Packaging and release discovery

2.2.0 preparation

Build 66 prepares Tasks, guarded abandoned-task recovery, protected cleared-history retention, a native menu-bar menu and PNG/JPEG/WebP comparison in the shared project diff viewer. Projects defaults to full-height Diff, with font sources and project actions in Config. Saved Glyphs sources can create verified package copies while retaining the original and refusing overwrites. The public catalog adds passive list_tasks: twenty-one data/action tools and one optional display tool. Local unsigned qualification does not establish signing, notarization or native/upgrade acceptance. Published downloads and feeds remain 2.1.0 until separately qualified publication. See the preparation record.

2.1.0 release

Stable build 63 adds clearer workflow result actions and persistent receipts, optional card display, project template previews and readable skill titles. The full gate passed 2,980 Python tests and 270 desktop tests; final signed runtimes, manual VM upgrade, native exports and public downloads were verified before feed promotion. See 2.1.0 qualification.

2.0.4 release

Stable build 61 fixes default Glyphs Python detection and FontTools export verification, adds a conditional Glyphs 4 copy selector and an installation override, improves Setup hierarchy and records correlated diagnostics. The full gate passed 2,952 Python and 263 desktop tests. Exact signed VM installation, six static export containers and a live publish/discard cycle passed with official Glyphs Python 3.14.6. Public archives were verified before promoting the signed stable feed. See 2.0.4 qualification.

Earlier 2.0.3 release

Stable build 59 exposes twenty tools, including save-free Edit tabs and document duplication. Already-authorized script Apply runs directly while explicit previews wait; current-state memory recovery remains available. Curve Inspector 0.5.2 explains no-change results. The existing signed, notarized and stapled universal artifacts were reused after 149 focused tests and bounded native verification. Swift implementation and distributed dependencies are unchanged from build 58; the full Swift/VM matrix was not repeated. See 2.0.3 qualification.

Earlier 2.0.2 release

The published build 57 release exposes eighteen tools, adding compare_fonts for compiled TTFs. Startup and Skills share background payload verification. Optional Setup installers require separately signed and qualified distributions. The catalog keeps Diffenator and the updated Beztrace companion unavailable until those assets and architecture acceptance exist.

Source checks cover comparison jobs, publication integrity, optional ownership, SDK provenance and startup coalescing/retry. The real Diffenator adapter has nine compiled-fixture checks on Apple Silicon with private Python 3.11.16. Follow-up signed optional packages passed bounded native/offline checks on macOS 26.7.1 arm64, including 0.44–0.50-second startup presentation and fresh-panel Beztrace tracing. Exact signed desktop update/migration and native recovery/login checks passed on macOS 14.6.1 and 26.6.2 arm64. Hosted optional assets, physical Intel and exact macOS 14.0 remain unverified. See the repository 2.0.2 qualification record. The corpus has 1,100 indexed documents with separate web and file-format authority provenance. Published evidence below retains its original scope.

Glyphs MCP 2.0.0, desktop build 55, uses the stable channel. Its universal app, payload and DMG are Developer ID-signed and Apple-notarized. Signed fresh-install, beta-to-stable desktop update, component migration/recovery and v1 migration checks passed on macOS 14.6.1 Apple silicon with Glyphs 4.1.1/build 4108. Exact macOS 14.0/current-macOS native acceptance and physical Intel execution remain unverified.

The published 2.0.0 payload includes eleven managed skills, thirteen tools, up to thirteen capability-gated job kinds, the Glyphs 4 bridge, sidecar, two optional inspectors, Cursor plugin, private runtimes and stable Beztrace 0.1.1 engine. Published 2.0.1 added four document tools: open_document, import_document, activate_document and close_document, bringing the catalog to seventeen. Its bounded signed/native acceptance is recorded separately. The independent Beztrace Glyphs plugin has its own installation. Glyphs 3 remains on its separate pinned v1.11.0 release. See qualification and version identity.

Build, sign and notarize locally on the maintainer’s Mac. GitHub Actions deploys documentation, not release artifacts. The source tag records the exact build inputs; reuse sealed artifacts and accepted receipts when those inputs are unchanged.

The installer manifest and receipt describe the runtime, bridge and companions independently, with dependencies and verified identities. Signing changes file identities; regenerate and verify manifests after signing and stapling, before packaging the final installer. Unsigned/local checks alone do not establish Developer ID, notarization or signed-update acceptance. Record those results for the exact final artifacts.

Stable deliverables

• Glyphs-MCP-2.1.0.dmg: signed and notarized installer.
• Glyphs-MCP-2.1.0.zip: Sparkle-signed desktop application archive.
• Glyphs-MCP-latest.dmg: byte-identical alias of the verified stable DMG. The compatibility Glyphs.MCP.zip and SHA256SUMS complete the inventory.
• appcast.xml: the signed stable feed, published unchanged after public archive verification.
• Checksums cover the exact release inventory; source and acceptance receipts identify the qualified build.

Keep local acceptance evidence containing private font paths out of public release assets unless reviewed for sharing. Store notarization credentials in Keychain.

Discoverable releases

The desktop uses checksum-pinned Sparkle and PierreDiffsSwift packages. Build receipts verify the Pierre package resource bundle and the exact bundled @pierre/diffs and Shiki JavaScript identities. Check for Updates runs on demand; automatic checking is enabled by default and can be disabled in Settings. The 2.1.0 release uses the stable feed https://raw.githubusercontent.com/thierryc/Glyphs-mcp/main/appcast.xml and archives under its signed v2.1.0 tag. The preserved Beta feed stays separate at lit/v2-beta/appcast.xml. Sparkle update ordering uses increasing installer builds, not the marketing-version label. A configured feed is not proof that it is publicly available.

The local publishing scripts verify source refs, signatures, checksums and uploaded asset identities before publication, then verify the exact release by tag. A beta must be a prerelease with make_latest=false; confirm that the stable Latest release is unchanged. A local build or a draft is not a public release. Publish only as a separately authorized step and update the documentation's candidate status and /latest destination accordingly.

See Release validation and documentation maintenance.

Local desktop build

Run scripts/build_desktop_release.sh with the verified Python build environment. It prepares checksum-pinned Sparkle, builds and signs the app and nested components, notarizes and staples, creates the DMG, and creates dist/desktop-update/ with the signed archive, feed candidate and checksums. It never publishes.

The Sparkle signing key stays in Keychain under account cx.ap.glyphsMcp, separate from the Developer ID certificate. Never export it into the repository. Application updates are separate from component migrations; acceptance must exercise a signed older-to-newer app update and component rollback.

Published 2.0.1 added Open, Import, Activate and Close under the matching document.*.v1 capabilities, bringing the public tool count to seventeen. create_document remains available under document.create.v1. See the current command reference for explicit unsaved handling, retry safety and separate Save As.