Add cross-platform runtime and Windows/Linux shipping

.gitattributes

@@ -1 +1,13 @@
 backend/spike_corpus/*.wav filter=lfs diff=lfs merge=lfs -text
+
+# Managed runtimes hash these exact UTF-8 bytes. Checkout conversion would
+# otherwise make a release built on Windows disagree with the signed/pinned
+# manifest digests while preserving semantically identical text.
+backend/runtime-locks/*.txt text eol=lf
+scripts/sa3-requirements.lock text eol=lf
+scripts/sa3-tflite-requirements.lock text eol=lf
+mrt2-pytorch-pin.json text eol=lf
+mrt2-pytorch-wheels.json text eol=lf
+sa3-pin.json text eol=lf
+sa3-tflite-pin.json text eol=lf
+sa3-tflite-wheels.json text eol=lf

.github/CODEOWNERS

@@ -4,6 +4,17 @@
 /justfile @protocol-works/engineering
 /scripts/create-release.sh @protocol-works/engineering
 /scripts/build-macos-release.sh @protocol-works/engineering
+/scripts/build-linux-appimage.sh @protocol-works/engineering
+/scripts/assert-windows-release-rejects-unsigned.ps1 @protocol-works/engineering
+/scripts/build-windows-installer.ps1 @protocol-works/engineering
 /scripts/freeze-sidecar.sh @protocol-works/engineering
+/scripts/release_artifact.py @protocol-works/engineering
+/scripts/sign-windows.ps1 @protocol-works/engineering
+/scripts/test-windows-installer.ps1 @protocol-works/engineering
+/scripts/verify-windows-release-install.ps1 @protocol-works/engineering
+/scripts/verify-windows-signatures.ps1 @protocol-works/engineering
+/scripts/verify_linux_appimage.py @protocol-works/engineering
 /src-tauri/entitlements.plist @protocol-works/engineering
 /src-tauri/tauri*.conf.json @protocol-works/engineering
+/src-tauri/windows/English.nsh @protocol-works/engineering
+/src-tauri/windows/installer-hooks.nsh @protocol-works/engineering

.github/workflows/ci.yml

@@ -0,0 +1,344 @@
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  windows-managed-runtime:
+    name: Managed runtime qualification (Windows)
+    runs-on: windows-2025
+    timeout-minutes: 90
+
+    steps:
+      - name: Check out source and test corpus
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          lfs: true
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: "3.13"
+
+      - name: Set up Node.js
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 24
+          cache: npm
+          cache-dependency-path: frontend/package-lock.json
+
+      - name: Build frontend assets for native shell
+        working-directory: frontend
+        run: npm ci && npm run build
+
+      - name: Set up Rust
+        run: rustup toolchain install stable --profile minimal --no-self-update
+
+      - name: Test managed runtime workspace
+        working-directory: src-tauri
+        run: cargo test --locked --workspace --features managed-runtime
+
+      - name: Lint managed runtime workspace
+        working-directory: src-tauri
+        run: cargo clippy --locked --workspace --all-targets --features managed-runtime -- -D warnings
+
+      - name: Build managed runtime release
+        working-directory: src-tauri
+        run: cargo build --locked --workspace --release --features managed-runtime
+
+  shared:
+    name: Shared checks (${{ matrix.name }})
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 120
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - name: macOS
+            runner: macos-15
+          - name: Ubuntu
+            runner: ubuntu-24.04
+          - name: Windows
+            runner: windows-2025
+
+    steps:
+      - name: Check out source and test corpus
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          lfs: true
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: "3.13"
+
+      - name: Install locked Python environment tool
+        run: python -m pip install uv==0.11.7
+
+      - name: Test release artifact contract
+        run: python -m unittest discover -s scripts/tests -v
+
+      - name: Check release tooling formatting
+        run: >-
+          uv run --project backend --frozen --only-group ci ruff format --check
+          scripts/release_artifact.py scripts/verify_linux_appimage.py
+          scripts/tests/test_release_artifact.py
+          scripts/tests/test_verify_linux_appimage.py
+          scripts/tests/test_windows_packaging.py
+
+      - name: Lint release tooling
+        run: >-
+          uv run --project backend --frozen --only-group ci ruff check
+          scripts/release_artifact.py scripts/verify_linux_appimage.py
+          scripts/tests/test_release_artifact.py
+          scripts/tests/test_verify_linux_appimage.py
+          scripts/tests/test_windows_packaging.py
+
+      - name: Check portable Python formatting
+        working-directory: backend
+        run: uv run --frozen --only-group ci ruff format --check .
+
+      - name: Lint portable Python
+        working-directory: backend
+        run: uv run --frozen --only-group ci ruff check .
+
+      - name: Test portable Python services
+        working-directory: backend
+        run: >-
+          uv run --frozen --only-group ci python -m pytest
+          tests/test_loras.py
+          tests/test_worker.py
+          tests/test_sidecar.py
+          tests/test_controller.py
+          tests/test_frozen.py
+
+      # Most DeckEngine behavior is model-independent. The excluded tests cross
+      # the Magenta/MLX import boundary and remain in the local full suite and
+      # the signed macOS release runtime check.
+      - name: Test portable Python deck behavior
+        working-directory: backend
+        run: >-
+          uv run --frozen --only-group ci python -m pytest tests/test_engine.py
+          -k "not constructor_uses_reference_sampling_defaults
+          and not embed_sample
+          and not sample_key_never_hits_the_text_embedder
+          and not sample_cache
+          and not failed_embed_does_not_evict"
+
+      # SA3 uses a copied Python interpreter and fake CLI; no runtime, weights,
+      # accelerator, shell, or network is involved. The selected model-manager
+      # nodes exercise only SA3 readiness. Its Magenta discovery/download nodes
+      # remain behind the backend-specific runtime gate.
+      - name: Test model-free Python runtime contracts
+        working-directory: backend
+        run: >-
+          uv run --frozen --only-group ci python -m pytest
+          tests/test_sa3.py
+          tests/test_sa3_audio.py
+          tests/test_sa3_manifest.py
+          tests/test_gpu_broker.py
+          tests/test_mrt2_pytorch.py
+          tests/test_mrt2_runtime.py
+          tests/test_mrt2_runtime_locks.py
+          tests/test_render_sidecar.py
+          tests/test_runtime_paths.py
+          tests/test_sa3_cuda.py
+          tests/test_sa3_cuda_pins.py
+          tests/test_sa3_cuda_worker.py
+          tests/test_models.py::test_readiness_classifies_a_checkout
+          tests/test_models.py::test_readiness_missing_when_no_checkout
+
+      - name: Set up Node.js
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 24
+          cache: npm
+          cache-dependency-path: frontend/package-lock.json
+
+      - name: Install frontend dependencies
+        working-directory: frontend
+        run: npm ci
+
+      - name: Lint frontend
+        working-directory: frontend
+        run: npm run lint
+
+      - name: Type-check frontend
+        working-directory: frontend
+        run: npx tsc -b
+
+      - name: Test frontend
+        working-directory: frontend
+        run: npm test
+
+      - name: Build frontend assets for native shell
+        working-directory: frontend
+        run: npm run build
+
+      - name: Install Ubuntu native build dependencies
+        if: runner.os == 'Linux'
+        run: >-
+          sudo apt-get update && sudo apt-get install --yes
+          build-essential
+          libasound2-dev
+          libayatana-appindicator3-dev
+          libgtk-3-dev
+          libssl-dev
+          libudev-dev
+          libwebkit2gtk-4.1-dev
+          libxdo-dev
+          librsvg2-dev
+
+      - name: Set up Rust
+        run: rustup toolchain install stable --profile minimal --no-self-update
+
+      - name: Test Rust workspace
+        run: cargo test --locked --workspace --manifest-path src-tauri/Cargo.toml
+
+      - name: Lint Rust workspace
+        run: >-
+          cargo clippy --locked --workspace --all-targets
+          --manifest-path src-tauri/Cargo.toml -- -D warnings
+
+      - name: Install pinned Tauri packaging CLI
+        if: runner.os == 'Windows'
+        run: cargo install tauri-cli --version '=2.11.2' --locked
+
+      - name: Build older unsigned Windows installer
+        if: runner.os == 'Windows'
+        id: windows_older
+        shell: pwsh
+        run: ./scripts/build-windows-installer.ps1 -ReleaseTag v2026.08.1 -UnsignedDevelopment
+
+      - name: Build newer unsigned Windows installer
+        if: runner.os == 'Windows'
+        id: windows_newer
+        shell: pwsh
+        run: ./scripts/build-windows-installer.ps1 -ReleaseTag v2026.08.2 -UnsignedDevelopment
+
+      - name: Prove release verification rejects unsigned artifacts
+        if: runner.os == 'Windows'
+        shell: pwsh
+        run: >-
+          ./scripts/assert-windows-release-rejects-unsigned.ps1
+          -Path '${{ steps.windows_newer.outputs.installer }}'
+
+      - name: Test Windows installer lifecycle
+        if: runner.os == 'Windows'
+        shell: pwsh
+        run: >-
+          ./scripts/test-windows-installer.ps1
+          -OlderInstaller '${{ steps.windows_older.outputs.installer }}'
+          -NewerInstaller '${{ steps.windows_newer.outputs.installer }}'
+          -OlderVersion '${{ steps.windows_older.outputs.version }}'
+          -NewerVersion '${{ steps.windows_newer.outputs.version }}'
+
+      - name: Upload unsigned Windows development installer
+        if: runner.os == 'Windows'
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: windows-x64-unsigned-development
+          path: ${{ steps.windows_newer.outputs.installer }}
+          if-no-files-found: error
+          retention-days: 7
+
+  linux_appimage:
+    name: Linux AppImage contract (Ubuntu 22.04)
+    runs-on: ubuntu-22.04
+    timeout-minutes: 90
+
+    steps:
+      - name: Check out source and test corpus
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          lfs: true
+          persist-credentials: false
+
+      - name: Set up Node.js
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 24
+          cache: npm
+          cache-dependency-path: frontend/package-lock.json
+
+      - name: Install pinned native build dependencies
+        shell: bash
+        run: |
+          set -euo pipefail
+          sudo apt-get update
+          sudo apt-get install --yes \
+            binutils \
+            build-essential \
+            libasound2-dev \
+            libayatana-appindicator3-dev \
+            libfuse2 \
+            libgtk-3-dev \
+            libssl-dev \
+            libudev-dev \
+            libwebkit2gtk-4.1-dev \
+            libxdo-dev \
+            librsvg2-dev \
+            xvfb
+          rustup toolchain install stable --profile minimal --no-self-update
+          rustup default stable
+          cargo install tauri-cli --version '=2.11.2' --locked
+          npm ci --prefix frontend
+
+      - name: Build and audit AppImage
+        env:
+          LSDJ_LINUX_AUDIT_PATH: ${{ runner.temp }}/linux-package-audit.json
+        shell: bash
+        run: scripts/build-linux-appimage.sh
+
+      - name: Smoke AppImage with spaces, Unicode, and isolated XDG roots
+        shell: bash
+        run: |
+          set -euo pipefail
+          shopt -s nullglob
+          APPIMAGES=(src-tauri/target/release/bundle/appimage/*.AppImage)
+          [[ "${#APPIMAGES[@]}" -eq 1 ]]
+
+          PROFILE="$RUNNER_TEMP/DJ Name 音楽"
+          export HOME="$PROFILE/home"
+          export XDG_CONFIG_HOME="$PROFILE/config 空間"
+          export XDG_DATA_HOME="$PROFILE/data 音楽"
+          export XDG_CACHE_HOME="$PROFILE/cache 音楽"
+          export XDG_RUNTIME_DIR="$RUNNER_TEMP/xdg-runtime"
+          mkdir -p \
+            "$HOME" \
+            "$XDG_CONFIG_HOME" \
+            "$XDG_DATA_HOME" \
+            "$XDG_CACHE_HOME" \
+            "$XDG_RUNTIME_DIR"
+          chmod 700 "$XDG_RUNTIME_DIR"
+
+          set +e
+          APPIMAGE_EXTRACT_AND_RUN=1 timeout --signal=TERM --kill-after=5s 15s \
+            xvfb-run --auto-servernum "${APPIMAGES[0]}"
+          STATUS=$?
+          set -e
+          [[ "$STATUS" -eq 0 || "$STATUS" -eq 124 || "$STATUS" -eq 143 ]]
+          test -d "$XDG_CONFIG_HOME/lsdj"
+          test -d "$XDG_DATA_HOME/lsdj"
+          test -d "$XDG_CACHE_HOME/lsdj"
+
+      - name: Upload package audit evidence
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: linux-package-audit
+          path: ${{ runner.temp }}/linux-package-audit.json
+          if-no-files-found: error
+          retention-days: 14