[blessdyb]

Summary

• consume the fixed publisher-signed official rule-pack feed with durable anti-rollback state, exact-content consent, bounded transport, and fail-closed cache/publication handling
• enforce committed managed packs and ordinary destination rules against the original proxied application before CONNECT, TLS bridging, tunneling, or plaintext upstream creation
• preserve rule precedence, global pause, exemptions, pack scopes/overrides, and trustworthy fail-open behavior when identity or durable refusal reporting cannot be established
• make finite-rule claims process-session-bound and per-rule-generation-valid; persist accepted bounded claims and their visible events atomically before proxy authorization completes
• decode pre-watermark extension batches conservatively as durable deliveries, preserving compatibility with a still-running older extension during upgrade
• serialize XPC registration and every policy/pack/claim mutation, reject superseded clients, reset partial transfers on registration, and reconnect on publication errors
• persist proxy pack activity exactly once before refusal, fence in-flight activity clearing, and avoid permanent watermark growth for app-local deliveries
• make startup once-only and ensure a superseded asynchronous reload still completes the capture-readiness barrier without publishing stale values
• reject AppleDouble metadata in PKG payloads even when newer macOS pins com.apple.provenance, while preserving signed bundle bytes/POSIX modes, normalizing install ownership to root:wheel, and keeping BOM/PackageInfo/payload counts identical
• document the exact inspection/enforcement boundary across all ten site languages

Verification

• complete macOS suite: 810 tests passed, 0 failed
• final release-blocker selection: 4/4 passed
• generation, reset/edit/delete invalidation, atomic bounded-claim persistence, old-batch decoding, XPC supersession/identity, startup readiness, activity-clear, retry/deduplication, and pre-upstream authorization regressions passed
• localization parity: 1,605/1,605 keys in all ten catalogs, with 0 missing and 0 stale
• generated site: 53 pages, 0 problems; release-note extraction passed
• production catalog source comparison and signature verification passed; deliberate entry mutation was rejected
• fresh Developer ID app 0.15.4/41 with extension 0.15.4/26 was notarized, stapled, and accepted by Gatekeeper; app, extension, and helper are universal
• exact DMG and corrected PKG were notarized, stapled, and accepted by Gatekeeper; the final signed product has 49 BOM records, PackageInfo declares 49 files, pkgutil --payload-files reports 49 paths, every BOM record is root:wheel, there are zero AppleDouble records, and the extracted app passes deep strict signature verification
• negative control against raw pkgbuild metadata found 48 AppleDouble records and the stale 97-file count, proving the cleanup/count gates detect the original failure mode
• exact corrected candidate PKG (SHA-256 85fcefc58a0059489fc459ea0c45a8144830e4b08bd4144708e8da3debae460e) was installed on the physical Mac; /Applications/Flowlight.app and nested payload are root:wheel, extension 0.15.4/26 remained activated enabled, inspection remained enabled/all-apps, and the local proxy listened on 127.0.0.1:8877
• immutable-tag dry run passed 810 tests and app/DMG/PKG signing, notarization, stapling, and Gatekeeper without publishing; production run published all three assets, verified the checksum asset, and updated Homebrew
• independently downloaded public assets matched SHA256SUMS.txt (Flowlight.dmg afd8c04…17ad, PKG 4dbdfe2…4dd32); outer containers and both embedded apps passed Developer ID, notarization/staple, Gatekeeper, version/build, universal architecture, and signed-catalog checks
• the downloaded public PKG independently reproduced 49 BOM records, PackageInfo count 49, 49 payload paths, zero AppleDouble records, and all-root:wheel ownership, then installed successfully on the physical Mac while preserving the 8.3 GiB database and 49 ordinary rules
• isolated Chrome through the publicly installed local inspection proxy received ERR_TUNNEL_CONNECTION_FAILED for adnxs.com; durable activity recorded Advertising v1 entry 1, suffix/block, com.google.Chrome, with zero origin exchanges after the baseline
• an out-of-scope curl request through the same public install reached origin with HTTP 404, was attributed to curl, and produced no new managed-pack activity
• post-acceptance policy state was restored: all packs disabled, all-app scopes and empty app selections, no overrides, dropped counters zero, automatic refresh enabled, Network Extension 0.15.4/26 active, inspection enabled, 49 pre-existing ordinary rules preserved, and the 8.3 GiB traffic database retained

🤖 Generated with Claude Code