From bd36929053bf8e9d92431b6d11f07d35b38fc38c Mon Sep 17 00:00:00 2001 From: SAPHID Date: Wed, 28 Oct 2026 16:00:46 +0000 Subject: [PATCH] docs: record v0.4.52 release verification --- docs/evidence/v0452-assets-2026-10-28.json | 76 ++++++++++++++++++++++ docs/evidence/v0452-release-2026-10-28.md | 70 ++++++++++++++++++++ 2 files changed, 146 insertions(+) create mode 100644 docs/evidence/v0452-assets-2026-10-28.json create mode 100644 docs/evidence/v0452-release-2026-10-28.md diff --git a/docs/evidence/v0452-assets-2026-10-28.json b/docs/evidence/v0452-assets-2026-10-28.json new file mode 100644 index 0000000..29c798e --- /dev/null +++ b/docs/evidence/v0452-assets-2026-10-28.json @@ -0,0 +1,76 @@ +{ + "tag": "v0.4.52", + "releaseId": 426854020, + "tagNameAtAudit": "v0.4.52", + "draftAtAudit": true, + "sha256sumsSha256": "71306c21818a8842f60633540a16457e962e9ffc7fac01a547a5a2fd17f32904", + "assets": [ + { + "name": "Frame-Control-mac-arm64.dmg", + "size": 177628410, + "sha256": "2dad765390965eaa01ab9a1737bffddcb6c8d481e4d255322e663bcdb7ad1e30", + "udifTrailer": "ok" + }, + { + "name": "Frame-Control-mac-arm64.zip", + "size": 177451653, + "sha256": "abb17c3e3de2ada967d10b7e277c9f122fb731108efc6d70fed9b87e92e66106", + "zipCrc": "ok", + "members": 1673, + "bundleVersion": "0.4.52" + }, + { + "name": "Frame-Control-mac-x64.dmg", + "size": 184701118, + "sha256": "1317ee7b30de46bc69a19d42d68245dbf55ca02fbc6ceee5761534ddb8706bab", + "udifTrailer": "ok" + }, + { + "name": "Frame-Control-mac-x64.zip", + "size": 184538083, + "sha256": "4d0fbf1904073a7b28d0e968013bd7ca34600536538db32d00b03cf6aaf5b3b4", + "zipCrc": "ok", + "members": 1669, + "bundleVersion": "0.4.52" + }, + { + "name": "Frame-Control-Setup-x64.exe", + "size": 151885028, + "sha256": "bb190c20abb2fae1878b732819ae64c214c0cfd627c3a6279b25e9d9c0517740", + "peMachine": 332 + }, + { + "name": "Frame-Control-win-x64.zip", + "size": 198840260, + "sha256": "ef7d248967bda011951bd703972f3a1cb00a43e484af0daf58a5f754e2f2486c", + "zipCrc": "ok", + "members": 1517 + }, + { + "name": "Frame-Control-linux-x86_64.AppImage", + "size": 179997222, + "sha256": "6241e068222a2c05f41946e94dedb1456dce25ae94d4857bcb7a4d1891feac7d", + "elfMachine": 62 + }, + { + "name": "Frame-Control-linux-arm64.AppImage", + "size": 171579364, + "sha256": "27da455144f8c88ba6a56d6eed90e1806c098d5f6806790089513ba77ec79f52", + "elfMachine": 183 + }, + { + "name": "Frame-Control-linux-amd64.deb", + "size": 146749772, + "sha256": "97425cbd4d460460b9f0574519bbf11afa1b8cc8003e1b784d6c002244da4075", + "debVersion": "0.4.52", + "architecture": "amd64" + }, + { + "name": "Frame-Control-linux-arm64.deb", + "size": 133832104, + "sha256": "58c98ed203caca60ce022c90232c13591d11c72ff5b28c5860aa7b221ec3e918", + "debVersion": "0.4.52", + "architecture": "arm64" + } + ] +} diff --git a/docs/evidence/v0452-release-2026-10-28.md b/docs/evidence/v0452-release-2026-10-28.md new file mode 100644 index 0000000..538dc4d --- /dev/null +++ b/docs/evidence/v0452-release-2026-10-28.md @@ -0,0 +1,70 @@ +# v0.4.52 tagged release verification, 28 October 2026 + +The annotated `v0.4.52` tag dereferences to merged main commit +`ac04407bcc799e9e88ce31c3f602020e9f3b1cee`. Its tree +`864fde2ec006afe00eb886279af9361a6e3b657e` exactly matches reviewed +[candidate PR #375](https://github.com/saphid/frame-control/pull/375) head +`432b29f9618d1e300abdf8437a2bd8360d54cffb`. The candidate's locked +source smoke and cleanup are recorded in [its evidence](v0452-candidate-2026-10-28.md). + +## Exact commit and tagged build gates + +- [Main checks](https://github.com/saphid/frame-control/actions/runs/40714882563) + passed on the tag commit: all seven jobs on the first attempt, including + e2e, iOS, Windows, macOS, Linux and the aggregate check. +- [Native Decky runtime](https://github.com/saphid/frame-control/actions/runs/40714882617) + passed on the tag commit: both published Decky 3.3.0 AMD64 and ARM64 jobs + on the first attempt. +- The [exact-tag release workflow](https://github.com/saphid/frame-control/actions/runs/40717151326) + passed all six jobs on the first attempt: draft, Linux, Windows, Intel Mac, + Apple Silicon Mac and checksums. No tagged job failed, was cancelled, + skipped or overridden. + +Before publication, the unpublished draft held exactly ten installers and +`SHA256SUMS`. Every installer was independently downloaded by GitHub asset +ID. Each downloaded size and SHA-256 matched the asset metadata; the +downloaded `SHA256SUMS` matched all ten entries byte for byte. Its SHA-256 was +`71306c21818a8842f60633540a16457e962e9ffc7fac01a547a5a2fd17f32904`. +The [sanitized asset audit](v0452-assets-2026-10-28.json) records all ten +names, sizes, hashes and package checks. It checked both Mac ZIP CRCs and +bundle version `0.4.52`, both DMG UDIF trailers, Windows ZIP CRC and PE +installer header, both AppImage ELF architectures, and both DEB version and +architecture fields. + +The independently downloaded Linux x86_64 AppImage had SHA-256 +`6241e068222a2c05f41946e94dedb1456dce25ae94d4857bcb7a4d1891feac7d`. +It launched under isolated Xvfb with a temporary profile, telemetry and +update checks disabled. Its bundled server returned HTTP 200 with +`FrameControl/1` and stopped after app exit. No physical Mac or Windows +launch of these exact installers was performed. + +## Real Frame and publication + +The [candidate evidence](v0452-candidate-2026-10-28.md) records a unique-lock +real Frame smoke on the version-bumped source: **12 passed, one optional +x86_64 launch skipped, zero failed**. Steam Linux Runtime 4 was absent, so +no x86_64 launch is claimed. A separate fresh-lock audit found no reserved +smoke title files, metadata or owned processes; both locks were released. +SteamVR activity was 3 (standby), proximity raw 2.3125 and battery 100%. +There was no wearer confirmation, wake command or worn interaction test. +The private smoke result's SHA-256 is +`42ea66740d001cc097ce9e871be6b01be1a10f184ab4480019b0a306851cfc57`. + +`scripts/publish-release.sh --dry-run v0.4.52` passed exact-main, native +runtime and tagged release jobs, all ten installer hashes, regenerated +`SHA256SUMS`, draft notes and update-manifest checks. Its local log had +SHA-256 `d4264b5ad3106387b63d3fc800f558c912ff36b546ea83d792a5a0e8a4949cc6`. +The real publisher repeated those gates, attached `update.json`, and published +[v0.4.52](https://github.com/saphid/frame-control/releases/tag/v0.4.52) at +**15:52:29 UTC**. GitHub's latest-release API returned `draft=false`, ten +installers, `SHA256SUMS` and `update.json`. A fresh public latest-download of +`update.json` reported version `0.4.52`, the correct release page, ten +names, sizes and hashes matching the independent downloads, and the explicit +limit that no person wore the headset. The public manifest's SHA-256 was +`486bafc8ae4f1feed0f3a1db28b5034498eed78af2a11083be48175489e6d461`. + +The exact-version Decky catalog is **6 works / 54 partial / 45 broken / +11 N/A**. Network Sentinel and Battery Tracker remain **partial**. Their +real managed ARM64 operation and wearer-visible behavior are unverified. +Worn VR visibility and physical-controller interaction also remain +unverified. The separate hourly worn check remains enabled.