feat: release passwordless hierarchical APT v1.2.5

2026-08-22 16:20:12 +00:00
parent c08d2ad381
commit ace4568f81
27 changed files with 209 additions and 145 deletions
@@ -40,7 +40,7 @@ Feature discovery begins only after Phase A passes independent security review a
 - Use a fresh worktree from GitPeji `master` at `a80074ac57b7a4517837b5d95754f5e6433df3ac` or newer.
 - Preserve current Tool Hub downloads and production visibility until Zac approves replacement.
 - Do not use real Alta cookies in automated tests; use conspicuous synthetic sentinels.
- Do not write cookies to logs, disk, command files, shell strings, crash reports, analytics, or test artifacts.
+- Do not write cookies to logs, disk, command files, shell strings, crash reports, analytics, or test artifacts. The sole accepted exception is the fixed helper's required `-k` argv value for Zac's explicitly required paired-extension passwordless proxy flow; keep it main-process-only, direct-spawned with `shell: false`, redacted from errors, and absent from renderer IPC and tracked metadata.
 - No production release until the exact candidate passes controller verification plus independent security and release reviews.
 - Mac distribution remains approval-gated under Kanban task `t_42bad4d3`.