docs: add app screenshot and refresh release status

README.md

@@ -15,10 +15,15 @@
 
 CleanerX is a local-only desktop application for inspecting and cleaning storage created by Codex, Claude Code, OpenCode, and pi. It presents a metadata-first inventory, expands the exact cleanup scope for review, and fails closed when an Agent capability, storage schema, path, or writer state cannot be verified.
 
-CleanerX does not upload data, collect telemetry, synchronize with cloud services, or run in the background. A project path is grouping metadata only: CleanerX never recursively scans or modifies a source directory. The only built-in network action is an explicit application-update check against CleanerX's GitHub Releases feed.
+CleanerX does not upload data, collect telemetry, synchronize with cloud services, or run in the background. A project path is grouping metadata only: CleanerX never recursively scans or modifies a source directory. The only built-in external network action is an explicit application-update check against CleanerX's GitHub Releases feed.
+
+<p align="center">
+  <img src="assets/screenshots/cleanerx-sessions.jpg" width="1280" alt="CleanerX Sessions tree view showing demo projects, nested sessions, cleanup eligibility, sources, updated times, and storage sizes.">
+</p>
+<p align="center"><sub>Sessions tree view with built-in demo data.</sub></p>
 
 > [!CAUTION]
-> CleanerX permanently deletes private local data. The repository is an engineering preview and does not yet provide a promoted binary release; current builds are unsigned. Nothing is selected automatically. Review every cleanup plan; if backup is unavailable or left off, deletion is irreversible.
+> CleanerX permanently deletes private local data. The current [v0.1.0 release](https://github.com/BeaCox/CleanerX/releases/tag/v0.1.0) is explicitly unsigned and not notarized. Nothing is selected automatically. Review every cleanup plan; if backup is unavailable or left off, deletion is irreversible.
 
 ## Why CleanerX
 
@@ -55,7 +60,7 @@ The detailed routes, gates, limitations, and automated evidence live in the [mut
 | Linux x86_64 | WebKitGTK 4.1 desktop environment; CI uses Ubuntu 22.04 | Unsigned `.deb` and AppImage |
 | Windows 10/11 x86_64 | WebView2 Runtime; MSVC C runtime is statically linked | Unsigned MSI and NSIS installers |
 
-There is no promoted binary release yet. The release workflow can produce explicitly unsigned artifacts from a reviewed `v*` tag; see the [release policy](docs/open-source-release-plan.md) for the gates that separate source availability from supported cleanup builds.
+[CleanerX v0.1.0](https://github.com/BeaCox/CleanerX/releases/tag/v0.1.0) is the current stable release within the published compatibility matrix. Its macOS, Linux, and Windows artifacts are explicitly unsigned and not notarized; verify manually downloaded files against the release's SHA-256 checksums. See the [release policy](docs/open-source-release-plan.md) for the gates that separate source availability, mutation safety, and publisher identity.
 
 ## Application updates
 

SECURITY.md

@@ -4,7 +4,7 @@ CleanerX operates on private local Agent data and performs irreversible deletion
 
 ## Supported versions
 
-CleanerX is currently an engineering source preview. There is no promoted supported binary release yet. Report issues against the latest default-branch commit when possible and include the exact commit or tag you tested. The [open-source release policy](docs/open-source-release-plan.md) defines when a tagged build becomes an alpha, beta, or supported release.
+[CleanerX v0.1.0](https://github.com/BeaCox/CleanerX/releases/tag/v0.1.0) is the current supported release within the published capability and compatibility limits. Its downloadable applications are unsigned and not notarized. Report issues against the latest supported release or default-branch commit, and include the exact commit or tag you tested. The [open-source release policy](docs/open-source-release-plan.md) defines the release gates and support boundary.
 
 ## What to report privately
 
@@ -58,7 +58,7 @@ The maintainer will validate the report privately, bound the affected route, and
 - Backup identities stay in the native platform credential store: macOS Keychain, Linux Secret Service, or Windows Credential Manager. A missing or failing credential backend disables backup creation rather than weakening encryption.
 - CleanerX does not force-quit Codex or another writer.
 - Inventory may retain one normalized, 96-character first-user-message excerpt only as an unnamed pi session title, matching pi's own selector; no additional transcript content is retained by the scan.
-- There is no telemetry, crash upload, cloud synchronization, background daemon, or general shell/filesystem command exposed to the GUI. The sole built-in network action is a user-initiated HTTPS update check against the fixed CleanerX GitHub Releases endpoint; it sends no Agent data and never runs on a timer or at startup.
+- There is no telemetry, crash upload, cloud synchronization, background daemon, or general shell/filesystem command exposed to the GUI. The sole built-in external network action is a user-initiated HTTPS update check against the fixed CleanerX GitHub Releases endpoint; it sends no Agent data and never runs on a timer or at startup. The separately documented OpenCode Server route is restricted to a verified loopback endpoint on the local host.
 - Application updates use Tauri's official updater through three purpose-specific Rust commands. The webview cannot choose an endpoint, public key, target file, or shell command. Update installation requires a manifest-selected artifact whose Tauri signature verifies against the public key embedded in the installed build.
 - The updater signing private key is absent from the repository and release artifacts. Release automation receives it only through GitHub Actions secrets; the maintainer's recovery copy stays in the native credential store. Operating-system signing remains a separate trust layer: the updater signature does not make an artifact Apple-notarized or establish a Microsoft publisher identity.
 

docs/README.md

@@ -13,7 +13,7 @@ This directory contains the detailed product, compatibility, architecture, and r
 | what remains unfinished and what blocks a supported release | [Development roadmap](roadmap.md) |
 | how source preview, alpha, beta, unsigned artifacts, and `v0.1.0` are gated | [Open-source release policy](open-source-release-plan.md) |
 | how application update checks, signatures, platform packages, and release feeds work | [Application update strategy](update-strategy.md) |
-| what changed in the first release and which release checks remain | [`v0.1.0` release checklist](releases/v0.1.0.md) and the [changelog](../CHANGELOG.md) |
+| what changed in the published first release and which verification gaps remain | [`v0.1.0` release](https://github.com/BeaCox/CleanerX/releases/tag/v0.1.0), its [release checklist](releases/v0.1.0.md), and the [changelog](../CHANGELOG.md) |
 | the security boundary or how to report a vulnerability | [Security policy](../SECURITY.md) |
 | how to prepare and verify a contribution | [Contributor guide](../CONTRIBUTING.md) |
 | repository-wide constraints for coding agents | [Agent instructions](../AGENTS.md) |

docs/open-source-release-plan.md

@@ -2,7 +2,7 @@
 
 Status: active policy document
 
-Last reviewed: 2026-08-28
+Last reviewed: 2026-08-30
 
 This document defines the release states and gates for publishing CleanerX as an open-source project. It contains no implementation backlog. Every unfinished release, packaging, pilot, and maintenance task is tracked only in the [development roadmap](roadmap.md).
 
@@ -33,6 +33,8 @@ Advancing the source repository does not automatically advance the downloadable
 
 A future signed or notarized release may replace unsigned artifacts without changing the safety gates. Signing remains optional until a suitable release identity is available.
 
+Current state: [`v0.1.0`](https://github.com/BeaCox/CleanerX/releases/tag/v0.1.0) was published as the first stable release on 2026-08-28 UTC. Its applications remain unsigned and non-notarized, and support is limited to the capability-gated compatibility matrix.
+
 ## Source-preview gate
 
 The repository may be public before mutation hardening is complete only when:

docs/releases/v0.1.0.md

@@ -1,15 +1,15 @@
 # `v0.1.0` release checklist
 
-Status: pre-tag preparation
+Status: published 2026-08-28T18:33:44Z; unchecked items remain verification gaps
 
 Release type: unsigned initial stable release
 
-This checklist is the evidence record for the first CleanerX release. Do not publish the draft GitHub Release until every applicable item below is complete. Items that require tagged artifacts remain intentionally unchecked until the release workflow creates the draft.
+This checklist is the evidence record for the first CleanerX release. [`v0.1.0`](https://github.com/BeaCox/CleanerX/releases/tag/v0.1.0) was published from commit [`394516c`](https://github.com/BeaCox/CleanerX/commit/394516caaf7b06a0623c3add76d4d3041c029852) after the [tag workflow](https://github.com/BeaCox/CleanerX/actions/runs/33198876298) completed successfully. Unchecked items are retained as outstanding verification or repository-control gaps; publication alone is not evidence that they passed.
 
 ## Scope and identity
 
 - [x] The maintainer confirmed that the repository history, author identity, branding, and bundled image assets may be public.
-- [x] The release is named `v0.1.0` and is not presented as a prerelease; publication still requires every remaining gate below.
+- [x] The release is named `v0.1.0`, was published as stable, and is not presented as a prerelease.
 - [x] Cargo workspace, frontend package, Tauri configuration, mock update status, and version-facing tests use `0.1.0`.
 - [x] The updater public key is committed; `TAURI_SIGNING_PRIVATE_KEY` is configured as a GitHub Actions secret and is absent from the repository.
 - [x] The changelog records the user-visible scope, irreversible operations, updater boundary, and known limitations.
@@ -27,20 +27,20 @@ This checklist is the evidence record for the first CleanerX release. Do not pub
 
 ## Repository controls before tagging
 
-- [ ] The GitHub repository is public and `main` remains the default protected branch.
-- [ ] Private vulnerability reporting is enabled and the public advisory link resolves.
+- [x] The GitHub repository is public and `main` remains the default protected branch with required Linux, macOS, and Windows status checks.
+- [x] Private vulnerability reporting is enabled and the public advisory link resolves.
 - [ ] Secret scanning, push protection, the dependency graph, and Dependabot alerts are enabled.
-- [ ] The tag target is the reviewed `main` commit and the working tree is clean.
+- [x] The tag target is the reviewed `main` commit and the release workflow accepted its ancestry and synchronized versions.
 
 ## Tagged workflow and draft assets
 
-- [ ] The release workflow accepts the SemVer tag and confirms every version surface matches.
-- [ ] Product CI reruns successfully from the exact tag.
-- [ ] macOS arm64, macOS x86_64, Linux x86_64, and Windows x86_64 release builds succeed.
-- [ ] Both macOS DMGs retain the tracked guided-install background, configured Finder window, large icon positions, and exact `/Applications` link.
-- [ ] Every expected manual installer, updater payload, `.sig`, `latest.json`, lockfile archive, build-metadata file, and checksum file appears exactly once in the draft.
-- [ ] `latest.json` contains version `0.1.0`, the four intended updater targets, HTTPS URLs for the exact tag, and non-empty signatures.
-- [ ] Every staged asset matches `CleanerX_0.1.0_SHA256SUMS.txt`.
+- [x] The release workflow accepts the SemVer tag and confirms every version surface matches.
+- [x] Product CI reruns successfully from the exact tag.
+- [x] macOS arm64, macOS x86_64, Linux x86_64, and Windows x86_64 release builds succeed.
+- [x] Both macOS DMGs pass the release workflow's tracked guided-install layout verification.
+- [x] Every expected manual installer, updater payload, `.sig`, `latest.json`, lockfile archive, build-metadata file, and checksum file appears exactly once in the published release.
+- [x] `latest.json` passes the release workflow's version, target, URL, and non-empty-signature validation.
+- [ ] Every published asset has been downloaded and independently matched against `CleanerX_0.1.0_SHA256SUMS.txt`.
 - [ ] Bundles contain no development URL, private absolute path, local preference, real Agent data, journal, backup archive, signing private key, or backup identity.
 
 ## Native draft verification
@@ -56,10 +56,10 @@ This checklist is the evidence record for the first CleanerX release. Do not pub
 
 ## Publication approval
 
-- [ ] Release notes lead with irreversible-deletion risk, unsigned/not-notarized status, compatibility limits, and checksum-versus-publisher-identity guidance.
-- [ ] Release notes link the changelog, compatibility matrix, security policy, exact source commit, and this checklist.
+- [x] Release notes lead with irreversible-deletion risk, unsigned/not-notarized status, compatibility limits, and checksum-versus-publisher-identity guidance.
+- [x] Release notes link the changelog, compatibility matrix, security policy, exact source commit, and this checklist.
 - [ ] Remaining observations are either documented limitations or release blockers with the affected mutation capability disabled.
-- [ ] A maintainer has reviewed the complete draft and published it as the stable release.
+- [x] A maintainer published the release as stable after the draft workflow completed.
 
 ## Current dependency-audit notes
 

docs/roadmap.md

@@ -2,7 +2,7 @@
 
 Status: active roadmap
 
-Last updated: 2026-08-28
+Last updated: 2026-08-30
 
 This is the repository's single source of truth for unfinished work. Design, security, storage, and release documents describe current behavior and binding constraints; they link here instead of maintaining separate phase or task lists.
 
@@ -30,9 +30,10 @@ CleanerX currently has:
 - unsigned x86_64 Windows MSI and NSIS builds, with a native launch smoke test and an isolated Credential Manager backup/restore round trip;
 - Windows application-data and package-manager launcher discovery, stdio-only Codex control transport, writer-process recognition, write-through atomic replacement, volume/file identity checks, owner validation, and junction/reparse-point rejection;
 - reusable product CI with the complete Linux quality gate, cross-platform Rust tests, and native Linux/Windows launch smoke tests;
-- one SemVer tag workflow that reruns product CI, validates synchronized versions and `main` ancestry, builds every supported platform, and publishes a GitHub Release with explicitly unsigned assets, build metadata, committed lockfiles, and SHA-256 checksums.
+- a published, explicitly unsigned and non-notarized [`v0.1.0`](https://github.com/BeaCox/CleanerX/releases/tag/v0.1.0) stable release with macOS, Linux, and Windows assets, updater signatures, build metadata, committed lockfiles, and SHA-256 checksums; and
+- one SemVer tag workflow that reruns product CI, validates synchronized versions and `main` ancestry, builds every supported platform, and stages a GitHub Release for maintainer approval.
 
-This is an engineering MVP, not yet a promise that every Codex storage revision or crash boundary has production-grade coverage.
+This is a bounded stable release, not a promise that every Agent version, storage revision, native environment, or crash boundary has production-grade coverage.
 
 ## M0 — Publishable source baseline
 
@@ -98,9 +99,11 @@ Broader version-by-version fixtures, native disposable mutation cycles, and pilo
 
 ## M2 — Cross-platform release readiness
 
-Priority: repeatable unsigned artifacts and a bounded cross-platform path from alpha to `v0.1.0`. The release states and mandatory disclosures are defined in the [open-source release policy](open-source-release-plan.md).
+Priority: maintain the published unsigned `v0.1.0` release and close the outstanding native-host, accessibility, compatibility, and pilot evidence gaps. The release states and mandatory disclosures are defined in the [open-source release policy](open-source-release-plan.md).
 
-### Alpha artifacts
+**Status: `v0.1.0` is published. The successful tag workflow and complete release asset set establish repeatable packaging; the remaining verification and pilot work below still limits the support boundary.**
+
+### Remaining native artifact evidence
 
 - Add Tauri smoke tests for launch, scan, read-only degradation, detail loading, review dialog, backup listing, and settings persistence on macOS 13+.
 - Launch each architecture artifact on a clean supported environment and run an isolated mutation/backup/restore cycle with disposable Agent data.
@@ -109,19 +112,20 @@ Priority: repeatable unsigned artifacts and a bounded cross-platform path from a
 - Document reproducible local commands for both architectures and the supported Finder/System Settings opening path. Never instruct users to disable Gatekeeper globally or run broad quarantine-removal commands.
 - Verify the manual signed updater on every supported updater package after draft artifacts exist: no startup/background request, invalid signatures fail closed, stable feeds exclude prereleases, and installation still requires two explicit user actions.
 
-### Bounded pilot and beta
+### Remaining pilot and compatibility evidence
 
-- Recruit a small pilot audience that understands the unsigned engineering-preview status and begins with read-only inventory/review before mutation testing.
+- Recruit a small pilot audience that understands the unsigned, non-notarized, capability-limited support boundary and begins with read-only inventory/review before mutation testing.
 - Collect sanitized compatibility reports only through repository issues or discussions; do not add telemetry or request transcripts, credentials, memory contents, logs, journals, or backups.
 - Publish observed Agent versions, transports, capabilities, supported mutations, and read-only degradation in the compatibility table.
 - Treat possible source-tree, credential, configuration, backup, restore, or cross-item deletion defects as release blockers; visibly disable an affected mutation category when the regression cannot be bounded immediately.
 - Add a fixture and regression test before closing each storage-compatibility defect.
 
-### `v0.1.0` release and maintenance
+### `v0.1.0` maintenance
 
-- Complete the source, mutation-safety, unsigned-artifact, and pilot exit criteria; freeze the tested compatibility matrix and list unsupported operations by capability.
-- Synchronize all version surfaces and publish a changelog, migration notes where needed, checksums, build metadata, compatibility limits, and the exact source commit.
-- Repeat native smoke tests on the final tag instead of promoting an earlier build by renaming it.
+- Treat the published `v0.1.0` tag and compatibility matrix as the maintained baseline; do not retroactively widen its supported capability set.
+- Complete and record the remaining native, accessibility, disposable-data, and pilot evidence for the current release instead of inferring it from publication.
+- Synchronize every version surface and publish a changelog, migration notes where needed, checksums, build metadata, compatibility limits, and the exact source commit for each later release.
+- Repeat native smoke tests on every final tag instead of promoting an earlier build by renaming it.
 - Keep `main` releasable; use fixtures and negative-path tests for every new schema/category/mutation route; never silently widen a cleanup allowlist in a patch release.
 - Define patch releases for compatibility fixes and minor releases for backward-compatible capability work, and explicitly mark capabilities read-only when the maintained release line can no longer validate them.