Operating contract

Build with evidence.

The repository's AGENTS.md is authoritative. This public summary keeps the maintenance direction visible without publishing private source.

Protect

Never modify a source app, inspect credentials, weaken exact-path deletion, run destructive tests against a real profile, or add telemetry.

Prove

Reproduce first, add a failing regression, run the full suite and strict-concurrency build, then test the assembled app and DMG.

Record

Every patch updates README, changelog, this site's patch record, and affected security, privacy, limitation, or validation documents.

Required validation

swift test
swift build -Xswiftc -warnings-as-errors -Xswiftc -strict-concurrency=complete
./Scripts/integration-test.sh
./Scripts/ui-regression-test.sh 3
./Scripts/package-dmg.sh
./Scripts/publish-pages.sh

Identity hygiene

Use generic paths, addresses, account labels, and fixtures. Never commit a real name, username, email address, machine name, home path, registry, profile, diagnostics export, signing identity, credential, local settings file, or build log. The source repository stays private; the publishing script copies only the allow-listed site/ payload into the separate public Pages repository.

Release rule

The top changelog version drives the bundle and DMG version. Hosted validation is keyed by commit so evidence cannot be displaced by a delayed event for an older revision. Workflows track the current official Node 24 action majors, including actions/checkout@v7. Public distribution requires Developer ID signing, Apple notarization, stapling, checksums, a matching tag, and release notes supported by observed validation output.