v0.1.0-beta.1 release evidence and follow-up ledger

[jremick]

v0.1.0-beta.1 release evidence and follow-up ledger

Moodarr v0.1.0-beta.1 was published as an early public beta on 2026-07-20. This issue records the released identity, evidence used for the beta decision, and the broader validation work that remains for later beta hardening. Unchecked follow-ups below are not represented as passing release evidence.

Released identity

• Source commit: 08447e87df2e1705aa9a79193a52a65fb00724c3
• Protected Git tag: v0.1.0-beta.1 at the exact source commit
• Candidate image: ghcr.io/jremick/moodarr:sha-08447e87df2e1705aa9a79193a52a65fb00724c3
• Released image: ghcr.io/jremick/moodarr:v0.1.0-beta.1
• Immutable OCI digest: sha256:c1558d33b1e38c01d7d77171354464dd2b507fd6b84b353f2b0e11372ed73157
• GitHub prerelease: https://github.com/jremick/moodarr/releases/tag/v0.1.0-beta.1
• Protected main at publication: 633a060080f02225761520cb8084e9eb2a2fa78a; the release source remains reachable from main

Never use any candidate recorded in .github/release-revocations.json, including the superseded c7b6deff54a78ede279d607e38bfe8df2bec3582 candidate.

Passed release evidence

• Exact candidate source CI: https://github.com/jremick/moodarr/actions/runs/29565465519
• Exact candidate CodeQL analysis: https://github.com/jremick/moodarr/actions/runs/29565465417
• Exact-source candidate publication, attestation, runtime scan, and registry read-back: https://github.com/jremick/moodarr/actions/runs/29565540479
• Independent exact-digest supply-chain, clean-install, Compose-install, alpha.21 upgrade, and rollback validation: https://github.com/jremick/moodarr/actions/runs/29565760158
• Protected exact-digest promotion, repeated release verification, vulnerability scan, revocation checks, and byte-identical GHCR read-back: https://github.com/jremick/moodarr/actions/runs/29727611811
• The frozen source contains the Finder/Admin redesign, catalog identity repair, SQLite failure hardening, configured Plex-home fallback, and direct-Unraid origin correction.
• GHCR package-writer ACL was maintainer-confirmed before candidate publication.
• The exact candidate ran healthy with the expected version, revision, policies, worker readiness, and protected access behavior.
• EXP ran the exact released digest and passed live Plex and Seerr connection checks plus a non-writing 90,000-item search smoke test.
• Desktop and 390-pixel mobile protected-shell rendering, keyboard focus visibility, and zero application console errors passed in the release smoke session.
• The pinned catalog asset was uploaded to the draft prerelease, downloaded again, and matched dd25ba6602e1bdb8e6999b0442bc40165e6d4faadd02e91e74e1a24e2b55e85a at 14,160,185 bytes before publication.
• Final Git tag, GitHub prerelease, GHCR semantic tag, catalog asset, and EXP exact-digest read-backs passed after publication.

Broader beta-hardening follow-ups

The original matrix below exceeds the intentionally narrower gate used for this early public beta. It remains useful hardening work for later beta prereleases and stable-release planning, but none of these unchecked rows should be inferred as completed:

• Complete fresh-Unraid Docker Manager and prior-alpha update coverage across additional real installations.
• Retain a full stopped, networkless catalog-import evidence package covering isolation, ambiguous-identity rejection, and request-attempt disclosure.
• Complete the dedicated-identity Plex and Seerr/Jellyseerr write matrix, including Watchlist cleanup, exactly-once confirmed request, idempotent retry, uncertain-outcome reconciliation, and upstream cleanup.
• Retain a production-sized native Linux amd64 two-CPU/two-GiB responsiveness report.
• Complete current-stable Chrome, Edge, Firefox, and macOS Safari coverage for Plex sign-in, request confirmation, Admin lock/unlock, keyboard-only navigation, focus, mobile layout, reduced motion, and console errors.
• Produce the comprehensive privacy-reviewed moodarr-beta-manual-evidence-v1 artifact for a later release gate.

Release boundary

This is an early beta, not v1.0. The published release notes define its supported platform, trusted-LAN/VPN deployment boundary, AI-off official-image policy, experimental iOS exclusion, and known limitations. Continue using the exact digest above for reproducible deployment and rollback.

[jremick]

Hosted artifact retention record

The following allowlisted workflow artifacts are bound to final source e7bb110a8650be8bd0c88c154dfb817b258de32e. GitHub currently reports expiry on 2026-08-15; retain the privacy-reviewed downloads outside GitHub before expiry.

Run	Artifact ID	Name	GitHub artifact digest
29490491710	8372226886	native-source-alpha21-upgrade-rollback-29490491710-1	sha256:b37dceac21ed88488c3106b4337dc20152061a7f6726d2d4ce81b9dfb661dcd4
29490491710	8372210464	native-source-clean-install-29490491710-1	sha256:f4f0d72fc3caa9c82246f9b4d1858fec21adeb345bd968f6febb815e476cbd63
29490491710	8372197576	container-scan-29490491710-1	sha256:0ea30825a7f600198571933421892f705067c7467c96f0aff4e0fa1e0e0710e5
29490883891	8372383003	beta-upgrade-rollback-e7bb110a8650be8bd0c88c154dfb817b258de32e	sha256:23096a5a147cfaf8ea6d27c111348999971b02f9ad16636c81881098c34db1f9
29490883891	8372367999	beta-clean-install-e7bb110a8650be8bd0c88c154dfb817b258de32e	sha256:67534772f986c7eeab8b3d00db0ac532201b86863a51f8d4f3bfe12564adea52
29490883891	8372352680	beta-supply-chain-e7bb110a8650be8bd0c88c154dfb817b258de32e	sha256:69c1cff0cf3d9fcf40805334b8dcf51a103d5c29b1705581478e5644391ce1e2

The candidate-publication and CodeQL runs do not currently expose a downloadable Actions artifact in the run-artifacts API; their durable references remain the run URLs in the issue body.

[jremick]

All six allowlisted GitHub Actions artifact ZIPs listed above have now been downloaded into a restricted, ignored local evidence store and read back against their service-reported SHA-256 values. All six matched. The extracted review copies were also hashed at download time. No private runtime logs, credentials, media identities, or origins were added to this public ledger.

[jremick]

Candidate identity refresh — 2026-07-16T13:05:53Z

Current live read-back remains GO for exact-digest validation and STOP for semantic promotion:

• remote main remains e7bb110a8650be8bd0c88c154dfb817b258de32e;
• anonymous reads of the full-SHA tag and exact digest return byte-identical OCI indexes at sha256:14fc74255b242d64c63d87d01cfe164b08943d639543f9a5495a5b482adcfea5;
• the exact live GitHub attestation again passed repository, signer workflow, signer/source digest, source-ref, and hosted-runner policy;
• the current revocation policy still contains only the two rejected candidates and does not revoke this candidate;
• the semantic Git tag, semantic GHCR image tag, and GitHub release all remain absent;
• all four authoritative workflow runs remain successful;
• all six retained artifact ZIPs still match GitHub's current service-reported SHA-256 values, and all 17 extracted evidence files still match the locally frozen digest manifest.

No package, ref, tag, release, deployment, integration, or source file was changed by this refresh. The non-waivable manual candidate rows below remain open.

[jremick]

Exact candidate artifact retention record

The allowlisted artifacts from the final exact-digest validation run are now retained in the restricted, ignored release-evidence store. Their extracted files were read back against a frozen local manifest; the manifest SHA-256 is 39a4d37a4ea63407adefd2879001bf424a19b51faa2469e5378b7a973dfb11c0.

Run	Artifact ID	Name	GitHub artifact digest	Expires
29565760158	8401054302	beta-clean-install-08447e87df2e1705aa9a79193a52a65fb00724c3	sha256:fa4468560b12578088692d60be6d1ff474c381aa6c3ff4e6d7e3785269d652ae	2026-08-16T08:16:26Z
29565760158	8401059659	beta-upgrade-rollback-08447e87df2e1705aa9a79193a52a65fb00724c3	sha256:1026441e1dc30ae60c36e3a6e64eee83025f1abf3cd12d434b49968bfb8b91e4	2026-08-16T08:16:42Z
29565760158	8401037728	beta-supply-chain-08447e87df2e1705aa9a79193a52a65fb00724c3	sha256:f53822eebf12342a4bcfc4ae234eae5fb3bef81303eff60fc21fb7288f4cba1e	2026-08-16T08:15:40Z

The compact supply-chain report records anonymous pull success, exact OCI index identity, attached SPDX 2.3 SBOM, validated BuildKit provenance, verified GitHub artifact attestation, and zero high/critical or actionable high/critical Trivy findings. Manual candidate rows remain open and semantic promotion remains blocked.

[jremick]

Beta.2 hardening tranche opened

PR #47 packages the next bounded web/server tranche: #47

Completed in the branch:

• repaired the newly failing high-severity dependency audit without changing beta.1 artifacts;
• made normal session lookup read-only under SQLite writer contention and moved expired-session cleanup off the request path;
• added bounded server configuration validation, including strict persisted boolean types with environment override recovery;
• added typed/bounded client failures, recoverable bootstrap Retry, stale-session recovery on HTTP 401, coalesced background refreshes, and endpoint-specific deadlines above server budgets;
• reconciled current-main beta/release documentation with this issue as the authoritative beta.1 evidence ledger and added an Unreleased changelog section.

Verification at branch head 9a6b38d53da30995485e39461d83f6d2f7cf550f:

• both full and production-only high-severity npm audits: zero vulnerabilities;
• clean npm ci, then npm run verify:release: 49 files / 751 tests, builds, recommendation evaluations, packaging, and disposable container smoke passed;
• local in-app browser: healthy desktop/390px layouts, unavailable state, Retry recovery without reload, and zero application console errors;
• independent correctness, security, testing/docs, and adversarial re-reviews: no remaining P0-P2 findings.

This does not close any of the six broader evidence rows in the issue body. The next release-enablement slice remains version-generalized beta.2 validators/release parity plus a direct immutable beta.1-to-beta.2 persisted-volume upgrade smoke. The external Unraid, real Plex/Seerr, native responsiveness, full browser, stopped/networkless catalog, and privacy-reviewed artifact rows remain open.

No EXP, household Plex/Seerr state, beta.1 tag, released image digest, or GitHub prerelease was changed.