[daniellee-ux]

Summary

• Shrink the base installer by preparing the signed ChatGPT connection component automatically on first sign-in. Cache it across updates; preserve the existing private account profile and Keychain namespace.
• Verify pinned archive/executable sizes and SHA-256 hashes plus Developer ID identity before launch. Add progress, cancellation, retry, corrupt-cache repair, and HTTPS redirect restrictions. No manual Codex installation is required.
• Integrate Sparkle 2.10.0 with signed architecture-specific feeds, signed delta updates, and full-download fallback. Automatic checks stay opt-in; downloads/installation remain user initiated. Protect active recordings and save pipelines from updater restarts.
• Package native Apple Silicon/Intel installers with LZMA compression, retaining the universal Seminarly.dmg for older clients.
• Prepare v0.1.12 (build 13) and add repeatable anonymous public-download checks before/after promoting a release to latest.

Installer sizes

Installer	Download
Apple Silicon	3.6 MB
Intel	4.1 MB
Universal compatibility	6.1 MB

Previously the v0.1.11 universal DMG was 174.2 MB. ChatGPT's optional first-use component downloads separately: 43.9 MB on Apple Silicon / 52.3 MB on Intel. This defers those bytes for ChatGPT users and avoids them for users of other providers.

Verification

• 465 macOS unit tests passed.
• Signing-identity, upstream-runtime, architecture packaging tests and 6 Python update/feed tests passed.
• All three actual DMGs passed Developer ID signing, notarization, stapling, Gatekeeper, and disk-image verification; native images were also inspected read-only.
• Both signed components passed the production installer/hash/signature/cache/protocol smoke with disposable signed-out profiles; no account login, model call, or meeting database access.
• Both architecture feeds and signed delta creation/application passed with disposable fixture apps; patched code signatures were verified. Intel execution was under Rosetta, not physical Intel hardware.
• Public URL verification is a release gate: upload all assets to a draft, publish as a non-latest prerelease, exercise actual URLSession first-use downloads and exact installer/feed byte checks, then promote and recheck /latest/download/ links.

The first upgrade from pre-Sparkle versions is still a full download. Delta updates apply to subsequent compatible releases. Private update-signing material stays in Keychain; only the public verification key is committed.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-24T19:13:02.623303Z	10dc7df	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[daniellee-ux]

Released as v0.1.12, now the stable latest release.

Release verification completed:

• The release tag resolves to merge commit cb1b7e677e59671191eb18a08d2c91c1f243a9e3; its source tree matches the tested PR commit.
• 465 local macOS tests passed, along with PR CI and post-merge CI.
• All seven assets uploaded completely, with GitHub SHA-256 digests matching the verified local artifacts. All three DMGs are Developer ID-signed, notarized, and stapled; both update feeds and their enclosures passed Sparkle signature verification.
• Anonymous downloads of all three installers and both feeds passed exact byte/hash and feed-target checks, first using pinned v0.1.12 URLs and again using latest/download after promotion. The legacy latest/download/Seminarly.dmg link remains valid.
• The production URLSession downloader fetched both ChatGPT components from their actual pinned public URLs into a fresh disposable cache. Archive/executable hashes, Developer ID validation, extraction, isolated signed-out startup, and cache reuse without another download all passed. No account login, AI request, or meeting-data access was used. Intel execution was tested via Rosetta.
• Signed delta generation/application and full-download fallback links passed for both architectures using disposable fixtures. This first Sparkle-enabled release intentionally has no production delta from v0.1.11; a real in-place app upgrade and physical Intel testing are not claimed.

Keep the pinned runtime assets published and preserve the generated update-history for subsequent releases.