release: prepare Windows 0.5.0-alpha.1 draft prerelease #171

Activity

1. abruption

   added this to the Windows support (Rust) milestone on Oct 22, 2026
2. abruption commented on Oct 22, 2026

   

   abruption

   on Oct 22, 2026

   OwnerAuthor

   More actions

   Preparation status: PR #170 merged at 36e3bf655cacddaac9b1c8ed3c80530199dd5ef5. PR #172 contains the draft-only Windows release lane, version-aware/static-CRT packaging, four localized README updates, platform scope and maintainer procedure.

   PR #172 head e90f559adbc5223c7b07f5afefdda5391af5f8b8 has 40 successful checks, including Windows packaging; automatic Code and Security Review have no findings. The remaining runtime-only npm audit failed twice on the remote advisory endpoint (CI 39713166837 attempts 1/2), and local bulk-advisory requests timed out. The full dependency audits passed, but the separate runtime-only gate has not passed and will not be waived.

   Remaining, in dependency order: successful security-audit → merge #172 → Release Please Windows alpha version PR and normal checks/reviews → merge version PR → draft release/assets → exact final-alpha Windows measurement. No alpha version/tag/draft release has been created yet, no public release or npm publication occurred, and stable npm remains 0.4.7. This issue stays open.
3. abruption commented on Oct 22, 2026

   

   abruption

   on Oct 22, 2026

   OwnerAuthor

   More actions

   Windows 0.5.0-alpha.1 draft prerelease preparation is complete.

   Source and review gates

   • Preparation PR feat: prepare Windows 0.5.0-alpha.1 diagnostic prerelease #172 merged as 815c56e047cca57b71f50805bb487c856f047526 after 41/41 checks and current-head Code/Security Review with no findings. The npm advisory service recovered; the existing audit succeeded without policy or dependency changes.
   • Release Please generated PR chore(main): release windows 0.5.0-alpha.1 #173 changed only Cargo.toml, Cargo.lock, the component changelog and Windows release manifest. Its 41/41 checks and current-head Code/Security Review passed before merge as 41aa81c1ff21d9695f1a5149cae2769e508d98c0.
   • Final main CI run 39721963372, attempt 2, passed. Initial Linux Node 22 failure was an existing coordination-refusal test receiving earlier owner-file lookup blockers instead of its expected coordination blocker; the outcome remained refused. The failed jobs passed on rerun without source changes. Windows Rust diagnostics, Rust fixtures, CodeQL and fixture compilation also passed on this source.

   Draft assets

   Draft prerelease, release ID 420304930, tag name windows-v0.5.0-alpha.1, target 41aa81c1ff21d9695f1a5149cae2769e508d98c0. It remains draft=true, prerelease=true.

   Preparation workflow 39721964946 passed release creation, source build and asset attachment. All three downloaded assets match GitHub's SHA-256 digests. ZIP shape, inner checksums, version, source manifest and executable hash were checked. The quickstart differs from the Git blob only by Windows checkout CRLF line endings; its original packaged bytes/checksums were retained.

   • ZIP SHA-256: 960a4ce1e734a726a8b9b5b4725df9c24661fdda42d88039ccd889c55b1023fc
   • Executable SHA-256: 0f13bbaca844c739026194391c906c8eacdfd8d62d5856336b9e9184c2d5b1f5
   • Outer manifest SHA-256: 305831990d3c8c49ca380cf04457ae52bef38985420b10f6acc32fe9969895c1

   Exact downloaded executable on Windows

   Measured on the designated quintet-desktop: Windows 10 build 19045, x64, NTFS, PowerShell RemoteSigned; Defender real-time protection was already disabled and was not changed. The preview reported 0.5.0-alpha.1.

   • High token (RID 12288): diagnostics refused, inspect exit 2, elevated_context_refused, no native diagnostic result.
   • Actual Medium token (RID 8192), non-elevated/non-AppContainer: diagnostic capabilities available; a self-started native Codex 0.163.0 app-server's guarded lock conflict was observed as held, exit 0. The PID remained observational evidence, not holder authority.
   • After the server's normal stdin-EOF shutdown: exit 0 and no signal for the server, then the thread lock file was absent and inspection returned unknown/open_existing_failed, Win32 2, exit 2. Provider connections: 0. safeToUnlock=false throughout.
   • The temporary scheduled task was removed after completion. Raw evidence stays private; remote/local result hashes agree. The first Medium attempt stopped at observer module loading because the staged scripts/validate-preview.mjs dependency was missing. That failed record was preserved; the dependency was copied and hash-verified, then the successful measurement above was performed. No release bytes were changed.

   Raw evidence SHA-256 (without publishing account/path/PID data):

   • High: 3ca42a6245aa82172e3f437373f7c9ff8cb048d91e938d2c2504897ed0e5a333
   • Medium: da817c2e8f52f4f5ce161a0959f9e20d5d3e14c9142540820231e2bfd7bb54ad
   • Native observation: 414190bc0115cc7248b2da2d46c304f055019b2a8902cf9374e686c399e1fd14
   • Observer source: dfd427470292d543fd010acaddf80472ec08e5b75019dc26d38a41725806bb50
   • Observer dependency: 6da0e5add13b81d784742545bff96a5e516d02cbf67ddd3c8f62e8b277c27198

   The four localized READMEs and platform/preview guides describe the diagnostic-only Windows prerelease and its limits. Windows 11, Defender-on qualification and Windows recovery are not established by these measurements.

   No public alpha tag/release or npm publication was created. Stable GitHub/npm latest remains v0.4.7 / 0.4.7. Public prerelease publication is the remaining maintainer decision; Node release PR #167 stays separate. The draft-preparation acceptance criteria of #171 are satisfied; this does not close Windows holder-attribution or recovery research.
4. abruption

   closed this as completedon Oct 22, 2026
5. abruption commented on Oct 22, 2026

   

   abruption

   on Oct 22, 2026

   OwnerAuthor

   More actions

   Published the prepared Windows diagnostic prerelease with the maintainer's authorization.

   • Public release: https://github.com/abruption/codex-unlock/releases/tag/windows-v0.5.0-alpha.1
   • Published at: 2026-10-22T04:30:31Z
   • Release ID: 420304930; draft=false, prerelease=true, immutable=true.
   • Tag resolves directly to the reviewed and tested source 41aa81c1ff21d9695f1a5149cae2769e508d98c0.
   • The three existing assets were preserved. Anonymous release access and anonymous ZIP download succeeded; downloaded ZIP SHA-256 remains 960a4ce1e734a726a8b9b5b4725df9c24661fdda42d88039ccd889c55b1023fc, identical to the package used for the final Windows measurement.
   • Stable GitHub latest remains v0.4.7 and npm latest remains 0.4.7; this Windows release is distributed as a standalone ZIP.

   This is diagnostic-only Windows support, with the qualification limits described in the README/platform guide. The final preparation and Windows evidence record applies to these unchanged published bytes.