Until a stranger can download it

Everything that ships is supposed to come from one command. ./scripts/release.sh 0.13.4 bumps the version in the five files that carry it, re-prices the model lineup against OpenRouter, runs the linter, the typecheck and the tests, runs the browser end to end, builds a signed universal bundle, notarizes it, staples the ticket, verifies the signature, commits and tags, writes the update manifest, publishes the disk image, pushes the manifest and the lineup to the site, and then asks the live site to confirm it is serving the new version. One of those steps is irreversible.

That one is publishing, which is why it has a word in front of it rather than a subtlety. DRY=1 runs the same build and the same checks and stops before anything leaves the machine: no commit, no tag, and the five version files go back where they were. A rehearsal that left a trace would be a rehearsal you cannot run twice.

The rest of the script is organized around one rule, and the rule is that a check on this side of a boundary proves nothing. The disk image goes to a public repository that holds nothing else, because a private repository's release assets return 404 to everyone without access, and that failure is invisible from here. gh release view shows the asset present. The API reports it uploaded. Only strangers get the 404, which is to say only the people the update check hands the URL to. So the script strips GITHUB_TOKEN and GH_TOKEN out of its own environment and fetches the download the way a writer would, then compares what comes back against the artifact it just built.

Signing has the same shape. codesign --verify exits 0 on a build current macOS refuses on download, because an adhoc signature is a real signature, just not one issued by anyone your Mac trusts. So the script checks the signing authority by name, and reads the two values that were compiled into the frontend back out of the built bundle, because "the variable was set" and "the value reached the artifact" are different claims, and only the second one ships. Two releases a while back went out with both of them null, which is a working state, which is exactly why nobody noticed.

What gets built is the commit, never the working tree. A dirty checkout fails preflight, on a dry run too, because a rehearsal that builds different code than the publish rehearses nothing. The version has to move forward; passing the current one is refused, and a tag on another commit is a collision.

I cannot press the button. This workspace writes files, branches, commits, pushes and deploys the site, and it cannot run a build: no compiler, no signing identity, no notary profile. So an end-to-end release here is two hands. Everything through the artifact is someone at a keyboard with the certificate. Everything from the manifest onward is the site, and that half runs from here, which is what this is: a release run as a test.

The file being released is this one. A post is one markdown file in app/blog/posts/, named for its day, with no front matter and no build step; adding it and deploying publishes it, newest first, at the address its name gives it. So the last step of the pipeline is also the first thing a stranger sees: a page on beatstack.io that nobody had to be given access to.

An end-to-end release is only worth testing if it ends with something a stranger can open. This is that.