Prepare Patchwright 0.2.0 community release

.github/ISSUE_TEMPLATE/config.yml

@@ -1,8 +1,8 @@
 blank_issues_enabled: false
 contact_links:
   - name: Security vulnerability
-    url: https://github.com/s1korrrr/patchwright/security/advisories/new
+    url: https://github.com/rsitech-ai/patchwright/security/advisories/new
     about: Report suspected vulnerabilities privately. Do not open a public issue.
   - name: Support policy
-    url: https://github.com/s1korrrr/patchwright/blob/main/SUPPORT.md
+    url: https://github.com/rsitech-ai/patchwright/blob/main/SUPPORT.md
     about: Review supported questions, diagnostics, and privacy guidance before opening an issue.

CHANGELOG.md

@@ -2,6 +2,37 @@
 
 All notable user-facing and distribution changes are documented here. Patchwright follows semantic versioning for public releases.
 
+## [0.2.0] - 2026-07-20
+
+### Added
+
+- Add a reproducible community-prerelease packager that binds an ad-hoc-signed
+  app archive and checksum to the exact clean Git commit and release tag.
+- Publish machine-readable community release metadata that states the app
+  architecture, minimum macOS version, signing class, and notarization status.
+- Embed and publish the Apache project license and RSI Tech project notice with
+  the community app alongside third-party attribution evidence.
+
+### Changed
+
+- Move the canonical public repository and release URLs to the RSI Tech
+  organization at `rsitech-ai/patchwright`.
+- Adopt Apache-2.0 as the sole project license and record Rafal Sikora as the
+  copyright owner, with RSI Tech as public maintainer.
+- Require the live GitHub App qualification smoke to reject both the canonical
+  organization repository and the legacy founder-account redirect.
+- Separate community prerelease downloads from the unchanged Developer ID,
+  notarization, clean-machine, and independent-promotion release contract.
+
+### Hardened
+
+- Require exact approved head and base identities immediately before supported
+  pull-request mutations.
+- Bound Codex protocol messages and request-wide resources, redact
+  credential-shaped durable content, and bind completion to exact active
+  request, thread, and turn identities.
+- Apply one global resource budget to nested GitHub snapshot fan-out.
+
 ## [0.1.1] - 2026-07-18
 
 ### Fixed
@@ -10,17 +41,10 @@ All notable user-facing and distribution changes are documented here. Patchwrigh
 - Remove preparation, delivery, and merge controls from completed task surfaces.
 - Adapt the populated pull-request queue to constrained window widths without negative AppKit geometry faults.
 - Clarify that local task preview and read-only GitHub data remain available without GitHub App mutation access.
-- Revalidate the approved head commit before resolving review threads, marking pull requests ready, or closing pull requests, and revalidate both approved refs before creating a draft pull request.
-- Bound GitHub snapshot fan-out across pull requests instead of applying the full resource limit independently to every nested endpoint.
 
 ### Security
 
 - Reject malformed or partial task-contract integrity evidence consistently in the Rust engine and Swift client.
-- Reject malformed signing team identifiers in release evidence.
-- Bound Codex protocol-line allocation and aggregate request duration, event count, and event bytes.
-- Match Codex responses and completion events to their exact active request, thread, and turn identities.
-- Redact credential-shaped Codex event and approval content before durable SQLite persistence.
-- Require an explicit warning and confirmation before running unsandboxed repository-controlled verification commands.
 
 ### Distribution
 
@@ -30,5 +54,6 @@ All notable user-facing and distribution changes are documented here. Patchwrigh
 
 - Initial public technical-beta release of the local-first Patchwright app, engine, and relay.
 
-[0.1.1]: https://github.com/s1korrrr/patchwright/compare/v0.1.0...v0.1.1
-[0.1.0]: https://github.com/s1korrrr/patchwright/releases/tag/v0.1.0
+[0.2.0]: https://github.com/rsitech-ai/patchwright/compare/v0.1.1...v0.2.0-community.1
+[0.1.1]: https://github.com/rsitech-ai/patchwright/compare/v0.1.0...v0.1.1
+[0.1.0]: https://github.com/rsitech-ai/patchwright/releases/tag/v0.1.0

CODE_OF_CONDUCT.md

@@ -60,7 +60,7 @@ representative at an online or offline event.
 
 Instances of abusive, harassing, or otherwise unacceptable behavior may be
 reported privately through the repository's
-[private reporting form](https://github.com/s1korrrr/patchwright/security/advisories/new).
+[private reporting form](https://github.com/rsitech-ai/patchwright/security/advisories/new).
 Do not include a conduct report in a public issue. Complaints will be reviewed
 and investigated fairly as maintainer capacity allows; no response time is
 promised.

CONTRIBUTING.md

@@ -38,7 +38,7 @@ sign-offs before merge.
 
 Unless you explicitly state otherwise, contributions intentionally submitted
 for inclusion in Patchwright are licensed under the repository's
-`MIT OR Apache-2.0` terms, without additional terms or conditions.
+Apache License 2.0 terms, without additional terms or conditions.
 
 Community participation is governed by the [Code of Conduct](CODE_OF_CONDUCT.md).
 Security vulnerabilities must follow the private process in

Cargo.toml

@@ -9,7 +9,7 @@ resolver = "3"
 [workspace.package]
 edition = "2024"
 rust-version = "1.85"
-license = "MIT OR Apache-2.0"
+license = "Apache-2.0"
 
 [workspace.dependencies]
 anyhow = "1.0"

NOTICE

@@ -0,0 +1,7 @@
+Patchwright
+Copyright 2026 Rafal Sikora
+
+Maintained publicly by RSI Tech (https://rsitech.ai).
+Project contact: info@rsitech.ai.
+
+Licensed under the Apache License, Version 2.0.

Packaging/Info.plist

@@ -19,21 +19,21 @@
     <key>CFBundlePackageType</key>
     <string>APPL</string>
     <key>CFBundleShortVersionString</key>
-    <string>0.1.1</string>
+    <string>0.2.0</string>
     <key>CFBundleVersion</key>
-    <string>2</string>
+    <string>3</string>
     <key>LSApplicationCategoryType</key>
     <string>public.app-category.developer-tools</string>
     <key>LSMinimumSystemVersion</key>
     <string>26.0</string>
     <key>NSHighResolutionCapable</key>
     <true/>
     <key>NSHumanReadableCopyright</key>
-    <string>Copyright © 2026 Patchwright contributors. Licensed under MIT OR Apache-2.0.</string>
+    <string>Copyright © 2026 Rafal Sikora. Licensed under Apache-2.0.</string>
     <key>NSPrincipalClass</key>
     <string>NSApplication</string>
     <key>SUFeedURL</key>
-    <string>https://github.com/s1korrrr/patchwright/releases/latest/download/appcast.xml</string>
+    <string>https://github.com/rsitech-ai/patchwright/releases/latest/download/appcast.xml</string>
     <key>SUPublicEDKey</key>
     <string>oMzk7aUjqsQFvrRBZDd5JsXaeTh8B4pQrJ7n6YHRWUA=</string>
     <key>SURequireSignedFeed</key>

README.md

@@ -2,23 +2,26 @@
 
 Patchwright is a local-first, macOS-native engineering control plane for GitHub. It separates private language-model assistance from a durable coding-agent runtime and makes every approval, command, diff, test, and remote mutation auditable.
 
-**Status:** beta. The current source manifests are version `0.1.1`; the latest
-published artifact remains the version shown on GitHub Releases until a newer
-release completes signing, notarization, clean-machine verification, and
-promotion.
+**Status:** beta. The current source manifests are version `0.2.0`. GitHub may
+also carry a clearly labeled community prerelease for review and evaluation;
+that archive is ad-hoc signed and is not an Apple-notarized distribution.
 
 Build Patchwright from [source](#build-and-verify). Official Developer ID-signed
 and Apple-notarized downloads are published through
-[GitHub Releases](https://github.com/s1korrrr/patchwright/releases). See the
+[GitHub Releases](https://github.com/rsitech-ai/patchwright/releases). See the
 [direct-download guide](docs/direct-download.md) for installation and
 verification.
 
 Project policies: [Contributing](CONTRIBUTING.md) ·
 [Security](SECURITY.md) · [Privacy](PRIVACY.md) · [Support](SUPPORT.md) ·
 [Code of Conduct](CODE_OF_CONDUCT.md) · [Changelog](CHANGELOG.md)
 
-Patchwright is available under your choice of the
-[MIT License](LICENSE-MIT) or [Apache License 2.0](LICENSE-APACHE).
+Patchwright is maintained by [RSI Tech](https://rsitech.ai). Public and
+confidential project correspondence can be sent to
+[info@rsitech.ai](mailto:info@rsitech.ai).
+
+Copyright © 2026 Rafal Sikora. Patchwright is available under the
+[Apache License 2.0](LICENSE); see the accompanying [NOTICE](NOTICE).
 
 This repository contains the Stage 1–3 MVP:
 
@@ -106,6 +109,12 @@ explicit promotion step. See the [direct-download guide](docs/direct-download.md
 [release readiness](docs/release-readiness.md), and
 [clean-machine test plan](docs/clean-machine-test-plan.md).
 
+When Developer ID and notarization credentials are unavailable,
+`script/package_community_release.sh` builds an ad-hoc-signed app from the
+exact clean tagged checkout and packages it with source, SBOM, and notice
+bindings. These community prerelease artifacts do not satisfy the official
+release gates.
+
 ## Safety
 
 Merge is disabled by default and can execute only for a typed pull-request task after an exact action preview, a separate merge-class approval, a fresh exact-head-SHA precondition, and a single-use execution claim. GitHub writes, network access, dependency installation, and workflow changes require action-specific approval. Set `PATCHWRIGHT_AUTOMATION_DISABLED=1` to fail closed for every mutating capability while retaining read-only inspection.
@@ -117,4 +126,4 @@ still execute repository-controlled build scripts, plugins, and tests with the
 current macOS user's file and network access. Review untrusted changes before
 confirming verification.
 
-See [the product design](docs/superpowers/specs/2026-07-13-patchwright-stages-1-3-design.md), [production plan](docs/production-plan.md), and [security operations](docs/security.md).
+See [the architecture](docs/architecture.md), [production operations](docs/production-plan.md), and [security operations](docs/security.md).

SECURITY.md

@@ -7,9 +7,9 @@ developer tooling and review action previews before approving them.
 ## Report a vulnerability privately
 
 Do not open a public issue for a suspected vulnerability. Use GitHub's
-[private vulnerability reporting form](https://github.com/s1korrrr/patchwright/security/advisories/new).
-If that form is unavailable, contact a maintainer privately through the contact
-method on their GitHub profile.
+[private vulnerability reporting form](https://github.com/rsitech-ai/patchwright/security/advisories/new).
+If that form is unavailable, email the RSI Tech maintainers privately at
+[info@rsitech.ai](mailto:info@rsitech.ai).
 
 Include the affected version or commit, impact, reproduction steps, and any
 suggested mitigation. Remove tokens, private source, personal data, and other

SUPPORT.md

@@ -2,10 +2,15 @@
 
 Patchwright is beta software provided without warranty or a service-level
 agreement. Community support is offered on a best-effort basis through
-[GitHub Issues](https://github.com/s1korrrr/patchwright/issues). There is no
+[GitHub Issues](https://github.com/rsitech-ai/patchwright/issues). There is no
 promise of response time, resolution, compatibility, continued maintenance, or
 individual support.
 
+General project correspondence can be sent to the RSI Tech maintainers at
+[info@rsitech.ai](mailto:info@rsitech.ai). Please do not send vulnerability
+details through public issues; use the confidential process in
+[SECURITY.md](SECURITY.md).
+
 Before opening an issue:
 
 1. Search existing issues and test the latest release or default branch.