From f4cc9ce0a146a649fb3dfe67bef859c098761bd7 Mon Sep 17 00:00:00 2001 From: SAPHID Date: Mon, 26 Oct 2026 23:26:59 +0000 Subject: [PATCH] Record v0.4.49 release verification --- docs/evidence/v0449-release-2026-10-26.md | 59 +++++++++++++++++++++++ 1 file changed, 59 insertions(+) create mode 100644 docs/evidence/v0449-release-2026-10-26.md diff --git a/docs/evidence/v0449-release-2026-10-26.md b/docs/evidence/v0449-release-2026-10-26.md new file mode 100644 index 0000000..de25470 --- /dev/null +++ b/docs/evidence/v0449-release-2026-10-26.md @@ -0,0 +1,59 @@ +# v0.4.49 tagged release verification, 26 October 2026 + +The annotated `v0.4.49` tag dereferences to merged main commit +`38db6a284696c3bb86bf97f6b853af7e97681701`. This is the same tree as +the reviewed [candidate PR #348](https://github.com/saphid/frame-control/pull/348). +Its [main checks run](https://github.com/saphid/frame-control/actions/runs/40417275314) +passed all seven jobs, including e2e, iOS, macOS, Windows and Linux. +The [native Decky 3.3.0 run](https://github.com/saphid/frame-control/actions/runs/40417275256) +passed on AMD64 and ARM64. The regression gate includes an expected failure +for v0.4.48's bad legacy calling convention. + +The exact-tag [release workflow](https://github.com/saphid/frame-control/actions/runs/40418177330) +passed all six jobs on its first attempt: draft, Linux, Windows, Apple Silicon +Mac, Intel Mac, and checksums. No tagged build failed, was cancelled, or was +skipped. The draft contained exactly ten installers and `SHA256SUMS` before +publication. Every asset had a GitHub SHA-256 digest. A fresh download of +`SHA256SUMS` had SHA-256 +`8a04f81f3b1efea9903e9acbba2c61b67f275869c160e0c6fa1d388a4803b42a`; +it matched a list regenerated from the ten GitHub installer digests byte for +byte. All ten installers were independently downloaded and passed +`sha256sum -c SHA256SUMS`. + +## Independent package checks + +| Package | Check | +| --- | --- | +| Linux x86_64 AppImage | SHA-256 `0ef192e6f13aed39469392c22b971b311d911a0bebae16cbbabbfa729b95ced0`; isolated Xvfb launch returned HTTP 200 with `FrameControl/1`, then its server stopped. The first local launch attempt hit the workspace sandbox's `Operation not permitted` restriction; the same downloaded bytes passed outside that sandbox. Tagged Linux CI also launched the AppImage. | +| Linux arm64 DEB | SHA-256 `a8e448b8b8f10b2813546cb9d8fea6bbe424e14dc3a739df86daa69bfd4023c1`; declares version 0.4.49 and arm64. | +| Linux amd64 DEB | SHA-256 `10bb554cc761c61c99d059ae3601f4889187d7f18bdc8f9eb3cf768822b5765d`; declares version 0.4.49 and amd64. | +| Mac arm64 ZIP | SHA-256 `c43c1017b3d244fcf59ab8f5bd35dbad17af4562b2aca3baf65908814f2ae4c3`; ZIP CRC, bundle version 0.4.49 and main Mach-O arm64 CPU passed. | +| Mac x64 ZIP | SHA-256 `0dd838a1322107928893ff5efce817719867a5db1af2fa09124b6bb03018a19d`; ZIP CRC, bundle version 0.4.49 and main Mach-O x86_64 CPU passed. | +| Windows x64 Setup | SHA-256 `386d99fd15314e1caef577f7cdf21e9e9f572d1c0dbaa65c369e5a5b0c047d31`; downloaded file is a PE/Nullsoft installer. Tagged Windows CI installed it and checked its packaged resources and Python libraries. | +| Windows x64 ZIP | SHA-256 `2c201a8d1115dd1a07ba7b9293f7e05c319bd802f574a4b2f9565268a7f5cf8b`; ZIP CRC passed. | + +The remaining three packages (both Mac DMGs and the ARM64 AppImage) also +matched `SHA256SUMS`; tagged CI built and checked their platform bundles. +Physical launch of these exact Mac and Windows installers was not performed. + +## Publication and real Frame scope + +The [candidate evidence](v0449-candidate-2026-10-26.md) records a unique-lock +real Frame smoke on the version-bumped source: **12 passed, one optional +x86_64 launch skipped, zero failed**, followed by an independent locked audit +with no test-title folders or processes. The optional runtime was absent; no +x86_64 launch is claimed. SteamVR stayed in standby, no wearer was confirmed, +and neither a worn test nor physical controller check was run. + +`scripts/publish-release.sh --dry-run v0.4.49` passed the exact main, native +Decky and tagged release job gates, ten installer hashes, regenerated +`SHA256SUMS`, draft notes and update manifest. The real publisher repeated +those gates, attached `update.json`, and published +[v0.4.49](https://github.com/saphid/frame-control/releases/tag/v0.4.49) at +**23:25:45 UTC**. GitHub's latest-release API returned `draft=false`, +`prerelease=false`, ten installers, `SHA256SUMS` and `update.json`. A fresh +public latest-download of `update.json` reported version 0.4.49, the correct +page, ten hashed assets, the v0.4.48 repair note and the worn-VR limit. +The v0.4.48 release remains a withdrawn draft; its notice points to v0.4.49. +Existing v0.4.48 installations do not auto-downgrade, and affected installed +Music Control plugins need managed Update or Remove and reinstall.