Prepare 0.33.1 with immutable runtime build inputs

Author: ShadowfetchStudio

.github/workflows/ci.yml

@@ -43,7 +43,7 @@ jobs:
       - name: Verify publisher authentication and private release snapshots
         run: node --test scripts/test-native-release-auth.mjs
       - name: Managed llama.cpp packaging (pins, notices, relative links, deb repack)
-        run: node --test scripts/test-llama-runtime.mjs
+        run: node --test scripts/test-llama-runtime.mjs scripts/test-llama-build-inputs.mjs
       - name: Packaging PATH ignores host node hijacks
         run: node --test scripts/test-native-packaging-env.mjs
       - name: Pinned-source failures and mirror recovery

.github/workflows/native.yml

@@ -23,7 +23,7 @@ jobs:
       - name: Native window dependencies
         run: sudo apt-get update && sudo apt-get install -y libwebkit2gtk-4.1-dev libgtk-3-dev librsvg2-dev libayatana-appindicator3-dev libasound2-dev patchelf webkit2gtk-driver xvfb appstream dbus-daemon dbus-bin
       - name: Test release staging and immutable retry behavior
-        run: node --test scripts/test-native-release.mjs scripts/test-native-release-verification.mjs scripts/test-publisher-auth.mjs scripts/test-native-release-signing.mjs scripts/test-native-test-session.mjs scripts/test-clean-host-mcp-receipt.mjs scripts/test-clean-host-container.mjs scripts/test-native-app-run.mjs && node scripts/test-native-process-ownership.mjs
+        run: node --test scripts/test-native-release.mjs scripts/test-native-release-verification.mjs scripts/test-publisher-auth.mjs scripts/test-native-release-signing.mjs scripts/test-native-test-session.mjs scripts/test-clean-host-mcp-receipt.mjs scripts/test-clean-host-container.mjs scripts/test-native-app-run.mjs scripts/test-llama-build-inputs.mjs && node scripts/test-native-process-ownership.mjs
       - name: Verify publisher authentication and private release snapshots
         run: node --test scripts/test-native-release-auth.mjs scripts/test-check-secrets.mjs
       - name: Package version

CHANGELOG.md

@@ -1,18 +1,23 @@
 # Changelog
 
-## 0.33.0: Reliability and daily workflow (release preparation)
+## 0.33.1: Reliability and daily workflow (release preparation)
 
+- Runtime builds and notices refreshes preserve tracked source pins and reference metadata; actual build provenance stays in generated runtime output. Regression coverage reproduces the source-integrity failure that stopped the unpublished 0.33.0 attempt.
 - Code highlighting, line numbers, undo/redo and recoverable editor drafts, with revision-checked saves and newline preservation.
 - Bounded attached-context inventory with exclusions, truncation notices and approximate token counts.
 - **Run a check…** from completed tasks: explicit commands, existing approvals, fresh output and verification receipts, no model selection or extra model turn, and preserved composer drafts.
 - Independent provider sign-in recovery after navigation; cancellation remains **Stopping…** until acknowledged. Cached account state survives uncertain progress reads, and refresh waits for ongoing sign-ins.
 - Safer Compare snapshots and recovery, unsaved-draft guards, and coordination of short workspace writes across cooperating ShadowCode processes.
 - Shared native event listeners prevent per-task listener growth. A real source-built X11 endurance run passed 100 tasks after bounded warm-up; this is not GPU or physical Wayland endurance evidence.
 - AppImage launch preserves an explicitly selected display backend; package normalization accepts only the exact expected linuxdeploy version field.
-- Authenticated installer recovery and staged release verification are strengthened. Signed publication, remote CI and final 0.33.0 artifact qualification are separate release steps, not implied by this changelog.
+- Authenticated installer recovery and staged release verification are strengthened. Signed publication, remote CI and final 0.33.1 artifact qualification are separate release steps, not implied by this changelog.
 
 See [release notes](docs/RELEASE_NOTES.md) for scope and remaining qualification.
 
+## 0.33.0: Failed release attempt (unpublished)
+
+[Release run 36414378697](https://github.com/Shadowfetchapps/ShadowCode/actions/runs/36414378697) at `9e385cb` failed the managed-runtime source-integrity gate after the runtime built and its six tests passed. The builder rewrote tracked runtime pin/COMMIT timestamps. Signing and publication were skipped. The existing `v0.33.0` tag remains unchanged; the next candidate is 0.33.1. Earlier local 0.33.0 package and latency results remain evidence for those exact bytes only.
+
 ## 0.32.0: The big upgrade
 
 Everyday use:

Cargo.lock

@@ -5,7 +5,7 @@ exclude = ["vendor/glib-0.18.5"]
 resolver = "2"
 
 [workspace.package]
-version = "0.33.0"
+version = "0.33.1"
 edition = "2021"
 rust-version = "1.95"
 license = "Apache-2.0"

Cargo.toml

@@ -42,28 +42,28 @@ need Ollama, LM Studio or any other model server.
   own terminal, go from commit to pull request, preview the app you're
   building, dictate with your voice, and follow along from your phone.
 
-This branch prepares **0.33.0**. See the [0.33.0 release notes](docs/RELEASE_NOTES.md)
+This branch prepares **0.33.1**. See the [0.33.1 release notes](docs/RELEASE_NOTES.md)
 and [release history](CHANGELOG.md). Publication, signing and final candidate
 qualification must be verified separately; these notes do not announce a release.
 
 ## Install
 
 Releases target x86_64 Linux with glibc 2.39 or newer (Ubuntu 24.04 or later).
 Check [GitHub releases](https://github.com/Shadowfetchapps/ShadowCode/releases)
-for published versions. The expected 0.33.0 package names are:
+for published versions. The expected 0.33.1 package names are:
 
-- `ShadowCode_0.33.0_amd64.AppImage`
-- `ShadowCode_0.33.0_amd64.deb`
+- `ShadowCode_0.33.1_amd64.AppImage`
+- `ShadowCode_0.33.1_amd64.deb`
 - `SHA256SUMS`
 
 ### AppImage (recommended)
 
 The development branch now requires signed release packages. Published 0.32.0
 assets are checksum-only and cannot be installed by this new entry point; use
 the instructions shipped with that released version for those existing assets.
-Public trust for 0.33.0 and the signing environment are configured. The exact reviewed
-tooling commit is recorded in GitHub configuration; the first signed release
-remains pending.
+The 0.33.0 release attempt failed before signing and publication. Its tag stays
+unchanged. Trust policy, deployment rules and the reviewed tooling pin require
+updates for 0.33.1; the first signed release remains pending.
 For development today, use [Build from source](#build-from-source).
 
 Once a signed release and independently authenticated installer bundle are
@@ -77,7 +77,7 @@ bundle and bootstrap requirements.
 From that independently authenticated installer bundle, run:
 
 ```bash
-bash /path/to/trusted-bundle/scripts/install-appimage.sh /path/to/downloads/ShadowCode_0.33.0_amd64.AppImage
+bash /path/to/trusted-bundle/scripts/install-appimage.sh /path/to/downloads/ShadowCode_0.33.1_amd64.AppImage
 ```
 
 The installer takes the AppImage path (or `--recover`), resolves its own trusted
@@ -111,22 +111,22 @@ as `--trust-dir` are not installer options.
   not yet qualified.
 
 After obtaining and verifying the intended package, run the AppImage without installing it:
-`./ShadowCode_0.33.0_amd64.AppImage --appimage-extract-and-run`. FUSE is not
+`./ShadowCode_0.33.1_amd64.AppImage --appimage-extract-and-run`. FUSE is not
 required.
 
 ### Debian package
 
 Verify the Debian artifact using the independently trusted verifier bundle.
-`verified-deb-0.33.0` must not already exist; install the verified snapshot:
+`verified-deb-0.33.1` must not already exist; install the verified snapshot:
 
 ```bash
 bash /path/to/trusted-bundle/scripts/verify-native-release.sh \
   --bundle-dir /path/to/downloads \
   --trust-dir /path/to/trusted-bundle/release/trust \
-  --artifact ShadowCode_0.33.0_amd64.deb \
-  --stage-dir ./verified-deb-0.33.0 \
-  --expect-version 0.33.0
-sudo apt install ./verified-deb-0.33.0/ShadowCode_0.33.0_amd64.deb
+  --artifact ShadowCode_0.33.1_amd64.deb \
+  --stage-dir ./verified-deb-0.33.1 \
+  --expect-version 0.33.1
+sudo apt install ./verified-deb-0.33.1/ShadowCode_0.33.1_amd64.deb
 ```
 
 This manual Debian verification does not provide the AppImage installer's durable

README.md

@@ -7,7 +7,7 @@ working tree, and every lane worktree and its branch is removed.
 
 ## Starting state
 
-In 0.33.0, Compare refuses to start while app-owned editor drafts differ from
+In 0.33.1, Compare refuses to start while app-owned editor drafts differ from
 their saved base. Save or discard the listed drafts first. The native snapshot
 also checks persisted recovery drafts and coordinates with short workspace
 writes from cooperating ShadowCode processes. Other editors' unsaved buffers

docs/COMPARE.md

@@ -822,3 +822,20 @@ Native run `36399332104` at documentation head `f14287b` failed 1 of 138 release
 Discovery now rechecks basic identity after EACCES/EPERM and disregards only a missing process or the same PID/start/UID in terminal Z/X state. Live unreadable candidates, changed identities, failed rechecks and other IO errors remain fatal before any signal. The new read uses the existing fixed-deadline client; no retry loop, deadline extension or ownership relaxation was added. Seventeen deterministic cases produced six expected failures before the fix and all 17 passed afterward. The complete required release/session fixture set then passed all 155 tests with no skips, including the real D-Bus activation and external wrapper boundary; both separate executable-ownership tests passed. Independent diff review found no actionable issue. Evidence is in `artifacts/release-0.33.0/proc-race/`.
 
 The already-built 0.33.0 AppImage additionally passes native TUI, MCP stdio/HTTP and all four official TypeScript v1/v2 transport combinations. This helper/test correction does not change those package bytes; their original build identity remains `7a38fcc`. A new current-head CI receipt is required. The earlier proposed release tag at `f14287b` must be superseded by the corrected source before release; no tag has been created.
+
+
+## Controlled long-stream keyboard latency on the local 0.33.0 package
+
+On 2026-09-28, the exact ShadowCode 0.33.0 AppImage SHA-256 cab6f61c5c4667c67dd8c9cd04969d6f349d42bce1ca198878e6f9be08429c62 passed a controlled native WebKit/Xvfb long-stream keyboard probe on an AMD Ryzen 7 5700G host with approximately 64 GiB RAM. A retained 88,810-byte Markdown/code answer preceded a 90.25-second, 1,200-chunk, 120,330-byte SSE answer from an isolated authenticated llama-server test double. During 70 seconds of the active stream, all 329 trusted WebDriver keyboard events produced input and preserved the draft. Event-timestamp-to-second-animation-frame p95 was 42 ms (max 52 ms), compared with 24 ms baseline across 40 keys; the prior independent run measured 44 ms p95 across 328 keys. WebKit Event Timing separately reported 88 keydowns meeting its 16 ms observation threshold: reported-event p95 was 24 ms, maximum 32 ms. The full-population figure uses two animation frames as a next-paint-opportunity proxy; the Event Timing distribution covers only browser-reported events, so these are not identical metrics. This supports the 100 ms target for this controlled workload; it does not prove physical keyboard-to-display latency, final 20 seconds of the stream, GPU/Wayland behavior, other hardware, or full UI acceptance. App, owned children, private D-Bus activations, and external X11 cleanup all passed. Both complete raw receipts and the failed undersized-context attempt remain under `artifacts/release-0.33.0/stream-latency/`. The probe changed no tracked source, tests or tags. This ledger entry subsequently records its result; it does not qualify a 0.33.1 package.
+
+## Failed v0.33.0 release and next 0.33.1 candidate
+
+[Release run 36414378697](https://github.com/Shadowfetchapps/ShadowCode/actions/runs/36414378697) at `9e385cb` / `v0.33.0` failed the managed-runtime source-integrity check. The runtime built and six runtime tests passed, but the builder rewrote tracked timestamps in `tools/llama.cpp.pin` and `packaging/llama.cpp/COMMIT`. Signing and publication were skipped. This is a failed, unpublished release attempt; the existing tag remains unchanged.
+
+Version 0.33.1 is the next candidate. Authoritative manifests, lockfiles and current documentation are being updated independently of historical 0.33.0 package/evidence identities. The source-integrity fix and regression are tracked separately. The existing public trust range and protected deployment rule authorize only 0.33.0; reviewed changes plus a new exact tooling pin are required before signing 0.33.1. No new candidate build, signature, publication or local installation is claimed here.
+
+## 0.33.1 runtime build correction
+
+The ordinary and notices-only builder paths now leave tracked source pins and reference metadata unchanged. Actual compile time/backend remain in ignored generated `bin/COMMIT`; notices-only retains the existing compile time. Three isolated real-shell regressions reproduce the previous behavior (two failures before the fix) and pass after it. The tests run early in packaging CI, native CI and the release receipt gate. The source-integrity guard is unchanged. Public trust is prepared for the same key through 0.33.1, with repository identity, epoch and installation floor preserved; remote deployment-rule/tooling updates and the new tag still require review.
+
+Focused local validation passed 164 release/runtime/session tests, 107 authentication/installer/metadata/scanner tests and two executable-ownership tests, with no skips. A fresh real Vulkan/CPU runtime build is separate pending evidence; these fixture passes do not claim a completed 0.33.1 package, signed publication or installation.

docs/FLAGSHIP_IMPLEMENTATION.md

@@ -1,6 +1,6 @@
 # ShadowCode 0.28 implementation report
 
-Historical report with later addenda. For current 0.33.0 preparation, see
+Historical report with later addenda. For current 0.33.1 preparation, see
 [release notes](RELEASE_NOTES.md) and the [evidence ledger](FLAGSHIP_IMPLEMENTATION.md).
 Versioned counts and provider observations below describe their original snapshots.
 

docs/IMPLEMENTATION_REPORT.md

@@ -4,6 +4,16 @@ The helpers in `scripts/native-release-auth.mjs` and `scripts/verify-native-rele
 
 The Bash verifier loads `scripts/native-release-auth-lib.sh` from its own script directory. Keep both reviewed code files together in the trusted tooling bundle; do not obtain the library from the candidate download or source metadata as shell code. The installer uses the same reviewed routines for current candidates and signed historical receipts; it never sources release metadata as code.
 
+## Next candidate: 0.33.1
+
+The `v0.33.0` release attempt at `9e385cb` failed its source-integrity gate
+before signing/publication ([run 36414378697](https://github.com/Shadowfetchapps/ShadowCode/actions/runs/36414378697)).
+Its tag remains unchanged. Current policy/rules below describe the existing
+0.33.0 setup: reviewed trust-range and deployment-rule updates plus a new exact
+tooling pin are required before 0.33.1 can be signed. The 0.33.1 verification
+example below is conditional on those updates and a successfully signed bundle.
+No new signature, publication or installation is established by this document.
+
 ## Trust and security contract
 
 The authorized canonical publisher is `Shadowfetchapps/ShadowCode`, repository ID `1377099349`, owner ID `209457103`. A read-only GitHub API query resolved the historical `ShadowfetchLinux/ShadowCode` origin to that identity. Only stable `MAJOR.MINOR.PATCH`, `x86_64-unknown-linux-gnu` releases are supported by this slice.
@@ -90,9 +100,9 @@ The end-user path is Bash plus OpenSSL 3 and ordinary GNU coreutils/diffutils; i
 bash verify-native-release.sh \
   --bundle-dir DOWNLOADED_FILES \
   --trust-dir INDEPENDENTLY_TRUSTED_KEYS \
-  --artifact ShadowCode_0.33.0_amd64.AppImage \
+  --artifact ShadowCode_0.33.1_amd64.AppImage \
   --stage-dir NEW_PRIVATE_STAGE \
-  --expect-version 0.33.0 \
+  --expect-version 0.33.1 \
   --expect-commit EXPECTED_COMMIT
 ```