refactor(release): simplify desktop distribution channels (#10163)

## Summary

Simplifies Omi release distribution while closing the executable
draft-PR blockers. The branch is rebased onto current `origin/main` and
now includes the independently reviewed memory chronology fix that was
blocking the broad backend CI lane.

Beta and Stable remain two desktop distribution pointers over one
immutable qualified manifest. The generalized release-record/ring
system, Beta backend fleet/routing, nomination, emergency promotion,
holds/receipts, and qualification-claim state are not restored.

## Trust, deployment, and routing changes

- Qualification records exact Stable/Beta URLs, hashes, and Sparkle
signatures for all four files; Beta and Stable promotion bind a
successful trusted candidate-tag qualification run at the exact
release-source SHA, never rebuild, and reject mutable release drift
before pointer movement.
- Evidence labels are explicit: T2/fault coverage is source-built
named-bundle evidence at the frozen tag, while exact signed ZIP/DMG
smoke is signing/notarization/package/storage proof. Required
operational evidence remains signed `.89` upgrade, `.70` side-by-side,
core journeys, soak, and same-manifest Stable promotion.
- Stable controls are pinned to `main`, use actual access-token
expansion, retain exact lost-response pointer idempotency, accept
retained qualified repoints, and verify exactly one `identity=stable`
XML item with immutable version/build/enclosure/signature facts.
- `environment=prod, deploy_targets=all` rejects before checkout, cloud
authentication, image publication, or mutation because transactional
GKE/config rollback parity does not exist.
- `environment=prod, deploy_targets=cloud-run-only` is intentionally
narrow: exact no-traffic tag, VPC Cloud Run Job known-audio gate with
Cloud Run IAM plus Firebase auth, traffic snapshot/restore, and
unconditional cleanup of the tag, Job, temporary invoker grant, and
temporary service account. It performs no GKE mutation.
- Source-admitted direct GKE workflows (`gcp_backend_listen_helm.yml`,
pusher, llm-gateway, agent-proxy) remain their respective production
paths and report checked-out HEAD identity with fresh-`origin/main`
ancestry diagnostics.
- Production-family Codemagic workflows pin `https://api.omi.me/`; the
startup function called by `main.dart` validates the production API and
agent WSS authority. It rejects old Beta/dev/staging/arbitrary overrides
while development remains configurable.
- Node-20 artifact-action majors are replaced with repository-approved
Node-24 majors. Resolver cache fixtures cover validated primary and LKG
records under the expanded immutable Beta manifest contract.
- Required-memory processing no longer owns or extends short-term TTL.
The authoritative apply owner preserves persisted capture/corroboration
expiry and keeps `updated_at` monotonic under clock skew; receipt
chronology cannot predate capture or grant freshness.

## Product invariants affected

- INV-AUTH-1
- INV-INT-1
- INV-MEM-1

Failure-Class: FC-nonrecoverable-promotion

## Verification

- Combined rebased exact head: deterministic local PR preflight passed
all 49 selected checks.
- Combined backend selection: memory lifecycle 28 passed, authoritative
memory apply store 7 passed, and `test_sync_v2.py` 163 passed.
- Focused desktop release/update/probe/vector suite: 62 passed.
- Memory lifecycle exact file also passed three consecutive times before
folding; adjacent apply/lifecycle/model suites: 100 passed.
- Deployment concurrency, direct-writer and mobile-routing mutation
contracts: passed.
- `actionlint` for changed release/deploy workflows and `git diff
--check`: passed.
- Flutter environment tests: 7 passed; targeted analysis had only the
existing non-blocking `library_private_types_in_public_api` information
message.
- Swift debug build and `APIClientRoutingTests`: 60 passed.

## Qualification boundary

Source-built named-bundle T2/fault evidence and exact signed-artifact
evidence are separate layers. Signed production binaries do not expose a
local automation/fault interface. Before Stable promotion, the exact
signed Beta artifact still requires `.89` upgrade, `.70` side-by-side
operation, real core journeys, recovery checks, and soak. Stable
advances the same immutable qualified manifest without rebuilding.

## Non-executed live operations

No cloud resources, releases, pointers, production app bundles, secrets,
deployments, or workflows were changed or dispatched.

Author: Git-on-my-level

.github/AGENTS.md

@@ -11,11 +11,7 @@ These rules apply to GitHub Actions workflows and custom actions under `.github/
 - Deployment group names are a cross-workflow API. Keep them aligned with
   `.github/scripts/check-deployment-concurrency.py`; use
   `cancel-in-progress: false` so a newer run cannot interrupt a remote mutation
-  or a staged validation/traffic promotion. `desktop_emergency_promote_beta.yml`
-  is the narrow exception: GitHub's single replaceable pending slot cannot
-  preserve a break-glass request, so each attempt has an isolated lock and the
-  server-side exact pointer CAS is the cross-lane arbiter; retain its focused
-  regression contract.
+  or a staged validation/traffic promotion.
 - `deploy-backend-stack-<environment>` intentionally covers the four backend
   Cloud Run services, traffic repair, backend-listen, LLM gateway, and
   backend-secrets. Those paths share mutable releases, while unrelated services

.github/CODEOWNERS

@@ -1,7 +1,3 @@
-# Release-ring deployment code is production authority. Branch protection must
-# require this owner plus the release-ring guard check before merging changes.
+# Broad production authority remains protected after the retired release-ring deletion.
 /.github/workflows/** @Git-on-my-level
-/.github/scripts/check_release_rings.py @Git-on-my-level
-/backend/scripts/release_rings.py @Git-on-my-level
-/backend/scripts/render_release_ring_config.py @Git-on-my-level
 /backend/charts/backend-secrets/** @Git-on-my-level

.github/checks-manifest.yaml

@@ -14,16 +14,6 @@ checks:
     triggers: ["all"]
     lanes: ["local", "ci"]
     reason: "manifest validity and workflow drift guard"
-  - id: release-ring-guards
-    command: ["python3", ".github/scripts/check_release_rings.py"]
-    triggers: [".github/workflows/release-record.yml", ".github/workflows/deploy-release-ring.yml", ".github/scripts/check_release_rings.py", ".github/scripts/check-deployment-concurrency.py", "backend/scripts/release_rings.py", "backend/scripts/render_release_ring_config.py", "backend/deploy/release_rings.yaml"]
-    lanes: ["local", "ci"]
-    reason: "#10049 keeps release records immutable, deploy inputs record-only, and recovery fail-closed"
-  - id: release-ring-guard-tests
-    command: ["python3", ".github/scripts/test_check_release_rings.py"]
-    triggers: [".github/scripts/check_release_rings.py", ".github/scripts/test_check_release_rings.py", ".github/workflows/release-record.yml", ".github/workflows/deploy-release-ring.yml", ".github/checks-manifest.yaml"]
-    lanes: ["local", "ci"]
-    reason: "release-ring structural guard must reject missing immutability, restore, and OIDC controls"
   - id: product-file-line-count-ratchet
     command: ["python3", ".github/scripts/check_product_file_line_count_ratchet.py", "--changed-files", "{changed_files}", "--base", "{base}"]
     triggers: ["backend/**/*.py", "desktop/macos/**/*.swift", "desktop/macos/**/*.rs", ".github/scripts/check_product_file_line_count_ratchet.py", ".github/scripts/product_file_line_count_ratchet_baseline/**/*.json"]
@@ -44,11 +34,6 @@ checks:
     triggers: [".github/schemas/desktop-release-evidence-v1.schema.json", ".github/scripts/desktop_release_doctor.py", ".github/scripts/desktop_release_doctor_report.py", ".github/scripts/test_desktop_release_doctor.py", ".github/workflows/desktop_release_doctor.yml"]
     lanes: ["local", "ci"]
     reason: "advisory desktop release evidence and drift report"
-  - id: desktop-qualification-dispatch
-    command: ["python3", ".github/scripts/test_desktop_qualification_dispatch.py"]
-    triggers: [".github/scripts/desktop_qualification_dispatch.py", ".github/scripts/test_desktop_qualification_dispatch.py", ".github/workflows/desktop_qualify_beta.yml", "codemagic.yaml", ".github/checks-manifest.yaml"]
-    lanes: ["local", "ci"]
-    reason: "#10080 timeout retries must expose state and permit only one trusted qualification execution per candidate dispatch key"
   - id: desktop-changelog-io-tests
     command: ["python3", ".github/scripts/test_desktop_changelog.py"]
     triggers: [".github/scripts/desktop-changelog.py", ".github/scripts/test_desktop_changelog.py", ".github/checks-manifest.yaml"]
@@ -355,16 +340,47 @@ checks:
     triggers: [".github/workflows/gcp_backend.yml", ".github/workflows/gcp_backend_auto_dev.yml", ".github/scripts/verify_backend_release_admission.py", ".github/scripts/verify_auto_backend_release_admission.py", ".github/scripts/check_backend_deploy_source_admission.py", ".github/scripts/test_check_backend_deploy_source_admission.py", ".github/checks-manifest.yaml"]
     lanes: ["local", "ci"]
     reason: "#9991 mutation-tests workflow-run event, result, branch, SHA, repository, and manual proof drift"
+  - id: gcp-backend-production-boundary
+    command: ["python3", ".github/scripts/check-gcp-backend-production-boundary.py"]
+    triggers: [".github/workflows/gcp_backend.yml", "backend/scripts/probe-transcription-candidate-from-cloud-run.sh", "backend/tests/unit/test_probe_transcription_candidate_from_cloud_run.py", ".github/scripts/check-gcp-backend-production-boundary.py", ".github/scripts/test_check_gcp_backend_production_boundary.py", ".github/checks-manifest.yaml"]
+    lanes: ["local", "ci"]
+    reason: "#10163 locks the supported production Cloud Run-only boundary and canonical tagged-candidate IAM audience without introducing another deployment control plane"
+  - id: gcp-backend-production-boundary-fixtures
+    command: ["python3", ".github/scripts/test_check_gcp_backend_production_boundary.py"]
+    triggers: [".github/workflows/gcp_backend.yml", ".github/scripts/check-gcp-backend-production-boundary.py", ".github/scripts/test_check_gcp_backend_production_boundary.py", ".github/checks-manifest.yaml"]
+    lanes: ["local", "ci"]
+    reason: "#10163 mutation-tests prod/all rejection, canonical IAM audience, and tagged request-target drift"
+  - id: direct-backend-production-admission
+    command: ["python3", ".github/scripts/check-direct-backend-production-admission.py"]
+    triggers: [".github/workflows/gcp_backend_agent_proxy.yml", ".github/workflows/gcp_backend_listen_helm.yml", ".github/workflows/gcp_backend_pusher.yml", ".github/workflows/gcp_llm_gateway.yml", ".github/scripts/check-direct-backend-production-admission.py", ".github/scripts/test_check_direct_backend_production_admission.py", ".github/checks-manifest.yaml"]
+    lanes: ["local", "ci"]
+    reason: "#10163 prevents direct production writers from deploying caller refs or mislabeling checked-out source"
+  - id: direct-backend-production-admission-fixtures
+    command: ["python3", ".github/scripts/test_check_direct_backend_production_admission.py"]
+    triggers: [".github/workflows/gcp_backend_agent_proxy.yml", ".github/workflows/gcp_backend_listen_helm.yml", ".github/workflows/gcp_backend_pusher.yml", ".github/workflows/gcp_llm_gateway.yml", ".github/scripts/check-direct-backend-production-admission.py", ".github/scripts/test_check_direct_backend_production_admission.py", ".github/checks-manifest.yaml"]
+    lanes: ["local", "ci"]
+    reason: "#10163 mutation-tests branch bypass and GITHUB_SHA image mislabeling"
+  - id: mobile-production-routing
+    command: ["python3", ".github/scripts/test_check_mobile_production_routing.py"]
+    triggers: ["codemagic.yaml", ".github/scripts/check-mobile-production-routing.py", ".github/scripts/test_check_mobile_production_routing.py", ".github/checks-manifest.yaml"]
+    lanes: ["local", "ci"]
+    reason: "#10163 mutation-tests production-family mobile API routing"
+  - id: stable-pointer-precondition-cli
+    command: ["python3", ".github/scripts/check_stable_pointer_precondition.py", "--help"]
+    triggers: [".github/workflows/desktop_promote_prod.yml", ".github/scripts/check_stable_pointer_precondition.py", ".github/scripts/verify_stable_appcast.py", ".github/scripts/test_stable_promotion_verifiers.py", ".github/checks-manifest.yaml"]
+    lanes: ["local", "ci"]
+    reason: "#10163 keeps Stable retry acknowledgement and appcast verification executable"
+  - id: stable-pointer-precondition-fixtures
+    command: ["python3", ".github/scripts/test_stable_promotion_verifiers.py"]
+    triggers: [".github/workflows/desktop_promote_prod.yml", ".github/scripts/check_stable_pointer_precondition.py", ".github/scripts/verify_stable_appcast.py", ".github/scripts/test_stable_promotion_verifiers.py", ".github/checks-manifest.yaml"]
+    lanes: ["local", "ci"]
+    reason: "#10163 mutation-sensitive Stable retry and default-channel feed fixtures"
 
 exempt:
   - path: ".github/scripts/check-desktop-auto-beta-candidate.py"
     reason: "release pipeline check requires published candidate artifacts and workflow inputs"
   - path: ".github/scripts/check-desktop-prod-promotion-policy.py"
     reason: "release-policy full-tree check, not diff-scoped"
-  - path: ".github/scripts/check-desktop-release-promotion.py"
-    reason: "release pipeline check with workflow inputs"
-  - path: ".github/scripts/check-desktop-release-terminology.py"
-    reason: "release-policy full-tree check, not diff-scoped"
   - path: ".github/scripts/check-release-process-guards.py"
     reason: "release-policy full-tree check, not diff-scoped"
   - path: ".github/scripts/check-deployment-concurrency.py"

.github/schemas/desktop-release-manifest-v1.schema.json

@@ -19,6 +19,11 @@
     "dmg_url",
     "dmg_sha256",
     "ed_signature",
+    "beta_zip_url",
+    "beta_zip_sha256",
+    "beta_dmg_url",
+    "beta_dmg_sha256",
+    "beta_ed_signature",
     "qualification_evidence_asset",
     "qualification_evidence_sha256",
     "qualification_tier",
@@ -46,6 +51,11 @@
     "dmg_url": { "$ref": "#/$defs/dmgUrl" },
     "dmg_sha256": { "$ref": "#/$defs/sha256" },
     "ed_signature": { "type": "string", "pattern": ".*\\S.*" },
+    "beta_zip_url": { "$ref": "#/$defs/betaZipUrl" },
+    "beta_zip_sha256": { "$ref": "#/$defs/sha256" },
+    "beta_dmg_url": { "$ref": "#/$defs/betaDmgUrl" },
+    "beta_dmg_sha256": { "$ref": "#/$defs/sha256" },
+    "beta_ed_signature": { "type": "string", "pattern": ".*\\S.*" },
     "qualification_evidence_asset": {
       "type": "string",
       "pattern": "^qualification-evidence-[^/]+\\.json$"
@@ -157,6 +167,14 @@
     "dmgUrl": {
       "type": "string",
       "pattern": "^https://github\\.com/BasedHardware/omi/releases/download/v[0-9]+\\.[0-9]+(?:\\.[0-9]+)?(?:%2[Bb]|\\+)[1-9][0-9]*-macos/omi\\.dmg$"
+    },
+    "betaZipUrl": {
+      "type": "string",
+      "pattern": "^https://github\\.com/BasedHardware/omi/releases/download/v[0-9]+\\.[0-9]+(?:\\.[0-9]+)?(?:%2[Bb]|\\+)[1-9][0-9]*-macos/Omi\\.Beta\\.zip$"
+    },
+    "betaDmgUrl": {
+      "type": "string",
+      "pattern": "^https://github\\.com/BasedHardware/omi/releases/download/v[0-9]+\\.[0-9]+(?:\\.[0-9]+)?(?:%2[Bb]|\\+)[1-9][0-9]*-macos/omi-beta\\.dmg$"
     }
   }
 }

.github/scripts/check-deployment-concurrency.py

@@ -37,8 +37,6 @@ class LockContract:
 # new deploy writer cannot silently bypass the audited lock graph.
 LOCK_CONTRACTS = {
     "desktop_backend_auto_dev.yml": LockContract("desktop-backend-auto-dev"),
-    "desktop_promote_prod.yml": LockContract("desktop-backend-promote-prod"),
-    "deploy-release-ring.yml": LockContract("deploy-release-ring-${{ inputs.ring }}"),
     "gcp_admin.yml": LockContract(
         "deploy-cloud-run-omi-admin-dashboard-${{ github.ref == 'refs/heads/development' && 'development' || github.ref == 'refs/heads/main' && 'prod' || format('nondeploy-{0}', github.run_id) }}"
     ),
@@ -91,9 +89,7 @@ class LockContract:
 # deployable public values. It never runs Helm, kubectl apply, or a Cloud Run
 # mutation; classifying credential acquisition alone as a writer would hide
 # that distinction and force a meaningless deploy lock.
-READ_ONLY_WORKFLOW_EXEMPTIONS = {
-    "release-record.yml": 'kubectl -n "${ring}-omi-backend" get configmap "${ring}-omi-backend-config" -o json',
-}
+READ_ONLY_WORKFLOW_EXEMPTIONS = {}
 
 # Firestore index creation is a schema migration, not ordinary deploy work.
 # Keep a single auditable writer so backend readiness can stay read-only.
@@ -248,8 +244,9 @@ def validate_serving_release_vector(name: str, text: str) -> list[str]:
         errors.append(f"{name}: release-vector verification must use the canonical verifier")
     if "--environment" not in verifier_text:
         errors.append(f"{name}: release-vector verification must bind an environment")
-    if name == "gcp_backend.yml" and "github.event.inputs.deploy_targets == 'all'" not in verifier_text:
-        errors.append(f"{name}: all-tier release-vector verification must not run for cloud-run-only deploys")
+    if name == "gcp_backend.yml":
+        if "github.event.inputs.deploy_targets" not in verifier_text or "--cloud-run-only" not in verifier_text:
+            errors.append(f"{name}: cloud-run-only promotion must use the Cloud Run-only release-vector contract")
     return errors
 
 

.github/scripts/check-desktop-auto-beta-candidate.py

@@ -131,9 +131,6 @@ def validate(args: argparse.Namespace) -> dict:
     metadata = parse_metadata(release.get("body") or "")
     if metadata.get("channel") != "candidate" or metadata.get("isLive", "").lower() not in {"false", "0", "no"}:
         fail("automatic beta qualification requires channel: candidate and isLive: false")
-    if metadata.get("stableCandidate", "").lower() in {"true", "1", "yes"}:
-        fail("automatic beta qualification refuses a release already nominated for stable")
-
     expected_version = match.group("version")
     expected_build = match.group("build")
     checks = _validate_smoke_contract(