Keep the product-slug spec when integrating the pinned cask docs.

Why:
origin/main added the notarized cask SHA pin after this branch
diverged. The merge-base copy of spec/build-and-test.md must keep both
the pinned-cask current-state bullets and the hardcoded
simulator-broker session-root contract.

Changed:
- spec/build-and-test.md: keep the product-slug session-root obligation
  and take the pinned-cask plus notarized zip current-state bullets.
- CHANGELOG.md, Casks/simulator-broker.rb, README.md, SECURITY.md,
  docs/getting-started.md, docs/status.md, docs/test/front-door.test.mjs:
  take the origin/main pinned-cask front door.

Verification:
- npm run agent:verify -- --profile spec-only --paths spec/build-and-test.md CHANGELOG.md Casks/simulator-broker.rb README.md SECURITY.md docs/getting-started.md docs/status.md docs/test/front-door.test.mjs --session-dir task-sessions/merge-agent-home-main-20260819

Affected:
- spec/build-and-test.md
- CHANGELOG.md
- Casks/simulator-broker.rb
- README.md
- SECURITY.md
- docs/getting-started.md
- docs/status.md
- docs/test/front-door.test.mjs

Refs:
- 0921bd6 (Merge pull request #13 from fiveonecode/release/cask-notarized-app-zip)
- 52259ea (Point Codex verify-specs at the simulator-broker slug)

Session:
- task-sessions/merge-agent-home-main-20260819

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: VladimirBrejcha

CHANGELOG.md

@@ -14,8 +14,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   [`fiveonecode/homebrew-simulator-broker`](https://github.com/fiveonecode/homebrew-simulator-broker)
   for that tap name. `Formula/` and `Casks/` here stay the source of truth.
 - Homebrew cask `Casks/simulator-broker.rb` installs `Simulator Broker.app`
-  from the signed, notarized GitHub Release zip `Simulator-Broker-<version>.zip`
-  when that zip is attached.
+  from the signed, notarized GitHub Release zip `Simulator-Broker-<version>.zip`.
+  Tag `v0.1.0-alpha.1` now attaches that zip, and the cask pins its SHA-256.
 - Packable npm CLI `packages/simbroker` (`npm run package:npm`) with a `bin`
   field. The repo-root package stays private. Tag-driven
   `.github/workflows/release.yml` attaches that tarball and no longer

Casks/simulator-broker.rb

@@ -1,6 +1,6 @@
 cask "simulator-broker" do
   version "0.1.0-alpha.1"
-  sha256 :no_check
+  sha256 "5e19d128bf8061d5e18812c092e8a3b8e5f4514ff42bc233baa643fb0f075f70"
 
   url "https://github.com/fiveonecode/simulator-broker/releases/download/v#{version}/Simulator-Broker-#{version}.zip"
   name "Simulator Broker"
@@ -13,9 +13,8 @@
 
   caveats <<~EOS
     This cask installs Simulator Broker.app from the signed, notarized
-    GitHub Release zip Simulator-Broker-#{version}.zip. Produce that zip
-    with npm run package:distribution (Developer ID Application + notarytool),
-    using payload/app/Simulator Broker.app from the distribution bundle.
-    The current Alpha GitHub Release attaches the CLI tarball, not this zip.
+    GitHub Release zip Simulator-Broker-#{version}.zip. Reproduce that
+    zip from payload/app/Simulator Broker.app after
+    npm run package:distribution (Developer ID Application + notarization).
   EOS
 end

README.md

@@ -5,8 +5,7 @@ on one Mac without stealing devices from each other.
 
 > **Alpha.** macOS only. Xcode is required to create or run iOS Simulators.
 > Interfaces can change. Install the CLI with Homebrew or the `simbroker`
-> npm package. A signed, notarized operator app is not attached to this
-> Alpha release yet.
+> npm package. Install the operator app with the Homebrew cask.
 
 [![Node tests](https://github.com/fiveonecode/simulator-broker/actions/workflows/ci.yml/badge.svg)](https://github.com/fiveonecode/simulator-broker/actions/workflows/ci.yml)
 
@@ -59,16 +58,18 @@ build the macOS app. If Homebrew is installed, `simbroker` lands in
 and one guarded login-shell PATH line. Open a new terminal if this shell still
 cannot resolve `simbroker`. `source .../env.sh` remains a fallback.
 
-The Homebrew cask `fiveonecode/simulator-broker/simulator-broker` installs
-`Simulator Broker.app` from the signed, notarized GitHub Release zip
-`Simulator-Broker-<version>.zip`. That zip is not attached to the current
-Alpha release. Produce it with `npm run package:distribution` after Developer
-ID signing and notarytool notarization.
+The Homebrew cask installs the signed, notarized operator app:
 
-Xcode is still required to create and run iOS Simulators. Alpha CLI tarballs
-are attached to
+```bash
+brew install --cask fiveonecode/simulator-broker/simulator-broker
+```
+
+That cask downloads `Simulator-Broker-<version>.zip` from
 [GitHub Releases](https://github.com/fiveonecode/simulator-broker/releases).
-Extract a tarball and run `./bin/simbroker --help`.
+
+Xcode is still required to create and run iOS Simulators. Alpha CLI tarballs
+are also attached to those releases. Extract a tarball and run
+`./bin/simbroker --help`.
 
 `simbroker` help and `simbroker doctor` print human-readable text by default.
 Pass `--json` for machine-readable payloads.

SECURITY.md

@@ -6,8 +6,8 @@ Security fixes are considered for the current `main` branch and for the latest
 tagged Alpha (`0.1.0-alpha.1`). Older Alpha tags are not supported. The
 published CLI artifacts are the GitHub Release tarball, the Homebrew
 formula that installs that tarball, and the packable `simbroker` npm
-package. A signed, notarized operator app zip is not attached to this
-Alpha release.
+package, and the signed, notarized operator app zip
+`Simulator-Broker-0.1.0-alpha.1.zip`.
 
 ## Reporting A Vulnerability
 

docs/getting-started.md

@@ -10,8 +10,7 @@ A small public patch follows the public-patches track in
 
 > **Alpha.** macOS only. Xcode is required to create or run iOS Simulators.
 > Interfaces can change. Install the CLI with Homebrew or the `simbroker`
-> npm package. A signed, notarized operator app is not attached to this
-> Alpha release yet.
+> npm package. Install the operator app with the Homebrew cask.
 
 ## Prerequisites
 
@@ -171,12 +170,12 @@ SIMBROKER_DISTRIBUTION_SIGNING_IDENTITY='Developer ID Application: Example (TEAM
 npm run package:distribution
 ```
 
-GitHub Releases attach the Alpha CLI tarball. The Homebrew cask
+GitHub Releases attach the Alpha CLI tarball and the signed, notarized
+`Simulator-Broker-<version>.zip`. The Homebrew cask
 `fiveonecode/simulator-broker/simulator-broker` installs
-`Simulator Broker.app` from `Simulator-Broker-<version>.zip` on that
-release. Produce the zip with `npm run package:distribution` after Developer
-ID signing and notarytool notarization. The current Alpha release does not
-attach that zip.
+`Simulator Broker.app` from that zip. Reproduce the zip from
+`payload/app/Simulator Broker.app` after `npm run package:distribution`
+and Developer ID notarization.
 
 ## Report a problem
 

docs/status.md

@@ -68,7 +68,5 @@ node client/bin/simbroker.mjs lease release --lease-file /tmp/simbroker-lease.js
 node client/bin/simbroker.mjs simulators boot --alias ui-1
 ```
 
-## Lower-priority public follow-through
-
-- Attach a signed, notarized `Simulator-Broker-<version>.zip` to GitHub
-  Releases so the Homebrew cask has a downloadable app artifact
+The Alpha GitHub Release attaches the signed, notarized
+`Simulator-Broker-<version>.zip` used by the Homebrew cask.

docs/test/front-door.test.mjs

@@ -140,9 +140,11 @@ test("README advertises GitHub Releases and the public Node CI badge", () => {
   assert.equal(readme.includes("or GitHub Release yet"), false);
   assert.equal(readme.includes("There is no Homebrew formula or npm package yet."), false);
   assert.ok(readme.includes("brew install fiveonecode/simulator-broker/simbroker"));
+  assert.ok(readme.includes("brew install --cask fiveonecode/simulator-broker/simulator-broker"));
   assert.ok(readme.includes("homebrew-simulator-broker"));
   assert.ok(readme.includes("npm install -g"));
   assert.ok(readme.includes("simbroker-0.1.0-alpha.1.tgz"));
+  assert.equal(readme.includes("is not attached"), false);
 });
 
 test("CHANGELOG and package.json name the Alpha version", () => {
@@ -306,9 +308,14 @@ test("Homebrew formula points at the Alpha CLI tarball and the cask names a nota
   assert.ok(cask.includes('cask "simulator-broker"'));
   assert.ok(cask.includes("releases/download/v#{version}/Simulator-Broker-#{version}.zip"));
   assert.ok(cask.includes('app "Simulator Broker.app"'));
+  const caskChecksum = cask.match(/sha256 "([a-f0-9]{64})"/);
+  assert.ok(caskChecksum, "cask must pin a sha256");
+  assert.equal(caskChecksum[1], "5e19d128bf8061d5e18812c092e8a3b8e5f4514ff42bc233baa643fb0f075f70");
+  assert.equal(cask.includes("sha256 :no_check"), false);
   assert.equal(cask.includes("package:local"), false);
   assert.equal(cask.includes("package_local"), false);
   assert.ok(cask.includes("package:distribution") || cask.includes("package_distribution"));
+  assert.equal(cask.includes("not this zip"), false);
 });
 
 test("root package stays private and package_npm.sh packs a runnable simbroker bin", () => {

spec/build-and-test.md

@@ -47,16 +47,19 @@ A first extracted implementation slice now exists:
   with a `bin` field; the repo-root package stays `private`
 - `Casks/simulator-broker.rb` installs `Simulator Broker.app` from
   `Simulator-Broker-<version>.zip` on GitHub Releases (signed/notarized app
-  shape from `package_distribution.sh`, not `package:local`)
+  from `payload/app/Simulator Broker.app` after `package_distribution.sh`,
+  not `package:local`). The cask pins the published zip SHA-256.
 - public GitHub-hosted Ubuntu CI runs `verify:public-surface`,
   `test:broker-core`, `test:client`, and `test:harness-adoption`; it does not
   run `test:app`. The job budget is 30 minutes. Broker tests that build an
   app snapshot must inject the fixture `simctl` adapter. The default
   public-surface scan reads index blobs only for dirty or missing worktree
   files so a clean checkout does not spawn one `git cat-file` per file.
-- tagged versions such as `v0.1.0-alpha.1` attach the CLI tarball and the
-  packable `simbroker-<version>.tgz` to a GitHub Release through
-  `.github/workflows/release.yml`
+- tagged versions such as `v0.1.0-alpha.1` attach the CLI tarball, the
+  packable `simbroker-<version>.tgz`, and the notarized
+  `Simulator-Broker-<version>.zip` to a GitHub Release. The CLI and npm
+  tarballs come from `.github/workflows/release.yml`; the app zip is an
+  operator-signed notarized attach for this Alpha.
 - local-debug portable bundle support through a zip bundle plus package-smoke verification of the bundled install path and installed-app launch proof
 - a separate Release distribution packaging path that requires operator-supplied signing inputs, runs `codesign` plus `spctl`, optionally notarizes with `notarytool`, and writes a readiness summary JSON
 - executable `agent-harness/` changes now route through the implementation