Changelog

Archivist Sort · Centennial Defense Systems

2.3.0 (current)

Rebuilt 2026-08-21 — Developer ID signed, notarized, stapled, Gatekeeper-accepted. 808 engine/CLI + 276 UI tests passed at the release build; one timing test ignored.

• Home is Cleanse and Structure — one spine: folder → scan → findings → exact plan → licensed execute → journal rollback. Cleanse decides Keep/Quarantine/Skip. Organize is Findings → Apply folder plan, not a second app. Structure Studio stays in the sidebar, not a home tile. Archive and Guard are no longer home tiles: Archive was a report that moved nothing, and Guard folder watch does not ship. Two jobs you can finish beat four tiles where two are promises.
• Packs after the loop — Home scan chips stay Sort (quick), Duplicates (full hash), and Free space (full hash). Photos, Models, Downloads, Inbox, and Caches are not home tiles. Photos & video is a secondary Findings date pack (extension buckets), not RAW+JPEG same-stem pairing. Models, caches, and inbox stay CLI.
• Decide stays one card — Keep / Quarantine / Skip for exact duplicates, perceptual duplicates, migration artifacts, and backup artifacts. Version families are not a home mode and not a fifth radio. The engine does not emit a version-family finding.

2.2.0

Shipped 2026-08-19 — Developer ID signed, notarized, stapled, Gatekeeper-accepted. 785 engine/CLI tests + 161 UI tests green at the release build.

• Free to plan, paid to execute — downloading, scanning, reviewing findings, generating plans, and simulating are now free and unlimited. A one-time $29 licence adds executing a plan through Sort. The plan is free; the undo is the product.
• The app opens onto your Mac — instead of a seven-step wizard and a permissions banner, the first screen reads your disk read-only and names one true thing about it, including a file you recognise. That first look says looks copied, never duplicates. Nothing moves, and it says so.
• Licences verify locally — Ed25519 signature checked on your own machine. No activation call, no seat tracking, no machine fingerprinting. Install the licence file in the app (Settings → Licence), not a typed command.
• Fixes — the default first-look volume list no longer claims to pick the largest disk by a measurement it could not take, and the census no longer blocks the app's other work while it runs.

2.1.1

Shipped 2026-08-19 — Developer ID signed, notarized, stapled, Gatekeeper-accepted. 742 engine/CLI tests + 149 UI tests green at the release build.

• CLI and agent kit work on your machine — fixes the 2.1.0 issue below. The policy bundle, report schema, and report template are now compiled into the binary instead of resolved from a path on our build machine, so review, execute, and purge run anywhere. --bundle, --report-schema, and --report-template still override. The desktop app is unchanged — it always embedded them.
• Regression guard — the build now fails if any shipping code resolves a build-machine path, so this class of defect cannot ship again.
• Agent kit rebuilt from current source; the 2.1.0 kit carried stale setup docs describing the retired fixed-string acknowledgement.

If you are on the 2.1.0 CLI or agent kit, replace both files. Re-download from the link in your receipt; the checksums on that page are updated.

2.1.0

Shipped 2026-08-19 — Developer ID signed, notarized, stapled, Gatekeeper-accepted. 735 engine/CLI tests + 149 UI tests green at the release build.

• Four mode tiles on the 2.1.0 home picker — that version listed Cleanse, Structure, Archive, and Guard. Cleanse and Structure ran the scan → review → approve → receipt → rollback spine. Archive was a stale/offload report and did not move files. Guard was listed so the spine was visible — folder watch did not ship.
• Migration preset — a new-Mac cleanup flow that surfaces migration leftovers.
• Archive reports + Guard watch proposals — cold-storage offload suggestions. No standing weekly watch in 2.1.0.
• Receipt share card — a before/after receipt export you can post.

Engine hardening from an adversarial review (2026-08-19)

• Plan-bound acknowledgement — the mutation acknowledgement now carries the plan's own checksum, so it is plan-specific rather than a fixed string. The safety model stays recovery, not prevention: quarantine instead of delete, receipts, byte-verified rollback.
• Agent-visible review queue — duplicate and organization proposals now appear in the non-interactive plan artifact, so a CLI or MCP caller can present them for approval instead of only an interactive terminal seeing them.
• Hardlink-aware recoverable space — a hardlink shares one copy of the bytes on disk, so it no longer counts toward reclaimable space or gets proposed as a redundant copy. (APFS clones are not detected yet; recoverable space can over-count for cloned files.)
• Fixes — model-census paths work for any user and across the /private firmlink; a missing-acknowledgement error now names the phrase that plan actually needs; purge validates its acknowledgement before checking eligibility.

Known issue in 2.1.0 — CLI and agent kit do not run on your Mac

Found 2026-08-19, after release. The shipped CLI resolves its policy bundle to an absolute path on our build machine, and the CLI zip does not carry that bundle, so review, execute, and purge fail on any other machine with a file-not-found error. scan and simulate accept --bundle, but the zip ships no bundle to point at. The agent kit drives the same CLI and fails identically, which means the MCP tools listed under 2.0.0 below do not work in 2.1.0 either.

The desktop app is not affected: it compiles the bundle into the binary. Every capability shown on the home page and in the demo runs in the app.

Cause of the miss: every green test run, ours included, executed inside the build checkout, where the path resolves. Nobody had run the product on a machine that wasn't the one that built it. The fix is to embed or relocate the bundle, and it requires a re-notarized release.

2.0.0

Previous release: Archivist-Sort.dmg v2.0.0 — Developer ID signed, notarized, stapled, Gatekeeper-accepted. Shipped features:

• Structure Studio — define your own folder templates; Sort proposes moves that fit them, for your review.
• Receipts & rollback — every action journaled with checksums; rollback restores byte-verified originals.
• Notarized DMG — Developer ID signed, notarized by Apple, stapled, Gatekeeper-accepted.
• CLI + agent kit — a CLI zip and an agent kit (MCP server + Claude/Codex/Cursor setup) published on the download page.
• Red-team hardening — template-traversal rejection, executor containment, torn-move rollback restoration proven under edge fixtures (symlink loops, aliases, unicode homoglyphs).

0.2.0

Local-first, review-first file cleanup for macOS — scan, review, plan, quarantine, receipt, rollback. Nothing leaves your machine.

Transcription now works from the app, not just the terminal

Earlier builds could only find a whisper backend through the shell PATH, so the double-clicked app silently found nothing. 0.2.0 resolves backends the way you actually install them — Homebrew, pipx, pip --user — spawns them by absolute path, and falls through a broken install to a working one instead of stopping. Settings shows exactly which binary was found, where, and why — or the specific reason none is usable. A wedged backend can never hang the app (bounded probes). Optional override: ARCHIVIST_SORT_WHISPER=/path/to/binary.

Export search hits to your editor

Search your transcripts on the Report screen and export the matching SOURCE files as an experimental FCP7 XML (xmeml) bin — a handoff starting point for DaVinci Resolve, Premiere, and FCP7-XML importers, not a finished timeline (whole files, not trimmed hit ranges — that refinement is on the roadmap). Duplicate hits collapse to unique clips; the exporter is honest about its dialect (it is not FCPXML and does not pretend to be).

Receipts that can't collide

Two runs in the same second used to share a receipts directory and could overwrite each other's plan. Run directories are now unique by construction (<timestamp>-<id>), in both the app engine and the shell loop.

Honesty and hardening

• Backend-missing guidance names exact install commands.
• Fail-closed everywhere: the app never invents a transcript, never executes a plan without your explicit acknowledgement, and rollback restores byte-verified originals.
• One canonical release pointer (RELEASE.md) — docs can no longer disagree about which artifact is current.