Prepare Patchwright 0.2.0 community release

[s1korrrr]

Outcome

Prepare Patchwright 0.2.0 for an RSI Tech community prerelease while preserving the stricter Developer ID/notarized distribution lane.

What changed

• move canonical repository and release metadata to rsitech-ai/patchwright
• adopt Apache-2.0 as the sole project license with Rafal Sikora as copyright owner and RSI Tech as maintainer
• publish rsitech.ai and info@rsitech.ai as project contacts
• consolidate maintained architecture and release documentation while removing obsolete internal release dossiers and plans
• bind the community app to an exact clean tagged checkout instead of accepting an external app bundle
• embed the privacy manifest, third-party notices, and complete license tree
• publish archive checksum, manifest, SPDX SBOM, and third-party notices as release assets
• reject source drift, tag drift, post-assembly byte changes, and missing provenance evidence

Validation

• ./script/verify.sh
• bash Tests/PackagingTests/community_release_contract.sh
• bash Tests/PackagingTests/compliance_contract.sh
• git diff --check
• author and committer identity audit across all rewritten branch/tag history
• git fsck --full --no-reflogs --unreachable

No Codex Security scan was run, per the requested scope.

Distribution boundary

The community artifact is ad-hoc signed and explicitly not Apple notarized. It is a prerelease for source-aligned evaluation and does not satisfy the Developer ID, notarization, clean-machine, or independent-promotion gates for an official direct-download release.

[s1korrrr]

Reviewed exact PR head 17c0348e4b158b39b74f9cd04162bf3bd175c973 against rewritten main c77a3bdf5878bbe8e8c6f71f7980fed644046994.

Review outcome: code and packaging changes are ready; merge remains held only for the latest exact-head hosted verify job, which is currently queued without a runner.

Evidence reviewed:

• all three original PR #20 findings are closed: source-bound assembly, embedded privacy/third-party resources, and accurate changelog attribution
• Apache LICENSE and project NOTICE are now embedded in the signed app, published as standalone assets, and digest-bound in assembly/release manifests
• expanded-archive tests compare both legal files byte-for-byte and verify the archive checksum plus deep code signature
• focused community and release contracts pass
• a real build_release_components.sh --community assembly passes with exact legal-file comparisons, assembly-wide SHA-256 verification, and deep signature verification
• the previous exact revision passed full local verification, 65 Swift tests, smoke/runtime launch, and hosted CI; the new seven-file delta has focused and real-assembly proof
• v0.1.0 release evidence and its restored tag both resolve to eaee7f7336e0642afdf89301ec426154129b7fed; the live Sparkle appcast remains available
• rewritten v0.1.1 and all new commit/tag metadata use 24563931+s1korrrr@users.noreply.github.com

The v0.1.0 release is intentionally retained because it is the active signed Sparkle feed provider. Its evidence-bound legacy commit is the one explicit history-rewrite exception.

No Codex Security scan was run for this release review, per scope.

[s1korrrr]

Final release reconciliation:

• exact PR head 17c0348e4b158b39b74f9cd04162bf3bd175c973 passed hosted CI and PR Prepare Patchwright 0.2.0 community release #21 merged
• GitHub squash metadata initially selected the account old primary email; the single merge commit was lease-protected rewritten per the authorized identity rewrite
• authoritative main is 2d087e8a30d41f7158cd732b883d7d05c8e65e7a, with author and committer Rafal Sikora <24563931+s1korrrr@users.noreply.github.com>
• exact-main CI run 29778787581 passed every step
• tag v0.2.0-community.1 resolves to that exact main commit
• the seven-asset community prerelease was downloaded separately and passed checksum, deep signature, version/build, privacy, legal-resource, third-party-license-tree, and manifest-digest verification
• v0.1.0 is retained because it remains the active stable Sparkle feed provider
• no Codex Security scan was run, per scope

Release: https://github.com/rsitech-ai/patchwright/releases/tag/v0.2.0-community.1