[NanaseInori]

Summary

Copying the old CONTRIBUTING examples sets 16- and 19-byte tokens, so the API rejects startup (minimum: 32 bytes). The four public download guides also still point to September's preview and say no Mac package exists, although v1.0.0-preview.20261020 ships a Windows EXE and both Mac DMGs.

• Generate separate tokens from 32 cryptographically random bytes using the already-required Node.js. Document dependencies, isolated development data, the two terminals, Vite proxy, browser connection and shutdown. CI executes the actual Bash and Windows PowerShell 5.1 snippets against Go, Vite and Chromium, including authentication and token-separation checks.
• Update both READMEs and platform guides to the current public preview, with accurate signing and validation limitations. Check that all four entry points agree on an explicit release tag and that uploaded release assets match the candidate.
• Complete the existing Mac DMG publication handoff: retrieve this run's verified artifacts, verify checksums, include both DMGs and their sidecars in the publication allowlist, and include Mac checksums in the preview's SHA256SUMS. Preserve the stable Windows checksum evidence.
• Pin Go 1.26.10 and synchronize active build instructions to resolve the reachable standard-library advisory GO-2026-6809.
• Fix the native browser cancellation test's cleanup assumption: Done signals the end of the first cleanup attempt; Close verifies completion and supports retry. Keep the cancellation deadline and blocked authority callback, reject further actions, and explicitly require verified process cleanup and profile removal before releasing the callback. Add a deterministic test of the pending-cleanup/retry contract.

Validation

• Go 1.26.10: go mod verify, go mod tidy -diff, and go test -p 1 -count=1 ./internal/releasegate ./cmd/releasegen.
• govulncheck@v1.6.0 ./... with Go 1.26.10 and the 2026-10-21 database: zero reachable vulnerabilities.
• go test -p 1 -race -count=1 ./internal/browserruntime, including the deterministic cleanup retry test.
• CI helper suite (56 tests), download documentation tests (8), Mac archive/DMG tests (24), and git diff --check.
• Download checker against the public preview's REST metadata and source revision. Public SHA256SUMS matches the Windows EXE and both DMG asset digests.
• Latest documentation run 39555547566 on db8fdfb: all three jobs passed with Go 1.26.10, including actual Linux/Bash and Windows/PowerShell 5.1 startup and Chromium connection. The Linux smoke test also passed locally.
• Latest desktop packaging run 39555547565 on db8fdfb: dependency/license gate, Windows packaging and both Mac architecture jobs passed; signing and publication skipped normally for the PR.
• Latest GitHub Go dependency audit: passed on Go 1.26.10.
• Native Chrome lifecycle tests and the complete Desktop jobs passed on Intel Mac and Apple Silicon, including cancellation while the authority lookup remains blocked.
• Latest commit db8fdfb: full CI 39555547564 passed all 23 jobs, including Go tests/vet, race checks, vulnerability audit, both native Mac jobs, Windows Desktop, real Edge UI, LSP, Store shards and both aggregate gates. All three workflows are green: 30 successful jobs and 2 normal PR publication/signing skips.

The local environment is Linux; native Mac and Windows behavior is verified by GitHub's platform jobs. PR runs skip signing/publication and create no public release.

Surface governance

• No Surface is added, promoted, downgraded, deprecated, or removed.

N/A — no Surface change.

Audit

• No credentials or local runtime data are included.
• Policy, workspace, sandbox, and persistence boundaries were reviewed.
• README and contributor/platform documentation were updated.

2026-10-27 整合验证：已合并最新 main 与 #501 依赖修复，解决四份文档中的 Node 版本冲突，并将新增文档 CI 的 Node 同步到主线 24.22.1。下载文档检查与8项回归测试通过；本机按 CONTRIBUTING 原始 PowerShell 命令实际启动 Go API、Vite 和 Chromium，令牌权限边界、代理和连接页验证通过（node scripts/check-contributor-startup.mjs）。已推送 168a2dc；新 CI 正在运行，未发布 Release。