fix(notify): restore D022 transcript comparison

[psimaker]

Summary

• expose the exact D022 transcript fingerprint in the explicit local diagnostics-docker.sh list output while an authorization is pending
• derive the value from the durable app-request and helper-accept digests, fail closed on malformed pending state, and omit it after activation
• prepare immutable helper patch release 2.0.1 without changing the published notify-v2.0.0 tag or artifacts
• keep notify-v1.8.0 as the fixed rollback baseline and make generated release notes use the manifest version

Reason

Decision 022 requires the app user and local operator to compare the same 12-character transcript fingerprint before the app sends type 3. Helper 2.0.0 computed this value only in tests and did not expose it to the operator. The capable app milestone therefore cannot activate pairing truthfully against 2.0.0.

Scope

This PR changes only the local helper admin display, its tests and operator documentation, plus version-pinned helper publication metadata for 2.0.1. It adds no endpoint, listener, discovery, trust adoption, namespace creation, transfer artifact, app runtime, Relay change, or Decision 024 change.

Local verification

• cd notify && go test ./...
• cd notify && go test -race ./...
• cd notify && go vet ./...
• cd notify && govulncheck ./...
• ruby .github/scripts/notify-publish-safety.rb
• notify/scripts/tests/install-dry-run-test.sh
• actionlint 1.7.12 over all workflows
• zizmor 1.27.0, medium and above, over the changed Docker and Security workflows
• ShellCheck 0.10.0 over the changed/relevant shell scripts
• git diff --check

All passed locally.

Security, privacy, and secrets

The transcript fingerprint is comparison UI, not a credential. It is emitted only by the explicit local operator command while state is exactly pending; active rows omit it. Invalid durable digest state returns unavailable instead of displaying a derived value. No QR body, bootstrap secret, key, binding, nonce, signed body, path, or token is logged or added. No scanner exception or security gate is weakened.

Existing-user and compatibility impact

Existing app/helper/Relay behavior remains dormant and unchanged until explicit diagnostics configuration and pairing. Old apps ignore the capability. Helper downgrade makes diagnostics unavailable without deleting credentials, namespace data, backups, versions, conflicts, or tombstones. Trigger v1 and Relay v1 stay wire-compatible.

Migration and rollback

Publication is not performed by this PR. After merge, notify-v2.0.1 must be created from the exact verified merge commit and pass the owner-gated immutable image/binary, SBOM, vulnerability, secret, upgrade, rollback, forward-recovery, and post-publication gates. notify-v2.0.0 remains unchanged; rollback remains the exact published 1.8.0 baseline.

Evidence boundary

Upload, download, and roundtrip product evidence remain unset. Cleanup remains evidence-orthogonal. VaultSync 2.0 remains NO-GO.

[coderabbitai]

Warning

Review limit reached

@psimaker, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 45 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: ddbf1793-3d21-4f3c-ab26-99d23e7f864c

📥 Commits

Reviewing files that changed from the base of the PR and between ab644d2 and a9f3020.

📒 Files selected for processing (2)

• .github/scripts/notify-publish-safety.rb
• .github/workflows/security.yml

📝 Walkthrough

Walkthrough

The release updates helper references from 2.0.0 to 2.0.1 across metadata, installers, workflows, tests, and rollout documentation. Diagnostics listings now show transcript fingerprints for pending authorizations and reject missing state digests.

Changes

Helper 2.0.1 publication rollout

Layer / File(s)	Summary
Release references and publication checks .github/scripts/notify-publish-safety.rb, notify/release.json	Publication assertions and release metadata now require helper 2.0.1 identifiers and image tags.
Installer, compose, and CI release wiring .github/workflows/*, notify/docker-compose.yml, notify/scripts/*, notify/README.md	Installer defaults, compose configuration, release workflows, documentation examples, and smoke tests reference helper 2.0.1.
Publication and compatibility rollout documentation docs/helper-publication-rollout.md, docs/relay-spec.md	Rollout, compatibility, monitoring, migration, recovery, and relay documentation now describes helper 2.0.1.

Diagnostics pairing transcript

Layer / File(s)	Summary
Pending authorization listing behavior notify/diagnostics_operator.go, notify/diagnostics_pairing_test.go	Pending authorization lines include a computed transcript fingerprint, and missing digest state causes listing failure.
Operator documentation and integration assertions docs/helper-runtime-packaging-readiness.md, notify/README.md, notify/diagnostics_runtime_integration_test.go	Local transcript comparison guidance was added, and active listings are verified not to retain pending fingerprints.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

• psimaker/vaultsync#114: Directly overlaps with the diagnostics operator listing and pairing runtime behavior.
• psimaker/vaultsync#116: Overlaps with publication immutability gates and rollout evidence.
• psimaker/vaultsync#111: Modifies the same publication-safety policy and related CI workflows.

Poem

Two-oh-one takes flight,
Fingerprints guide pairing right,
Pending rows speak clear,
Stale tags disappear,
Releases roll into the light.

🚥 Pre-merge checks | ✅ 7

✅ Passed checks (7 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
No Private Note Leakage	✅ Passed	No new private-note/secret sinks: the only added output is a local 12-char transcript fingerprint from pairing digests, active rows omit it, and no changed file logs keys/paths.
Bounded Ios Background Work	✅ Passed	PR touches only docs/workflows/scripts; HEAD has no .swift files, so there are no iOS background-execution changes to bound.
Bridge Contract Compatibility	✅ Passed	No gomobile/Swift bridge APIs or JSON shapes changed; the PR only adjusts internal diagnostics listing/tests and release/docs metadata.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title is concise, conventional-commit style, and accurately summarizes the main change.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch agent/helper-pairing-transcript-fingerprint

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}