refactor(release): independent candidate pipelines and acceptance replay

[luokerenx4]

Outcome

Stable release orchestration and non-publishing acceptance are complete. The maintainer accepted this topic for merge to dev. No product version/tag/public release was created.

Changes

• Independent native desktop build -> upgrade pipelines, retaining final all-platform aggregation.
• POSIX system-package fixtures no longer wait for Windows/npm materialization.
• Exact-byte candidate manifests, authenticated producing-run selection, and bound acceptance verified before staging.
• Same-source desktop recovery skips builds and runs fresh acceptance over preserved bytes.
• Integrated dev/master verifier selection changes verification code only; product SHA/version/tag remain fixed.
• Full stable source validation runs on the same dispatch SHA concurrently with candidate builds, joining at publication.
• Shared commit/hash-verified CLI inputs; native compilation and acceptance remain per target.
• Read-only isolated unsigned rehearsals; production cannot select rehearsal artifacts.

Measured evidence

• Three-platform build + upgrade: all passed. First native job -> last completion 29m23s.
• Same-source restored candidates: all passed. All three downloaded acceptance JSON records exactly match originals, including candidate IDs and all 11 checks.
  Execution 15m49s, observed 46.2% lower. Deliberate pre-start waiting 15m10s is separate; total dispatch time 30m59s. Acceptance runtime varied, so the reduction is not all causally attributable to reuse.
  Aggregate original build time 25m10s vs restore 3m16s.
• New verifier / same ARM candidate: 2m56s dispatch-to-completion. Exact candidate ID unchanged; expected verifier SHA changed; all 11 checks identical and successful.
• Real CLI benchmark: consumer 157s -> 65s, but producer+restore 183s. Less repeated computation, not faster first artifact.
• Negative replay: wrong source rejected before download/install.

Local verification

• Complete suite: 723 files, 6482 passed, 3 skipped, 406.82s with maxWorkers=1; root typecheck passed.
• Subsequent final receipt/workflow tests: 43 passed; neutral-input/verifier tests: 11 passed.
• Earlier full run had one unchanged Connector UI timeout. Its isolated 32-test suite and subsequent complete run passed; the original failure remains documented rather than claimed fixed.
• actionlint passed with stale macos-15-intel label diagnostic excluded; shellcheck/pyflakes unavailable.
• First rehearsal exposed a reusable-caller actions:read omission missed by lint; fixed and subsequent real runs passed.

Preserved boundaries / residual risk

Stable source, native runtime, N-1, signing, exact-byte integrity and channel gates remain. Diagnostic replay receipts are not publication authority: recovery performs fresh bound acceptance through the normal final gate. Product changes cannot reuse old bytes as a new source/version/channel.
No full signed release or public activation was performed. Historic ~57m -> modeled ~34-35m remains an estimate, not a measured signed release result. Windows installer duration and signing/notarization remain major residual costs.

Owner guide and applicable local release skills are updated. The accepted plan and PLANS.md entry were removed per repository policy. The final plan is preserved at commit 46d52e5 (plans/release-pipeline-efficiency.md); this PR records measured results and the owner guide retains operating instructions.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
openalice-demo	Ready	Preview	Sep 5, 2026 11:47am UTC