[abrichr]

Ready, but hold. Merging this PR starts the 0.21.0 release, and the founder approves that separately. The trusted publisher, the pypi-desktop and native-release environments and the openadapt-desktop-v* tag rulesets are now set up. Merge this only after #1292 (the unified release workflow) is on main, and merge main into this branch again before merging. Keep it out of every merge queue.

This ports OpenAdaptAI/openadapt-desktop#206 into packages/desktop. That PR wasn't merged in openadapt-desktop because any merge there auto-publishes to PyPI.

What it does

The technical details on the Needs you screen now include a Decided by list for each save of an item. Each entry is one of:

• a person in Run it;
• a person on their phone (a Cloud-signed, AAL2 decision);
• a named agent, rule or system, with the first characters of the grant a person signed.

approval_mode.item_approval adds approvers, built from closed codes and opaque ids in Flow's approvals rows. Names and values never appear. These rows are marked unverified ("a person should look"):

• a delegate row without a grant hash;
• a delegate on a person's route;
• a phone answer without AAL2.

Rows that aren't answers are left out. This is display only: what counts as approved, or as saved without a person, doesn't change.

Commits

1. feat(approval): show who decided each save and fix(approvers): …, carried over from the original branch with git am -3 --directory=packages/desktop. Authorship and messages are unchanged.
2. chore: release 0.21.0, written by scripts/prepare_release.py. It sets 0.21.0 in pyproject.toml, __init__, uv.lock and the five native version files, and adds the CHANGELOG section. That section also lists the two desktop fixes already on main that haven't been released yet.

Base

#1281 is merged, so this PR is now based on main. It still needs #1292 merged first, so that desktop-release.yml on main is the unified release workflow.

Tests

• tests/test_engine/test_item_approvers.py (new) and tests/test_release_intent.py pass. So do the approval, release and version tests (167 passed).
• check_release_consistency.py and check_release_intent.py --base origin/main pass. ruff is clean.
• The name guard and gitleaks found nothing.
• vitest for src/lib/approvalMode.test.ts runs in CI, not locally.

🤖 Generated with Claude Code