feat(agent): add signed Prod updates with explicit restart

.agents/skills/develop-maple-agent/SKILL.md

@@ -98,14 +98,21 @@ account isolation, tool execution, MCP/ACP inputs, persistence, and process
 ownership at the layer implementing the effect. Never treat a passing source
 import or a native login screen as authenticated chat or containment proof.
 
-Packaged Agent Prod only links to stable `maple-agent-vX.Y.Z` releases; Dev only
-links to prereleases named `maple-agent-dev-vX.Y.Z`. Their embedded profiles,
-bundle IDs, and configuration/data namespaces must remain separate. Packaged
-profiles never adopt legacy Agent or Research state. See
+Packaged Agent Prod uses its independently signed R2 update feed with compiled
+primary and backup public-key pins. Packaged Prod checks the compiled feed;
+publication remains disabled pending owner service setup. Invitations still
+require the signed installed-update rehearsal.
+Dev and unpackaged builds have no production updater. Empty-key profiles still
+disable update traffic. Do not substitute a test key or inherit feed/key overrides
+from the launch environment. Embedded profiles, bundle IDs and state namespaces
+remain separate; packaged profiles
+never adopt legacy Agent or Research state. See
 [`desktop builds`](../../../apps/maple-agent/docs/desktop-builds.md) for packaging
 commands and the protected-master signing/artifact contract.
-Never use repository-wide `/releases/latest` for Agent, accept Research's bare
-`vX.Y.Z` tags, or turn a failed/incomplete release scan into an update offer.
-No Agent publisher is activated by the import. Future Agent release work
-requires explicit authorization and `make_latest: false` to preserve Research's
-latest pointer. Do not rename SDKs or publish registries incidentally.
+Never use repository-wide `/releases/latest` for Agent or modify Research's
+Worker/feed/publisher while working on the Agent updater. Preserve exact signed
+manifest bytes, anti-rollback, bounded downloads, staged-state revalidation and
+host/install lock ownership. Linux activation needs its own packaged update proof.
+Follow [updater development](../../../apps/maple-agent/docs/updates.md) for key
+setup and validation. Production resources, keys, routes, signing and publication
+remain separately authorized operations. Do not publish registries incidentally.

.github/workflows/agent-desktop-build.yml

@@ -166,6 +166,9 @@ jobs:
           path: apps/maple-agent/target
       - name: Verify prebuilt profile and source before signing
         run: nix develop --no-update-lock-file . -c ./scripts/verify-prebuilt-release.sh "$MAPLE_RELEASE_PROFILE"
+      - name: Build trusted installer archive scanner
+        if: ${{ matrix.variant == 'prod' }}
+        run: nix develop --no-update-lock-file . -c cargo build --locked -p maple-agent-updater --example validate-release-archive
       - name: Sign and notarize Agent packages
         run: nix develop --no-update-lock-file . -c ./scripts/package-release.sh "$MAPLE_RELEASE_PROFILE"
         env:
@@ -174,6 +177,9 @@ jobs:
           APPLE_ID: ${{ secrets.APPLE_ID }}
           APPLE_ID_PASSWORD: ${{ secrets.APPLE_ID_PASSWORD }}
           APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
+      - name: Scan actual Prod updater archive with installer parser
+        if: ${{ matrix.variant == 'prod' }}
+        run: nix develop --no-update-lock-file . -c ./scripts/verify-updater-archive.sh "dist/$MAPLE_RELEASE_PROFILE"
       - name: Attest final macOS packages
         uses: actions/attest@281a49d4cbb0a72c9575a50d18f6deb515a11deb
         with:
@@ -223,8 +229,14 @@ jobs:
           path: apps/maple-agent/target
       - name: Verify prebuilt profile and source
         run: nix develop --no-update-lock-file . -c ./scripts/verify-prebuilt-release.sh "$MAPLE_RELEASE_PROFILE"
+      - name: Build trusted installer archive scanner
+        if: ${{ matrix.variant == 'prod' }}
+        run: nix develop --no-update-lock-file . -c cargo build --locked -p maple-agent-updater --example validate-release-archive
       - name: Package unsigned Agent preview
         run: nix develop --no-update-lock-file . -c ./scripts/package-release.sh "$MAPLE_RELEASE_PROFILE" --unsigned
+      - name: Scan actual Prod updater archive with installer parser
+        if: ${{ matrix.variant == 'prod' }}
+        run: nix develop --no-update-lock-file . -c ./scripts/verify-updater-archive.sh "dist/$MAPLE_RELEASE_PROFILE" --unsigned
       - name: Verify unsigned package profile and hashes
         run: nix develop --no-update-lock-file . -c ./scripts/verify-release.sh "$MAPLE_RELEASE_PROFILE" "dist/$MAPLE_RELEASE_PROFILE" --unsigned
       - name: Upload Agent packages

apps/maple-agent/Cargo.toml

@@ -1,10 +1,10 @@
 [workspace]
 resolver = "2"
-members = ["crates/maple-agent", "crates/maple-billing", "crates/pi-ai", "crates/pi-agent-core", "crates/pi-coding-agent", "crates/store-bench", "app"]
+members = ["crates/maple-agent", "crates/maple-billing", "crates/maple-agent-updater", "crates/pi-ai", "crates/pi-agent-core", "crates/pi-coding-agent", "crates/store-bench", "app"]
 
 [workspace.package]
 edition = "2024"
-version = "0.1.0"
+version = "0.0.1"
 license = "MIT"
 
 [workspace.dependencies]

apps/maple-agent/README.md

@@ -511,7 +511,7 @@ the missing feature.
 
 Local unpackaged builds accept the environment settings below. Packaged Dev
 and Prod bake their service endpoints, client ID, PCR trust, state namespace,
-and update repository at compile time; service and repository overrides are
+and updater trust at compile time; service overrides are
 ignored. See [build profiles](docs/release-profiles.md).
 
 | Variable | Purpose | Default |
@@ -522,8 +522,7 @@ ignored. See [build profiles](docs/release-profiles.md).
 | `MAPLE_MODEL` | Model to select at start. | Runtime default |
 | `MAPLE_CONTEXT_LIMIT` | Context window in tokens, used instead of the model catalog's for compaction and the context ring. | Catalog value |
 | `MAPLE_SHELL` | The bash the agent's `bash` tool runs. | `/bin/bash`, else `bash` on PATH (Windows: Git Bash; without it, the `powershell` tool) |
-| `MAPLE_UPDATE_REPO` | GitHub `owner/repo` containing stable `maple-agent-vX.Y.Z` releases. | `MaplePrivacyLabs/Maple` |
-| `MAPLE_DISABLE_UPDATE_CHECK` | `1` turns the release check off. | unset |
+| `MAPLE_DISABLE_UPDATE_CHECK` | `1` turns Agent update checks off. | unset |
 | `RUST_LOG` | Log filter. | `info` |
 
 ### File locations
@@ -585,17 +584,27 @@ check.
 
 ## Update and release boundary
 
-Prod and unpackaged builds accept stable `maple-agent-vX.Y.Z` releases. Dev
-accepts only prereleases in `maple-agent-dev-vX.Y.Z`. Each selects the highest
-semantic version across a bounded, complete scan of release pages. Research
-`vX.Y.Z` releases, drafts, and the other channel are ignored. A failed or
-incomplete scan produces no update banner. The app only links to a canonical
-GitHub release page; it does not download or install binaries.
+Packaged Prod builds use the independent signed Agent update feed. Dev and
+unpackaged/MDE builds do not check a production updater. The Prod profile pins
+the update URL and reviewed primary/backup public keys; inherited environment
+variables cannot replace them. Packaged Prod builds check the compiled feed, while
+publication remains disabled pending owner service setup. Invitations still
+require the signed installed-update rehearsal.
+An empty-key profile still reports that updates are not configured and makes no
+update requests.
+
+Updates authenticate product, channel, version, target, byte size and SHA-256
+before staging. Automatic downloads default on; installation requires the
+explicit Restart to Update action, fresh feed revalidation and profile-host
+shutdown. Read-only installations offer a manual download. Linux automatic
+replacement stays disabled until its packaged update gate is independently
+validated. See [updater development and activation](docs/updates.md).
 
 The [desktop build workflow](docs/desktop-builds.md) provides Actions artifacts
-without creating releases or advancing update feeds. Future Agent releases
-must set `make_latest: false` so Research’s global GitHub latest pointer remains
-unchanged. Release publication requires its own authorization. Local
+without creating releases or advancing update feeds. Agent publication uses
+its own R2 bucket and workflow, with no GitHub Release or tag creation and no
+Research Worker/feed changes. Production activation and release publication
+require their own authorization. Local
 `just release` and `just dist` only build local files.
 
 ## Shared dependencies and provenance