veritas-kanban/docs/V6-GA-CHECKLIST.md

Veritas Kanban v6 GA Checklist

This checklist contains the active stable-release gate for Veritas Kanban 6.1.2 and retains the completed 6.1.1, 6.1.0, and 6.0.2 evidence below. Command results, platform details, workflow links, limitations, and artifact hashes belong in v6 Release Candidate Evidence Packet.

Documentation freshness: 2026-08-24 for Veritas Kanban 6.1.2.

6.1.2 Release Gate

• Audit issues #1162, #1163, and #1165-#1173 are closed through merged, evidence-linked pull requests; #1164 implementation is merged and awaits the single final regression milestone before closure.
• Root, shared, server, web, CLI, MCP, and desktop manifests are 6.1.2.
• README, canonical instructions, API reference, compatibility policy, upgrade guide, release notes, canonical GitHub body, freshness record, and changelog are synchronized for 6.1.2.
• Runtime paths, storage repositories, provider adapters and lifecycle, credential-aware frontend requests, immutable actions, continuous scanning, critical coverage, dependency cleanup, lint ratchets, and the production Docker contract are represented in release documentation.
• Independent and cross-model review remain optional; they are not part of the default delivery or release gate.
• The coordinated private security fix is integrated into the candidate and remains private until supported artifacts exist and disclosure is approved.
• One clean final candidate passes the complete Node-floor and current-Node verification matrix with exact counts, skips, retries, image size, and limitations recorded in the evidence packet.
• The release PR merges and its exact merge is published as annotated v6.1.2 with a live body matching docs/releases/v6.1.2.md.
• Signed/notarized macOS assets, updater metadata, installed-app readiness, the live Homebrew cask, and the private advisory disposition are verified.
• Release tracker #1174 closes only after every publication readback passes.

Historical 6.1.1 Completed Release Gate

• Issue #1153 and pull requests #1148, #1149, #1150, #1154, and #1155 received an evidence-backed maintainer disposition.
• Long Task Detail content is constrained and scrollable, with Chromium layout, overflow, and wheel-input regression coverage (#1153, #1154).
• Dependency updates were audited for runtime compatibility, peer ranges, advisories, lockfile integrity, tests, builds, and desktop packaging; jsdom 30 was rejected rather than weakening the Node.js floor (#1148, #1149, #1150, #1155).
• Root, shared, server, web, CLI, MCP, and desktop manifests are 6.1.1.
• README, API reference, compatibility policy, upgrade guide, release notes, canonical GitHub release body, and changelog agree on 6.1.1.
• Frozen install, production and full audits, lint and warning budget, typecheck, build, workspace tests, Playwright, Mantine QA, CLI/MCP smoke, desktop checks, and release validators pass on the consolidated candidate.
• Independent review is owner-directed and is not part of the active 6.1.1 release gate; exact local and CI evidence carries the release decision.
• The release PR merges and the exact merge is published as annotated v6.1.1 with a live body matching docs/releases/v6.1.1.md.
• Signed/notarized macOS assets, updater metadata, independent installed-app readiness, and the Homebrew cask are published and verified.

Historical 6.1.0 Completed Release Gate

• Roadmap issues #855, #864, #865, #866, #867, #868, #871, #872, #873, #876, and #879 are closed through merged pull requests.
• Root, shared, server, web, CLI, MCP, and desktop manifests are 6.1.0.
• README, canonical agent instructions, API/MCP references, compatibility policy, upgrade guide, release notes, and changelog agree on 6.1.0.
• The reviewed GitHub release body exists at docs/releases/v6.1.0.md and passes the full-width release-format gate.
• Focused verification passed for each roadmap slice before merge.
• The milestone workspace suite is green. pnpm test:unit completed successfully across every workspace on the consolidated candidate; server reported 3,234 passing and 5 skipped tests, web reported 469 passing tests, and desktop reported 67 passing tests.
• Required release-PR CI, production audit, lint, typecheck, build, compatibility smoke, and packaging gates pass on the reviewed candidate.
• The release PR merges, annotated v6.1.0 tag and GitHub release publish, and the desktop workflow uploads signed/notarized assets and updater metadata.
• Independent download, signature, Gatekeeper, stapling, readiness, updater, GitHub release-body, and Homebrew cask verification pass.

Final Release Validation Commands

Apply ci:full to the release pull request and keep it applied through the final candidate synchronization. That single milestone runs the complete workspace suite, critical-path coverage, unsigned desktop artifacts, and Docker image contract. Run the following commands once from the clean 6.1.2 release candidate at the supported Node floor and current supported Node:

pnpm install --frozen-lockfile
pnpm check:pnpm-settings
pnpm check:security-artifacts
pnpm check:delivery-cadence
pnpm test:ci-scope
pnpm audit --prod --audit-level=high
pnpm audit:all
pnpm check:gitleaks
pnpm lint
pnpm lint:budget
pnpm lint:report
pnpm qa:mantine
pnpm typecheck
pnpm build
pnpm test
pnpm test:unit
pnpm test:e2e
pnpm smoke:cli-mcp
pnpm desktop:test
pnpm desktop:build
pnpm desktop:check:electron-artifacts
pnpm desktop:test:readiness
pnpm desktop:dev:fresh
pnpm desktop:smoke:mac:local
pnpm desktop:package:mac:unsigned
pnpm test:release-format
pnpm validate:release -- --version 6.1.2 --skip-build-output
pnpm validate:release -- --version 6.1.2 --docker-build

Mount and inspect the unsigned DMG and ZIP, exercise the visible native single-instance/reopen/clean-close/quit lifecycle with an isolated profile, and run the production image as its non-root user against an isolated volume. Record health, auth, SQLite, static-web, canonical-path, backup, integrity, image-size, and clean-shutdown evidence. The same candidate must pass these gates at Node 22.22.1 and the current supported Node runtime.

Distribution And Post-Publication

The 6.1.2 publication gate is pending the final candidate, release merge, tag, signed/notarized artifacts, independent launch verification, post-publication validator, live Homebrew cask, and approved advisory disposition. Completed 6.1.1 evidence remains recorded below and in the evidence packet.

Historical 6.0.2 Source And Scope

• The Buzz integration epic and every required child are closed through merged, focused pull requests.
• The equal-footing harness epic and every required child are closed through merged, focused pull requests.
• The release tracker lists the exact main baseline, release branch, release PR, deferred v6.x work, and no unresolved release blocker.
• Root, shared, server, web, CLI, MCP, and desktop manifests are 6.0.2.
• AGENTS.md, README badge, health, CLI, MCP, desktop bundle, artifact names, updater metadata, changelog, and current docs agree on 6.0.2.
• The public API remains intentionally v1, with additive v6 contracts and tested CLI/MCP compatibility.

6.0.1 Stabilization

• Task drawers, shared overlays, Archive cards, scoring profiles, and template authoring have focused scroll, resize, compact-window, and keyboard coverage (#935, #938, #939, #941).
• Workflow loading, route/task/overlay history, and scoring-profile creation have focused recovery and state-transition coverage (#936, #937, #943).
• Operations Digest inventory, filters, exclusions, source IDs, window semantics, run de-duplication, and data quality reconcile in JSON, Markdown, scheduled snapshots, and UI tests (#944).
• Chat has visible, Escape, browser Back, persisted-state, compact-window, and native menu recovery coverage; the independently downloaded signed app passes the same recovery checks (#945).
• Desktop setup is version-neutral and the bridge consumes Electron's application version; the published bundle, health endpoint, updater, and bridge all report 6.0.1 (#986).

6.0.2 Desktop Recovery Hotfix

• Board Chat and Squad Chat default to a bounded right-side Workbench dock and can switch between Right and Bottom without remounting the active conversation (#1004).
• Chat width and height clamp to the live viewport; scrolling, wheel input, Close, Escape, browser Back, Reset Layout, persisted-state recovery, and focus restoration have focused coverage (#1004).
• Native About, copied support information, the desktop bridge, and updater fallback consume one authoritative version/build/channel/OS/architecture record (#1005).
• Ordinary pull-request verification records affected workspaces without running tests; manual focused diagnostics and explicit ci:full, scheduled, or release milestones own the test suites (#1000, #1227).
• Published release notes are sourced from docs/releases/vX.Y.Z.md, use one full-width Markdown line per paragraph or list item, reject blockquotes and overlong prose blocks, and are compared with GitHub during post-publication validation. Run pnpm test:release-format, pnpm validate:release, and the post-publication pnpm validate:release -- --github check.

Provider Certification

• Buzz Agent v0.4.24 / buzz-agent 0.1.0 passes the composed credential-free compatibility gate at the pinned commit and fixture revision.
• Grok Build v0.2.111 build 94172f2aa4e5 passes exact-version ACP, restrictive-policy, source-limitation, and deterministic fixtures.
• Codex app-server 0.145.0 passes exact generated schemas, disabled remote control, lifecycle, approval, event, completion, and deterministic fixtures.
• Codex CLI and @openai/codex-sdk 0.144.3 pass their provider-runtime, launch, tool, event, credential, and completion gates.
• Claude Code 2.1.218 passes bare-mode launch, permission, environment, stream, lifecycle, MCP, event, completion, and deterministic fixtures.
• GitHub Copilot CLI 1.0.74 passes exact ACP handshake, restrictive launch, preview/source-limit, and deterministic fixtures.
• Hermes v2026.7.7.2 and OpenClaw v2026.6.11 retain truthful existing support and explicit unsupported controls.
• Settings, API, vk doctor --json, dispatch, and telemetry report the same Detected, Configured, Certified, Degraded, or Unsupported state.
• Every Certified claim has exact runtime/build and passing deterministic evidence. Credential-gated smoke is recorded separately; unavailable credentials, quota, subscriptions, binaries, and upstream services are reported rather than inferred.

Security, Migration, And Data Preservation

• Legacy provider profiles normalize only through exact built-in type/command identity and never fall through to OpenClaw.
• Claude Code permission bypass is absent and unsafe custom launch controls fail closed.
• Approval decisions bind to exact action, attempt, reviewer, expiry, and authentication freshness; replay and drift tests pass.
• Credential definitions, leases, run catalogs, the veritas-run bridge, logs, telemetry, fixtures, and APIs remain value-free outside the one-shot downstream call.
• Provider protocol frames, stdout/stderr, events, retries, timeouts, and retained payloads are bounded and redacted.
• Required unsupported sandbox, network, tool, MCP, credential, lifecycle, and provider controls block before attempt mutation.
• A populated v5.2.5 desktop workspace upgrades through an isolated copy with matching representative counts, PRAGMA quick_check=ok, preserved owner/profile metadata, preserved registry absence, and a working v6 runtime. A separate exact-format v5.2.5 registry fixture verifies populated registry compatibility.
• File-backed migration and restore paths pass their seven-test portability fixture.
• Rollback guidance has been tested against the actual schema/profile posture and does not promise destructive down migration.
• Secret and tracked-runtime-security scans pass.

Application And Runtime

• A clean dependency install and build produce new shared, server, web, CLI, MCP, and desktop outputs without reused dist, staged desktop payloads, or prior release artifacts.
• An isolated in-app Browser run verifies first-run, login, provider and Buzz Settings, degraded states, themes, command-palette focus, and a clean console. Deterministic and E2E suites verify task launch, causal events, approvals, cancellation, completion, MCP, worktrees, telemetry, and Buzz mapping/replay under the maintainer-approved release-evidence split recorded in the evidence packet.
• Dark/light themes, keyboard flow, labels, and focus are inspected in the in-app Browser; compact layout and recoverable error states pass the E2E matrix under the same evidence split.
• A fresh native macOS build verifies one instance, visible window, bundled server/web health, menus, shortcuts, window restoration, update check, clean close, reopen, and quit.
• The unsigned DMG/ZIP is inspected and the packaged app launches from the packaged artifact with an isolated profile.

Mantine component-system cleanup gate

• Run pnpm --filter @veritas-kanban/web build before the bundle check.
• Run pnpm qa:mantine.
• Run pnpm test:e2e -- e2e/mantine-qa-gate.spec.ts.
• Retain visual and accessibility evidence for current routes, dark/light themes, compact widths, keyboard navigation, focus, labels, and touch targets.
• Track planned but unavailable surfaces as temporary holdouts instead of claiming coverage.
• No active feature imports legacy primitive compatibility wrappers outside documented internals.
• No direct shadcn/Radix dependency or vendor-radix bundle returns.
• Bundle sizes remain within the recorded QA budgets or have an explicit release-risk acceptance.

Historical 6.0.2 Final Release Validation Commands

Run from the clean release-candidate worktree:

node --version
pnpm --version
git --version
pnpm install --frozen-lockfile
pnpm check:pnpm-settings
pnpm audit --prod --audit-level=high
pnpm lint
pnpm lint:budget
pnpm qa:mantine
pnpm typecheck
pnpm build
pnpm test:unit
pnpm test:e2e
pnpm smoke:cli-mcp
pnpm test:buzz:compatibility
pnpm desktop:test
pnpm desktop:build
pnpm desktop:check:electron-artifacts
pnpm desktop:smoke:mac:local
pnpm desktop:package:mac:unsigned
pnpm validate:release -- --version 6.0.2
pnpm validate:release -- --version 6.0.2 --docker-build

Provider-specific deterministic suites are part of pnpm test:unit; record their test counts and exact fixture baselines separately. Run credential-gated provider smoke only when the exact binary, authentication, subscription, and quota are available.

Historical 6.0.2 Distribution And Post-Publication

• The ready release PR passes required CI and the milestone-wide workspace suite, then merges to main.
• Annotated tag v6.0.2 peels to the exact release merge commit.
• The GitHub release is published from reviewed docs/releases/v6.0.2.md without hard-wrapped prose.
• Desktop Release completes with signed/notarized arm64 DMG and ZIP, blockmaps, latest-mac.yml, and SHA-256 sidecars.
• Independent downloads match GitHub digests, sidecars, updater metadata, byte sizes, and SHA-256 values.
• DMG and ZIP app signatures, hardened runtime, Gatekeeper, and notarization stapling pass.
• The downloaded signed app launches with an isolated profile, reports 6.0.2 through bundle, health, updater, native About, copied support information, and desktop bridge metadata; verifies Right and Bottom Chat recovery at the minimum supported window; executes a bounded task; and quits cleanly.
• pnpm validate:release -- --version 6.0.2 --github --repo BradGroux/veritas-kanban passes.
• The Homebrew cask PR uses the published ZIP checksum, merges, and the registered tap passes style, strict online audit, dry-run install, and livecheck.
• The evidence packet contains release/workflow/asset/Homebrew links, exact hashes, runtime results, limitations, and deferred v6.x issues.
• The release tracker closes only after every distribution surface above is independently verified.