Reedtrullz · Reedtrullz · Aug 9, 2026 · Aug 9, 2026
@@ -43,7 +43,7 @@ body:
     id: install-source
     attributes:
       label: Install source
-      description: How did you install this build? For v1.1.1, prefer Source build from tag or Source-first unsigned-dev zip. For current main/local builds, choose Local ad-hoc build with the exact source SHA. Choose notarized or Homebrew only for an exact published trusted-binary artifact such as v1.4.4.
+      description: How did you install this build? For v1.1.1, prefer Source build from tag or Source-first unsigned-dev zip. For current main/local builds, choose Local ad-hoc build with the exact source SHA. Choose notarized or Homebrew only for an exact published trusted-binary artifact such as v1.4.5.
       options:
         - Source build from tag
         - Source-first unsigned-dev zip

@@ -10,7 +10,7 @@ body:
 
         Please collect read-only evidence. Do not bypass Gatekeeper, edit the cask SHA manually, disable verifier signature/notarization checks, or run fan-write smoke tests to diagnose a release-trust issue.
 
-        Vifty v1.4.4 build 12 is the current arm64-only Developer ID release. Its signed/notarized GitHub Release artifact and matching Homebrew cask checksum pass the release-level verifier as recorded in .github/release-manifest.json. Exact-build installed release review and manual Fixed/Curve/Auto validation remain pending for v1.4.4; the historical v1.3.2 build 7 holds passed installed and hardware claims on MacBookPro18,1, and neither result transfers to another build or model. Report any local mismatch with those facts here. A source tag, passing CI run, unsigned-dev convenience build, local signing smoke build, or CI artifact alone is not a trusted public binary release.
+        Vifty v1.4.5 build 13 is the current arm64-only Developer ID release. Its signed/notarized GitHub Release artifact and matching Homebrew cask checksum pass the release-level verifier as recorded in .github/release-manifest.json. Exact-build installed release review and manual Fixed/Curve/Auto validation remain pending for v1.4.5; the historical v1.3.2 build 7 holds passed installed and hardware claims on MacBookPro18,1, and neither result transfers to another build or model. Report any local mismatch with those facts here. A source tag, passing CI run, unsigned-dev convenience build, local signing smoke build, or CI artifact alone is not a trusted public binary release.
 
         The published v1.1.0 source/unsigned-dev release has a known helper-unreachable issue that was fixed by v1.1.1. Do not retag v1.1.0 or replace its unsigned-dev assets with a main build; report it here and use the v1.1.1 source-first hotfix path.
 
@@ -19,7 +19,7 @@ body:
     attributes:
       label: Release version
       description: Which Vifty release is affected?
-      placeholder: e.g. 1.4.4
+      placeholder: e.g. 1.4.5
     validations:
       required: true
 
@@ -83,7 +83,7 @@ body:
         brew install --cask vifty
         git fetch origin main --tags
         scripts/check-release-readiness.sh --mode source-first --version 1.1.1 --repo Reedtrullz/Vifty --json
-        scripts/check-release-readiness.sh --mode developer-id --version 1.4.4 --repo Reedtrullz/Vifty --require-source-ref v1.4.4 --json
+        scripts/check-release-readiness.sh --mode developer-id --version 1.4.5 --repo Reedtrullz/Vifty --require-source-ref v1.4.5 --json
         scripts/verify-release-artifact.sh --team-id "$APPLE_TEAM_ID"
     validations:
       required: true

@@ -41,41 +41,45 @@
         "reviewReport": "docs/validation-reports/2026-07-14-v1.3.2-macbookpro18-supported/review-result.json",
         "attestation": "docs/validation-reports/2026-07-14-v1.3.2-macbookpro18-supported/manual-smoke-attestation.md"
       }
+    },
+    {
+      "version": "1.4.4",
+      "build": 12,
+      "tag": "v1.4.4",
+      "sourceCommit": "0ac7842483a602a30900671904f76fd7b06e2370",
+      "sourceCIRunID": 31252163922,
+      "releaseWorkflowRunID": 31253285103,
+      "artifact": "Vifty-v1.4.4.zip",
+      "checksumAsset": "Vifty-v1.4.4.zip.sha256",
+      "artifactSummary": "Vifty-v1.4.4-artifact-summary.json",
+      "releaseChecklist": "Vifty-v1.4.4-release-checklist.md",
+      "sha256": "d35c7326166d128c3596f0b84b87f283a54dedd1483a854a37bcbef888af713f",
+      "artifactTrust": "passed",
+      "signingTrust": "developer-id-notarized",
+      "tagTrust": "signed-verified",
+      "installedReleaseReview": "pending",
+      "manualCompatibility": "pending",
+      "manualCompatibilityScope": null
     }
   ],
   "publishedRelease": {
-    "version": "1.4.4",
-    "build": 12,
-    "tag": "v1.4.4",
-    "sourceCommit": "0ac7842483a602a30900671904f76fd7b06e2370",
-    "sourceCIRunID": 31252163922,
-    "releaseWorkflowRunID": 31253285103,
-    "artifact": "Vifty-v1.4.4.zip",
-    "checksumAsset": "Vifty-v1.4.4.zip.sha256",
-    "artifactSummary": "Vifty-v1.4.4-artifact-summary.json",
-    "releaseChecklist": "Vifty-v1.4.4-release-checklist.md",
-    "sha256": "d35c7326166d128c3596f0b84b87f283a54dedd1483a854a37bcbef888af713f",
-    "artifactTrust": "passed",
-    "signingTrust": "developer-id-notarized",
-    "tagTrust": "signed-verified",
-    "installedReleaseReview": "pending",
-    "manualCompatibility": "pending",
-    "manualCompatibilityScope": null
-  },
-  "candidate": {
     "version": "1.4.5",
     "build": 13,
     "tag": "v1.4.5",
+    "sourceCommit": "174dcd28a343de7f797d682d02c0f70e26b72c2e",
+    "sourceCIRunID": 31283125895,
+    "releaseWorkflowRunID": 31284620552,
     "artifact": "Vifty-v1.4.5.zip",
     "checksumAsset": "Vifty-v1.4.5.zip.sha256",
     "artifactSummary": "Vifty-v1.4.5-artifact-summary.json",
     "releaseChecklist": "Vifty-v1.4.5-release-checklist.md",
-    "sha256": null,
-    "artifactTrust": "pending",
-    "signingTrust": "pending",
-    "tagTrust": "signed-required",
+    "sha256": "13fa763cbfdca3e77fcf6f657df6d51b32e19a4d25dd17a79614635fe844b0d5",
+    "artifactTrust": "passed",
+    "signingTrust": "developer-id-notarized",
+    "tagTrust": "signed-verified",
     "installedReleaseReview": "pending",
     "manualCompatibility": "pending",
     "manualCompatibilityScope": null
-  }
+  },
+  "candidate": null
 }
@@ -158,7 +158,7 @@ ViftyCore is the shared library consumed by Vifty app, ViftyDaemon, ViftyHelper,
 16. **Protected/system fan mode is explicit** — SMC mode value `3` represents macOS/System-managed control. If direct manual mode writes are rejected and `Ftst` exists, helper writes may use a guarded unlock/retry path; restoring Auto should return `Ftst` to `0` when available.
 17. **Agent JSON is a contract** — capabilities, read-only audit export, readiness diagnostics, command errors, and rate-limit responses must stay machine-readable. Preserve policy fields, source schema paths, bundled schema resource paths, schema ID references, `policySource`, `daemonStatusAvailable`, `policyStatusAvailable`, `supportsForceRetry`, `runLifecycle`, readiness check IDs, state strings, `recommendedAgentAction`, `recommendedRecoveryAction`, `safeToRequestCooling`, `safeToProceed`, `readOnly`, `coolingCommandsRun`, and `retryAfterSeconds` across Codable and XPC dictionary coding. `capabilities --json` must remain parseable when daemon status is unavailable, but it must fail closed with `exitCodes.unavailable`, `policyStatusAvailable: false`, and a disabled fallback policy. Agents must not trust `policy.*` duration/RPM limits unless `policyStatusAvailable` is true.
 18. **Release XPC hardening is build-configured** — local builds leave `VIFTY_XPC_ALLOWED_TEAM_ID` empty for ad-hoc signing; release builds should set it so the daemon requires matching signing identifiers and the configured TeamID.
-19. **Separate source-first from trusted binaries** — `v1.1.1` remains the immutable source-first hotfix and `v1.1.0` is superseded; neither may be retagged or refreshed from later source. `v1.4.4` is the published Developer ID release; its exact public artifact, cask checksum, release evidence, notarization, stapling, TeamID, and Gatekeeper checks passed. Signed-helper parity, installed release-mode review, explicit Auto restoration, and manual Fixed/Curve hardware compatibility remain separate claims for the exact `v1.4.4` binary; prior-version proof does not transfer. The historical `v1.3.2` release holds passed installed and hardware claims on `MacBookPro18,1` only; the supervised `v1.3.1` smoke exposed an in-flight Curve-to-Auto race and is not compatibility proof. Do not flatten source-first, local-build, or prior-version proof into current trusted-binary claims. Trusted binary releases use `.github/workflows/release.yml`.
+19. **Separate source-first from trusted binaries** — `v1.1.1` remains the immutable source-first hotfix and `v1.1.0` is superseded; neither may be retagged or refreshed from later source. `v1.4.5` is the published Developer ID release; its exact public artifact, cask checksum, release evidence, notarization, stapling, TeamID, and Gatekeeper checks passed. Signed-helper parity, installed release-mode review, explicit Auto restoration, and manual Fixed/Curve hardware compatibility remain separate claims for the exact `v1.4.5` binary; prior-version proof does not transfer. The historical `v1.4.4` release cannot migrate a v1.3.2 install on macOS 26, and the historical `v1.3.2` release holds passed installed and hardware claims on `MacBookPro18,1` only; the supervised `v1.3.1` smoke exposed an in-flight Curve-to-Auto race and is not compatibility proof. Do not flatten source-first, local-build, or prior-version proof into current trusted-binary claims. Trusted binary releases use `.github/workflows/release.yml`.
 20. **Diagnostics are read-only** — `viftyctl diagnose` must not prepare leases, restore Auto, or perform SMC writes. It may read daemon snapshots, thermal pressure, and agent-control status only.
 21. **Run command preflight comes before cooling** — `viftyctl run` must resolve/validate the child command before preparing a lease, then execute the resolved path directly only if prepare returns a matching active lease. While the child is active, handled terminal/session signals should be forwarded to the child so the wrapper can still restore Auto before exiting. Auto-restore failures after child exit must be visible to agents through stderr and a nonzero wrapper exit when the child itself succeeded.
 22. **Local persistence is private by default** — agent-control stores, curve profiles/backups, and manual-control markers must keep directories at `0o700` and files at `0o600`, including when tightening permissions on legacy files from older builds.

@@ -1,6 +1,6 @@
 cask "vifty" do
-  version "1.4.4"
-  sha256 "d35c7326166d128c3596f0b84b87f283a54dedd1483a854a37bcbef888af713f"
+  version "1.4.5"
+  sha256 "13fa763cbfdca3e77fcf6f657df6d51b32e19a4d25dd17a79614635fe844b0d5"
 
   url "https://github.com/Reedtrullz/Vifty/releases/download/v#{version}/Vifty-v#{version}.zip"
   name "Vifty"

@@ -2,11 +2,11 @@
 
 <!-- BEGIN GENERATED RELEASE FACTS -->
 > Release facts authority: `.github/release-manifest.json` (schema `docs/schemas/release-manifest.schema.json`).
-> Published: `v1.4.4` (version `1.4.4`, build `12`), `arm64` only, minimum macOS `15.0`.
+> Published: `v1.4.5` (version `1.4.5`, build `13`), `arm64` only, minimum macOS `15.0`.
 > Runtime identities: app `tech.reidar.vifty`, daemon `tech.reidar.vifty.daemon`, helper `tech.reidar.vifty.helper`, CLI `tech.reidar.vifty.ctl`.
-> Canonical artifact: `Vifty-v1.4.4.zip` with checksum asset `Vifty-v1.4.4.zip.sha256` and SHA-256 `d35c7326166d128c3596f0b84b87f283a54dedd1483a854a37bcbef888af713f`.
-> Public artifact trust: `passed` / `developer-id-notarized` for TeamID `X88J3853S2`; source `0ac7842483a602a30900671904f76fd7b06e2370`, CI run `31252163922`, Release run `31253285103`.
-> Tag policy: `v1.4.4` remains recorded as `signed-verified` evidence; signed tags are mandatory from version `1.3.3` onward.
+> Canonical artifact: `Vifty-v1.4.5.zip` with checksum asset `Vifty-v1.4.5.zip.sha256` and SHA-256 `13fa763cbfdca3e77fcf6f657df6d51b32e19a4d25dd17a79614635fe844b0d5`.
+> Public artifact trust: `passed` / `developer-id-notarized` for TeamID `X88J3853S2`; source `174dcd28a343de7f797d682d02c0f70e26b72c2e`, CI run `31283125895`, Release run `31284620552`.
+> Tag policy: `v1.4.5` remains recorded as `signed-verified` evidence; signed tags are mandatory from version `1.3.3` onward.
 > Separate exact-build claims: installed release review `pending`; manual Fixed/Curve/Auto compatibility `pending`.
 <!-- END GENERATED RELEASE FACTS -->
 
@@ -77,17 +77,17 @@ The checked-in [v1.3.2 MacBookPro18,1 report](docs/validation-reports/2026-07-14
 
 ### Current release trust status
 
-Vifty `v1.4.4` is the current published Developer ID release. Its immutable annotated tag object is `8c364558f4e0e9a75c129e4d08adf470b7f32bec` at commit `0ac7842483a602a30900671904f76fd7b06e2370`, source CI run `31252163922` passed, signed/notarized Release run `31253285103` passed, and the canonical zip, checksum, verifier summary, and release checklist are published at the [v1.4.4 GitHub Release](https://github.com/Reedtrullz/Vifty/releases/tag/v1.4.4).
+Vifty `v1.4.5` is the current published Developer ID release. Its immutable annotated tag object is `ffd6fdc11a77b460ce1e629b1ec43f3b7ebf582e` at commit `174dcd28a343de7f797d682d02c0f70e26b72c2e`, source CI run `31283125895` passed, signed/notarized Release run `31284620552` passed, and the canonical zip, checksum, verifier summary, and release checklist are published at the [v1.4.5 GitHub Release](https://github.com/Reedtrullz/Vifty/releases/tag/v1.4.5).
 
-The exact public zip and the checked-in cask both resolve to SHA-256 `d35c7326166d128c3596f0b84b87f283a54dedd1483a854a37bcbef888af713f`. The publication workflow summary records that this exact artifact passed bundle-version, required-executable and bundled-schema, Developer ID TeamID, LaunchDaemon allowlist, stapling, and Gatekeeper checks without skip flags. This is release evidence, not a claim that a fresh verifier run has succeeded on every current host. The exact installed public `v1.3.2` build also passed release-mode review and human-supervised Fixed → Auto → Curve → Auto validation on `MacBookPro18,1`; see the [release review](docs/validation-reports/2026-07-14-v1.3.2-macbookpro18-release/review-result.json) and [hardware attestation](docs/validation-reports/2026-07-14-v1.3.2-macbookpro18-supported/manual-smoke-attestation.md). Installed-binary parity, explicit Auto restoration, and manual hardware compatibility are now separately reviewed for that exact build on `MacBookPro18,1`; they are not broad model-family or future-release proof, and installed release-mode review and manual hardware compatibility for `v1.4.4` remain pending and are not claimed. `v1.1.1` remains the published source-first fallback; see [docs/release-status.md](docs/release-status.md).
+The exact public zip and the checked-in cask both resolve to SHA-256 `13fa763cbfdca3e77fcf6f657df6d51b32e19a4d25dd17a79614635fe844b0d5`. The publication workflow summary records that this exact artifact passed bundle-version, required-executable and bundled-schema, Developer ID TeamID, LaunchDaemon allowlist, stapling, and Gatekeeper checks without skip flags. This is release evidence, not a claim that a fresh verifier run has succeeded on every current host. The exact installed public `v1.3.2` build also passed release-mode review and human-supervised Fixed → Auto → Curve → Auto validation on `MacBookPro18,1`; see the [release review](docs/validation-reports/2026-07-14-v1.3.2-macbookpro18-release/review-result.json) and [hardware attestation](docs/validation-reports/2026-07-14-v1.3.2-macbookpro18-supported/manual-smoke-attestation.md). Installed-binary parity, explicit Auto restoration, and manual hardware compatibility are now separately reviewed for that exact build on `MacBookPro18,1`; they are not broad model-family or future-release proof, and installed release-mode review and manual hardware compatibility for `v1.4.5` remain pending and are not claimed. `v1.1.1` remains the published source-first fallback; see [docs/release-status.md](docs/release-status.md).
 
 The immutable `v1.1.1` source tag is `a82f2237ff39c24a6b366dca8f95a17ee54fd972`. Later `main` commits may contain post-release hardening, but they are not part of the published `v1.1.1` source release unless a future release is cut.
 
 An optional `Vifty-v1.1.1-unsigned-dev.zip` convenience app is attached to the GitHub Release for testers. It is ad-hoc signed, not notarized, not the official trusted binary, and macOS may show Gatekeeper warnings. The unsigned-dev zip is valid only with its `.sha256` sidecar, and the SHA-256 digest in that sidecar must match the zip bytes. See [docs/release-status.md](docs/release-status.md) before treating any binary path as trusted.
 
 Superseded release: the published `v1.1.0` source/unsigned-dev release predates helper-install hardening and may leave the app showing "Fan helper unreachable" after update. Do not retag `v1.1.0` or silently replace its assets; use the `v1.1.1` source-first hotfix release instead.
 
-The exact public `v1.3.2` binary could not gain the update checker retroactively. The exact public `v1.4.4` binary contains the advisory release-availability checker but no executable downloader or in-place installer, and must be installed manually. Eligible Developer ID builds check GitHub's fixed latest-release endpoint at most daily, with an opt-out, and open the matching fixed tag page through **Update to latest version**. This validates availability metadata and expected filenames only; it does not verify archive bytes, checksum contents, a signed tag, or notarization. Local ad-hoc, CI, source-first, and unsigned-dev builds make no update requests. This is a browser handoff only: Vifty does not download executable assets, silently replace the app, or yet provide a Sparkle installer. See [docs/auto-update.md](docs/auto-update.md).
+The exact public `v1.3.2` binary could not gain the update checker retroactively. The exact public `v1.4.5` binary contains the advisory release-availability checker but no executable downloader or in-place installer, and must be installed manually. Eligible Developer ID builds check GitHub's fixed latest-release endpoint at most daily, with an opt-out, and open the matching fixed tag page through **Update to latest version**. This validates availability metadata and expected filenames only; it does not verify archive bytes, checksum contents, a signed tag, or notarization. Local ad-hoc, CI, source-first, and unsigned-dev builds make no update requests. This is a browser handoff only: Vifty does not download executable assets, silently replace the app, or yet provide a Sparkle installer. See [docs/auto-update.md](docs/auto-update.md).
 
 ### Install trust levels
 
@@ -145,7 +145,7 @@ To audit the already-published `v1.1.0` boundary, check out `v1.1.0` and set `RE
 
 ### Homebrew
 
-The Homebrew cask now points at the published `v1.4.4` notarized zip with SHA-256 `d35c7326166d128c3596f0b84b87f283a54dedd1483a854a37bcbef888af713f`. The publication-time workflow recorded a pass for that exact artifact using the cask checksum; this is not a fresh current-host verifier claim. Installed-binary parity, explicit Auto restoration, and manual hardware compatibility remain pending for the exact `v1.4.4` build and are not claimed; the historical `v1.3.2` build was separately reviewed on `MacBookPro18,1`. Keep compatibility claims gated by [docs/release-status.md](docs/release-status.md), and never point the cask at an unsigned-dev artifact.
+The Homebrew cask now points at the published `v1.4.5` notarized zip with SHA-256 `13fa763cbfdca3e77fcf6f657df6d51b32e19a4d25dd17a79614635fe844b0d5`. The publication-time workflow recorded a pass for that exact artifact using the cask checksum; this is not a fresh current-host verifier claim. Installed-binary parity, explicit Auto restoration, and manual hardware compatibility remain pending for the exact `v1.4.5` build and are not claimed; the historical `v1.3.2` build was separately reviewed on `MacBookPro18,1`. Keep compatibility claims gated by [docs/release-status.md](docs/release-status.md), and never point the cask at an unsigned-dev artifact.
 
 ## Build and verify