[blessdyb]

Summary

• show the exact embedded JavaScript and complete 64-character package/script SHA-256 values before plugin installation
• keep large source and all permissions/privacy declarations reviewable in a bounded sheet with pinned actions
• discard package-supplied local configuration and reject invisible Unicode formatting controls that could misrepresent reviewed source
• publish 0.15.14/61 documentation and generated site output while leaving the direct extension at 0.15.4/27

Verification

• 856 macOS tests passed with zero failures
• focused plugin/demo suite passed 26 tests, including red-to-green package-configuration proof and Unicode format-control coverage
• Developer ID candidate modal accepted on this Mac with full digests, exact source, pinned actions, and all supported permission/privacy categories visible
• Mac App Store graph built as 0.15.14/61 with its app extension present and direct system extension/helper absent
• Xcode project drift, site, localization, and diff gates passed
• independent trust-boundary review found no residual concrete issues

Release discipline

• no tag or publication yet
• immutable tag only after exact-head CI and CodeQL are green
• signed dry run before production publication
• public artifact verification before merge

🤖 Generated with Claude Code