governance: centralize release metadata and source reviews

.github/ISSUE_TEMPLATE/accessibility-report.yml

@@ -0,0 +1,44 @@
+name: Accessibility report / 无障碍报告
+description: Report a keyboard, focus, contrast, screen-reader, zoom, motion, or forced-colors barrier.
+title: "[Accessibility] "
+labels: ["accessibility"]
+body:
+  - type: dropdown
+    id: surface
+    attributes:
+      label: Surface / 受影响部分
+      options:
+        - Gallery website
+        - Theme Manager
+        - Theme Manager installer or update UI
+    validations:
+      required: true
+
+  - type: textarea
+    id: environment
+    attributes:
+      label: Environment / 环境
+      description: OS, browser/WebView, assistive technology when relevant, zoom or display scaling, and color/motion settings.
+    validations:
+      required: true
+
+  - type: textarea
+    id: barrier
+    attributes:
+      label: Barrier and expected outcome / 障碍与预期结果
+      description: Include the control or content, current behavior, expected behavior, and why it blocks the task.
+    validations:
+      required: true
+
+  - type: textarea
+    id: reproduce
+    attributes:
+      label: Reproduction steps / 复现步骤
+    validations:
+      required: true
+
+  - type: textarea
+    id: evidence
+    attributes:
+      label: Privacy-safe evidence / 脱敏证据
+      description: Screenshots, a short recording, or screen-reader output are welcome after private content is removed.

.github/ISSUE_TEMPLATE/bug-report.yml

@@ -0,0 +1,63 @@
+name: Bug report / 缺陷报告
+description: Report a reproducible Gallery, generator, Theme Manager, or Native fallback defect.
+title: "[Bug] "
+labels: ["bug"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Do not include credentials, private chats, account names, local home paths, or unredacted screenshots. For a security vulnerability, follow SECURITY.md instead of opening a public issue.
+
+  - type: dropdown
+    id: surface
+    attributes:
+      label: Surface / 受影响部分
+      options:
+        - Gallery
+        - Theme generator or validator
+        - Theme Manager
+        - Full Skin runtime
+        - Native fallback
+        - Installer or release artifact
+    validations:
+      required: true
+
+  - type: textarea
+    id: environment
+    attributes:
+      label: Environment / 环境
+      description: Include OS, architecture, browser or Theme Manager version, and the exact Codex version only when relevant.
+    validations:
+      required: true
+
+  - type: textarea
+    id: reproduce
+    attributes:
+      label: Reproduction steps / 复现步骤
+      placeholder: |
+        1. ...
+        2. ...
+        3. ...
+    validations:
+      required: true
+
+  - type: textarea
+    id: expected_actual
+    attributes:
+      label: Expected and actual result / 预期与实际结果
+    validations:
+      required: true
+
+  - type: textarea
+    id: evidence
+    attributes:
+      label: Privacy-safe evidence / 脱敏证据
+      description: Add a redacted error, screenshot, or a minimal trace. Do not attach private application data.
+
+  - type: checkboxes
+    id: confirmation
+    attributes:
+      label: Confirmation / 确认
+      options:
+        - label: I removed private data, secrets, and personal paths from this report. / 我已移除私有数据、密钥和个人路径。
+          required: true

.github/ISSUE_TEMPLATE/compatibility-report.yml

@@ -0,0 +1,55 @@
+name: Compatibility report / 兼容性报告
+description: Report a platform, package-version, or supported-runtime compatibility result.
+title: "[Compatibility] "
+labels: ["compatibility"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Compatibility is version-bound. Please do not run a Full Skin probe against a personal or production session just to fill this form. Remove private paths, user names, chats, and account data.
+
+  - type: dropdown
+    id: platform
+    attributes:
+      label: Platform / 平台
+      options:
+        - Windows x64
+        - macOS Apple silicon
+        - macOS Intel
+        - Other or unsupported platform
+    validations:
+      required: true
+
+  - type: dropdown
+    id: path
+    attributes:
+      label: Feature path / 功能路径
+      options:
+        - Full Skin apply and restore
+        - Native fallback import
+        - Persistent replay
+        - Theme Manager build or launch
+        - App update channel
+    validations:
+      required: true
+
+  - type: textarea
+    id: identity
+    attributes:
+      label: Version and target identity / 版本与目标身份
+      description: State exact app and Theme Manager versions. Redact personal installation paths; package family/channel is enough.
+    validations:
+      required: true
+
+  - type: textarea
+    id: result
+    attributes:
+      label: Result and verification boundary / 结果与验证边界
+      description: Describe what worked or failed, what direct evidence you observed, and any step you intentionally did not run.
+    validations:
+      required: true
+
+  - type: textarea
+    id: evidence
+    attributes:
+      label: Privacy-safe evidence / 脱敏证据

.github/ISSUE_TEMPLATE/performance-report.yml

@@ -0,0 +1,51 @@
+name: Performance report / 性能报告
+description: Report measurable slowness, memory pressure, rendering jank, or generator regressions.
+title: "[Performance] "
+labels: ["performance"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Use privacy-safe measurements. Do not upload full process dumps, private pages, account data, or credentials.
+
+  - type: dropdown
+    id: surface
+    attributes:
+      label: Surface / 受影响部分
+      options:
+        - Gallery load, search, or filter
+        - Theme generator
+        - Theme Manager interface
+        - Full Skin apply or restore
+        - Persistent replay
+    validations:
+      required: true
+
+  - type: textarea
+    id: environment
+    attributes:
+      label: Environment and build / 环境与构建
+      description: OS, architecture, app/browser version, catalog revision, and hardware class. Omit serial numbers and private paths.
+    validations:
+      required: true
+
+  - type: textarea
+    id: measurement
+    attributes:
+      label: Measurement / 测量结果
+      description: State baseline, observed time or memory, sample count, and how you measured it.
+      placeholder: "Baseline: ...\nObserved: ...\nSamples: ...\nMethod: ..."
+    validations:
+      required: true
+
+  - type: textarea
+    id: reproduce
+    attributes:
+      label: Reproduction path / 复现路径
+    validations:
+      required: true
+
+  - type: textarea
+    id: evidence
+    attributes:
+      label: Privacy-safe trace or screenshot / 脱敏追踪或截图

.github/workflows/desktop.yml

@@ -202,6 +202,11 @@ jobs:
             fi
           done
 
+      - name: Verify release tag matches metadata
+        if: startsWith(github.ref, 'refs/tags/v') && vars.DESKTOP_RELEASE_READY == 'true'
+        shell: bash
+        run: test "${{ github.ref_name }}" = "v0.3.2"
+
       - name: Build updater-signed beta artifacts and publish the tagged release
         if: startsWith(github.ref, 'refs/tags/v') && vars.DESKTOP_RELEASE_READY == 'true'
         uses: tauri-apps/tauri-action@v1
@@ -214,10 +219,10 @@ jobs:
           projectPath: apps/theme-manager
           args: "--config src-tauri/tauri.release.conf.json ${{ matrix.build-args }}"
           tagName: ${{ github.ref_name }}
-          releaseName: "Awesome Codex Theme ${{ github.ref_name }} Beta"
+          releaseName: "Awesome Codex Theme v0.3.2 Beta"
           releaseAssetNamePattern: ${{ matrix.release-asset-name }}
           releaseBody: "Updater-signed Tauri Theme Manager beta with ACT Full Skin v1. Windows Authenticode and Apple Developer ID signing/notarization are not included in this beta, so the operating system may show an unknown-publisher warning. macOS bundles carry an ad-hoc signature for package integrity only. The app applies verified backgrounds, materials, colors, and theme copy without modifying ChatGPT application files."
-          prerelease: false
+          prerelease: true
           releaseDraft: true
 
       - name: Verify release macOS disk image and ad-hoc signature

README.md

@@ -29,6 +29,21 @@ The screenshot above comes from ChatGPT Beta `26.715.3651.0` after the skin was
 
 > Desktop builds are published only on the official [GitHub Releases page](https://github.com/rwang23/awesome-codex-theme/releases). If that page has no asset compatible with your operating system and CPU, there is no supported public installer for that target.
 
+<!-- ACT:CAPABILITY-MATRIX:START -->
+## Current platform capability matrix
+
+This table is generated from [`metadata/release.json`](metadata/release.json) and checked by `npm run metadata:check`.
+
+| Target | Full Skin | Native fallback | Persistence |
+| --- | --- | --- | --- |
+| Windows x64 | Verified (`26.715.3651.0`) | Verified (`26.715.2305.0`) | Verified (`26.715.3651.0`) |
+| macOS Apple silicon | Build-only | Build-only | Unverified |
+| macOS Intel | Build-only | Build-only | Unverified |
+
+The current catalog has **68 themes** and **136 modes** (revision `2026072201`).
+The current `beta` update-feed status is `unreleased`; in-app updates are not claimed until a signed static feed covers every platform.
+<!-- ACT:CAPABILITY-MATRIX:END -->
+
 ## More than a color palette
 
 Awesome Codex Theme combines the parts that make a desktop skin feel complete:
@@ -94,7 +109,7 @@ The Windows implementation of **Apply & Keep Full Skin** has passed an exact Cha
 
 Theme updates and app updates are independent. The manager refreshes the verified Registry on startup, so newly published themes appear immediately without reinstalling or restarting the app. A signed app update is needed only when the manager itself changes, such as its runtime, compatibility rules, security boundary, platform integration, or interface.
 
-The public beta uses Tauri updater signatures so future app updates can be verified. macOS bundles also carry an ad-hoc signature for package integrity, but Windows Authenticode, Apple Developer ID, and notarization are deferred. The operating system may still show an unknown-publisher warning; neither the updater signature nor the ad-hoc Mac signature removes SmartScreen or Gatekeeper warnings. See [release trust and signing](docs/release-signing.md).
+The public beta uses Tauri updater signatures for the future signed-update path. The current update-feed state is intentionally **unreleased**: a GitHub prerelease alone does not enable in-app updates until a signed static feed covers every platform and passes action-after verification. macOS bundles also carry an ad-hoc signature for package integrity, but Windows Authenticode, Apple Developer ID, and notarization are deferred. The operating system may still show an unknown-publisher warning; neither the updater signature nor the ad-hoc Mac signature removes SmartScreen or Gatekeeper warnings. See [release metadata](docs/release-metadata.md) and [release trust and signing](docs/release-signing.md).
 
 ## See the real result
 

README.zh-CN.md

@@ -29,6 +29,21 @@
 
 > 桌面安装包只会发布在官方 [GitHub Releases 页面](https://github.com/rwang23/awesome-codex-theme/releases)。如果页面上没有与你的操作系统和 CPU 匹配的文件，就表示当前没有支持该目标的公开安装包。
 
+<!-- ACT:CAPABILITY-MATRIX:START -->
+## 当前平台能力矩阵
+
+此表由 [`metadata/release.json`](metadata/release.json) 生成，并由 `npm run metadata:check` 校验。
+
+| 目标 | Full Skin | Native 回退 | 常驻 |
+| --- | --- | --- | --- |
+| Windows x64 | 已验证 (`26.715.3651.0`) | 已验证 (`26.715.2305.0`) | 已验证 (`26.715.3651.0`) |
+| macOS Apple 芯片 | 仅构建 | 仅构建 | 未验证 |
+| macOS Intel | 仅构建 | 仅构建 | 未验证 |
+
+当前 Catalog 有 **68 套主题**、**136 个模式**（修订 `2026072201`）。
+当前 `beta` 通道更新源状态为 `unreleased`；在签名静态清单覆盖全部平台前，不宣称应用内更新可用。
+<!-- ACT:CAPABILITY-MATRIX:END -->
+
 ## 它不只是换一组颜色
 
 Awesome Codex Theme 会把一套皮肤需要的部分一起应用：
@@ -93,7 +108,7 @@ Windows 版“应用并保持完整皮肤”已经通过 ChatGPT Beta `26.715.36
 
 主题更新与应用更新彼此独立。管理器启动时会刷新经过验证的 Registry，所以新发布的主题无需重装或重启应用就会直接出现。只有管理器自身的运行时、兼容规则、安全边界、平台集成或界面发生变化时，才需要安装签名应用更新。
 
-公开 Beta 使用 Tauri updater 签名来验证以后收到的应用更新；macOS 应用包还带有只用于包完整性的 ad-hoc 签名。Windows Authenticode、Apple Developer ID 与公证暂时延后，所以系统仍可能显示未知发布者提示。Updater 与 ad-hoc 签名都不能消除 SmartScreen 或 Gatekeeper 提示，详见[发布信任与签名](docs/release-signing.md)。
+公开 Beta 为未来的签名更新链路保留 Tauri updater 签名。当前更新源状态明确为**尚未发布**：仅有 GitHub prerelease 并不代表可以应用内更新，必须先有覆盖全部平台的签名静态清单并完成 action-after 验证。macOS 应用包还带有只用于包完整性的 ad-hoc 签名。Windows Authenticode、Apple Developer ID 与公证暂时延后，所以系统仍可能显示未知发布者提示。Updater 与 ad-hoc 签名都不能消除 SmartScreen 或 Gatekeeper 提示，详见[发布元数据](docs/release-metadata.md)与[发布信任与签名](docs/release-signing.md)。
 
 ## 真实使用效果