From 1c56cb7e650fa7bf99c928b8cac9332db7478850 Mon Sep 17 00:00:00 2001
From: AffPapa <270025613+AffPapa@users.noreply.github.com>
Date: Sat, 26 Sep 2026 22:56:49 +0700
Subject: [PATCH] Publish verified NeClip 2.8.7 download metadata
---
BACKLOG.md | 4 +--
CHANGELOG.md | 2 +-
README.md | 22 +++++++++-------
SECURITY.md | 2 +-
artifacts/neclip-audit-20260926/LOOP.md | 3 +++
docs/PROJECT-MAP.md | 6 ++---
docs/RELEASE-2.8.7-STATUS.md | 35 +++++++++++++++++++++++++
docs/backlog.json | 13 ++++-----
docs/changelog.json | 26 +++++++++---------
docs/index.html | 22 ++++++++--------
docs/project.json | 13 ++++-----
docs/version.json | 30 ++++++++++-----------
scripts/test-site.rb | 18 ++++++-------
13 files changed, 120 insertions(+), 76 deletions(-)
create mode 100644 docs/RELEASE-2.8.7-STATUS.md
diff --git a/BACKLOG.md b/BACKLOG.md
index b9b3671..8e06101 100644
--- a/BACKLOG.md
+++ b/BACKLOG.md
@@ -4,9 +4,9 @@ NeClip remains a small local macOS utility: clipboard history, snippet folders
and safe EN/RU layout correction. Accounts, cloud sync, subscriptions,
telemetry, advertising and AI processing are not planned.
-## Current public release — 2.8.6 / build 52
+## Current public release — 2.8.7 / build 53
-Released 26 September 2026 after required Swift CI, CodeQL and secret scan; Developer ID signing, Apple notarization, stapling, Gatekeeper, mounted-DMG and independent public-download checks passed. Download the [NeClip 2.8.6 DMG](https://github.com/AffPapa/neclip/releases/download/v2.8.6/NeClip-2.8.6.dmg) or [ZIP archive](https://github.com/AffPapa/neclip/releases/download/v2.8.6/NeClip-2.8.6.zip). See [release evidence](docs/RELEASE-2.8.6-STATUS.md).
+Released 26 September 2026 after required Swift CI, CodeQL and secret scan; Developer ID signing, Apple notarization, stapling, Gatekeeper, mounted-DMG and independent public-download checks passed. Download the [NeClip 2.8.7 DMG](https://github.com/AffPapa/neclip/releases/download/v2.8.7/NeClip-2.8.7.dmg) or [ZIP archive](https://github.com/AffPapa/neclip/releases/download/v2.8.7/NeClip-2.8.7.zip). See [release evidence](docs/RELEASE-2.8.7-STATUS.md).
- Save any text history item as a raw-text snippet with folder selection and duplicate checks.
- Search local history with bounded text, type, application and date filters.
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6f4f583..c76753e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,6 +1,6 @@
# Changelog
-## 2.8.7 / build 53 — candidate
+## 2.8.7 / build 53 — released 2026-09-26
- Restrict history search shortcuts to its search field and results; preserve native control focus, modified navigation and marked IME text.
- Recheck image capture settings before storing queued screenshots.
diff --git a/README.md b/README.md
index 88739f9..8073932 100644
--- a/README.md
+++ b/README.md
@@ -8,22 +8,22 @@ NeClip — приложение для macOS, которое сохраняет
## Скачать NeClip для Mac
-Актуальная версия: **NeClip 2.8.6 (сборка 52)**. Дата выпуска — 26 сентября 2026 года.
+Актуальная версия: **NeClip 2.8.7 (сборка 53)**. Дата выпуска — 26 сентября 2026 года.
-- [Скачать DMG для Mac](https://github.com/AffPapa/neclip/releases/download/v2.8.6/NeClip-2.8.6.dmg) — 2 142 659 байт.
-- [Скачать ZIP-архив приложения](https://github.com/AffPapa/neclip/releases/download/v2.8.6/NeClip-2.8.6.zip) — 2 109 029 байт.
-- [Открыть страницу релиза NeClip 2.8.6](https://github.com/AffPapa/neclip/releases/tag/v2.8.6).
+- [Скачать DMG для Mac](https://github.com/AffPapa/neclip/releases/download/v2.8.7/NeClip-2.8.7.dmg) — 2 142 658 байт.
+- [Скачать ZIP-архив приложения](https://github.com/AffPapa/neclip/releases/download/v2.8.7/NeClip-2.8.7.zip) — 2 109 242 байт.
+- [Открыть страницу релиза NeClip 2.8.7](https://github.com/AffPapa/neclip/releases/tag/v2.8.7).
Откройте DMG или распакуйте ZIP, перетащите NeClip в «Программы» и запустите. Значок приложения появится в строке меню macOS; постоянный значок в Dock не нужен. Приложение и DMG подписаны Developer ID, прошли нотариальную проверку Apple и содержат билет нотариализации.
Перед установкой можно сверить контрольные суммы SHA-256:
-- DMG: `59e14e6a7ca8a534cfcb0e1cd273216460717fbd84b35795b1e0adc0226bc810` ([файл контрольной суммы](https://github.com/AffPapa/neclip/releases/download/v2.8.6/NeClip-2.8.6.dmg.sha256)).
-- ZIP: `7d267fbd686ac45ecb7e18f5e5be865c385b44a545bfbf5e21a4e42706622de1` ([файл контрольной суммы](https://github.com/AffPapa/neclip/releases/download/v2.8.6/NeClip-2.8.6.zip.sha256)).
+- DMG: `3111009d22c8ad9e56a3951f215c63cfe669786ff0f8596ca8d80ed007e8984a` ([файл контрольной суммы](https://github.com/AffPapa/neclip/releases/download/v2.8.7/NeClip-2.8.7.dmg.sha256)).
+- ZIP: `a7ff40101da09d16c69ac2c5f8535bd1b547a3af84308b823012c3bd8e8f169d` ([файл контрольной суммы](https://github.com/AffPapa/neclip/releases/download/v2.8.7/NeClip-2.8.7.zip.sha256)).
-DMG и ZIP находятся в одном неизменяемом релизе и содержат подписанное, нотарифицированное приложение. Подробности проверок — в [отчёте о выпуске 2.8.6](docs/RELEASE-2.8.6-STATUS.md).
+DMG и ZIP находятся в одном неизменяемом релизе и содержат подписанное, нотарифицированное приложение. Подробности проверок — в [отчёте о выпуске 2.8.7](docs/RELEASE-2.8.7-STATUS.md).
-Исходный коммит приложения: `4e5b827e5f54b1e6b8d0710a74c33467ddc15b5a`.
+Исходный коммит приложения: `2cad4383bcc6d1a7c8c28c6e60bbfe67a3b11be6`.
**Проект Иванова:** [affpapa.org](https://affpapa.org/).
@@ -86,9 +86,11 @@ DMG и ZIP находятся в одном неизменяемом релиз
Инструкции используют синтетические примеры, описывают ограничения и разрешения macOS и ссылаются на официальные страницы сравниваемых продуктов.
-## Изменения в NeClip 2.8.6
+## Изменения в NeClip 2.8.7
-Старые записи истории теперь добавляются в нативное подменю только при его открытии; все записи, порядок, нумерация и действия сохранены. Ссылка «Проект Иванова» опубликована на всех восьми редакционных страницах и в этом README. Синтетический замер построения пунктов для 1 000 записей: p50 0,012 мс для начального ленивого меню и 0,839 мс при создании всех пунктов; это не измерение полной задержки интерфейса. Бинарный файл продуктовой release-сборки отличается от 2.8.5 на 16 байт.
+Поиск истории сохраняет стандартную работу клавиатуры в фильтрах, кнопках и при вводе через IME; модифицированные команды навигации передаются AppKit. Отключение истории изображений учитывается и для скриншотов, уже ожидающих записи. При совпадении заголовка поиск больше не преобразует всё тело записи к нижнему регистру.
+
+Синтетический поиск по 64 записям с телами по 512 КиБ, 30 прогретых release-итераций: p50 164,965 → 3,741 мс; p95 229,571 → 4,187 мс. Это измерение поиска в SQLite и обработки строк, не полной задержки интерфейса.
## Разработка и выпуск
diff --git a/SECURITY.md b/SECURITY.md
index 54a6383..466c90f 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -10,7 +10,7 @@ only when the user explicitly chooses “Check for Updates”.
Release binaries are accepted only after Developer ID signing, Apple
notarization, stapling, Gatekeeper assessment and published SHA-256 verification.
-The only supported public release is `v2.8.6`, with immutable assets and tag.
+The only supported public release is `v2.8.7`, with immutable assets and tag.
Older releases remain superseded and are retained for rollback. GitHub also checks Swift
and workflow source with CodeQL, allows only GitHub-owned Actions referenced by
full SHA and monitors the exact SwiftPM dependency for vulnerabilities. Branch
diff --git a/artifacts/neclip-audit-20260926/LOOP.md b/artifacts/neclip-audit-20260926/LOOP.md
index c852a55..4de0d6d 100644
--- a/artifacts/neclip-audit-20260926/LOOP.md
+++ b/artifacts/neclip-audit-20260926/LOOP.md
@@ -15,3 +15,6 @@ After: synthetic search p50 3.7405 ms, p95 4.187333 ms with identical fixture/to
Physical UI: separate debug bundle and database under /private/tmp/neclip-audit-20260926, screenshot QA forces paused capture. Synthetic editor AX exposes named tools and region actions. Following window close the native automation service repeatedly returned timeoutReached; search physical behavior and VoiceOver audio are not verified. AppKit responder/IME integration tests pass.
Release checkpoint: ASan and TSan full suites passed (371 XCTest, 8 opt-in skips, plus 4 Swift Testing); site/SEO gates passed. Developer ID identity and existing neclip notary profile available. GitHub main requires test/full-history/CodeQL actions, ruby, swift, with strict up-to-date checks; no required approval count. No protection bypass is authorized or needed. Next release candidate 2.8.7 / build 53, old public metadata stays 2.8.6 until downloaded bytes are verified.
+
+Physical follow-up recovered: isolated native search returned expected fixture; Down selected the next row, Ctrl+Option+Up preserved it and filter Return did not paste. Default-size search screenshot reviewed. Screenshot keyboard markup, Undo/Redo and native Save produced a visually checked 720×420 PNG. VoiceOver audio and multi-monitor testing remain unverified.
+PR #71 passed all required CI (Swift CodeQL 17m59s), merged as 2cad4383bcc6d1a7c8c28c6e60bbfe67a3b11be6. Stable release toolchain Swift 6.4.0.34.1 passed strict tests. Exact merged-source release is signed/notarized/stapled/Gatekeeper accepted. Immutable v2.8.7 published 2026-09-26T15:55:01Z with DMG+ZIP and both checksums. Fresh public downloads match local bytes and sidecars. Artifact secret scan clean; source/history scanner reports 258 HEAD commits and 26 side-ref-only commits.
diff --git a/docs/PROJECT-MAP.md b/docs/PROJECT-MAP.md
index 442af18..f5aa35e 100644
--- a/docs/PROJECT-MAP.md
+++ b/docs/PROJECT-MAP.md
@@ -1,8 +1,8 @@
# NeClip project map
-Current public release: **2.8.6 / build 52**. The exact signed artifacts,
+Current public release: **2.8.7 / build 53**. The exact signed artifacts,
source commit and release checks are recorded in
-[RELEASE-2.8.6-STATUS.md](RELEASE-2.8.6-STATUS.md).
+[RELEASE-2.8.7-STATUS.md](RELEASE-2.8.7-STATUS.md).
## Runtime ownership
@@ -22,7 +22,7 @@ source commit and release checks are recorded in
## Release boundary
-Only `v2.8.6` is supported publicly. Its immutable GitHub release contains both
+Only `v2.8.7` is supported publicly. Its immutable GitHub release contains both
the signed, notarized DMG and ZIP; `docs/version.json` records their URLs,
SHA-256 digests and sizes. The release tag points to the exact source commit in
`main`. Verify downloaded bytes before changing either public link.
diff --git a/docs/RELEASE-2.8.7-STATUS.md b/docs/RELEASE-2.8.7-STATUS.md
new file mode 100644
index 0000000..1d42d9c
--- /dev/null
+++ b/docs/RELEASE-2.8.7-STATUS.md
@@ -0,0 +1,35 @@
+# NeClip 2.8.7 release evidence
+
+Published 2026-09-26T15:55:01Z. Immutable release: [v2.8.7](https://github.com/AffPapa/neclip/releases/tag/v2.8.7).
+
+## Source and review
+
+- Exact release source, tag and PR #71 merge commit: `2cad4383bcc6d1a7c8c28c6e60bbfe67a3b11be6`.
+- [PR #71](https://github.com/AffPapa/neclip/pull/71): three focused runtime fixes; no unrelated changes.
+- Required Swift CI, CodeQL Actions/Ruby/Swift and full-history Secret Scan passed before merge. No branch protection bypass.
+- Previous immutable v2.8.6 and its files remain unchanged.
+
+## Reproductions and validation
+
+- Before: keyboard regression failed 18 modifier assertions; queued image test stored one screenshot after opt-out. After: focus-aware search shortcuts, marked-text pass-through and insertion-time image opt-out pass.
+- Debug, strict release, ASan and TSan: 371 XCTest, 8 expected opt-in skips, 0 failures; 4 Swift Testing checks. Release-toolchain strict tests also passed.
+- Site: 14 tests / 45 assertions; SEO: 13 tests / 37 assertions; all eight canonical pages and project attribution verified locally.
+- Secret scans: detector self-tests, publishable tree and fetched Git history passed; ignored third-party build fixtures are excluded from the publishable tree scan.
+- Synthetic in-memory SQLite, 64 text rows × 512 KiB ASCII bodies, matching titles, 30 warmed release iterations on macOS 27.0 (26A5416b), arm64, Swift 6.4.0.27.1: p50 164.964791 → 3.7405 ms; p95 229.571209 → 4.187333 ms. Same fixture/configuration before and after. No end-to-end UI speed claim.
+- Signed release compiler: stable Xcode, Swift 6.4.0.34.1; separately passed strict release tests.
+- Physical isolated debug UI: synthetic screenshot editor tools exposed by AX; menu shows paused capture and two fixture rows; search fixture B returns only B; Down selects next result; Ctrl+Option+Up does not change selection; Return with filter focus does not paste/close. Default-size search screenshot inspected. Synthetic screenshot keyboard region, Undo/Redo and native Save exported a visually checked 720×420 PNG with opaque markup. Initial automation timeouts recovered by relaunch.
+
+## Signed public artifacts
+
+Developer ID signing, app/DMG notarization and stapling passed. App extracted from ZIP and mounted DMG pass signature, stapler and Gatekeeper checks. Both artifacts and SHA-256 sidecars were attached before immutable publication. Fresh independent public downloads match local files and sidecars.
+
+| Artifact | Size | SHA-256 | Download |
+| --- | ---: | --- | --- |
+| DMG | 2,142,658 bytes | `3111009d22c8ad9e56a3951f215c63cfe669786ff0f8596ca8d80ed007e8984a` | [NeClip-2.8.7.dmg](https://github.com/AffPapa/neclip/releases/download/v2.8.7/NeClip-2.8.7.dmg) |
+| ZIP | 2,109,242 bytes | `a7ff40101da09d16c69ac2c5f8535bd1b547a3af84308b823012c3bd8e8f169d` | [NeClip-2.8.7.zip](https://github.com/AffPapa/neclip/releases/download/v2.8.7/NeClip-2.8.7.zip) |
+
+## Limits and deferred P2
+
+VoiceOver audio, multiple monitors/Spaces, real ScreenCaptureKit permission flows and all supported macOS versions were not certified. No user history or installed app was modified. Deferred: token insertion caret behavior, screenshot-title dimensions after padded export, unnecessary clipboard read for literal snippets. Screenshot clipboard failure rollback remains an unconfirmed concern.
+
+Pages/README publication is verified separately after the metadata PR deploy. [Проект Иванова](https://affpapa.org/).
diff --git a/docs/backlog.json b/docs/backlog.json
index 49c3959..9a8ef2b 100644
--- a/docs/backlog.json
+++ b/docs/backlog.json
@@ -1,10 +1,10 @@
{
"currentRelease": {
- "version": "2.8.6",
- "build": 52,
- "release": "https://github.com/AffPapa/neclip/releases/download/v2.8.6/NeClip-2.8.6.dmg",
- "appArchive": "https://github.com/AffPapa/neclip/releases/download/v2.8.6/NeClip-2.8.6.zip",
- "evidence": "https://github.com/AffPapa/neclip/blob/main/docs/RELEASE-2.8.6-STATUS.md"
+ "version": "2.8.7",
+ "build": 53,
+ "release": "https://github.com/AffPapa/neclip/releases/download/v2.8.7/NeClip-2.8.7.dmg",
+ "appArchive": "https://github.com/AffPapa/neclip/releases/download/v2.8.7/NeClip-2.8.7.zip",
+ "evidence": "https://github.com/AffPapa/neclip/blob/main/docs/RELEASE-2.8.7-STATUS.md"
},
"done": [
"2.6.0: history actions, local search, trust status, screenshot QA, token preview, starter snippets and database backup/restore",
@@ -20,7 +20,8 @@
"2.8.3: clipboard-generation guards, validated record-only restore, private atomic backups and precise screenshot editing with optional backgrounds",
"2.8.4: native menu Return routing, explicit privacy-aware snippet history, draft merge safety, file search decoding, streamed reads and cancellation-safe screenshot restart; synthetic-image Save dialog PNG/JPEG/cancel/reopen verified",
"2.8.5: finish screenshot exports after the editor is hidden; reduce brace-heavy template scanning; independently verified signed and notarized public release",
- "2.8.6: defer older history rows until opened; publish project attribution on all public pages; sign/notarize and independently verify DMG and ZIP"
+ "2.8.6: defer older history rows until opened; publish project attribution on all public pages; sign/notarize and independently verify DMG and ZIP",
+ "2.8.7: respect native search focus and IME, reject queued images after opt-out, avoid redundant full-body normalization"
],
"inDevelopment": [],
"next": [
diff --git a/docs/changelog.json b/docs/changelog.json
index 7e5f220..34f4aa0 100644
--- a/docs/changelog.json
+++ b/docs/changelog.json
@@ -1,9 +1,22 @@
{
"versions": [
+ {
+ "version": "2.8.7",
+ "build": 53,
+ "status": "released",
+ "date": "2026-09-26",
+ "changes": [
+ "Preserve filter/button, VoiceOver and IME keyboard handling in history search.",
+ "Recheck image history opt-out before queued screenshot storage.",
+ "Skip full-body lowercase when the title already matches.",
+ "371 XCTest (8 opt-in skips) and 4 Swift Testing checks; strict Swift 6, ASan, TSan, required CI, CodeQL and Secret Scan passed.",
+ "Developer ID signing, notarization, stapling, Gatekeeper and independent public DMG/ZIP byte verification passed."
+ ]
+ },
{
"version": "2.8.6",
"build": 52,
- "status": "released",
+ "status": "superseded",
"changes": [
"Build older history menu rows only when the user opens the submenu, preserving all entries, order, numbering and actions",
"Add the project owner link to all eight editorial pages and the repository README",
@@ -11,17 +24,6 @@
"Developer ID signing, Apple notarization, stapling, Gatekeeper checks and independent public DMG/ZIP download verification passed"
]
},
- {
- "version": "2.8.7",
- "build": 53,
- "status": "candidate",
- "date": "2026-09-26",
- "changes": [
- "Preserve filter/button, VoiceOver and IME keyboard handling in history search.",
- "Recheck image history opt-out before queued screenshot storage.",
- "Skip full-body lowercase when the title already matches."
- ]
- },
{
"version": "2.8.5",
"build": 51,
diff --git a/docs/index.html b/docs/index.html
index 5594559..9ce9e8b 100644
--- a/docs/index.html
+++ b/docs/index.html
@@ -15,7 +15,7 @@
-
+
@@ -26,17 +26,17 @@
Старые пункты меню строятся только при открытии «Ещё из истории»; все записи, нумерация, порядок и действия сохранены
Ссылка «Проект Иванова» добавлена на все восемь редакционных страниц и в README
Начальное меню создаёт только видимые записи; синтетические замеры измеряют создание пунктов, а не полную задержку интерфейса
367 XCTest (7 ожидаемых пропусков) и 4 Swift Testing прошли; strict Swift 6, обязательные CI, CodeQL и secret scan прошли. DMG и ZIP подписаны, нотарифицированы, закреплены и приняты Gatekeeper.
Поиск сохраняет нативную работу фильтров, кнопок, модифицированных клавиш и IME
Отключение истории изображений учитывается перед записью скриншота из очереди
При совпадении заголовка поиск пропускает лишнее преобразование большого текста
371 XCTest (8 ожидаемых пропусков) и 4 Swift Testing прошли; strict Swift 6, ASan, TSan, обязательные CI, CodeQL и secret scan прошли. DMG и ZIP подписаны, нотарифицированы и приняты Gatekeeper.