Build, notarize and publish v0.5.0 #252

Goal

Build, notarize and publish v0.5.0 following ADR 0006 and the v0.4.0 receipt in #236.

Context

• Contents since v0.4.0: Open approval reminders without unlocking management #245, End timed allowances on screen lock or sleep when enabled #244, Add one timed read allowance for a credential group #246, Harden timed allowance sleep tracking coverage #249, Move timed allowance lock handling off the main thread #250 (v0.4.0..5cf9bc3), plus the pre-release fix Keep the library empty state centred above the timed-allowance list #251.
• Why 0.5.0: two user-facing features (one timed read allowance for a credential group; the opt-in End Timed Allow on Lock setting) and a stored settings field that 0.4.0 cannot verify once the setting is turned on.
• Pre-release review: a read-only review of v0.4.0..5cf9bc3 found no P0/P1 and one P2 (empty-state layout, fixed in Keep the library empty state centred above the timed-allowance list #251). There is no library migration, and a 0.4.0 Agent access policy is read unchanged with the setting off, so no Resume is expected. The maintainer decided to keep the group button for single-credential groups and the current Settings subtitle wording.

Executor: Codex, coordinated through Orca. Every gated step needs the maintainer's approval, relayed by the coordinator.

Steps

1. Version PR. Set AskKeyVersion.current to 0.5.0 and turn CHANGELOG [Unreleased] into a 0.5.0 entry that lists every user-visible change since v0.4.0 in Added, Changed, Fixed and Security groups, verified against the merged PRs:

   • Added: the group timed allowance on read cards for grouped credentials (Details lists every covered credential; later additions are excluded); the timed-allowance list at the top of the library with countdown and Revoke; the End Timed Allow on Lock setting (off by default, system authentication in both directions).
   • Changed: clicking a pending-request reminder while management is locked opens the approval prompt directly and keeps management locked on its page (supersedes the 0.4.0 "after management unlocks" behavior); a credential covered by a group allowance shows Revoke Group Allowance, which ends the whole grant.
   • Fixed: clicking an agent write-failure notification brings Ask Key forward without jumping to Pending requests.
   • Security: what the setting ends and refuses (lock, sleep, user switch; unconsumed timed approvals and runs that include a timed credential), and the group allowance's scope and deadline, matching SECURITY.md.
   • Upgrade notes: no library migration and Agent access settings are kept without Resume. Downgrading to 0.4.0 with the setting off changes nothing. With it on, 0.4.0 pauses Agent access and its Resume restores all Agent access settings to defaults; upgrading again before Resume loses nothing. Advise turning the setting off before downgrading. Say "0.4.0", not "an older build".
   • README and README.zh-CN: add the group allowance and the lock setting to the timed-allowance description (~96 and ~134 in both), and replace the 0.3.2 → 0.4.0 upgrade paragraph with the notes above.
   • ADR 0002: the main Decision bullet (~18) still says timed allowances cover one credential; add a pointer to the group amendment.
   • docs/testing.md Pre-release checks: extend the upgrade (~136), language (~137), Touch ID (~139), read Details (~142) and short-screen (~146) items, rewrite the reminder-click item (~145) for Open approval reminders without unlocking management #245, and add lock, sleep, user switch and responsiveness items from step 3.

   Gate: maintainer approves the merge.

2. Tag. After Keep the library empty state centred above the timed-allowance list #251 and the version PR are merged and the push CI on that commit is green, tag v0.5.0 on it. Gate: maintainer approves the tag push.

3. Install and device check. No library backup is required (no migration). Build Release, quit the running 0.4.0, move it to the Trash and install the new build at /Applications/Ask Key.app. Launch it with a clean environment, not from a terminal with Orca or CODEX_HOME variables. Gate: maintainer approves the install.

   Then run the device check with the maintainer present, one request at a time with explicit instructions. The coordinator triggers agent requests with harmless commands that print no values, sending lock-timed requests with a delay so the maintainer never waits.

   • Upgrade. Version 0.5.0, Broker health, 请旨 display name; not paused, no Resume banner; read authentication and timed-allowance settings unchanged; End Timed Allow on Lock off; same after relaunch.
   • Setting. Turning it on asks for Touch ID; cancelling leaves it off; it stays on after relaunch; turning it off also asks.
   • Screen lock (⌃⌘Q), setting on. With one single and one group allowance active, lock for at least 5 seconds and unlock: the list is empty and the next read shows a card. A request sent just before locking stays pending and its reminder appears. The UI stays responsive through five quick lock/unlock cycles.
   • Setting off. Allowances survive a lock and no Keychain prompt appears.
   • Sleep, setting on. Apple menu > Sleep, wake and unlock: allowances are gone, and a new timed approval works right after wake.
   • Group card, English and Chinese. Details lists only eligible credentials and the Expires row when a member expires earlier; all buttons fit on a short screen; approving shows one list row; a member's inspector shows Revoke Group Allowance and revoking ends the whole grant.
   • Reminder click while management is locked. The approval card appears and management stays locked on the same page; with nothing pending the click only brings the window forward.
   • Empty states. Empty group, no search results: centred (Keep the library empty state centred above the timed-allowance list #251).
   • Carried over from v0.4.0 (still NOT_VERIFIED): clicking a delivered reminder while Ask Key is not running; the Dock icon during a file picker or alert.
   • Optional, maintainer decides at the time: fast user switch; passwordless wake.
   • Clients. Each installed client still reports Connected.

4. Notarize. Run package-release.sh --notary-credential with the Ask Key release credential (two approvals in Ask Key). Verify all four files and both checksums, staple and Gatekeeper, and that the app inside the DMG has the same CDHash as the installed build.

5. Publish. Create a draft release with bilingual notes in the style of v0.4.0, including the upgrade notes from step 1, and upload the four files. Gate: maintainer approves publication. Publish it, re-download releases/latest/download/AskKey.dmg anonymously and verify it, post a receipt here in the Build, notarize and publish v0.4.0 #236 format, and record v0.5.0 in the AGENTS.md status line.

Acceptance

The release is published with all four assets, and the receipt is posted. Signing identity, Team ID and credential contents never appear in GitHub.

Blocked by

#251 (step 2 onward).