Fix release trust and prepare ShadowCode 2.3.3

.github/workflows/release.yml

@@ -39,6 +39,31 @@ jobs:
           assert.match(env.SIGNING_ENVIRONMENT || '', /^[A-Za-z0-9][A-Za-z0-9 _.-]{0,254}$/, 'Provision an existing protected signing environment');
           appendFileSync(env.GITHUB_OUTPUT, `tooling=${env.TOOLING_COMMIT}\nenvironment=${env.SIGNING_ENVIRONMENT}\n`);
           NODE
+      - name: Checkout reviewed signing policy
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          ref: ${{ steps.validate.outputs.tooling }}
+          path: trusted-policy
+          persist-credentials: false
+      - name: Checkout candidate policy
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          path: candidate-policy
+          persist-credentials: false
+      - name: Check reviewed and candidate trust cover the release
+        run: |
+          node --input-type=module <<'NODE'
+          import assert from 'node:assert/strict';
+          import { readFile } from 'node:fs/promises';
+          import { parseTrustPolicy, compareVersions } from './trusted-policy/scripts/native-release-auth.mjs';
+          const trusted = await readFile('trusted-policy/release/trust/policy');
+          const candidate = await readFile('candidate-policy/release/trust/policy');
+          assert(trusted.equals(candidate), 'Candidate and independently reviewed trust policies differ');
+          const policy = parseTrustPolicy(trusted), version = process.env.GITHUB_REF_NAME.slice(1);
+          for (const target of ['x86_64-unknown-linux-gnu', 'aarch64-unknown-linux-gnu']) assert(policy.targets.includes(target), `Trust policy lacks ${target}`);
+          assert(compareVersions(version, policy.minimumVersion) >= 0, 'Release is below the trust floor');
+          assert(policy.keys.some(key => key.epoch >= policy.minimumEpoch && compareVersions(version, key.minimum) >= 0 && compareVersions(version, key.maximum) <= 0), 'No trusted key interval covers this release');
+          NODE
   build:
     needs: configuration
     runs-on: ubuntu-24.04

CHANGELOG.md

@@ -2,7 +2,11 @@
 
 ## Unreleased
 
-## 2.3.2: Desktop reliability
+## 2.3.3: Desktop reliability
+
+Extends the existing Linux release signing key trust interval through 2.3.3. The tagged 2.3.2 candidate was not published because its trust interval ended at 2.3.1.
+
+## 2.3.2: Desktop reliability (unpublished candidate)
 
 - Relocate bundled WebKit helper paths so AppImages do not depend on the build host's Debian filesystem layout. Verify relocation against the shipped library bytes.
 - On compatible non-Debian desktop layouts, select a complete host WebKit/GTK stack to avoid mixing newer Mesa drivers with the bundled Debian graphics stack. Both helper executables and all native dependencies are checked; the bundled fallback remains available. No sandbox is disabled.

Cargo.toml

@@ -5,7 +5,7 @@ exclude = ["vendor/glib-0.18.5"]
 resolver = "2"
 
 [workspace.package]
-version = "2.3.2"
+version = "2.3.3"
 edition = "2021"
 rust-version = "1.95"
 license = "Apache-2.0"

docs/PLATFORM_QUALIFICATION.md

@@ -1,5 +1,7 @@
 # Physical-machine platform qualification
 
+The 2.3.3 candidate carries the 2.3.2 candidate fixes and extends the existing Linux signing-key interval through 2.3.3. Evidence below is for the 2.3.2 candidate and does not qualify the 2.3.3 artifacts; final package and physical-device testing remains pending.
+
 ## 2.3.2 candidate — November 1, 2026
 
 This is a qualification record, not a claim that the candidate has been released.

docs/RELEASE_NOTES.md

@@ -1,3 +1,7 @@
+# ShadowCode 2.3.3 — candidate
+
+This candidate includes the desktop fixes described below and extends the existing Linux release signing key trust interval through 2.3.3. The 2.3.2 tag was not published: its trusted key interval ended at 2.3.1. Final artifacts and physical-device qualification remain pending.
+
 # ShadowCode 2.3.2 — candidate
 
 This source candidate addresses an AppImage desktop-startup failure reproduced on

packaging/com.shadowfetch.shadowcode.appdata.xml

@@ -29,7 +29,7 @@
     <binary>shadowcode</binary>
   </provides>
   <releases>
-    <release version="2.3.2" date="2026-11-01">
+    <release version="2.3.3" date="2026-11-01">
       <description><p>Improves AppImage startup on rolling Linux desktops, model-picker focus, and platform keyboard hints.</p></description>
     </release>
     <release version="2.3.1" date="2026-10-31">

packaging/shadow-agent.desktop

@@ -13,4 +13,4 @@ Keywords=agent;llm;coding;shadowfetch;
 StartupNotify=true
 StartupWMClass=shadowcode
 X-GNOME-UsesNotifications=true
-X-ShadowCode-Version=2.3.2
+X-ShadowCode-Version=2.3.3

release/trust/policy

@@ -7,4 +7,4 @@ channel=stable
 minimum-epoch=1
 minimum-version=0.33.0
 keys=ed25519-spki-sha256
-key=1	f0c60ff8228314616985712f8918c9798c0ecf72b7271e19343a041c25663b7f	0.33.0	2.3.1
+key=1	f0c60ff8228314616985712f8918c9798c0ecf72b7271e19343a041c25663b7f	0.33.0	2.3.3

scripts/test-native-release-signing.mjs

@@ -155,7 +155,7 @@ test('release workflow separates untrusted build from protected signing and writ
 });
 test('workflow configuration fails closed without real provisioning; fixture-only inputs exercise its parser', () => testFixture(async f => {
   const workflow = await readFile(new URL('../.github/workflows/release.yml', import.meta.url), 'utf8');
-  const body = /        run: \|\n([\s\S]*?)\n  build:/.exec(workflow)[1].replace(/^          /gm, '');
+  const body = /        run: \|\n([\s\S]*?)\n      - name:/.exec(workflow)[1].replace(/^          /gm, '');
   const env = { ...process.env, GITHUB_REPOSITORY: context.repo, REPOSITORY_ID: IDENTITY.repositoryId, OWNER_ID: IDENTITY.ownerId, GITHUB_EVENT_NAME: 'push', GITHUB_REF_TYPE: 'tag', GITHUB_REF_NAME: context.tag, TOOLING_COMMIT: '', SIGNING_ENVIRONMENT: '', GITHUB_OUTPUT: path.join(f.root, 'configuration-output') };
   const run = extra => spawnSync('bash', ['-euo', 'pipefail', '-c', body], { env: { ...env, ...extra }, encoding: 'utf8', timeout: 20000 });
   assert.notEqual(run({}).status, 0);

src-tauri/tauri.conf.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://schema.tauri.app/config/2",
   "productName": "ShadowCode",
-  "version": "2.3.2",
+  "version": "2.3.3",
   "identifier": "com.shadowfetch.shadowcode",
   "build": {
     "beforeDevCommand": {

ui/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shadow-agent-ui",
-  "version": "2.3.2",
+  "version": "2.3.3",
   "private": true,
   "license": "Apache-2.0",
   "type": "module",