chore(release): release Buzz Desktop version 0.5.24

[wesbillman]

Buzz Desktop release v0.5.24

• Frozen main: fe56d311a7156802408afb04023c3f75d4015007
• Reviewed candidate: 3befaf16002d802a97aa79007be29b23623ceb3f
• Previous desktop release: desktop-v0.5.23
• Proposed immutable tag: desktop-v0.5.24

This PR may be squash merged after the Desktop Release Candidate check and all protected-branch checks pass. Merging authorizes publication of the exact reviewed candidate; later or unrelated changes on main cannot alter it.

The checked-in changelog accounts for every non-merge commit in the release range. The Desktop tag points to the reviewed candidate commit, not the later squash commit. Publication remains bound to that immutable candidate tag.

[github-actions]

🔐 Codex Security Review

Status: review required for the current range.

The current range is fe56d311a7156802408afb04023c3f75d4015007...3befaf16002d802a97aa79007be29b23623ceb3f.
A new review must complete for this exact range. When manual authorization
is required, a Block organization member must comment exactly
@buzz-security-review 3befaf16002d802a97aa79007be29b23623ceb3f to authorize a new review.
Any previous review applies only to its recorded range.

[jedwards27]

:bot: Jude’s code review agent

APPROVE at exact head 26ccc0200b457bac1af30600d69d7bd46133ac9e against frozen base 26ede6dfa2496993aa62ce5781d2112df4c2d009.

No author-actionable defects found. Author action: none.

The integrated review verified:

• the candidate is one commit directly above the recorded frozen base and changes only the six allowed release files;
• 0.5.24 is synchronized across candidate metadata, package, Tauri, Cargo manifest, and lockfile;
• the prior-release ledger binds desktop-v0.5.23 to its immutable candidate and squash merge;
• the deterministic changelog contains exactly the expected 72 unique non-merge commits, with no missing, extra, or duplicate entries;
• tagging remains bound to the reviewed PR head rather than the squash commit, while publication and promotion stay fail-closed behind their platform and artifact gates.

Exact-head local validation passed:

• python3 scripts/desktop_release.py validate --candidate HEAD --version 0.5.24 --repo block/buzz
• scripts/test-desktop-release-candidate.sh
• git diff --check 26ede6dfa2496993aa62ce5781d2112df4c2d009...HEAD

The tree remained clean and HEAD was confirmed before and after those checks.

Confidence gaps / verification ownership: At review time, no CI check had failed, but Desktop Core and four Desktop Smoke E2E shards were still running. Their final state is owned by protected-branch CI; any red required gate must block merge and be triaged on its evidence. Installers do not exist before the immutable tag, so signing/notarization, real upgrade artifacts, native accessibility, updater behavior, and manual promotion remain owned by the post-merge release/promotion gates. Those are release-stage checks, not author rework on this metadata-only candidate.

[jedwards27]

:bot: Jude’s code review agent

Verdict: APPROVE
Reviewed: 26ede6dfa2496993aa62ce5781d2112df4c2d009..26ccc0200b457bac1af30600d69d7bd46133ac9e (exact head 26ccc0200b457bac1af30600d69d7bd46133ac9e)
Risk: critical — this PR authorizes immutable tagging, signed multi-platform publication, and later updater promotion.

Findings: No author-actionable defect found across release integrity and adversarial product/package review.

Behavior/contracts traced: frozen-main → one-commit candidate → deterministic prior-release ledger/changelog → synchronized Desktop manifests → squash authorization → immutable candidate tag → fail-closed platform assembly/publication → separate manual updater promotion and higher-patch recovery.

Evidence:

• The candidate is one clean commit directly above the recorded frozen base and changes only the six allowed release files.
• 0.5.24 is synchronized across .release/desktop-candidate.json, desktop/package.json, desktop/src-tauri/Cargo.toml, desktop/src-tauri/Cargo.lock, and desktop/src-tauri/tauri.conf.json.
• The v0.5.24 ledger contains 72 unique exact SHAs for all 72 expected non-merge commits from the prior recorded base through frozen main, excluding only the prior release squash. Classification into Desktop/shared versus other repository changes matches scripts/desktop_release.py; no unsupported user-facing claim was introduced.
• The post-merge workflow revalidates PR/API identity and trusted check producers, then tags the reviewed PR head rather than the squash commit (.github/workflows/auto-tag-on-release-pr-merge.yml:93-163; scripts/verify-desktop-release-merge.sh:32-84). Tag creation is create-once and idempotent only at the same SHA.
• Publication requires the complete platform set before the versioned release leaves draft state; promotion is separate, verifies the retained manifest/assets, rejects downgrade and divergent same-version retries, and leaves existing clients unchanged when withheld (.github/workflows/release.yml:779-949; RELEASING.md:201-245).

Validation at matching clean HEAD:

• PASS: python3 scripts/desktop_release.py validate --candidate HEAD --version 0.5.24 --repo block/buzz
• PASS: scripts/test-desktop-release-candidate.sh
• PASS: scripts/test-release-ref-contract.sh
• PASS in independent lane: deterministic just bump-desktop-version 0.5.24 regeneration followed by git diff --exit-code
• PASS: git diff --check 26ede6dfa2496993aa62ce5781d2112df4c2d009..HEAD
• Exact-head CI already green for Desktop Release Candidate, DCO, Rust lint/Windows Rust, macOS and Windows Desktop builds, relay-backed Desktop integration, Semgrep, and zizmor; no failed checks at final review submission.

Manual/native evidence: none. This release PR contains no production UI/runtime delta, and no 0.5.24 installer exists before immutable tagging.

Residual risk: Five exact-head Desktop Core/Smoke E2E jobs remained in progress at final submission. Branch protection and the post-merge verifier own that gate; do not merge unless they settle acceptably. Signed/notarized Apple Silicon and Intel macOS artifacts, unsigned Windows x64, Linux .deb/AppImage, real upgrade behavior, and updater promotion remain downstream release/manual-promotion verification—not author rework for this source-sound candidate.

Author action: none.
Verification owner: protected-branch CI, then post-merge release and manual promotion gates.

[jedwards27]

:bot: Jude’s code review agent — APPROVE at exact head 3befaf16002d802a97aa79007be29b23623ceb3f (base fe56d311a7156802408afb04023c3f75d4015007).

The refreshed head and base expired prior clearance. This re-review found no author-actionable defect.

The immutable release chain remains coherent: HEAD^, PR base, merge-base, and candidate base_sha all bind to fe56d311...; the candidate diff contains only the six allowed release files; all package/Tauri/Cargo version authorities remain 0.5.24; and the changelog now accounts for 75/75 unique expected non-merge commits with no missing, extra, or duplicate SHA. The refresh from the previously approved candidate is minimal: base/count metadata plus the three intervening commits (#7672, #7744, #7821). Tag, squash, publication, signing, promotion, and recovery contracts are unchanged.

Product/adversarial review found the three new entries truthful, including the test-fixture stabilization entry, and no unsupported user-facing promise. The packaging matrix remains the documented signed/notarized Apple Silicon + Intel macOS, Windows x64, and Linux DEB/AppImage contract.

Exact-head evidence:

• scripts/desktop_release.py validate --candidate HEAD --version 0.5.24 --repo block/buzz: passed.
• Candidate, release-ref, OSS promotion, and promotion-behavior contract suites: passed.
• git diff --check, Desktop Release Candidate, DCO, Rust lint, Windows/macOS Desktop builds, relay producer, Semgrep, and zizmor: passed.
• Live head/base remained exact, the PR is MERGEABLE, and the review tree was clean.

Confidence gaps, not author action: Windows Rust, Desktop Core, four smoke shards, and two relay-backed integration shards were still running at review submission. Protected CI owns merge readiness. Installers, signing/notarization, upgrade smoke, and updater promotion necessarily remain downstream post-tag release gates.

Author action: none.

[jedwards27]

:bot: Jude’s code review agent

Verdict: APPROVE
Reviewed: fe56d311a7156802408afb04023c3f75d4015007..3befaf16002d802a97aa79007be29b23623ceb3f (exact head 3befaf16002d802a97aa79007be29b23623ceb3f)
Risk: critical — this refresh reauthorizes immutable tagging, signed multi-platform publication, and later updater promotion.

Findings: No author-actionable defect found across the systems/release-integrity and adversarial product/package lanes.

Delta reviewed: Prior clearance at 26ccc0200b457bac1af30600d69d7bd46133ac9e expired. The refreshed candidate moves frozen main from 26ede6dfa2496993aa62ce5781d2112df4c2d009 to fe56d311a7156802408afb04023c3f75d4015007, updates ledger count 72 → 75, and adds exactly the three intervening commits: #7821 Desktop smoke-fixture stabilization, #7672 Inbox unread-only persistence, and #7744 development App Attest support. Release workflows and publication/promotion contracts are unchanged from the prior reviewed head.

Evidence:

• Live PR head, reviewed detached HEAD, candidate parent, PR base, and recorded base_sha bind correctly; the candidate still changes only the six allowed release files.
• 0.5.24 remains synchronized across candidate metadata, package, Tauri config, Cargo manifest, and Tauri lock entry. Remote desktop-v0.5.24 remains absent.
• The changelog contains 75 unique exact SHAs for all 75 expected non-merge commits from the recorded prior boundary through refreshed frozen main, excluding only the prior release squash. Independent reconciliation found no missing, extra, duplicate, or misleading added row.
• Packaging remains the documented signed/notarized Apple Silicon + Intel macOS, unsigned Windows x64, and Linux DEB/AppImage matrix (RELEASING.md:231-239); this PR does not alter packaging configuration.
• Squash/head-tag binding, trusted-check validation, create-once tag behavior, complete-set publication, separate promotion, and higher-patch recovery are byte-unchanged from the previously reviewed contracts.

Validation at matching clean HEAD:

• PASS: python3 scripts/desktop_release.py validate --candidate HEAD --version 0.5.24 --repo block/buzz
• PASS: scripts/test-desktop-release-candidate.sh
• PASS in independent lane: scripts/test-release-ref-contract.sh, scripts/test-oss-desktop-promotion.sh, and scripts/test-oss-desktop-promotion-behavior.sh
• PASS: git diff --check fe56d311a7156802408afb04023c3f75d4015007..HEAD
• Exact-head CI already green for Desktop Release Candidate, DCO, Rust Lint, Windows Desktop build, macOS Desktop build/results, relay producer, Semgrep, and zizmor; no check was red at submission.

Manual/native evidence: none. No 0.5.24 installer exists before immutable tagging, and the release PR itself has no product implementation or packaging-matrix delta.

Residual risk: Windows Rust, Desktop Core, Desktop Smoke, and relay-backed Desktop integration jobs were still running at submission. Protected CI owns those required gates; any red required gate must block merge. Artifact assembly, signing/notarization, real install/upgrade behavior, and updater promotion remain owned by post-merge release and manual-promotion gates.

Author action: none.
Verification owner: protected-branch CI, then post-merge release operator and manual promotion gates.