[v3 release] Beta-to-GA release tracker

[taliesin-ai]

Current release health

• Authoritative stage: Beta 3. Project 16, milestone v3.0.0-beta.3, this tracker, and the active execution queue are aligned.

• Exact audit window: 2026-08-17T21:00:00Z inclusive through 2026-08-18T21:00:00Z exclusive (2026-08-18 07:00–2026-08-19 07:00 Australia/Sydney).

• Release and ledger: No v3 release was published in-window. v3.0.0-beta.9 remains the latest v3 prerelease; its tag and runtime package both report beta.9. The authoritative plan.json remains 38 open gates, 27 blocking, zero passed and zero waived. No gate changed.

• GitHub intake: Four items were created: translation-only #5996; v2.15 partial publication #5997; concurrent SQLite Prepare 100% CPU spin #5998; and skipped application hooks/cancellation #5999. GitHub Discussions had no in-window activity. No data-loss report entered the window.

• Prominent risk: #5993 gained a critical review finding: manual dispatch could run fork-controlled Go before the fork guard while a persisted repository-write token was available. Commit cfc49e3fd removes that credential path. A beta.9 Windows reproduction on reopened #4905 confirms wails3 dev can fatal when Vite cold-start exceeds the approximately five-second readiness window; existing #5828 is the non-duplicate fix. Flatpak startup #5972 and cross-platform custom-scheme cancellation #5963 remain Blockers.

• CI and security: 102 Actions runs started: 54 succeeded, 29 skipped, 18 required approval, and one failed. The sole failure was recurring translation sync run 32083026495, already tracked by #5885. Security remains 32 open Dependabot alerts (14 high/16 medium/2 low) and 23 open code-scanning alerts (1 critical/7 high/15 medium), with no in-window alert transition.

• Discord: wails3 had two in-window messages: a user asked for an alpha-to-beta conversion guide and a community reply reported that a version bump should suffice with no known breaking changes. Evidence was recorded on existing RC migration issue #5868. No activity appeared in currently active v3-feedback posts or the active wails3 thread; archived-thread enumeration was unavailable.

• Selection: Four independent Beta 3 streams proceeded: Blocker #5954/#5967, Blocker #5963, Blocker #5972, and Required #5990/#5993. Todo #5991 was not run concurrently because it overlaps fix(release): correct beta.9 nanoid changelog #5993's workflow/scripts; Todo #5992 requires a Crowdin credential owner.

• Slot 1 — delegated / [v3 release] Reconcile tag-only Beta 7 policy in the release ledger #5954 + docs(release): reconcile tag-only beta evidence #5967: pushed commit c9ffe502b to agent/5954-beta7-ledger, changing only .release/v3.0.0-beta.0/comms/launch-sequence.md. It stages documentation preview before publication and makes published-channel install checks follow docs deployment. JSON, exact 38/27/0 invariants, unchanged gate tuples, reference scans, ordering assertions, diff checks, and hosted CI pass. Evidence. PR remains Blocker/In Progress pending maintainer disposition of sw-artifacts and sw-signing, then review.

• Slot 2 — delegated / Webview custom scheme never cancels r.Context() when the client aborts a request (v2 and v3) #5963: no edit, commit, push, or PR. Current WebKit receives aborts internally but exposes no public cancellation callback; WebView2 still exposes no per-request abort event. v3 assetserver race tests, native/Windows vet, and v2/v3 Windows cross-build checks pass; v2 Linux tests lack local GTK3/WebKit2GTK development packages. Evidence. Blocker/In Progress remains truthful pending a native Linux lifetime-hook spike and Windows scope/API decision.

• Slot 3 — delegated / feat(v3/linux): allow overriding the GTK application id #5972: no edit, commit, push, comment, or approval. Head a17d41e32 passes all hosted checks plus focused/broader GTK4 and GTK3 suites, example builds, docs/tracker checks, gofmt, and diff checks. Native Flatpak E2E is unavailable; all inline threads are resolved, but atterpac's requested-changes review remains. Blocker/In Progress is correct; next action is maintainer re-review and native Flatpak validation.

• Slot 4 — coordinator / release: beta.9 notes misdescribe the #5985 security fix #5990 + fix(release): correct beta.9 nanoid changelog #5993: pushed commits cfc49e3fd and d19feb897 to agent/5990-beta9-notes, changing .github/workflows/changelog-v3.yml. PR-controlled validation is now contents-read-only with persisted credentials disabled; manual reporting is a separate no-checkout job; automatic pushes are removed; additions-only/deletions-only diffs are no-match-safe. Focused generator/validator tests, YAML parsing, privilege and source-injection assertions, asymmetric diffs, the real fix(release): correct beta.9 nanoid changelog #5993 correction, and diff checks pass. Hosted review found the final output-injection edge after the initial local review; it was fixed in d19feb897, and all three new threads were resolved; evidence. Pair remains Required/In Progress pending fresh hosted CI and independent review; published beta.9 notes still require maintainer correction.

• Board reconciliation: Selected rows were reasserted and reread as Beta 3, milestone-matched, assigned taliesin-ai, and In Progress. Reopened #4905, paired it with #5828, and queued both plus #5998 and #5999 as Beta 3 Required / Software / Bug bash / In Progress. Project 16 now has 41 visible rows: 30 Todo, 11 In Progress, zero unarchived Done. No completed item required archiving.

• Milestone membership identifies intended release stage; Project 16 Release Role distinguishes Blocker, Required, Candidate, and Tracker. A checked gate below requires plan.json status passed or an explicit evidenced waiver. identifies intended release stage; Project 16 Release Role distinguishes Blocker, Required, Candidate, and Tracker. A checked gate below requires plan.json status passed or an explicit evidenced waiver.

Blocking release gates

Software

• sw-scope — Scope locked: shipped feature list matches the plan
• sw-version — Version number matches the change set
• sw-compat — Compatibility promise approved: platforms, runtimes, and minimum versions
• sw-deprecations — Deprecations and scheduled removals verified
• sw-upgrade — Upgrade path tested from the last two releases on real projects
• sw-rollback — Rollback/downgrade path documented and rehearsed
• sw-artifacts — Reproducible artifacts for every published platform
• sw-signing — Artifacts signed; checksums and provenance published
• sw-install — Installation verified from the published channel

Documentation

• doc-notes — User-focused release notes complete
• doc-changelog — Changelog entry landed in the standard format
• doc-migration — Migration guide covers every breaking change with before/after examples
• doc-getting-started — Getting-started path verified on a clean machine
• doc-reference — API reference regenerated and deployed
• doc-site — Documentation site and translated locales build and deploy

Legal and security

• legal-licence — Licence and source headers reviewed
• legal-deps — Dependency licences and third-party notices reviewed
• legal-provenance — Contribution provenance reviewed
• sec-review — New attack surface reviewed
• sec-advisories — Advisories and disclosure timing prepared

Communications

• com-positioning — One-liner, problem, proof, audience, and CTA agreed
• com-announcement — Announcement written and reviewed
• com-channels — Channel plan and publishing owners agreed
• com-site — Website version and download surfaces updated

Operations

• ops-runbook — Launch sequence, owners, and abort criteria ready
• ops-support — First-72-hours support rota staffed
• ops-hotfix — Hotfix branch/build/publish path rehearsed

Release contract

Desktop Beta covers Windows 10/11 amd64/arm64, macOS Intel/Apple Silicon, and Linux amd64/arm64. GTK4 + WebKitGTK 6.0 is the Linux default; GTK3 + WebKit2GTK 4.1 remains legacy through v3.0.x. Go 1.25+ is required. Android and iOS remain experimental and do not block desktop Beta.

Exit criteria

Each published milestone must be cut from the release branch only after its blocking software, documentation, legal/security, communications, and operations gates are green or explicitly waived with evidence. Tagging, workflow dispatch, publication, and merges remain human decisions.

[coderabbitai]

🔗 Related PRs

#5170 - fix(v3): macOS SingleInstance + URL scheme — relay URL to first instance (#5089) [merged]
#5274 - docs: phase-d sweep — replace stale v3-alpha branch references [merged]
#5463 - feat(linux): flip GTK4 + WebKitGTK 6.0 to the default build (#5459) [merged]
#5490 - docs(v3): update README — replace 'v3 Alpha' with Beta scope statement [merged]
#5708 - feat(v3,macos): NSWindow tabbing mode configuration [merged]
#5863 - chore(release): prepare v3 beta release branch for merge [merged]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!

[leaanthony]

Maintainer update for the active release train:\n\nThis issue remains a coordination tracker and evidence ledger; it is not itself a release blocker. The older “current health” snapshot in the issue body is now superseded.\n\nSince that snapshot:\n- #5843 (GTK verification) has been closed with the available Linux evidence documented in #5881.\n- #5870, #5877, #5879, #5880, and #5881 have been merged.\n- #5880 corrected the nightly-to-v3 release artifact dispatch for future beta tags.\n- #5882 corrected the nightly gate so a run after a release with only generated changelog/version/release bookkeeping changes does not create another release. Real source, documentation, workflow, or runtime changes still trigger a release.\n\n#5876 is historical Beta 2 publication evidence, not a Beta 3 code blocker. Beta 3 should be validated from its actual published release assets and install channel after the scheduled run. This tracker should stay open for release-readiness evidence rather than be treated as an unresolved blocking defect.