fix(release): gate release identity, model/updater admission, and platform trust

.github/workflows/build-baseline.yml

@@ -410,8 +410,17 @@ jobs:
             bandscope-sbom.cdx.json
             supply-chain/supplemental-component-inventory.json
       - name: Validate release asset set
-        run: python3 scripts/release/select_release_assets.py --output release-assets.txt
-      - name: Create draft release with complete assets, then publish
+        run: python3 scripts/release/select_release_assets.py --output release-artifacts.txt
+      - name: Build receipt-bound updater manifest
+        run: |
+          python3 scripts/release/build_updater_manifest.py \
+            --git-sha "${{ github.sha }}" \
+            --repository "${{ github.repository }}" \
+            --server-url "${{ github.server_url }}" \
+            --output latest.json
+          cp release-artifacts.txt release-assets.txt
+          printf '%s\n' latest.json >> release-assets.txt
+      - name: Create draft release, re-verify hosted bytes, then publish
         env:
           GH_TOKEN: ${{ secrets.BANDSCOPE_RELEASE_TOKEN }}
           RELEASE_TAG: ${{ github.ref_name }}
@@ -425,7 +434,16 @@ jobs:
             echo "Release $RELEASE_TAG already exists; immutable release assets must be attached before publication."
             exit 1
           fi
-          python3 scripts/release/select_release_assets.py --input release-assets.txt
+          python3 scripts/release/select_release_assets.py --input release-artifacts.txt
+          python3 scripts/release/build_updater_manifest.py \
+            --git-sha "${{ github.sha }}" \
+            --repository "${{ github.repository }}" \
+            --server-url "${{ github.server_url }}" \
+            --output latest.json \
+            --check
+          cp release-artifacts.txt expected-release-assets.txt
+          printf '%s\n' latest.json >> expected-release-assets.txt
+          cmp -s expected-release-assets.txt release-assets.txt
           mapfile -t release_assets < release-assets.txt
           (( ${#release_assets[@]} > 0 ))
           gh release create "$RELEASE_TAG" \
@@ -435,4 +453,32 @@ jobs:
             --title "BandScope ${RELEASE_TAG#v}" \
             --verify-tag \
             --repo "${{ github.repository }}"
+
+          rm -rf draft-release-download
+          mkdir draft-release-download
+          gh release download "$RELEASE_TAG" \
+            --dir draft-release-download \
+            --repo "${{ github.repository }}"
+          python3 scripts/release/verify_hosted_release_assets.py \
+            --local-root . \
+            --hosted-root draft-release-download \
+            --asset-list release-assets.txt
+
           gh release edit "$RELEASE_TAG" --draft=false --repo "${{ github.repository }}"
+
+          rm -rf published-release-download
+          mkdir published-release-download
+          gh release download "$RELEASE_TAG" \
+            --dir published-release-download \
+            --repo "${{ github.repository }}"
+          python3 scripts/release/verify_hosted_release_assets.py \
+            --local-root . \
+            --hosted-root published-release-download \
+            --asset-list release-assets.txt
+
+          gh release verify "$RELEASE_TAG" --repo "${{ github.repository }}"
+          while IFS= read -r asset; do
+            [ -n "$asset" ] || continue
+            gh release verify-asset "$RELEASE_TAG" "$asset" \
+              --repo "${{ github.repository }}"
+          done < release-assets.txt

.github/workflows/ci.yml

@@ -48,9 +48,31 @@ jobs:
       - name: Reject manifest or lockfile drift
         run: git diff --exit-code -- package.json package-lock.json
 
+  distribution-download-platform:
+    name: gate / ci / distribution-download / ${{ matrix.os }}
+    needs: lock-validation
+    strategy:
+      fail-fast: false
+      matrix:
+        os:
+          - ubuntu-latest
+          - windows-2025
+          - macos-15
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - name: Install stable Rust toolchain
+        run: rustup toolchain install stable --profile minimal
+      - name: Test Distribution download staging and lease contracts
+        run: cargo +stable test --manifest-path apps/desktop/distribution-download/Cargo.toml --locked --all-targets
+
   verify:
     name: ci / build-and-test
-    needs: lock-validation
+    needs:
+      - lock-validation
+      - distribution-download-platform
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

ARCHITECTURE.md

@@ -1,6 +1,6 @@
 # ARCHITECTURE.md
 
-Last updated: 2026-03-11
+Last updated: 2026-09-15
 
 ## Brand source
 
@@ -58,11 +58,34 @@ Last updated: 2026-03-11
 ## Repository map
 
 - `apps/desktop` - desktop shell and user-facing React UI
+- `apps/desktop/distribution-core` - Tauri-independent Rust security policy for updater release identity, anti-replay, target compatibility, and project-schema-aware rollback decisions
+- `apps/desktop/distribution-runtime` - stateless Rust admission boundary for untrusted Tauri updater JSON; validates the complete four-target document including each platform's canonical standard-base64 outer signature envelope, then returns provisional metadata with the selected target's exact admitted URL/signature and cannot mutate freshness state
+- `apps/desktop/distribution-transport` - deterministic Rust response-state bridge from the strict provisional target projection to bounded updater staging; consumes metadata-owner signature syntax guarantees and owns exact effective-URL checks plus one-hop release-asset redirect admission, but not sockets, TLS, metadata authentication, minisign verification or installation
+- `apps/desktop/distribution-download` - network-library-independent Rust streaming/staging boundary for updater artifacts; owns expected-size/content-length/chunk/cumulative limits, exclusive temporary artifact lifecycle, cleanup-on-drop and read-only descriptor-bound verifier access, but not HTTP, signatures, digests or installation
+- `apps/desktop/distribution-state` - Distribution-owned bounded append/sync log for the highest authenticated updater identity; consumes `distribution-core` identity and never project bytes
 - `packages/shared-types` - stable cross-layer types shared by the UI and orchestration layer
 - `services/analysis-engine` - Python analysis service for source separation and music analysis
 - `scripts/harness` - fail-fast repo verification
 - `scripts/checks` - small doc and structure checks
 
+## Distribution/update bounded context
+
+- Distribution owns commercial release identity, native signing/notarization admission, updater policy, immutable publication evidence, bounded updater artifact transport/storage admission, highest-seen update freshness state, and last-known-good installer recovery decisions.
+- `apps/desktop/distribution-core` contains deterministic security decisions only. It does not fetch metadata, verify Tauri signatures, write project data, run installers, or manufacture signing/key authority.
+- `apps/desktop/distribution-runtime` admits the current static updater JSON only as bounded provisional remote input. It rejects duplicate/unknown members, unexpected targets, mutable release URLs, invalid release-identity syntax, and any supported platform signature that is not a bounded canonical RFC 4648 standard-base64 outer envelope; retains the selected target's canonical URL/signature from that same strict parse for later transport consumption; and projects the fixed app-owned highest-seen path without creating or writing it. It deliberately has no `distribution-state` dependency, and retained transport fields remain provisional rather than authenticated authority.
+- `apps/desktop/distribution-transport` consumes only that already-selected provisional projection and admits updater transport state without reparsing `raw_json` or duplicating signature-envelope syntax. A direct `200` must report the exact canonical initial URL. GitHub release-asset `302` handling is explicit and limited to one HTTPS hop to the current `release-assets.githubusercontent.com` egress allowlist; the follow-up must terminate in `200` at the exact admitted Location and redirect chaining fails closed. The CDN hostname is a product allowlist, not a claim that GitHub guarantees it permanently. The crate has no HTTP client, socket, installer, metadata-authentication, minisign-verification or freshness-state capability.
+- Publication mirrors that outer signature-envelope contract after exact receipt binding: `scripts/release/build_updater_manifest.py` requires `.sig` bytes to be canonical standard base64 and the decoded envelope payload to be UTF-8 before static updater JSON can be emitted. This is publication admission only and does not replace Tauri's updater signature verification.
+- `apps/desktop/distribution-download` owns the pure streaming/staging primitive used before artifact trust is established. It enforces a 2 GiB artifact ceiling, exact optional `Content-Length`, 1 MiB maximum caller chunk, cumulative overrun rejection before sink write, sink-error poisoning, exact-length completion, exclusive app-owned staging and cleanup-on-drop. A sealed artifact remains provisional; downstream verification reads the exact still-open descriptor through a positional `Read` wrapper and cannot obtain the underlying write-capable staging `File` through the public API. It does not perform network I/O, authenticate metadata, verify signatures/digests, run installers or mutate freshness state. Commercial completion requires the production HTTP adapter to disable implicit redirects, report response state through `distribution-transport`, and route actual response chunks through this boundary rather than relying on Tauri's full-response buffering.
+- `apps/desktop/distribution-state` persists only the highest authenticated release identity as a bounded append-only log. It revalidates committed identities, rejects local version regression/equivocation, synchronizes accepted appends, and recovers only a syntactically valid torn final-record prefix; it does not own Tauri networking/signature verification, installer execution, or project persistence.
+- Tauri updater signatures authenticate downloaded updater artifact bytes. They do not, by themselves, authenticate the whole `Update.raw_json` response or BandScope's `sourceCommit`/digest extensions. Remote metadata therefore stays provisional until a canonical metadata-authentication path binds its release identity to trusted authority.
+- Only after metadata authentication and updater artifact signature/digest/size binding may exact `version`, `sourceCommit`, updater SHA-256, target, and compatibility floor enter `distribution-core` and `distribution-state` as freshness authority.
+- Stable-channel automatic update decisions use canonical numeric `MAJOR.MINOR.PATCH`. Prerelease/build ordering is not approximated; a future beta channel requires a separate ADR and canonical SemVer implementation.
+- A release older than locally persisted highest-seen authenticated metadata is replay, and the same version with a different source commit or updater digest is equivocation. Neither may be silently downgraded into a normal update offer.
+- Highest-seen release identity belongs to Distribution-owned app state and is recorded only after its metadata identity has authenticated authority; installation completion is not required, but syntactically valid remote JSON alone is insufficient. Project Persistence remains owner of project bytes and project-schema truth.
+- Automatic rollback may use only a previously authenticated known-good installer whose version is older than the current installation and whose declared reader can open the current on-disk project schema. The decision core does not bypass project recovery or schema ownership.
+- `release/updater-policy.json` remains fail-closed while organization-approved updater key/production endpoint authority is absent. No source code or test fixture is production authority.
+- Traceability and claim boundaries live in `docs/traceability/updater-release-admission.md`, `docs/traceability/release-artifact-receipt.md`, `docs/traceability/updater-security-metadata.md`, `docs/traceability/updater-bounded-download.md`, and `docs/traceability/updater-transport-policy.md`.
+
 ## Product capability scope
 
 - BandScope is not only a shell around chord labels, stems, and ranges.
@@ -96,10 +119,11 @@ Last updated: 2026-03-11
 ## Harness decisions
 
 - The harness uses `npm` workspaces for JavaScript/TypeScript and `uv` for Python.
-- The desktop app is scaffolded as `Tauri + Vite + React`, but initial verification keeps Rust packaging out of the default quickcheck path.
+- The desktop app is scaffolded as `Tauri + Vite + React`. Full Tauri packaging remains outside the default quickcheck path, while security-critical Tauri-independent Rust bounded-context suites may be invoked from repository tests through a narrow validation boundary.
 - The desktop shell uses an explicit Tauri CSP that only allows self-hosted assets, inline styles, Tauri IPC, and loopback development traffic.
 - Mechanical gates focus on lint, typecheck, unit tests, coverage for Python, and documentation presence.
 - Python quality gates also require 100% docstring coverage via `package.json` script `check:python-docstrings`, enforced with Ruff rules `D100` through `D107` across tracked packages, modules, classes, nested classes, functions, methods (including `__init__`), `services/analysis-engine` tests, and repo-owned Python scripts.
+- Distribution `distribution-core`, `distribution-runtime`, `distribution-transport`, `distribution-download`, and `distribution-state` Rust compilation denies warnings and missing public rustdoc; their standalone locked unit suites are invoked by the repository analysis test harness without adding Python production logic.
 - Mechanical gates also enforce security document presence, plan `Security Notes`, and basic forbidden-pattern checks.
 - Security context is part of architecture, not just implementation detail; docs and plans must record the trust boundary touched by risky changes.
 - Supply-chain controls are part of the bootstrap architecture, not a release-afterthought.

apps/desktop/distribution-core/Cargo.toml

@@ -0,0 +1,13 @@
+[package]
+name = "bandscope-distribution-core"
+version = "0.1.0"
+edition = "2021"
+description = "Pure Distribution/update anti-replay and rollback decision core for BandScope."
+publish = false
+
+[workspace]
+
+[lints.rust]
+unsafe_code = "forbid"
+warnings = "deny"
+missing_docs = "deny"