[github-actions]

🤖 I have created a release beep boop

0.5.0-alpha.1 (2026-10-22)

Features

• experimental: add diagnostic-only Rust Windows prototype (#164) (22857b3)
• experimental: add standalone Windows diagnostic preview (#170) (36e3bf6)
• prepare standalone Windows diagnostic alpha releases (#172) (815c56e)

---

This PR was generated with Release Please. See documentation.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-22T04:17:41.813450Z	72c138f	Draft marked ready
🔒 Security Review	✅ Completed 2026-10-22T04:20:37.696104Z	72c138f	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

🤖 Created releases:

• windows-v0.5.0-alpha.1

🌻

[abruption]

Windows 0.5.0-alpha.1 draft prerelease preparation is complete.

Source and review gates

• Preparation PR feat: prepare Windows 0.5.0-alpha.1 diagnostic prerelease #172 merged as 815c56e047cca57b71f50805bb487c856f047526 after 41/41 checks and current-head Code/Security Review with no findings. The npm advisory service recovered; the existing audit succeeded without policy or dependency changes.
• Release Please generated PR chore(main): release windows 0.5.0-alpha.1 #173 changed only Cargo.toml, Cargo.lock, the component changelog and Windows release manifest. Its 41/41 checks and current-head Code/Security Review passed before merge as 41aa81c1ff21d9695f1a5149cae2769e508d98c0.
• Final main CI run 39721963372, attempt 2, passed. Initial Linux Node 22 failure was an existing coordination-refusal test receiving earlier owner-file lookup blockers instead of its expected coordination blocker; the outcome remained refused. The failed jobs passed on rerun without source changes. Windows Rust diagnostics, Rust fixtures, CodeQL and fixture compilation also passed on this source.

Draft assets

Draft prerelease, release ID 420304930, tag name windows-v0.5.0-alpha.1, target 41aa81c1ff21d9695f1a5149cae2769e508d98c0. It remains draft=true, prerelease=true.

Preparation workflow 39721964946 passed release creation, source build and asset attachment. All three downloaded assets match GitHub's SHA-256 digests. ZIP shape, inner checksums, version, source manifest and executable hash were checked. The quickstart differs from the Git blob only by Windows checkout CRLF line endings; its original packaged bytes/checksums were retained.

• ZIP SHA-256: 960a4ce1e734a726a8b9b5b4725df9c24661fdda42d88039ccd889c55b1023fc
• Executable SHA-256: 0f13bbaca844c739026194391c906c8eacdfd8d62d5856336b9e9184c2d5b1f5
• Outer manifest SHA-256: 305831990d3c8c49ca380cf04457ae52bef38985420b10f6acc32fe9969895c1

Exact downloaded executable on Windows

Measured on the designated quintet-desktop: Windows 10 build 19045, x64, NTFS, PowerShell RemoteSigned; Defender real-time protection was already disabled and was not changed. The preview reported 0.5.0-alpha.1.

• High token (RID 12288): diagnostics refused, inspect exit 2, elevated_context_refused, no native diagnostic result.
• Actual Medium token (RID 8192), non-elevated/non-AppContainer: diagnostic capabilities available; a self-started native Codex 0.163.0 app-server's guarded lock conflict was observed as held, exit 0. The PID remained observational evidence, not holder authority.
• After the server's normal stdin-EOF shutdown: exit 0 and no signal for the server, then the thread lock file was absent and inspection returned unknown/open_existing_failed, Win32 2, exit 2. Provider connections: 0. safeToUnlock=false throughout.
• The temporary scheduled task was removed after completion. Raw evidence stays private; remote/local result hashes agree. The first Medium attempt stopped at observer module loading because the staged scripts/validate-preview.mjs dependency was missing. That failed record was preserved; the dependency was copied and hash-verified, then the successful measurement above was performed. No release bytes were changed.

Raw evidence SHA-256 (without publishing account/path/PID data):

• High: 3ca42a6245aa82172e3f437373f7c9ff8cb048d91e938d2c2504897ed0e5a333
• Medium: da817c2e8f52f4f5ce161a0959f9e20d5d3e14c9142540820231e2bfd7bb54ad
• Native observation: 414190bc0115cc7248b2da2d46c304f055019b2a8902cf9374e686c399e1fd14
• Observer source: dfd427470292d543fd010acaddf80472ec08e5b75019dc26d38a41725806bb50
• Observer dependency: 6da0e5add13b81d784742545bff96a5e516d02cbf67ddd3c8f62e8b277c27198

The four localized READMEs and platform/preview guides describe the diagnostic-only Windows prerelease and its limits. Windows 11, Defender-on qualification and Windows recovery are not established by these measurements.

No public alpha tag/release or npm publication was created. Stable GitHub/npm latest remains v0.4.7 / 0.4.7. Public prerelease publication is the remaining maintainer decision; Node release PR #167 stays separate. The draft-preparation acceptance criteria of #171 are satisfied; this does not close Windows holder-attribution or recovery research.