Prepare v1.5.2 release candidate

[Hkshoonya]

Summary

• prepare v1.5.2 as the first public v1.5 release while preserving the withdrawn v1.5.0 and unpublished v1.5.1 history
• include the fully soaked v1.5.1 runtime, safe native-upgrade, cleanup, and provenance work plus post-tag PRs Harden Snap Store dispatch source validation #79, Select a fully supported Python for source installs #80, Add cumulative app contributor credits and enforce recognition #81, and the reviewed camera fallback in Fix mjpeg capture raw fallback #76
• update package, AppStream, Snap Store, installer, changelog, and release-note metadata consistently for a planned September 4 publication
• keep direct website downloads pinned to the latest public v1.4.0 artifacts until v1.5.2 is actually published

Release boundary

This PR does not publish a GitHub Release, create a tag, or move Snap stable. The immutable v1.5.1 tag and draft remain untouched. After this tree passes hosted release checks, the exact v1.5.2 candidate must receive a fresh 72-hour soak because #76 changes physical-camera startup behavior.

Native users upgrading from public v1.4.0 or older must use the v1.5.2 checksum-bound upgrade helper. Snap users update normally through the Store.

Local validation

• complete non-hardware suite: 622 passed, plus 22 subtests
• release smoke: 346 tests passed; v1.5.2 wheel built and packaged contributor registry verified
• metadata suite: 59 passed
• native-upgrade and metadata focus: 68 passed, plus 3 subtests
• pip check, pip-audit, Bandit medium/high scan, Bash syntax, ShellCheck 0.11.0, actionlint 1.7.12, AppStream validation, and git diff --check passed
• exact v1.5.2 DEB and RPM built and inspected in clean environments; identities, payload exclusions, anchored maintainer scripts, contributor registry, and upgrade-helper hashes verified
• Fix mjpeg capture raw fallback #76 was separately validated before merge with 63 focused tests, the full 622-test suite, and successful MJPEG/raw pipelines at the exact advertised camera geometry

The repository-wide Ruff scan still reports its existing GTK import-order and legacy unused-import baseline. Both Python files changed by this release PR pass Ruff; unrelated lint cleanup is deliberately excluded.

Publication plan

1. Require all PR and supported-platform checks on this exact commit.
2. Run package and Snap workflows from the exact release commit without a Store action.
3. Merge only after review, then create the annotated v1.5.2 tag with explicit release authorization.
4. Verify tag-built package/Snap attestations and exact Store revisions.
5. Promote both Snap architectures to candidate, complete the fresh soak, then request explicit stable publication approval.
6. Publish the existing GitHub draft and update public download links only after stable artifacts are verified.

[Hkshoonya]

Pre-tag validation is complete on exact head 046bcc7a701689d952d405db209aae623fa0cabe:

• PR checks: contributor credit, GitGuardian, Linux validation, Python 3.11, and Python 3.14 passed.
• Build Packages: DEB/RPM/helper, Apple Silicon PKG, Linux amd64/arm64, macOS Python 3.11-3.13, Python 3.11/3.13/3.14, dependency audit, runtime closure, package inspection, and Swift extension compilation passed. Tag-only attestation/release jobs correctly skipped.
• Build & Publish Snap: amd64 CUDA and arm64 CPU snaps built; runtime pip exclusion and full dependency closure passed. No Store action, release attachment, or channel change ran.
• Downloaded hosted DEB/RPM/helper/PKG artifacts report version 1.5.2; the helper embeds the exact hosted native-package hashes.

Local full, release-smoke, package, AppStream, Bash, ShellCheck, actionlint, Bandit, pip-audit, and exact helper checks remain as recorded in the PR body. The existing repository-wide Ruff baseline is unchanged; the Python files touched here pass Ruff.

This evidence authorizes merging the reviewed release tree only. Tag creation, Store candidate promotion, soak, and public stable publication remain separate gates.

[Hkshoonya]

The v1.5.2 candidate deployment is complete.

• v1.5.2 points to merge commit c9c17ec62fc92749f7bbb91db541a46452ed2204.
• Tag-built native packages passed all platform jobs, checksums, and provenance generation. I downloaded the final DEB, RPM, native-upgrade helper, PKG, and checksum manifest; all hashes and exact-tag attestations verify.
• Tag-built Snaps passed runtime-pip exclusion, dependency closure, and provenance on amd64 and arm64. The arm64 Snap and checksum are attached to the draft release. The 2.24 GB amd64 Snap exceeds GitHub Releases’ 2 GiB per-file limit, so it remains available through Actions and the Store rather than as a GitHub release asset.
• Store review build rebuilt from the immutable tag. Both actual upload artifacts independently verify against the expected tag, commit, workflow, and GitHub-hosted runners. Store processing finished ready to release.
• Candidate promotion moved only reviewed amd64 revision 177 and arm64 revision 176 to latest/candidate; rollback and post-release revision checks passed.

The public Store API confirms v1.5.2 candidate revisions 177/176. Stable remains v1.4.0 revisions 151/148, and the GitHub release remains a draft. The unpublished v1.5.1 candidate is superseded; users do not need to install it first.

The fresh 72-hour soak began at 2026-09-01 00:48:49 UTC and reaches its minimum at 2026-09-04 00:48:49 UTC (September 3, 8:48:49 PM EDT). Local amd64 refresh and camera/mode-change smoke testing are still pending interactive sudo authorization. Stable promotion and GitHub release publication remain blocked until that testing and the soak complete. Snap rebuilds are provenance-verified but not byte-for-byte reproducible; that known boundary remains tracked in #60.

[Hkshoonya]

Release gate update: exact candidate testing found two packaging blockers after candidate deployment. Strict Snap transcription could not create Python multiprocessing semaphores under /dev/shm, and native/source installers still allowed the vulnerable pip 26.1.2 line.

#86 fixes both without changing the application version or unrelated runtime behavior: the Snap now uses a private shared-memory plug, installers require pip>=26.2, and packaging regression coverage and release metadata were updated. All hosted PR checks passed. Local verification completed with 633 tests plus 22 subtests, release smoke, 60 packaging tests, Snap manifest expansion, dependency audit, Bandit medium/high scan, AppStream validation, and shell syntax checks.

The existing draft/tag artifacts at c9c17ec62fc92749f7bbb91db541a46452ed2204 are superseded and will not be published. Because v1.5.2 has never reached GitHub publication or Snap stable, the draft and tag will be replaced at merged commit 8e33dda41b21346baaf9716e9fe585097979d5ac, followed by fresh package, Snap, checksum, and provenance builds. Candidate revisions 177/176 remain in place until their replacements pass Store review. Existing camera/runtime evidence carries forward; only the changed transcription and packaging paths require fresh artifact validation. Snap stable remains on v1.4.0.

[Hkshoonya]

Replacement candidate gate update:

• v1.5.2 now resolves to merged blocker-fix commit 8e33dda41b21346baaf9716e9fe585097979d5ac; the superseded draft was deleted before the tag update, so old and new assets were not mixed.
• Build Packages passed all Linux amd64/arm64, macOS, supported-Python, dependency-audit, checksum, package inspection, release-smoke, and provenance jobs. Every final native asset and checksum was downloaded, hash-checked, and independently verified against the exact tag, source digest, signer workflow, and GitHub-hosted runners.
• Tag-built Snaps passed runtime-pip exclusion, dependency closure, and provenance on amd64 and arm64. Both artifacts were independently verified; their generated manifests declare the app plug and private shared-memory interface. The fresh arm64 Snap/checksum are attached to the unpublished draft; amd64 remains in Actions because it exceeds GitHub Releases 2 GiB limit.
• Store review rebuilt from the same immutable tag and returned ready to release for amd64 revision 181 and arm64 revision 180. The exact review-run artifacts and attestations were independently verified before promotion.
• Candidate promotion moved only reviewed revisions 181/180 to candidate with rollback and post-release checks. The public Store view confirms candidate amd64 181; stable remains v1.4.0.

The original camera/runtime soak evidence and its 2026-09-04 00:48:49 UTC minimum carry forward because those paths are unchanged. The focused 48-hour window for the private shared-memory/transcription and packaging delta began with candidate promotion at 2026-09-01 08:06:28 UTC and ends 2026-09-03 08:06:28 UTC, inside the existing camera window, so the overall release clock is not restarted.

Local amd64 refresh from revision 177 to 181 and strict-confined semaphore/Whisper validation remain pending one authenticated Snap refresh. Stable promotion and GitHub publication remain blocked until that exact Store artifact passes.

[Hkshoonya]

A second exact-candidate packaging check found that revision 181 contained the correct app-owned packaging 26.3 and setuptools 84.0.0, but the runtime imported older copies from the GNOME content Snap because the app site-packages directory was last in sys.path. The installed dependency validator correctly failed those ownership checks.

#88 fixes the root cause by putting $SNAP/lib/python3.12/site-packages first in the generated app PYTHONPATH. Focused tests passed, and the full suite completed with 634 tests plus 22 subtests. Fresh CPU and CUDA process probes used only their expected providers; TensorRT continued to fail closed when libnvinfer.so.10 was absent. #89 separately fixes the overlapping Snap release-asset glob that caused the fresh tag workflow attachment step to attempt the checksum twice; that automation-only merge is intentionally after the product tag and did not trigger another version bump or product rebuild.

The replacement release evidence is now complete through candidate promotion:

• v1.5.2 resolves to product commit cf95d5239b1bed90b05b9542e92b142fda6f70a8.
• Native package build passed all jobs. Downloaded DEB, RPM, PKG, helper, and checksum assets passed their manifests and exact-tag provenance verification.
• Fresh tag Snap build passed both architecture build, pip-exclusion, dependency-closure, provenance, and artifact-upload jobs. Its attachment-only duplicate-checksum failure was repaired in the still-draft release and fixed for future workflows by Avoid duplicate Snap release asset uploads #89.
• Exact Store review build returned ready to release for amd64 revision 185 and arm64 revision 184. Both review artifacts verify against the tag, source digest, expected signer workflow, and GitHub-hosted runners. Their generated manifests declare strict confinement, private shared memory, and app-owned site-packages first in PYTHONPATH.
• After promotion, Canonical Store downloads of revisions 185 and 184 are byte-for-byte identical to those attested CI artifacts: amd64 SHA-256 bf2dc893691057d1a9e159b7cb63c6d475eae6f3ba76f4986903ed703031d78e; arm64 SHA-256 0179620a91c68ef20c4f03af8d63892a92c2b3f4e41cc39c7c82d506c22a7bae.
• Candidate promotion moved only revisions 185/184 to candidate and verified both channel assignments. An additional unchannelled amd64 revision 186 was not selected or promoted.

Stable remains on v1.4.0, and the GitHub release remains unpublished. Existing camera evidence and the overall 2026-09-04 00:48:49 UTC gate carry forward; there is no blanket soak restart. Local refresh to exact amd64 revision 185, installed dependency/transcription/runtime checks, and the targeted GUI/camera/mode-switch smoke are still required before stable promotion.

[Hkshoonya]

Correction to the previous update: amd64 revision 186 finished processing after that comment and became the current latest/edge revision; it is not unchannelled. Candidate remains the exact reviewed 185/184 pair, and stable remains v1.4.0.

I downloaded revision 186 directly from the Store. It has SHA-256 8a3ae4952f72453300aeacc08d77d07ba0ef03b145cf8fdf32cf79c645984ce2, differs from candidate 185, and has no GitHub attestation in this repository. Its creation timing and automatic edge assignment are consistent with a separate connected Launchpad/Snapcraft recipe, which Canonical documents as capable of rebuilding on source changes and publishing directly to configured Store channels: https://ubuntu.com/docs/launchpad/user/how-to/packaging/build-snaps-in-launchpad/

Two provenance-gated attempts to replace edge with the verified candidate build set failed closed only at Store authorization: the stable token is restricted to stable, and the candidate token is restricted to candidate. Neither attempt changed any channel. The authenticated Store dashboard is currently returning HTTP 504 for its release APIs, matching the current Launchpad service degradation.

An isolated branch now adds an exact candidate-to-edge operation backed by a dedicated SNAP_EDGE_TOKEN; it will remain unmerged until the connected recipe is disabled or reconfigured, because another main-branch change could otherwise trigger another automatic edge build. The v1.5.2 stable/publication gate remains closed, and local revision 185 testing is still pending the authenticated Snap refresh.

[Hkshoonya]

Edge containment is complete.

• The Snap Store dashboard now shows latest/edge and latest/candidate on the same verified build set: amd64 revision 185, arm64 revision 184.
• Stable remains v1.4.0 revisions 151/148.
• The connected Launchpad recipe ~build.snapcraft.io/+snap/2925f985ed132821352c3eb5520a88f0 was disconnected; its direct API URL now returns 404.
• The matching repository webhook 606929697 (https://snapcraft.io/api/nvbroadcast/webhook/notify) was removed and the repository hook list is now empty, so main-branch changes cannot recreate automatic unattested edge builds.
• Draft Add provenance-gated Snap edge promotion #90 adds a future provenance-gated candidate-to-edge operation with a dedicated edge-only credential. All hosted checks pass, but it remains unmerged and is not required for the current candidate.

No version, tag, candidate revision, stable channel, GitHub draft, or release soak clock changed during this containment. Local installation is still revision 181; exact revision 185 runtime and hardware testing remains pending sudo snap refresh nvbroadcast --candidate.

[Hkshoonya]

Exact installed-candidate validation is complete on local amd64 revision 185.

• Snap refresh change 169 completed cleanly. snap info shows installed/candidate/edge on v1.5.2 revision 185; stable remains v1.4.0 revision 151. The private shared-memory interface is connected.
• Runtime ownership is correct: app site-packages is first, packaging 26.3 and setuptools 84.0.0 load from the app, and the installed-artifact validator passed all 66 distributions.
• multiprocessing.Semaphore and ProcessPoolExecutor passed. The real MeetingTranscriber loaded the packaged faster-whisper small model, started its worker, processed four seconds of silent audio, stopped cleanly, and returned zero segments without a semaphore or /dev/shm failure.
• Fresh provider probes executed CPU only on CPUExecutionProvider and CUDA only on CUDAExecutionProvider. TensorRT failed closed on the missing libnvinfer.so.10; it executed no graph on CPU.
• The actual Snap started with CuPy and RVM Ultra on GPU 0 while an external GStreamer client continuously read /dev/video10. Live transitions Replace -> Blur, Blur -> Remove, and Remove -> Replace all produced the expected processed output without an original-camera fallback.
• In one running process, DocZeus -> CPU High Quality -> CUDA Balanced -> DocZeus rebuilt RVM to Quality, Balanced, and Ultra as expected. The app and external camera consumer stayed alive throughout.
• Auto Frame passed at the minimum UI zoom 1.0, including Center -> Stable -> Center. Output remained nonblank and processed.
• The full test-window audit contains no crash, segfault, OOM, failed user unit, or shared-memory denial. Strict confinement still logs nonfatal denials for optional icon/theme, NVIDIA MIG/device cleanup, Vulkan, and D-Bus probes; all tested GPU, audio, tray, camera, transcription, and shutdown paths worked.
• The exact pre-test user configuration was restored, and all app, audio, and GStreamer test processes exited cleanly.

Visual observation: there was no red edge outline in the sampled frames. Soft gray haloing remains visible around some hair/body boundaries in Blur and Remove under the current lighting; that is a matting-quality follow-up, not a revision 185 packaging or mode-switch regression.

The installed-artifact and local hardware gates pass. Revision 185/184 promotion completed at 2026-09-01 10:56:34 UTC; a focused 48-hour observation of the path-order delta ends at 2026-09-03 10:56:34 UTC, before the existing overall gate at 2026-09-04 00:48:49 UTC. The later overall gate remains authoritative, so there is no blanket soak restart and no stable/GitHub publication before it.

[Hkshoonya]

The visual matting follow-up from this validation is now tracked separately in #91 so it remains visible after release closure. No version, artifact, channel, or release gate changed.

[Hkshoonya]

Publication direction recorded on September 1:

• Keep v1.5.2 frozen at cf95d5239b1bed90b05b9542e92b142fda6f70a8.
• Keep Snap candidate/edge on the reviewed amd64 185 and arm64 184 revisions.
• Do not merge Fix Remove fringe cleanup and Blur matte edges #93, Clarify canonical project attribution #94, or other post-release work into this version; do not rebuild, bump, or restart the soak.
• Do not promote or publish before the authoritative 2026-09-04 00:48:49 UTC gate.

At or after the gate, perform one final blocker and exact-artifact check. If the frozen revisions, tag, checks, and observed candidate state remain valid, proceed in order: promote those exact Snap revisions to stable, verify the stable installation/channel state, publish the existing GitHub draft, then update public website/download/store metadata and the release announcement. A concrete blocker must be documented before delaying or replacing this release.