chore(release): prepare v0.3.94

.github/ISSUE_TEMPLATE/bug.yml

@@ -15,7 +15,7 @@ body:
     attributes:
       label: ConfigForge version
       description: Include the tag, package version, or commit SHA.
-      placeholder: v0.3.93
+      placeholder: v0.3.94
     validations:
       required: true
 

.github/workflows/release-mac.yml

@@ -11,7 +11,7 @@ name: Release (macOS author)
 #
 # Trigger: workflow_dispatch only. Run the workflow definition from protected `main`;
 # the checkout step below switches to and verifies the supplied immutable mac tag.
-# CLI: `gh workflow run "Release (macOS author)" --ref main -f release_tag=mac-v0.3.93-author.2`
+# CLI: `gh workflow run "Release (macOS author)" --ref main -f release_tag=mac-v0.3.94-author.1`
 # The protected main copy of the public packaging guard checks the tagged tree
 # before npm install or electron-builder runs.
 #
@@ -143,7 +143,7 @@ jobs:
           ) > SHA256SUMS-macos-author.txt
           cat SHA256SUMS-macos-author.txt
 
-      # Attach to the existing draft release (e.g. mac-v0.3.93-author.2).
+      # Attach to the existing draft release (e.g. mac-v0.3.94-author.1).
       # `--clobber` overwrites if a re-run uploads the same filename.
       - name: Upload artifacts to draft release
         env:

AGENTS.md

@@ -15,22 +15,18 @@ The renderer is built with Vite and routes through a typed IPC bridge (`window.c
 
 ### Current repository snapshot
 
-The following release references were verified on 2026-07-25:
+The following release references were verified on 2026-07-26:
 
 | Line | Reference | State |
 |---|---|---|
-| `main` | `v0.3.93` | Full Windows/Linux line. Latest tag and package version are `v0.3.93` and `0.3.93`; PR [#76](https://github.com/Azure/ConfigForge/pull/76) adds nested value keyboard editing and PR [#82](https://github.com/Azure/ConfigForge/pull/82) repairs the standalone Windows Server 2025 audits. |
-| `mac-author-build` | `c4ce196` (PR [#84](https://github.com/Azure/ConfigForge/pull/84)) | Current author-only macOS head and target of annotated tag `mac-v0.3.93-author.2`. The matching GitHub release exists with five verified assets, but it is a draft and is unpublished. |
+| `main` | `v0.3.94` | Current Windows/Linux tagged source. The matching GitHub release is a draft and unpublished. PR [#86](https://github.com/Azure/ConfigForge/pull/86) patches dev-only `brace-expansion`; PRs [#88](https://github.com/Azure/ConfigForge/pull/88) and [#91](https://github.com/Azure/ConfigForge/pull/91) establish the public packaging and policy surface; PR [#89](https://github.com/Azure/ConfigForge/pull/89) refreshes nine synthetic-content screenshots. |
+| `mac-author-build` | `mac-v0.3.94-author.1` | Current author-only macOS tagged source. The matching GitHub release is a draft and unpublished. |
 
 On `mac-author-build`, the root package, desktop package, and lockfile records
-use `0.3.93-author.2`. The annotated `mac-v0.3.93-author.2` tag resolves to
-`c4ce196574f1d3fdf878d4c5856f64539f6dec7a`, which is also the current macOS
-branch head. The matching GitHub release is intentionally a draft and must
-remain unpublished unless a maintainer separately approves publication.
-Workflow run
-[#30186678580](https://github.com/Azure/ConfigForge/actions/runs/30186678580)
-completed successfully and verified all five assets. The package versions on
-`main` are `0.3.93`; do not copy macOS package metadata to `main`.
+use `0.3.94-author.1`. The current macOS Author tagged source is
+`mac-v0.3.94-author.1`, and its matching GitHub release remains a draft and
+unpublished. The Full-edition package versions are `0.3.94`; do not copy
+macOS package metadata to `main`.
 
 ### Current feature inventory
 
@@ -120,13 +116,12 @@ Cherry-picks from `main` to `mac-author-build` almost always conflict on `packag
 - The macOS tag must resolve to the exact final validated commit on
   `mac-author-build`. `scripts/ship-mac.ps1` accepts only the `mac-v` form and
   defaults to `Azure/ConfigForge`.
-- The existing `0.3.93-author.2` draft release contains exactly these verified
-  assets:
+- The `0.3.94-author.1` release contract expects exactly these asset names:
 
   | Asset | Exact name |
   |---|---|
-  | DMG | `ConfigForge-Author-0.3.93-author.2-mac-arm64.dmg` |
-  | Blockmap | `ConfigForge-Author-0.3.93-author.2-mac-arm64.dmg.blockmap` |
+  | DMG | `ConfigForge-Author-0.3.94-author.1-mac-arm64.dmg` |
+  | Blockmap | `ConfigForge-Author-0.3.94-author.1-mac-arm64.dmg.blockmap` |
   | Update metadata | `latest-mac.yml` |
   | CycloneDX SBOM | `sbom-macos-author.cdx.json` |
   | SHA-256 manifest | `SHA256SUMS-macos-author.txt` |
@@ -142,7 +137,7 @@ Cherry-picks from `main` to `mac-author-build` almost always conflict on `packag
   gh workflow run "Release (macOS author)" `
     --repo Azure/ConfigForge `
     --ref main `
-    -f release_tag=mac-v0.3.93-author.2
+    -f release_tag=mac-v0.3.94-author.1
   ```
 
 - `--ref main` selects the reviewed workflow definition, not the source to
@@ -456,13 +451,18 @@ When touching IPC contracts or `packages/core/src/handlers/`, exercise the chann
   [#30176765724](https://github.com/Azure/ConfigForge/actions/runs/30176765724)
   passed the install, production audit, build, SBOM, checksum, and upload
   gates and verified the five expected assets.
-- Current annotated tag `mac-v0.3.93-author.2` and `mac-author-build` both
-  resolve to merge `c4ce196574f1d3fdf878d4c5856f64539f6dec7a`. PR check run
+- The prior annotated tag `mac-v0.3.93-author.2` resolved to merge
+  `c4ce196574f1d3fdf878d4c5856f64539f6dec7a`. PR check run
   [#30186333208](https://github.com/Azure/ConfigForge/actions/runs/30186333208)
   passed, and tag-pinned workflow run
   [#30186678580](https://github.com/Azure/ConfigForge/actions/runs/30186678580)
   passed the install, production audit, build, SBOM, checksum, and upload
-  gates. Both macOS releases remain drafts and are unpublished.
+  gates. The prior author.1 and author.2 releases remain drafts and
+  unpublished.
+- The current macOS Author tagged source is `mac-v0.3.94-author.1`, with an
+  unpublished draft release. Use current GitHub checks and release metadata
+  as the authority for build and asset status rather than recording a merge
+  SHA or workflow run here.
 
 ---
 

CHANGELOG.md

@@ -1,11 +1,50 @@
 # Changelog
 
-## [Unreleased]
+## [0.3.94] - 2026-07-26
+
+> `v0.3.94` is the current Windows/Linux tagged source. Its matching GitHub
+> release remains a draft and is unpublished.
+
+### Changed
+
+- Exclude CIS benchmark source data from public installers; Benchmark Mapping
+  and CIS Diff continue to use user-supplied benchmark files.
+  ([#88](https://github.com/Azure/ConfigForge/pull/88))
+- Clarify that ConfigForge sends no product telemetry, update checks contact
+  GitHub Releases, and the separately installed `oscfg` CLI may send required
+  diagnostics under its own policy.
+  ([#88](https://github.com/Azure/ConfigForge/pull/88))
+- Publish canonical MIT licensing plus clear community ownership,
+  contribution, best-effort support, and private vulnerability-reporting
+  guidance, with structured issue and pull-request templates.
+  ([#88](https://github.com/Azure/ConfigForge/pull/88),
+  [#91](https://github.com/Azure/ConfigForge/pull/91))
+- Refresh nine README screenshots with reviewed synthetic Industry Benchmark
+  content; no licensed CIS benchmark data or screenshot tooling is added.
+  ([#89](https://github.com/Azure/ConfigForge/pull/89))
 
 ### Security
 
-- **Updated dev-only `brace-expansion` 5.x to 5.0.8.** This addresses
-  GHSA-mh99-v99m-4gvg / CVE-2026-14257 and resolves Dependabot alert #53.
+- Update dev-only `brace-expansion` 5.x to 5.0.8 to address
+  GHSA-mh99-v99m-4gvg / CVE-2026-14257 and resolve Dependabot alert #53; this
+  dependency is not bundled with the desktop app.
+  ([#86](https://github.com/Azure/ConfigForge/pull/86))
+
+## macOS Author mac-v0.3.94-author.1 - 2026-07-26 (draft, unpublished)
+
+- Align public licensing, privacy, security, support, contribution, packaging,
+  and ownership guidance while preserving the author-only capability boundary.
+  ([#90](https://github.com/Azure/ConfigForge/pull/90),
+  [#92](https://github.com/Azure/ConfigForge/pull/92),
+  [#93](https://github.com/Azure/ConfigForge/pull/93))
+- Refresh the same nine synthetic-content documentation screenshots used by
+  the Full edition without adding CIS data or screenshot tooling.
+  ([#94](https://github.com/Azure/ConfigForge/pull/94))
+- Update dev-only `brace-expansion` 5.x to 5.0.8 with the reviewed public npm
+  registry metadata. The dependency is not bundled with the application.
+  ([#86](https://github.com/Azure/ConfigForge/pull/86))
+- Keep device deployment, audit, enforcement, revert, elevation, health, and
+  audit-results storage excluded from the macOS Author edition.
 
 ## [0.3.93] - 2026-07-25
 
@@ -42,8 +81,8 @@
 
 ## [0.3.93-author.2] - 2026-07-25 (draft, unpublished)
 
-> Annotated tag `mac-v0.3.93-author.2` and the current
-> `mac-author-build` head resolve to
+> Annotated tag `mac-v0.3.93-author.2` resolved to the then-current
+> `mac-author-build` head at
 > `c4ce196574f1d3fdf878d4c5856f64539f6dec7a`. The matching GitHub release
 > contains five verified assets but remains a draft and is unpublished.
 > Workflow run

INSTALL.md

@@ -8,10 +8,11 @@ ConfigForge has two editions:
   and Audit Pack export are available. Device Deploy, Audit, and Revert are
   intentionally omitted.
 
-The latest tagged Full-edition release is `v0.3.93`. The current macOS Author
-line is `0.3.93-author.2` with tag `mac-v0.3.93-author.2`; its GitHub release
-exists with five verified assets but is intentionally a draft and is not
-published. The Full-edition package version on `main` is `0.3.93`.
+The current Windows/Linux tagged source is `v0.3.94`, and its matching GitHub
+release is a draft and unpublished. The current macOS Author tagged source is
+`mac-v0.3.94-author.1`, and its matching GitHub release is also a draft and
+unpublished. The package versions are `0.3.94` for the Full edition and
+`0.3.94-author.1` for the macOS Author edition.
 
 ConfigForge does **not** bundle the OSConfig CLI. To use the Full edition's Deploy, Audit, or Revert features against a real Windows or Linux machine, install `oscfg` separately from its upstream source.
 
@@ -127,13 +128,11 @@ later). The release contains an ARM64-only binary. It is not an x64 or
 universal build and does not support Intel Macs. Rosetta does not provide
 ARM64-on-Intel compatibility.
 
-The `mac-v0.3.93-author.2` tag and matching GitHub release exist. The five
-verified assets are attached to that release, but it remains a draft and is
-not available from the public
+The current macOS Author tagged source is `mac-v0.3.94-author.1`. Its matching
+GitHub release is a draft and is not available from the public
 [Azure/ConfigForge releases](https://github.com/Azure/ConfigForge/releases)
-page until a maintainer publishes it. Maintainers with draft access can test
-the assets now. Other users can build the tagged source by following the
-instructions in the
+page until a maintainer publishes it. Users can build the tagged source by
+following the instructions in the
 [Azure/ConfigForge repository](https://github.com/Azure/ConfigForge).
 
 The app is unsigned and not notarized. Copy **ConfigForge Author.app** to

README.md

@@ -6,27 +6,11 @@
 
 > The `oscfg` binary is **not** bundled. Editor, Microsoft Baselines, Diff, Benchmark Mapping, and Audit Pack PDF/Markdown export all work without it, including in the macOS Author edition. Deploy, device Audit, and Revert require the Full edition and the CLI. See [`INSTALL.md`](./INSTALL.md) for platform-by-platform install steps.
 
-The latest tagged Full-edition release is `v0.3.93`. The current macOS Author
-line is `0.3.93-author.2` with tag `mac-v0.3.93-author.2`; its GitHub release
-exists with five verified assets but is intentionally a draft and is not
-published. The tag resolves to the current `mac-author-build` head at
-`c4ce196574f1d3fdf878d4c5856f64539f6dec7a`. The Full-edition package version
-on `main` is `0.3.93`.
-PR [#75](https://github.com/Azure/ConfigForge/pull/75) restored macOS
-authoring parity; PR [#76](https://github.com/Azure/ConfigForge/pull/76) is
-merged on `main`, and PR
-[#77](https://github.com/Azure/ConfigForge/pull/77) ports that navigation
-series to `mac-author-build`. PR
-[#79](https://github.com/Azure/ConfigForge/pull/79) finalizes the current
-documentation and immutable-tag release tooling; PR
-[#80](https://github.com/Azure/ConfigForge/pull/80) merges the tagged release
-branch. PR [#83](https://github.com/Azure/ConfigForge/pull/83) ports the
-standalone Windows Server 2025 audit repairs to the macOS line, and PR
-[#84](https://github.com/Azure/ConfigForge/pull/84) prepares the current
-author.2 release.
-Tag-pinned workflow run
-[#30186678580](https://github.com/Azure/ConfigForge/actions/runs/30186678580)
-completed successfully. The release remains unpublished.
+The current Windows/Linux tagged source is `v0.3.94`, and its matching GitHub
+release is a draft and unpublished. The current macOS Author tagged source is
+`mac-v0.3.94-author.1`, and its matching GitHub release is also a draft and
+unpublished. The package versions are `0.3.94` for the Full edition and
+`0.3.94-author.1` for the macOS Author edition.
 
 ## What it looks like
 
@@ -187,7 +171,8 @@ is not a universal binary.
 - **[`SUPPORT.md`](./SUPPORT.md)** and **[`SECURITY.md`](./SECURITY.md)**: best-effort support boundaries and private vulnerability reporting.
 - **[`apps/desktop/src/design/PLATFORM.md`](./apps/desktop/src/design/PLATFORM.md)**: platform-specific UX rules (Windows Mica + custom titlebar, Linux native frame, etc.).
 - **[`CHANGELOG.md`](./CHANGELOG.md)**: per-release notes. The current macOS
-  Author line is the draft, unpublished `0.3.93-author.2` release.
+  Author tagged source is `mac-v0.3.94-author.1`; its matching release is a
+  draft and unpublished.
 - **[`docs/src/SUMMARY.md`](./docs/src/SUMMARY.md)**: documentation source for
   Quick Start, User Guide, Architecture, API Reference, and Operations. No
   Azure-hosted Pages URL is documented until its public destination is
@@ -213,9 +198,11 @@ is not a universal binary.
 
 | Version | Highlights |
 |---|---|
-| **0.3.93-author.2** (current macOS draft, unpublished) | Ports the standalone Windows Server 2025 audit repairs, corrected CIS aliases, Source-link cleanup, and policy-identity fixes through PR #83; PR #84 prepares the immutable tag. Workflow run #30186678580 verified all five assets. |
+| **0.3.94** (current Windows/Linux tagged source; draft unpublished) | Excludes CIS benchmark source data from public installers, publishes the public licensing/privacy/support/security policy surface, patches dev-only `brace-expansion` 5.x, and refreshes nine README screenshots with synthetic benchmark content in PR #89 |
+| **0.3.94-author.1** (current macOS tagged source; draft unpublished) | Carries the public-source packaging, policy, privacy, security, and nine synthetic screenshot updates into the author-only Apple Silicon edition without adding device operations |
+| **0.3.93-author.2** (prior macOS draft, unpublished) | Ports the standalone Windows Server 2025 audit repairs, corrected CIS aliases, Source-link cleanup, and policy-identity fixes through PR #83; PR #84 prepares the immutable tag. Workflow run #30186678580 verified all five assets. |
 | **0.3.93-author.1** (prior macOS draft, unpublished) | Restored complete macOS authoring parity and nested Enter/Tab editing through PRs #75, #76, and #77; PR #79 finalized documentation and immutable-tag release tooling, and PR #80 merged the tagged release branch. Workflow run #30176765724 verified all five assets. |
-| **0.3.93** (latest tagged Full edition) | Adds nested Enter/Tab editing and repairs standalone Windows Server 2025 audits, CIS mapping, and Matrix Diff policy identity handling |
+| **0.3.93** (prior Full edition) | Adds nested Enter/Tab editing and repairs standalone Windows Server 2025 audits, CIS mapping, and Matrix Diff policy identity handling |
 | **0.3.92** | Patches the desktop updater, AppImage packager, PostCSS processor, and archive toolchain against newly disclosed vulnerabilities |
 | **0.3.91** | Shows stacked Test schema rules in Visual mode and enforces supported constraints on newly edited values |
 | **0.3.90** | Prevents Baseline Detail footer collisions and keeps long multi-value Visual rows inside their table columns |

SECURITY.md

@@ -2,12 +2,12 @@
 
 ## Supported versions
 
-Security fixes are evaluated for the current tagged release lines.
+Security fixes are evaluated for the current tagged source lines.
 
 | Edition | Current version | Security updates |
 | --- | --- | --- |
-| Full edition for Windows and Linux | `v0.3.93` | Supported |
-| macOS Author edition | `mac-v0.3.93-author.2` | Supported tagged source; release remains a draft |
+| Full edition for Windows and Linux | `v0.3.94` | Supported tagged source; release remains a draft |
+| macOS Author edition | `mac-v0.3.94-author.1` | Supported tagged source; release remains a draft |
 | Older versions | Earlier tags | Not supported |
 
 ## Security scope

apps/desktop/PACKAGING.md

@@ -9,7 +9,7 @@
 > flavor lives on the `mac-author-build` branch and uses its own
 > `electron-builder.author.yml`.
 >
-> **Current through v0.3.93:** the release pipeline generates a
+> **Current through v0.3.94:** the release pipeline generates a
 > CycloneDX SBOM per platform, enforces
 > `npm audit --omit=dev --audit-level=high` as a release gate,
 > pins `electron-builder` invocation via `npx --no-install`, and