete. PR #1157 merged as `2cfb89396da7e115571f3c1449449ef60bde53d7`; annotated `v6.1.1`, the live GitHub release body, signed/notarized assets, installed-app verification, and Homebrew PR #49 are verified.                                                                                                          |

### 6.1.1 verification evidence

| Gate                                       | Candidate result                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
| ------------------------------------------ |   |
| Task Detail and mobile browser regressions | Chromium verifies the Mantine tabs root is a flex column, the overlay has real overflow, and wheel input increases the scroll position. Chromium and WebKit verify nested task-card controls do not activate the card and status movement completes through the visible save lifecycle                                                                                                                                                                                                                                                                                       |
| Workflow storage readiness                 | The release-PR workspace job exposed an `ENOENT` startup race between asynchronous workflow-directory creation and the first write. File-backed workflow operations now await the shared readiness promise; the complete optimistic-concurrency route test passes in ten consecutive isolated runs.                                                                                                                                                                                                                                                                          |
| Dependency security                        | `pnpm audit --prod` and full `pnpm audit` report no known vulnerabilities after stale override floors were refreshed                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
| Dependency PR CI                           | Build, lint/typecheck, security audit, affected-workspace tests, and unsigned macOS, Linux, and Windows packaging passed on #1155                                                                                                                                                                                                                                                                                                                                                                                                                                            |
| Consolidated candidate                     | Frozen install, production and full audits, package-manager policy, release formatting, lint and 592-warning budget, typecheck, build, 3,771 workspace tests, 37 Playwright cases across Chromium and WebKit, Mantine QA, CLI/MCP smoke, 50 Buzz compatibility tests, 67 desktop tests, seven readiness tests, unsigned macOS packaging, packaged-app smoke, and the 6.1.1 release validator pass. The local Docker build variant was unavailable because the Docker daemon was not running. Independent review is owner-directed and is not part of the active release SOP. |

## 6.1.0 Roadmap Release

| Field               | Value                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
| ------------------- |   |
| Release version     | 6.1.0                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
| Source branch       | `release/v6.1.0`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
| Source baseline     | `0a19b9050da8915042860f55ef9ca009d164e816`, the release integration of `main` after #1142 cleared the milestone blockers                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
| Included issues     | [#855](https://github.com/BradGroux/veritas-kanban/issues/855), [#864](https://github.com/BradGroux/veritas-kanban/issues/864), [#865](https://github.com/BradGroux/veritas-kanban/issues/865), [#866](https://github.com/BradGroux/veritas-kanban/issues/866), [#867](https://github.com/BradGroux/veritas-kanban/issues/867), [#868](https://github.com/BradGroux/veritas-kanban/issues/868), [#871](https://github.com/BradGroux/veritas-kanban/issues/871), [#872](https://github.com/BradGroux/veritas-kanban/issues/872), [#873](https://github.com/BradGroux/veritas-kanban/issues/873), [#876](https://github.com/BradGroux/veritas-kanban/issues/876), and [#879](https://github.com/BradGroux/veritas-kanban/issues/879) |
| Source verification | Focused verification passed per merged roadmap slice. PR #1142 completed append-only admission writes, restored the complete filesystem test-double surface, and mapped the exact knowledge-collection permission prefix. The consolidated candidate then passed `pnpm test:unit` across every workspace; server reported 3,234 passing and 5 skipped tests, web reported 469 passing tests, and desktop reported 67 passing tests.                                                                                                                                                                                                                                                                                                |
| Publication state   | Complete. PR #1137 merged as `e5aba49e61fca35c14616574a22174c0f848812f`; annotated `v6.1.0`, signed/notarized assets, post-publication validation, isolated installed-app readiness, and Homebrew PR #46 are verified.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |

### 6.1.0 issue traceability

| Issue                                                          | Outcome                                                                                            |
| -------------------------------------------------------------- | -------------------------------------------------------------------------------------------------- |
| [#855](https://github.com/BradGroux/veritas-kanban/issues/855) | Run-scoped egress gateway and enforceable network policy                                           |
| [#864](https://github.com/BradGroux/veritas-kanban/issues/864) | Durable admission, aggregate budgets, fairness, cancellation, and circuit breaking                 |
| [#865](https://github.com/BradGroux/veritas-kanban/issues/865) | Durable goal supervision across turns, restarts, and continuations                                 |
| [#866](https://github.com/BradGroux/veritas-kanban/issues/866) | Reviewed, attributable memory extraction and consolidation                                         |
| [#867](https://github.com/BradGroux/veritas-kanban/issues/867) | Source-grounded workspace knowledge collections                                                    |
| [#868](https://github.com/BradGroux/veritas-kanban/issues/868) | Knowledge integrity linting, material-claim lifecycle, scheduling, semantic candidates, and health |
| [#871](https://github.com/BradGroux/veritas-kanban/issues/871) | Run-scoped background-command and monitor supervision                                              |
| [#872](https://github.com/BradGroux/veritas-kanban/issues/872) | Preview-first turn-boundary checkpoints and attributable rewind                                    |
| [#873](https://github.com/BradGroux/veritas-kanban/issues/873) | Stalled and repetitive run detection with bounded recovery                                         |
| [#876](https://github.com/BradGroux/veritas-kanban/issues/876) | Governed artifact spill for oversized run output                                                   |
| [#879](https://github.com/BradGroux/veritas-kanban/issues/879) | Agent-dependency load shedding integrated with circuit breakers                                    |

## 6.0.2 Desktop Recovery Candidate

| Field               | Value                                                                                                                                                                                                                                                                      |
| ------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Release version     | 6.0.2                                                                                                                                                                                                                                                                      |
| Release tracker     | [#1010](https://github.com/BradGroux/veritas-kanban/issues/1010)                                                                                                                                                                                                           |
| Source branch       | `release/v6.0.2-1010`                                                                                                                                                                                                                                                      |
| Source baseline     | `2f18229ff24153ef33b5a21de21f0befb94d8a08`, the merged #1005 main commit with green CI and cross-platform unsigned desktop artifacts                                                                                                                                       |
| Included issues     | [#1000](https://github.com/BradGroux/veritas-kanban/issues/1000), [#1004](https://github.com/BradGroux/veritas-kanban/issues/1004), [#1005](https://github.com/BradGroux/veritas-kanban/issues/1005), and [#1010](https://github.com/BradGroux/veritas-kanban/issues/1010) |
| Source verification | Focused tests and rendered smoke per fix; reviewed full workspace evidence on the exact #1005 merge ancestry; one milestone release validation gate                                                                                                                        |
| Signed runtime gate | Exact 6.0.2 equality across bundle, health, updater, native About, copied support text, and desktop bridge; Right/Bottom Chat recovery at the minimum supported window; bounded task; clean quit                                                                           |
| Distribution gate   | Annotated tag, reviewed full-width GitHub release body, signed/notarized DMG and ZIP, updater metadata, independent digests, GitHub release validation, and verified Homebrew cask                                                                                         |

### 6.0.2 issue traceability

| Issue                                                            | Pull request                                                   | Outcome                                                                                                             |
| ---------------------------------------------------------------- | -------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------- |
| [#1000](https://github.com/BradGroux/veritas-kanban/issues/1000) | [#1003](https://github.com/BradGroux/veritas-kanban/pull/1003) | Deterministic documentation, focused, and full CI test scope                                                        |
| [#1004](https://github.com/BradGroux/veritas-kanban/issues/1004) | [#1008](https://github.com/BradGroux/veritas-kanban/pull/1008) | Bounded right/bottom Chat dock with complete visible recovery paths                                                 |
| [#1005](https://github.com/BradGroux/veritas-kanban/issues/1005) | [#1009](https://github.com/BradGroux/veritas-kanban/pull/1009) | Authoritative native version/build/channel/OS/architecture record and offline copy action                           |
| [#1010](https://github.com/BradGroux/veritas-kanban/issues/1010) | [#1011](https://github.com/BradGroux/veritas-kanban/pull/1011) | Version, documentation, full-width release body, signed publication, downloaded-app verification, and Homebrew gate |

## 6.0.1 Stabilization Candidate

| Field                  | Value                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
| ---------------------- |   |
| Release version        | 6.0.1                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
| Stabilization tracker  | [#924](https://github.com/BradGroux/veritas-kanban/issues/924)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
| Source branch          | `release/v6.0.1`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
| Superseded publication | [`v6.0.0`](https://github.com/BradGroux/veritas-kanban/releases/tag/v6.0.0), retained as a quarantined prerelease                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
| Stabilization issues   | [#935](https://github.com/BradGroux/veritas-kanban/issues/935), [#936](https://github.com/BradGroux/veritas-kanban/issues/936), [#937](https://github.com/BradGroux/veritas-kanban/issues/937), [#938](https://github.com/BradGroux/veritas-kanban/issues/938), [#939](https://github.com/BradGroux/veritas-kanban/issues/939), [#941](https://github.com/BradGroux/veritas-kanban/issues/941), [#943](https://github.com/BradGroux/veritas-kanban/issues/943), [#944](https://github.com/BradGroux/veritas-kanban/issues/944), [#945](https://github.com/BradGroux/veritas-kanban/issues/945), and [#986](https://github.com/BradGroux/veritas-kanban/issues/986) |
| Source verification    | Focused tests plus changed-file CI per issue; one full workspace suite is reserved for the release PR                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
| Signed runtime gate    | Exact 6.0.1 equality across bundle, health, updater, and desktop bridge metadata; Chat recovery; bounded task; clean quit                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
| Distribution gate      | Signed/notarized DMG and ZIP, updater metadata, independent checksums, GitHub release validation, and verified Homebrew cask                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |

### Stabilization issue traceability

| Issue                                                          | Pull request                                                 | Outcome                                                                                                      |
| -------------------------------------------------------------- | ------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------ |
| [#935](https://github.com/BradGroux/veritas-kanban/issues/935) | [#992](https://github.com/BradGroux/veritas-kanban/pull/992) | Task drawers and shared overlays remain usable at compact heights                                            |
| [#936](https://github.com/BradGroux/veritas-kanban/issues/936) | [#989](https://github.com/BradGroux/veritas-kanban/pull/989) | Workflow actions normalize omitted collections and surface recoverable failures                              |
| [#937](https://github.com/BradGroux/veritas-kanban/issues/937) | [#993](https://github.com/BradGroux/veritas-kanban/pull/993) | Navigation and nested overlays preserve the actual route origin and scroll state                             |
| [#938](https://github.com/BradGroux/veritas-kanban/issues/938) | [#995](https://github.com/BradGroux/veritas-kanban/pull/995) | Scoring profile content has intentional nested scroll ownership                                              |
| [#939](https://github.com/BradGroux/veritas-kanban/issues/939) | [#991](https://github.com/BradGroux/veritas-kanban/pull/991) | Archive cards and layout remain reachable at compact sizes                                                   |
| [#941](https://github.com/BradGroux/veritas-kanban/issues/941) | [#996](https://github.com/BradGroux/veritas-kanban/pull/996) | Template editing is a complete visible authoring flow                                                        |
| [#943](https://github.com/BradGroux/veritas-kanban/issues/943) | [#990](https://github.com/BradGroux/veritas-kanban/pull/990) | New scoring profiles open as visible validated drafts                                                        |
| [#944](https://github.com/BradGroux/veritas-kanban/issues/944) | [#994](https://github.com/BradGroux/veritas-kanban/pull/994) | Operations Digest reconciles current state, windowed events, exclusions, and source evidence                 |
| [#945](https://github.com/BradGroux/veritas-kanban/issues/945) | [#988](https://github.com/BradGroux/veritas-kanban/pull/988) | Chat has visible, keyboard, browser-history, persisted-state, compact-window, and native-menu recovery paths |
| [#986](https://github.com/BradGroux/veritas-kanban/issues/986) | [#997](https://github.com/BradGroux/veritas-kanban/pull/997) | Desktop setup is version-neutral and the bridge consumes Electron's application version                      |

## Historical 6.0.0 Release Scope

| Field                    | Value                                                                                                                                     |
| ------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------- |
| Release version          | 6.0.0                                                                                                                                     |
| Release tracker          | [Veritas Kanban 6.0.0 harness parity and Buzz integration](https://github.com/BradGroux/veritas-kanban/issues/924)                        |
| Buzz epic                | [First-class Buzz integration](https://github.com/BradGroux/veritas-kanban/issues/904)                                                    |
| Harness epic             | [Equal-footing agent harness support](https://github.com/BradGroux/veritas-kanban/issues/915)                                             |
| Implementation baseline  | `398fe7f67e94c3d6cabee0702b2331d9c873fd0f`                                                                                                |
| Release branch           | `release/v6.0.0`                                                                                                                          |
| Release PR               | [#985](https://github.com/BradGroux/veritas-kanban/pull/985)                                                                              |
| Release merge            | [`1bd43f9279f5ab736bff03378d5d85243e16813e`](https://github.com/BradGroux/veritas-kanban/commit/1bd43f9279f5ab736bff03378d5d85243e16813e) |
| Tag and GitHub release   | [`v6.0.0`](https://github.com/BradGroux/veritas-kanban/releases/tag/v6.0.0)                                                               |
| Desktop Release workflow | [Run 30109135335](https://github.com/BradGroux/veritas-kanban/actions/runs/30109135335)                                                   |
| Homebrew PR              | [#37](https://github.com/BradGroux/homebrew-tap/pull/37), merged as `7d77106e7c526a0975c49b9b11e0c9526921ead0`                            |
| Evidence host            | macOS 26.5.2 arm64; Node 26.5.0; pnpm 11.1.1; Git 2.55.0                                                                                  |

## Issue And Pull Request Traceability

### Support, task, launch, credential, and worktree foundations

| Issue                                                                                         | Pull request                                                 | Outcome                                                  |
| --------------------------------------------------------------------------------------------- | ------------------------------------------------------------ | -------------------------------------------------------- |
| [First-class harness support profile](https://github.com/BradGroux/veritas-kanban/issues/919) | [#925](https://github.com/BradGroux/veritas-kanban/pull/925) | One support tier and fail-closed onboarding contract     |
| [Immutable run launch manifest](https://github.com/BradGroux/veritas-kanban/issues/854)       | [#926](https://github.com/BradGroux/veritas-kanban/pull/926) | Attempt-bound compiled launch evidence                   |
| [Provider-owned task transports](https://github.com/BradGroux/veritas-kanban/issues/892)      | [#928](https://github.com/BradGroux/veritas-kanban/pull/928) | Immutable task request rendered per adapter              |
| [Idempotent completion results](https://github.com/BradGroux/veritas-kanban/issues/893)       | [#930](https://github.com/BradGroux/veritas-kanban/pull/930) | One authoritative provider-neutral terminal result       |
| [Credential registry and leases](https://github.com/BradGroux/veritas-kanban/issues/931)      | [#933](https://github.com/BradGroux/veritas-kanban/pull/933) | Value-free definitions and exact run/action leases       |
| [Transactional worktrees](https://github.com/BradGroux/veritas-kanban/issues/858)             | [#934](https://github.com/BradGroux/veritas-kanban/pull/934) | Remote-safe allocation, ownership, recovery, and cleanup |

### Durable shared runtime

| Issue                                                                                      | Pull request                                                                                                               | Outcome                                                    |
| ------------------------------------------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------- |
| [Causal run-event journal](https://github.com/BradGroux/veritas-kanban/issues/850)         | [#949](https://github.com/BradGroux/veritas-kanban/pull/949), [#950](https://github.com/BradGroux/veritas-kanban/pull/950) | Replayable redacted events and CI repair                   |
| [Interactive approval broker](https://github.com/BradGroux/veritas-kanban/issues/852)      | [#953](https://github.com/BradGroux/veritas-kanban/pull/953)                                                               | Exact-action durable approvals                             |
| [Durable run supervisor](https://github.com/BradGroux/veritas-kanban/issues/853)           | [#954](https://github.com/BradGroux/veritas-kanban/pull/954)                                                               | Restart ownership, recovery, and terminal reconciliation   |
| [Conversation lifecycle](https://github.com/BradGroux/veritas-kanban/issues/856)           | [#958](https://github.com/BradGroux/veritas-kanban/pull/958)                                                               | Capability-gated resume, follow-up, fork, steer, and close |
| [Run-scoped tool control plane](https://github.com/BradGroux/veritas-kanban/issues/857)    | [#959](https://github.com/BradGroux/veritas-kanban/pull/959)                                                               | Versioned discovery/catalog and governed invocation        |
| [Generic ACP stdio provider](https://github.com/BradGroux/veritas-kanban/issues/870)       | [#961](https://github.com/BradGroux/veritas-kanban/pull/961)                                                               | Provider-neutral ACP v1 client adapter                     |
| [ACP server view](https://github.com/BradGroux/veritas-kanban/issues/960)                  | [#967](https://github.com/BradGroux/veritas-kanban/pull/967)                                                               | `vk acp serve` and status over Veritas-owned sessions      |
| [Launch credential classification](https://github.com/BradGroux/veritas-kanban/issues/932) | [#963](https://github.com/BradGroux/veritas-kanban/pull/963)                                                               | Boot, brokered, and high-risk passthrough evidence         |
| [Credential boundary catalog](https://github.com/BradGroux/veritas-kanban/issues/968)      | [#971](https://github.com/BradGroux/veritas-kanban/pull/971)                                                               | Exact value-free broker boundary                           |
| [Mediated lease consumption](https://github.com/BradGroux/veritas-kanban/issues/969)       | [#972](https://github.com/BradGroux/veritas-kanban/pull/972)                                                               | One-shot downstream MCP credential resolution              |
| [System-owned provider bridge](https://github.com/BradGroux/veritas-kanban/issues/970)     | [#973](https://github.com/BradGroux/veritas-kanban/pull/973)                                                               | Narrow `veritas-run` injection or fail-closed block        |
| [Runtime hook bus](https://github.com/BradGroux/veritas-kanban/issues/874)                 | [#977](https://github.com/BradGroux/veritas-kanban/pull/977)                                                               | Bounded in-process pre/post runtime hooks                  |
| [Harness conformance suites](https://github.com/BradGroux/veritas-kanban/issues/859)       | [#975](https://github.com/BradGroux/veritas-kanban/pull/975)                                                               | Seeded deterministic repeated evaluation                   |

### Harness adapters and Buzz delivery

| Issue                                                                                    | Pull request                                                 | Outcome                                                       |
| ---------------------------------------------------------------------------------------- | ------------------------------------------------------------ | ------------------------------------------------------------- |
| [Grok Build ACP profile](https://github.com/BradGroux/veritas-kanban/issues/920)         | [#966](https://github.com/BradGroux/veritas-kanban/pull/966) | Exact v0.2.111 restrictive ACP profile                        |
| [Codex app-server v2](https://github.com/BradGroux/veritas-kanban/issues/921)            | [#952](https://github.com/BradGroux/veritas-kanban/pull/952) | Pinned JSON-RPC v2 lifecycle adapter                          |
| [Claude Code stream adapter](https://github.com/BradGroux/veritas-kanban/issues/916)     | [#951](https://github.com/BradGroux/veritas-kanban/pull/951) | Bare-mode supervised stream-json execution                    |
| [GitHub Copilot CLI ACP profile](https://github.com/BradGroux/veritas-kanban/issues/917) | [#965](https://github.com/BradGroux/veritas-kanban/pull/965) | Public-preview exact v1.0.74 restrictive profile              |
| [Buzz compatibility diagnostics](https://github.com/BradGroux/veritas-kanban/issues/905) | [#946](https://github.com/BradGroux/veritas-kanban/pull/946) | Reference-only relay/identity evidence                        |
| [Buzz Squad Chat adapter](https://github.com/BradGroux/veritas-kanban/issues/906)        | [#947](https://github.com/BradGroux/veritas-kanban/pull/947) | Signed bidirectional roots/replies and replay                 |
| [Buzz Agent ACP profile](https://github.com/BradGroux/veritas-kanban/issues/907)         | [#964](https://github.com/BradGroux/veritas-kanban/pull/964) | Exact Buzz v0.4.24 generic ACP profile                        |
| [Buzz run-scoped MCP](https://github.com/BradGroux/veritas-kanban/issues/909)            | [#974](https://github.com/BradGroux/veritas-kanban/pull/974) | System-owned `veritas-run` bridge for Buzz                    |
| [Buzz persona/team import](https://github.com/BradGroux/veritas-kanban/issues/910)       | [#948](https://github.com/BradGroux/veritas-kanban/pull/948) | Signed preview-first one-way import                           |
| [Buzz workflow triggers](https://github.com/BradGroux/veritas-kanban/issues/911)         | [#978](https://github.com/BradGroux/veritas-kanban/pull/978) | Allowlisted root-message triggers with replay protection      |
| [Buzz compatibility gate](https://github.com/BradGroux/veritas-kanban/issues/912)        | [#979](https://github.com/BradGroux/veritas-kanban/pull/979) | Composed 50-test credential-free gate                         |
| [Cross-harness matrix](https://github.com/BradGroux/veritas-kanban/issues/918)           | [#976](https://github.com/BradGroux/veritas-kanban/pull/976) | One matrix for API, doctor, Settings, telemetry, and dispatch |

### Release-blocking native fixes

| Issue                                                                                               | Pull request                                                 | Outcome                                                         |
| --------------------------------------------------------------------------------------------------- | ------------------------------------------------------------ | --------------------------------------------------------------- |
| [Lazy run-supervisor storage binding](https://github.com/BradGroux/veritas-kanban/issues/981)       | [#982](https://github.com/BradGroux/veritas-kanban/pull/982) | Packaged SQLite startup initializes storage before lookup       |
| [Reject desktop updater downgrade metadata](https://github.com/BradGroux/veritas-kanban/issues/983) | [#984](https://github.com/BradGroux/veritas-kanban/pull/984) | v6 refuses published v5 metadata after stable channel selection |

### Release engineering

| Issue                                                                                       | Pull request                                                 | Outcome                                                        |
| ------------------------------------------------------------------------------------------- | ------------------------------------------------------------ | -------------------------------------------------------------- |
| [Tier changed-file and full CI](https://github.com/BradGroux/veritas-kanban/issues/955)     | [#957](https://github.com/BradGroux/veritas-kanban/pull/957) | Focused pull-request gates with explicit full-workspace lanes  |
| [Bounded desktop upgrade readiness](https://github.com/BradGroux/veritas-kanban/issues/927) | [#929](https://github.com/BradGroux/veritas-kanban/pull/929) | Version-matched installed-app startup and diagnostic readiness |

## Reviewed Provider Baselines

| Harness            | Version/build                             | Deterministic posture   | Credential-gated posture                           |
| ------------------ | ----------------------------------------- | ----------------------- | -------------------------------------------------- |
| Buzz Agent         | v0.4.24 / `710ed9...`; `buzz-agent 0.1.0` | Pass: 7 files, 50 tests | Binary unavailable; no live claim                  |
| Grok Build         | v0.2.111 / `94172f2aa4e5`                 | Pass in workspace gate  | Installed 0.2.22 is stale and unauthenticated      |
| Codex app-server   | 0.145.0 / `25af12...`                     | Pass in workspace gate  | Pass: exact authenticated 0.145.0, 1 smoke test    |
| Codex SDK          | 0.144.3                                   | Pass in workspace gate  | Deterministic evidence only                        |
| Claude Code        | 2.1.218                                   | Pass in workspace gate  | Binary unavailable; no live claim                  |
| GitHub Copilot CLI | 1.0.74 / `2b809c...` tag commit           | Pass in workspace gate  | Exact binary installed; authentication unavailable |
| Hermes             | v2026.7.7.2                               | Pass in workspace gate  | Binary unavailable; retained non-Certified tier    |
| OpenClaw           | v2026.6.11                                | Pass in workspace gate  | Installed 2026.6.1 is stale; no live gateway claim |

No row may be changed to a live passing claim without exact command/runtime
evidence. A skipped credential gate remains skipped, not passed.

### Observed isolated-runtime support tiers

The packaged 6.0.0 candidate returned the configured-profile rows below through
the redacted `harness-compatibility-matrix/v1` status path from the copied
v5.2.5 profile. The OpenClaw row applies the same normalized tier contract at
the host executable boundary because that copied profile had no OpenClaw entry.
Deterministic fixture results do not replace these live tiers.

| Profile                 | Observed tier | Certification | Evidence date | Runtime evidence                                                     |
| ----------------------- | ------------- | ------------- | ------------- | -------------------------------------------------------------------- |
| OpenAI Codex CLI        | Configured    | Not current   | 2026-07-24    | `codex-cli 0.145.0`; executable and authentication detected          |
| OpenAI Codex SDK        | Detected      | Not current   | 2026-07-24    | `codex-cli 0.145.0`; disabled profile                                |
| OpenAI Codex app-server | Detected      | Not current   | 2026-07-24    | `codex-cli 0.145.0`; disabled profile                                |
| GitHub Copilot CLI      | Detected      | Not current   | 2026-07-24    | GitHub Copilot CLI 1.0.74; disabled profile; auth not inferred       |
| Grok Build              | Detected      | Not current   | 2026-07-24    | 0.2.22 build `967574cb117`; disabled and older than reviewed 0.2.111 |
| Claude Code             | Degraded      | Not current   | 2026-07-24    | Executable not installed                                             |
| Buzz Agent              | Degraded      | Not current   | 2026-07-24    | Executable not installed                                             |
| Hermes                  | Degraded      | Not current   | 2026-07-24    | Executable not installed                                             |
| OpenClaw                | Detected      | Not current   | 2026-07-24    | 2026.6.1 executable found; no enabled profile or live gateway claim  |

No profile reported Certified because persisted certification evidence was
not current in this isolated profile. OpenClaw is Detected at the host boundary
because the executable exists while no profile is enabled; its stale
2026.6.1 build is not a live gateway claim. The exact authenticated app-server
smoke remains separate command evidence, not a support-tier mutation.

## Verification Matrix

Results are filled from the clean release candidate. Counts and elapsed time are
recorded when the tool reports them.

| Gate                                                      | Environment                     | Result  | Evidence or limitation                                                            |
| --------------------------------------------------------- | ------------------------------- | ------- | --------------------------------------------------------------------------------- |
| Toolchain versions                                        | macOS 26.5.2 arm64              | Pass    | Node 26.5.0; pnpm 11.1.1; Git 2.55.0                                              |
| `pnpm install --frozen-lockfile`                          | clean release worktree          | Pass    | 1,116 packages in 4.8 s; lockfile pinned to pnpm 11.1.1                           |
| `pnpm check:pnpm-settings`                                | clean release worktree          | Pass    | Package manager and instruction versions agree                                    |
| `pnpm audit --prod --audit-level=high`                    | production dependencies         | Pass    | 0 high/critical; 1 low and 1 moderate retained                                    |
| `pnpm lint` and `pnpm lint:budget`                        | all tracked source/docs         | Pass    | 0 errors; 595 warnings within the 600-warning budget                              |
| `pnpm qa:mantine`                                         | built web bundle                | Pass    | Initial JS 238.9 KiB gzip; CSS 51.4 KiB gzip                                      |
| `pnpm typecheck`                                          | all workspaces                  | Pass    | 11.97 s                                                                           |
| `pnpm build`                                              | all workspaces                  | Pass    | 16.53 s                                                                           |
| `pnpm test:unit`                                          | sequential workspaces           | Pass    | 3,217 passed, 4 skipped; 329 files; 48.74 s                                       |
| `pnpm test:e2e`                                           | Playwright matrix               | Pass    | 36/36; Chromium, mobile Chromium, mobile WebKit; 79.76 s                          |
| `pnpm smoke:cli-mcp`                                      | release output                  | Limited | Static versions/builds pass; live read/write skipped without test key             |
| `pnpm test:buzz:compatibility`                            | credential-free fixtures        | Pass    | 7 files, 50/50 tests; 4.30 s Vitest                                               |
| Provider/lifecycle/approval/MCP/credential suites         | credential-free fixtures        | Pass    | Focused release integration set: 4 files, 83/83 tests, 2.76 s                     |
| `pnpm desktop:test`                                       | macOS arm64                     | Pass    | 14 files, 61 tests, 344 ms                                                        |
| `pnpm desktop:build`                                      | macOS arm64                     | Pass    | 1.20 s; Electron artifact check 4/4                                               |
| `pnpm desktop:check:electron-artifacts`                   | fresh desktop output            | Pass    | Main and preload artifacts accepted                                               |
| `pnpm desktop:smoke:mac:local`                            | isolated unsigned package       | Pass    | 25.28 s                                                                           |
| `pnpm desktop:package:mac:unsigned`                       | macOS arm64                     | Pass    | Final post-blocker DMG/ZIP package in 57.49 s                                     |
| v5.2.5 populated-profile upgrade                          | isolated copy                   | Pass    | Matching counts, integrity, owner summary, profile; registry absence preserved    |
| v5.2.5 registry compatibility                             | exact-format deterministic test | Pass    | 1/1; identity, provider, capabilities, metadata, status, and session preserved    |
| File-backed migration and restore                         | isolated deterministic fixture  | Pass    | 7/7; tasks, config, workflows, chat, telemetry, backup, and restore               |
| In-app Browser runtime                                    | isolated server/web             | Pass    | First run, login, provider/Buzz settings, themes, palette/focus; 0 console errors |
| Local browser automation                                  | Playwright matrix               | Pass    | 36-route/interaction E2E matrix                                                   |
| Native desktop runtime                                    | isolated profile                | Pass    | One instance, window, health, menus, reopen, update, clean quit                   |
| `pnpm validate:release -- --version 6.0.0`                | clean release worktree          | Pass    | 0.60 s                                                                            |
| `pnpm validate:release -- --version 6.0.0 --docker-build` | production target               | Pass    | 116.39 s; `veritas-kanban:validate-6.0.0`                                         |
| Focused standards review                                  | diff from `398fe7f6...`         | Pass    | GPT-5.6 standards axis; no remaining findings; cross-model review waived          |
| Focused spec/security claim review                        | release tracker and goal prompt | Pass    | GPT-5.6 spec axis; findings corrected; secret/security scan passed                |

### Accepted browser verification split

On 2026-07-24 the maintainer directed a sustainable verification cadence:
focused behavior tests for issue pull requests, changed-file CI per pull
request, and one complete workspace suite at the final release gate. Applying
that direction, the in-app Browser pass covered rendered and interactive
behavior that benefits from manual inspection: first run, login, provider and
Buzz Settings, degraded states, dark/light themes, command-palette focus,
labels, and console health. Stateful task launch, causal events, approvals,
cancellation, Buzz replay, MCP, worktrees, telemetry, completion, compact
layout, and recoverable errors remained in the passing deterministic and E2E
automation instead of being duplicated manually in the in-app Browser.

This is an explicit release-evidence split, not a claim that those scripted
flows were manually clicked in the in-app Browser.

## Migration And Data Preservation

Completed isolated drill:

- source: latest signed v5.2.5 desktop workspace copy under an isolated
  `codex-v525-smoke` profile;
- no database writer before copy or after final quit;
- `PRAGMA quick_check=ok` before and after;
- matching counts before and after: 2 tasks, 3 Squad Chat messages,
  1 telemetry event, 1 workflow definition, 1 workflow run,
  1 app-config document, and 1 user;
- agent registry absent before and after; no implicit provider enablement or
  OpenClaw fallback;
- a separate automated fixture using the exact v5.2.5 registry shape preserved
  agent identity, provider, capabilities, metadata, status, and session
  reference in 1/1 focused test;
- the file-backed portability suite passed 7/7 for tasks, configuration,
  workflows, chats, telemetry, backup, failure recovery, and restore;
- onboarding detected and summarized the populated database, v6 health
  reported 6.0.0, the packaged renderer opened, provider and Buzz settings
  rendered, reopen/single-instance/menu/update/quit checks passed;
- the final updater check reported 5.2.5 as older with downgrade disallowed,
  and download/install actions remained disabled;
- rollback remains restore-first: retain the stopped-writer v5.2.5 backup
  because destructive schema down-migration is not promised.

The signed profile contained no agent registry, so the native drill proves that
absence remains absence while the exact-format automated fixture covers a
populated v5 registry. The signed fixture's two task rows were deliberately
minimal direct-SQL migration records, so the onboarding count is authoritative
evidence; their incomplete legacy JSON is not claimed as a rendered task-card
test.

No private data, credential value, raw provider conversation, or unrestricted
runtime profile is retained in this packet.

## 6.1.2 Publication Evidence

Publication has not started. This section will record the release PR merge SHA,
annotated tag object and peeled commit, GitHub release URL and exact body
readback, Desktop Release workflow, signed/notarized artifact names, sizes,
SHA-256 values, blockmaps, updater metadata, Gatekeeper/stapling/launch proof,
Homebrew PR and merge SHA, live cask validation, and approved advisory state.

## 6.1.1 Publication Evidence

Source publication, signed-macOS verification, full-width release-note validation, isolated installed-app readiness, and Homebrew distribution are complete.

| Publication item                                | Result                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
| ----------------------------------------------- |   |
| Release PR and merge                            | [#1157](https://github.com/BradGroux/veritas-kanban/pull/1157); reviewed head `5813d0d3d5285558582cb76c97e7d824b5ad9425`; verified squash merge `2cfb89396da7e115571f3c1449449ef60bde53d7`                                                                                                                                                                                                                                                                                                                                                                                          |
| Annotated `v6.1.1` tag object and peeled commit | `c18955bbd7cc582f7ccd41a958ec1f53b6907cc2`; `2cfb89396da7e115571f3c1449449ef60bde53d7`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
| GitHub release URL and body                     | https://github.com/BradGroux/veritas-kanban/releases/tag/v6.1.1; stable release published 2026-08-22; the live body exactly matches `docs/releases/v6.1.1.md` and is the latest non-prerelease                                                                                                                                                                                                                                                                                                                                                                                      |
| Release CI and unsigned packaging               | [CI run 32608829719](https://github.com/BradGroux/veritas-kanban/actions/runs/32608829719) passed build, security audit, lint/typecheck, scope selection, 3,771 workspace tests, and the changed-test gate; [artifact run 32608829776](https://github.com/BradGroux/veritas-kanban/actions/runs/32608829776) passed macOS, Linux, and Windows unsigned packaging on the reviewed head                                                                                                                                                                                               |
| Desktop Release workflow URL and duration       | [Run 32609140955](https://github.com/BradGroux/veritas-kanban/actions/runs/32609140955); exact release merge SHA; signed and notarized job passed in 11m37s                                                                                                                                                                                                                                                                                                                                                                                                                         |
| Signed/notarized DMG                            | `Veritas-Kanban-6.1.1-mac-arm64.dmg`; 268,632,259 bytes; SHA-256 and published sidecar value `7fa44f4129be751757a7e049cd3681266cab3215402cd2e2a5d8b0acf38c6c11`; independent download, signature, Gatekeeper, and stapling validation pass                                                                                                                                                                                                                                                                                                                                          |
| Signed/notarized ZIP                            | `Veritas-Kanban-6.1.1-mac-arm64.zip`; 272,805,716 bytes; SHA-256 and published sidecar value `cd9c1cc68d474d3dbea8b6aae90380f5188f041009c229756371eeba7eecd9b0`; Homebrew strict online audit independently downloaded and accepted the asset                                                                                                                                                                                                                                                                                                                                       |
| DMG/ZIP blockmaps and SHA-256 sidecars          | Blockmap digests `fe15ce89df44e720e3b1c9381b035d80a079042697a592c12b2be9cad96a949e` and `a5b9b910d458ab430daee0ae61ad962948c115bd69436fdbc4e56af861db38b8`; sidecar-file digests `7f29b0095ff92529b0c9fdcffac539fe4ae20adff772011f4ed14ca735a641c6` and `fd0cbb9aa58315f4143c1b4daf9aad158c150283086660a6be93829e42b9ccce`                                                                                                                                                                                                                                                          |
| `latest-mac.yml`                                | Version 6.1.1; 530 bytes; SHA-256 `df7b4f16c3f6c21720f7446af531967854bc3901749f09aaa87e5d1d06b1eb11`; ZIP and DMG names, sizes, and SHA-512 values match the published assets                                                                                                                                                                                                                                                                                                                                                                                                       |
| Installed signed-app isolated launch            | Homebrew upgraded the installed cask from 6.1.0 to 6.1.1. `CFBundleShortVersionString` reports 6.1.1; deep strict code-signature validation, Gatekeeper acceptance from notarized Developer ID `RLBHD62MPW`, and stapling validation pass. A disposable profile and workspace launched the packaged app on isolated port 3101; exact-version readiness passed in 4.289s and proved the packaged app owned the listener. `/api/health` reported 6.1.1, the process stopped cleanly, both disposable user-data directories moved to Trash, and the existing workspace was not opened. |
| Release validator                               | Post-publication `pnpm validate:release -- --version 6.1.1 --skip-build-output --github --repo BradGroux/veritas-kanban` passes and proves the live release and body match the annotated tag and canonical checked-in file                                                                                                                                                                                                                                                                                                                                                          |
| Homebrew cask                                   | [Issue #48](https://github.com/BradGroux/homebrew-tap/issues/48); [PR #49](https://github.com/BradGroux/homebrew-tap/pull/49); reviewed head `4956cd0c7245ad28571f0860ce1f0d63159e4ff5`; verified merge `033983c2d76eccb6ef348e529a42f53d328ef335`; registered `bradgroux/tap/veritas-kanban` resolves 6.1.1 with the published ZIP checksum and passes Ruby syntax, cask style, strict online audit, dry-run install, livecheck, installed-cask upgrade, and exact-version packaged readiness                                                                                      |

## 6.1.0 Publication Evidence

Source publication, signed-macOS verification, full-width release-note validation, isolated installed-app readiness, and Homebrew distribution are complete.

| Publication item                                | Result                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
| ----------------------------------------------- |   |
| Release PR and merge                            | [#1137](https://github.com/BradGroux/veritas-kanban/pull/1137); reviewed head `ec9d7b6e86bcb5566cf04419db8817fa836508ae`; squash merge `e5aba49e61fca35c14616574a22174c0f848812f`                                                                                                                                                                                                                                                                                                                                                                  |
| Annotated `v6.1.0` tag object and peeled commit | `415a88e50e96a5c1ca02034e7e2392c08482d6e0`; `e5aba49e61fca35c14616574a22174c0f848812f`                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
| GitHub release URL and body                     | https://github.com/BradGroux/veritas-kanban/releases/tag/v6.1.0; stable release published 2026-07-26; the post-publication release validator proves the live body exactly matches `docs/releases/v6.1.0.md`, which passes the checked-in full-width format gate                                                                                                                                                                                                                                                                                    |
| Release CI and unsigned packaging               | [CI run 30199975494](https://github.com/BradGroux/veritas-kanban/actions/runs/30199975494) passed security audit, lint, typecheck, build, and changed tests; [artifact run 30199975488](https://github.com/BradGroux/veritas-kanban/actions/runs/30199975488) passed macOS, Linux, and Windows preview packaging                                                                                                                                                                                                                                   |
| Desktop Release workflow URL and duration       | [Run 30200162940](https://github.com/BradGroux/veritas-kanban/actions/runs/30200162940); exact release merge SHA; signed and notarized job passed in 10m55s                                                                                                                                                                                                                                                                                                                                                                                        |
| Signed/notarized DMG                            | `Veritas-Kanban-6.1.0-mac-arm64.dmg`; 277,393,979 bytes; SHA-256/GitHub digest `b7f3fb09a4b35c34bf015b3fa4f878bf6c91b126d2f5c5bad70e602839b9d599`; release workflow signature, Gatekeeper, and stapling validation passed                                                                                                                                                                                                                                                                                                                          |
| Signed/notarized ZIP                            | `Veritas-Kanban-6.1.0-mac-arm64.zip`; 281,520,166 bytes; SHA-256/GitHub digest and published sidecar `6ca5f99394fb551b6b5fb60006ffaa8e5a793808be1382d49c4b3a3209e98701`; Homebrew strict online audit independently downloaded and accepted the asset                                                                                                                                                                                                                                                                                              |
| DMG/ZIP blockmaps and SHA-256 sidecars          | Blockmap digests `29582df6dbdc121cbbfab4255c7ccaf5c258100456be7230b971d65a27a8eaf9` and `f9834743c9523f334c6d7113af00402f16c18c08a5f35345313ad0f644ecb886`; sidecar digests `33b2eb510b4eaa6b51082aa9dc0090b4e5e578316d51b98dcf5305016d63577e` and `bdf782510a2aebb35b22d29875d92bcaf0c75415164c0644f01d43a58914e301`                                                                                                                                                                                                                              |
| `latest-mac.yml`                                | Version 6.1.0; 530 bytes; SHA-256 `b51be7cb54b37dc7cf49e045c276d7d09a4563e9462583a3eaec72d972c88c6d`                                                                                                                                                                                                                                                                                                                                                                                                                                               |
| Installed signed-app isolated launch            | Homebrew upgraded the installed cask from 6.0.2 to 6.1.0. `CFBundleShortVersionString` reports 6.1.0; deep strict code-signature validation, Gatekeeper acceptance from notarized Developer ID `RLBHD62MPW`, and stapling validation pass. A disposable profile and workspace launched the packaged app on isolated port 3101; exact-version readiness passed in 6.294s and proved the packaged app owned the listener. The process stopped cleanly, the disposable user-data directory moved to Trash, and the existing workspace was not opened. |
| Compatibility smoke                             | CLI/MCP version and build-output smoke passed with zero failures and two expected live read/write skips because no `VK_API_KEY` was supplied; Buzz deterministic compatibility passed 7 files and 50 tests                                                                                                                                                                                                                                                                                                                                         |
| Release validator                               | Post-publication `pnpm validate:release -- --version 6.1.0 --skip-build-output --github --repo BradGroux/veritas-kanban` passes and proves the published release body equals the canonical checked-in file                                                                                                                                                                                                                                                                                                                                         |
| Homebrew cask                                   | [Issue #45](https://github.com/BradGroux/homebrew-tap/issues/45); [PR #46](https://github.com/BradGroux/homebrew-tap/pull/46); reviewed head `222c5a8`; merge `4179cce931e7a7e6401a0e3fcd5097bcc23ff830`; registered `bradgroux/tap/veritas-kanban` resolves 6.1.0 with the published ZIP checksum and passes Ruby syntax, style, strict online audit, dry-run install, livecheck, installed-cask upgrade, and exact-version verification                                                                                                          |

## 6.0.2 Publication Evidence

Source publication, independent signed-macOS verification, release-note
format validation, and Homebrew distribution are complete.

| Publication item                                | Result                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
| ----------------------------------------------- |   |
| Release PR and merge                            | [#1011](https://github.com/BradGroux/veritas-kanban/pull/1011); reviewed head `88fb70c23cf10ac58b6444b9fd08af4077956bb6`; squash merge `3a73662b9c3431115f77401e3620a6839f95b61d`; the two commits have identical Git trees                                                                                                                                                                                                                                                                                                                                                      |
| Annotated `v6.0.2` tag object and peeled commit | `a56785e0f9052572982332bb974dbab871c0c971`; `3a73662b9c3431115f77401e3620a6839f95b61d`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
| GitHub release URL and body                     | https://github.com/BradGroux/veritas-kanban/releases/tag/v6.0.2; stable release published 2026-07-24; live body exactly matches `docs/releases/v6.0.2.md`; no carriage returns, hard-wrapped prose, trailing-space breaks, literal escaped newlines, or HTML `<br>`                                                                                                                                                                                                                                                                                                              |
| Desktop Release workflow URL and duration       | https://github.com/BradGroux/veritas-kanban/actions/runs/30132949865; exact release merge SHA; signed and notarized job passed in 11m52s                                                                                                                                                                                                                                                                                                                                                                                                                                         |
| Signed/notarized DMG                            | `Veritas-Kanban-6.0.2-mac-arm64.dmg`; 276,146,896 bytes; SHA-256/GitHub digest `2cf7deb9c600036468db12436988b1c23b679130f088a46a5a910366119ea52b`; Developer ID `RLBHD62MPW`, hardened runtime, Gatekeeper, and stapling pass; the mounted app independently passes the same signature, Gatekeeper, and stapling checks                                                                                                                                                                                                                                                          |
| Signed/notarized ZIP                            | `Veritas-Kanban-6.0.2-mac-arm64.zip`; 279,993,375 bytes; SHA-256/GitHub digest `b6f389c67f3a99086210df104c8cdec4976b9bb56a7cea5b32e611fbc41c21cd`; extracted app Developer ID `RLBHD62MPW`, hardened runtime, Gatekeeper, and stapling pass                                                                                                                                                                                                                                                                                                                                      |
| DMG/ZIP blockmaps and SHA-256 sidecars          | Blockmap digests `02c7fe30788c92b5ec06459a157b5c4096a645c398fdda867090e5ba707e4f9e` and `08ac8ed54189981039368074c0fd085348d4cd080c9cb63ae2924dcb67776398`; sidecar digests `40e95f25cf9a2297db872d3fed33ac198bd5f40901df189069a6a5e08795266f` and `d32a9e1184ce1d8ebaa611c3c4a4fbebcc885072920963b470d37e226ffaf632`; both sidecars verify                                                                                                                                                                                                                                      |
| `latest-mac.yml`                                | Version 6.0.2; 530 bytes; SHA-256 `04797813b0aae9643295329a7ee93aa75f18746a1f4a47992cfb1432813139b3`; DMG/ZIP names, byte sizes, and independently computed SHA-512 values match                                                                                                                                                                                                                                                                                                                                                                                                 |
| Downloaded signed-app isolated launch           | Pass at 1180x760; fresh disposable profile; ready local-production server; bundle, `/api/health`, updater, native About, copied support information, and desktop bridge report 6.0.2 with build `3a73662b9c3431115f77401e3620a6839f95b61d`; Right and Bottom docks remain contained and preserve the active conversation; close, Escape, Back, obsolete-state recovery, and Reset Layout restore the board and focus; bounded task creation passes; latest-version update check passes; native Quit removes app and bundled-server listeners; disposable profiles moved to Trash |
| Release validator                               | Pre-publication `pnpm validate:release -- --version 6.0.2` and `--docker-build` pass; post-publication `pnpm validate:release -- --version 6.0.2 --skip-build-output --github` passes and proves the live body equals the canonical file                                                                                                                                                                                                                                                                                                                                         |
| Homebrew cask                                   | [Issue #43](https://github.com/BradGroux/homebrew-tap/issues/43); [PR #44](https://github.com/BradGroux/homebrew-tap/pull/44); reviewed head `3bb23d5c7e7f8593ed8c4b7a294e59e4e6aa754b`; merge `03878fbbf886d24fd543422c484397747e55c80c`; registered `bradgroux/tap/veritas-kanban` resolves 6.0.2 with the published ZIP checksum and passes syntax, style, strict online audit, dry-run install, and livecheck                                                                                                                                                                |
| Verification-efficiency follow-up               | [Issue #1012](https://github.com/BradGroux/veritas-kanban/issues/1012) and [PR #1013](https://github.com/BradGroux/veritas-kanban/pull/1013) stop cosmetic label events from executing or canceling CI and reuse reviewed full-suite evidence only for exact-tree squash merges; two live cosmetic-label runs skipped every job while the authoritative run completed, and the post-merge workspace suite reused the exact reviewed tree                                                                                                                                         |

## 6.0.1 Publication Evidence

Source publication, the independent signed-macOS gate, and Homebrew
restoration are complete.

| Publication item                                | Result                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
| ----------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Release PR and merge                            | [#998](https://github.com/BradGroux/veritas-kanban/pull/998); reviewed head `1c86d90386ce9ed05639c7118ab355385b88fb37`; merge `faeec2752a79ca42adef982ad169f21fd55b0711`                                                                                                                                                                                                                                                                                                                                  |
| Annotated `v6.0.1` tag object and peeled commit | `a2388528ecd80e4b4ecc5ce6e8922dcb05f23c95`; `faeec2752a79ca42adef982ad169f21fd55b0711`                                                                                                                                                                                                                                                                                                                                                                                                                    |
| GitHub release URL                              | https://github.com/BradGroux/veritas-kanban/releases/tag/v6.0.1; stable release published 2026-07-24                                                                                                                                                                                                                                                                                                                                                                                                      |
| Desktop Release workflow URL and duration       | https://github.com/BradGroux/veritas-kanban/actions/runs/30118916300; exact merge SHA; signed and notarized job passed in 11m6s                                                                                                                                                                                                                                                                                                                                                                           |
| Signed/notarized DMG                            | `Veritas-Kanban-6.0.1-mac-arm64.dmg`; 276,120,202 bytes; SHA-256/GitHub digest `f6b811f46c92532feceb18302a7edd46ecac33580fdd3bf417bb3afd3952c22c`; Developer ID `RLBHD62MPW`, hardened runtime, Gatekeeper, and stapling pass                                                                                                                                                                                                                                                                             |
| Signed/notarized ZIP                            | `Veritas-Kanban-6.0.1-mac-arm64.zip`; 279,986,716 bytes; SHA-256/GitHub digest `f0f03e0210141b789daed09de34171c07260eaad2cf5f5c1d1f74fbd5296a4de`; extracted app Developer ID `RLBHD62MPW`, hardened runtime, Gatekeeper, and stapling pass                                                                                                                                                                                                                                                               |
| DMG/ZIP blockmaps and SHA-256 sidecars          | Blockmap digests `4cc52ca62e0cd3fb44bbe230d44811e8da87d06cef52cb45ba456e4d8e69d593` and `369b0891d9d7ae0a3641ba5cc8d6dfa0a207dfd4fd8ee6b09a46f0353b4fb3db`; sidecar digests `eb2e223c0a0220e748f7b21b9c15c8c09dfc3718e9894ddfb1330ae6d702fac1` and `32ff009d56f6d18b27608ac616dc7c7a01914b5e4382ce22070b7d0bb965b6f6`; both sidecars verify                                                                                                                                                               |
| `latest-mac.yml`                                | Version 6.0.1; 530 bytes; SHA-256 `47e6b3a2b24696873699ee11cc15de2d8b7dd580c2302ee698ae4c49ab5abbdc`; DMG/ZIP names, byte sizes, and independently computed SHA-512 values match                                                                                                                                                                                                                                                                                                                          |
| Downloaded signed-app isolated launch           | Pass; fresh disposable profile; ready local-production server; bundle, health, updater, and desktop bridge report 6.0.1; onboarding/login and bounded task creation pass; Board Chat preserves the shell; close, Escape, Back, obsolete-state recovery, and native layout reset pass; stable updater reports latest; native Quit removes both app and bundled-server listeners                                                                                                                            |
| Release validator                               | `pnpm validate:release -- --version 6.0.1 --github --repo BradGroux/veritas-kanban --docker-build` passes, including a clean production image build                                                                                                                                                                                                                                                                                                                                                       |
| Homebrew cask                                   | [Issue #40](https://github.com/BradGroux/homebrew-tap/issues/40); [PR #42](https://github.com/BradGroux/homebrew-tap/pull/42); reviewed head `0a785cc1956070a8bc05533b194108010997bedb`; merge `c23cc7e1b6d1b1d05f5117b5fdfea67806d42f48`; normal registered tap resolves 6.0.1 with the published ZIP checksum and passes syntax, style, strict online audit, dry-run install, and livecheck; [verification #41](https://github.com/BradGroux/homebrew-tap/issues/41) records the exact command evidence |

## Historical 6.0.0 Publication Evidence

Source publication completed from reviewed release PR #985. The tag-triggered
workflow, independent artifact verification, signed-app runtime check, and
Homebrew publication are also complete.

| Publication item                                | Result                                                                                                                                                                                                                         |
| ----------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| Release merge SHA                               | `1bd43f9279f5ab736bff03378d5d85243e16813e`                                                                                                                                                                                     |
| Annotated `v6.0.0` tag object and peeled commit | `85d0328a23b54bd7e7d578b5725d50cd2e0084f3`; `1bd43f9279f5ab736bff03378d5d85243e16813e`                                                                                                                                         |
| GitHub release URL                              | https://github.com/BradGroux/veritas-kanban/releases/tag/v6.0.0                                                                                                                                                                |
| Desktop Release workflow URL and duration       | https://github.com/BradGroux/veritas-kanban/actions/runs/30109135335; pass in 12m7s                                                                                                                                            |
| Signed/notarized DMG                            | `Veritas-Kanban-6.0.0-mac-arm64.dmg`; 276,118,002 bytes; SHA-256/GitHub digest `0a2a51cb279d42089770932f760bb77abedf9db767c151cc0071d1ee3e1bfa55`; Developer ID, Gatekeeper, and stapling pass                                 |
| Signed/notarized ZIP                            | `Veritas-Kanban-6.0.0-mac-arm64.zip`; 279,976,801 bytes; SHA-256/GitHub digest `7a5947bb6abd440c4d69da36def9f891e154139547f741d2f44c4733c6719cb8`; extracted app Developer ID, hardened runtime, Gatekeeper, and stapling pass |
| DMG/ZIP blockmaps and SHA-256 sidecars          | Present; blockmap digests `b31e50258dd3744a0daeef45a1f7ae375f538b24e6c68243f13c0963661b95b5` and `af99a35b1e6380a8b9888658054690846c84b325067f7108299a4eedb6993255`; both sidecars verify                                      |
| `latest-mac.yml`                                | Version 6.0.0; 530 bytes; SHA-256 `ac2e5ee7f25d235d607409a62a047359145f80dbaf9f1f5333131dc20700df72`; DMG/ZIP names, sizes, and SHA-512 values match independent downloads                                                     |
| Downloaded signed-app isolated launch           | Pass; fresh disposable profile, ready SQLite, health/update version 6.0.0, latest-version update check, task creation, and clean quit                                                                                          |
| Homebrew tap issue/PR/merge                     | [Issue #36](https://github.com/BradGroux/homebrew-tap/issues/36); [PR #37](https://github.com/BradGroux/homebrew-tap/pull/37); merge `7d77106e7c526a0975c49b9b11e0c9526921ead0`                                                |
| Homebrew style/audit/dry-run/livecheck          | Pass against registered `bradgroux/tap/veritas-kanban` at 6.0.0 with the published ZIP checksum                                                                                                                                |

Source CI, tag creation, asset upload, signing, notarization, downloaded runtime,
and Homebrew availability are independent gates.

## Deferred v6.x Work And Accepted Limits

- [Run-scoped egress gateway](https://github.com/BradGroux/veritas-kanban/issues/855)
  is deferred for fine-grained HTTP method/path/domain enforcement. Required
  rules unsupported by current provider evidence already block launch.
- Grok Build and GitHub Copilot CLI retain documented source-provenance limits.
- GitHub Copilot CLI ACP remains public preview.
- Buzz Agent does not resume in-memory sessions; Buzz communication does not
  project files, reactions, forums, DMs, or destructive edit/delete behavior.
- [Packaged desktop version reporting](https://github.com/BradGroux/veritas-kanban/issues/986)
  landed in 6.0.1; [native build and support information](https://github.com/BradGroux/veritas-kanban/issues/1005)
  is added in 6.0.2. Exact equality across the downloaded bundle, health
  endpoint, updater metadata, native About, copied support text, and desktop
  bridge remains a signed-publication gate.
- Linux and Windows desktop packages remain unsigned previews.
- Provider and Buzz Settings screenshots were captured from the isolated
  profile. No public-safe active approval existed, so approval visual evidence
  remains a documented text contract.
