chore(release): cut 0.4.11

[steipete]

Recover signed macOS releases after v0.4.10 stopped before creating binaries. Pin the landed shared-helper correction that resolves the login home for the Developer ID signing canary; the canonical helper now passes a real canary from an empty isolated HOME.

Add the finalized 0.4.11 changelog entry. The producer appends the complete dated 0.4.10 section to 0.4.11 release notes and verifies that same combined body throughout draft and publication. Regression coverage checks exact ordering, ordinary releases, and missing or duplicate recovery sections. Versions continue to derive from the immutable release tag and Go module metadata.

Validation: Go 1.26.8 build, lint, tests, coverage, documentation metadata, isolated-home signing canary, and independent P0–P2 autoreview passed. The full contract rerun and exact-head PR CI must pass before merge. The v0.4.10 tag remains unchanged. Homebrew remains held by the existing Formula/Cask handoff contract.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed September 13, 2026, 10:26 PM ET / September 14, 2026, 02:26 UTC.

ClawSweeper review

What this changes

Updates the macOS signing helper used by release tooling and combines the 0.4.11 recovery notes with the unpublished 0.4.10 changes, with focused regression coverage.

Merge readiness

✅ Ready for maintainer review

This recovery release remains necessary: main retains the older signing-helper pin, and the latest published release is v0.4.9. No actionable defect was found in the proposed changes; the collaborator-authored PR should remain open.

Priority: P2
Reviewed head: 053b65fa9b5bccdc829d51f1039cd910c77d8ea5

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused release repair with verified dependency provenance, consistent note handling, and useful regression coverage.
Proof confidence	🌊 off-meta tidepool	Not applicable: The collaborator-authored PR is exempt from the external-contributor proof gate. Its body reports a real isolated-home signing canary, and dependency inspection confirms the corresponding production change; no new cross-principal authority is introduced.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: The collaborator-authored PR is exempt from the external-contributor proof gate. Its body reports a real isolated-home signing canary, and dependency inspection confirms the corresponding production change; no new cross-principal authority is introduced.
Evidence reviewed	7 items	Introduced scope: The verified base-to-head delta contains four files: release notes, release documentation, the producer, and its tests; production shell code grows by 10 net lines and tests by 54. Consistent release-note handling: The recovery section is appended only for released version 0.4.11. Draft creation, draft verification, publication, and Homebrew verification all use the same extractor; tests cover ordering, ordinary releases, and missing or duplicate recovery headers. Affirmative dependency boundary: The release producer directly executes the external release-mac-app helper. It checks both entrypoint and library digests, freezes private copies, and rechecks them before secret-bearing execution; docs explicitly require review when updating these pins.
Findings	None	None.
Security	None	None.

How this fits together

The local release producer turns verified source tags into signed release binaries and GitHub release notes. It checks a pinned external signing helper before execution and verifies release-note contents throughout draft creation and publication.

flowchart TD
  A[Verified source tag] --> B[Local release producer]
  C[Pinned signing helper] --> B
  D[Tagged changelog] --> E[Recovery note assembly]
  B --> F[Signed release draft]
  E --> F
  F --> G[Verification and publication]

Loading

Before merge

None.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Production and test growth	Production +10 net lines; tests +54 net lines	Production growth is limited to the explicitly documented recovery-note rollup, with focused regression coverage.

Technical review

Best possible solution:

Retain the narrowly scoped helper correction and recovery notes within the existing signed, draft-first release process.

Do we have a high-confidence way to reproduce the issue?

Yes at the source level: the producer supplies an isolated HOME, while the old helper runs its signing canary before restoring the account home. The PR reports a successful corrected canary; this review did not execute macOS signing.

Is this the best way to solve the issue?

Yes. The pin update adopts a verified one-line dependency correction, and the version-specific note rollup reuses the existing extraction and verification path.

AGENTS.md: not found in the target repository.

Codex review notes: model internal, reasoning medium; reviewed against ce57ab1d32a8.

Labels

Label changes:

• add P2: Repairs a bounded release-producer failure while existing v0.4.9 downloads remain available.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: The collaborator-authored PR is exempt from the external-contributor proof gate. Its body reports a real isolated-home signing canary, and dependency inspection confirms the corresponding production change; no new cross-principal authority is introduced.

Label justifications:

• P2: Repairs a bounded release-producer failure while existing v0.4.9 downloads remain available.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: The collaborator-authored PR is exempt from the external-contributor proof gate. Its body reports a real isolated-home signing canary, and dependency inspection confirms the corresponding production change; no new cross-principal authority is introduced.

Evidence

What I checked:

• Introduced scope: The verified base-to-head delta contains four files: release notes, release documentation, the producer, and its tests; production shell code grows by 10 net lines and tests by 54. (scripts/release-local:1194, 053b65fa9b5b)
• Consistent release-note handling: The recovery section is appended only for released version 0.4.11. Draft creation, draft verification, publication, and Homebrew verification all use the same extractor; tests cover ordering, ordinary releases, and missing or duplicate recovery headers. (scripts/release-local:1194, 053b65fa9b5b)
• Affirmative dependency boundary: The release producer directly executes the external release-mac-app helper. It checks both entrypoint and library digests, freezes private copies, and rechecks them before secret-bearing execution; docs explicitly require review when updating these pins. (scripts/release-local:325, 053b65fa9b5b)
• Verified shared-helper change: GitHub repository metadata verified ownership. The dependency commit adds only a login-account HOME assignment around the signing canary; explicit keychain and identity arguments and subsequent Apple trust checks remain intact. The parent library hashes to the old target pin, and the updated library hashes to the new pin. (skills/release-mac-app/scripts/lib/mac_release.sh:1568, 16a71932d9e8)
• Main and release provenance: Main still pins the preceding helper library. The merged release-preparation PR chore(release): cut 0.4.10 #55 prepared 0.4.10 but does not contain this correction. GitHub release enumeration shows v0.4.9 as the latest published release and no published 0.4.10 or 0.4.11. (scripts/release-local:25, ce57ab1d32a8)
• Routing history: Recent release-script history repeatedly identifies Peter Steinberger; GitHub commit metadata maps the latest merged release preparation to steipete. Deeper pickaxe and blame inspection encountered unavailable historical blobs, so no feature-introduction claim is made. (scripts/release-local:26, ce57ab1d32a8)

Likely related people:

• unknown: The claimed source-line change could not be verified from bounded local history. (role: source history unknown; confidence: low)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.