Alpha.28 release verification

v2.0.0-alpha.28 was published on 10 September 2026 at 11:32:29Z, from tagged commit 5b73fb7782d7d08134d6a82e5a70626a4b281a46. It was prepared on codex/release-alpha28 from f7e845cc6546e5ac745aa1a6fc05e720bb5d9f8e, with user authorization to publish. Local verification, all hosted candidate CI jobs, and the tag-triggered release workflow passed.

Release scope

• Read-only reuse of a locally authenticated Codex installation on macOS, with explicit effective settings, credential ownership, source/account/user binding, safe failure states, and optional owner-coordinated renewal.
• Authentication checks before provider requests and after tool/approval waits, with bounded recovery that preserves account binding and does not repeat earlier tool effects.
• A native macOS demo with local-session reuse, browser OAuth, device-code sign-in, chat, tools, approvals, typed output, personas/skills, images, memory, and File/SQLite/Realm persistence.
• One DemoApp/CodexKitDemo.xcodeproj with CodexKitIOSDemo and CodexKitMacDemo targets and schemes. Existing iOS bundle, Keychain, and settings identifiers are preserved.
• Account-directory persistence initializers, SwiftUI request/progress helpers, macOS workspace recovery after OAuth, and simulator container-lookup reliability.
• macOS demo execution in current-host CI and the release verification workflow, with retained build logs and verification results.

The versioned changelog supplies the GitHub release body. The migration guide covers the external-session and demo-path changes. Swift 6.1, iOS 17, and macOS 14 remain the minimum versions. No database schema migration is required.

Local verification

Checks ran on macOS 26.6.2 with Apple Swift 6.3.3. Demo checks ran after the final project/target rename; subsequent changes are release documentation and workflow wiring.

Check	Result	Local evidence
Full SDK suite, warnings as errors	560 executed, 6 opt-in skips, zero failures	.build/alpha28-package-tests.log
Release library build, warnings as errors	All four library products passed	.build/alpha28-release-build.log
Optimized regression/performance/concurrency checks	29 passed; 40 rounds per adapter; zero failures	.build/alpha28-optimized-tests.log
Signed macOS demo	25 checks passed	.build/macos-demo/build.log, .build/macos-demo/verification-result.json
Signed native credential probe	File, Keychain, and auto discovery/disconnect passed with synthetic credentials	.build/alpha28-native-auth-probe.log
Signed iOS simulator demo	SQLite, Realm, reopening, completion, and cancellation passed	.build/verification/CodexKitVerification.json
Verification script tests	11 passed	.build/alpha28-harness-tests.log
Source-size guard	235 production files, each at most 600 physical lines	.build/alpha28-source-size.log
Core/UI source API comparison with alpha.27	No removed public declarations or changed existing protocol requirements	.build/alpha28-api-review/

The iOS verifier ran on iOS 26.5 / iPhone 17 Pro, completed at 2026-09-10T10:09:09Z, and removed its temporary simulator. Live-account access was disabled for that run. The ordinary package suite skips two opt-in live-provider tests and four performance workloads; the optimized selection separately enables performance and 40 concurrency rounds per adapter.

The optimized selection completed in 111.252 seconds. File, SQLite, and Realm stress workloads each performed 240 operations with six concurrent workers, 40 reader reopens, and 20 runtime reopens. Across adapters, 720 operations passed the independent transcript and attachment checks. Both workflow YAML files parsed successfully; 161 relative documentation/file links and the release workflow's alpha.28 changelog extraction were checked. Historical absolute links to old local audit artifacts were excluded from the relative-link check.

The API digester's sole enum diagnostic adds invalidStorageDirectory to package-scoped CodexKitManagedStorageError. That implementation type is not a public host-app API. Public SQLite/Realm directory initializers are also exercised by ScopedStorageTests; the digester script compares core/UI modules only. These checks do not establish binary ABI compatibility.

Real-session and manual evidence

• The signed macOS demo reused the existing local disk-backed Codex session and completed a typed shipping-draft request. Disconnect left the owner credential file unchanged. The result is .build/alpha28-local-live-features.json.
• After the user completed browser OAuth, the signed demo restored that saved session and received exactly CODEXKIT_OAUTH_SESSION_OK from a live request using temporary conversation storage. Saved Keychain credentials were unchanged. The result is .build/alpha28-oauth-live-reply.json.
• The user confirmed the renamed demo was working. OAuth Keychain access required user interaction with the macOS system prompt.

These checks establish the tested local-session and saved-OAuth paths. They do not establish access to another application's Keychain item under every ACL, sandboxed access, device-code sign-in in this release, or unattended renewal after the real owner token expires. No built-in credential-owner renewal broker is provided.

Local verification artifacts remain under ignored .build/; credentials and private account data are not committed.

Hosted verification and publication

Candidate CI run 34466177455 passed for 5fdce18611a3985701c8cef8186a205f0158af88:

• Current-platform verification, including package tests, Release build, optimized regression/concurrency checks, and the iOS and macOS demo verifiers.
• Minimum-platform verification.
• Swift 6.1 iOS 17 verifier build.
• iOS 17 runtime verification.

The only change between that candidate revision and the release tag was this verification record. main was fast-forwarded and the annotated v2.0.0-alpha.28 tag was pushed. Release workflow 34469083975 passed exact-tag verification, source-size and harness checks, library tests/builds, optimized regression/concurrency checks, and both demo verifiers. Its publication job created the GitHub prerelease from the alpha.28 changelog entry. GitHub confirms the release is published, is a prerelease, and is not a draft.