release: prepare v0.23.3

BunsDev · BunsDev · commit 14f692cc90be · 2026-04-13T21:58:44.000-05:00
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -7,6 +7,14 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.23.3] - 2026-04-13
+
+See [docs/releases/v0.23.3.md](docs/releases/v0.23.3.md) for full notes and [docs/releases/v0.23.3/assets.md](docs/releases/v0.23.3/assets.md) for release asset inventory.
+
+### Fixed
+
+- Format v0.23.2 release files.
+
 ## [0.23.2] - 2026-04-13
 
 See [docs/releases/v0.23.2.md](docs/releases/v0.23.2.md) for full notes and [docs/releases/v0.23.2/assets.md](docs/releases/v0.23.2/assets.md) for release asset inventory.
@@ -766,3 +774,4 @@ First public version tag. See [docs/releases/v0.0.1.md](docs/releases/v0.0.1.md)
 [0.23.0]: https://github.com/OpenKnots/okcode/releases/tag/v0.23.0
 [0.23.1]: https://github.com/OpenKnots/okcode/releases/tag/v0.23.1
 [0.23.2]: https://github.com/OpenKnots/okcode/releases/tag/v0.23.2
+[0.23.3]: https://github.com/OpenKnots/okcode/releases/tag/v0.23.3
diff --git a/apps/desktop/package.json b/apps/desktop/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@okcode/desktop",
-  "version": "0.23.2",
+  "version": "0.23.3",
   "private": true,
   "main": "dist-electron/main.js",
   "scripts": {
diff --git a/apps/mobile/android/app/build.gradle b/apps/mobile/android/app/build.gradle
@@ -8,7 +8,7 @@ android {
         minSdkVersion rootProject.ext.minSdkVersion
         targetSdkVersion rootProject.ext.targetSdkVersion
         versionCode 1
-        versionName "0.23.2"
+        versionName "0.23.3"
         testInstrumentationRunner "androidx.test.runner.AndroidJUnitRunner"
         aaptOptions {
              // Files and dirs to omit from the packaged assets dir, modified to accommodate modern web apps.
diff --git a/apps/mobile/ios/App/App.xcodeproj/project.pbxproj b/apps/mobile/ios/App/App.xcodeproj/project.pbxproj
@@ -306,7 +306,7 @@
 					"$(inherited)",
 					"@executable_path/Frameworks",
 				);
-				MARKETING_VERSION = 0.23.2;
+				MARKETING_VERSION = 0.23.3;
 				OTHER_SWIFT_FLAGS = "$(inherited) \"-D\" \"COCOAPODS\" \"-DDEBUG\"";
 				PRODUCT_BUNDLE_IDENTIFIER = com.openknots.okcode.mobile;
 				PRODUCT_NAME = "$(TARGET_NAME)";
@@ -331,7 +331,7 @@
 					"$(inherited)",
 					"@executable_path/Frameworks",
 				);
-				MARKETING_VERSION = 0.23.2;
+				MARKETING_VERSION = 0.23.3;
 				PRODUCT_BUNDLE_IDENTIFIER = com.openknots.okcode.mobile;
 				PRODUCT_NAME = "$(TARGET_NAME)";
 				SWIFT_ACTIVE_COMPILATION_CONDITIONS = "";
diff --git a/apps/mobile/package.json b/apps/mobile/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@okcode/mobile",
-  "version": "0.23.2",
+  "version": "0.23.3",
   "private": true,
   "type": "module",
   "scripts": {
diff --git a/apps/server/package.json b/apps/server/package.json
@@ -1,6 +1,6 @@
 {
   "name": "okcodes",
-  "version": "0.23.2",
+  "version": "0.23.3",
   "license": "MIT",
   "repository": {
     "type": "git",
diff --git a/apps/web/package.json b/apps/web/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@okcode/web",
-  "version": "0.23.2",
+  "version": "0.23.3",
   "private": true,
   "type": "module",
   "scripts": {
diff --git a/docs/releases/README.md b/docs/releases/README.md
@@ -9,6 +9,7 @@ Use this directory for versioned release notes and asset manifests only:
 
 | Version              | Summary                                                                                                   | Assets                        |
 | -------------------- | --------------------------------------------------------------------------------------------------------- | ----------------------------- |
+| [0.23.3](v0.23.3.md) | Patch release to harden desktop migrations and normalize leg                                              | [manifest](v0.23.3/assets.md) |
 | [0.23.2](v0.23.2.md) | Desktop migration hardening and model-selection backfill patch release                                    | [manifest](v0.23.2/assets.md) |
 | [0.23.1](v0.23.1.md) | Desktop and iOS release-readiness update with Codex/Copilot                                               | [manifest](v0.23.1/assets.md) |
 | [0.23.0](v0.23.0.md) | Copilot support, provider/auth hardening, richer settings controls, and release-stability cleanup         | [manifest](v0.23.0/assets.md) |
diff --git a/docs/releases/v0.23.3.md b/docs/releases/v0.23.3.md
@@ -0,0 +1,32 @@
+# OK Code v0.23.3
+
+**Date:** 2026-04-13
+**Tag:** [`v0.23.3`](https://github.com/OpenKnots/okcode/releases/tag/v0.23.3)
+
+## Summary
+
+Patch release to harden desktop migrations and normalize legacy model-selection data.
+
+## Highlights
+
+- **Format v0.23.2 release files.**
+
+## Breaking changes
+
+- None.
+
+## Upgrade and install
+
+- **CLI:** `npm install -g okcodes@0.23.3` (after the package is published to npm manually).
+- **Desktop:** Download from [GitHub Releases](https://github.com/OpenKnots/okcode/releases/tag/v0.23.3). Filenames are listed in [assets.md](v0.23.3/assets.md).
+- **iOS:** Available via TestFlight (uploaded automatically by the Release iOS workflow).
+
+## Known limitations
+
+OK Code remains early work in progress. Expect rough edges around session recovery, streaming edge cases, and platform-specific desktop behavior. Report issues on GitHub.
+
+## Release operations
+
+- Review the [asset manifest](v0.23.3/assets.md) to confirm every expected GitHub Release attachment is present.
+- Use the [rollout checklist](v0.23.3/rollout-checklist.md) to walk the coordinated release from preflight through post-release verification.
+- Use the [soak test plan](v0.23.3/soak-test-plan.md) to validate the highest-risk surfaces after the tag is live.
diff --git a/docs/releases/v0.23.3/assets.md b/docs/releases/v0.23.3/assets.md
@@ -0,0 +1,57 @@
+# v0.23.3 — Release assets (manifest)
+
+Binaries are **not** stored in this git repository; they are attached to the [GitHub Release for `v0.23.3`](https://github.com/OpenKnots/okcode/releases/tag/v0.23.3) by the [Release Desktop workflow](../../.github/workflows/release.yml).
+
+The GitHub Release also includes **documentation attachments** (same content as in-repo, stable filenames for download):
+
+| File                        | Source in repo                        |
+| --------------------------- | ------------------------------------- |
+| `okcode-CHANGELOG.md`       | [CHANGELOG.md](../../../CHANGELOG.md) |
+| `okcode-RELEASE-NOTES.md`   | [v0.23.3.md](../v0.23.3.md)           |
+| `okcode-ASSETS-MANIFEST.md` | This file                             |
+
+After the workflow completes, expect **installer and updater** artifacts similar to the following (exact names may include the product name `OK Code` and version `0.23.3`).
+
+## Desktop installers and payloads
+
+| Platform            | Kind           | Typical pattern |
+| ------------------- | -------------- | --------------- |
+| macOS Apple Silicon | DMG (signed)   | `*.dmg` (arm64) |
+| macOS Intel         | DMG (signed)   | `*.dmg` (x64)   |
+| macOS               | ZIP (updater)  | `*.zip`         |
+| Linux x64           | AppImage       | `*.AppImage`    |
+| Windows x64         | NSIS installer | `*.exe`         |
+
+### macOS code signing and notarization
+
+All macOS DMG and ZIP payloads are **code-signed** with an Apple Developer ID certificate and **notarized** via the Apple notarization service. Gatekeeper will verify the signature on first launch. The hardened runtime is enabled with entitlements defined in `apps/desktop/resources/entitlements.mac.plist`.
+
+## Electron updater metadata
+
+| File               | Purpose                                                   |
+| ------------------ | --------------------------------------------------------- |
+| `latest-mac.yml`   | macOS update manifest (merged from per-arch builds in CI) |
+| `latest-linux.yml` | Linux update manifest                                     |
+| `latest.yml`       | Windows update manifest                                   |
+| `*.blockmap`       | Differential download block maps                          |
+
+## iOS (TestFlight)
+
+The iOS build is uploaded directly to App Store Connect / TestFlight by the [Release iOS workflow](../../.github/workflows/release-ios.yml). No IPA artifact is attached to the GitHub Release.
+
+| Detail            | Value                                      |
+| ----------------- | ------------------------------------------ |
+| Bundle ID         | `com.openknots.okcode.mobile`              |
+| Marketing version | `0.23.3`                                   |
+| Build number      | Set from `GITHUB_RUN_NUMBER` at build time |
+
+## Checksums
+
+SHA-256 checksums are not committed here; verify downloads via GitHub's release UI or `gh release download` if you use the GitHub CLI.
+
+## Operational references
+
+| File                                         | Purpose                                                           |
+| -------------------------------------------- | ----------------------------------------------------------------- |
+| [rollout-checklist.md](rollout-checklist.md) | Step-by-step release playbook from preflight through post-release |
+| [soak-test-plan.md](soak-test-plan.md)       | Structured release validation for the highest-risk surfaces       |
diff --git a/docs/releases/v0.23.3/rollout-checklist.md b/docs/releases/v0.23.3/rollout-checklist.md
@@ -0,0 +1,65 @@
+# v0.23.3 Rollout Checklist
+
+Step-by-step playbook for the v0.23.3 release. Each phase must complete before advancing.
+
+## Phase 0: Pre-flight
+
+- [ ] Verify all release package versions are `0.23.3`:
+  - `apps/server/package.json`
+  - `apps/desktop/package.json`
+  - `apps/web/package.json`
+  - `apps/mobile/package.json`
+  - `packages/contracts/package.json`
+- [ ] Verify Android `versionName` and iOS `MARKETING_VERSION` both match `0.23.3`.
+- [ ] Confirm `CHANGELOG.md` has `## [0.23.3] - 2026-04-13`.
+- [ ] Confirm `docs/releases/v0.23.3.md` exists with Summary, Highlights, Upgrade and install, and Release operations sections.
+- [ ] Confirm `docs/releases/v0.23.3/assets.md` exists and lists every expected attachment class.
+- [ ] Confirm `docs/releases/v0.23.3/rollout-checklist.md` and `docs/releases/v0.23.3/soak-test-plan.md` exist.
+- [ ] Confirm `docs/releases/README.md` includes the v0.23.3 row.
+- [ ] Run `bun run release:validate 0.23.3`.
+- [ ] Confirm the working tree is clean.
+- [ ] Confirm you are on `main`.
+
+### Quality gates
+
+- [ ] `bun run fmt:check`
+- [ ] `bun run lint`
+- [ ] `bun run typecheck`
+- [ ] `bun run test`
+- [ ] `bun run --cwd apps/web test:browser`
+- [ ] `bun run test:desktop-smoke`
+- [ ] `bun run release:smoke`
+
+## Phase 1: Publish
+
+- [ ] Push the release-prep commit to `main`.
+- [ ] Create and push tag `v0.23.3`.
+- [ ] Verify the coordinated `release.yml` workflow starts.
+- [ ] Monitor the pipeline through Preflight, Desktop builds, iOS signing preflight, optional iOS TestFlight, Publish GitHub Release, Finalize release, and optional CLI publish if started through manual dispatch.
+
+### Asset verification
+
+- [ ] GitHub Release body matches `docs/releases/v0.23.3.md`.
+- [ ] `okcode-CHANGELOG.md` is attached.
+- [ ] `okcode-RELEASE-NOTES.md` is attached.
+- [ ] `okcode-ASSETS-MANIFEST.md` is attached.
+- [ ] macOS release artifacts are attached: DMG, ZIP, updater manifest, and blockmaps.
+- [ ] Linux release artifacts are attached: AppImage and updater manifest if generated.
+- [ ] Windows release artifacts are attached: installer, updater manifest, and blockmaps.
+- [ ] If the Intel compatibility workflow is run, confirm the x64 macOS DMG is attached separately.
+
+## Phase 2: Post-release verification
+
+- [ ] `npx --yes okcodes@0.23.3 --version` returns `0.23.3`.
+- [ ] macOS installer launches and passes Gatekeeper.
+- [ ] Linux AppImage launches.
+- [ ] Windows installer installs and launches.
+- [ ] Desktop auto-update metadata is present for supported platforms.
+- [ ] If iOS signing was enabled, confirm the new TestFlight build appears.
+- [ ] Confirm the finalize job did not need to push another version-alignment commit, or review its no-op output if versions were already aligned before tagging.
+
+## Phase 3: Follow-through
+
+- [ ] Trigger the Intel compatibility workflow if macOS x64 artifacts are required for this train.
+- [ ] Update external release references or announcements.
+- [ ] Monitor reports for regressions in provider onboarding, auth flows, release packaging, and cross-platform install/update behavior.
diff --git a/docs/releases/v0.23.3/soak-test-plan.md b/docs/releases/v0.23.3/soak-test-plan.md
@@ -0,0 +1,39 @@
+# v0.23.3 Soak Test Plan
+
+Structured validation plan for the highest-risk surfaces in v0.23.3.
+
+## 1. Provider onboarding and auth flows
+
+| Step                                                              | Expected                                                                     | Pass |
+| ----------------------------------------------------------------- | ---------------------------------------------------------------------------- | ---- |
+| Configure each primary provider from Settings                     | Provider setup screens save cleanly and validation messages stay actionable  | [ ]  |
+| Exercise Claude and OpenClaw auth flows after reload              | Saved credentials and provider state restore without stale or conflicting UI | [ ]  |
+| Start a Codex or Copilot-backed conversation after provider setup | Turn creation, streaming, and provider selection remain consistent           | [ ]  |
+| Trigger an auth failure intentionally                             | Errors surface clearly without leaking secrets or breaking follow-up retries | [ ]  |
+
+## 2. Settings and configuration surfaces
+
+| Step                                                       | Expected                                                              | Pass |
+| ---------------------------------------------------------- | --------------------------------------------------------------------- | ---- |
+| Open the settings route on desktop and narrow layouts      | Navigation stays stable and each section is reachable                 | [ ]  |
+| Change provider availability and default options           | Picker filtering and availability controls update without stale state | [ ]  |
+| Use hotkey configuration controls and reset actions        | Shortcuts persist, restore, and do not regress the editor UI          | [ ]  |
+| Open the browser-preview-related settings and helper links | The helper flow launches correctly and does not break the app shell   | [ ]  |
+
+## 3. Runtime and review workflows
+
+| Step                                                            | Expected                                                           | Pass |
+| --------------------------------------------------------------- | ------------------------------------------------------------------ | ---- |
+| Run a thread that emits runtime events and reconnect mid-stream | Session state and event feeds remain consistent after reconnect    | [ ]  |
+| Open the PR review dashboard with recent review history         | Dashboard loads quickly and shows the expected recent activity     | [ ]  |
+| Navigate between threads, projects, and restored sessions       | Cached lookups, projections, and route transitions stay responsive | [ ]  |
+| Trigger browser preview and workspace activity during a turn    | The app avoids flicker, stale panes, and blocked input             | [ ]  |
+
+## 4. Desktop, CLI, and release packaging
+
+| Step                                                                    | Expected                                               | Pass |
+| ----------------------------------------------------------------------- | ------------------------------------------------------ | ---- |
+| Run `bun run test:desktop-smoke` on the release branch                  | Desktop packaging smoke remains green                  | [ ]  |
+| Run `bun run release:smoke` before and after tagging                    | Release-specific workflow checks remain green          | [ ]  |
+| Verify a packaged desktop artifact launches and reports the new version | Installed app opens cleanly and reports v0.23.3        | [ ]  |
+| Verify the CLI package after publish or from a packed tarball           | `okcode --version` and help commands resolve correctly | [ ]  |
diff --git a/packages/contracts/package.json b/packages/contracts/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@okcode/contracts",
-  "version": "0.23.2",
+  "version": "0.23.3",
   "private": true,
   "files": [
     "dist"

Original file line number	Diff line number	Diff line change
`@@ -1,6 +1,6 @@`
`1`	`1`	`{`
`2`	`2`	`"name": "@okcode/desktop",`
`3`		`- "version": "0.23.2",`
	`3`	`+ "version": "0.23.3",`
`4`	`4`	`"private": true,`
`5`	`5`	`"main": "dist-electron/main.js",`
`6`	`6`	`"scripts": {`
Original file line number	Diff line number	Diff line change
`@@ -1,6 +1,6 @@`
`1`	`1`	`{`
`2`	`2`	`"name": "@okcode/mobile",`
`3`		`- "version": "0.23.2",`
	`3`	`+ "version": "0.23.3",`
`4`	`4`	`"private": true,`
`5`	`5`	`"type": "module",`
`6`	`6`	`"scripts": {`
Original file line number	Diff line number	Diff line change
`@@ -1,6 +1,6 @@`
`1`	`1`	`{`
`2`	`2`	`"name": "okcodes",`
`3`		`- "version": "0.23.2",`
	`3`	`+ "version": "0.23.3",`
`4`	`4`	`"license": "MIT",`
`5`	`5`	`"repository": {`
`6`	`6`	`"type": "git",`
Original file line number	Diff line number	Diff line change
`@@ -1,6 +1,6 @@`
`1`	`1`	`{`
`2`	`2`	`"name": "@okcode/web",`
`3`		`- "version": "0.23.2",`
	`3`	`+ "version": "0.23.3",`
`4`	`4`	`"private": true,`
`5`	`5`	`"type": "module",`
`6`	`6`	`"scripts": {`