{
  "schema": "finetic.release-evidence.v1",
  "product": "Finetic",
  "version": "0.2.4",
  "channel": "stable",
  "releasedAt": "2026-08-04T11:07:20Z",
  "sourceRevision": "bbc0610d6630bdf4b198f61b8e5fa4e06b68b399",
  "releaseTag": "v0.2.4",
  "releaseUrl": "https://hub.docker.com/r/youngstudiouk/finetic/tags?name=0.2.4",
  "workflow": {
    "name": "CI",
    "result": "success",
    "url": "https://github.com/360john360/finetic/actions/runs/30902375427"
  },
  "container": {
    "references": [
      "docker.io/youngstudiouk/finetic"
    ],
    "indexDigest": "sha256:544d7966221c069715b01db26bd5bba0f23820079c239176db52c50b471560f0",
    "platforms": {
      "linux/amd64": "sha256:dfdea1fb0fe2198f75afd31cbadbdb14ed3fa07ed00c19a5509c96a62379c9c4",
      "linux/arm64": "sha256:dfd4aa4e235159f329142d221ac482e31826d1fc608729904a7477c65b74ab09"
    },
    "supportedChannel": "docker.io/youngstudiouk/finetic:stable",
    "discoveryTags": ["0.2.4", "stable", "latest", "preview"],
    "attestations": {
      "provenance": "SLSA BuildKit provenance attached for each platform",
      "sbom": "SPDX 2.3 SBOM attached for each platform"
    }
  },
  "validation": {
    "automatedTests": "passed",
    "dependencyAuditHighOrCritical": "passed",
    "typescript": "passed",
    "compiledReleaseBuild": "passed",
    "deterministicBrowserPlaybackGate": "passed",
    "sourceFreeContainerInspection": "passed",
    "registryChannelAlignment": "passed"
  },
  "changes": [
    "Adds first-class household viewing profiles with protected administrator switching and remembered viewer selection.",
    "Adds the optional global Finetic Operator with saved chats, evidence-grounded answers and confirmation-bound administrator actions.",
    "Makes user, profile and invitation library permissions follow every configured movie, television, music and custom library root.",
    "Hardens cross-client playback stopping, stale-session cleanup and mutual exclusion between music and video playback.",
    "Refreshes music popularity through resilient provider evidence and consolidates provider-backed artist aliases and missing-separator tags during scans.",
    "Restores Operator starter prompts on plain-HTTP local-network installations."
  ],
  "limitations": [
    "This release record and its validation are first-party evidence, not independent certification.",
    "The attached SBOM is an inventory and does not by itself establish whether a component is exploitable.",
    "A new complete vulnerability report and application assessment have not yet been published for v0.2.4. The v0.1.92 reports remain historical evidence and are not attributed to this release.",
    "Finetic Operator remains hidden unless an administrator explicitly configures and enables server-side OpenAI access; Finetic does not provide an API key.",
    "The compiled public-preview artifacts contain the Finetic runtime but no media."
  ]
}