Authoritative project documentation

ApiaryLens Preview 2 (build 0.1.0-preview.4)

Release date: 2026-07-18

Superseded by build 0.1.0-preview.5, published as ApiaryLens Preview 1 of the rebooted platform+web product. This build's GitHub release has been retitled "Superseded internal build — do not use", and it does not count in the restarted public preview sequence. Its air-gap bundle is defective (#82): the recorded image IDs do not survive docker load, so its lifecycle scripts fail closed on every host. Use the 0.1.0-preview.5 artifacts instead. The Windows Setup below remains the most recent Windows preview build; it carries the known deferred defect #84 and receives no further preview fixes pending the planned Windows rewrite.

Preview 2 is the second public ApiaryLens preview. Its wire/semver version is the internal build number 0.1.0-preview.4: build ordinals only ever increase and may not match the public preview number (preview.2 and preview.3 were consumed by unpublished internal drafts). Tags, manifests, and artifact names carry the build number; this preview's public name is Preview 2.

Preview 2 is the first ApiaryLens release that offers the Windows desktop application as a downloadable preview artifact. The Windows Setup executable in this release is not Authenticode signed; it ships under the unsigned-preview conditions of the accepted platform design (labeling, published checksums, keyless attestation, honest SmartScreen documentation, and fail-closed signed channels). Release candidate and stable releases cannot ship unsigned.

What changed since Public Preview 1

Added the standalone Windows desktop application (Electron + Squirrel, per-user install, no elevation): offline-first standalone mode, first-run mode chooser, connect-at-install and connect-later Scout Bee profiles, verified Windows backup/restore, standalone-to-connected migration with interruption resume and rollback, update ledger, and package-manager install detection.
Added the release-engineering pipeline: SignPath-ready Authenticode signing round trip (fail-closed for RC/stable, explicit opt-in labeled unsigned previews), Sigstore keyless attestation of every published subject, SHA-256 manifest publication, and immutable GitHub release publication.
Added the air-gapped Compose bundle with offline lifecycle scripts (install, update, rollback, restore, tamper fail-closed) and the machine-verified compatibility manifest binding contracts, migrations, upgrade/rollback constraints, and lifecycle verb ownership.
Added the cross-client conformance fixture suite exercising both backend profiles, decomposed the web client into client core, local store, and feature UI, and added profile import preview, clickable Overview cards, and the offline beekeeping glossary.
Continued equipment stack, weather snapshot, synchronization, and accessibility work carried in the internal 0.1.0-preview.2 and 0.1.0-preview.3 build records (unpublished drafts; their build numbers were consumed and are never reused).

Windows installation (unsigned preview)

The Windows artifact is published on the GitHub release for tag v0.1.0-preview.4 as ApiaryLensSetup-UNSIGNED-PREVIEW.exe, beside SHA256SUMS, windows-package.json, and the signing evidence record apiarylens-windows-signing.json. The installed app labels itself UNSIGNED-PREVIEW in the Account and build view.

What Windows will tell you, honestly

Because the installer is not Authenticode signed, Windows SmartScreen will warn that the file is from an unknown publisher, and Microsoft Defender may flag the download. Those warnings are accurate. Windows cannot verify who published an unsigned file, and continuing past the prompt is not safe on trust alone. Bypassing SmartScreen is only reasonable after you have verified the exact bytes yourself:

Download ApiaryLensSetup-UNSIGNED-PREVIEW.exe and SHA256SUMS from the v0.1.0-preview.4 GitHub release.
Verify the checksum: Get-FileHash .\ApiaryLensSetup-UNSIGNED-PREVIEW.exe -Algorithm SHA256 and compare it to the entry in SHA256SUMS.
Verify the keyless attestation: gh attestation verify .\ApiaryLensSetup-UNSIGNED-PREVIEW.exe --repo ApiaryLens/apiarylens
Only then run the installer (per-user, no elevation). If the hash or attestation does not verify, delete the file and do not install it.

If you are not comfortable performing these checks, wait for a signed release. Preview builds are for testing with data you can afford to lose; keep current backups and exports.

Compatibility

Product: 0.1.0-preview.4
API contract: 1.0
Sync contract: 1
Database migration head: 0004
Deployment-plan contract: 1
Minimum direct upgrade source: 0.1.0-preview.1

Scout Bee is independently versioned; the compatibility manifest published with this release records the exact artifact identities.

Known limitations

The Windows Setup executable and the binaries inside its update packages are unsigned; SmartScreen and Defender warnings are expected and accurate.
winget and Chocolatey submissions are explicitly excluded until the first signed stable release (GV4); draft manifests exist in-repo only.
The extended manual assistive-technology matrix (NVDA, VoiceOver, retail Windows High Contrast, native zoom) remains scheduled beyond the preview.
Native iPhone and Android applications, AI, video, sensors, passkeys, and OIDC federation are post-MVP.