feat(update-all): add Touch ID support and v0.1.0 release workflows

[iamgerwin]

Summary

update-all --setup-touchid
  active sudo PAM rule? -> already enabled; no changes
  otherwise -> mo touchid enable -> verify setup; no package updates

update-all [Homebrew enabled, interactive macOS terminal]
  reuse sudo timestamp OR foreground sudo -v
    macOS chooses Touch ID when available, with native password fallback
  run existing package updates as the normal user

• Adds opt-in macOS sudo Touch ID setup through the installed mo helper, checks active legacy/sudo_local rules, and never reads passwords or writes PAM itself. --no-auth opts out; CI, redirected runs, Linux, and other manager-only modes skip upfront sudo. Failed authentication stops updates before they start.
• Adds read-only Linux/macOS PR/main CI, system Bash 3.2 coverage, shell/workflow lint, maintained-doc links, release alignment, and existing/new regression suites. Tests sandbox credentials and package managers.
• Ships 0.1.0 with aligned VERSION, README, and CHANGELOG; adds a main-only, full-CI-gated release pipeline using dated changelog notes. The owner confirmed local physical Mac testing and authorized release, closing the prior hold. Published: v0.1.0, targeting merge commit f3a540f2e7537272afb13debd1632c5f7a37efe6 through the successful Release workflow.
• Adds living learnings/dump.md, agent instructions to consult/update it, and a PR checklist. Documents setup, fallback limitations, hardware verification, rollback, tests, and semantic versioning.
• With owner approval, configured main protection to require Regression (ubuntu-latest), Regression (macos-latest), and Shell and workflow lint, up-to-date branches, and administrator enforcement. Approval requirements were not added.

Assignee: @iamgerwin

Evidence

• GitHub CI for final head b1bd459: all 3 required checks passed — macOS regression, Linux regression, and shell/workflow lint.
• Before: origin/main help lacks --setup-touchid/--no-auth; the safe baseline help assertion fails: Baseline regression: --setup-touchid is not implemented. Updates had no foreground authentication preflight or PR/release workflows.
  After: bash scripts/check.sh --lint passes locally on macOS/system /bin/bash: 28 new tests, all existing statusline/parser tests, all 3 skill validations, syntax checks for 44 Bash scripts plus Zsh, maintained-doc links, and VERSION/changelog/README alignment. ShellCheck error-level checks and actionlint v1.7.7 pass.
• Auth regressions cover full-main ordering, cached sudo, password/no-Touch-ID path, failures before updates, noninteractive/CI/Linux skips, isolation flags, missing tools, opt-in/repeat-safe/cancelled setup, and active/commented/missing PAM rules. Other regressions cover cask-ignore parsing/filtering, timeout error propagation, SemVer rejection, tag mismatch, stale README, and invalid release notes.
• python3 scripts/release.py --tag v0.1.0 passes. Branch-protection API confirms all three required contexts, strict: true, and administrator enforcement.
• Review found and fixed a sandbox gap: tests now intercept cargo as well as cargo-install-update, isolate inherited Cargo/Rustup homes, and exercise a deliberately broken source guard using a harmless PATH decoy. Both new regressions failed safely before the fix and pass afterward. See the review results and scorecard.
• Owner hardware acceptance (2026-10-19): local physical Mac tests confirmed; Touch ID succeeded without requesting a password. The owner explicitly authorized release. This is owner-reported evidence, not hosted-CI or agent-observed biometric testing; individual unreported fallback outcomes and machine details are not inferred. README and lessons record the acceptance.
• Post-merge verification: main CI and release checks/publication passed on f3a540f. Published stable tag v0.1.0 was independently verified to point to that merge commit.

Merge Danger

Door: Two-way for code; opt-in system settings and GitHub protection require separate rollback.

Blast Radius: Interactive macOS runs including Homebrew now authenticate upfront and stop if it fails; use --no-auth for the prior behavior. Sourcing update-all no longer starts updates. Explicit Touch ID setup changes system-wide sudo policy; reverting this PR does not undo that setting (mo touchid → Disable). No sudo keepalive is installed, so long runs may prompt again. macOS/PAM controls fallback; app-owned dialogs, SSH, tmux, closed-lid operation, and unavailable hardware are not guaranteed biometric paths. Main branch protection is a repository setting and survives reverting code. Releases require merge, passing checks, matching stable SemVer metadata, and a main commit; existing releases are never overwritten.

[iamgerwin]

Code review results and scorecard

Completed: merged and v0.1.0 released. On 2026-10-19, the owner confirmed local physical Mac testing, reported Touch ID succeeding without a password prompt, and explicitly authorized release. The prior hardware hold is closed on that owner-provided acceptance.

Reviewed the PR against base 9a5032297cee7bde891ccf72cb6676a2659d70e6, initially at ad4131b, with the fix verified at a8d8ffc and acceptance documentation at b1bd45977edf630e4a80c5411c8d207674649f2b. Standards and requirement coverage were reviewed separately; both reviewers verified the code fix. This is an agent-assisted code self-review, not independent human code approval; hardware acceptance comes from the owner.

Standards

1. P1 — Physical verification gate (CLOSED by owner acceptance on 2026-10-19). The owner confirmed local physical Mac tests and reported successful Touch ID with no password prompt, then authorized release. README and lessons record that exact owner-reported outcome, separately from CI. OS/terminal details and individual cancellation/fallback outcomes were not supplied and are not inferred. The authentication-only test command and future verification checklist remain documented.
2. P2 — Package-update sandbox escape (FIXED in a8d8ffc). The updater executes cargo install-update -a, but the sandbox intercepted only cargo-install-update. A source-guard regression could therefore reach real Cargo. The fix exports the actual cargo stub, isolates Cargo/Rustup homes, and tests the broken-source-guard path with a harmless PATH decoy. No real installer was invoked.

No additional substantive Fowler baseline smells were found; tooling-enforced issues were excluded.

Spec

One P2 finding, FIXED: “add test runners to ensure the feature works and checks for any regressions” was undermined by the same Cargo sandbox gap. Both reviewers confirmed the correction and its two regression tests. No additional missing implementation, unjustified scope expansion, or confirmed implementation defect was found.

The owner has now accepted physical Mac testing and confirmed the Touch ID success path. Native cancellation/password fallback was not independently observed by the agent. Setup still uses the installed helper, while the README and PR title lead with this repository's command rather than highlighting an upstream project.

Scorecard

Scores describe readiness for the stated review scope, not a guarantee against regressions. 5 = applicable review criteria satisfied, using owner-reported hardware acceptance where noted.

Area	Score	Result
Standards	5/5	Code finding fixed; owner supplied hardware acceptance
Requirement coverage	5/5	Implementation covered; owner authorized release after local testing
Regression coverage / isolation	5/5	28 Python tests plus existing shell suites; source-guard failure path intercepted
CI / workflow validation	5/5	All 3 required jobs pass on final head; shell and workflow lint pass
Documentation alignment	5/5	README, CHANGELOG, lessons, helper prerequisite, rollback, and acceptance align
Physical authentication	Owner-confirmed	Local Touch ID succeeded without a password prompt; not independently observed by the agent

Evidence

• Before fix: Both new tests failed safely: the harmless decoy recorded ESCAPED cargo install-update -a, and inherited toolchain homes were not isolated.
• After fix: bash scripts/check.sh --lint passes: 28 Python tests, existing statusline/parser suites, all 3 skill validations, 44 Bash syntax checks plus Zsh, maintained-doc links, and release metadata alignment. Actionlint passes.
• Final-head GitHub CI (b1bd459): macOS regression, Linux regression, and shell/workflow lint all SUCCESS.
• Merged/released commit f3a540f2e7537272afb13debd1632c5f7a37efe6: main CI and Release workflow both SUCCESS. The stable, non-draft/non-prerelease v0.1.0 tag points exactly to the merge commit.

Owner acceptance record — 2026-10-19

physical mac test are confirmed on my local and it didn't ask any password touchid is enough, please proceed on the release

This records the owner's confirmation without inventing individual unreported test outcomes or machine details.

Findings by axis: Standards: 2 total, both closed (P2 fixed; P1 accepted by owner). Spec: 1 total, fixed; no open confirmed code defect. Merge respected branch protection; publication completed through the validated release workflow.

[iamgerwin]

v0.1.0 published

• PR feat(update-all): add Touch ID support and v0.1.0 release workflows #135 merged normally, without bypassing protection, as f3a540f2e7537272afb13debd1632c5f7a37efe6.
• Stable release v0.1.0 is published; its tag points exactly to the merge commit.
• Final PR CI, main CI, and the release pipeline all passed. The release pipeline reran Linux/macOS regressions and lint before publication.
• README, CHANGELOG, and living lessons record the owner's confirmed local Touch ID success without a password prompt and release authorization. The review scorecard is updated; no open code findings remain.