Check our work before you read a word of our copy.

Verify it yourself

Do not take our word for any of this. The quickest check is one command, and it asks Gatekeeper rather than us:

spctl -a -vv -t install /Volumes/FocusTimer/FocusTimer.app

For the whole chain, verify.sh runs fifteen checks across three layers: the bytes you downloaded, the outer DMG's notarisation ticket and Gatekeeper verdict, and the app inside it. If the hash does not match it stops before mounting anything.

curl -fsSLO https://hawserkit.com/verify.sh
curl -fsSLO https://hawserkit.com/verify.json
bash verify.sh FocusTimer.dmg

The hash it checks against is published in verify.json, which is regenerated whenever the download changes. That file is deliberately kept out of the edge cache for a week the way the video is: a stale copy would tell an honest visitor their good download is corrupt.

What this proves

• The exact bytes you downloaded match the bytes we published.
• The outer DMG is Developer ID signed, notarised and stapled, and Gatekeeper accepts it.
• The inner app passes codesign --verify --deep --strict and its Designated Requirement.
• The app is a genuine universal binary with a 13.0 deployment target.
• The bundled Sparkle updater and its XPC services are correctly signed and sandbox-ready.

What it does not prove

Said plainly, because a proof that overclaims is worth less than no proof:

• Not a live update round trip. The sample points at its own feed, which answers and carries one EdDSA-signed item for this same 0.1.1. So Sparkle finds a valid signed feed and correctly reports there is nothing newer, which is not the same as watching an update install.
• Not licence behaviour. Activation, offline grace, refund and revocation are not exercised here; the sample ships POLAR_ORGANIZATION_ID=REPLACE_ME, so its License tab shows the "developer setup incomplete" state on purpose.
• Nothing about runtime behaviour. This covers packaging, signing and distribution only.

A stronger check than this one

This page asks you to inspect an artifact we built, which proves our pipeline produces a valid one. Useful, but it is our homework. hawser-check is the same class of inspection pointed at an app you shipped, and it is the one that can tell you something you did not already know. It is free too, and it needs no download from us beyond one readable script.

If the sample holds up, the thing that produced it is $99, once. If it does not, tell us what broke: yaveez.dev@gmail.com.