auraoneai · gchahal1982 · Jul 13, 2026 · Jul 13, 2026
@@ -6,7 +6,7 @@ on:
       version:
         description: "Release version without leading v"
         required: true
-        default: "0.1.0"
+        default: "0.2.0"
         type: string
       channel:
         description: "Release channel"
@@ -25,7 +25,7 @@ permissions:
 
 env:
   NODE_VERSION: "20"
-  PNPM_VERSION: "10.33.2"
+  PNPM_VERSION: "10.18.0"
 
 jobs:
   build:
@@ -122,7 +122,7 @@ jobs:
             python3 -c 'print("bubblewrap-ok")'
 
       - name: Build Tauri bundles
-        run: pnpm exec tauri build
+        run: pnpm run tauri:build
 
       - name: Packaged startup smoke
         run: pnpm run test:packaged-startup -- --json --no-build

@@ -1,9 +1,9 @@
-node_modules
-dist
-.vercel
-desktop/src-tauri/target
-desktop/src-tauri/gen
-crates/*/target
-.DS_Store
+.vercel/
+dist/
+node_modules/
+packages/*/dist/
+packages/*/node_modules/
+desktop/src-tauri/target/
+cli/.pytest_cache/
+cli/**/__pycache__/
 *.pyc
-__pycache__/
@@ -0,0 +1,4 @@
+node_modules
+dist
+desktop/src-tauri/target
+.vercel
@@ -0,0 +1,24 @@
+# Changelog
+
+All notable changes to Agent Studio Open are documented in this file.
+
+## 0.2.0 - 2026-07-12
+
+### Changed
+
+- Replaced the cream, serif, remote-font, noise, gradient, and glass presentation
+  with the light-first Proofline visual system.
+- Aligned Connect, Compose, Traces, Replay, A2A, Data network, Compare, Ship,
+  Settings, first-run, error, loading, empty, and evidence states.
+- Added compact responsive navigation, 44px mobile controls, stronger focus
+  indicators, reduced-motion support, and clearer semantic state colors.
+- Replaced the pinned macOS artifact URL with a configurable stable release URL.
+- Added an explicit signed-update state in Settings.
+- Aligned the VS Code Compose webview with the same Proofline tokens.
+
+### Release
+
+- Synchronized the desktop, CLI, and VS Code release version at `0.2.0`.
+- Desktop release links can be overridden with
+  `VITE_AGENT_STUDIO_DESKTOP_RELEASE_URL`; the default points to the latest
+  GitHub release rather than a versioned artifact.
@@ -3,12 +3,26 @@
 Agent Studio Open is AuraOne's MIT-licensed, local-first IDE for debugging,
 replaying, comparing, and regression-testing AI agents that speak MCP and A2A.
 
-It is designed for the daily loop of an MCP server author or agent-platform
-engineer:
+It is designed for MCP server authors, agent-platform engineers, evaluation
+teams, and security reviewers who need protocol evidence rather than a hosted
+trace dashboard. Its differentiator is one desktop/browser/VS Code/CLI workflow
+for endpoint discovery, trace inspection, deterministic replay, behavioral
+comparison, risk review, and CI artifact export.
+
+## Visual Workflow
+
+![Agent Studio Open deterministic replay workspace showing the selected trace, tool sequence, replay evidence, and regression result](https://www.auraone.ai/open/agent-studio-open/screenshots/replay-run.webp)
+
+The selected proof image matches the single product view used by the public
+website route. Capture provenance is recorded in the
+[AuraFoundry release evidence](https://github.com/gchahal1982/AuraFoundry/blob/main/docs/evidence/final-makeover/assets/open-source-capture-provenance.json).
+
+## Daily Loop
 
 1. Connect to a local stdio MCP server or a remote SSE / HTTP / WebSocket server.
 2. Inspect tools, resources, prompts, raw manifests, logs, and risk findings.
-3. Compose schema-backed tool calls and model-driven agent loops.
+3. Compose schema-backed requests and model inputs without fabricating a local
+   tool result when the selected runtime does not expose execution.
 4. Record a session into a portable `.ast` trace store.
 5. Replay the same session deterministically with mocked tool outputs.
 6. Compare model behavior across provider profiles, including custom model IDs.
@@ -21,10 +35,62 @@ Agent Studio Open is not an orchestration framework and is not a hosted
 observability backend. It is the local debug and regression surface for agents
 built on other frameworks.
 
-## Quickstart
+## Install And Quickstart
+
+### Hosted Browser
+
+Open [agentstudio.auraone.ai](https://agentstudio.auraone.ai/) for the browser
+edition. It supports remote MCP/A2A work and local trace storage, but not stdio
+or an OTLP receiver.
+
+### Public Desktop Release
+
+Download the signed and notarized macOS Apple silicon DMG from
+[Agent Studio Open 0.2.0](https://github.com/auraoneai/agent-studio-open/releases/tag/v0.2.0).
+Verify the downloaded artifact before opening it:
+
+```bash
+shasum -a 256 Agent.Studio.Open_0.2.0_aarch64.dmg
+# 30adbf96b107eb221cce5e07514f4ead7ce32046253f89dd5692f77c52c578ca
+```
+
+The companion CLI is published independently on PyPI:
+
+```bash
+python -m pip install auraone-agent-studio-open==0.2.0
+agentstudio --help
+```
+
+The JavaScript MCP manifest validator and release metadata companion is
+published on npm:
+
+```bash
+npm install @auraone/agent-studio@0.2.0
+npx @auraone/agent-studio validate ./manifest.json
+```
+
+The npm package does not bundle the visual application or Python runtime.
+Homebrew is not a verified `0.2.0` distribution channel.
+
+### Source Checkout
+
+```bash
+git clone https://github.com/auraoneai/agent-studio-open.git
+cd agent-studio-open
+pnpm install
+pnpm dev
+```
+
+Use Node.js `20.19.5` or newer. This `0.2.0` repository vendors the exact
+shared AuraOne Open Studio source packages used by the application. A fresh
+clone therefore installs without a sibling monorepo checkout. Vite prints the
+browser URL.
+
+### CLI Workflow Example
+
+From an AuraFoundry source checkout:
 
 ```bash
-brew install auraoneai/open/agent-studio-open
 agentstudio --json connect stdio --command python --arg opensource/agent-studio-cookbook/sample-servers/filesystem-risk/server.py
 agentstudio risk-scan opensource/agent-studio-cookbook/sample-servers/filesystem-risk --format json --fail-on critical --out reports/risk.json
 agentstudio import-trace opensource/agent-studio-open/cli/tests/fixtures/openai_events.jsonl --format openai --store /tmp/filesystem-smoke.ast
@@ -33,8 +99,9 @@ agentstudio export gh-action opensource/agent-studio-open/cli/tests/fixtures/reg
 ```
 
 Desktop is required for stdio MCP and the local OTLP receiver. Browser edition
-supports remote SSE / HTTP MCP, A2A card testing, trace import, IndexedDB trace
-storage, passphrase-protected provider keys, and custom model picker entries.
+supports remote SSE / HTTP / WebSocket MCP, A2A card testing, trace import,
+IndexedDB trace storage, passphrase-protected provider keys, and custom model
+picker entries.
 
 ## Editions
 
@@ -45,27 +112,109 @@ storage, passphrase-protected provider keys, and custom model picker entries.
 | VS Code | Workspace MCP discovery, manifest inspector, compose webview, risk hovers, desktop deep links. | Editor companion, not a full IDE replacement. |
 | CLI | Pipe-friendly `agentstudio` binary for connect, record, replay, compare, risk-scan, A2A, and export. | CI and automation surface. |
 
+## Runtime, Data, And Network Boundary
+
+- **Browser data:** imported traces and workspace state use local IndexedDB.
+  Provider keys are passphrase-encrypted before browser persistence.
+- **Desktop data:** traces and exports remain local files. Provider secrets use
+  the OS keychain contract; stdio and OTLP stay behind the desktop boundary.
+- **Network:** a connection is created only when the user selects a remote
+  MCP/A2A endpoint, provider, model gateway, release/update action, or other
+  explicit network command. Browser mode cannot open a local stdio process.
+- **Telemetry:** telemetry is off by default and excludes prompts, tool inputs
+  and outputs, trace payloads, provider keys, headers, and other protocol
+  content. Local previews do not prove delivery.
+- **Exports:** replay stores, JUnit, GitHub Actions, PR-comment text, trace
+  cards, and intake packets are generated locally. Data leaves the machine only
+  through an explicit connection, upload, or user-directed handoff.
+
+## Interface System And Font Boundary
+
+Agent Studio Open uses the OSS-safe Proofline interface contract through the
+local `@auraone/aura-ide-kit` compatibility layer. The default experience is
+light-first, uses system sans-serif typography with a system monospace stack,
+keeps ordinary radii at 8px or less, and maps evidence states to explicit
+success, info, review, warning, danger, and blocked colors. No remote font is
+required to render the desktop, browser, or VS Code surfaces.
+
+The desktop download action resolves to the stable GitHub latest-release page
+by default. Release builds can set `VITE_AGENT_STUDIO_DESKTOP_RELEASE_URL` to a
+signed distribution landing page without changing application source.
+
+Private licensed font binaries are excluded from public source, npm metadata,
+VSIX/CLI packages, and desktop release artifacts. An authorized branded
+deployment may provide licensed typography only through a host-owned stylesheet
+on an approved same-origin path; if it is absent or blocked, the system stacks
+remain the supported fallback. Capture tooling may use an isolated temporary
+loopback font boundary, but it must never copy those binaries into a public
+package.
+
+## Proof And Verification
+
+```bash
+pnpm typecheck
+pnpm test
+pnpm test:a11y
+pnpm build
+pnpm desktop:check
+pnpm test:capture-evidence
+PYTHONPATH=cli/src python -m pytest -q cli/tests
+```
+
+The frontend suite covers protocol manifests, trace import, replay/compare,
+keyboard and screen-reader behavior, IndexedDB/key handling, and evidence
+exports. Rust and Python suites cover the desktop bridge, transports, OTLP,
+trace stores, risk scanning, and CLI artifact generation.
+
+The July 13, 2026 capture manifest preserves the original local-render
+provenance. Public availability is established separately by the pushed release
+commit, GitHub Release asset, registry package, checksum, notarization record,
+and production browser deployment.
+
+## Release Truth
+
+Status verified on **July 13, 2026**:
+
+- GitHub Release `agent-studio-open-v0.2.0` is public.
+- `Agent.Studio.Open_0.2.0_aarch64.dmg` is signed, notarized, stapled,
+  Gatekeeper accepted, checksum verified, and offline-install tested.
+- `auraone-agent-studio-open 0.2.0` is public on PyPI for CLI workflows.
+- `@auraone/agent-studio 0.2.0` is public on npm for MCP manifest validation
+  and release metadata.
+- The hosted browser edition is publicly reachable at
+  `agentstudio.auraone.ai`.
+- The npm package does not contain the root visual app. Homebrew, Windows,
+  Linux, and automatic updater channels are not published for `0.2.0`.
+
 ## Documentation
 
-- Product page: `/open/agent-studio-open`
-- Docs hub: `/resources/docs/agent-studio-open`
-- 60-second quickstart: `/resources/docs/agent-studio-open/quickstart`
-- MCP cookbook: `/resources/docs/agent-studio-open/mcp-cookbook`
-- A2A cookbook: `/resources/docs/agent-studio-open/a2a-cookbook`
-- OTEL cookbook: `/resources/docs/agent-studio-open/otel-cookbook`
-- CLI reference: `/resources/docs/agent-studio-open/cli-reference`
-- Privacy: `/resources/docs/agent-studio-open/privacy-telemetry`
-- Sandbox: `/resources/docs/agent-studio-open/sandbox`
-- Troubleshooting: `/resources/docs/agent-studio-open/troubleshooting`
-
-## Local-first privacy posture
-
-Trace contents stay on the user's machine unless the user explicitly exports a
-file, posts a PR comment, or packages an AuraOne intake packet. Telemetry is off
-by default and never includes prompts, tool outputs, provider keys, headers, or
-trace payloads. Desktop provider keys are stored through the OS keychain. Browser
-provider keys are stored as passphrase-encrypted IndexedDB records and can be
-saved, verified, or removed from Settings.
+- Product page: [auraone.ai/open/agent-studio-open](https://auraone.ai/open/agent-studio-open)
+- Docs hub: [Agent Studio Open docs](https://auraone.ai/resources/docs/agent-studio-open)
+- 60-second quickstart: [quickstart](https://auraone.ai/resources/docs/agent-studio-open/quickstart)
+- MCP cookbook: [MCP cookbook](https://auraone.ai/resources/docs/agent-studio-open/mcp-cookbook)
+- A2A cookbook: [A2A cookbook](https://auraone.ai/resources/docs/agent-studio-open/a2a-cookbook)
+- OTEL cookbook: [OTEL cookbook](https://auraone.ai/resources/docs/agent-studio-open/otel-cookbook)
+- CLI reference: [CLI reference](https://auraone.ai/resources/docs/agent-studio-open/cli-reference)
+- Privacy: [privacy and telemetry](https://auraone.ai/resources/docs/agent-studio-open/privacy-telemetry)
+- Sandbox: [sandbox](https://auraone.ai/resources/docs/agent-studio-open/sandbox)
+- Troubleshooting: [troubleshooting](https://auraone.ai/resources/docs/agent-studio-open/troubleshooting)
+
+## Local-First Privacy Posture
+
+Trace contents stay on the user's machine unless the user explicitly connects
+to a remote endpoint, exports a file for a user-directed handoff, or packages an
+AuraOne intake packet. Telemetry is off by default and never includes prompts,
+tool outputs, provider keys, headers, or trace payloads. Desktop provider keys
+are stored through the OS keychain. Browser provider keys are stored as
+passphrase-encrypted IndexedDB records and can be saved, verified, or removed
+from Settings.
+
+## Next Action
+
+Use the hosted browser, verified `0.2.0` GitHub DMG, or PyPI CLI for released
+behavior. Start with a non-sensitive fixture and a dry-run provider profile.
+Treat Homebrew, Windows, Linux, and automatic updater paths as unavailable until
+destination-specific evidence is published.
 
 ## License