Release evidence and publication

Document status: current release procedure. Release history belongs in CHANGELOG.md; feature availability belongs in the functional specifications.

The current release target is v0.44.13. A 0.x release must pass the version, changelog, trusted-tag, build, artifact, checksum, and explicit publication controls below, but it does not claim 1.0 maturity. npm publication is an independent package-delivery step and does not block a verified desktop/GitHub Release. Real product visuals and two external developer runs become mandatory only when the major version is 1 or higher.

v0.44.13 closes the two issues that had survived the most repair rounds, in both cases by making the failing path produce evidence instead of collapsing it. Image loads (issue #382) no longer swallow the cause: HTTP 401/403, network interruption, an unreadable Tauri channel, a zero-byte response, a sniffing failure, and a WebView decode failure are now classified and written to the exportable desktop diagnostics channel, while the user-facing text stays unchanged. LAN discovery (issue #369) gains two corrections: every rejection branch in record_peer now logs a reason category and a running count (previously all eight branches returned silently, so "filtered out by server identity" and "never received the packet" were indistinguishable in the log), and the LAN server fingerprint is now derived from the server's self-reported uniqueID rather than from the client's entry URL, so two devices reaching the same Rocket.Chat through an IP, a hostname, HTTP, or HTTPS agree on one identity. The fingerprint must stay a single authoritative value because it also binds the handshake transcript signature; admitting two fingerprints for discovery would produce peers that are discoverable but whose signature can never verify. Both devices must run v0.44.13 or later to discover each other; mixed-version pairs are now visible in the log as reason=server_fingerprint. Servers that do not expose uniqueID fall back to the previous entry-URL normalization, and the device-identity keychain scope is unchanged, so existing device identities and pinned trust survive. The lightbox also closes on a click anywhere in the blank area around the image, without a pan-drag release closing it by accident (issue #388).

v0.44.12 carries the four v0.44.11 corrections plus the release tooling that prevents the failure which withheld that candidate. pnpm sync-version <x.y.z> now aligns every version surface in one step, reusing the same packageFiles list the release verifier checks, and refuses to write anything when the target CHANGELOG.md section is missing; pnpm precheck:release runs the release contract, the three documentation version surfaces, typecheck, architecture checks, pure tests, and the regression suite locally. The v0.44.11 candidate was withheld after its desktop gate caught this release document and docs/compatibility.md still pointing at v0.44.9.

v0.44.11 (superseded) carries four user-facing corrections: nested reply quotes deeper than two levels no longer render the inner quote links (issue #387); notification-click navigation no longer re-locates a stale message when the immediate event and the native pending-queue replay interleave (issue #381); LAN discovery keeps broadcast and UDP running when multicast join or mDNS is unavailable, instead of letting one failed channel disable the rest (issue #369); and the lightbox white backing is applied to SVG only, so transparent PNGs no longer gain a white border (issue #386). The v0.44.10 candidate was withheld after its gate caught three stale version surfaces (app-sdk package contract, public version surfaces, and this release document).

v0.44.9 carries the LAN discovery fixes previously staged for v0.44.8 (the v0.44.8 tag was withdrawn after its desktop gate caught a stale log-count assertion in the LAN diagnostics regression, before any artifact was published): server-URL normalization for LAN identity fingerprints so devices logging in through different URLs to the same Rocket.Chat still discover each other, plus the inbound Windows firewall rule for LAN P2P.

v0.44.8 (superseded) addresses the two most likely causes of the "no LAN peer is online" failure on real Windows pairs: (1) LAN identity fingerprinting now normalizes the server URL (scheme/host case, default ports, trailing slash, query) so two devices that log in through different URLs to the same Rocket.Chat (LAN IP vs hostname vs localhost, or Site_Url differing from the login URL) still discover each other instead of silently filtering the announcements; (2) the Windows runtime now adds an inbound program-level firewall rule (RocketX LAN P2P) for the private+domain profiles, because the default Windows firewall blocks inbound UDP 45826 and the random TCP listener, and Tauri apps never show the browser-style "allow access" prompt.

v0.44.7 makes LAN P2P failures actionable in the UI: the native Rust errors (no LAN peer is online for this user, no LAN peer candidate is available, LAN service is not running, connect failures) are mapped to step-by-step Chinese hints that point at the exact layer (peer presence, candidate reachability, service state) and direct users to export the rocketx::lan_diagnostics log when retesting a failure.

v0.44.6 corrects the lightbox white backing so it only wraps the decoded image box (transparent SVGs still need the white canvas as a contrast bed), while the stage itself stays transparent. The v0.44.5 candidate laid a full-stage white canvas behind every image, adding a large white border to ordinary PNGs; a UI regression now asserts that opaque images show no white margin and that the white backing matches the image's rendered size.

v0.44.5 corrects the desktop lightbox for small images: the stage previously sized itself to the image's intrinsic dimensions (a 24×24 SVG rendered as a 24px thumb inside an 86vh backdrop), so clicking the thumbnail appeared to "show nothing". The lightbox stage is now a fixed viewport-sized canvas with object-contain scaling, so originals of any size are enlarged and visible.

v0.44.4 corrects desktop SVG thumbnail rendering when the server returns PNG bytes from a URL that still ends in .svg and the response declares the wrong MIME (or none): the image pipeline now sniffs the actual bytes and restores the Blob MIME from the file signature, so the WebView decodes what the server really sent (the v0.44.3 candidate was withheld after manual testing on a real Rocket.Chat against the same broken-thumbnail case showed the failure placeholder still appeared).

v0.44.3 carries the cross-platform compile correction required by the release workflow so all platform build jobs can reach packaging (the v0.44.2 candidate was withheld after the desktop gate stopped at cargo check on Linux/macOS: the upload-cancel registry uses std::sync::OnceLock on every platform but its import was behind #[cfg(windows)]).

v0.44.2 carries the Rust formatting correction required by the release workflow so all platform build jobs can reach packaging (the v0.44.1 candidate was withheld after the desktop gate stopped at cargo fmt --check).

v0.44.1 fixes notification-card clicks not navigating to the referenced message (clicks arriving before WebView listeners or login recovery now queue in a desktop-side FIFO and replay once ready — issue #381) and adds full-chain LAN diagnostics logging (rocketx::lan_diagnostics) so real-world retests of issue #369 can be located precisely. It also delivers file-transfer progress and control (issue #385): streamed desktop downloads with percentage and cancel, cancel across all upload paths, XHR upload percentage on web, and desktop native upload progress via a Rust counting stream + Tauri Channel (the desktop upload path is rewritten from Part::file to the counting stream while keeping the disk-handle streaming constraint of issue #367).

v0.44.0 lands the slash-command overhaul and three native team features. All 30 slash commands now have per-command client strategies with parameter-filling GUIs and fully localized descriptions; /poll votes with digit-emoji reactions that official Rocket.Chat clients can join (verified with two accounts on 8.6.1), /kanban and /oncall store shared state as root-message + thread event logs. The App SDK gains chat.react, chat.send, chat.threads, and the message.updated event, while message-content events are now gated behind the chat:read grant. It also fixes directory sorting for channel browsing and auto-paginates thread reads.

v0.43.28 fixes transparent SVG originals appearing blank in the desktop lightbox when black artwork is rendered over the black viewer background. The lightbox now provides a white image backing and the UI regression uses a transparent black SVG.

v0.43.27 adds per-interface IPv4 directed broadcasts for LAN discovery on Windows, refreshing the interface list as network adapters change. It keeps multicast and global broadcast fallbacks and addresses the remaining multi-network/VPN reachability gap in issue #369.

v0.43.26 corrects desktop SVG thumbnail rendering when Rocket.Chat returns PNG bytes from a URL that still ends in .svg. The Tauri file path now restores the Blob MIME from the response Content-Type; the local Docker stack permits SVG uploads for integration testing, while external server upload policies remain authoritative.

v0.43.25 keeps every discovered endpoint for a LAN device, falls back when the preferred UDP or mDNS address is unreachable, and sends files to the exact device that completed the signed probe. It also includes the desktop SVG, HTML preview, and notification-navigation corrections from issues #381, #382, and #383.

v0.43.24 carries the first LAN P2P reachability correction that keeps the UDP-discovered address ahead of conflicting mDNS addresses, while preserving server, device, and signed-handshake validation.

v0.43.23 carries the typed App SDK capability surface, sanitized app metadata, declaration-scoped configuration and secrets handling, and the local mock Bridge needed for App SDK development and preview.

v0.43.19 carries the verified all-entry pinyin search coverage, private-chat external mentions, and explicit first-trust LAN handshake correction; internal LAN keys remain local and are never sent as chat messages.

v0.43.18 carries the first-trust LAN handshake correction validated with two independent accounts and a 559,320,082-byte direct transfer; internal LAN keys remain local and are never sent as chat messages.

v0.43.17 carries the Rust formatting correction required by the release workflow so all platform build jobs can reach packaging.

v0.43.16 makes LAN file transfer explicit from the chat composer, requiring a successful one-to-one handshake before file selection; ordinary messages and server uploads no longer use LAN fallback. It also streams native uploads from disk and hides legacy LAN control messages from chat history.

v0.43.15 fixes two conversation-targeting gaps on the published v0.43.14 line. When a global search hits both a multi-person conversation and a username, entering that conversation now opens the members panel with the matched member located and highlighted (Issue #364). Direct and multi-person DMs can also mention people outside the conversation: directory matches are labelled as not in the conversation, insert only the mention text, and never trigger an invite (inviting into a DM would create a new conversation), while group channels keep the existing invite-before-send behavior.

v0.43.14 completes the Issue #356 runtime-boundary convergence: Native Host, Codex/DSH, LAN discovery and transfer, Rocket.Chat domain clients, and versioned local-data migration keep their existing IPC, REST, realtime, storage-key, and cross-platform release contracts.

v0.43.11 builds on the published v0.43.9 line. It opens the daily-work-loop line from docs/specs/daily-loop.md with the focus-mode MVP: a first-level navigation entry starts a timed or open-ended focus session that forces notification aggregation (the zen-mode penetration whitelist still applies), stops taskbar flashing, switches presence to busy, restores the previous presence on end, and closes with a digest card counting held-back and penetrated messages. It also adds alias import/export scoped to person aliases only (u: keys, filling gaps without overwriting; room aliases stay on the account-sync channel), and collapsible over-long messages with an account-synced toggle and a fold threshold estimated from half the viewport (adjustable to one or two screens in Settings → Messages).

v0.43.6 builds on the verified v0.43.5 transport and cross-platform packaging line. It adds server-aware long-message chunking, restores direct-message mentions without global broadcast behavior, imports archived aliases after a successful preference write, relaxes system DSH checks to the verified semver floor, and adds the corresponding auto-away, notification, preference-cache, reverse-MCP attachment, Rocket.Chat 8.6 preference, and Azure DevOps compatibility fixes. The client keeps the existing offline and optimistic-send paths while confirming uncertain message results before continuing a multi-part send. The release line remains split: default slim desktop artifacts only probe installed Codex/DSH runtimes, and a system DSH is accepted only when RocketX has verified the @deepseek-ai/dsh@0.1.0-rc.6 minimum support line. The Windows full installer continues to ship the exactly locked private DSH runtime, private Node payload, fixed Codex payload, and OCR resources into private application data. Uninstalling either package may remove RocketX-owned private resources but must never remove npm/pnpm global DSH installations. A source checkout of deepseek-harness is never a release prerequisite. Earlier unpublished candidates remain documented in their changelog entries.

v0.43.9 builds on the published v0.43.8 line. It fixes upgrade-time "Unable to uninstall" failures: the NSIS installer and uninstaller now sweep processes that still run from the install directory before replacing files (matched by executable path with up to ten seconds of lock-release waiting), so a slow-to-exit app or the full package's private runtime processes (such as node.exe) can no longer make the old uninstaller leave files behind and abort the outer installer.

v0.43.8 builds on the published v0.43.6 line; the v0.43.7 candidate was withheld after the release gate caught a stale compatibility-matrix version line before any artifact was built. It adds upload pre-checks with zero-copy multipart sends (#355), repairs SMB shared-directory auto-updates that the NSIS image-name process check killed (#354), and restores the rocketx_business room tools after ADO credential sync failures (#309). It delivers the notification sound, alias-aware chat.postMessage chunking, presence-button sync, conversation-menu scroll dismissal, Tauri command cleanup, and the TFS 2015/2017/2018 version mapping refinements that landed after the v0.43.6 tag. LAN file transfer now applies a configurable size threshold (50 MiB by default) with a one-time notice, keeps an offline fallback that ignores the threshold when the Rocket.Chat upload fails or the file exceeds the server limit, and marks direct-LAN file messages on both sides while withholding server-dependent actions from them. Message text UNC share paths render as clickable cards that open through the system after an explicit confirmation on desktop. Windows full-package startup probes DSH/Codex off the main thread in parallel, caches the bundled-runtime archive checksum by file metadata, and no longer blocks first paint on AI runtime probing.

v0.34.5 restored the official Windows x64, macOS universal, and Linux x64 desktop Release. Starting with v0.35.0, the protected workflow continues to publish the verified three-platform Release as GitHub Latest and checks that gh api repos/$GITHUB_REPOSITORY/releases/latest resolves the new tag. Windows updater metadata must continue to select the slim NSIS installer rather than the optional full package.

The macOS bundle uses Tauri's supported ad-hoc signing identity because this repository does not yet have Apple Developer signing and notarization credentials. This prevents an entirely unsigned universal app while keeping the limitation explicit: the DMG is not Apple-notarized and may require manual approval in macOS Privacy & Security.

Future 1.0 external acceptance evidence

The future v1.0.0 tag workflow requires two JSON evidence files. Do not add them until the runs were completed by two different people who had not previously used RocketX.

v1.0.0-g3.json:

{
  "gate": "G3",
  "result": "pass",
  "tester": "external-developer-alias",
  "document": "README.md",
  "startedAt": "2026-07-17T09:00:00Z",
  "completedAt": "2026-07-17T09:20:00Z",
  "artifacts": ["private acceptance log or recording reference"]
}

v1.0.0-g4.json uses gate G4 and document docs/app-development.md. Each run must finish within 30 minutes and reference at least one retained log, recording, or observer note. Do not commit personal names, credentials, server URLs, or other private data.

Repository release controls

The npm-release and release environments accept deployments from main only and require approval from lusipad. Self-review remains enabled because RocketX is currently a single-maintainer project; the approval still keeps publication separate from build completion.

The active Protect immutable v* release tags ruleset prevents updates, force-pushes, and deletion after a v* tag is created. GitHub does not allow the GitHub Actions integration to be a ruleset bypass actor for this personal repository, so ref creation cannot be restricted to that integration without a separate release credential or GitHub App. Repository write access and the validated Tag Version workflow are therefore the creation boundary; moving the repository to an organization or installing a dedicated release App should add the creation rule with only that App as bypass actor.

Release sequence

1. Verify that the protected environments and immutable v* tag ruleset above are still active.
2. Author the dated ## vX.Y.Z - YYYY-MM-DD section in CHANGELOG.md by hand, then run pnpm sync-version X.Y.Z to align every version surface in one step; the tool preserves the changelog date and body, and writes nothing at all when the target section is missing. Run pnpm precheck:release and commit only after it passes. For a major version of 1 or higher, also commit the real README PNG/GIF and two evidence JSON files.
3. Push release/vX.Y.Z at the verified main commit. Tag Version refuses any other commit, mismatched version, or existing tag; 1.0+ additionally refuses missing visuals or external evidence.
4. Desktop Build creates a draft Release and builds the Windows NSIS slim, MSI, and full installers; the macOS universal DMG and updater archive; the Linux AppImage, DEB, and RPM packages; updater metadata and signatures. Slim artifacts only probe installed runtimes and accept system DSH only after RocketX has verified the exact 0.1.0-rc.6 support line; the Windows full installer carries the private DSH/Codex/private-Node payloads and the OCR resources. It does not publish the draft.
5. Prepare Release runs after the multi-platform build job succeeds. It packages the plugin bundle, verifies all uploaded artifacts, generates SHA256SUMS.txt, and writes the release notes from CHANGELOG.md into the draft Release. It does not publish the draft.
6. If the release changes the public SDK or CLI and npm delivery is required, run Publish npm packages with confirmation publish vX.Y.Z. The protected job publishes @lusipad/rocketx first and create-rcx-app second. Bootstrap each new package against the immutable tag with npm's interactive identity flow, then bind this exact workflow as its Trusted Publisher; later releases use GitHub OIDC without a stored npm token. This step is independent from the desktop Release.
7. Review the draft, then run Publish GitHub Release with the same confirmation. It rechecks the three-platform artifacts and checksums, publishes the new Release as Latest, and asserts gh api repos/$GITHUB_REPOSITORY/releases/latest returns the new tag.

pnpm precheck:release verifies the release contract and the three documentation version surfaces first, then runs typecheck, architecture checks, pure tests, and the regression suite. It deliberately skips codex:protocol:check (needs the pinned Codex CLI), test:ui and test:ui:release (need Playwright Chromium), and the Web build with test:ecosystem (extra build and clean-room packaging cost). CI still runs all of them, and platform-conditional compilation can only fail on the three-platform matrix, so the local precheck shortens the feedback loop but never replaces the CI release gate.

Never delete and recreate a released npm version or rewrite an existing release tag.

Plugin bundle

The Prepare Release job packages every directory under plugins/ into rocketx-plugins-<version>.zip and uploads that archive to the draft GitHub Release before checksums are generated. Regular iframe plugins in that archive can be installed with Settings → Apps → Install local app. Plugins that declare native:service, including intranet-link, are signed built-ins: the archive contains their auditable source, while their executable Sidecar is delivered only inside the RocketX desktop package and cannot be granted to a directory or URL install.