Ship Alpha 0.1.0-alpha.2 so Homebrew matches main.

Why:
The advertised brew CLI plus cask path still served the older
0.1.0-alpha.1 tarball and app zip. Refresh and first-run honesty from
PR 14 lived only on main.

Changed:
Version, docs, formula URL, and cask pin now name 0.1.0-alpha.2. The
formula sha256 is the packaged CLI tarball. The cask sha256 is the
signed, notarized, stapled app zip. Front-door tests read the version
from package.json. Install-failure copy names the Homebrew cask.

Verification:
npm run agent:verify -- --profile spec-only --paths .github/ISSUE_TEMPLATE/install-failure.yml,CHANGELOG.md,Casks/simulator-broker.rb,Formula/simbroker.rb,README.md,SECURITY.md,docs/getting-started.md,docs/test/front-door.test.mjs,package-lock.json,package.json,packages/simbroker/README.md,packages/simbroker/package.json,spec/README.md,spec/build-and-test.md --session-dir task-sessions/alpha-2-release-20260820

Affected:
.github/ISSUE_TEMPLATE/install-failure.yml
CHANGELOG.md
Casks/simulator-broker.rb
Formula/simbroker.rb
README.md
SECURITY.md
docs/getting-started.md
docs/test/front-door.test.mjs
package-lock.json
package.json
packages/simbroker/README.md
packages/simbroker/package.json
spec/README.md
spec/build-and-test.md

Refs:
#14
spec/build-and-test.md

Session:
task-sessions/alpha-2-release-20260820

Author: VladimirBrejcha

.github/ISSUE_TEMPLATE/install-failure.yml

@@ -9,9 +9,9 @@ body:
         Simulator Broker is **Alpha**, **macOS-only**, and needs **Xcode** to
         create or run iOS Simulators. Install the CLI with
         `brew install fiveonecode/simulator-broker/simbroker` or
-        `npm install -g` of the `simbroker-0.1.0-alpha.1.tgz` from GitHub
-        Releases. A signed, notarized operator app zip is not attached to
-        this Alpha release.
+        `npm install -g` of the `simbroker-0.1.0-alpha.2.tgz` from GitHub
+        Releases. Install the operator app with
+        `brew install --cask fiveonecode/simulator-broker/simulator-broker`.
 
         Do not paste credentials, private home paths, customer data, or
         live lease files. Redact logs first. Security reports go through
@@ -23,7 +23,8 @@ body:
       label: What install path did you use?
       options:
         - Homebrew (`brew install fiveonecode/simulator-broker/simbroker`)
-        - npm (`npm install -g` of `simbroker-0.1.0-alpha.1.tgz` from GitHub Releases)
+        - npm (`npm install -g` of `simbroker-0.1.0-alpha.2.tgz` from GitHub Releases)
+        - Homebrew cask (`brew install --cask fiveonecode/simulator-broker/simulator-broker`)
         - CLI-only (`bash scripts/install_local.sh --cli-only`)
         - Contributor app + CLI (`npm run install:local`)
         - Alpha CLI tarball from GitHub Releases

CHANGELOG.md

@@ -7,6 +7,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.1.0-alpha.2] - 2026-08-20
+
+This tag is the first Homebrew CLI tarball, npm tarball, and notarized
+app zip that match the public first-run docs on `main`.
+
 ### Changed
 
 - Public first-run order is Homebrew CLI, Homebrew cask, then **Set Up This
@@ -19,11 +24,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   create simulators.
 - The app **Finish Local Broker Installation** copy leads with
   `brew install fiveonecode/simulator-broker/simbroker` and **Refresh**.
-  Refresh now discovers `simbroker` in Homebrew prefix `bin` (`/opt/homebrew`
-  and `/usr/local`) as well as `install.json` and `~/.local/bin`.
+  Refresh now discovers `simbroker` in Homebrew prefix `bin` as well as
+  `install.json` and the clone-install default bin.
 - `host init --bootstrap-config` `runtime-not-found` errors name
   `--ios-version` and `xcrun simctl list runtimes`. Default starter iOS
   stays `18`.
+- Formula, cask, README npm URL, and SECURITY supported version now name
+  `0.1.0-alpha.2`.
 
 ### Added
 
@@ -33,11 +40,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   for that tap name. `Formula/` and `Casks/` here stay the source of truth.
 - Homebrew cask `Casks/simulator-broker.rb` installs `Simulator Broker.app`
   from the signed, notarized GitHub Release zip `Simulator-Broker-<version>.zip`.
-  Tag `v0.1.0-alpha.1` now attaches that zip, and the cask pins its SHA-256.
+  This tag attaches that zip, and the cask pins its SHA-256.
 - Packable npm CLI `packages/simbroker` (`npm run package:npm`) with a `bin`
   field. The repo-root package stays private. Tag-driven
-  `.github/workflows/release.yml` attaches that tarball and no longer
-  claims the release is not a Homebrew formula or npm package.
+  `.github/workflows/release.yml` attaches that tarball.
 
 ## [0.1.0-alpha.1] - 2026-08-18
 

Casks/simulator-broker.rb

@@ -1,6 +1,6 @@
 cask "simulator-broker" do
-  version "0.1.0-alpha.1"
-  sha256 "5e19d128bf8061d5e18812c092e8a3b8e5f4514ff42bc233baa643fb0f075f70"
+  version "0.1.0-alpha.2"
+  sha256 "1135d767cb6eb4944ed389f7b57af808b7046b00078875bef79ad50ee14c6e40"
 
   url "https://github.com/fiveonecode/simulator-broker/releases/download/v#{version}/Simulator-Broker-#{version}.zip"
   name "Simulator Broker"

Formula/simbroker.rb

@@ -1,8 +1,8 @@
 class Simbroker < Formula
   desc "Local iOS Simulator control plane CLI"
   homepage "https://github.com/fiveonecode/simulator-broker"
-  url "https://github.com/fiveonecode/simulator-broker/releases/download/v0.1.0-alpha.1/simulator-broker-0.1.0-alpha.1-cli.tar.gz"
-  sha256 "699695bc65a5bcb25b9c9b5d01494fcc3f25a40dcc90b8b5bf1ec61ea87a8522"
+  url "https://github.com/fiveonecode/simulator-broker/releases/download/v0.1.0-alpha.2/simulator-broker-0.1.0-alpha.2-cli.tar.gz"
+  sha256 "f4b8740ff21ce6e7c6a3544e2811c1836d7132aaf3682d9e1c071732c80c7abe"
   license "MIT"
 
   depends_on :macos

README.md

@@ -65,7 +65,7 @@ inventory you cannot afford to change.
 Other CLI install options:
 
 ```bash
-npm install -g https://github.com/fiveonecode/simulator-broker/releases/download/v0.1.0-alpha.1/simbroker-0.1.0-alpha.1.tgz
+npm install -g https://github.com/fiveonecode/simulator-broker/releases/download/v0.1.0-alpha.2/simbroker-0.1.0-alpha.2.tgz
 simbroker --help
 ```
 

SECURITY.md

@@ -3,11 +3,11 @@
 ## Supported Versions
 
 Security fixes are considered for the current `main` branch and for the latest
-tagged Alpha (`0.1.0-alpha.1`). Older Alpha tags are not supported. The
+tagged Alpha (`0.1.0-alpha.2`). Older Alpha tags are not supported. The
 published CLI artifacts are the GitHub Release tarball, the Homebrew
 formula that installs that tarball, and the packable `simbroker` npm
 package, and the signed, notarized operator app zip
-`Simulator-Broker-0.1.0-alpha.1.zip`.
+`Simulator-Broker-0.1.0-alpha.2.zip`.
 
 ## Reporting A Vulnerability
 

docs/getting-started.md

@@ -38,7 +38,7 @@ in this repository stay the source of truth.
 ## Install the CLI with npm
 
 ```bash
-npm install -g https://github.com/fiveonecode/simulator-broker/releases/download/v0.1.0-alpha.1/simbroker-0.1.0-alpha.1.tgz
+npm install -g https://github.com/fiveonecode/simulator-broker/releases/download/v0.1.0-alpha.2/simbroker-0.1.0-alpha.2.tgz
 command -v simbroker
 simbroker --help
 ```

docs/test/front-door.test.mjs

@@ -12,6 +12,9 @@ function readRepoFile(relativePath) {
   return fs.readFileSync(path.join(repoRoot, relativePath), "utf8");
 }
 
+const packageJson = JSON.parse(readRepoFile("package.json"));
+const version = packageJson.version;
+
 function firstScreen(markdown) {
   const lines = markdown.split(/\r?\n/);
   const headingIndexes = [];
@@ -192,16 +195,16 @@ test("README advertises GitHub Releases and the public Node CI badge", () => {
   assert.ok(readme.includes("brew install --cask fiveonecode/simulator-broker/simulator-broker"));
   assert.ok(readme.includes("homebrew-simulator-broker"));
   assert.ok(readme.includes("npm install -g"));
-  assert.ok(readme.includes("simbroker-0.1.0-alpha.1.tgz"));
+  assert.ok(readme.includes(`simbroker-${version}.tgz`));
   assert.equal(readme.includes("is not attached"), false);
 });
 
 test("CHANGELOG and package.json name the Alpha version", () => {
   const changelog = readRepoFile("CHANGELOG.md");
-  const packageJson = JSON.parse(readRepoFile("package.json"));
 
-  assert.equal(packageJson.version, "0.1.0-alpha.1");
-  assert.ok(changelog.includes("## [0.1.0-alpha.1]"));
+  assert.equal(packageJson.version, version);
+  assert.match(version, /^0\.1\.0-alpha\.\d+$/);
+  assert.ok(changelog.includes(`## [${version}]`));
   assert.ok(changelog.includes("scripts/package_cli.sh"));
 });
 
@@ -251,7 +254,9 @@ test("issue forms cover install failure, bug, and feature and state Alpha limits
   assert.ok(install.includes("install_local.sh --cli-only"));
   assert.ok(install.includes("brew install fiveonecode/simulator-broker/simbroker"));
   assert.ok(install.includes("npm install -g"));
-  assert.ok(install.includes("simbroker-0.1.0-alpha.1.tgz"));
+  assert.ok(install.includes(`simbroker-${version}.tgz`));
+  assert.ok(install.includes("brew install --cask fiveonecode/simulator-broker/simulator-broker"));
+  assert.equal(install.includes("operator app zip is not attached"), false);
   assert.ok(bug.includes("labels:"));
   assert.ok(feature.includes("enhancement"));
   for (const body of [install, bug, feature, config]) {
@@ -347,19 +352,20 @@ test("Homebrew formula points at the Alpha CLI tarball and the cask names a nota
   assert.ok(url, "formula must have a url");
   assert.equal(
     url[1],
-    "https://github.com/fiveonecode/simulator-broker/releases/download/v0.1.0-alpha.1/simulator-broker-0.1.0-alpha.1-cli.tar.gz",
+    `https://github.com/fiveonecode/simulator-broker/releases/download/v${version}/simulator-broker-${version}-cli.tar.gz`,
   );
   assert.ok(checksum, "formula must pin a sha256");
-  assert.equal(checksum[1], "699695bc65a5bcb25b9c9b5d01494fcc3f25a40dcc90b8b5bf1ec61ea87a8522");
+  assert.match(checksum[1], /^[a-f0-9]{64}$/);
   assert.ok(formula.includes('shell_output("#{bin}/simbroker --help")'));
   assert.equal(formula.includes("package:local"), false);
 
   assert.ok(cask.includes('cask "simulator-broker"'));
+  assert.ok(cask.includes(`version "${version}"`));
   assert.ok(cask.includes("releases/download/v#{version}/Simulator-Broker-#{version}.zip"));
   assert.ok(cask.includes('app "Simulator Broker.app"'));
   const caskChecksum = cask.match(/sha256 "([a-f0-9]{64})"/);
   assert.ok(caskChecksum, "cask must pin a sha256");
-  assert.equal(caskChecksum[1], "5e19d128bf8061d5e18812c092e8a3b8e5f4514ff42bc233baa643fb0f075f70");
+  assert.match(caskChecksum[1], /^[a-f0-9]{64}$/);
   assert.equal(cask.includes("sha256 :no_check"), false);
   assert.equal(cask.includes("package:local"), false);
   assert.equal(cask.includes("package_local"), false);
@@ -386,7 +392,7 @@ test("root package stays private and package_npm.sh packs a runnable simbroker b
   });
   assert.equal(pack.status, 0, pack.stderr + pack.stdout);
 
-  const tarball = path.join(outputDir, "simbroker-0.1.0-alpha.1.tgz");
+  const tarball = path.join(outputDir, `simbroker-${version}.tgz`);
   assert.equal(fs.existsSync(tarball), true, pack.stdout);
 
   const installDir = path.join(outputDir, "prefix");
@@ -415,7 +421,7 @@ test("package_cli.sh writes a runnable CLI tarball without tests or the app", ()
   });
 
   assert.equal(result.status, 0, result.stderr);
-  const tarball = path.join(outputDir, "simulator-broker-0.1.0-alpha.1-cli.tar.gz");
+  const tarball = path.join(outputDir, `simulator-broker-${version}-cli.tar.gz`);
   const checksum = `${tarball}.sha256`;
   assert.equal(fs.existsSync(tarball), true, result.stdout);
   assert.equal(fs.existsSync(checksum), true, result.stdout);
@@ -425,7 +431,7 @@ test("package_cli.sh writes a runnable CLI tarball without tests or the app", ()
   const extract = spawnSync("tar", ["-xzf", tarball, "-C", extractDir], { encoding: "utf8" });
   assert.equal(extract.status, 0, extract.stderr);
 
-  const root = path.join(extractDir, "simulator-broker-0.1.0-alpha.1-cli");
+  const root = path.join(extractDir, `simulator-broker-${version}-cli`);
   const help = spawnSync(path.join(root, "bin/simbroker"), ["--help"], { encoding: "utf8" });
   assert.equal(help.status, 0, help.stderr);
   assert.ok(help.stdout.includes("simbroker") || help.stderr.includes("simbroker"));

package-lock.json

@@ -32,7 +32,7 @@
     "test:package-smoke": "bash ./scripts/package_smoke.sh",
     "verify:public-surface": "node client/public-surface.mjs"
   },
-  "version": "0.1.0-alpha.1",
+  "version": "0.1.0-alpha.2",
   "description": "Local simulator broker and macOS operator app for coordinated iOS Simulator workflows",
   "license": "MIT",
   "repository": {