refactor(release): simplify desktop distribution channels

.github/AGENTS.md

@@ -11,11 +11,7 @@ These rules apply to GitHub Actions workflows and custom actions under `.github/
 - Deployment group names are a cross-workflow API. Keep them aligned with
   `.github/scripts/check-deployment-concurrency.py`; use
   `cancel-in-progress: false` so a newer run cannot interrupt a remote mutation
-  or a staged validation/traffic promotion. `desktop_emergency_promote_beta.yml`
-  is the narrow exception: GitHub's single replaceable pending slot cannot
-  preserve a break-glass request, so each attempt has an isolated lock and the
-  server-side exact pointer CAS is the cross-lane arbiter; retain its focused
-  regression contract.
+  or a staged validation/traffic promotion.
 - `deploy-backend-stack-<environment>` intentionally covers the four backend
   Cloud Run services, traffic repair, backend-listen, LLM gateway, and
   backend-secrets. Those paths share mutable releases, while unrelated services

.github/CODEOWNERS

@@ -1,7 +1,3 @@
-# Release-ring deployment code is production authority. Branch protection must
-# require this owner plus the release-ring guard check before merging changes.
+# Broad production authority remains protected after the retired release-ring deletion.
 /.github/workflows/** @Git-on-my-level
-/.github/scripts/check_release_rings.py @Git-on-my-level
-/backend/scripts/release_rings.py @Git-on-my-level
-/backend/scripts/render_release_ring_config.py @Git-on-my-level
 /backend/charts/backend-secrets/** @Git-on-my-level

.github/checks-manifest.yaml

@@ -14,16 +14,6 @@ checks:
     triggers: ["all"]
     lanes: ["local", "ci"]
     reason: "manifest validity and workflow drift guard"
-  - id: release-ring-guards
-    command: ["python3", ".github/scripts/check_release_rings.py"]
-    triggers: [".github/workflows/release-record.yml", ".github/workflows/deploy-release-ring.yml", ".github/scripts/check_release_rings.py", ".github/scripts/check-deployment-concurrency.py", "backend/scripts/release_rings.py", "backend/scripts/render_release_ring_config.py", "backend/deploy/release_rings.yaml"]
-    lanes: ["local", "ci"]
-    reason: "#10049 keeps release records immutable, deploy inputs record-only, and recovery fail-closed"
-  - id: release-ring-guard-tests
-    command: ["python3", ".github/scripts/test_check_release_rings.py"]
-    triggers: [".github/scripts/check_release_rings.py", ".github/scripts/test_check_release_rings.py", ".github/workflows/release-record.yml", ".github/workflows/deploy-release-ring.yml", ".github/checks-manifest.yaml"]
-    lanes: ["local", "ci"]
-    reason: "release-ring structural guard must reject missing immutability, restore, and OIDC controls"
   - id: product-file-line-count-ratchet
     command: ["python3", ".github/scripts/check_product_file_line_count_ratchet.py", "--changed-files", "{changed_files}", "--base", "{base}"]
     triggers: ["backend/**/*.py", "desktop/macos/**/*.swift", "desktop/macos/**/*.rs", ".github/scripts/check_product_file_line_count_ratchet.py", ".github/scripts/product_file_line_count_ratchet_baseline/**/*.json"]
@@ -44,11 +34,6 @@ checks:
     triggers: [".github/schemas/desktop-release-evidence-v1.schema.json", ".github/scripts/desktop_release_doctor.py", ".github/scripts/desktop_release_doctor_report.py", ".github/scripts/test_desktop_release_doctor.py", ".github/workflows/desktop_release_doctor.yml"]
     lanes: ["local", "ci"]
     reason: "advisory desktop release evidence and drift report"
-  - id: desktop-qualification-dispatch
-    command: ["python3", ".github/scripts/test_desktop_qualification_dispatch.py"]
-    triggers: [".github/scripts/desktop_qualification_dispatch.py", ".github/scripts/test_desktop_qualification_dispatch.py", ".github/workflows/desktop_qualify_beta.yml", "codemagic.yaml", ".github/checks-manifest.yaml"]
-    lanes: ["local", "ci"]
-    reason: "#10080 timeout retries must expose state and permit only one trusted qualification execution per candidate dispatch key"
   - id: desktop-changelog-io-tests
     command: ["python3", ".github/scripts/test_desktop_changelog.py"]
     triggers: [".github/scripts/desktop-changelog.py", ".github/scripts/test_desktop_changelog.py", ".github/checks-manifest.yaml"]
@@ -355,16 +340,47 @@ checks:
     triggers: [".github/workflows/gcp_backend.yml", ".github/workflows/gcp_backend_auto_dev.yml", ".github/scripts/verify_backend_release_admission.py", ".github/scripts/verify_auto_backend_release_admission.py", ".github/scripts/check_backend_deploy_source_admission.py", ".github/scripts/test_check_backend_deploy_source_admission.py", ".github/checks-manifest.yaml"]
     lanes: ["local", "ci"]
     reason: "#9991 mutation-tests workflow-run event, result, branch, SHA, repository, and manual proof drift"
+  - id: gcp-backend-production-boundary
+    command: ["python3", ".github/scripts/check-gcp-backend-production-boundary.py"]
+    triggers: [".github/workflows/gcp_backend.yml", "backend/scripts/probe-transcription-candidate-from-cloud-run.sh", "backend/tests/unit/test_probe_transcription_candidate_from_cloud_run.py", ".github/scripts/check-gcp-backend-production-boundary.py", ".github/scripts/test_check_gcp_backend_production_boundary.py", ".github/checks-manifest.yaml"]
+    lanes: ["local", "ci"]
+    reason: "#10163 locks the supported production Cloud Run-only boundary and canonical tagged-candidate IAM audience without introducing another deployment control plane"
+  - id: gcp-backend-production-boundary-fixtures
+    command: ["python3", ".github/scripts/test_check_gcp_backend_production_boundary.py"]
+    triggers: [".github/workflows/gcp_backend.yml", ".github/scripts/check-gcp-backend-production-boundary.py", ".github/scripts/test_check_gcp_backend_production_boundary.py", ".github/checks-manifest.yaml"]
+    lanes: ["local", "ci"]
+    reason: "#10163 mutation-tests prod/all rejection, canonical IAM audience, and tagged request-target drift"
+  - id: direct-backend-production-admission
+    command: ["python3", ".github/scripts/check-direct-backend-production-admission.py"]
+    triggers: [".github/workflows/gcp_backend_agent_proxy.yml", ".github/workflows/gcp_backend_listen_helm.yml", ".github/workflows/gcp_backend_pusher.yml", ".github/workflows/gcp_llm_gateway.yml", ".github/scripts/check-direct-backend-production-admission.py", ".github/scripts/test_check_direct_backend_production_admission.py", ".github/checks-manifest.yaml"]
+    lanes: ["local", "ci"]
+    reason: "#10163 prevents direct production writers from deploying caller refs or mislabeling checked-out source"
+  - id: direct-backend-production-admission-fixtures
+    command: ["python3", ".github/scripts/test_check_direct_backend_production_admission.py"]
+    triggers: [".github/workflows/gcp_backend_agent_proxy.yml", ".github/workflows/gcp_backend_listen_helm.yml", ".github/workflows/gcp_backend_pusher.yml", ".github/workflows/gcp_llm_gateway.yml", ".github/scripts/check-direct-backend-production-admission.py", ".github/scripts/test_check_direct_backend_production_admission.py", ".github/checks-manifest.yaml"]
+    lanes: ["local", "ci"]
+    reason: "#10163 mutation-tests branch bypass and GITHUB_SHA image mislabeling"
+  - id: mobile-production-routing
+    command: ["python3", ".github/scripts/test_check_mobile_production_routing.py"]
+    triggers: ["codemagic.yaml", ".github/scripts/check-mobile-production-routing.py", ".github/scripts/test_check_mobile_production_routing.py", ".github/checks-manifest.yaml"]
+    lanes: ["local", "ci"]
+    reason: "#10163 mutation-tests production-family mobile API routing"
+  - id: stable-pointer-precondition-cli
+    command: ["python3", ".github/scripts/check_stable_pointer_precondition.py", "--help"]
+    triggers: [".github/workflows/desktop_promote_prod.yml", ".github/scripts/check_stable_pointer_precondition.py", ".github/scripts/verify_stable_appcast.py", ".github/scripts/test_stable_promotion_verifiers.py", ".github/checks-manifest.yaml"]
+    lanes: ["local", "ci"]
+    reason: "#10163 keeps Stable retry acknowledgement and appcast verification executable"
+  - id: stable-pointer-precondition-fixtures
+    command: ["python3", ".github/scripts/test_stable_promotion_verifiers.py"]
+    triggers: [".github/workflows/desktop_promote_prod.yml", ".github/scripts/check_stable_pointer_precondition.py", ".github/scripts/verify_stable_appcast.py", ".github/scripts/test_stable_promotion_verifiers.py", ".github/checks-manifest.yaml"]
+    lanes: ["local", "ci"]
+    reason: "#10163 mutation-sensitive Stable retry and default-channel feed fixtures"
 
 exempt:
   - path: ".github/scripts/check-desktop-auto-beta-candidate.py"
     reason: "release pipeline check requires published candidate artifacts and workflow inputs"
   - path: ".github/scripts/check-desktop-prod-promotion-policy.py"
     reason: "release-policy full-tree check, not diff-scoped"
-  - path: ".github/scripts/check-desktop-release-promotion.py"
-    reason: "release pipeline check with workflow inputs"
-  - path: ".github/scripts/check-desktop-release-terminology.py"
-    reason: "release-policy full-tree check, not diff-scoped"
   - path: ".github/scripts/check-release-process-guards.py"
     reason: "release-policy full-tree check, not diff-scoped"
   - path: ".github/scripts/check-deployment-concurrency.py"

.github/schemas/desktop-release-manifest-v1.schema.json

@@ -19,6 +19,11 @@
     "dmg_url",
     "dmg_sha256",
     "ed_signature",
+    "beta_zip_url",
+    "beta_zip_sha256",
+    "beta_dmg_url",
+    "beta_dmg_sha256",
+    "beta_ed_signature",
     "qualification_evidence_asset",
     "qualification_evidence_sha256",
     "qualification_tier",
@@ -46,6 +51,11 @@
     "dmg_url": { "$ref": "#/$defs/dmgUrl" },
     "dmg_sha256": { "$ref": "#/$defs/sha256" },
     "ed_signature": { "type": "string", "pattern": ".*\\S.*" },
+    "beta_zip_url": { "$ref": "#/$defs/betaZipUrl" },
+    "beta_zip_sha256": { "$ref": "#/$defs/sha256" },
+    "beta_dmg_url": { "$ref": "#/$defs/betaDmgUrl" },
+    "beta_dmg_sha256": { "$ref": "#/$defs/sha256" },
+    "beta_ed_signature": { "type": "string", "pattern": ".*\\S.*" },
     "qualification_evidence_asset": {
       "type": "string",
       "pattern": "^qualification-evidence-[^/]+\\.json$"
@@ -157,6 +167,14 @@
     "dmgUrl": {
       "type": "string",
       "pattern": "^https://github\\.com/BasedHardware/omi/releases/download/v[0-9]+\\.[0-9]+(?:\\.[0-9]+)?(?:%2[Bb]|\\+)[1-9][0-9]*-macos/omi\\.dmg$"
+    },
+    "betaZipUrl": {
+      "type": "string",
+      "pattern": "^https://github\\.com/BasedHardware/omi/releases/download/v[0-9]+\\.[0-9]+(?:\\.[0-9]+)?(?:%2[Bb]|\\+)[1-9][0-9]*-macos/Omi\\.Beta\\.zip$"
+    },
+    "betaDmgUrl": {
+      "type": "string",
+      "pattern": "^https://github\\.com/BasedHardware/omi/releases/download/v[0-9]+\\.[0-9]+(?:\\.[0-9]+)?(?:%2[Bb]|\\+)[1-9][0-9]*-macos/omi-beta\\.dmg$"
     }
   }
 }

.github/scripts/check-deployment-concurrency.py

@@ -1,4 +1,4 @@
 #!/usr/bin/env python3
 """Enforce target-scoped serialization for persistent deployment writers.
 
 This is intentionally a narrow, stdlib-only structural policy check. Actionlint
@@ -37,8 +37,6 @@
 # new deploy writer cannot silently bypass the audited lock graph.
 LOCK_CONTRACTS = {
     "desktop_backend_auto_dev.yml": LockContract("desktop-backend-auto-dev"),
-    "desktop_promote_prod.yml": LockContract("desktop-backend-promote-prod"),
-    "deploy-release-ring.yml": LockContract("deploy-release-ring-${{ inputs.ring }}"),
     "gcp_admin.yml": LockContract(
         "deploy-cloud-run-omi-admin-dashboard-${{ github.ref == 'refs/heads/development' && 'development' || github.ref == 'refs/heads/main' && 'prod' || format('nondeploy-{0}', github.run_id) }}"
     ),
@@ -91,9 +89,7 @@
 # deployable public values. It never runs Helm, kubectl apply, or a Cloud Run
 # mutation; classifying credential acquisition alone as a writer would hide
 # that distinction and force a meaningless deploy lock.
-READ_ONLY_WORKFLOW_EXEMPTIONS = {
-    "release-record.yml": 'kubectl -n "${ring}-omi-backend" get configmap "${ring}-omi-backend-config" -o json',
-}
+READ_ONLY_WORKFLOW_EXEMPTIONS = {}
 
 # Firestore index creation is a schema migration, not ordinary deploy work.
 # Keep a single auditable writer so backend readiness can stay read-only.
@@ -248,8 +244,9 @@
         errors.append(f"{name}: release-vector verification must use the canonical verifier")
     if "--environment" not in verifier_text:
         errors.append(f"{name}: release-vector verification must bind an environment")
-    if name == "gcp_backend.yml" and "github.event.inputs.deploy_targets == 'all'" not in verifier_text:
-        errors.append(f"{name}: all-tier release-vector verification must not run for cloud-run-only deploys")
+    if name == "gcp_backend.yml":
+        if "github.event.inputs.deploy_targets" not in verifier_text or "--cloud-run-only" not in verifier_text:
+            errors.append(f"{name}: cloud-run-only promotion must use the Cloud Run-only release-vector contract")
     return errors
 
 
@@ -717,7 +714,7 @@
         raise PolicyError("cancel-in-progress: true satisfied the deploy contract")
 
 
 def _self_test_deploy_guards() -> None:
     in_deploy_acceptance = """name: fixture
 jobs:
   deploy:

.github/scripts/check-desktop-auto-beta-candidate.py

@@ -131,9 +131,6 @@ def validate(args: argparse.Namespace) -> dict:
     metadata = parse_metadata(release.get("body") or "")
     if metadata.get("channel") != "candidate" or metadata.get("isLive", "").lower() not in {"false", "0", "no"}:
         fail("automatic beta qualification requires channel: candidate and isLive: false")
-    if metadata.get("stableCandidate", "").lower() in {"true", "1", "yes"}:
-        fail("automatic beta qualification refuses a release already nominated for stable")
-
     expected_version = match.group("version")
     expected_build = match.group("build")
     checks = _validate_smoke_contract(