Prepare v0.3.96 release

.github/ISSUE_TEMPLATE/bug.yml

@@ -15,7 +15,7 @@ body:
     attributes:
       label: ConfigForge version
       description: Include the tag, package version, or commit SHA.
-      placeholder: v0.3.95
+      placeholder: v0.3.96
     validations:
       required: true
 

.github/workflows/release-mac.yml

@@ -11,7 +11,7 @@ name: Release (macOS author)
 #
 # Trigger: workflow_dispatch only. Run the workflow definition from protected `main`;
 # the checkout step below switches to and verifies the supplied immutable mac tag.
-# CLI: `gh workflow run "Release (macOS author)" --ref main -f release_tag=mac-v0.3.94-author.1`
+# CLI: `gh workflow run "Release (macOS author)" --ref main -f release_tag=mac-v0.3.96-author.1`
 # The protected main copy of the public packaging guard checks the tagged tree
 # before npm install or electron-builder runs.
 #
@@ -143,7 +143,7 @@ jobs:
           ) > SHA256SUMS-macos-author.txt
           cat SHA256SUMS-macos-author.txt
 
-      # Attach to the existing draft release (e.g. mac-v0.3.94-author.1).
+      # Attach to the existing draft release (e.g. mac-v0.3.96-author.1).
       # `--clobber` overwrites if a re-run uploads the same filename.
       - name: Upload artifacts to draft release
         env:

AGENTS.md

@@ -15,17 +15,17 @@ The renderer is built with Vite and routes through a typed IPC bridge (`window.c
 
 ### Current repository snapshot
 
-The following release references were verified on 2026-07-27:
+The following release references were verified on 2026-07-28:
 
 | Line | Reference | State |
 |---|---|---|
-| `main` | `v0.3.95` | Current Windows/Linux tagged source. The matching GitHub release is a draft and unpublished. PR [#97](https://github.com/Azure/ConfigForge/pull/97) corrects documentation drift and PR [#100](https://github.com/Azure/ConfigForge/pull/100) replaces unreliable native hover titles with FluentUI tooltips on My Baselines status cells. |
-| `mac-author-build` | `mac-v0.3.94-author.1` | Current author-only macOS tagged source. The matching GitHub release is a draft and unpublished. |
+| `main` | `v0.3.96` | Current Windows/Linux tagged source. The matching GitHub release is a draft and unpublished. PR [#104](https://github.com/Azure/ConfigForge/pull/104) preserves the full WS2025 control sets and hardens Machine Configuration MOF export. |
+| `mac-author-build` | `mac-v0.3.96-author.1` | Current author-only macOS tagged source. The matching GitHub release is a draft and unpublished. PR [#105](https://github.com/Azure/ConfigForge/pull/105) ports the same authoring/export changes. |
 
 On `mac-author-build`, the root package, desktop package, and lockfile records
-use `0.3.94-author.1`. The current macOS Author tagged source is
-`mac-v0.3.94-author.1`, and its matching GitHub release remains a draft and
-unpublished. The Full-edition package versions are `0.3.95`; do not copy
+use `0.3.96-author.1`. The current macOS Author tagged source is
+`mac-v0.3.96-author.1`, and its matching GitHub release remains a draft and
+unpublished. The Full-edition package versions are `0.3.96`; do not copy
 macOS package metadata to `main`.
 
 ### Current feature inventory
@@ -116,12 +116,12 @@ Cherry-picks from `main` to `mac-author-build` almost always conflict on `packag
 - The macOS tag must resolve to the exact final validated commit on
   `mac-author-build`. `scripts/ship-mac.ps1` accepts only the `mac-v` form and
   defaults to `Azure/ConfigForge`.
-- The `0.3.94-author.1` release contract expects exactly these asset names:
+- The `0.3.96-author.1` release contract expects exactly these asset names:
 
   | Asset | Exact name |
   |---|---|
-  | DMG | `ConfigForge-Author-0.3.94-author.1-mac-arm64.dmg` |
-  | Blockmap | `ConfigForge-Author-0.3.94-author.1-mac-arm64.dmg.blockmap` |
+  | DMG | `ConfigForge-Author-0.3.96-author.1-mac-arm64.dmg` |
+  | Blockmap | `ConfigForge-Author-0.3.96-author.1-mac-arm64.dmg.blockmap` |
   | Update metadata | `latest-mac.yml` |
   | CycloneDX SBOM | `sbom-macos-author.cdx.json` |
   | SHA-256 manifest | `SHA256SUMS-macos-author.txt` |
@@ -137,7 +137,7 @@ Cherry-picks from `main` to `mac-author-build` almost always conflict on `packag
   gh workflow run "Release (macOS author)" `
     --repo Azure/ConfigForge `
     --ref main `
-    -f release_tag=mac-v0.3.94-author.1
+    -f release_tag=mac-v0.3.96-author.1
   ```
 
 - `--ref main` selects the reviewed workflow definition, not the source to
@@ -443,9 +443,9 @@ When touching IPC contracts or `packages/core/src/handlers/`, exercise the chann
   errors, the desktop build, and a production audit with 0 vulnerabilities.
 - Historical `0.3.93-author.1` and `0.3.93-author.2` validation records are
   superseded; their tags/releases no longer exist. Use the current
-  `mac-v0.3.94-author.1` unpublished draft release metadata and current GitHub
+  `mac-v0.3.96-author.1` unpublished draft release metadata and current GitHub
   checks as the authority for macOS Author build and asset status.
-- The current macOS Author tagged source is `mac-v0.3.94-author.1`, with an
+- The current macOS Author tagged source is `mac-v0.3.96-author.1`, with an
   unpublished draft release. Use current GitHub checks and release metadata
   as the authority for build and asset status rather than recording a merge
   SHA or workflow run here.

CHANGELOG.md

@@ -1,6 +1,9 @@
 # Changelog
 
-## Unreleased
+## [0.3.96] - 2026-07-28
+
+> `v0.3.96` is the current Windows/Linux tagged source. Its matching GitHub
+> release remains a draft and unpublished.
 
 ### Fixed
 
@@ -18,8 +21,8 @@
 
 ## [0.3.95] - 2026-07-27
 
-> `v0.3.95` is the current Windows/Linux tagged source. Its matching GitHub
-> release remains a draft and is unpublished.
+> `v0.3.95` is the prior Windows/Linux tagged source. Its matching GitHub
+> release was an unpublished draft.
 
 ### Fixed
 
@@ -37,8 +40,8 @@
 
 ## [0.3.94] - 2026-07-26
 
-> `v0.3.94` is the current Windows/Linux tagged source. Its matching GitHub
-> release remains a draft and is unpublished.
+> `v0.3.94` is a prior Windows/Linux tagged source. Its matching GitHub
+> release was an unpublished draft.
 
 ### Changed
 

INSTALL.md

@@ -8,11 +8,11 @@ ConfigForge has two editions:
   and Audit Pack export are available. Device Deploy, Audit, and Revert are
   intentionally omitted.
 
-The current Windows/Linux tagged source is `v0.3.95`, and its matching GitHub
+The current Windows/Linux tagged source is `v0.3.96`, and its matching GitHub
 release is a draft and unpublished. The current macOS Author tagged source is
-`mac-v0.3.94-author.1`, and its matching GitHub release is also a draft and
-unpublished. The package versions are `0.3.95` for the Full edition and
-`0.3.94-author.1` for the macOS Author edition.
+`mac-v0.3.96-author.1`, and its matching GitHub release is also a draft and
+unpublished. The package versions are `0.3.96` for the Full edition and
+`0.3.96-author.1` for the macOS Author edition.
 
 ConfigForge does **not** bundle the OSConfig CLI. To use the Full edition's Deploy, Audit, or Revert features against a real Windows or Linux machine, install `oscfg` separately from its upstream source.
 
@@ -128,7 +128,7 @@ later). The release contains an ARM64-only binary. It is not an x64 or
 universal build and does not support Intel Macs. Rosetta does not provide
 ARM64-on-Intel compatibility.
 
-The current macOS Author tagged source is `mac-v0.3.94-author.1`. Its matching
+The current macOS Author tagged source is `mac-v0.3.96-author.1`. Its matching
 GitHub release is a draft and is not available from the public
 [Azure/ConfigForge releases](https://github.com/Azure/ConfigForge/releases)
 page until a maintainer publishes it. Users can build the tagged source by

README.md

@@ -6,11 +6,11 @@
 
 > The `oscfg` binary is **not** bundled. Editor, Microsoft Baselines, Diff, Benchmark Mapping, and Audit Pack PDF/Markdown export all work without it, including in the macOS Author edition. Deploy, device Audit, and Revert require the Full edition and the CLI. See [`INSTALL.md`](./INSTALL.md) for platform-by-platform install steps.
 
-The current Windows/Linux tagged source is `v0.3.95`, and its matching GitHub
+The current Windows/Linux tagged source is `v0.3.96`, and its matching GitHub
 release is a draft and unpublished. The current macOS Author tagged source is
-`mac-v0.3.94-author.1`, and its matching GitHub release is also a draft and
-unpublished. The package versions are `0.3.95` for the Full edition and
-`0.3.94-author.1` for the macOS Author edition.
+`mac-v0.3.96-author.1`, and its matching GitHub release is also a draft and
+unpublished. The package versions are `0.3.96` for the Full edition and
+`0.3.96-author.1` for the macOS Author edition.
 
 ## What it looks like
 
@@ -171,7 +171,7 @@ is not a universal binary.
 - **[`SUPPORT.md`](./SUPPORT.md)** and **[`SECURITY.md`](./SECURITY.md)**: best-effort support boundaries and private vulnerability reporting.
 - **[`apps/desktop/src/design/PLATFORM.md`](./apps/desktop/src/design/PLATFORM.md)**: platform-specific UX rules (Windows Mica + custom titlebar, Linux native frame, etc.).
 - **[`CHANGELOG.md`](./CHANGELOG.md)**: per-release notes. The current macOS
-  Author tagged source is `mac-v0.3.94-author.1`; its matching release is a
+  Author tagged source is `mac-v0.3.96-author.1`; its matching release is a
   draft and unpublished.
 - **[`docs/src/SUMMARY.md`](./docs/src/SUMMARY.md)**: documentation source for
   Quick Start, User Guide, Architecture, API Reference, and Operations. The
@@ -199,11 +199,13 @@ is not a universal binary.
 
 | Version | Highlights |
 |---|---|
-| **0.3.95** (current Windows/Linux tagged source; draft unpublished) | Replaces unreliable native hover titles with FluentUI tooltips on My Baselines status cells (keyboard accessible, ARIA-exposed multiline details) in PR #100; corrects documentation architecture and release-state drift in PR #97 |
+| **0.3.96** (current Windows/Linux tagged source; draft unpublished) | Preserves all 320/321/296 WS2025 controls while fixing Registry/CSP contracts and CEL compliance, and hardens Machine Configuration MOF export in PR #104 |
+| **0.3.96-author.1** (current macOS tagged source; draft unpublished) | Ports the same WS2025 authoring and global MOF export fixes to the author-only macOS line in PR #105 |
+| **0.3.95** (prior Windows/Linux draft) | Replaces unreliable native hover titles with FluentUI tooltips on My Baselines status cells (keyboard accessible, ARIA-exposed multiline details) in PR #100; corrects documentation architecture and release-state drift in PR #97 |
 | **0.3.94** (prior Full edition) | Excludes CIS benchmark source data from public installers, publishes the public licensing/privacy/support/security policy surface, patches dev-only `brace-expansion` 5.x, and refreshes nine README screenshots with synthetic benchmark content in PR #89 |
-| **0.3.94-author.1** (current macOS tagged source; draft unpublished) | Carries the public-source packaging, policy, privacy, security, and nine synthetic screenshot updates into the author-only Apple Silicon edition without adding device operations |
-| **0.3.93-author.2** (historical macOS source milestone; no current tag or release) | Ports the standalone Windows Server 2025 audit repairs, corrected CIS aliases, Source-link cleanup, and policy-identity fixes through PR #83/#84. Historical workflow evidence is superseded by the current `mac-v0.3.94-author.1` draft release metadata. |
-| **0.3.93-author.1** (historical macOS source milestone; no current tag or release) | Restored complete macOS authoring parity and nested Enter/Tab editing through PRs #75, #76, and #77. Historical workflow evidence is superseded by the current `mac-v0.3.94-author.1` draft release metadata. |
+| **0.3.94-author.1** (prior macOS draft) | Carries the public-source packaging, policy, privacy, security, and nine synthetic screenshot updates into the author-only Apple Silicon edition without adding device operations |
+| **0.3.93-author.2** (historical macOS source milestone; no current tag or release) | Ports the standalone Windows Server 2025 audit repairs, corrected CIS aliases, Source-link cleanup, and policy-identity fixes through PR #83/#84. Historical workflow evidence is superseded by the current `mac-v0.3.96-author.1` draft release metadata. |
+| **0.3.93-author.1** (historical macOS source milestone; no current tag or release) | Restored complete macOS authoring parity and nested Enter/Tab editing through PRs #75, #76, and #77. Historical workflow evidence is superseded by the current `mac-v0.3.96-author.1` draft release metadata. |
 | **0.3.93** (prior Full edition) | Adds nested Enter/Tab editing and repairs standalone Windows Server 2025 audits, CIS mapping, and Matrix Diff policy identity handling |
 | **0.3.92** | Patches the desktop updater, AppImage packager, PostCSS processor, and archive toolchain against newly disclosed vulnerabilities |
 | **0.3.91** | Shows stacked Test schema rules in Visual mode and enforces supported constraints on newly edited values |

SECURITY.md

@@ -6,8 +6,8 @@ Security fixes are evaluated for the current tagged source lines.
 
 | Edition | Current version | Security updates |
 | --- | --- | --- |
-| Full edition for Windows and Linux | `v0.3.95` | Supported tagged source; release remains a draft |
-| macOS Author edition | `mac-v0.3.94-author.1` | Supported tagged source; release remains a draft |
+| Full edition for Windows and Linux | `v0.3.96` | Supported tagged source; release remains a draft |
+| macOS Author edition | `mac-v0.3.96-author.1` | Supported tagged source; release remains a draft |
 | Older versions | Earlier tags | Not supported |
 
 ## Security scope

apps/desktop/PACKAGING.md

@@ -9,7 +9,7 @@
 > flavor lives on the `mac-author-build` branch and uses its own
 > `electron-builder.author.yml`.
 >
-> **Current through v0.3.95:** the release pipeline generates a
+> **Current through v0.3.96:** the release pipeline generates a
 > CycloneDX SBOM per platform, enforces
 > `npm audit --omit=dev --audit-level=high` as a release gate,
 > pins `electron-builder` invocation via `npx --no-install`, and