release: prepare Study Buddy 0.2.3 alpha

CHANGELOG.md

@@ -1,11 +1,41 @@
 # Changelog
 
 This project follows [Semantic Versioning](https://semver.org/) for tagged
-releases. Version `0.2.2-alpha` is currently undergoing release-candidate
+releases. Version `0.2.3-alpha` is currently undergoing release-candidate
 validation; the `1.x` line remains reserved for the first full release.
 
 ## Unreleased
 
+## 0.2.3-alpha — 2026-08-31
+
+### Fixed
+
+- Restored the packaged Study Buddy source broker so installed desktop requests
+  can use configured Moodle, CIS, calendar, and website sources.
+- Bound every broker run to a server-generated scope and rejected disabled,
+  deleted, unconfigured, or mismatched source targets before credentials can be
+  resolved.
+- Added bounded Windows and Unix process-tree termination and request
+  cancellation so failed source runs do not leave provider children behind.
+
+### Security
+
+- Restricted packaged Codex network access to the authenticated loopback broker
+  and kept public outbound networking denied for source-backed workflows.
+- Redacted raw, JSON-escaped, and URL-encoded source credentials from broker
+  diagnostics and provider output.
+- Enforced quiz approval in the native broker: fabricated, skipped, changed,
+  declined, or expired approvals fail closed, while final quiz submission
+  remains blocked.
+
+### Testing
+
+- Added deterministic packaged source probes for exact configured targets,
+  public CIS access, credential injection, cancellation, and fail-closed source
+  lifecycle behavior.
+- Extended the clean Windows and Fedora release gates with the repaired
+  source-runtime path and a targeted Moodle-to-artifact acceptance round.
+
 ## 0.2.2-alpha — 2026-08-29
 
 ### Fixed

README.md

@@ -4,7 +4,7 @@ Study Buddy is a local-first AI learning companion that finds authorized course
 evidence and turns it into source-grounded answers, PDF study guides, and
 single-file offline learning webpages.
 
-> **Alpha status:** `v0.2.2-alpha` is the current release candidate. Public
+> **Alpha status:** `v0.2.3-alpha` is the current release candidate. Public
 > alpha builds are promoted only after clean Windows and Fedora acceptance;
 > the `1.x` line remains reserved for the future full release. Read
 > the [security](SECURITY.md) and [privacy](PRIVACY.md) guidance before

docs/release-readiness.md

@@ -1,4 +1,4 @@
-# `v0.2.2-alpha` release readiness
+# `v0.2.3-alpha` release readiness
 
 This is the durable, credential-free handoff for the current corrective Study
 Buddy alpha. A green result applies
@@ -11,7 +11,7 @@ previews; unpublished build attempts do not consume additional public versions.
 
 ## Release contract
 
-- Version/tag: `0.2.2-alpha` / `v0.2.2-alpha`
+- Version/tag: `0.2.3-alpha` / `v0.2.3-alpha`
 - GitHub state: prerelease
 - Platforms: Windows 11 x64 and Linux x64
 - Windows signing: intentionally unsigned with SmartScreen disclosure
@@ -50,7 +50,7 @@ zero-source onboarding, more-than-three source management, edit/disable/delete,
 browser-backed source checks, optional telemetry delivery, restart persistence,
 offline recovery, Windows SmartScreen behavior, and Fedora AppImage execution.
 Those runs are regression evidence only; they do not approve new
-`0.2.2-alpha` bytes.
+`0.2.3-alpha` bytes.
 
 The release-lab now additionally requires ChatGPT subscription authentication,
 a real streamed response in a newly created packaged desktop thread, bounded
@@ -63,7 +63,7 @@ of the calibrated Windows `clean` and Fedora `clean-wallet` snapshots.
    with the exact public UI submodule pin.
 2. Complete root and UI typecheck, test, lint/format, dependency audit, license,
    SBOM, public-tree, link, submodule, secret-scan, and CodeQL gates.
-3. Build the exact `0.2.2-alpha` Windows and Linux bundle from the final tagged
+3. Build the exact `0.2.3-alpha` Windows and Linux bundle from the final tagged
    default-branch commit. Verify all manifest, checksum, updater, SBOM, version,
    platform, and unsigned-state claims.
 4. Complete full-setup packaged acceptance in the disposable Windows and Fedora
@@ -86,6 +86,6 @@ of the calibrated Windows `clean` and Fedora `clean-wallet` snapshots.
 
 Status: **blocked for publication while preparation is in progress**.
 
-The source candidate is being converted to the agreed `0.2.2-alpha` contract.
+The source candidate is being converted to the agreed `0.2.3-alpha` contract.
 No final bundle, exact VM pass, reviewed GitHub draft, or deployed website
 promotion exists yet. Successful source CI alone will not change this decision.

docs/releases/v0.2.3-alpha.md

@@ -0,0 +1,78 @@
+# Study Buddy v0.2.3-alpha
+
+This corrective alpha restores the packaged source runtime and hardens its
+authorization boundary while retaining the Windows x64 and Linux x64
+distribution and update contract introduced in the previous public alphas.
+
+## Highlights
+
+- Installed desktop requests can use configured Moodle, CIS, calendar, and
+  website sources through the restored local source broker.
+- Source onboarding starts empty and supports adding, editing, disabling, and
+  deleting an unrestricted number of sources.
+- Direct Moodle and public CIS targets are validated against their exact
+  configured origin and path before a provider process starts.
+- The startup surface shows only the centered Study Buddy mark and a compact
+  gold spinner.
+- Packaged release acceptance includes deterministic source-broker and Codex
+  runtime probes, plus a targeted authenticated Moodle-to-artifact check for
+  this repaired failure path.
+
+## Security and privacy
+
+The source broker uses a random per-run scope and loopback token, resolves only
+registered and enabled sources, and injects credentials only into the bounded
+provider child that needs them. Study Buddy blocks public network access for the
+Codex process in source-backed workflows and redacts raw, escaped, and encoded
+credential forms from diagnostics. Native quiz approval fails closed if a
+request is missing, changed, declined, fabricated, or expired; final quiz
+submission remains blocked.
+
+Usage analytics and conversation sharing remain separate opt-in controls that
+start disabled. Saved source credentials stay on the device, while model
+requests can send the user's prompt and selected context to the configured
+model provider. Review private course material before sending it.
+
+The Windows installer is intentionally unsigned. Download it only from the
+official Study Buddy website or this GitHub Release, verify its SHA-256 against
+`SHA256SUMS`, and expect Windows to display **Unknown publisher** or a
+SmartScreen warning. Never disable SmartScreen globally.
+
+## Supported downloads
+
+- `Study-Buddy-0.2.3-alpha-x64.exe` — Windows 11 x64 NSIS installer
+- `Study-Buddy-0.2.3-alpha-x86_64.AppImage` — Linux x64 AppImage
+
+macOS and other CPU architectures are not included in this alpha.
+
+## Verify and install
+
+Windows PowerShell:
+
+```powershell
+Get-FileHash .\Study-Buddy-0.2.3-alpha-x64.exe -Algorithm SHA256
+```
+
+Linux:
+
+```bash
+sha256sum Study-Buddy-0.2.3-alpha-x86_64.AppImage
+chmod u+x Study-Buddy-0.2.3-alpha-x86_64.AppImage
+./Study-Buddy-0.2.3-alpha-x86_64.AppImage
+```
+
+Compare the result with the matching `SHA256SUMS` entry before launching.
+
+## Known limitations
+
+- Windows publisher identity is not code-signed yet.
+- macOS is not supported.
+- Generic Moodle and website sources are supported; CIS/calendar behavior is
+  currently tailored to FH Technikum Wien.
+- PDF generation and complete PDF/Office ingestion require the separately
+  documented Typst, Poppler, or LibreOffice tools.
+- Authenticated model and institution-source checks require the user's own
+  authorized accounts and must follow the connected provider's terms.
+
+GitHub-generated source archives omit submodule contents. Developers should
+clone with `--recurse-submodules`.

package.json

@@ -1,6 +1,6 @@
 {
   "name": "study-buddy",
-  "version": "0.2.2-alpha",
+  "version": "0.2.3-alpha",
   "description": "Local-first, source-grounded AI study workflows for Moodle and FH Technikum Wien student systems.",
   "license": "MIT",
   "private": true,