git:20261102.5b72677 to git:20261102.ea98d13

1 added, 1 removed. Audit A to A.

# KDock repository rules

## Versioning

- Never hand-edit the application version in `package.json`, `Cargo.toml`, `package-lock.json`, or `src-tauri/tauri.conf.json`.

- `npm run tauri build` must be the packaging entry point. `scripts/tauri-entry.mjs` runs Semifold before Tauri starts, because Tauri reads `tauri.conf.json` before `beforeBuildCommand`.

- `beforeBuildCommand` verifies the marker set by that wrapper. Direct `npx tauri build`, cargo packaging, or another Tauri entry point must fail instead of producing an unbumped package.

- CI runs `smif version` during packaging and commits the generated version/changelog changes back to `main` after a successful build.

- Use `scripts/semfold-version.ps1 -DryRun` to preview a release without changing files.

- Do not bypass the Semifold flow with `cargo build --release` when producing a distributable package.

## Update manifest

- `release/kdock-update.json` is generated by `scripts/release-manifest.mjs` in CI and uploaded with the rolling `test-latest` release.

- - The startup updater accepts installer URLs only from the KDock GitHub Release and never installs automatically.

+ - The startup updater accepts installer URLs only from the KDock GitHub Release, downloads to app-local storage, verifies the manifest SHA-256, and never installs without explicit user confirmation.