You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Prepare the v1.29.3 interim maintenance candidate on the current protected main. The release remains unpublished and every candidate/tag/publication gate stays pending until it is proved on the exact resulting main and candidate SHAs.
Changes
Synchronize package.json, src-tauri/Cargo.toml, src-tauri/tauri.conf.json, and the worldscript-studio entry in src-tauri/Cargo.lock to 1.29.3 using the repository version-sync script. The root pnpm lockfile has no root-package version field and is unchanged.
Curate verified post-v1.29.2 changes into the dated 1.29.3 candidate notes; retain an empty [Unreleased] section under the repository's release-candidate marker.
Add docs/RELEASE-V1.29.3-EVIDENCE.md with pending candidate, qualification, tag, publication, and verification states.
Fix stale service-worker cache versioning: edge builds now run sync-sw-version.mjs before Vite copies public files, prebuild:pages synchronizes the worker explicitly, and checked-in public/sw.js is at 1.29.3. Regression coverage verifies both lifecycle hooks and the edge build sequence.
Safety boundaries
RTK remains pinned to 2.12.0; the existing updater public key and v1.30/R-15 boundaries are unchanged. This PR creates no tag, GitHub Release, GHCR publication, or installer. It preserves documented OSV accepted risks and unowned browser caches. It makes no Intel macOS, Apple notarization, or Windows Authenticode claim.
Validation
Node 22.23.3 and pnpm 12.13.0; frozen dependency reconciliation and fingerprint verification passed with no dependency lockfile changes.
docs:check, i18n:check, tauri-plugins:check, and tests/unit/tooling/releaseSecurityGate.test.ts passed (29 tests).
tests/unit/buildEdgeRuntimeAssets.test.ts passed (7 tests) after the service-worker fix.
pr:budget and ci:prepush passed against origin/main on da2ad6ef; introduced commits are signed and locally verified.
The non-publishing stored updater-key probe and the three desktop bundle jobs passed on baseline main 5295b163; tampered payload and wrong-key probes were rejected. This baseline dispatch is not exact-candidate or tag qualification.
Remaining release gates
After merge, verify resulting-main push CI/CD, CodeQL, Pages, Vercel Production and SAFE-only retention. Then run a fresh all-lockfile OSV scan, exact-candidate three-OS packaging and packaged data-preservation checks, and verify the complete signed asset matrix before creating any annotated tag. Review the accepted risks tracked in #1163, #1164, and the release contract in #1201. The latest published release remains v1.29.2 until every release gate passes.
Synchronize the package and Tauri version authorities, curate the post-v1.29.2 candidate notes, and stage a release evidence record with all future gates pending. This change does not create a tag or publish release assets. Track the release under #1201.
Skipping CodeAnt AI review — this PR is a back-merge between long-lived branches (release/v1293-prep-20261108 → main). The diff here has already been reviewed when the underlying commits landed on the source branch, so re-running analysis would produce duplicate findings on already-reviewed code.
If you want to analyze this anyway (e.g. you resolved conflicts with new logic), comment @codeant-ai : review and CodeAnt will start a review.
Update edge-build preparation to synchronize the service-worker version before generating runtime assets, and rename the exported preparation-step list to reflect its broader role.
public/sw.js L9
scripts/runtime-asset-steps.d.mts L1
scripts/runtime-asset-steps.mjs L4-16, L21
Configuration
Synchronize the application and Tauri version authorities to 1.29.3 and run service-worker version synchronization in the Pages preparation hook.
package.json L4, L85
src-tauri/Cargo.lock L5913
src-tauri/Cargo.toml L3
src-tauri/tauri.conf.json L4
Documentation
Curate verified post-v1.29.2 changes into the dated v1.29.3 candidate notes while keeping Unreleased empty and marking the candidate unreleased.
CHANGELOG.md L10-28
Record baseline release evidence, pending candidate and publication gates, and the release’s stated scope and limitations.
docs/RELEASE-V1.29.3-EVIDENCE.md L1-56
Tests
Update edge-build tests to verify the renamed preparation sequence runs before Vite and stops on preparation failure.
tests/unit/buildEdgeRuntimeAssets.test.ts L31-41 (+6 small edits)
Tips and commands
Interacting with Sourcery
Trigger a new review: Comment @sourcery-ai review on the pull request.
Continue discussions: Reply directly to Sourcery's review comments.
Generate a GitHub issue from a review comment: Ask Sourcery to create an
issue from a review comment by replying to it. You can also reply to a
review comment with @sourcery-ai issue to create an issue from it.
Generate a pull request title: Write @sourcery-ai anywhere in the pull
request title to generate a title at any time. You can also comment @sourcery-ai title on the pull request to (re-)generate the title at any time.
Generate a pull request summary: Write @sourcery-ai summary anywhere in
the pull request body to generate a PR summary at any time exactly where you
want it. You can also comment @sourcery-ai summary on the pull request to
(re-)generate the summary at any time.
Generate reviewer's guide: Comment @sourcery-ai guide on the pull
request to (re-)generate the reviewer's guide at any time.
Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
pull request to resolve all Sourcery comments. Useful if you've already
addressed all the comments and don't want to see them anymore.
Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
request to dismiss all existing Sourcery reviews. Especially useful if you
want to start fresh with a new review - don't forget to comment @sourcery-ai review to trigger a new review!
Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).
Limit details: You’ve used the included review currently available. Your 79 included PR review attempts over the past 7 days set your current allowance at 1 review per hour.
Reviewing files that changed from the base of the PR and between 16a914b and da2ad6e.
Files selected for processing: 5
package.json
public/sw.js
scripts/runtime-asset-steps.d.mts
scripts/runtime-asset-steps.mjs
tests/unit/buildEdgeRuntimeAssets.test.ts
Walkthrough
The changes set the package and application versions to 1.29.3, update the changelog, and add a release evidence record. The record identifies pending release gates, baseline checks, supported desktop targets, and scope limitations.
Changes: Release preparation
Layer / File(s)
Summary
Version declarations and release notes package.json, src-tauri/Cargo.toml, src-tauri/tauri.conf.json, CHANGELOG.md
The package and application versions change from 1.29.2 to 1.29.3. The changelog adds a release-candidate marker, a dated heading, and release-summary bullets.
Release status and qualification evidence docs/RELEASE-V1.29.3-EVIDENCE.md
The record distinguishes pre-preparation baseline evidence from exact-candidate evidence. It lists pending release gates and documents the proposed version, supported targets, and release limitations.
Merge Risk: Low · previous review 16a91
The 1.29.3 web build can keep the previous service-worker cache generation, so some clients may see stale cached images. Bump the worker version or run the sync in the edge build before release.
The reason will be displayed to describe this comment to others. Learn more.
Hey - I've found 1 issue
Prompt for AI Agents
Please address the comments from this code review:
## Individual Comments### Comment 1
<locationpath="package.json"line_range="4" />
<code_context>
"name": "worldscript-studio",
"private": true,
- "version": "1.29.2",
+ "version": "1.29.3",
"description": "WorldScript Studio — offline-first, AI-powered creative writing application.",
"author": "QNBS",
</code_context>
<issue_to_address>
**Old app caches remain active**
When a build or deployment consumes the checked-in service worker without running the version sync hook, `public/sw.js` retains `APP_VERSION = '1.29.2'`, so it publishes the old cache names and does not invalidate prior app caches for v1.29.3 users.
Keep `public/sw.js`'s `APP_VERSION` synchronized with the package version, or ensure the sync hook runs before every build and deployment.
</issue_to_address>
Sourcery assessment
Approval pending. 1 finding to address first.
Blocking findings: package.json:4
Sourcery is free for open source - if you like our reviews please consider sharing them ✨
Reviewing files that changed from the base of the PR and between 5295b16 and 16a914b.
Files ignored due to path filters: 1
src-tauri/Cargo.lock is excluded by !**/*.lock
Files selected for processing: 5
CHANGELOG.md
docs/RELEASE-V1.29.3-EVIDENCE.md
package.json
src-tauri/Cargo.toml
src-tauri/tauri.conf.json
Included review availability: This review used your included allowance. 0 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 1 review per hour.
Pinned: head 16a914bb73350c7de2e2d76006daed5ada13eec3, base protected 5295b163864f75af3576fe1b884ba1b5437e4114; 1/15 GitHub-Verified signed commit, six files, 70 additions/59 deletions; review-ready and OPEN, mergeable_state=blocked pending required exact-head gates. Scope is appropriately limited to 1.29.3 version metadata (package.json, Cargo.toml, Cargo.lock self entry, tauri.conf.json), summarized accurate CHANGELOG and docs/RELEASE-V1.29.3-EVIDENCE.md with all six release stages PENDING. The existing AGENTS.md explicitly places dynamic version truth in package.json and has no Version field, so no unrelated AGENTS edit is required.
Independent live checks: Codex Connector code review on this SHA reports no findings, CodeScene APPROVED (non-code Code Health skip), CodeAnt Quality PASS, 0 review threads; exact-head CodeQL analysis SUCCESS, workflow-policy, Security Audit, PR Size and changelog/ref governance SUCCESS. Node22+Node24 Vitest and Tauri Rust compile checks are still running in CI #42498472794; PR is NOT YET MERGE-READY. Do not loop optional bot reviews or spend extra commits for source-independent noise.
Prior baseline proved, not current candidate:Tauri workflow_dispatch #42496866632 on pre-prep main 5295b16 completed SUCCESS: stored updater key verified against same pinned public key as tag v1.29.2, valid/tampered/wrong-key probe results and 3 manual unsigned OS builds (Linux/Windows/macOS ARM) successful. #627 exact-main receipt terminal SAFE=1, UNKNOWN=0, 1 safe preview removed and 54/54 protected. These are baseline only; they do not qualify the upcoming versioned resulting-main SHA.
Next sole local Codex operation: wait for required exact-head Node22/24/Tauri Rust/SAST/reviewer gates; merge #1203 only with full protected admission. Then freeze resulting versioned main, requalify exact main CI/CD+CodeQL, Pages, Vercel exact-SHA Production and canonical SAFE-only new-main postproof; run fresh 1.29.3 3-OS packaged-candidate (not prior 1.29.2 manual builds), fresh exact-ref OSV pnpm+both Rust locks (November 30 waiver expiry), v1.29.2→v1.29.3 upgrade/data-preservation and expected release assets. Only after RELEASE_READY=YES create GitHub-Verified signed annotated v1.29.3 tag, invoke exact-tag Tauri/GHCR, verify complete 20-asset manifest/signatures/digests and publish/read-back. The current GitHub Release remains v1.29.2. Held RTK 2.13 #1195 and R-15/v1.30 are outside this PR. Full owner tracking #1201.
No repository, secret, tag, release, CI or provider mutation performed by this issue-review comment.
2026-11-08 ~17:10 CET independent exact-head review — #1203 release-prep closeout
Pin: head da2ad6ef8aa3f55d149f9ebbce5bfbc89bfd077f, base protected main=5295b163864f75af3576fe1b884ba1b5437e4114, 3 of 15 allowed GitHub Verified signed commits, 10 files, +95/-82 lines, OPEN / BLOCKED only until remaining protected checks and review admission are terminal. Both inline review threads 2/2 RESOLVED. Newest checks: 30 PASS / 0 FAIL, exact-head Node24 Quality still IN_PROGRESS on CI/CD #42500721661; Node22, Tauri Rust compile, verified signatures, workflow policy, Security Audit, CodeQL #42500721561, Semgrep, CodeScene 3/3, CodeFactor PASS. PR Size Governance check PASS despite advisory 10 files > normal 8-file target (177 meaningful lines < 400 and 3 commits < 6 normal); do not split a coherent candidate on this advisory alone.
Source-level verified improvement on latest head:package.json, Tauri config, Cargo.toml and app Cargo.lock entry synchronized to 1.29.3; public/sw.js APP_VERSION also 1.29.3. scripts/runtime-asset-steps.mjs now explicitly runs sync-sw-version.mjs before direct edge Vite build, and prebuild:pages synchronizes SW before Pages build. tests/unit/buildEdgeRuntimeAssets.test.ts covers the ordered preparation sequence and failure stop; this directly addresses Sourcery's earlier old-cache finding. CHANGELOG has release-candidate marker and truthful scope; docs/RELEASE-V1.29.3-EVIDENCE.md starts future stages PENDING. Unlike base main, the PR's branch version is 1.29.3. Do not tag from the unmerged PR or treat a READY Preview as Production.
Proved pre-prep baseline, NOT yet v1.29.3 candidate proof: protected baseline main 5295b163 had exact push CI/CD #42492667174, CodeQL #42492667095, Pages job 128774564802, Vercel READY Production dpl_F5YZ8gT3qD2T2pgEXU4XVEUGNywC on all three canonical aliases, #627 terminal SAFE-only receipt (SAFE=1, UNKNOWN=0, one deletion, 54 protected). Tauri manual #42496866632 on same baseline: real stored updater key signer probe PASS with valid/tampered/wrong-key, three manual Linux/Windows/macOS ARM unsigned bundle builds PASS; those manual builds deliberately skipped per-bundle updater signature checks and release publication. Existing updater public key unchanged from v1.29.2. No v1.29.3 release/tag has been issued. The latest published release remains v1.29.2, 20 assets.
Sole local Codex CLI next:
Await exact-head Node24 and final branch protection/reviewer epoch; avoid gratuitous pushes/commits. If all mandatory checks green, merge chore(release): prepare v1.29.3 maintenance candidate #1203 via approved protected signed flow. A CodeRabbit rate limit or optional review does not substitute for mandatory gates, and should not cause churn.
Only after RELEASE_READY=YES and proved exact qualified SHA create GitHub Verified signed annotated v1.29.3 tag. Tag-time Tauri+GHCR, draft complete all-3-platform signed updater/installer/SBOM/notices inventory, sha256 and latest.json verification before public publish and readback after. No premature publication, updater key rotation, native Apple/Windows signing or Intel macOS claims.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
![codescene-access[bot]](https://avatars.githubusercontent.com/in/3755875?s=60&v=4){kind=small}
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Summary
Prepare the v1.29.3 interim maintenance candidate on the current protected main. The release remains unpublished and every candidate/tag/publication gate stays pending until it is proved on the exact resulting main and candidate SHAs.
Changes
package.json,src-tauri/Cargo.toml,src-tauri/tauri.conf.json, and theworldscript-studioentry insrc-tauri/Cargo.lockto 1.29.3 using the repository version-sync script. The root pnpm lockfile has no root-package version field and is unchanged.[Unreleased]section under the repository's release-candidate marker.docs/RELEASE-V1.29.3-EVIDENCE.mdwith pending candidate, qualification, tag, publication, and verification states.sync-sw-version.mjsbefore Vite copies public files,prebuild:pagessynchronizes the worker explicitly, and checked-inpublic/sw.jsis at 1.29.3. Regression coverage verifies both lifecycle hooks and the edge build sequence.Safety boundaries
RTK remains pinned to 2.12.0; the existing updater public key and v1.30/R-15 boundaries are unchanged. This PR creates no tag, GitHub Release, GHCR publication, or installer. It preserves documented OSV accepted risks and unowned browser caches. It makes no Intel macOS, Apple notarization, or Windows Authenticode claim.
Validation
docs:check,i18n:check,tauri-plugins:check, andtests/unit/tooling/releaseSecurityGate.test.tspassed (29 tests).tests/unit/buildEdgeRuntimeAssets.test.tspassed (7 tests) after the service-worker fix.pr:budgetandci:prepushpassed againstorigin/mainonda2ad6ef; introduced commits are signed and locally verified.5295b163; tampered payload and wrong-key probes were rejected. This baseline dispatch is not exact-candidate or tag qualification.Remaining release gates
After merge, verify resulting-main push CI/CD, CodeQL, Pages, Vercel Production and SAFE-only retention. Then run a fresh all-lockfile OSV scan, exact-candidate three-OS packaging and packaged data-preservation checks, and verify the complete signed asset matrix before creating any annotated tag. Review the accepted risks tracked in #1163, #1164, and the release contract in #1201. The latest published release remains v1.29.2 until every release gate passes.