arcships · eric8810 · Aug 5, 2026 · Aug 5, 2026
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -4,6 +4,8 @@ This file records user-visible changes to `light-ocr`. Published artifact detail
 
 ## [Unreleased]
 
+## [0.5.7] - 2026-08-05
+
 ### Fixed
 
 - On macOS only, accepted a re-signed native payload as an equivalent
@@ -19,6 +21,9 @@ This file records user-visible changes to `light-ocr`. Published artifact detail
   acceptance is deliberately macOS-only and documented because ad-hoc
   signatures are reproducible by anyone.
 
+Release record: [English](docs/releases/npm-0.5.7.en.md) /
+[中文](docs/releases/npm-0.5.7.md).
+
 ## [0.5.6] - 2026-07-31
 
 ### Changed
@@ -37,7 +42,7 @@ This file records user-visible changes to `light-ocr`. Published artifact detail
   page bytes, and end-to-end Chinese OCR without install-time or runtime
   downloads.
 
-Release preparation: [English](docs/releases/npm-0.5.6.en.md) /
+Release record: [English](docs/releases/npm-0.5.6.en.md) /
 [中文](docs/releases/npm-0.5.6.md).
 
 ## [0.5.5] - 2026-07-27

diff --git a/README.md b/README.md
@@ -231,8 +231,10 @@ selection guidance, and exit code reference:
 - [Build and release](docs/build-and-release.md)
 - [Roadmap](docs/roadmap.md)
 - [Changelog](CHANGELOG.md)
-- [npm 0.5.6 release preparation — English](docs/releases/npm-0.5.6.en.md)
-- [npm 0.5.6 发布准备记录 — 中文](docs/releases/npm-0.5.6.md)
+- [npm 0.5.7 release record — English](docs/releases/npm-0.5.7.en.md)
+- [npm 0.5.7 发布记录 — 中文](docs/releases/npm-0.5.7.md)
+- [npm 0.5.6 release record — English](docs/releases/npm-0.5.6.en.md)
+- [npm 0.5.6 发布记录 — 中文](docs/releases/npm-0.5.6.md)
 - [npm 0.3.0 release report](docs/releases/npm-0.3.0.md)
 
 ## Community and license

diff --git a/README.zh-CN.md b/README.zh-CN.md
@@ -223,8 +223,10 @@ AI Agent 使用。它提供场景驱动的工作流、命令选择建议和退
 - [构建与发布](docs/build-and-release.md)
 - [路线图](docs/roadmap.md)
 - [更新日志](CHANGELOG.md)
-- [npm 0.5.6 release preparation — English](docs/releases/npm-0.5.6.en.md)
-- [npm 0.5.6 发布准备记录 — 中文](docs/releases/npm-0.5.6.md)
+- [npm 0.5.7 release record — English](docs/releases/npm-0.5.7.en.md)
+- [npm 0.5.7 发布记录 — 中文](docs/releases/npm-0.5.7.md)
+- [npm 0.5.6 release record — English](docs/releases/npm-0.5.6.en.md)
+- [npm 0.5.6 发布记录 — 中文](docs/releases/npm-0.5.6.md)
 - [npm 0.3.0 发布报告](docs/releases/npm-0.3.0.md)
 
 ## 社区与协议

diff --git a/docs/implementation-status.md b/docs/implementation-status.md
@@ -1,7 +1,7 @@
 # C++ Core 与 Node-API 实施状态
 
-更新时间：2026-07-31<br>
-结论：npm `0.5.6` 已发布并晋升 `latest`。六个平台包内置校验锁定的官方 Noto Sans SC fallback 字体及 OFL 许可证，patched PDFium 初始化时只使用包内字体目录；用户安装与运行均无二次下载。最终 `main` 的 Core、sanitizer/fuzzer、oracle 和 WebGPU CI 已全绿，[发布 run 30599969242](https://github.com/arcships/light-ocr/actions/runs/30599969242) 完成六平台构建、离线安装、图片 OCR、非嵌入中文字体 PDF 端到端 smoke、registry 发布与回装验证，[晋升 run 30600575756](https://github.com/arcships/light-ocr/actions/runs/30600575756) 只将稳定 Small/runtime/native 闭包提升为默认安装。D116 记录修复契约，完整证据见 [npm 0.5.6 发布记录](releases/npm-0.5.6.md)（[English](releases/npm-0.5.6.en.md)）。
+更新时间：2026-08-05<br>
+结论：npm `0.5.7` 已完成代码合并与发布前验证，尚未写入 registry。该补丁允许下游 macOS 打包器重新签名 `light_ocr_node.node` 与 ONNX Runtime dylib：descriptor 的 bytes/SHA-256 仍是首要门，仅当它因重签名变化时，才接受通过严格 `codesign` 验证且与宿主 TeamIdentifier 相同、或宿主与制品均为 ad-hoc 的 Mach-O。异签名、未签名篡改、非 Mach-O 与非 macOS 平台继续 fail closed。最终 `main` 的 [Core 30986015180](https://github.com/arcships/light-ocr/actions/runs/30986015180) 与 [Native WebGPU 30986015218](https://github.com/arcships/light-ocr/actions/runs/30986015218) 全绿，[六平台演练 30986812237](https://github.com/arcships/light-ocr/actions/runs/30986812237) 已完成构建、离线安装、图片/PDF OCR、签名策略与 manifest 审计。完整版本闭包见 [npm 0.5.7 发布记录](releases/npm-0.5.7.md)（[English](releases/npm-0.5.7.en.md)）。
 
 状态含义：
 
@@ -25,6 +25,26 @@
 - workspace PR 运行 types、Node/server contract 和 Python package tests；只有 native/Core/model contract 路径进入完整构建。release 不重复 qualification、模型转换、Core test 或双重 npm pack。
 - 本机新 Core 对三个真实 bundle 均识别 `HELLO 123`；Tiny/Small/Medium 初始化约 `0.9s / 1.5s / 6.4s`，单次 OCR 约 `58ms / 112ms / 457ms`（Apple M4 Max，仅为 smoke 快照，不作性能承诺）。
 
+## macOS 下游重签名兼容（0.5.7）
+
+状态：发布前验证完成 / registry 发布待执行
+
+- runtime descriptor 的 bytes 与 SHA-256 精确匹配仍是正常加载路径；只有
+  macOS 上已知的签名重写导致描述符不一致时才进入等价签名证明。
+- fallback 先检查 Mach-O magic，再执行 `codesign --verify --strict`，并要求
+  制品与宿主拥有相同 TeamIdentifier；只有双方均为 ad-hoc 时允许无 Team ID。
+- 异 Team、未签名篡改、非 Mach-O、畸形 descriptor 与 Linux/Windows
+  仍保持 `package_load_failed`，native inventory 与 ABI contract 门不变。
+- PR CI 同时使用 GitHub runner 默认 Node 和复制后 ad-hoc 重签的 Node
+  执行真实 `codesign` 集成测试；Developer ID signed host 的手工验证使用
+  TeamIdentifier `3AA79YWT4C`，确认原始制品通过、未签名篡改拒绝、异签
+  ad-hoc 制品拒绝。
+- 该兼容无需环境变量、postinstall、keychain 或额外依赖；ad-hoc 签名可由
+  任何人复现，因此其接受范围明确限制为同样 ad-hoc 的 macOS 宿主。
+- [六平台发布演练 30986812237](https://github.com/arcships/light-ocr/actions/runs/30986812237)
+  的 14 个 jobs 全绿；13 包 manifest 绑定 `main` SHA `1a26d53`，11 个新
+  package identity 再次确认未发布，可进入 `next` 发布。
+
 ## PDF fallback 字体修复（0.5.6 已发布）
 
 状态：已发布至 npm registry / 稳定闭包已晋升 `latest`

diff --git a/docs/releases/npm-0.5.7.en.md b/docs/releases/npm-0.5.7.en.md
@@ -0,0 +1,172 @@
+# npm 0.5.7 Release Record
+
+[中文版](npm-0.5.7.md)
+
+Status: pre-release validation complete. No candidate version has been written
+to the npm registry; the current stable Small/runtime/native closure remains at
+`0.5.6`. The six-platform rehearsal and manifest audit are green, so the
+release may proceed.
+
+Release identity:
+
+- Implementation and release-gate hardening:
+  [PR #59](https://github.com/arcships/light-ocr/pull/59)
+- Merged `main` commit:
+  [`1a26d53`](https://github.com/arcships/light-ocr/commit/1a26d53b97c4260bce2af6badeebd9cb3fe48484)
+- Final `main` validation:
+  [Core 30986015180](https://github.com/arcships/light-ocr/actions/runs/30986015180)
+  and
+  [Native WebGPU 30986015218](https://github.com/arcships/light-ocr/actions/runs/30986015218)
+- Six-platform release rehearsal:
+  [30986812237](https://github.com/arcships/light-ocr/actions/runs/30986812237)
+  (`publish_to_registry=false`)
+- Registry publication and reinstall verification: pending
+- Stable dist-tag promotion: pending
+- GitHub Release: pending
+
+## User-visible changes
+
+- Fix native loading after Electron, notarization, or another downstream macOS
+  packaging pipeline re-signs the payload and thereby changes its size and
+  SHA-256. `light_ocr_node.node` and the ONNX Runtime dylib may now be re-signed
+  with the same Developer ID as the host application.
+- Keep exact descriptor bytes/SHA-256 matching as the primary integrity gate.
+  Only when that gate diverges on macOS does the loader check the Mach-O magic,
+  run `codesign --verify --strict`, and require the artifact TeamIdentifier to
+  equal the host process TeamIdentifier. A both-ad-hoc host/artifact pair is
+  also accepted.
+- Continue to return `package_load_failed` for different TeamIdentifiers,
+  unsigned mutations, non-Mach-O files, malformed descriptors, and every
+  descriptor mismatch on Linux or Windows. Native inventory and the post-load
+  ABI contract remain unchanged.
+- Require no Electron configuration, environment variable, postinstall hook,
+  certificate keychain, or added dependency. `codesign` is used only for
+  verification. Because anyone can reproduce an ad-hoc signature, that branch
+  is explicitly limited to macOS cases where both the host and artifact are
+  ad-hoc signed.
+- Preserve every public API and schema, including image, PDF, multi-page, CLI,
+  and provider behavior.
+
+## Candidate version closure
+
+| Maturity | Package | Candidate version | Target tags |
+| --- | --- | ---: | --- |
+| stable | `@arcships/light-ocr` | `0.5.7` | `next`, then `latest` after verification |
+| stable | `@arcships/light-ocr-runtime` | `0.1.7` | `next`, then `latest` after verification |
+| stable | six native platform packages | `0.5.7` | `next`, then `latest` after verification |
+| compatibility | `@arcships/light-ocr-document` | `0.1.3` | `next` |
+| preview | `@arcships/light-ocr-tiny` | `0.1.6` | `next` |
+| preview | `@arcships/light-ocr-medium` | `0.1.6` | `next` |
+
+No model receives a new version. Small remains at `0.3.4`, while Tiny and
+Medium remain at `0.1.0`. The publication workflow rebuilds or retrieves these
+immutable model tarballs for complete offline installation testing and reuses
+a registry version only after confirming identical integrity.
+
+## Six-platform native candidates
+
+The following values come from the rehearsal's `release-manifest.json`. Each
+delta uses the published `0.5.6` tarball as its baseline. A customer installs
+only the one native package selected for the current platform.
+
+| Platform package | Compressed bytes | Delta from 0.5.6 | Unpacked bytes | SHA-256 |
+| --- | ---: | ---: | ---: | --- |
+| `darwin-arm64` | 22,889,540 | -2 | 56,356,978 | `55f5539456e8da241d8101c7ca5f015b9ab130d77758b5a99552f3b5467c9554` |
+| `darwin-x64` | 24,853,682 | +1 | 62,109,821 | `18975175b52da136d00e740f3a55ba4aab582732a80390b6c21f5b7053f0e51e` |
+| `linux-arm64-gnu` | 20,453,508 | +23 | 40,261,084 | `ffb45dbff2f585010dade1978465b7e5b521c4da01db4dbc955cb20b27d889b7` |
+| `linux-x64-gnu` | 27,033,573 | -18 | 59,390,897 | `a3bb20608d785a054b34c90a579f695a72648dae5db91e321167648b97c2e2c4` |
+| `win32-arm64` | 16,661,617 | -2,136 | 30,977,284 | `7bbb501cfef7909ec319218c57fd5ed732aa619260ddbf5c39649c7005e3dc3c` |
+| `win32-x64` | 30,386,121 | -1,022 | 63,065,652 | `84804a4fa8db6657361d59a2645c6140b00e48de2063a5dab182156ee4fb2d0e` |
+
+## Signing-policy verification
+
+- PR CI runs real `codesign` integration tests under the default Node host on
+  a GitHub macOS runner, covering pristine artifacts, unsigned mutations,
+  non-Mach-O payloads, different signers, and malformed descriptor records.
+- The release workflow copies and ad-hoc signs setup-node's Node executable,
+  then runs the same tests again to deterministically exercise the positive
+  both-ad-hoc host/artifact path.
+- A manual Developer ID signed-host check used TeamIdentifier `3AA79YWT4C`:
+  the pristine artifact passed, an unsigned mutation was rejected, and an
+  artifact re-signed ad-hoc was rejected as a different signer. If no matching
+  Developer ID is present in the runner keychain, the same-team positive test
+  explicitly skips instead of opening keychain UI or manufacturing evidence.
+
+## Release gates
+
+- [x] PR Linux native build and workspace Node tests
+- [x] Post-merge six-platform Core, sanitizers, fuzzer, and oracle
+- [x] Linux and Windows Native WebGPU contracts
+- [x] Real signing-policy tests under the default macOS Node host
+- [x] Positive both-ad-hoc test under an ad-hoc re-signed Node host
+- [x] Developer ID signed-host pristine/tamper/different-signer manual checks
+- [x] Malformed bytes/SHA-256 descriptor rejected before signature fallback
+- [x] npm registry availability for all 11 new package identities
+- [x] Native and PDFium addon rebuilt from pinned sources on all six platforms
+- [x] Complete closure installed offline with installation scripts disabled on
+      all six platforms
+- [x] Real image OCR and non-embedded Chinese-font PDF OCR on all six platforms
+- [x] Candidate manifest, byte counts, SHA-256 values, and npm integrity audited
+- [ ] Immutable candidates published to `next` with
+      `publish_to_registry=true`
+- [ ] Registry reinstall, integrity, and network-disabled runtime verification
+- [ ] Stable Small/runtime/native closure promoted to `latest`
+- [ ] `v0.5.7` GitHub Release created
+
+## Publication and rollback sequence
+
+1. Run the `npm release` rehearsal only from the `main` SHA that passed final
+   validation. Download `light-ocr-npm-0.5.7` and audit package count,
+   versions, bytes, SHA-256 values, and npm integrity in the manifest.
+2. After merging this record, rerun the same six-platform workflow with
+   `publish_to_registry=true`. It publishes new package identities only to
+   `next`, then reinstalls from the registry and executes offline image/PDF
+   smoke tests.
+3. Only after the publication run succeeds, promote Small `0.5.7`, runtime
+   `0.1.7`, and the six native `0.5.7` packages to `latest` from that run's
+   immutable artifact. Document, Tiny, and Medium are not part of stable
+   promotion and remain on `next`.
+4. If a blocking issue appears after promotion, do not overwrite or delete an
+   immutable version. Use the archived `0.5.6` release artifact from run
+   `30599969242` to restore the stable tags to Small/native `0.5.6` and runtime
+   `0.1.6`.
+
+## GitHub Release draft
+
+Release name:
+
+`同印随舟，重签安渡 · Support re-signed macOS artifacts in 0.5.7`
+
+Highlights:
+
+- Allow downstream macOS packaging pipelines to re-sign the native addon and
+  ONNX Runtime dylib with the same Developer ID as the host application.
+- Keep descriptor bytes/SHA-256 as the primary integrity gate and use strict
+  code-signature equivalence only for a mismatched macOS Mach-O.
+- Accept identical TeamIdentifier signatures or the explicitly documented
+  both-ad-hoc development case; reject different identities, unsigned
+  mutations, non-Mach-O payloads, and malformed descriptors.
+- Require no Electron configuration, postinstall hook, keychain access, or new
+  dependency, while preserving every public API and non-macOS behavior.
+
+Versions:
+
+- `@arcships/light-ocr@0.5.7`
+- `@arcships/light-ocr-runtime@0.1.7`
+- six native platform packages at `0.5.7`
+- Document compatibility facade `0.1.3` under `next`
+- Tiny/Medium preview facades `0.1.6` under `next`
+- unchanged Small `0.3.4` and Tiny/Medium `0.1.0` model packages
+
+Verification:
+
+- implementation and PR checks:
+  <https://github.com/arcships/light-ocr/pull/59>
+- final Core:
+  <https://github.com/arcships/light-ocr/actions/runs/30986015180>
+- final Native WebGPU:
+  <https://github.com/arcships/light-ocr/actions/runs/30986015218>
+- pre-release dry-run:
+  <https://github.com/arcships/light-ocr/actions/runs/30986812237>
+- release workflow: pending
+- stable promotion: pending