# Verification and release readiness — HOLD 0.2.0

## 0.2.6 desktop updater implementation

See also the 2026-10-19 [local selection implementation](/reference/docs/LOCAL_AI_SELECTION.md) and [candidate source audit](/reference/docs/evidence/candidate-source-audit-2026-10-19.json). Core/desktop checks, mobile checks and actual native model quality are recorded separately; no release or physical-phone certification is implied.

The existing 325-check desktop/core regression run passed. Seven targeted updater checks passed after release-configuration validation, including fixed feed/publisher requirements, metadata rejection, background download with no automatic installation, busy/confirmation races, failed signatures/downloads, duplicate checks, and signing-required packaging. The desktop TypeScript/Vite build passed. Actual Electron development-runtime UI verification confirmed the disabled development-preview state and that a synthetic ready event cannot restart with an unsent draft; the draft remained intact. Evidence: `artifacts/desktop-updates/`. No live feed, signed upgrade, true delta transfer, or installed-version replacement is claimed. See [desktop updates](/reference/docs/desktop-updates.md) for activation requirements.

## 0.2.5 web-search verification

Automatic current-information lookup uses Bing RSS summaries, with local answer generation, source links, an offline setting, bounded requests, cancellation, and relevance filtering. No cloud AI, paid service or API key was added. Searches send the current query only; saved history, files and notes are excluded. Shared desktop/mobile search logic is checked for byte equality. Windows development-runtime and native Android acceptance evidence and package checksums are recorded under `artifacts/web-search/`; Apple and physical-phone behavior remain unverified. Windows code-integrity policy blocks the unsigned standalone executable; the official Electron development runtime passed the desktop acceptance flow, and the separate Program Files installation was preserved. This is summary retrieval, not full-page browsing or guaranteed live factual accuracy.

## Current MyAi 0.2.4 acceptance

Automatic AI setup, two-field helper creation, optional advanced settings and the simpler website are verified separately in `artifacts/simple-experience/after/`. The current run passed 308 core/desktop checks, 47 mobile checks and 6 static-site checks. Installed Windows acceptance covered an empty profile, automatic reuse/loading of a pinned download, helper creation with no added grants, a real local coding reply, and advanced settings visibility. Android acceptance covered automatic setup, helper creation, an actual local coding reply and large-text Save/Cancel access on the owned API36 emulator. The website passed all nine routes at 320, 390 and 1440 pixels. These are local previews, not a public release, clean-machine certification or Apple/physical-phone validation. Earlier results below remain historical.

The mobile 0.2.1 free-AI update has [separate native acceptance](/reference/docs/evidence/mobile-local-agents-0.2.1.json), [43 tests](/reference/docs/evidence/mobile-local-agents-tests-0.2.1.txt) and [92 source/build-copy checks](/reference/docs/evidence/mobile-free-ai-build-0.2.1.json). Desktop source/binaries below are unchanged; this baseline is not a new Apple/physical-phone certification. See [free AI scope](/reference/docs/FREE_AI_SCOPE.md).

Date: 2026-10-15. These are scoped local build and execution results. They do not certify every device or authorize a public release. The [requirements matrix](/reference/docs/REQUIREMENTS.md) maps the original specification to source, evidence and remaining limits, including explicitly future marketplace work. Earlier 0.1.0-alpha.1 artifacts and reports are preserved as historical evidence; they do not establish acceptance of a changed 0.2.0 binary.

## Environment and method

Windows x64 build 26200, Ryzen 9 5950X (16 physical/32 logical cores), approximately 31.9 GiB RAM, RTX 4080 with 16,376 MiB VRAM, NVIDIA driver 616.64. Desktop uses Node 24, Electron 44.7.2 and pinned llama.cpp b11429. Android native verification used an API 36 x86_64 emulator. A separately owned Debian Linux container was used for Linux CPU validation. No physical phone, Mac or iPhone was available. Tests used isolated profiles and synthetic project/conversation content under .data; unrelated user files were preserved.

Unit/regression tests, protocol fixtures, actual models, native UI workflows, packaged application execution, installer execution and physical-device certification are separate evidence categories. A successful unit suite is never used as a substitute for the others. No funded inference, GPU rental, public deployment, source publication or store submission occurred.

## Current checks

| Area | Actual scope and result | Evidence |
| --- | --- | --- |
| Full desktop/core regression suite | **304/304 passed**, zero skipped/cancelled; storage, import, downloads, model updates, execution queues/budgets, permissions, project paths/checkpoints, file bounds, speech/photo boundaries, Git, isolated tests, Power, pairing and retrieval | [Summary](/reference/docs/evidence/unit-tests-v2.json), [complete output](/reference/docs/evidence/unit-tests-v2.txt) |
| Desktop keyboard/accessibility | 7 source-native groups,18 light/dark/compact screens; labelled progress, modal alerts, focus restoration and arrow-key tabs | [Source acceptance](/reference/docs/evidence/desktop-accessibility-source-v2.json), [direct ZIP policy refusal](/reference/docs/evidence/desktop-accessibility-packaged-launch-v2.json) |
| Storage recovery | 7 controlled source-native checks; low-space download refusal, preserved draft/attachment/history and successful retry | [Recovery evidence](/reference/docs/evidence/desktop-storage-shortage-v2.json) |
| Standard desktop smoke | 8 groups passed; launch, hardware/catalog, theme, memory, project/agent navigation, encrypted restart, compact layout and restricted renderer | [Current desktop smoke](/reference/docs/evidence/desktop-smoke-v2.json) |
| Desktop native chat/device flow | 12 groups passed; real model conversations, preferences, comparison, text drop, private pairing, exact agent grant and per-task denial/approval, task-result display, revoke/pause, compact UI and encrypted restart | [Native chat/device acceptance](/reference/docs/evidence/desktop-chat-v2.json) |
| Workspace and history | 5 groups passed; 1,000 saved messages, 60/120-message paging, old-message search, rich text/code copy, inert remote markup, folder creation/review, file filter/preview, instructions, compact layout and built-in help | [Workspace acceptance](/reference/docs/evidence/desktop-workspace-v2.json) |
| Project context and durable edits | 6 context groups and 4 checkpoint groups passed; source selection, note scope, encrypted restart, exact edit approval, apply/revert and durable history | [Context](/reference/docs/evidence/desktop-context-v2.json), [checkpoints](/reference/docs/evidence/desktop-checkpoints-v2.json) |
| Local semantic search | Real pinned Nomic embeddings; measured relevant project retrieval, encrypted indexes, source change/deletion/revocation; saved-chat/note search and native result navigation/restart/invalidation | [Project retrieval](/reference/docs/evidence/retrieval-real-v2.json), [saved search](/reference/docs/evidence/conversation-search-real-v2.json), [5 native search groups](/reference/docs/evidence/desktop-saved-search-v2.json) |
| Agents | Actual local model execution, scoped delegation, durable restart/no replay, bounded tools/budgets and exact approvals; 6 native task/editor groups | [Execution](/reference/docs/evidence/agent-execution-v2.json), [native UI](/reference/docs/evidence/desktop-agents-v2.json), [web boundaries](/reference/docs/evidence/agent-web-v2.json) |
| Resource observation | Actual owned inference-process CPU/RAM/budget observation; 8 real checks, 4 native UI groups and 5 unit regressions | [Resource evidence](/reference/docs/evidence/agent-resources-v2.json), [native UI](/reference/docs/evidence/desktop-agent-resources-v2.json) |
| Git | 12 actual repository fixture groups and 4 native UI groups; reviewed exact staging/commits/branches, malicious metadata/filter/hook boundaries | [Git evidence](/reference/docs/evidence/project-git-v2.json), [native UI](/reference/docs/evidence/desktop-git-v2.json) |
| Isolated code tests | 34 regressions, 10 actual Docker groups, 4 native UI groups, 6 actual agent-to-container diagnosis groups; no network, copied source, enforced CPU/RAM/PID/time/output limits, real exit status/cancel/cleanup | [Container execution](/reference/docs/evidence/isolated-execution-real-v2.json), [native UI](/reference/docs/evidence/desktop-execution-v2.json), [agent diagnosis](/reference/docs/evidence/agent-isolated-real-v2.json) |
| Photos and voice | 6 real CPU vision groups, 5 native photo groups; 4 synthesis and 4 dictation native groups using installed offline Windows resources and controlled audio/capture fixtures | [Vision](/reference/docs/evidence/vision-real-v2.json), [photo UI](/reference/docs/evidence/desktop-photo-v2.json), [speech](/reference/docs/evidence/desktop-speech-v2.json), [dictation](/reference/docs/evidence/desktop-dictation-v2.json) |
| Models and acceleration | Real CPU/Vulkan baseline plus 10 CUDA checks; full downloads/hashes and measured Qwen coding/reasoning/vision results, including quality failures; 6 native import/update groups | [CPU](/reference/docs/evidence/inference-v2.json), [CUDA](/reference/docs/evidence/cuda-v2.json), [model evaluation](/reference/docs/evidence/model-evaluation-v2.json), [import/update](/reference/docs/evidence/desktop-model-import-v2.json) |
| Pairing and phone tasks | Actual pinned TLS/authenticated native Java interoperability and model streams; saved-agent task execution with real Qwen3 4B, cancellation, grant/config revalidation, encrypted ownership, restart/session rotation and revocation | [Pairing](/reference/docs/evidence/pairing-real-v2.json), [real tasks](/reference/docs/evidence/paired-tasks-real-v2.json), [Android acceptance](/reference/docs/evidence/mobile-native-verification-v2.json) |
| Optional remote connections | 33 provider/transport regressions, 5 actual-model loopback HTTP endpoint groups, 4 native UI groups; exact data review, protected credentials, denial, cancellation and quota accounting | [Connection tests](/reference/docs/evidence/power-connections-v2.json), [owned endpoint](/reference/docs/evidence/hosted-model-v2.json), [native UI](/reference/docs/evidence/desktop-power-v2.json) |
| Android | Final 0.2.0 native APK installed; on-device text/photo/offline WAV speech and TTS, camera/picker/share/QR, conversation controls, desktop tasks, restart/recovery, large text, permission returns, offline smoke; 38 tests and typecheck pass | [Final native report](/reference/docs/evidence/mobile-native-verification-v2.json), [38 tests](/reference/docs/evidence/mobile-tests-v2.txt), [mobile details](/reference/docs/mobile.md) |
| Android performance and accessibility | Six real replies across three cold/reused-context cycles; measured load, first-token latency, throughput, startup and memory. TalkBack, two viewports and 200% text/keyboard recovery exercised | [Measurements](/reference/docs/evidence/mobile-performance-v2.json), [accessibility](/reference/docs/evidence/mobile-accessibility-v2.json) |
| Linux CPU | 8 actual network-disabled container checks: verified runtime files, real arithmetic reply, unauthorized request rejection, encrypted restart, context reload, streamed cancellation and owned-process cleanup | [Linux runtime](/reference/docs/evidence/linux-runtime-v2.json) |
| Website | Static build and six structural/link checks; real desktop/phone browser checks, light/dark and availability navigation; local Markdown targets and heading anchors validated | [Website evidence](/reference/docs/evidence/website-v2.json), [website verification](/reference/apps/website/VERIFICATION.md) |
| Dependencies and secrets | Fresh approved audit: desktop production 0, desktop full graph 8 moderate; mobile full/production graphs 15 high propagated build-tool entries. Pattern source scan found no matching credentials; exact file count is recorded in its report | [Security scope](/reference/docs/security.md), [source scan](/reference/docs/evidence/source-secret-scan-v2.json) |

Test counts above overlap where focused suites are part of the 304-test run. They are not summed into a synthetic total.

## Exact artifacts and installation boundary

The final Windows 0.2.0 unsigned installer passed [installation, real-model application acceptance and uninstall](/reference/docs/evidence/windows-installation-v2.json) on the recorded development host. NSIS and uninstall both exited 0; removal preserved the isolated test profile. The installed directory measured 1,769,775,480 bytes before removal. An [earlier artifact's installation](/reference/docs/evidence/windows-installation-earlier-v2.json) was refused by [Enterprise signing policy](/reference/docs/evidence/windows-application-control-v2.json); those distinct bytes and events remain historical evidence. No security policy was disabled, relaxed or bypassed. The final installer is still unsigned; owner publisher trust, upgrade testing and clean-machine validation remain separate gates.

The final [installed-app acceptance](/reference/docs/evidence/packaged-app-v2.json) passed 10 groups with real CPU/Vulkan/CUDA replies, native offline speech, photo processing, encrypted restart and bundled-service initialization. [Source consistency](/reference/docs/evidence/artifact-source-consistency-v2.json) matches 79 packaged desktop files and all 89 Android build inputs. An earlier candidate completed [four CPU → Vulkan → CUDA cycles](/reference/docs/evidence/packaged-acceleration-stress-v2.json), with 12 actual answers, matching saved/rendered message IDs and no renderer/process errors. An [earlier CUDA-view assertion](/reference/docs/evidence/packaged-first-attempt-v2.json) failed despite completed core inference; it did not reproduce and its root cause is not claimed fixed. Installation and app acceptance both passed for the final artifact. Final artifact hashes and source commit are in artifacts/releases/0.2.0/release-manifest.json and SHA256SUMS.txt. The versioned source, website and verification ZIPs exclude model weights, credentials, dependency installations, private profiles and toolchains. The separate Windows app ZIP contains the tested application and its dependencies: extract the whole folder and open HOLD.exe. It uses the normal local user profile, not portable-data mode. The installed copy ran on this host. Direct ZIP launch was refused by its signing policy; use the verified installer. Other machines may apply different trust requirements.

The final Android APK is **177,020,791 bytes**, SHA-256 **509bfe572c83f75f78965b06a574a253555bf0ec29d937f97a74f2efe47cac63**. Installed base.apk was independently retrieved and matched. Version name is 0.2.0, version code2, debuggable=false, with a development certificate. All 89 recorded source/build inputs match. Local timing details, repeated emulator measurements and narrow-screen accessibility results are recorded with their actual scope. Scanner/runtime dependency checks are retained; they are not independent native security certification or owner publisher signing.

The Linux AppImage is **149,187,437 bytes**, SHA-256 **874f900dccd32bcc0317683f411cdce6df5a6fda3e4cc99549ec85c73fa04a0d**. [Artifact verification](/reference/docs/evidence/linux-artifact-v2.json) matches 77 packaged workspace files, 31 renderer inputs, package metadata and 61 runtime files. Its [production Chromium sandbox launch](/reference/docs/evidence/linux-desktop-v2.json) refused to start in the container because the extracted helper did not satisfy sandbox ownership/permission requirements. No sandbox bypass was used for the final test. An earlier automation launch that implicitly disabled the sandbox is explicitly nonacceptance evidence. Full desktop/keyring/GPU validation needs a suitable Linux desktop environment; [Linux details](/reference/docs/linux-validation.md) distinguish that from the successful CPU core test.

## Performance and reliability limits

Raw timing, token, memory and load observations are retained in the linked reports. They describe this shared development machine/emulator under the actual recorded workload. Native workspace launch was approximately 1.18 seconds and opening the 1,000-message history approximately 0.99 seconds in that run. GPU selection is accepted only after positive native offload evidence. No advertised cross-device throughput, battery or thermal guarantee is inferred.

Desktop offline tests block external application HTTP/fetch after model acquisition while retaining authenticated loopback. They do not disconnect the Windows adapter. Android final airplane-mode checks and Linux network-disabled container checks have their own recorded conditions. Controlled WAV recognition does not establish physical microphone performance or universal speech-language availability.

Model quality is separate from transport correctness. Expanded evaluations retain imperfect reasoning/coding scores. A small Qwen model produced a template answer in one phone-task attempt and another chose the wrong example file; those [native](/reference/docs/evidence/desktop-paired-task-small-model-quality-v2.json) and [core](/reference/docs/evidence/paired-tasks-small-model-failure-v2.json) failures remain alongside the successful Qwen3 4B task. No small-model success is generalized to reliable autonomous coding.

## Findings and resolutions

This continuation fixed stale/racing state reconciliation, bounded actual file reads rather than trusting pre-read size, invalidated semantic indexes through durable mutation, revoked task handles/grants on data replacement, revalidated asynchronous phone approvals and results, enforced aggregate delegation budgets, and preserved ownership through cancellation/restart. Native tests exposed layout/accessibility issues and permission-return behavior on Android; these were corrected and retested. The final website review found missing packaged documentation targets; the reference graph and archive rebuild verification now cover them.

The runtime parser remains a native user process, not a hostile-model sandbox. Fixed isolated test containers do not make arbitrary marketplace code or imported model parsers safe. Curated pinned weights and explicit unreviewed imports preserve that distinction. Local JSON persistence is bounded and tested for corruption/concurrency, but an unlimited-history production soak is not claimed. OS-account compromise, secure SSD erasure, third-party provider retention, physical-device behavior and professional penetration certification remain outside these tests.

Fresh registry findings have no compatible upstream patch at the recorded review time. Desktop sprintf-js reaches the build-tool graph; mobile node-forge/braces reach the Expo/Metro toolchain. Forced downgrades were not substituted for remediation. Scope evidence, raw audits and upstream patch checks remain available for owner security review.

## Public-release gates

Required owner/environment work is detailed in [OWNER_SETUP.md](/reference/OWNER_SETUP.md): Windows/Android/Apple publisher signing identities, Mac/Xcode and physical devices, clean-device validation for the advertised platforms, final licensing and explicit repository/domain/store publication approval. Independent security/accessibility review is recommended additional assurance, not an invented credential blocker. No automatic publication or spending path is enabled. Future Network/settlement and optional exploration rows remain honestly unimplemented; see [release gates and future scope](/reference/docs/NEXT_STEPS.md).