Veritas Kanban v6 Release Candidate Evidence Packet
This packet records the Veritas Kanban 6.1.1 maintenance release candidate and
retains historical evidence for the completed 6.1.0 release, the quarantined 6.0.0 prerelease, the 6.0.1
stabilization release, and the 6.0.2 desktop recovery hotfix. It separates
merged implementation, deterministic conformance, local runtime proof, signed
publication, and Homebrew availability.
Veritas Kanban 6.1.0 remains the supported stable v6 release until 6.1.1
publication and artifact verification complete. Do not use 6.0.0 for installation or upgrade validation.
Documentation freshness: 2026-08-22 for the Veritas Kanban 6.1.1 release candidate.
6.1.1 Maintenance Release Candidate
| Field |
Value |
| Release version |
6.1.1 |
| Source branch |
fix/release-6-1-1-1156 |
| Source baseline |
main after the audited task-drawer fix, dependency rollup, and Chalk 6 disposition (#1154, #1155, #1149) |
| Included issues |
#1153 and release tracker #1156 |
| Pull-request audit |
#1154 accepted and merged with browser proof; #1155 accepted with refreshed security floors; #1149 accepted after Node.js and test review; #1150 closed as unnecessary because pnpm/action-setup@v6 already resolves to 6.0.9; #1148 rejected because its engine floor and 65 failing tests violate the release contract |
| Publication state |
Pending the consolidated release gate, release PR, annotated tag, GitHub publication, signed/notarized assets, installed-app verification, and Homebrew cask update |
6.1.1 verification evidence
| Gate |
Candidate result |
| Task Detail and mobile browser regressions |
Chromium verifies the Mantine tabs root is a flex column, the overlay has real overflow, and wheel input increases the scroll position. Chromium and WebKit verify nested task-card controls do not activate the card and status movement completes through the visible save lifecycle |
| Workflow storage readiness |
The release-PR workspace job exposed an ENOENT startup race between asynchronous workflow-directory creation and the first write. File-backed workflow operations now await the shared readiness promise; the complete optimistic-concurrency route test passes in ten consecutive isolated runs. |
| Dependency security |
pnpm audit --prod and full pnpm audit report no known vulnerabilities after stale override floors were refreshed |
| Dependency PR CI |
Build, lint/typecheck, security audit, affected-workspace tests, and unsigned macOS, Linux, and Windows packaging passed on #1155 |
| Consolidated candidate |
Frozen install, production and full audits, package-manager policy, release formatting, lint and 592-warning budget, typecheck, build, 3,771 workspace tests, 37 Playwright cases across Chromium and WebKit, Mantine QA, CLI/MCP smoke, 50 Buzz compatibility tests, 67 desktop tests, seven readiness tests, unsigned macOS packaging, packaged-app smoke, and the 6.1.1 release validator pass. The local Docker build variant was unavailable because the Docker daemon was not running. Independent review is owner-directed and is not part of the active release SOP. |
6.1.0 Roadmap Release
| Field |
Value |
| Release version |
6.1.0 |
| Source branch |
release/v6.1.0 |
| Source baseline |
0a19b9050da8915042860f55ef9ca009d164e816, the release integration of main after #1142 cleared the milestone blockers |
| Included issues |
#855, #864, #865, #866, #867, #868, #871, #872, #873, #876, and #879 |
| Source verification |
Focused verification passed per merged roadmap slice. PR #1142 completed append-only admission writes, restored the complete filesystem test-double surface, and mapped the exact knowledge-collection permission prefix. The consolidated candidate then passed pnpm test:unit across every workspace; server reported 3,234 passing and 5 skipped tests, web reported 469 passing tests, and desktop reported 67 passing tests. |
| Publication state |
Complete. PR #1137 merged as e5aba49e61fca35c14616574a22174c0f848812f; annotated v6.1.0, signed/notarized assets, post-publication validation, isolated installed-app readiness, and Homebrew PR #46 are verified. |
6.1.0 issue traceability
| Issue |
Outcome |
| #855 |
Run-scoped egress gateway and enforceable network policy |
| #864 |
Durable admission, aggregate budgets, fairness, cancellation, and circuit breaking |
| #865 |
Durable goal supervision across turns, restarts, and continuations |
| #866 |
Reviewed, attributable memory extraction and consolidation |
| #867 |
Source-grounded workspace knowledge collections |
| #868 |
Knowledge integrity linting, material-claim lifecycle, scheduling, semantic candidates, and health |
| #871 |
Run-scoped background-command and monitor supervision |
| #872 |
Preview-first turn-boundary checkpoints and attributable rewind |
| #873 |
Stalled and repetitive run detection with bounded recovery |
| #876 |
Governed artifact spill for oversized run output |
| #879 |
Agent-dependency load shedding integrated with circuit breakers |
6.0.2 Desktop Recovery Candidate
| Field |
Value |
| Release version |
6.0.2 |
| Release tracker |
#1010 |
| Source branch |
release/v6.0.2-1010 |
| Source baseline |
2f18229ff24153ef33b5a21de21f0befb94d8a08, the merged #1005 main commit with green CI and cross-platform unsigned desktop artifacts |
| Included issues |
#1000, #1004, #1005, and #1010 |
| Source verification |
Focused tests and rendered smoke per fix; reviewed full workspace evidence on the exact #1005 merge ancestry; one milestone release validation gate |
| Signed runtime gate |
Exact 6.0.2 equality across bundle, health, updater, native About, copied support text, and desktop bridge; Right/Bottom Chat recovery at the minimum supported window; bounded task; clean quit |
| Distribution gate |
Annotated tag, reviewed full-width GitHub release body, signed/notarized DMG and ZIP, updater metadata, independent digests, GitHub release validation, and verified Homebrew cask |
6.0.2 issue traceability
| Issue |
Pull request |
Outcome |
| #1000 |
#1003 |
Deterministic documentation, focused, and full CI test scope |
| #1004 |
#1008 |
Bounded right/bottom Chat dock with complete visible recovery paths |
| #1005 |
#1009 |
Authoritative native version/build/channel/OS/architecture record and offline copy action |
| #1010 |
#1011 |
Version, documentation, full-width release body, signed publication, downloaded-app verification, and Homebrew gate |
6.0.1 Stabilization Candidate
| Field |
Value |
| Release version |
6.0.1 |
| Stabilization tracker |
#924 |
| Source branch |
release/v6.0.1 |
| Superseded publication |
v6.0.0, retained as a quarantined prerelease |
| Stabilization issues |
#935, #936, #937, #938, #939, #941, #943, #944, #945, and #986 |
| Source verification |
Focused tests plus changed-file CI per issue; one full workspace suite is reserved for the release PR |
| Signed runtime gate |
Exact 6.0.1 equality across bundle, health, updater, and desktop bridge metadata; Chat recovery; bounded task; clean quit |
| Distribution gate |
Signed/notarized DMG and ZIP, updater metadata, independent checksums, GitHub release validation, and verified Homebrew cask |
Stabilization issue traceability
| Issue |
Pull request |
Outcome |
| #935 |
#992 |
Task drawers and shared overlays remain usable at compact heights |
| #936 |
#989 |
Workflow actions normalize omitted collections and surface recoverable failures |
| #937 |
#993 |
Navigation and nested overlays preserve the actual route origin and scroll state |
| #938 |
#995 |
Scoring profile content has intentional nested scroll ownership |
| #939 |
#991 |
Archive cards and layout remain reachable at compact sizes |
| #941 |
#996 |
Template editing is a complete visible authoring flow |
| #943 |
#990 |
New scoring profiles open as visible validated drafts |
| #944 |
#994 |
Operations Digest reconciles current state, windowed events, exclusions, and source evidence |
| #945 |
#988 |
Chat has visible, keyboard, browser-history, persisted-state, compact-window, and native-menu recovery paths |
| #986 |
#997 |
Desktop setup is version-neutral and the bridge consumes Electron's application version |
Historical 6.0.0 Release Scope
Issue And Pull Request Traceability
Support, task, launch, credential, and worktree foundations
Durable shared runtime
Harness adapters and Buzz delivery
Release-blocking native fixes
Release engineering
Reviewed Provider Baselines
| Harness |
Version/build |
Deterministic posture |
Credential-gated posture |
| Buzz Agent |
v0.4.24 / 710ed9...; buzz-agent 0.1.0 |
Pass: 7 files, 50 tests |
Binary unavailable; no live claim |
| Grok Build |
v0.2.111 / 94172f2aa4e5 |
Pass in workspace gate |
Installed 0.2.22 is stale and unauthenticated |
| Codex app-server |
0.145.0 / 25af12... |
Pass in workspace gate |
Pass: exact authenticated 0.145.0, 1 smoke test |
| Codex SDK |
0.144.3 |
Pass in workspace gate |
Deterministic evidence only |
| Claude Code |
2.1.218 |
Pass in workspace gate |
Binary unavailable; no live claim |
| GitHub Copilot CLI |
1.0.74 / 2b809c... tag commit |
Pass in workspace gate |
Exact binary installed; authentication unavailable |
| Hermes |
v2026.7.7.2 |
Pass in workspace gate |
Binary unavailable; retained non-Certified tier |
| OpenClaw |
v2026.6.11 |
Pass in workspace gate |
Installed 2026.6.1 is stale; no live gateway claim |
No row may be changed to a live passing claim without exact command/runtime
evidence. A skipped credential gate remains skipped, not passed.
Observed isolated-runtime support tiers
The packaged 6.0.0 candidate returned the configured-profile rows below through
the redacted harness-compatibility-matrix/v1 status path from the copied
v5.2.5 profile. The OpenClaw row applies the same normalized tier contract at
the host executable boundary because that copied profile had no OpenClaw entry.
Deterministic fixture results do not replace these live tiers.
| Profile |
Observed tier |
Certification |
Evidence date |
Runtime evidence |
| OpenAI Codex CLI |
Configured |
Not current |
2026-07-24 |
codex-cli 0.145.0; executable and authentication detected |
| OpenAI Codex SDK |
Detected |
Not current |
2026-07-24 |
codex-cli 0.145.0; disabled profile |
| OpenAI Codex app-server |
Detected |
Not current |
2026-07-24 |
codex-cli 0.145.0; disabled profile |
| GitHub Copilot CLI |
Detected |
Not current |
2026-07-24 |
GitHub Copilot CLI 1.0.74; disabled profile; auth not inferred |
| Grok Build |
Detected |
Not current |
2026-07-24 |
0.2.22 build 967574cb117; disabled and older than reviewed 0.2.111 |
| Claude Code |
Degraded |
Not current |
2026-07-24 |
Executable not installed |
| Buzz Agent |
Degraded |
Not current |
2026-07-24 |
Executable not installed |
| Hermes |
Degraded |
Not current |
2026-07-24 |
Executable not installed |
| OpenClaw |
Detected |
Not current |
2026-07-24 |
2026.6.1 executable found; no enabled profile or live gateway claim |
No profile reported Certified because persisted certification evidence was
not current in this isolated profile. OpenClaw is Detected at the host boundary
because the executable exists while no profile is enabled; its stale
2026.6.1 build is not a live gateway claim. The exact authenticated app-server
smoke remains separate command evidence, not a support-tier mutation.
Verification Matrix
Results are filled from the clean release candidate. Counts and elapsed time are
recorded when the tool reports them.
| Gate |
Environment |
Result |
Evidence or limitation |
| Toolchain versions |
macOS 26.5.2 arm64 |
Pass |
Node 26.5.0; pnpm 11.1.1; Git 2.55.0 |
pnpm install --frozen-lockfile |
clean release worktree |
Pass |
1,116 packages in 4.8 s; lockfile pinned to pnpm 11.1.1 |
pnpm check:pnpm-settings |
clean release worktree |
Pass |
Package manager and instruction versions agree |
pnpm audit --prod --audit-level=high |
production dependencies |
Pass |
0 high/critical; 1 low and 1 moderate retained |
pnpm lint and pnpm lint:budget |
all tracked source/docs |
Pass |
0 errors; 595 warnings within the 600-warning budget |
pnpm qa:mantine |
built web bundle |
Pass |
Initial JS 238.9 KiB gzip; CSS 51.4 KiB gzip |
pnpm typecheck |
all workspaces |
Pass |
11.97 s |
pnpm build |
all workspaces |
Pass |
16.53 s |
pnpm test:unit |
sequential workspaces |
Pass |
3,217 passed, 4 skipped; 329 files; 48.74 s |
pnpm test:e2e |
Playwright matrix |
Pass |
36/36; Chromium, mobile Chromium, mobile WebKit; 79.76 s |
pnpm smoke:cli-mcp |
release output |
Limited |
Static versions/builds pass; live read/write skipped without test key |
pnpm test:buzz:compatibility |
credential-free fixtures |
Pass |
7 files, 50/50 tests; 4.30 s Vitest |
| Provider/lifecycle/approval/MCP/credential suites |
credential-free fixtures |
Pass |
Focused release integration set: 4 files, 83/83 tests, 2.76 s |
pnpm desktop:test |
macOS arm64 |
Pass |
14 files, 61 tests, 344 ms |
pnpm desktop:build |
macOS arm64 |
Pass |
1.20 s; Electron artifact check 4/4 |
pnpm desktop:check:electron-artifacts |
fresh desktop output |
Pass |
Main and preload artifacts accepted |
pnpm desktop:smoke:mac:local |
isolated unsigned package |
Pass |
25.28 s |
pnpm desktop:package:mac:unsigned |
macOS arm64 |
Pass |
Final post-blocker DMG/ZIP package in 57.49 s |
| v5.2.5 populated-profile upgrade |
isolated copy |
Pass |
Matching counts, integrity, owner summary, profile; registry absence preserved |
| v5.2.5 registry compatibility |
exact-format deterministic test |
Pass |
1/1; identity, provider, capabilities, metadata, status, and session preserved |
| File-backed migration and restore |
isolated deterministic fixture |
Pass |
7/7; tasks, config, workflows, chat, telemetry, backup, and restore |
| In-app Browser runtime |
isolated server/web |
Pass |
First run, login, provider/Buzz settings, themes, palette/focus; 0 console errors |
| Local browser automation |
Playwright matrix |
Pass |
36-route/interaction E2E matrix |
| Native desktop runtime |
isolated profile |
Pass |
One instance, window, health, menus, reopen, update, clean quit |
pnpm validate:release -- --version 6.0.0 |
clean release worktree |
Pass |
0.60 s |
pnpm validate:release -- --version 6.0.0 --docker-build |
production target |
Pass |
116.39 s; veritas-kanban:validate-6.0.0 |
| Focused standards review |
diff from 398fe7f6... |
Pass |
GPT-5.6 standards axis; no remaining findings; cross-model review waived |
| Focused spec/security claim review |
release tracker and goal prompt |
Pass |
GPT-5.6 spec axis; findings corrected; secret/security scan passed |
Accepted browser verification split
On 2026-07-24 the maintainer directed a sustainable verification cadence:
focused behavior tests for issue pull requests, changed-file CI per pull
request, and one complete workspace suite at the final release gate. Applying
that direction, the in-app Browser pass covered rendered and interactive
behavior that benefits from manual inspection: first run, login, provider and
Buzz Settings, degraded states, dark/light themes, command-palette focus,
labels, and console health. Stateful task launch, causal events, approvals,
cancellation, Buzz replay, MCP, worktrees, telemetry, completion, compact
layout, and recoverable errors remained in the passing deterministic and E2E
automation instead of being duplicated manually in the in-app Browser.
This is an explicit release-evidence split, not a claim that those scripted
flows were manually clicked in the in-app Browser.
Migration And Data Preservation
Completed isolated drill:
- source: latest signed v5.2.5 desktop workspace copy under an isolated
codex-v525-smoke profile;
- no database writer before copy or after final quit;
PRAGMA quick_check=ok before and after;- matching counts before and after: 2 tasks, 3 Squad Chat messages,
1 telemetry event, 1 workflow definition, 1 workflow run,
1 app-config document, and 1 user;
- agent registry absent before and after; no implicit provider enablement or
OpenClaw fallback;
- a separate automated fixture using the exact v5.2.5 registry shape preserved
agent identity, provider, capabilities, metadata, status, and session
reference in 1/1 focused test;
- the file-backed portability suite passed 7/7 for tasks, configuration,
workflows, chats, telemetry, backup, failure recovery, and restore;
- onboarding detected and summarized the populated database, v6 health
reported 6.0.0, the packaged renderer opened, provider and Buzz settings
rendered, reopen/single-instance/menu/update/quit checks passed;
- the final updater check reported 5.2.5 as older with downgrade disallowed,
and download/install actions remained disabled;
- rollback remains restore-first: retain the stopped-writer v5.2.5 backup
because destructive schema down-migration is not promised.
The signed profile contained no agent registry, so the native drill proves that
absence remains absence while the exact-format automated fixture covers a
populated v5 registry. The signed fixture's two task rows were deliberately
minimal direct-SQL migration records, so the onboarding count is authoritative
evidence; their incomplete legacy JSON is not claimed as a rendered task-card
test.
No private data, credential value, raw provider conversation, or unrestricted
runtime profile is retained in this packet.
6.1.0 Publication Evidence
Source publication, signed-macOS verification, full-width release-note validation, isolated installed-app readiness, and Homebrew distribution are complete.
| Publication item |
Result |
| Release PR and merge |
#1137; reviewed head ec9d7b6e86bcb5566cf04419db8817fa836508ae; squash merge e5aba49e61fca35c14616574a22174c0f848812f |
Annotated v6.1.0 tag object and peeled commit |
415a88e50e96a5c1ca02034e7e2392c08482d6e0; e5aba49e61fca35c14616574a22174c0f848812f |
| GitHub release URL and body |
https://github.com/BradGroux/veritas-kanban/releases/tag/v6.1.0; stable release published 2026-07-26; the post-publication release validator proves the live body exactly matches docs/releases/v6.1.0.md, which passes the checked-in full-width format gate |
| Release CI and unsigned packaging |
CI run 30199975494 passed security audit, lint, typecheck, build, and changed tests; artifact run 30199975488 passed macOS, Linux, and Windows preview packaging |
| Desktop Release workflow URL and duration |
Run 30200162940; exact release merge SHA; signed and notarized job passed in 10m55s |
| Signed/notarized DMG |
Veritas-Kanban-6.1.0-mac-arm64.dmg; 277,393,979 bytes; SHA-256/GitHub digest b7f3fb09a4b35c34bf015b3fa4f878bf6c91b126d2f5c5bad70e602839b9d599; release workflow signature, Gatekeeper, and stapling validation passed |
| Signed/notarized ZIP |
Veritas-Kanban-6.1.0-mac-arm64.zip; 281,520,166 bytes; SHA-256/GitHub digest and published sidecar 6ca5f99394fb551b6b5fb60006ffaa8e5a793808be1382d49c4b3a3209e98701; Homebrew strict online audit independently downloaded and accepted the asset |
| DMG/ZIP blockmaps and SHA-256 sidecars |
Blockmap digests 29582df6dbdc121cbbfab4255c7ccaf5c258100456be7230b971d65a27a8eaf9 and f9834743c9523f334c6d7113af00402f16c18c08a5f35345313ad0f644ecb886; sidecar digests 33b2eb510b4eaa6b51082aa9dc0090b4e5e578316d51b98dcf5305016d63577e and bdf782510a2aebb35b22d29875d92bcaf0c75415164c0644f01d43a58914e301 |
latest-mac.yml |
Version 6.1.0; 530 bytes; SHA-256 b51be7cb54b37dc7cf49e045c276d7d09a4563e9462583a3eaec72d972c88c6d |
| Installed signed-app isolated launch |
Homebrew upgraded the installed cask from 6.0.2 to 6.1.0. CFBundleShortVersionString reports 6.1.0; deep strict code-signature validation, Gatekeeper acceptance from notarized Developer ID RLBHD62MPW, and stapling validation pass. A disposable profile and workspace launched the packaged app on isolated port 3101; exact-version readiness passed in 6.294s and proved the packaged app owned the listener. The process stopped cleanly, the disposable user-data directory moved to Trash, and the existing workspace was not opened. |
| Compatibility smoke |
CLI/MCP version and build-output smoke passed with zero failures and two expected live read/write skips because no VK_API_KEY was supplied; Buzz deterministic compatibility passed 7 files and 50 tests |
| Release validator |
Post-publication pnpm validate:release -- --version 6.1.0 --skip-build-output --github --repo BradGroux/veritas-kanban passes and proves the published release body equals the canonical checked-in file |
| Homebrew cask |
Issue #45; PR #46; reviewed head 222c5a8; merge 4179cce931e7a7e6401a0e3fcd5097bcc23ff830; registered bradgroux/tap/veritas-kanban resolves 6.1.0 with the published ZIP checksum and passes Ruby syntax, style, strict online audit, dry-run install, livecheck, installed-cask upgrade, and exact-version verification |
6.0.2 Publication Evidence
Source publication, independent signed-macOS verification, release-note
format validation, and Homebrew distribution are complete.
| Publication item |
Result |
| Release PR and merge |
#1011; reviewed head 88fb70c23cf10ac58b6444b9fd08af4077956bb6; squash merge 3a73662b9c3431115f77401e3620a6839f95b61d; the two commits have identical Git trees |
Annotated v6.0.2 tag object and peeled commit |
a56785e0f9052572982332bb974dbab871c0c971; 3a73662b9c3431115f77401e3620a6839f95b61d |
| GitHub release URL and body |
https://github.com/BradGroux/veritas-kanban/releases/tag/v6.0.2; stable release published 2026-07-24; live body exactly matches docs/releases/v6.0.2.md; no carriage returns, hard-wrapped prose, trailing-space breaks, literal escaped newlines, or HTML <br> |
| Desktop Release workflow URL and duration |
https://github.com/BradGroux/veritas-kanban/actions/runs/30132949865; exact release merge SHA; signed and notarized job passed in 11m52s |
| Signed/notarized DMG |
Veritas-Kanban-6.0.2-mac-arm64.dmg; 276,146,896 bytes; SHA-256/GitHub digest 2cf7deb9c600036468db12436988b1c23b679130f088a46a5a910366119ea52b; Developer ID RLBHD62MPW, hardened runtime, Gatekeeper, and stapling pass; the mounted app independently passes the same signature, Gatekeeper, and stapling checks |
| Signed/notarized ZIP |
Veritas-Kanban-6.0.2-mac-arm64.zip; 279,993,375 bytes; SHA-256/GitHub digest b6f389c67f3a99086210df104c8cdec4976b9bb56a7cea5b32e611fbc41c21cd; extracted app Developer ID RLBHD62MPW, hardened runtime, Gatekeeper, and stapling pass |
| DMG/ZIP blockmaps and SHA-256 sidecars |
Blockmap digests 02c7fe30788c92b5ec06459a157b5c4096a645c398fdda867090e5ba707e4f9e and 08ac8ed54189981039368074c0fd085348d4cd080c9cb63ae2924dcb67776398; sidecar digests 40e95f25cf9a2297db872d3fed33ac198bd5f40901df189069a6a5e08795266f and d32a9e1184ce1d8ebaa611c3c4a4fbebcc885072920963b470d37e226ffaf632; both sidecars verify |
latest-mac.yml |
Version 6.0.2; 530 bytes; SHA-256 04797813b0aae9643295329a7ee93aa75f18746a1f4a47992cfb1432813139b3; DMG/ZIP names, byte sizes, and independently computed SHA-512 values match |
| Downloaded signed-app isolated launch |
Pass at 1180x760; fresh disposable profile; ready local-production server; bundle, /api/health, updater, native About, copied support information, and desktop bridge report 6.0.2 with build 3a73662b9c3431115f77401e3620a6839f95b61d; Right and Bottom docks remain contained and preserve the active conversation; close, Escape, Back, obsolete-state recovery, and Reset Layout restore the board and focus; bounded task creation passes; latest-version update check passes; native Quit removes app and bundled-server listeners; disposable profiles moved to Trash |
| Release validator |
Pre-publication pnpm validate:release -- --version 6.0.2 and --docker-build pass; post-publication pnpm validate:release -- --version 6.0.2 --skip-build-output --github passes and proves the live body equals the canonical file |
| Homebrew cask |
Issue #43; PR #44; reviewed head 3bb23d5c7e7f8593ed8c4b7a294e59e4e6aa754b; merge 03878fbbf886d24fd543422c484397747e55c80c; registered bradgroux/tap/veritas-kanban resolves 6.0.2 with the published ZIP checksum and passes syntax, style, strict online audit, dry-run install, and livecheck |
| Verification-efficiency follow-up |
Issue #1012 and PR #1013 stop cosmetic label events from executing or canceling CI and reuse reviewed full-suite evidence only for exact-tree squash merges; two live cosmetic-label runs skipped every job while the authoritative run completed, and the post-merge workspace suite reused the exact reviewed tree |
6.0.1 Publication Evidence
Source publication, the independent signed-macOS gate, and Homebrew
restoration are complete.
| Publication item |
Result |
| Release PR and merge |
#998; reviewed head 1c86d90386ce9ed05639c7118ab355385b88fb37; merge faeec2752a79ca42adef982ad169f21fd55b0711 |
Annotated v6.0.1 tag object and peeled commit |
a2388528ecd80e4b4ecc5ce6e8922dcb05f23c95; faeec2752a79ca42adef982ad169f21fd55b0711 |
| GitHub release URL |
https://github.com/BradGroux/veritas-kanban/releases/tag/v6.0.1; stable release published 2026-07-24 |
| Desktop Release workflow URL and duration |
https://github.com/BradGroux/veritas-kanban/actions/runs/30118916300; exact merge SHA; signed and notarized job passed in 11m6s |
| Signed/notarized DMG |
Veritas-Kanban-6.0.1-mac-arm64.dmg; 276,120,202 bytes; SHA-256/GitHub digest f6b811f46c92532feceb18302a7edd46ecac33580fdd3bf417bb3afd3952c22c; Developer ID RLBHD62MPW, hardened runtime, Gatekeeper, and stapling pass |
| Signed/notarized ZIP |
Veritas-Kanban-6.0.1-mac-arm64.zip; 279,986,716 bytes; SHA-256/GitHub digest f0f03e0210141b789daed09de34171c07260eaad2cf5f5c1d1f74fbd5296a4de; extracted app Developer ID RLBHD62MPW, hardened runtime, Gatekeeper, and stapling pass |
| DMG/ZIP blockmaps and SHA-256 sidecars |
Blockmap digests 4cc52ca62e0cd3fb44bbe230d44811e8da87d06cef52cb45ba456e4d8e69d593 and 369b0891d9d7ae0a3641ba5cc8d6dfa0a207dfd4fd8ee6b09a46f0353b4fb3db; sidecar digests eb2e223c0a0220e748f7b21b9c15c8c09dfc3718e9894ddfb1330ae6d702fac1 and 32ff009d56f6d18b27608ac616dc7c7a01914b5e4382ce22070b7d0bb965b6f6; both sidecars verify |
latest-mac.yml |
Version 6.0.1; 530 bytes; SHA-256 47e6b3a2b24696873699ee11cc15de2d8b7dd580c2302ee698ae4c49ab5abbdc; DMG/ZIP names, byte sizes, and independently computed SHA-512 values match |
| Downloaded signed-app isolated launch |
Pass; fresh disposable profile; ready local-production server; bundle, health, updater, and desktop bridge report 6.0.1; onboarding/login and bounded task creation pass; Board Chat preserves the shell; close, Escape, Back, obsolete-state recovery, and native layout reset pass; stable updater reports latest; native Quit removes both app and bundled-server listeners |
| Release validator |
pnpm validate:release -- --version 6.0.1 --github --repo BradGroux/veritas-kanban --docker-build passes, including a clean production image build |
| Homebrew cask |
Issue #40; PR #42; reviewed head 0a785cc1956070a8bc05533b194108010997bedb; merge c23cc7e1b6d1b1d05f5117b5fdfea67806d42f48; normal registered tap resolves 6.0.1 with the published ZIP checksum and passes syntax, style, strict online audit, dry-run install, and livecheck; verification #41 records the exact command evidence |
Historical 6.0.0 Publication Evidence
Source publication completed from reviewed release PR #985. The tag-triggered
workflow, independent artifact verification, signed-app runtime check, and
Homebrew publication are also complete.
| Publication item |
Result |
| Release merge SHA |
1bd43f9279f5ab736bff03378d5d85243e16813e |
Annotated v6.0.0 tag object and peeled commit |
85d0328a23b54bd7e7d578b5725d50cd2e0084f3; 1bd43f9279f5ab736bff03378d5d85243e16813e |
| GitHub release URL |
https://github.com/BradGroux/veritas-kanban/releases/tag/v6.0.0 |
| Desktop Release workflow URL and duration |
https://github.com/BradGroux/veritas-kanban/actions/runs/30109135335; pass in 12m7s |
| Signed/notarized DMG |
Veritas-Kanban-6.0.0-mac-arm64.dmg; 276,118,002 bytes; SHA-256/GitHub digest 0a2a51cb279d42089770932f760bb77abedf9db767c151cc0071d1ee3e1bfa55; Developer ID, Gatekeeper, and stapling pass |
| Signed/notarized ZIP |
Veritas-Kanban-6.0.0-mac-arm64.zip; 279,976,801 bytes; SHA-256/GitHub digest 7a5947bb6abd440c4d69da36def9f891e154139547f741d2f44c4733c6719cb8; extracted app Developer ID, hardened runtime, Gatekeeper, and stapling pass |
| DMG/ZIP blockmaps and SHA-256 sidecars |
Present; blockmap digests b31e50258dd3744a0daeef45a1f7ae375f538b24e6c68243f13c0963661b95b5 and af99a35b1e6380a8b9888658054690846c84b325067f7108299a4eedb6993255; both sidecars verify |
latest-mac.yml |
Version 6.0.0; 530 bytes; SHA-256 ac2e5ee7f25d235d607409a62a047359145f80dbaf9f1f5333131dc20700df72; DMG/ZIP names, sizes, and SHA-512 values match independent downloads |
| Downloaded signed-app isolated launch |
Pass; fresh disposable profile, ready SQLite, health/update version 6.0.0, latest-version update check, task creation, and clean quit |
| Homebrew tap issue/PR/merge |
Issue #36; PR #37; merge 7d77106e7c526a0975c49b9b11e0c9526921ead0 |
| Homebrew style/audit/dry-run/livecheck |
Pass against registered bradgroux/tap/veritas-kanban at 6.0.0 with the published ZIP checksum |
Source CI, tag creation, asset upload, signing, notarization, downloaded runtime,
and Homebrew availability are independent gates.
Deferred v6.x Work And Accepted Limits
- Run-scoped egress gateway
is deferred for fine-grained HTTP method/path/domain enforcement. Required
rules unsupported by current provider evidence already block launch.
- Grok Build and GitHub Copilot CLI retain documented source-provenance limits.
- GitHub Copilot CLI ACP remains public preview.
- Buzz Agent does not resume in-memory sessions; Buzz communication does not
project files, reactions, forums, DMs, or destructive edit/delete behavior.
- Packaged desktop version reporting
landed in 6.0.1; native build and support information
is added in 6.0.2. Exact equality across the downloaded bundle, health
endpoint, updater metadata, native About, copied support text, and desktop
bridge remains a signed-publication gate.
- Linux and Windows desktop packages remain unsigned previews.
- Provider and Buzz Settings screenshots were captured from the isolated
profile. No public-safe active approval existed, so approval visual evidence
remains a documented text contract.
2cfb89396d