1.2.0-alpha.5

Templar 1.2.0-alpha.5

1.2.0-alpha.5 is the published packaged validation candidate for Templar’s persistence, recovery, and custom-CSS safety remediation. It maintains the v1 note/template compatibility contract and corrects the final GitHub release publish-job context issue discovered while validating alpha.4.

Why alpha.5

The immutable 1.2.0-alpha.4 tag completed its Node 20 build, ship verification, checksum staging, artifact upload, and artifact download, but the checkout-free publish job invoked gh release without an explicit repository. No alpha.4 GitHub release was created and its tag is not repointed. Alpha.5 passes ${GITHUB_REPOSITORY} to every release operation so the verified artifact handoff completes without expanding the publish job’s trust boundary.

Remediation candidate contents

• Broad custom CSS cannot escape the virtual page subtree or make essentially every note descendant unreadable through transparency, typography, clipping, or zero-geometry rules.
• Automatic Style Rule writes use a raw-fingerprint compare-and-swap guard; a note changed after rule inspection is skipped instead of overwritten.
• Explicit Batch Apply can replace a current valid style while preserving selected per-note page options; protected data is skipped.
• Destructive operations affecting protected outer data, nested source snapshots, malformed/future settings, or quarantined templates are recovery-backed and fingerprint-checked.
• Supported schemas migrate in memory through runtime and import paths without persisting a read-time upgrade.
• Recovery UI, post-write warnings, multi-template settings mutation, runtime-policy template interpolation scanning, and renderer lifecycle/performance evidence have been completed.

Automated verification

The exact alpha.5 candidate is verified with:

• ESLint and all runtime, test, and tooling TypeScript checks.
• 47 Vitest files / 259 tests, including 8 integration files / 19 integration tests.
• V8 coverage: 54.46% statements and lines, 79.23% branches, and 78.33% functions.
• Production build, mobile-bundle guard, runtime privacy-policy guard, release metadata verifier, BRAT contract verifier, dependency audits (zero vulnerabilities), and the full benchmark matrix including PageRenderer workloads.

The tag workflow rebuilds with Node 20, verifies checksums and the BRAT contract, uploads and redownloads the exact verified staging bundle, creates a draft GitHub release, verifies its downloaded asset hashes, and only then publishes main.js, manifest.json, styles.css, and SHA256SUMS.txt.

Validation still required before beta

This published alpha package is the required package under test for beta promotion. The following results must be recorded against its downloaded artifacts before beta promotion:

• BRAT clean-vault install, frozen-tag, update, deep-link, and reinstall behavior.
• Upgrade from the previous alpha with styled notes, templates, rules, settings, and source snapshots.
• Desktop Reading View, Live Preview, multiple-leaf, popout, page-mode, content, and print checks.
• Manual recovery, automatic-rule race, Batch Apply, and adversarial CSS sanity checks.
• Interactive mobile/emulation coverage and any physical-device results.

Installation and feedback

Install through BRAT with K0g1/Templar, or download the three plugin files from this release into <vault>/.obsidian/plugins/templar/. Back up important notes before testing prerelease software. When reporting a compatibility problem, include the Templar version, Obsidian version, operating system/device, view mode, exact steps, and whether the note contains existing templar frontmatter.

Known limitations

Templar remains a prerelease plugin. Its package-level beta validation matrix is still in progress at this alpha tag; physical iOS and Android results are not yet represented by this release note. Custom CSS intentionally supports only the documented virtual page selectors and may reject broad rules even when a host browser would accept them.