veritas-kanban/docs/V6-GA-CHECKLIST.md

Veritas Kanban v6 GA Checklist

This checklist is the stable-release gate for Veritas Kanban 6.0.2. Command results, platform details, workflow links, limitations, and artifact hashes belong in v6 Release Candidate Evidence Packet.

Documentation freshness: 2026-07-24 for Veritas Kanban 6.0.2.

Source And Scope

• The Buzz integration epic and every required child are closed through merged, focused pull requests.
• The equal-footing harness epic and every required child are closed through merged, focused pull requests.
• The release tracker lists the exact main baseline, release branch, release PR, deferred v6.x work, and no unresolved release blocker.
• Root, shared, server, web, CLI, MCP, and desktop manifests are 6.0.2.
• AGENTS.md, README badge, health, CLI, MCP, desktop bundle, artifact names, updater metadata, changelog, and current docs agree on 6.0.2.
• The public API remains intentionally v1, with additive v6 contracts and tested CLI/MCP compatibility.

6.0.1 Stabilization

• Task drawers, shared overlays, Archive cards, scoring profiles, and template authoring have focused scroll, resize, compact-window, and keyboard coverage (#935, #938, #939, #941).
• Workflow loading, route/task/overlay history, and scoring-profile creation have focused recovery and state-transition coverage (#936, #937, #943).
• Operations Digest inventory, filters, exclusions, source IDs, window semantics, run de-duplication, and data quality reconcile in JSON, Markdown, scheduled snapshots, and UI tests (#944).
• Chat has visible, Escape, browser Back, persisted-state, compact-window, and native menu recovery coverage; the independently downloaded signed app passes the same recovery checks (#945).
• Desktop setup is version-neutral and the bridge consumes Electron's application version; the published bundle, health endpoint, updater, and bridge all report 6.0.1 (#986).

6.0.2 Desktop Recovery Hotfix

• Board Chat and Squad Chat default to a bounded right-side Workbench dock and can switch between Right and Bottom without remounting the active conversation (#1004).
• Chat width and height clamp to the live viewport; scrolling, wheel input, Close, Escape, browser Back, Reset Layout, persisted-state recovery, and focus restoration have focused coverage (#1004).
• Native About, copied support information, the desktop bridge, and updater fallback consume one authoritative version/build/channel/OS/architecture record (#1005).
• Pull-request verification uses documentation-only, focused, or full test scope, while explicit and milestone release gates remain full (#1000).
• Published release notes are sourced from docs/releases/vX.Y.Z.md, use one full-width Markdown line per paragraph or list item, reject blockquotes and overlong prose blocks, and are compared with GitHub during post-publication validation. Run pnpm test:release-format, pnpm validate:release, and the post-publication pnpm validate:release -- --github check.

Provider Certification

• Buzz Agent v0.4.24 / buzz-agent 0.1.0 passes the composed credential-free compatibility gate at the pinned commit and fixture revision.
• Grok Build v0.2.111 build 94172f2aa4e5 passes exact-version ACP, restrictive-policy, source-limitation, and deterministic fixtures.
• Codex app-server 0.145.0 passes exact generated schemas, disabled remote control, lifecycle, approval, event, completion, and deterministic fixtures.
• Codex CLI and @openai/codex-sdk 0.144.3 pass their provider-runtime, launch, tool, event, credential, and completion gates.
• Claude Code 2.1.218 passes bare-mode launch, permission, environment, stream, lifecycle, MCP, event, completion, and deterministic fixtures.
• GitHub Copilot CLI 1.0.74 passes exact ACP handshake, restrictive launch, preview/source-limit, and deterministic fixtures.
• Hermes v2026.7.7.2 and OpenClaw v2026.6.11 retain truthful existing support and explicit unsupported controls.
• Settings, API, vk doctor --json, dispatch, and telemetry report the same Detected, Configured, Certified, Degraded, or Unsupported state.
• Every Certified claim has exact runtime/build and passing deterministic evidence. Credential-gated smoke is recorded separately; unavailable credentials, quota, subscriptions, binaries, and upstream services are reported rather than inferred.

Security, Migration, And Data Preservation

• Legacy provider profiles normalize only through exact built-in type/command identity and never fall through to OpenClaw.
• Claude Code permission bypass is absent and unsafe custom launch controls fail closed.
• Approval decisions bind to exact action, attempt, reviewer, expiry, and authentication freshness; replay and drift tests pass.
• Credential definitions, leases, run catalogs, the veritas-run bridge, logs, telemetry, fixtures, and APIs remain value-free outside the one-shot downstream call.
• Provider protocol frames, stdout/stderr, events, retries, timeouts, and retained payloads are bounded and redacted.
• Required unsupported sandbox, network, tool, MCP, credential, lifecycle, and provider controls block before attempt mutation.
• A populated v5.2.5 desktop workspace upgrades through an isolated copy with matching representative counts, PRAGMA quick_check=ok, preserved owner/profile metadata, preserved registry absence, and a working v6 runtime. A separate exact-format v5.2.5 registry fixture verifies populated registry compatibility.
• File-backed migration and restore paths pass their seven-test portability fixture.
• Rollback guidance has been tested against the actual schema/profile posture and does not promise destructive down migration.
• Secret and tracked-runtime-security scans pass.

Application And Runtime

• A clean dependency install and build produce new shared, server, web, CLI, MCP, and desktop outputs without reused dist, staged desktop payloads, or prior release artifacts.
• An isolated in-app Browser run verifies first-run, login, provider and Buzz Settings, degraded states, themes, command-palette focus, and a clean console. Deterministic and E2E suites verify task launch, causal events, approvals, cancellation, completion, MCP, worktrees, telemetry, and Buzz mapping/replay under the maintainer-approved release-evidence split recorded in the evidence packet.
• Dark/light themes, keyboard flow, labels, and focus are inspected in the in-app Browser; compact layout and recoverable error states pass the E2E matrix under the same evidence split.
• A fresh native macOS build verifies one instance, visible window, bundled server/web health, menus, shortcuts, window restoration, update check, clean close, reopen, and quit.
• The unsigned DMG/ZIP is inspected and the packaged app launches from the packaged artifact with an isolated profile.

Mantine component-system cleanup gate

• Run pnpm --filter @veritas-kanban/web build before the bundle check.
• Run pnpm qa:mantine.
• Run pnpm test:e2e -- e2e/mantine-qa-gate.spec.ts.
• Retain visual and accessibility evidence for current routes, dark/light themes, compact widths, keyboard navigation, focus, labels, and touch targets.
• Track planned but unavailable surfaces as temporary holdouts instead of claiming coverage.
• No active feature imports legacy primitive compatibility wrappers outside documented internals.
• No direct shadcn/Radix dependency or vendor-radix bundle returns.
• Bundle sizes remain within the recorded QA budgets or have an explicit release-risk acceptance.

Final Release Validation Commands

Run from the clean release-candidate worktree:

node --version
pnpm --version
git --version
pnpm install --frozen-lockfile
pnpm check:pnpm-settings
pnpm audit --prod --audit-level=high
pnpm lint
pnpm lint:budget
pnpm qa:mantine
pnpm typecheck
pnpm build
pnpm test:unit
pnpm test:e2e
pnpm smoke:cli-mcp
pnpm test:buzz:compatibility
pnpm desktop:test
pnpm desktop:build
pnpm desktop:check:electron-artifacts
pnpm desktop:smoke:mac:local
pnpm desktop:package:mac:unsigned
pnpm validate:release -- --version 6.0.2
pnpm validate:release -- --version 6.0.2 --docker-build

Provider-specific deterministic suites are part of pnpm test:unit; record their test counts and exact fixture baselines separately. Run credential-gated provider smoke only when the exact binary, authentication, subscription, and quota are available.

Distribution And Post-Publication

• The ready release PR passes required CI and the milestone-wide workspace suite, then merges to main.
• Annotated tag v6.0.2 peels to the exact release merge commit.
• The GitHub release is published from reviewed docs/releases/v6.0.2.md without hard-wrapped prose.
• Desktop Release completes with signed/notarized arm64 DMG and ZIP, blockmaps, latest-mac.yml, and SHA-256 sidecars.
• Independent downloads match GitHub digests, sidecars, updater metadata, byte sizes, and SHA-256 values.
• DMG and ZIP app signatures, hardened runtime, Gatekeeper, and notarization stapling pass.
• The downloaded signed app launches with an isolated profile, reports 6.0.2 through bundle, health, updater, native About, copied support information, and desktop bridge metadata; verifies Right and Bottom Chat recovery at the minimum supported window; executes a bounded task; and quits cleanly.
• pnpm validate:release -- --version 6.0.2 --github --repo BradGroux/veritas-kanban passes.
• The Homebrew cask PR uses the published ZIP checksum, merges, and the registered tap passes style, strict online audit, dry-run install, and livecheck.
• The evidence packet contains release/workflow/asset/Homebrew links, exact hashes, runtime results, limitations, and deferred v6.x issues.
• The release tracker closes only after every distribution surface above is independently verified.