Prepare Gloss 0.8.4 release

Resources/Info.plist

@@ -19,9 +19,9 @@
     <key>CFBundlePackageType</key>
     <string>APPL</string>
     <key>CFBundleShortVersionString</key>
-    <string>0.8.3</string>
+    <string>0.8.4</string>
     <key>CFBundleVersion</key>
-    <string>11</string>
+    <string>12</string>
     <key>GlossSafariExtensionAvailable</key>
     <true/>
     <key>CFBundleDocumentTypes</key>

docs/release-notes/v0.8.4.md

@@ -0,0 +1,83 @@
+# Gloss 0.8.4
+
+Gloss 0.8.4 focuses the product on browser and PDF translation, makes the same
+scenario model available to automation, and closes the Homebrew update loop.
+It is the first public build after 0.8.2 and carries the complete 0.8.3 release
+candidate forward.
+
+## Capability and scenario model
+
+- Composes user-facing workflows from a shared capability registry instead of
+  starting every implemented feature.
+- Enables Chrome browser translation and PDF translation by default; an
+  Apple-signed build also enables Safari.
+- Keeps clipboard, screenshot/OCR, system selection, glossary, and history
+  implementations available in source without exposing their UI or starting
+  their listeners.
+- Uses the same registry for App lifecycle decisions, menus, settings, external
+  PDF-open requests, and CLI dispatch.
+- Reads a signed-build capability flag so Homebrew's ad-hoc package does not
+  expose an unusable Safari settings entry or claim Safari in CLI output.
+- Omits the Safari App Extension from ad-hoc/Homebrew artifacts so PlugInKit
+  cannot register an unusable system extension.
+- Removes dormant text and image Services from the focused App bundle while
+  retaining their implementation in source.
+
+## CLI automation
+
+- Adds `gloss-cli capabilities --json` for stable, machine-readable capability,
+  scenario, dependency, and command mappings.
+- Adds `gloss-cli browser` with webpage translation semantics.
+- Adds an explicit `gloss-cli text` mapping for the reusable translation core;
+  the original flat invocation remains an alias.
+- Adds `gloss-cli pdf INPUT... --output DIR` for sequential PDF batches that
+  reuse one isolated BabelDOC session without taking over the App service.
+- Keeps the existing flat text command for compatibility while requiring the
+  shared text-translation capability.
+
+## PDF reliability
+
+- Requires the signed BabelDOC `0.6.4+gloss.5` runtime, which includes the
+  `o200k_base` tokenizer needed by current translation models.
+- Installs a compatible available runtime after the launch-time check instead
+  of continuing with an incompatible cached version.
+- Extends the bounded cold-start window to 180 seconds for a first DocLayout
+  initialization.
+
+## Homebrew updates
+
+- Checks the signed public release manifest silently after launch and at most
+  once every 24 hours, with manual check and update controls in the App.
+- Offers in-App installation only when the running bundle is verified as the
+  official `sunchj/tap/gloss` Homebrew cask.
+- Runs fixed Homebrew commands from a staged helper after Gloss exits, without
+  a shell or `sudo`, then verifies the version, architecture, ad-hoc signature,
+  and quarantine state before reopening the App.
+- Binds the exact Homebrew Cask bytes and current-architecture App asset to the
+  signed manifest, waits for a helper readiness acknowledgement, and restores a
+  verified previous App if an upgrade damages the installed bundle.
+- Defers installation while a browser or PDF translation task is active and
+  surfaces failure results after restart.
+
+## Release integrity
+
+- Signs the App update manifest with Ed25519 and publishes its detached
+  signature with both architecture-specific release archives.
+- Packages and signs the CLI, bundled Codex runtime, and update helper as
+  explicit Homebrew cask components.
+- Links the bundled `gloss-cli` into Homebrew's `bin` directory and validates
+  its capability report in both architecture install smokes.
+
+## Validation
+
+- The complete test suite passes: 290 tests, 5 conditionally skipped, and no
+  failures.
+- All three products (`Gloss`, `gloss-cli`, and `gloss-update-helper`) build.
+- A real CLI translation of the 15-page *Attention Is All You Need* PDF
+  completed in 31.56 seconds and produced a 15-page, 2.3 MB PDF with selectable
+  Chinese text using BabelDOC `0.6.4+gloss.5`.
+
+## Compatibility
+
+Gloss 0.8.4 requires macOS 14 or newer. Existing Homebrew installations can
+upgrade through the App or with `brew upgrade --cask sunchj/tap/gloss`.

docs/runtime-distribution.md

@@ -86,8 +86,8 @@ active runtime。
 `.github/workflows/release.yml` 在 `v*` tag 上：
 
 1. 分别在 `macos-15` arm64 和 `macos-15-intel` x86_64 runner 构建 `Gloss.app`，并显式使用
-   `GLOSS_SIGN_IDENTITY=-` 对 App、helper 与嵌套 extension 做 ad-hoc codesign；不导入 Apple
-   证书，也不执行 notarization 或 stapling。
+   `GLOSS_SIGN_IDENTITY=-` 对 App 与 helper 做 ad-hoc codesign；Homebrew 产物不包含需要 Apple
+   身份配对的 Safari extension，也不执行 notarization 或 stapling。
 2. 生成 `Gloss-macos-arm64.zip`、`Gloss-macos-x86_64.zip`、`SHA256SUMS` 和包含两个
    architecture asset 的 `gloss-release-manifest.json`。
 3. 生成并校验使用 `on_arm` / `on_intel` URL 与 SHA-256 的根级 Release asset
@@ -101,17 +101,19 @@ active runtime。
 6. Release 上传成功后，dispatch `SunChJ/homebrew-tap` 的 `update-cask.yml`，由公开 tap
    下载并二次校验 Release，再更新 `Casks/gloss.rb`。
 
-完整 App 会同时检出并构建私有浏览器扩展仓库。Release workflow 使用两个职责分离的凭据：
+完整 App 会同时检出并构建私有浏览器扩展仓库。Release workflow 使用三个职责分离的凭据：
 
 | Secret | 用途 |
 | --- | --- |
 | `GLOSS_EXTENSION_SSH_KEY` | 只读检出私有 `SunChJ/personal-immersive-translator` |
+| `GLOSS_APP_UPDATE_MANIFEST_SIGNING_KEY` | 使用 Ed25519 对 App 更新 manifest 签名 |
 | `GLOSS_DISTRIBUTION_TOKEN` | 向公开 binary repo 上传 Release，并 dispatch 公开 tap workflow |
 
-workflow 的第一个 job 始终检查 `GLOSS_EXTENSION_SSH_KEY`；tag 事件以及显式开启
-`publish_release` 的手工恢复任务还会检查 `GLOSS_DISTRIBUTION_TOKEN`。缺失即 fail closed，
-不会开始正式构建。手工 `workflow_dispatch` 默认不走 public publication 路径，因此不需要
-distribution token，但仍需只读 extension deploy key 才能构建完整 App。
+workflow 的第一个 job 始终检查 `GLOSS_EXTENSION_SSH_KEY` 和
+`GLOSS_APP_UPDATE_MANIFEST_SIGNING_KEY`；tag 事件以及显式开启 `publish_release` 的手工恢复任务
+还会检查 `GLOSS_DISTRIBUTION_TOKEN`。缺失即 fail closed，不会开始正式构建。手工
+`workflow_dispatch` 默认不走 public publication 路径，因此不需要 distribution token，但仍需
+只读 extension deploy key 与 manifest signing key 才能构建完整 App。
 
 ### 公开仓库与凭据初始化
 
@@ -196,7 +198,8 @@ brew upgrade --cask sunchj/tap/gloss
 1. 先发布兼容的 `SunChJ/BabelDOC` signed runtime，并确认 stable manifest 可下载。
 2. 合并 Gloss 的发行提交，确认 `Resources/Info.plist` 版本与准备创建的 `v*` tag 完全一致。
 3. 确认两个公开仓库、`update-cask.yml`、`GLOSS_EXTENSION_SSH_KEY`、
-   `GLOSS_DISTRIBUTION_TOKEN` 和 tap 的 Actions/branch protection 设置均已就绪。
+   `GLOSS_APP_UPDATE_MANIFEST_SIGNING_KEY`、`GLOSS_DISTRIBUTION_TOKEN` 和 tap 的
+   Actions/branch protection 设置均已就绪。
 4. 在私有 Gloss 仓库的目标 commit 上创建并推送 tag，例如 `v0.8.0`。
 5. 等待 Gloss Release workflow 完成 ad-hoc 签名；workflow 会先创建 draft Release，上传全部
    资产后再发布，最后 dispatch tap 更新。