release: publish and anonymously verify v1.1.2 installer assets

[bradtaylorsf]

Summary

Publish v1.1.2 with complete immutable installer assets and verify every public download without GitHub authentication.

Proposed Approach

• Generate assets from the v1.1.2 tag using the release workflow.
• Verify the manifest pins the public runtime image digest.
• Publish only after checksums and inventory match.
• Download anonymously and verify hashes before execution.
• Exercise documented macOS and Windows bootstrap entry points.

Acceptance Criteria

• v1.1.2 is a non-draft production release.
• Required macOS, Windows/WSL2, manifest, and checksum assets are attached.
• Checksums match locally regenerated values from tagged source.
• Manifest pins an anonymously pullable runtime digest.
• Every asset downloads and verifies without credentials.
• Notes cover supported hardware, privacy, limitations, rollback, and security reporting.

Related

• Parent epic: epic: deliver zero-to-first-memory desktop onboarding and isolated local channels #40
• Depends on public repository/runtime publication.
• Do not publish npm.

[bradtaylorsf]

Release blocker discovered: Trivy v0.74.0 found 6 fixable critical and 56 fixable high findings in the exact v1.1.0 runtime digest. Do not publish, install, or certify v1.1.0. Issue #89 tracks the required immutable patch release; this issue must be retargeted only after the owner selects that new version.

[bradtaylorsf]

Release baseline decision approved by the owner on 2026-08-21:

• v1.1.1 remains an immutable, unpublished draft with zero assets and is superseded.
• v1.1.2 will be cut only from the reviewed source containing fix: support OpenAI-compatible local model servers without LM Studio management APIs #93/fix: support generic OpenAI-compatible local model servers (Ollama) in the guided install #92.
• No existing tag or asset will be moved or replaced, and no npm package will be published.

Implementation and verification plan:

User outcome: publish the first usable anonymous one-prompt installer, including generic OpenAI-compatible local model support, with checksummed macOS and Windows/WSL2 assets.

Technical plan:

1. Bump active release/package/docs/bootstrap references to 1.1.2 on chore/GH-81-v1-1-2-release from the exact merged master commit.
2. Rebuild bundled plugin archives and all pinned bootstrap/manifest checksums deterministically.
3. Run targeted release tests, full pnpm verify, production dependency audit, and container build.
4. Merge through protected CI, create immutable v1.1.2, scan and publish both runtime platforms, anonymously verify the digest, then dispatch candidate and production installer workflows.
5. Publish the existing exact-tag release only after all anonymous asset checks pass; keep clean-hardware test: validate v1.1.2 on clean Apple Silicon macOS #82/test: validate v1.1.2 on clean Windows 11 with WSL2 #83 open until independently proven.

[bradtaylorsf]

v1.1.2 source publication progress:

• Ollama/OpenAI-compatible fix merged in fix: support generic OpenAI-compatible local model servers (Ollama) in the guided install #92; bug fix: support OpenAI-compatible local model servers without LM Studio management APIs #93 closed.
• Release preparation merged in chore: prepare immutable v1.1.2 release #94 after verify and container passed.
• Immutable tag v1.1.2 points to 4f4e0575622715664fa8503ba8fc9df340573eba.
• Draft release created with zero assets pending protected verification.
• Runtime scan/publication workflow: https://github.com/the-answerai/answer-engine/actions/runs/32520170568
• v1.1.1 remains an unchanged unpublished draft and is explicitly marked superseded.

This issue stays open until the exact runtime digest and every installer asset are anonymously verified and the v1.1.2 release is non-draft.

[bradtaylorsf]

v1.1.2 release status — runtime published, installer correctly blocked by private GHCR

Runtime workflow #32520170568 succeeded from exact source commit 4f4e0575622715664fa8503ba8fc9df340573eba.

Immutable runtime reference:

ghcr.io/the-answerai/answer-engine@sha256:56ebd5921ed3db87e1f6ffa49593c0b8577d21197b5798c1fb72b275ddae0fd9

Tags on that index: v1.1.2, 1.1.2, and sha-4f4e0575622715664fa8503ba8fc9df340573eba.

The non-publishing installer candidate workflow #32521393503 ran the full source verification successfully, then intentionally failed its anonymous runtime-platform gate with GHCR 401 Unauthorized. The package is still private. No installer assets were built or published.

Next actions:

1. Change the answer-engine GHCR package visibility to Public in the supported GitHub package settings UI.
2. Anonymously inspect the exact digest and confirm linux/amd64 + linux/arm64.
3. Re-run the candidate workflow with the same immutable inputs.
4. Verify all checksums/manifests/provenance, then run protected publication and anonymous download verification.

The v1.1.2 GitHub release remains a zero-asset draft until these gates pass.