Update ShadowfetchStudio GitHub identity while preserving signed releases

Author: ShadowfetchStudio

.github/workflows/release.yml

@@ -29,7 +29,7 @@ jobs:
           import assert from 'node:assert/strict';
           import { appendFileSync } from 'node:fs';
           const env = process.env;
-          assert.equal(env.GITHUB_REPOSITORY, 'Shadowfetchapps/ShadowCode');
+          assert.equal(env.GITHUB_REPOSITORY, 'ShadowfetchStudio/ShadowCode');
           assert.equal(env.REPOSITORY_ID, '1377099349');
           assert.equal(env.OWNER_ID, '209457103');
           assert.equal(env.GITHUB_EVENT_NAME, 'push');

CHANGELOG.md

@@ -2,6 +2,7 @@
 
 ## 2.0.0: Flatpak, brand identity, and remote-access fixes
 
+- Update repository, contributor, release and package links for the ShadowfetchStudio GitHub account rename. Preserve verification of existing signed releases with the same pinned repository and publisher IDs.
 - Introduce the Shadowfetch and ShadowCode trademark policy, update the project introduction, and show publisher, website, repository, and contributor information in About.
 - Preserve host terminal job control, resizing, Ctrl-C, and cleanup through a host PTY relay.
 - Build the native desktop and CPU/Vulkan llama.cpp runtime inside GNOME SDK 50 and export a single-file Flatpak. Host Git, terminals, and installed coding CLIs are reached through an explicit host bridge.
@@ -210,7 +211,7 @@ Packaging:
 
 ## 0.34.1: Failed release attempt (unpublished)
 
-[Release run 36507326107](https://github.com/Shadowfetchapps/ShadowCode/actions/runs/36507326107)
+[Release run 36507326107](https://github.com/ShadowfetchStudio/ShadowCode/actions/runs/36507326107)
 at `206fd03` passed `native-source` but stopped in the required
 `native-window` gate. On a clean CI host no model is ready, so the welcome
 offers a free model, an OpenRouter key or a subscription instead of
@@ -220,7 +221,7 @@ unchanged, and 0.34.2 ships the same changes.
 
 ## 0.34.0: Failed release attempt (unpublished)
 
-[Release run 36499751141](https://github.com/Shadowfetchapps/ShadowCode/actions/runs/36499751141)
+[Release run 36499751141](https://github.com/ShadowfetchStudio/ShadowCode/actions/runs/36499751141)
 at `3409d59` stopped in the required `native-source` gate: every Rust test
 passed, but two new opt-in network tests (the Hugging Face catalog check and
 a multi-GB download) were not on the gate's list of allowed optional tests,
@@ -237,13 +238,13 @@ and the gate refuses any unlisted skip. Nothing was signed or published. The
 - Safer Compare snapshots and recovery, unsaved-draft guards, and coordination of short workspace writes across cooperating ShadowCode processes.
 - Shared native event listeners prevent per-task listener growth. A real source-built X11 endurance run passed 100 tasks after bounded warm-up; this is not GPU or physical Wayland endurance evidence.
 - AppImage launch preserves an explicitly selected display backend; package normalization accepts only the exact expected linuxdeploy version field.
-- Authenticated installer recovery and staged release verification are strengthened. [Version 0.33.1](https://github.com/Shadowfetchapps/ShadowCode/releases/tag/v0.33.1) was published on September 28, 2026 from `e15c448`, after all 15 required build gates and protected signing passed. The workflow publication job failed on a transient draft-listing response; publication resumed locally with the same frozen publisher and signed artifact, with all seven remote assets compared before publication. See the release notes for the exact evidence and remaining limits.
+- Authenticated installer recovery and staged release verification are strengthened. [Version 0.33.1](https://github.com/ShadowfetchStudio/ShadowCode/releases/tag/v0.33.1) was published on September 28, 2026 from `e15c448`, after all 15 required build gates and protected signing passed. The workflow publication job failed on a transient draft-listing response; publication resumed locally with the same frozen publisher and signed artifact, with all seven remote assets compared before publication. See the release notes for the exact evidence and remaining limits.
 
 See [release notes](docs/RELEASE_NOTES.md) for scope and remaining qualification.
 
 ## 0.33.0: Failed release attempt (unpublished)
 
-[Release run 36414378697](https://github.com/Shadowfetchapps/ShadowCode/actions/runs/36414378697) at `9e385cb` failed the managed-runtime source-integrity gate after the runtime built and its six tests passed. The builder rewrote tracked runtime pin/COMMIT timestamps. Signing and publication were skipped. The existing `v0.33.0` tag remains unchanged; the separately qualified successor is 0.33.1. Earlier local 0.33.0 package and latency results remain evidence for those exact bytes only.
+[Release run 36414378697](https://github.com/ShadowfetchStudio/ShadowCode/actions/runs/36414378697) at `9e385cb` failed the managed-runtime source-integrity gate after the runtime built and its six tests passed. The builder rewrote tracked runtime pin/COMMIT timestamps. Signing and publication were skipped. The existing `v0.33.0` tag remains unchanged; the separately qualified successor is 0.33.1. Earlier local 0.33.0 package and latency results remain evidence for those exact bytes only.
 
 ## 0.32.0: The big upgrade
 
@@ -996,4 +997,4 @@ integrations, broader stress checks, packaging, and installation are tracked in
 
 Introduced the minimal drawer-based desktop, Goal Mode, per-task rewind, session
 management, model picker, notifications, and source-checkout updater. Release
-history is available on [GitHub](https://github.com/Shadowfetchapps/ShadowCode/releases).
+history is available on [GitHub](https://github.com/ShadowfetchStudio/ShadowCode/releases).

Cargo.toml

@@ -9,7 +9,7 @@ version = "2.0.0"
 edition = "2021"
 rust-version = "1.95"
 license = "Apache-2.0"
-repository = "https://github.com/Shadowfetchapps/ShadowCode"
+repository = "https://github.com/ShadowfetchStudio/ShadowCode"
 
 [patch.crates-io]
 # GTK3/WebKit still require 0.18. Preserve that API with the upstream UB fix.

NOTICE

@@ -2,7 +2,7 @@ ShadowCode
 Copyright 2026 Shadowfetch
 
 ShadowCode was originally created by Shadowfetch.
-https://github.com/Shadowfetchapps/ShadowCode
+https://github.com/ShadowfetchStudio/ShadowCode
 
 Licensed under the Apache License, Version 2.0 (see LICENSE). Any copy or
 derivative work you distribute must include this NOTICE file (section 4(d)).

README.md

@@ -16,7 +16,7 @@ Developed and maintained by **Shadowfetch**.
 
 Licensed under Apache 2.0.
 
-Official project: https://github.com/Shadowfetchapps/ShadowCode
+Official project: https://github.com/ShadowfetchStudio/ShadowCode
 
 Publisher: https://shadowfetch.com
 
@@ -72,14 +72,14 @@ The code is open source; the Shadowfetch and ShadowCode product identity is cove
 
 The source tree is now **2.0.0**, with a locally buildable Flatpak and fixes for private-profile access and secret-file diff redaction. See [Flatpak installation and build instructions](docs/FLATPAK.md). The 2.0.0 source is available here; its Flatpak bundle is a local build and has not been published as a GitHub release or on Flathub.
 
-The last published release, ShadowCode **1.0.1**, is available in [GitHub releases](https://github.com/Shadowfetchapps/ShadowCode/releases/tag/v1.0.1).
+The last published release, ShadowCode **1.0.1**, is available in [GitHub releases](https://github.com/ShadowfetchStudio/ShadowCode/releases/tag/v1.0.1).
 See the [1.0.1 release notes](docs/RELEASE_NOTES.md) for changes and qualification
 limits, and the [release history](CHANGELOG.md).
 
 ## Install
 
 Releases target x86_64 Linux with glibc 2.39 or newer (Ubuntu 24.04 or later).
-Check [GitHub releases](https://github.com/Shadowfetchapps/ShadowCode/releases)
+Check [GitHub releases](https://github.com/ShadowfetchStudio/ShadowCode/releases)
 for published versions. The 1.0.1 packages and checksums are:
 
 - `ShadowCode_1.0.1_amd64.AppImage`

SECURITY.md

@@ -3,7 +3,7 @@
 ## Supported versions and reporting
 
 The latest release and `main` are supported. Report vulnerabilities through a
-[private security advisory](https://github.com/Shadowfetchapps/ShadowCode/security/advisories/new).
+[private security advisory](https://github.com/ShadowfetchStudio/ShadowCode/security/advisories/new).
 Include the affected versions, the impact and steps to reproduce, and leave out
 live credentials. There is no bug bounty program.
 

TRADEMARKS.md

@@ -35,7 +35,7 @@ must not imply official sponsorship or endorsement where none exists.
 
 ## Official identity and other uses
 
-Official project: https://github.com/Shadowfetchapps/ShadowCode
+Official project: https://github.com/ShadowfetchStudio/ShadowCode
 
 Official website: https://www.shadowfetchlinux.org/shadowcode
 

docs/API_CONTRACT.md

@@ -2977,7 +2977,7 @@ Remote policy (`remote::policy::check`), besides each route's Remote column:
 Settings › About and the update notice (`native/core/src/updates.rs`,
 [DISTRIBUTING.md](DISTRIBUTING.md#updates)). Only `?auto=1` and
 `POST /api/updates/check` reach the network, and only `GET
-https://api.github.com/repos/Shadowfetchapps/ShadowCode/releases/latest`
+https://api.github.com/repos/ShadowfetchStudio/ShadowCode/releases/latest`
 with `User-Agent: ShadowCode-update-check` and no identifiers.
 
 - `GET /api/about` → `{name, publisher, version, commit: string|null, install: {kind:

docs/DISTRIBUTING.md

@@ -8,7 +8,7 @@ and the license terms.
 
 ## Which package
 
-Each release on [GitHub](https://github.com/Shadowfetchapps/ShadowCode/releases)
+Each release on [GitHub](https://github.com/ShadowfetchStudio/ShadowCode/releases)
 has two packages for x86_64 Linux with glibc 2.39 or newer (Debian 13,
 Ubuntu 24.04 and later):
 
@@ -29,7 +29,7 @@ verifier and public key from a reviewed copy of the ShadowCode repository at
 the release tag, never with files that came with the download:
 
 ```sh
-git clone --depth 1 --branch vVERSION https://github.com/Shadowfetchapps/ShadowCode trusted
+git clone --depth 1 --branch vVERSION https://github.com/ShadowfetchStudio/ShadowCode trusted
 bash trusted/scripts/verify-native-release.sh \
   --bundle-dir /path/to/downloads \
   --trust-dir trusted/release/trust \
@@ -141,7 +141,7 @@ The package strips the runtime's binaries and gives its shared libraries mode
 ShadowCode checks for a newer release at most once a day while its window is
 open, and when the user presses **Check now** in **Settings › About**. It
 sends one HTTPS `GET` to
-`https://api.github.com/repos/Shadowfetchapps/ShadowCode/releases/latest` with
+`https://api.github.com/repos/ShadowfetchStudio/ShadowCode/releases/latest` with
 the fixed `User-Agent: ShadowCode-update-check`. The request has no query
 string and carries no version, account, token, cookie or other identifier.
 ShadowCode sends no telemetry.

docs/FLAGSHIP_ACCEPTANCE_SPEC.md

@@ -271,15 +271,15 @@ Complete each phase's implementation and tests before declaring it done. Do not
 These are review references, not instructions to trust an old snapshot over the current checkout.
 
 ```text
-https://github.com/Shadowfetchapps/ShadowCode/blob/e371baaa4c690527173a322f7e0e1cfae4db329a/native/core/src/compare.rs
+https://github.com/ShadowfetchStudio/ShadowCode/blob/e371baaa4c690527173a322f7e0e1cfae4db329a/native/core/src/compare.rs
   resolve_models / remove_lanes / stop_lanes: retrieved source lines 640–815
   get / list / commit_checkout / apply_checkout: retrieved source lines 900–1130
   keep / discard / cancel / concurrency tests: retrieved source lines 1131–1390
 
-https://github.com/Shadowfetchapps/ShadowCode/blob/e371baaa4c690527173a322f7e0e1cfae4db329a/.github/workflows/release.yml
+https://github.com/ShadowfetchStudio/ShadowCode/blob/e371baaa4c690527173a322f7e0e1cfae4db329a/.github/workflows/release.yml
   checked native build and final publication sequence
 
-https://github.com/Shadowfetchapps/ShadowCode/actions/runs/36210288819
+https://github.com/ShadowfetchStudio/ShadowCode/actions/runs/36210288819
   most recent retrieved summary: UI/Rust passes; headless CLI fails; later checks skipped
 
 https://developers.openai.com/codex/app-server