chore: release 0.1.7

[steipete]

Prepare v0.1.7 with the macOS Developer ID signing and notarization fix as the release highlight. Finalize the dated changelog section and set the source version to 0.1.7 so source installs report the same version as release binaries.

The signed release migration landed in #9. Validation: CLI/application tests and a source-built blu --version returning 0.1.7; independent P0–P2 review. Release publication will use the shared workflow after exact-head CI passes.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed September 14, 2026, 11:17 AM ET / 15:17 UTC.

ClawSweeper review

What this changes

Dates the 0.1.7 changelog, highlights signed and notarized macOS downloads, and makes source builds report version 0.1.7.

Merge readiness

✅ Ready for maintainer review

Keep open: this release preparation remains necessary and follows the documented release process. No actionable defect was found; owner-authored work and the repository profile also prohibit automatic closure.

Priority: P3
Reviewed head: 7a21c2293273395c5f87869b3913144c6a967923

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused release update that follows the existing contract and has no identified correctness or security defect.
Proof confidence	🌊 off-meta tidepool	Not applicable: The OWNER-authored PR is exempt from the external-contributor proof gate; its body reports source-built version output of 0.1.7, which directly matches the changed CLI behavior.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: The OWNER-authored PR is exempt from the external-contributor proof gate; its body reports source-built version output of 0.1.7, which directly matches the changed CLI behavior.
Evidence reviewed	7 items	Verified introduced scope: The pinned base-to-head diff changes only the dated changelog section and the source version string; no publishing workflow, dependency, permission, or signing implementation changes are introduced. Existing release contract: The release guide explicitly requires a dated changelog with Highlights and an updated source version. GoReleaser continues to override main.version with the release version; existing CLI tests cover forwarding that value to version output. Current main still needs the version update: Current main retains the dev source-version default. GitHub independently returned this same main SHA.
Findings	None	None.
Security	None	None.

How this fits together

blucli controls BluOS devices from the command line. Its release metadata supplies the source-build version output and the changelog section used by the existing publishing workflow.

flowchart LR
  A[Source version] --> B[CLI startup]
  B --> C[Version output]
  D[Dated changelog] --> E[Release workflow]
  F[Release version] --> E
  E --> G[Versioned downloads and release notes]

Loading

Before merge

None.

Agent review details

Security

None.

Review metrics

None.

Technical review

Best possible solution:

Keep source-install version output and dated release notes aligned through the existing documented publishing process.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this is release preparation, and source inspection confirms the version value reaches the existing CLI output path.

Is this the best way to solve the issue?

Yes: the two-file update follows docs/releasing.md and preserves the existing linker override for packaged binaries.

AGENTS.md: found, but no applicable review policy affected this item.

Codex review notes: model internal, reasoning medium; reviewed against dbe6571e4a1e.

Labels

Label changes:

• add P3: This is a narrowly scoped release-metadata update; the signing implementation already landed separately.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: The OWNER-authored PR is exempt from the external-contributor proof gate; its body reports source-built version output of 0.1.7, which directly matches the changed CLI behavior.

Label justifications:

• P3: This is a narrowly scoped release-metadata update; the signing implementation already landed separately.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: The OWNER-authored PR is exempt from the external-contributor proof gate; its body reports source-built version output of 0.1.7, which directly matches the changed CLI behavior.

Evidence

What I checked:

• Verified introduced scope: The pinned base-to-head diff changes only the dated changelog section and the source version string; no publishing workflow, dependency, permission, or signing implementation changes are introduced. (cmd/blu/main.go:12, 7a21c2293273)
• Existing release contract: The release guide explicitly requires a dated changelog with Highlights and an updated source version. GoReleaser continues to override main.version with the release version; existing CLI tests cover forwarding that value to version output. (docs/releasing.md:53, dbe6571e4a1e)
• Current main still needs the version update: Current main retains the dev source-version default. GitHub independently returned this same main SHA. (cmd/blu/main.go:12, dbe6571e4a1e)
• Published release: GitHub reports v0.1.6 as the latest release, published 2026-09-14T06:48:33Z; this review does not establish publication of v0.1.7.
• Merged prerequisite: GitHub verifies fix(release): sign and notarize macOS downloads #9 as merged at the current main SHA. It supplies the signing implementation described by this release's highlight, but does not finalize the release metadata. (.github/workflows/release-unified.yml:21, dbe6571e4a1e)
• Release-area history: The release instructions were added by the current-main commit, verified against its raw recorded parent. Peter Steinberger also appears throughout the available release and CLI history. Older follow-history and blame traversal encountered unavailable Git objects, so routing rests on the directly inspected recent change. (docs/releasing.md:55, dbe6571e4a1e)

Likely related people:

• unknown: The claimed source-line change could not be verified from bounded local history. (role: source history unknown; confidence: low)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.