[ymote]

Makes the desktop (octosense) self-contained and installable, with a tag-triggered workflow that produces unsigned packages. Signing has hooks gated on secrets (none are configured yet).

Includes the closed #85. Its desktop-kernel work is the first commit here: crates/kernel/src/launch.rs finds a packaged octos-kernel[.exe] beside the shell when OCTOS_APP_CORE_BIN is unset, and tools/build-desktop.py stages the locked kernel there. The packages ship that kernel.

Rebased onto main (2026-10-01) as a linear history (8d740e7..459c5bb), with the old merge commits gone. The conflicts and how they were resolved:

• Cargo.toml / Cargo.lock: main's versions. Package the desktop Octos kernel and update hosted Rinx #85's hosted-Rinx revision 197d5170 is dropped, because main pins Rinx by tag v1.1.0 through native-apps.json. Its [patch."…/OctoSense.git"] redirect, which includes octosense-kernel, is already on main.
• .gitignore: main's /.sources, plus /desktop/packaging/.release.generated.json.
• crates/shell/src/octosense/paths.rs: main's private_dir and scope_linked_app_data are kept, followed by packaged() and its uses.
• desktop/README*.md: main's OCTOSENSE_GLANCE_DEMO row is kept, and the OCTOS_APP_CORE_BIN row describes the packaged-sibling fallback.
• New commit: main's ci-local drift check (tools/test_ci_local.py, in the desktop job) rejected release-desktop.yml. It is now listed in GITHUB_ONLY (tools/ci_local.py), so drift leaves it alone and ci-local-merge refuses a PR that triggers it. Such a PR waits for GitHub's run. A test and docs/local-ci.md cover this.

Checked after the rebase, in a fresh worktree with python3 tools/setup.py --no-hub. All of these pass:

• setup.py --check --cargo, native_apps.py --check, python3 -m unittest discover -s tools -p 'test_*.py' (90 tests, including test_build_desktop, test_release_scan and test_ci_local), ci_local.py --check-drift, and rom/tests/test_no_local_paths.py
• the desktop and phone cargo check --locked builds, and both check-shell-graph.sh runs
• from phone/: the shell/Home/App Hub/AppCard/ai-host tests, plus the appcard and host_tools runs; cargo test --locked -p octosense-kernel
• desktop/scripts/test_package.py, tools/build-desktop.py --plan, and desktop/scripts/package.py --print-env --no-kernel

No package was built or scanned after the rebase. The packaging results below are from before it.

What a package contains, and how it is found at run time

• Resources: built with MAKEPAD_PACKAGE_DIR (MAKEPAD=apple_bundle on macOS), so Makepad reads every crate_resource from the package. desktop/scripts/package.py stages the resources/ of every linked git or path crate, found with cargo tree -p octosense: makepad_widgets (fonts, icons, textures, 61.7 MB), octosense_shell, octosense_app_hub_app, rinx, article_core/article_makepad. They land in Contents/Resources/<crate>/resources/ (macOS, via NSBundle), beside octosense.exe (NSIS, .), and in usr/lib/octosense/ (deb/AppImage, ../lib/octosense from usr/bin).
• System apps and config: App Hub packs the system-app bundles into the binary at build time, so nothing from apps/ or system-apps.json is read at run time. A packaged build no longer looks for the checkout it was built in (paths::packaged()). As a result it has no source-built developer catalog; --apps with executable rows still works. Dev cargo run is unchanged.
• Kernel: octos at the pinned revision, built via Package the desktop Octos kernel and update hosted Rinx #85's source_at/stage (the stage step checks --version against the pin). It ships as octos-kernel beside the executable, where Package the desktop Octos kernel and update hosted Rinx #85's kernel service finds it without OCTOS_APP_CORE_BIN. --no-kernel ships none, and the app then runs without an assistant.
• Identity: product name OctoSense, identifier org.octosense.desktop (desktop/packaging/release.json), version taken from the desktop-v* tag. The icon is the OctoSense flower mark, rendered by desktop/packaging/make_icons.py (stdlib only). Android keeps dev.makepad.octosense.
• No private paths: builds use --remap-path-prefix for home, CARGO_HOME and the checkout, and strip debug info. Crates also embed their manifest dirs as strings, which remapping cannot reach, so the workflow builds macOS under /private/tmp and puts Windows' CARGO_HOME on D:. tools/release-scan.py then scans the packages and their payloads (.app, .dmg via hdiutil, .deb, .AppImage, .zip, NSIS via 7-Zip) and fails on user dirs, non-runner homes, *.local hosts, private IPv4 addresses, the scanning account and host names, and RELEASE_SCAN_EXTRA.

Workflow: .github/workflows/release-desktop.yml

It runs on macos-14 (arm64), windows-2022 and ubuntu-22.04 (x86_64). Each job does: setup.py → setup.py --check --cargo + check-shell-graph.sh → package.py → scan → artifacts. A desktop-v* tag also attaches all packages, receipts and SHA256SUMS to a draft, --latest=false release. workflow_dispatch (with a dry_run input) and pull requests that touch the packaging run the same jobs but release nothing. No x86_64 macOS build is made, because the runner is arm64.

Signing secrets still needed, each step skipped while its secret is absent: APPLE_CERTIFICATE, APPLE_CERTIFICATE_PASSWORD, APPLE_SIGNING_IDENTITY, APPLE_API_KEY, APPLE_API_ISSUER, APPLE_API_KEY_P8, WINDOWS_CERTIFICATE, WINDOWS_CERTIFICATE_PASSWORD. RELEASE_SCAN_EXTRA is optional. The signing paths are unverified.

Verified locally (macOS arm64)

• package.py built OctoSense.app (278 MB) and OctoSense_0.1.0_aarch64.dmg (131 MB) from a checkout outside any home directory. Kernel: octos 2.0.3-rc.13 at the then-pinned a6ea850.
• I copied the .app outside the repository, renamed both the build tree and .sources out of reach, and ran it with MAKEPAD_HIDE_WINDOWS=1 and the remote bridge, OCTOS_APP_CORE_BIN unset. desktop/scripts/system_apps_remote.sh (with OCTOSENSE_BIN set to the packaged binary) passed its functional checks: desktop up, launcher lists all six system apps, Photos draws, Mail's host sign-in sheet opens, AI providers opens, bundles unpacked. Its last check failed only because it matches [ui-hang] frames by symbol name, and that build had symbols stripped. The release build now strips debug info only, so symbol names stay.
• A second run through /d, /snap and /click showed the bar, dock and Liquid Glass frames, and App Hub listing News, Maps, Photos and Camera in its preview catalog. The log had no resource-load errors and said "octos: kernel service ready", meaning it found the packaged kernel. /gq quit the app.
• Scan: the shell binary and staged resources were clean. The a6ea850 kernel was refused, because it embedded a developer's absolute paths from octos' project templates. octos#2583 removed them, and chore(octos): pin octos main 60cf96e6 (octos#2583) #88 has since moved the pin to 60cf96e, which this branch includes.
• actionlint is clean. Tool tests pass (tools/, desktop/scripts/test_package.py), and so does rom/tests/test_no_local_paths.py.

A second local build on the current pins (octos 60cf96e) produced OctoSense.app (339 MB, of which the kernel is 117 MB) and a 140 MB .dmg. The scan of the .app, .dmg, staged resources and kernel came back clean. I ran it again outside the repository with the sources hidden: every functional check passed, and there were no resource errors. The script's [ui-hang] check flagged only these two things:

• packaged resource and font loads on the UI thread at startup and first use. These are now in its known list.
• one 314 ms shader compile, which has nothing to do with packaging.

CI dry run (pull_request trigger, run 36391231861): all green

Platform	Packages	Scan
macos-14	OctoSense_0.1.0_aarch64.dmg (147 MB), OctoSense_0.1.0_macos_aarch64.app.zip (147 MB)	clean, 595 files
windows-2022	octosense_0.1.0_x64-setup.exe (108 MB)	clean, 598 files
ubuntu-22.04	octosense_0.1.0_amd64.deb (157 MB), octosense_0.1.0_x86_64.AppImage (149 MB)	clean, 637 files

Fixes the dry runs forced:

• core.autocrlf false: Windows CRLF checkouts broke the runtime patch digest.
• PYTHONUTF8=1: Windows Python read cargo's JSON as cp1252.
• C:\Users\runneradmin is treated as a CI path, like /home/runner. The prebuilt NSIS plugin cargo-packager bundles carries it.
• .local hosts must be one label, and XDG .local/… paths are excluded. Rust packs string literals back to back, so otherwise octos' strings read as host names.

Windows and Linux packages are built and scanned in CI only; nobody has run them on a machine yet, so they are unverified. No desktop-v tag was created.

🤖 Generated with Claude Code

[ymote]

Note from #98 (Talk to Octos): #98 no longer uses a downstream octos overlay. octos serve --host-managed is upstream in octos-org/octos#2591. Once that merges and the workspace octos pin moves to the merged commit, this PR's desktop packaging needs nothing beyond that pin: building the pinned octos is enough. The #98 head (d5e20d9) merges with this branch without textual conflicts. The files both change are Cargo.toml/Cargo.lock, crates/kernel/src/{launch,lib}.rs, crates/kernel/tests/core.rs, crates/kernel/README.md, crates/ai-host/src/lib.rs and the desktop READMEs.

🤖 Generated with Claude Code

[ymote]

Replaced by two fresh PRs on current main:

• Desktop: find the packaged octos kernel and refuse one of another revision #256: the packaged-kernel finder (from Package the desktop Octos kernel and update hosted Rinx #85), plus a launch-time check that the packaged kernel's receipt names the pinned octos revision and its SHA-256.
• Desktop release packages; a release workflow that keeps signing out of the build #257 (stacked on Desktop: find the packaged octos kernel and refuse one of another revision #256): this PR's packaging and release-desktop.yml, with every review finding fixed. The build job has no secrets; signing runs in separate release-environment jobs that only download the artifacts; the checkout is the tag's and is verified before attaching; pull requests get no secrets; AuthKey.p8 is deleted in an always() step; actions are pinned to SHAs and Rust to 1.97.1; a packaged build never looks for a checkout; and release-desktop.yml is excluded from the ci-local drift check, with its reason.

🤖 Generated with Claude Code