[P13-26] Promote the accepted source commit to v0.23.0

[Nowhitestar]

Closed as superseded — September 29, 2026

Stable v0.23.0 publication, accepted-source identity and public artifact checks were completed as recorded below. Public releases have since reached v0.26.0. The September 28 whole-App update to local build 0.26.0-local.20260928.1 / 1694 passed bundle/signature, Host/Capture, database/configuration preservation and native-control checks; today's Host and database readback remain healthy. The previous App and operational data were backed up.

The one deferred, exact RC21-to-v0.23.0 transition was not replayed and is not marked as a passing test. That historical transition is obsolete after subsequent whole-App updates, so this remaining version-specific follow-up is closed as not planned. The accepted limitations in #170 remain recorded. No downgrade, VM restart, OAuth flow, recording or external share was performed for closure. Public reconciliation: #228.

Historical issue record

Stable publication closeout — 2026-09-15

Candidate #170 is accepted under the owner's explicit reduced physical-Mac scope. Its omitted final-public fresh-runtime/legacy-upgrade and additional matrix repetitions remain disclosed validation risks, not passes.

Stable v0.23.0 was published at 2026-09-15T08:05:26Z as a non-draft, non-prerelease and is GitHub's latest release. Tag/source is exactly accepted RC21 ef9828a3d241acde0d05c8908e1d7b4023878760; stable build is 1667, following candidate build 1666. Publisher 34943140833 passed both jobs.

• Exact accepted-source stable tag and public release.
• Anonymous downloads match all four public asset sizes and digests; checksum verification passes.
• DMG and nested App pass Developer ID team, strict/deep signature, notarization/staple, Gatekeeper, Applications alias and self-contained runtime verification.
• All three update payloads pass independent SLSA attestation verification pinned to the official reusable workflow, exact source and stable tag, with self-hosted runners rejected.
• Public-key-only Ed25519 verification passes for the DMG enclosure and signed appcast. Feed metadata declares build 1667, short version 0.23.0, arm64 and minimum macOS 13.0.0. The live stable feed exactly equals the release's signed appcast.
• Final Release body exactly matches the versioned release notes, including accepted residual risks.
• Repository guidance/metadata PR docs(release): close v0.23.0 stable guidance #218 merged after all CI passed. Remote main has the exact reviewed tree; VERSION/manifest are 0.23.0 and release maintenance has left the RC line.
• Website Nowhitestar/tingfengji#10 merged after passing preview checks. Anonymous production readback exactly matches the new page's stable CTA and footer. GitHub About/website remain correct.
• Complete the ordinary installed RC21-to-stable whole-App update and final service/data readback once the running App is idle. The active recording is deliberately not interrupted.
• Close this issue, [Spec] Phase 13: Guided onboarding, manual sharing, and self-contained macOS App #145 and the task goal after that final installed outcome; do not mark a deferred update as passed.

Public SHA-256:

• DMG (78,070,894 bytes): b509a8cb70e8fbbdb17a5c09e1c7a00f6566f094b7a31b1571fd1cde8be775a8.
• Runtime ZIP (22,832,712 bytes): 1147dbfa019d221b74eb4789736d81ebf12461c72845c0d380d47a9bc0c8890f.
• Appcast (1,278 bytes): 6e60aedb81fc9ce80f4b8e1c1d22ae393f90e1ed9d3e306ba56e9553fd018895.
• Checksums (290 bytes): 41e0c6da4000571507dc6ff29dcb73d7151952d50aed2656bf426ce077ef6104.

No new VM, OAuth login, model call or external share is required. This is the sole remaining installed update, not a reopened functional-validation matrix.

Historical pre-acceptance checkpoint

Parent and dependency

• Parent: [Spec] Phase 13: Guided onboarding, manual sharing, and self-contained macOS App #145. Final candidate acceptance belongs to [P13-25] Complete consolidated public-install acceptance #170.
• Current execution record: docs/phase13-closeout.md; do not restart historical candidate/framework checklists.

Current checkpoint — 2026-09-15

The consolidated RC21 release was published at 2026-09-15T05:21:13Z and publisher 34931133893 passed. Exact candidate source: ef9828a3d241acde0d05c8908e1d7b4023878760; candidate build: 1666. Public downloads, digests, provenance, signatures, notarization/staples and release-feed signatures have been independently verified under #170. The stable feed remains byte-for-byte unchanged.

The Runtime Pack repairs (#212), installation-entry corrections (#214), promotion boundary (#215) and legacy menu-bar ownership repair (#216) are merged. Source/component and public-artifact checks do not substitute for the remaining installed-upgrade acceptance under #170.

Stable is not tagged, published or accepted. Once #170 passes, publish v0.23.0 from the exact accepted RC21 source, without intervening code changes. The existing identity validator reserves build 1667 for same-source promotion. No additional candidate is required merely for status or documentation changes.

Remaining acceptance

• Stable tag and release resolve to the exact source accepted under [P13-25] Complete consolidated public-install acceptance #170.
• Verify public stable DMG digest, provenance, signatures, notarization, staple, update feed and metadata.
• Read back changed Release/README/site/About/install guidance; reuse applicable unchanged evidence.
• Verify the accepted RC updates to stable through the whole-App updater.
• Record the final result and close the phase only when these outcomes are complete. Failed artifact/readback checks keep it open.

Use existing environments, preserve data and provider selection, and do not request another OAuth login or inspect password stores. Fresh cloud-summary repetition is outside the current acceptance scope, not a newly passing test. Sharing remains exclusively manual.