[dlev02]

What changes?

Keydoze now updates itself with Sparkle 2. It checks GitHub once a day, asks before installing, and can be turned off in a new Settings window. There's also a Check for Updates… command. This is version 0.2.0, build 4.

• Updates and the feed must be EdDSA signed, with no fallback to an unsigned feed. The feed is releases/latest/download/appcast.xml.
• While a cleaning session runs, no check starts, Sparkle's windows stay hidden, its alerts are dismissed, and a relaunch waits until input is back.
• script/make_release.sh builds the notarized DMG and ZIP, the signed appcast and the checksums, and uploads nothing.
• Keydoze is no longer fully offline, so PRIVACY.md, the README, About, the guides and the templates now say what goes to GitHub and how to turn it off.
• Sparkle's MIT-style license ships in the app and is noted in NOTICE. It's compatible with Apache 2.0.

Verification

• swift test --disable-sandbox passes: 22 core and 13 adapter tests. The CI build steps also pass locally with ad-hoc signing.
• A real update ran from a lower-versioned copy to a higher-versioned one, through download, verify, install and relaunch. This used test keys and a local feed.
• A tampered ZIP, a wrong key, an edited feed and an unsigned feed were all refused.
• With the off switch on, no request is made even when a check is overdue.
• Session guard: simulated sessions, plus one real keyboard-only session with the watchdog armed and an update response arriving mid-session. A relaunch requested during a session waited until it ended; this needed a temporary test build, not committed.
• A dry run of the release script was accepted by Apple notarization for both the app and the DMG, and Gatekeeper accepted both.
• Settings, About and the update window were checked by eye in light and dark.

Details and limits are in docs/VALIDATION.md.

Not covered: a translocated copy, a copy in a folder the user can't write to, and macOS 26 runtime.

Contribution checklist

• The change is focused and preserves the privacy and input-safety boundaries, with no network use beyond update checks.
• Relevant tests or content checks pass, or limitations are explained above.
• No credentials, personal diagnostics, or generated app bundles are included.
• I have the right to contribute this work under Apache 2.0; any third-party material is identified.