Prepare Rieke OS 0.1.3 desktop and indexed workspace release

.github/workflows/desktop-candidate.yml

@@ -0,0 +1,119 @@
+name: Rieke OS desktop candidate
+on:
+  push:
+    tags: ['v*']
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: Exact reviewed version tag in Rieke-OS
+        required: true
+      signed:
+        description: Require Developer ID signing and notarization
+        type: boolean
+        default: false
+permissions:
+  contents: read
+concurrency:
+  group: rieke-desktop-candidate-${{ inputs.tag || github.ref_name }}
+  cancel-in-progress: false
+jobs:
+  build:
+    if: github.repository == 'maxwellsdm1867/Rieke-OS'
+    runs-on: macos-15
+    environment: ${{ (github.event_name == 'push' || inputs.signed) && 'desktop-signing' || 'desktop-build' }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.tag || github.ref }}
+          fetch-depth: 0
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '22.12.0'
+      - uses: astral-sh/setup-uv@v6
+      - name: Verify clean canonical source and coordinated versions
+        env:
+          RELEASE_TAG: ${{ inputs.tag || github.ref_name }}
+          RELEASE_REPOSITORY: ${{ github.repository }}
+        run: |
+          test "$(uname -m)" = arm64
+          python3 tools/desktop_release.py baseline --tag "$RELEASE_TAG" --repository "$RELEASE_REPOSITORY" --output "$RUNNER_TEMP/desktop-baseline.json"
+      - run: npm ci && npm test && npm run build
+        working-directory: workspace-app
+      - run: npm ci && npm test
+        working-directory: desktop
+      - name: Assemble the complete portable runtime
+        run: python3 tools/desktop_build_runtime.py --skip-frontend
+      - name: Verify backend and runtime contracts
+        run: |
+          desktop/build/runtime/python/bin/python3.11 -m unittest discover -s python/tests -p 'test_*desktop*.py' -v
+          desktop/build/runtime/python/bin/python3.11 -m unittest discover -s python/tests -p test_workspace_bootstrap.py -v
+          python3 tools/desktop_runtime_manifest.py
+        env:
+          PYTHONPATH: python
+          PYTHONDONTWRITEBYTECODE: '1'
+      - name: Build unsigned local qualification candidate
+        if: github.event_name != 'push' && !inputs.signed
+        working-directory: desktop
+        env:
+          CSC_IDENTITY_AUTO_DISCOVERY: 'false'
+        run: npm run dist
+      - name: Build signed and notarized candidate
+        if: github.event_name == 'push' || inputs.signed
+        working-directory: desktop
+        env:
+          CSC_LINK: ${{ secrets.CSC_LINK }}
+          CSC_KEY_PASSWORD: ${{ secrets.CSC_KEY_PASSWORD }}
+          APPLE_API_KEY: ${{ secrets.APPLE_API_KEY }}
+          APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
+          APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
+          CSC_IDENTITY_AUTO_DISCOVERY: 'false'
+        run: |
+          node -e "if(require('./distribution.json').channel!=='signed')throw new Error('Commit the reviewed signed distribution policy before building a signed release')"
+          test -n "$CSC_LINK"
+          test -n "$CSC_KEY_PASSWORD"
+          test -n "$APPLE_API_KEY"
+          test -n "$APPLE_API_KEY_ID"
+          test -n "$APPLE_API_ISSUER"
+          npm run dist
+          codesign --verify --deep --strict 'dist/mac-arm64/Rieke OS.app'
+          spctl --assess --type execute 'dist/mac-arm64/Rieke OS.app'
+          xcrun stapler validate 'dist/mac-arm64/Rieke OS.app'
+      - name: Exercise updater transport failures without installing
+        run: npm run test:e2e:updater --prefix desktop
+      - name: Exercise the actual packaged desktop UI and orderly lifecycle
+        run: npm run test:e2e --prefix desktop
+      - name: Exercise explicit unsigned Install and Open
+        if: github.event_name != 'push' && !inputs.signed
+        run: npm run test:e2e:bootstrap --prefix desktop
+      - name: Verify recovery before opening projects when backend startup fails
+        run: npm run test:e2e:startup-failure --prefix desktop
+      - name: Audit extracted installers and native database workflows
+        run: python3 tools/desktop_artifact_e2e.py --installed 'desktop/dist/mac-arm64/Rieke OS.app' --output docs/dev/desktop-artifact-e2e.json
+      - name: Inventory exact candidate bytes
+        run: |
+          python3 tools/desktop_release.py inventory --output desktop/dist/artifacts.json
+          cp "$RUNNER_TEMP/desktop-baseline.json" desktop/dist/desktop-baseline.json
+          cp desktop/build/runtime/runtime-audit.json desktop/dist/runtime-audit.json
+      - uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: desktop-e2e-evidence
+          path: |
+            docs/dev/desktop-updater-client-e2e.json
+            docs/dev/desktop-ui-e2e/
+            docs/dev/desktop-artifact-e2e.json
+          if-no-files-found: warn
+          retention-days: 30
+      - uses: actions/upload-artifact@v4
+        with:
+          name: rieke-desktop-macos-arm64
+          path: |
+            desktop/dist/*.dmg
+            desktop/dist/*.zip
+            desktop/dist/*.blockmap
+            desktop/dist/latest-mac.yml
+            desktop/dist/artifacts.json
+            desktop/dist/desktop-baseline.json
+            desktop/dist/runtime-audit.json
+          if-no-files-found: error
+          retention-days: 30

.github/workflows/desktop-promote.yml

@@ -0,0 +1,69 @@
+name: Promote qualified Rieke OS desktop
+on:
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: Reviewed stable tag
+        required: true
+      candidate_run_id:
+        description: Successful desktop-candidate run containing the exact qualified artifacts
+        required: true
+      evidence_path:
+        description: Reviewed qualification JSON committed to the default branch
+        required: true
+permissions:
+  contents: read
+  actions: read
+concurrency:
+  # All stable versions share a lock; an older build cannot race a newer promotion.
+  group: rieke-desktop-stable-promotion
+  cancel-in-progress: false
+jobs:
+  promote:
+    if: github.repository == 'maxwellsdm1867/Rieke-OS'
+    runs-on: macos-15
+    # Repository owners must enable required reviewers here. YAML alone does not.
+    environment: desktop-publishing
+    permissions:
+      contents: write
+      actions: read
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '22.12.0'
+      - run: npm ci --ignore-scripts
+        working-directory: desktop
+      - name: Require a successful canonical candidate run
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          CANDIDATE_RUN: ${{ inputs.candidate_run_id }}
+        run: |
+          python3 - <<'PY'
+          import json, os, re, subprocess
+          run_id = os.environ['CANDIDATE_RUN']
+          if not re.fullmatch(r'\d+', run_id): raise SystemExit('Invalid candidate run ID')
+          receipt = json.loads(subprocess.check_output(['gh','api',f'repos/maxwellsdm1867/Rieke-OS/actions/runs/{run_id}'],text=True))
+          if receipt['conclusion'] != 'success' or receipt['path'] != '.github/workflows/desktop-candidate.yml':
+              raise SystemExit('Candidate must be a successful desktop build')
+          PY
+      - uses: actions/download-artifact@v4
+        with:
+          name: rieke-desktop-macos-arm64
+          run-id: ${{ inputs.candidate_run_id }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          path: desktop/dist
+      - name: Verify reviewed evidence, recover draft uploads, and promote exact bytes
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          RELEASE_TAG: ${{ inputs.tag }}
+          EVIDENCE_PATH: ${{ inputs.evidence_path }}
+        run: |
+          python3 - <<'PY'
+          import os, pathlib, subprocess
+          root = pathlib.Path.cwd().resolve()
+          evidence = (root / os.environ['EVIDENCE_PATH']).resolve(strict=True)
+          if not evidence.is_relative_to(root / 'release-evidence') or evidence.suffix != '.json':
+              raise SystemExit('Evidence must be a reviewed release-evidence JSON in this checkout')
+          subprocess.run(['python3','tools/desktop_release.py','promote','--tag',os.environ['RELEASE_TAG'],'--evidence',str(evidence)],check=True)
+          PY

.github/workflows/workspace-release-candidate.yml

@@ -1,12 +1,19 @@
-name: Build signed Rieke OS release candidate
+name: Legacy source-release candidate (manual)
 on:
   workflow_dispatch:
     inputs:
       tag:
         description: Reviewed stable version tag, for example v0.1.0
         required: true
+      publish:
+        description: Publish the validated candidate as the latest stable GitHub Release
+        type: boolean
+        default: false
 permissions:
   contents: read
+concurrency:
+  group: rieke-release-${{ inputs.tag || github.ref_name }}
+  cancel-in-progress: false
 jobs:
   candidate:
     # First advertised platform only. Linux needs its own native validation.
@@ -15,7 +22,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
         with:
-          ref: ${{ inputs.tag }}
+          ref: ${{ inputs.tag || github.ref }}
           fetch-depth: 0
       - uses: actions/setup-node@v4
         with:
@@ -58,5 +65,26 @@ jobs:
           name: signed-rieke-release-candidate
           path: ${{ runner.temp }}/rieke-candidate/
           if-no-files-found: error
-      # Deliberately no public release publication. Promotion requires the real
-      # database, transfer, old-to-new upgrade and licensed MATLAB gates in docs.
+  publish:
+    needs: candidate
+    if: github.repository == 'maxwellsdm1867/Rieke-OS' && (github.event_name == 'push' || inputs.publish)
+    runs-on: ubuntu-latest
+    # Configure required reviewers here to attest the real upgrade/recovery and
+    # worker-shutdown evidence in docs/dev/releasing-rieke-os.md before promotion.
+    environment: release-publishing
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          name: signed-rieke-release-candidate
+          path: ${{ runner.temp }}/rieke-candidate
+      - name: Publish the exact signed candidate
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_REPO: ${{ github.repository }}
+          RELEASE_TAG: ${{ inputs.tag || github.ref_name }}
+          CANDIDATE_DIRECTORY: ${{ runner.temp }}/rieke-candidate
+        run: |
+          gh release create "$RELEASE_TAG" "$CANDIDATE_DIRECTORY"/* \
+            --verify-tag --latest=false --generate-notes --title "Rieke OS source $RELEASE_TAG"

.gitignore

@@ -69,3 +69,9 @@ docs/legacy/old_epochtree/
 
 # Clone-local Rieke OS dependencies/config (never scientific project data)
 /.rieke-runtime/
+
+# Desktop build closure and local packages (source/locks remain tracked)
+/desktop/node_modules/
+/desktop/build/
+/desktop/dist/
+/desktop/resources/

CHANGELOG.md

@@ -5,6 +5,26 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## Rieke OS [0.1.3] - 2026-09-30
+
+This desktop candidate uses the explicit unsigned testing channel. It is separate
+from the MATLAB library version below and from signed production distribution.
+
+### Added
+- Self-contained Apple Silicon desktop packaging with private Python and MySQL runtimes, folder selection, controlled installation, and testing-channel updates.
+- Persistent native tag membership and autocomplete dictionaries, with Unicode prefix indexes, maintained usage counts, and exact author attribution.
+- Transactional annotation history, incremental current-state recovery, and verified index migration and reuse.
+
+### Improved
+- Small annotation batches acknowledge durable saves promptly; cell tags inherit by cell UUID without copying annotations into every epoch.
+- Large-project browsing, selection, metadata storage, cache validation, and protocol-scoped curation preserve exact scientific identities.
+- Portable project handling, folder-boundary checks, draft preservation, and desktop service lifecycle validation.
+
+At 100,000 synthetic epochs, tag autocomplete measured 21–26 ms. Initial native
+index preparation took about two minutes; the paired two-save/filter API sequence
+measured 192 ms. See the [reproducible benchmark report](docs/dev/scale-audit-2026-09-29/native-tag-sequence-results.md)
+for scope, first-use measurements, and limitations.
+
 ## [1.0.0] - 2026-02-28
 
 ### Added

CONTEXT.md

@@ -28,6 +28,34 @@ _Avoid_: Matching cells solely by a repeated label such as Cell2
 Recording date plus original cell name/number, with a separate cell-type tag; include a session qualifier when labels collide. Stable cell UUIDs are available as details.
 _Avoid_: Using a mutable cell-type classification as a database key
 
+**Recorded cell identity**:
+The identity of a cell in an acquisition, together with its recorded source and experimental ancestry. Matching dates, labels, classifications or measured values do not establish that two records identify the same cell.
+_Avoid_: Cell number as identity, identity inferred from matching metadata
+
+**Cell correspondence**:
+A reviewed scientific claim that distinct recorded cell identities refer to the same biological cell, supported by retained evidence and provenance.
+_Avoid_: Automatic merge, renaming a cell to resolve uncertain identity
+
+**Source revision**:
+One exact version of a recording's original contents. Moving or renaming an unchanged recording does not create a new source revision; changing its contents does.
+_Avoid_: Filename as identity
+
+**Identity conflict**:
+Evidence that a recorded identifier, its ancestry, or its source revision disagrees with another representation of the same acquisition. A conflict is distinct from two legitimate acquisitions sharing a display label.
+_Avoid_: Duplicate inferred from name, overwriting to reconcile
+
+**Shared tag**:
+A project annotation attached to an exact cell or epoch identity, with its author profile and provenance retained across protocol workspaces.
+_Avoid_: A dataset-specific inclusion decision, an acquisition identifier
+
+**Inherited cell tag**:
+A cell annotation visible on its epochs through their recorded cell UUID relationship. Inheritance does not copy or reassign the annotation to each epoch.
+_Avoid_: Inheritance by matching cell labels or dates
+
+**Dataset tag**:
+A curation tag scoped to an epoch within a particular protocol workspace. Multiple dataset tags and shared tags may coexist without changing acquisition identity.
+_Avoid_: Treating all tags as one unscoped set
+
 **Recorded duration**:
 The sum of recording durations for distinct epochs in an explicit scope and timebase, counting an epoch once across its streams and excluding gaps.
 _Avoid_: Session elapsed time, stimulation time, summing the same epoch once per device

desktop/.gitignore

@@ -0,0 +1,5 @@
+node_modules/
+dist/
+resources/
+build-work/
+build/