fix(release): gate release identity, model/updater admission, and platform trust

.github/workflows/build-baseline.yml

@@ -411,7 +411,14 @@ jobs:
             supply-chain/supplemental-component-inventory.json
       - name: Validate release asset set
         run: python3 scripts/release/select_release_assets.py --output release-assets.txt
-      - name: Create draft release with complete assets, then publish
+      - name: Build receipt-bound updater manifest
+        run: |
+          python3 scripts/release/build_updater_manifest.py \
+            --git-sha "${{ github.sha }}" \
+            --repository "${{ github.repository }}" \
+            --server-url "${{ github.server_url }}" \
+            --output latest.json
+      - name: Create draft release, re-verify hosted bytes, then publish
         env:
           GH_TOKEN: ${{ secrets.BANDSCOPE_RELEASE_TOKEN }}
           RELEASE_TAG: ${{ github.ref_name }}
@@ -426,6 +433,13 @@ jobs:
             exit 1
           fi
           python3 scripts/release/select_release_assets.py --input release-assets.txt
+          python3 scripts/release/build_updater_manifest.py \
+            --git-sha "${{ github.sha }}" \
+            --repository "${{ github.repository }}" \
+            --server-url "${{ github.server_url }}" \
+            --output latest.json \
+            --check
+          printf '%s\n' latest.json >> release-assets.txt
           mapfile -t release_assets < release-assets.txt
           (( ${#release_assets[@]} > 0 ))
           gh release create "$RELEASE_TAG" \
@@ -435,4 +449,32 @@ jobs:
             --title "BandScope ${RELEASE_TAG#v}" \
             --verify-tag \
             --repo "${{ github.repository }}"
+
+          rm -rf draft-release-download
+          mkdir draft-release-download
+          gh release download "$RELEASE_TAG" \
+            --dir draft-release-download \
+            --repo "${{ github.repository }}"
+          python3 scripts/release/verify_hosted_release_assets.py \
+            --local-root . \
+            --hosted-root draft-release-download \
+            --asset-list release-assets.txt
+
           gh release edit "$RELEASE_TAG" --draft=false --repo "${{ github.repository }}"
+
+          rm -rf published-release-download
+          mkdir published-release-download
+          gh release download "$RELEASE_TAG" \
+            --dir published-release-download \
+            --repo "${{ github.repository }}"
+          python3 scripts/release/verify_hosted_release_assets.py \
+            --local-root . \
+            --hosted-root published-release-download \
+            --asset-list release-assets.txt
+
+          gh release verify "$RELEASE_TAG" --repo "${{ github.repository }}"
+          while IFS= read -r asset; do
+            [ -n "$asset" ] || continue
+            gh release verify-asset "$RELEASE_TAG" "$asset" \
+              --repo "${{ github.repository }}"
+          done < release-assets.txt

.github/workflows/ci.yml

@@ -33,6 +33,8 @@ jobs:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
+      - name: Validate Distribution HTTP dependency admission
+        run: python3 scripts/checks/verify_distribution_http_dependencies.py
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: "22.22.3"
@@ -48,9 +50,56 @@ jobs:
       - name: Reject manifest or lockfile drift
         run: git diff --exit-code -- package.json package-lock.json
 
+  distribution-download-platform:
+    name: gate / ci / distribution-download / ${{ matrix.os }}
+    needs: lock-validation
+    strategy:
+      fail-fast: false
+      matrix:
+        os:
+          - ubuntu-latest
+          - windows-2025
+          - macos-15
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - name: Install stable Rust toolchain
+        run: rustup toolchain install stable --profile minimal
+      - name: Test Distribution download staging and lease contracts
+        run: cargo +stable test --manifest-path apps/desktop/distribution-download/Cargo.toml --locked --all-targets
+
+  distribution-owned-platform:
+    name: gate / ci / distribution-owned / ${{ matrix.os }}
+    needs: lock-validation
+    strategy:
+      fail-fast: false
+      matrix:
+        os:
+          - ubuntu-latest
+          - windows-2025
+          - macos-15
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - name: Install stable Rust toolchain
+        run: rustup toolchain install stable --profile minimal
+      - name: Test Distribution state authority contracts
+        run: cargo +stable test --manifest-path apps/desktop/distribution-state/Cargo.toml --locked --all-targets
+      - name: Test Distribution metadata admission contracts
+        run: cargo +stable test --manifest-path apps/desktop/distribution-runtime/Cargo.toml --locked --all-targets
+      - name: Test Distribution transport contracts
+        run: cargo +stable test --manifest-path apps/desktop/distribution-transport/Cargo.toml --locked --all-targets
+
   verify:
     name: ci / build-and-test
-    needs: lock-validation
+    needs:
+      - lock-validation
+      - distribution-download-platform
+      - distribution-owned-platform
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

ARCHITECTURE.md

@@ -1,6 +1,6 @@
 # ARCHITECTURE.md
 
-Last updated: 2026-03-11
+Last updated: 2026-09-16
 
 ## Brand source
 
@@ -58,11 +58,34 @@ Last updated: 2026-03-11
 ## Repository map
 
 - `apps/desktop` - desktop shell and user-facing React UI
+- `apps/desktop/distribution-core` - Tauri-independent Rust security policy for updater release identity, anti-replay, target compatibility, and project-schema-aware rollback decisions
+- `apps/desktop/distribution-runtime` - stateless Rust admission boundary for untrusted Tauri updater JSON; validates the complete four-target document including each platform's canonical standard-base64 outer signature envelope, then returns provisional metadata with the selected target's exact admitted URL/signature and cannot mutate freshness state
+- `apps/desktop/distribution-transport` - deterministic Rust response-state bridge from the strict provisional target projection to bounded updater staging; consumes metadata-owner signature syntax guarantees and owns exact effective-URL checks plus one-hop release-asset redirect admission, but not sockets, TLS, metadata authentication, minisign verification or installation
+- `apps/desktop/distribution-download` - network-library-independent Rust streaming/staging boundary for updater artifacts; owns expected-size/content-length/chunk/cumulative limits, exclusive temporary artifact lifecycle, descriptor-bound Unix cleanup, conservative Windows deferred stale-file reclamation, and read-only descriptor-bound verifier access, but not HTTP, signatures, digests or installation
+- `apps/desktop/distribution-state` - Distribution-owned bounded highest-authenticated-release state; Unix uses a single-link append/sync log, while Windows publishes synchronized replacement snapshots to avoid mutating pre-existing hard-link aliases on stable Rust; it consumes `distribution-core` identity and never project bytes
 - `packages/shared-types` - stable cross-layer types shared by the UI and orchestration layer
 - `services/analysis-engine` - Python analysis service for source separation and music analysis
 - `scripts/harness` - fail-fast repo verification
 - `scripts/checks` - small doc and structure checks
 
+## Distribution/update bounded context
+
+- Distribution owns commercial release identity, native signing/notarization admission, updater policy, immutable publication evidence, bounded updater artifact transport/storage admission, highest-seen update freshness state, and last-known-good installer recovery decisions.
+- `apps/desktop/distribution-core` contains deterministic security decisions only. It does not fetch metadata, verify Tauri signatures, write project data, run installers, or manufacture signing/key authority.
+- `apps/desktop/distribution-runtime` admits the current static updater JSON only as bounded provisional remote input. It rejects duplicate/unknown members, unexpected targets, mutable release URLs, invalid release-identity syntax, and any supported platform signature that is not a bounded canonical RFC 4648 standard-base64 outer envelope; retains the selected target's canonical URL/signature from that same strict parse for later transport consumption; and projects the fixed app-owned highest-seen path without creating or writing it. It deliberately has no `distribution-state` dependency, and retained transport fields remain provisional rather than authenticated authority.
+- `apps/desktop/distribution-transport` consumes only that already-selected provisional projection and admits updater transport state without reparsing `raw_json` or duplicating signature-envelope syntax. A direct `200` must report the exact canonical initial URL. GitHub release-asset `302` handling is explicit and limited to one HTTPS hop to the current `release-assets.githubusercontent.com` egress allowlist; the follow-up must terminate in `200` at the exact admitted Location and redirect chaining fails closed. The CDN hostname is a product allowlist, not a claim that GitHub guarantees it permanently. The crate has no HTTP client, socket, installer, metadata-authentication, minisign-verification or freshness-state capability.
+- Publication mirrors that outer signature-envelope contract after exact receipt binding: `scripts/release/build_updater_manifest.py` requires `.sig` bytes to be canonical standard base64 and the decoded envelope payload to be UTF-8 before static updater JSON can be emitted. This is publication admission only and does not replace Tauri's updater signature verification.
+- `apps/desktop/distribution-download` owns the pure streaming/staging primitive used before artifact trust is established. It enforces a 2 GiB artifact ceiling, exact optional `Content-Length`, 1 MiB maximum caller chunk, cumulative overrun rejection before sink write, sink-error poisoning, exact-length completion, exclusive app-owned staging and descriptor-safe cleanup. A sealed artifact remains provisional; downstream verification reads the exact still-open descriptor through a positional `Read` wrapper and cannot obtain the underlying write-capable staging `File` through the public API. Unix cleanup unlinks the staging pathname only when the current direct regular-file `(dev, ino)` still matches the open descriptor, so an already-replaced basename is not deleted as if it were the owned artifact. Windows does not unlink a remembered pathname on `Drop` when stable Rust cannot prove descriptor/path identity; it closes the handle and leaves the unverified scratch file for the next staging attempt, which may reclaim a stale direct regular child only after acquiring the shared staging lease. This trades bounded scratch retention for avoiding deletion of an unrelated replacement object and is not trust promotion. It does not perform network I/O, authenticate metadata, verify signatures/digests, run installers or mutate freshness state. Commercial completion requires the production HTTP adapter to disable implicit redirects, report response state through `distribution-transport`, and route actual response chunks through this boundary rather than relying on Tauri's full-response buffering.
+- `apps/desktop/distribution-state` persists only the highest authenticated release identity as a bounded ordered log under a sibling OS lease. It revalidates committed identities, rejects local version regression/equivocation, and recovers only a syntactically valid torn final-record prefix. Unix admits only a single-link state object and uses synchronized append/truncate repair. Windows does not depend on nightly-only link-count metadata: when mutation is required it writes the complete committed bounded log to a `create_new` sibling snapshot, synchronizes it, and replaces only the state pathname, preserving any pre-existing hard-link alias file record. This source-level design is not packaged Windows power-loss proof and does not claim protection from a same-user actor that ignores the advisory lease and races filesystem namespace changes.
+- Tauri updater signatures authenticate downloaded updater artifact bytes. They do not, by themselves, authenticate the whole `Update.raw_json` response or BandScope's `sourceCommit`/digest extensions. Remote metadata therefore stays provisional until a canonical metadata-authentication path binds its release identity to trusted authority.
+- Only after metadata authentication and updater artifact signature/digest/size binding may exact `version`, `sourceCommit`, updater SHA-256, target, and compatibility floor enter `distribution-core` and `distribution-state` as freshness authority.
+- Stable-channel automatic update decisions use canonical numeric `MAJOR.MINOR.PATCH`. Prerelease/build ordering is not approximated; a future beta channel requires a separate ADR and canonical SemVer implementation.
+- A release older than locally persisted highest-seen authenticated metadata is replay, and the same version with a different source commit or updater digest is equivocation. Neither may be silently downgraded into a normal update offer.
+- Highest-seen release identity belongs to Distribution-owned app state and is recorded only after its metadata identity has authenticated authority; installation completion is not required, but syntactically valid remote JSON alone is insufficient. Project Persistence remains owner of project bytes and project-schema truth.
+- Automatic rollback may use only a previously authenticated known-good installer whose version is older than the current installation and whose declared reader can open the current on-disk project schema. The decision core does not bypass project recovery or schema ownership.
+- `release/updater-policy.json` remains fail-closed while organization-approved updater key/production endpoint authority is absent. No source code or test fixture is production authority.
+- Traceability and claim boundaries live in `docs/traceability/updater-release-admission.md`, `docs/traceability/release-artifact-receipt.md`, `docs/traceability/updater-security-metadata.md`, `docs/traceability/updater-bounded-download.md`, `docs/traceability/updater-staging-path-identity.md`, `docs/traceability/updater-highest-seen-concurrency.md`, and `docs/traceability/updater-transport-policy.md`.
+
 ## Product capability scope
 
 - BandScope is not only a shell around chord labels, stems, and ranges.
@@ -96,10 +119,11 @@ Last updated: 2026-03-11
 ## Harness decisions
 
 - The harness uses `npm` workspaces for JavaScript/TypeScript and `uv` for Python.
-- The desktop app is scaffolded as `Tauri + Vite + React`, but initial verification keeps Rust packaging out of the default quickcheck path.
+- The desktop app is scaffolded as `Tauri + Vite + React`. Full Tauri packaging remains outside the default quickcheck path, while security-critical Tauri-independent Rust bounded-context suites may be invoked from repository tests through a narrow validation boundary.
 - The desktop shell uses an explicit Tauri CSP that only allows self-hosted assets, inline styles, Tauri IPC, and loopback development traffic.
 - Mechanical gates focus on lint, typecheck, unit tests, coverage for Python, and documentation presence.
 - Python quality gates also require 100% docstring coverage via `package.json` script `check:python-docstrings`, enforced with Ruff rules `D100` through `D107` across tracked packages, modules, classes, nested classes, functions, methods (including `__init__`), `services/analysis-engine` tests, and repo-owned Python scripts.
+- Distribution `distribution-core`, `distribution-runtime`, `distribution-transport`, `distribution-download`, and `distribution-state` Rust compilation denies warnings and missing public rustdoc; their standalone locked unit suites are invoked by the repository analysis test harness without adding Python production logic.
 - Mechanical gates also enforce security document presence, plan `Security Notes`, and basic forbidden-pattern checks.
 - Security context is part of architecture, not just implementation detail; docs and plans must record the trust boundary touched by risky changes.
 - Supply-chain controls are part of the bootstrap architecture, not a release-afterthought.

apps/desktop/distribution-core/Cargo.toml

@@ -0,0 +1,13 @@
+[package]
+name = "bandscope-distribution-core"
+version = "0.1.0"
+edition = "2021"
+description = "Pure Distribution/update anti-replay and rollback decision core for BandScope."
+publish = false
+
+[workspace]
+
+[lints.rust]
+unsafe_code = "forbid"
+warnings = "deny"
+missing_docs = "deny"