ReShiki 0.13.1 release validation

This record distinguishes the release preparation, unsigned manual packages, and final public downloads. The checks below retain the source and package identities they actually tested. Release notes · Release procedure.

Initial source and preparation

The initial preparation and package reviews below retain their historical sources. All four completion follow-ups are merged at main checkpoint 91ea325d, with applicable PR checks and comment review passed. Final main checks and documentation passed at released source 25ace515. The publication record below identifies the final tag and verified public packages.

All 28 QA source pull requests merged before release preparation PR #583 was merged. Its frozen head was 55dd647d70dea1eb234fb1d7d5fab7d432e42aa8; the complete functional base was 8e139268. The preparation changed version, release notes and current documentation metadata, with no production behavior change relative to that base.

The frozen preparation head had a successful CI rollup across 33 contexts and no unresolved review comments. Expected conditional or manual-publication jobs were skipped, rather than counted as successful executions. One Windows PowerShell argument-test invocation timed out without an assertion failure; the same head passed both Windows manual-package test jobs and the single failed-job retry. No source change was made for that timeout. The manual package review passed before #583 merged.

The first tagged release attempt used 8d3493d92582d57b6ad2ee07506f331db3b5535c. Its Checks, Documentation, Wayland clipboard and Nix workflows passed before the v0.13.1 tag was created.

Every new save uses document format 30. Older drawings remain readable; ReShiki 0.13.0 reads at most format 29 and refuses format 30 with update guidance. The distance-derived bond provenance implementation introduced this format; release metadata did not change it.

Finding coverage and credits

The release inventory contains 64 findings, grouped into the 28 pull requests below. Each group is credited to @Ameyanagi in the release notes and contributor list. The linked review records retain their original source, input, platform, measurements and limits; their successful checks do not establish checks on the final release preparation or published packages.

Pull request	Findings	Original evidence and limits
#535	#513	Review
#536	#522	Review
#537	#490	Review
#538	#515	Review
#539	#507	Review
#540	#514	Review
#541	#521	Review
#542	#516, #520	Review
#543	#492, #493, #498, #500, #509	Review
#544	#496, #501, #510	Review
#545	#494, #495, #497, #504, #506	Review
#557	#511, #523, #525, #526, #527, #528	Review
#558	#517	Review
#559	#508	Review
#560	#502, #503, #505	Review
#561	#512, #518, #519, #524	Review
#562	#546, #547, #549	Review
#563	#491	Review
#564	#548, #550, #551, #554	Review
#565	#499	Review
#566	#533, #534	Review
#567	#552, #553, #555, #556	Review
#568	#530, #531, #532	Review
#577	#575, #576	Review
#578	#572, #573	Review
#579	#569, #570, #571	Review
#581	#580	Review
#582	#574	Review

Local preparation checks

These checks ran on macOS ARM64 against the complete source base above plus this release metadata. They do not establish checks on signed or published packages. The preparation CI and package results are recorded separately below.

Check	Observed result
Theme generation	Regenerated all five themes; parsed data matches the source base after removing only reshiki_version (0.13.0 → 0.13.1).
Theme and version-resource tests	1 theme-reference test and 4 host-independent Windows resource-version tests passed.
Release Python modules	tests.test_release, tests.test_prepare_nightly and tests.test_release_downloads: 28 tests passed.
Documentation diagnostics	0 errors, 0 warnings and 0 hints.
Documentation build	13,829 local links/assets, llms.txt, agent-api.txt and 1,360 published colours verified.
Coverage and inherited evidence	All 64 findings, 28 PR groups, 23 central-note images and original review links retained.

Dated merged-PR comment snapshot

The comment audit at 2026-10-26 04:19:51 UTC covered all 30 then-merged source/preparation/ reference-repair PRs. It found zero actionable items, zero inline review threads and zero unresolved threads. All 30 observed timeline entries were Copilot quota notices; this does not mean Copilot completed code review. PR #586 was excluded and monitored separately. This is a dated API snapshot, not a statement about future comments.

Historical unsigned manual review at 55dd647d

The six-platform feature-branch Release run 40238703860 completed successfully at exact preparation head 55dd647d. Static review covered all ten packages, six portable archive manifests, actual architectures, version/source metadata, required notices and checksum sidecars. Platform jobs also completed their packaging/runtime checks. These were unsigned test artifacts, with ad-hoc macOS signatures; they do not establish the signature or notarization of public downloads.

This review predates the security dependency changes. It remains evidence only for 55dd647d; the current security package smoke is recorded below.

The unmodified Mac ARM ZIP had SHA-256 8de814c49a740cfd369c5a22e8be3b1d672db9834c42780037229cd5bf445a74. A bounded graphical smoke ran on Apple M1, arm64, macOS 27.0.1 (26A434) with isolated application data and output folders. The app reported 0.13.1; network-denied CLI ethanol analysis returned C2H6O and the expected InChI with Python, uv and checkout support unavailable.

A format 29 caffeine drawing opened. Native keyboard drawing and the atom label editor created an OMe group; Properties reported C2H6O, COC and 46.069 g/mol. Native Copy reported success, and the packaged CLI exported a one-page PDF whose OMe drawing was rendered and inspected. An actual Save recorded format 30, and closing and reopening that file restored the drawing. The official Mac ARM 0.13.0 CLI refused the actual saved file with “Update ReShiki to open it” guidance.

A saved caffeine model displayed in Both view beside Properties. Opening NaCl CIF displayed a projected cell, Cl4Na4 composition, 233.772 g/mol and the explicit distance-derived-bond analysis notice.

All nine app-file hashes matched before and after the smoke. The owned app was closed; no offered recovery draft was restored or discarded. The compact smoke receipt records identities, image hashes and scope. The original native captures are JPEG, 2560 × 1696 px; these copies retain the original bytes under matching .jpg extensions.

This package smoke did not repeat all 64 fixes, artemisinin depiction, performance measurements, conformer generation, or external Office/ChemDraw paste. The saved-model check is narrower than the earlier source-specific 3D evidence. No Intel, Windows or Linux graphical runtime is claimed.

First stable release attempt

The first v0.13.1 attempt used source 8d3493d9. Release run 40246080829 completed with failure. All six platform builds and both macOS signing jobs succeeded. Nine live-reference shards failed on expectations predating the intentional cleanup-refusal wording, reaction ink placement and the NCI/2808 ring-template layout changes. Shard 3 passed on all three reference platforms. The nine failed logs were retained and inventoried; the compact attempt receipt records the job identities and conclusions.

The publication, browser-demo and npm jobs were skipped. No public release or public assets were created by this attempt. Successful signing jobs are workflow results, not a local verification of public package signatures.

Test-only repair PR #584, at c00b0b27a819aedb21090e4ff8f25a0a67ba3397, updates these reference contracts. It preserves the frozen Python worker and strict chemistry, stereochemistry, identity and full-response comparisons. The affected cleanup, native cleanup, reaction drawing, native routing, native import, IO reference guards and engine migration suites passed locally on macOS ARM64. Strict reference-test Clippy, the required three-package WASM Clippy and normal commit hooks also passed. The repair merged as bceea7a5. All applicable main CI passed: Checks and Wayland clipboard. Application and packaging behavior is unchanged by this test-only repair. These results do not establish a replacement stable release result.

Security and Nix CI at d658a67e

PR #586 addresses security #585 and CI #588 at d658a67e82735aaaaccab4173b8e8dbfc7269a48. It merged as 9a9b2dc679f486b4fd79d84fbab5d93fc5efc2f4, with the exact tested tree. The minimal implementation retains the Rust/npm/Python dependency fixes and Bun/uv/Node pins while removing the custom scanner, attestation and runtime-policy frameworks. PR additions fell from 7,116 to 1,217 lines, about 83%.

CI uses the standard SHA-pinned Determinate Nix action 3.24.1. A 49-line first-step Node bootstrap remains because observed hosted runners supply Node 24.21.0; it verifies official Node 24.22.1 artifact hashes before replacement. setup-node alone does not change the runtime used by JavaScript actions. The flake selects official prebuilt rustc and Cargo 1.99.1, with all three archive hashes pinned. Original GTK dependencies and full chemical/PNG install checks remain. A short build step checks the actual dry-run plan for source LLVM/Rust/Cargo builds, then runs the full flake check with lock changes and source fallback disabled.

The maintainer explicitly accepts stock pinned nixpkgs curl/Brotli/FreeType build-library advisories; their global overlays are removed. The dated assessment retains the prior OSV scan’s eight findings: six maintenance notices and two scoped exposures from 1,226 queried Cargo/npm/PyPI versions. The original hosted audit receipt remains dated evidence, not a recurring scan gate or a universal CVE-free claim. The unavailable Dependabot alert inventory remains qualified in its original receipt.

The exact-source local receipt records the archived d658a67e tree tested on amearch. Complete Linux nix flake check and the original installed-binary checks passed in 380.77 s (about 6 m 21 s). The log started one application derivation and zero source toolchain builds. All three cache-aware plans and eight build-step controls passed. ARM/macOS evidence is dry-run metadata, not full native builds. The local test reused the existing Nix daemon/store cache with sandbox=false; it is not a cold-build benchmark and did not execute the GitHub vendor action.

The Python unit/regression suite at cbf9949d ran 218 tests: 213 passed and five skipped. Mocked package/Windows fixtures do not establish actual package acceptance. All six minimal Node sandbox cases and applicable normal hooks passed. These results retain their tested-source scope; the receipt records the later exact-source Linux result separately.

The hosted Nix matrix passed on Linux ARM64 in 10m18s, Linux x64 in 13m07s, and macOS ARM64 in 17m51s, with original install checks and zero source LLVM/Rust/Cargo builds. Checks, Documentation, contribution-license and Wayland also passed: 25 successful PR contexts and three expected skips, with no actionable review comments. The focused follow-ups’ main-merge status is recorded below; final release acceptance remains separate. No additional manual Release workflow was dispatched.

Historical evidence remains source-qualified. Initial application validation at 48eaa508 passed 3,128 native tests and 206 JavaScript/WASM/desktop comparisons; its receipt is unchanged. At b956e463, full Mac/Linux ARM Nix application checks passed, but Linux x64 timed out at six hours before the app build. The earlier custom runtime checkpoint, its Mac runtime receipt, compiler-only graph review, pre-minimal local build and b9c7941e metadata repair remain superseded historical receipts, not descriptions of current CI. The unsigned 3d3eed65 packages below retain their own artifact identities.

Historical security-package validation at 3d3eed65

The unsigned six-platform manual run, 40264759989, at exact security head 3d3eed6593d0b02eab6976f31a8cefac08a36fb3, completed successfully. Static review of all ten packages and six portable archives passed: checksums/sidecars, actual architectures, version/source manifests, single application executable and required notices, including the full CDLA license. The original static receipt has SHA-256 c3f8424f779fbbd90987dd558c0bbecc6f039fa12d8c54b776e6e7120a60aa57. The independent root acceptance records the package digests, receipt verification and accepted manual gate. This completes the unsigned manual package review, separately from Nix and future signed-public-package verification.

These packages and the native smoke below remain 3d3eed65 artifacts. Application sources, dependency locks and release-packaging scripts are unchanged by the subsequent timeout/runtime CI repairs. The new CI scripts and tests do change the complete Nix source tree; it is not byte-identical to the tree tested at 3d3eed65. The complete source-scope comparison records all seven changed CI/documentation/test paths through b956e463; it is not a comparison against the later Rust 1.99.1/workflow/policy-test tree. Those later CI/toolchain changes preserve production application code, dependency locks and release-packaging implementation but do change the build toolchain and complete Nix source tree. No identical Nix derivation, output or package bytes are asserted. No new manual package run is claimed. The application-input equivalence does not make future commit metadata or signatures identical. Final public packages require their own source-stamp, checksum and signing verification. Subsequent production fixes described below also require the final tag build to cover the new application source; these older packages are not current acceptance for those fixes. No additional manual Release rehearsal is planned.

The Mac ARM portable ZIP used for the native smoke has SHA-256 a735c9b054adafe0a1b273e7b8e94a7c189b6f08afd0be7c0102a30b6e8802e2. The source and dependency identity receipt records the Cargo lock hash and updated TLS/Tokio dependency versions.

The unmodified packaged app was tested on Apple M1, arm64, macOS 27.0.1 (26A434) in new isolated data/output folders. Native and CLI version checks reported 0.13.1. Network-denied ethanol analysis returned C2H6O and the expected InChI with an empty PATH, Python/uv/checkout overrides unavailable and HOME unchanged. An older format 29 caffeine drawing loaded through CLI and GUI.

Native keyboard drawing and the atom label editor produced an OMe group. Whole and selected Properties matched C2H6O, COC, 46.069 g/mol and three atoms with two bonds. Native Copy reported “Editable drawing and images copied.”

An actual native Save wrote format 30. Closing the tab and reopening that file restored a clean title, disabled Undo and the same chemistry. The official unmodified 0.13.0 Mac ARM CLI refused that actual file with update guidance. The reopened drawing was captured. Packaged CLI PDF export produced 9,615 bytes; its Poppler render was inspected and the OMe group/bond are clear and unclipped.

The saved caffeine model opened in Both view beside Properties. Opening NaCl CIF displayed the projected cell, Cl4Na4, 233.772 g/mol and the explicit analysis-unavailable notice for distance-derived bonds.

All nine app-file hashes remained identical before and after, and strict deep ad-hoc signature verification still passed. The owned app exited; the final native inventory reported it stopped. The smoke receipt records the exact source, package, inputs, checks and original image hashes. Independent smoke verification checked all seven image hashes and the equal app inventories, and inspected the drawing, model, crystal and PDF previews. This Mac ARM package-review gate passed with its recorded limits.

This is historical package smoke at 3d3eed65, not evidence for the final signed public assets. It does not repeat the 64-finding QA, artemisinin depiction, performance measurements, fresh conformer generation or external Office/ ChemDraw paste. No Intel, Windows or Linux graphical runtime is claimed.

Completion follow-ups

Change	Pull request	Tested source	Main status
Reaction-reference coverage	#589	34a21da8	Merged as 44ea4f74
Large-selection Commands	#590	6e7722bb	Merged as b5977bea
Portable synthetic paste	#591	f1174fec	Merged as b4e2a3c4
Large-selection PDF feedback	#592	b5b22c98	Merged as 91ea325d

On 2026-10-26 UTC, #589 merged at 16:30:29, #591 at 16:32:04, #590 at 16:44:59 and #592 at 16:48:17. PRs #589 and #591 each had 20 successful PR contexts; #590 and #592 each had 22, including both Wayland jobs. All four had three expected skips and zero actionable comments. These source-specific checks do not establish final package acceptance.

A scheduled main Checks run, 40295742094, failed three Linux reference shards on the same synthetic owned map/stereo ink assertion. The focused fix at 34a21da8 on fix/qa-reference-owned-ink passed seven unit tests and one real production import regression, plus normal hooks. The focused receipt keeps that local scope. Required live Checks run 40308091132 completed successfully: 31 successful jobs, one expected skip and all twelve live-reference shards passed. The hosted and Linux verification also records the exact original assertion failing on amearch and the separately rebuilt candidate passing the focused 7 + 1 checks plus 48 relevant test invocations across nine commands, including overlapping execution. This is bounded Linux reproduction, not a universal automatic-indicator guarantee. The workflow was Checks, not Release.

The large-selection command-palette fix for issue #587 is pushed as 6e7722bb. It passed 34 focused tests, an optimized native build, bounded native usability, native/WASM Clippy and normal hooks. The evidence snapshot qualifies the native check as usability rather than precise latency; no native screenshot artifact was saved. It merged in PR #590.

The Firefox synthetic-paste harness correction is pushed as f1174fec. Current-source synthetic paste passed Firefox, Chromium and WebKit. The same evidence snapshot preserves the source/harness qualification. This is browser harness evidence, not a native clipboard or external Office paste guarantee.

The current-source #574 follow-up at b5b22c98 merged in PR #592 with the verified narrow query changes. In its controlled matched M1 comparison, warm median accepted-command to Preparing presentation improved 64.026666 → 30.036 ms, and completion improved 815.803042 → 661.366375 ms. Preparing appeared on the first requested draw with menus closed throughout. The portable timing receipt retains the exact base, production/instrumentation patch, binary/log identities and warmup plus three quiet warm trials per build.

The 33.3 ms median budget is met in this controlled M1 comparison. The original M4 hardware, 1600 × 1000 pt window, NO₂-chain target, pointer-off condition, physical-click latency and GPU scanout remain unverified. Timing starts at the accepted application command and ends at successful compositor submission; no logging overhead is subtracted. Three warm trials do not establish a latency distribution or an uninstrumented universal deadline.

The final PDFs each have one page, 776,466 bytes and sixteen indirect objects. Their complete resolved object graphs/trailer and overview/detail rendered pixels match. Raw serialization and object IDs differ; byte identity is not claimed for this final pair. Graph comparison preserves stream hashes, array order and multiplicity while normalizing serialization order/object IDs/ xref offsets. Both rendered comparisons have zero differing RGBA pixels.

All 77 focused tests passed on Mac and the exact frozen Linux patch, with two existing opt-in renderer ignores. Required native/WASM lint and normal hooks passed. Independent source/test verification rehashes 23 local files and both remote test ELFs and matches the fourteen-file final source freeze. These results are not Linux timing or final package acceptance. The original intermediate candidate is retained as historical evidence and is superseded by this source-pinned result.

For issue #507, independent verification checked 99 files, 96 commands and five equal complete chemical-analysis pairs. The recorded M1 release comparison showed 8–41% median whole-command overhead, not engine-only timings or a universal no-regression result. The original source, input and hardware qualifications remain attached to that frozen measurement.

All five inputs now also have native before/after Fit captures and actual CLI PNG renders from the same identified 0.13.0 and 3d3eed65 builds. Eight native captures used fresh imports; the two baseline peptides used native Open of preserved RSKs whose geometry and stereobonds match the baseline CLI outputs after the old import became unobservable. This route difference is documented. Fixed peptide labels and wedges are too small at 4% Fit for individual detail claims; the existing closeups and geometry/stereo checks supply those.

Input	CLI before	CLI after
Polystyrene ×30	PNG	PNG
Polystyrene ×75	PNG	PNG
Polystyrene ×100	PNG	PNG
Alanine ×200	PNG	PNG
Poly-L-alanine ×200	PNG	PNG

The CLI receipt records all ten successful network-denied commands and output hashes. --width 3200 --height 2000 sets maximum dimensions, not a fixed canvas. Neither these images nor the native captures are final signed-package acceptance or new timing measurements.

The four source heads retain original author @Ameyanagi in #589, #590, #591 and #592. Contributor and release-note credit landed first in #593, merged as eed6f76f9d37115bacf7e7fa6b5c948bc14d2438 after its own CI/comment review. All four source PRs are merged. The original 64-finding/28-group table above remains the original inventory; its QA retains the source and measurement limits recorded above.

Published source and verification

ReShiki 0.13.1, release 424605576, was published at 2026-10-26 18:20:11 UTC and verified as GitHub’s Latest stable release. Its source is 25ace5153fb112c636b7505eb319e029a00e09d7, tree b143e06c8a54b0c3674ef69cdc6200a525150038, with annotated tag object fe38e874d2e1604ff801b3f350a02a5deb1412b1. The initial tag object 160d9b17934c1ac72afa3eb6d7bdd959669a17f8 remains preserved as release-attempt/0.13.1-1, pointing to first-attempt source 8d3493d9.

The tagged Release run 40364101896 completed successfully with 42 successful jobs and two expected skips, including all six package builds, both macOS signing jobs, all twelve live-reference shards and the full native/geometry checks. Attempt 1’s sole adverse job timed out downloading LibreOffice apt packages before its UNO tests. A targeted retry passed all 171 UNO tests in 0.820 s; the 38 previously successful jobs retained their original timestamps. No source changes or package rebuilds were needed. No additional manual Release rehearsal was dispatched.

The compact public verification receipt records the retained metadata and proof-file identities. All eleven public assets match GitHub’s reported sizes and SHA-256 digests; SHA256SUMS matches the ten packages. Static inspection of all six portable archives verified the final source/version, actual executable architectures, single application executable, payload inventory and source-matching notices. DMG/setup static coverage is limited to filenames, sizes and hashes. Manifest signing fields are declarations; the operating-system checks below verify macOS signatures.

Independent verification on an Apple M1 followed the retained Mac verifier contract for both ARM and Intel ZIP/DMG pairs: Developer ID team XXN44W8X56, notarization, stapled tickets and Gatekeeper assessment passed. For each architecture the ZIP and copied-out DMG app have identical inventories, unchanged after verification. The ARM ZIP and DMG apps also passed version and offline ethanol checks with an empty executable search path, unavailable Python/uv overrides and network denied. Intel was not executed locally because Rosetta was unavailable; native Intel CI packaging and signing runtime checks passed. These checks do not establish graphical acceptance on every platform.

The live browser demo served 0.13.1 at 2026-10-26 18:35 UTC after Documentation run 40378705715 passed at the final source. Its index matches the published archive. All seven current hashed JS/WASM assets and seven retained baseline assets match byte for byte; their thirteen unique live files returned HTTP 200. The archive has no embedded commit marker, so source attribution comes from the release and docs workflow context. This verifies deployed bytes rather than new interactive browser behavior.

The public npm package and its latest dist-tag both resolve to 0.13.1, with gitHead matching final source 25ace515. An isolated install with lifecycle scripts disabled passed. Standard npm signature/provenance verification passed with no invalid or missing entries, identifying the final source, v0.13.1 tag and Release attempt 2. The downloaded package’s actual WASM returned version 0.13.1, ethanol SMILES CCO and a valid SVG on macOS ARM64 with network denied. This is API smoke coverage; it does not add browser UI or all-platform runtime acceptance.

Windows production signing remains disabled; Windows and Linux downloads are unsigned.

Measurement and hardware limits

The earlier pointer-hover QA record met three predeclared spatial checks on its recorded M1 host: 14.08/7.16/13.53 pt gaps, against a 43.68 pt bond with ±2 pt uncertainty. The large-selection PDF record reported 53.678 ms for its earlier source-pinned sample. That remains historical evidence, not the current #574 result: the accepted current-source follow-up above measured 64.026666 → 30.036 ms on M1. That controlled median meets 33.3 ms; the original M4/window/NO₂/pointer-off/physical-input/scanout conditions remain unverified. These measurements are not final package benchmarks, application FPS or all-frame maxima.

This release record preserves the original scopes of those checks. Published package verification does not imply broad graphical acceptance on unavailable hardware or new performance guarantees.