feat(app): harden export flow and release gates

.codex/actions/_artifact_env.sh

@@ -0,0 +1,42 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# codex-os-managed
+REPO_ROOT="${CODEX_REPO_ROOT:-$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)}"
+REPO_NAME="${CODEX_REPO_NAME:-$(basename "$REPO_ROOT")}" 
+
+if command -v shasum >/dev/null 2>&1; then
+  REPO_HASH="${CODEX_REPO_HASH:-$(printf '%s' "$REPO_ROOT" | shasum -a 256 | awk '{print substr($1,1,12)}')}"
+else
+  REPO_HASH="${CODEX_REPO_HASH:-$(printf '%s' "$REPO_ROOT" | md5 | awk '{print substr($NF,1,12)}')}"
+fi
+
+RUN_ID="${CODEX_RUN_ID:-$(date +%Y%m%dT%H%M%S)-$$}"
+CODEX_CACHE_ROOT="${CODEX_CACHE_ROOT:-/Users/d/Library/Caches/Codex}"
+CODEX_BUILD_ROOT="${CODEX_BUILD_ROOT:-$CODEX_CACHE_ROOT/build}"
+CODEX_LOG_ROOT="${CODEX_LOG_ROOT:-$CODEX_CACHE_ROOT/logs}"
+
+export CODEX_REPO_ROOT="$REPO_ROOT"
+export CODEX_REPO_NAME="$REPO_NAME"
+export CODEX_REPO_HASH="$REPO_HASH"
+export CODEX_RUN_ID="$RUN_ID"
+
+export CODEX_BUILD_RUST_DIR="${CODEX_BUILD_RUST_DIR:-$CODEX_BUILD_ROOT/rust/$REPO_HASH}"
+export CODEX_BUILD_NEXT_DIR="${CODEX_BUILD_NEXT_DIR:-$CODEX_BUILD_ROOT/next/$REPO_HASH}"
+export CODEX_BUILD_JS_DIR="${CODEX_BUILD_JS_DIR:-$CODEX_BUILD_ROOT/js/$REPO_HASH}"
+export CODEX_LOG_RUN_DIR="${CODEX_LOG_RUN_DIR:-$CODEX_LOG_ROOT/$REPO_NAME/$RUN_ID}"
+
+mkdir -p "$CODEX_BUILD_RUST_DIR" "$CODEX_BUILD_NEXT_DIR" "$CODEX_BUILD_JS_DIR" "$CODEX_LOG_RUN_DIR"
+
+if [[ -z "${CARGO_TARGET_DIR:-}" ]]; then
+  export CARGO_TARGET_DIR="$CODEX_BUILD_RUST_DIR"
+fi
+if [[ -z "${NEXT_CACHE_DIR:-}" ]]; then
+  export NEXT_CACHE_DIR="$CODEX_BUILD_NEXT_DIR"
+fi
+if [[ -z "${VITE_CACHE_DIR:-}" ]]; then
+  export VITE_CACHE_DIR="$CODEX_BUILD_JS_DIR/vite"
+fi
+if [[ -z "${TURBO_CACHE_DIR:-}" ]]; then
+  export TURBO_CACHE_DIR="$CODEX_BUILD_JS_DIR/turbo"
+fi

.codex/verify.commands

@@ -1,5 +1,6 @@
 pnpm lint
-pnpm typecheck
+pnpm type-check
+pnpm release:verify-version
 pnpm test:coverage
 pnpm test:integration
 pnpm test:e2e:smoke

.github/workflows/desktop-ci.yml

@@ -0,0 +1,46 @@
+name: desktop-ci
+
+on:
+  pull_request:
+  push:
+    branches: [main, master]
+
+jobs:
+  desktop-smoke:
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, windows-latest, macos-latest]
+
+    steps:
+      - uses: actions/checkout@v5
+
+      - uses: pnpm/action-setup@v4
+        with:
+          version: 10.28.1
+
+      - uses: actions/setup-node@v5
+        with:
+          node-version: 20
+          cache: pnpm
+
+      - name: Setup Rust
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Install Linux system dependencies
+        if: runner.os == 'Linux'
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y \
+            libwebkit2gtk-4.1-dev \
+            libgtk-3-dev \
+            libayatana-appindicator3-dev \
+            librsvg2-dev \
+            patchelf
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Desktop build smoke test
+        run: pnpm tauri build --no-bundle

.github/workflows/quality-gates.yml

@@ -13,13 +13,27 @@ jobs:
         with:
           fetch-depth: 0
 
-      - uses: actions/setup-node@v5
+      - uses: pnpm/action-setup@v4
         with:
-          node-version: 22
+          version: 10.28.1
 
-      - uses: pnpm/action-setup@v4
+      - uses: actions/setup-node@v5
         with:
-          version: 9
+          node-version: 20
+          cache: pnpm
+
+      - name: Setup Rust
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Install Linux system dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y \
+            libwebkit2gtk-4.1-dev \
+            libgtk-3-dev \
+            libayatana-appindicator3-dev \
+            librsvg2-dev \
+            patchelf
 
       - name: Install dependencies
         run: pnpm install --frozen-lockfile

.github/workflows/release-desktop.yml

@@ -0,0 +1,118 @@
+name: release-desktop
+
+on:
+  push:
+    tags:
+      - 'v*'
+  workflow_dispatch:
+
+permissions:
+  contents: write
+
+jobs:
+  validate-release:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+
+      - uses: pnpm/action-setup@v4
+        with:
+          version: 10.28.1
+
+      - uses: actions/setup-node@v5
+        with:
+          node-version: 20
+          cache: pnpm
+
+      - name: Setup Rust
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Install Linux system dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y \
+            libwebkit2gtk-4.1-dev \
+            libgtk-3-dev \
+            libayatana-appindicator3-dev \
+            librsvg2-dev \
+            patchelf
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Validate verification commands
+        run: bash .codex/scripts/run_verify_commands.sh
+
+      - name: Validate release version sync
+        run: node scripts/release/verify-version-sync.mjs
+
+  build-artifacts:
+    needs: validate-release
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, windows-latest, macos-latest]
+
+    steps:
+      - uses: actions/checkout@v5
+
+      - uses: pnpm/action-setup@v4
+        with:
+          version: 10.28.1
+
+      - uses: actions/setup-node@v5
+        with:
+          node-version: 20
+          cache: pnpm
+
+      - name: Setup Rust
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Install Linux system dependencies
+        if: runner.os == 'Linux'
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y \
+            libwebkit2gtk-4.1-dev \
+            libgtk-3-dev \
+            libayatana-appindicator3-dev \
+            librsvg2-dev \
+            patchelf
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Build desktop release artifacts
+        run: pnpm tauri:build
+
+      - name: Collect release artifacts
+        shell: bash
+        run: scripts/release/collect-artifacts.sh release-artifacts
+
+      - name: Upload release artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: release-artifacts-${{ matrix.os }}
+          path: release-artifacts/
+
+  publish-release:
+    if: startsWith(github.ref, 'refs/tags/')
+    needs: build-artifacts
+    runs-on: ubuntu-latest
+    steps:
+      - name: Download artifacts
+        uses: actions/download-artifact@v4
+        with:
+          pattern: release-artifacts-*
+          path: release-artifacts
+          merge-multiple: true
+
+      - name: Publish GitHub release
+        uses: softprops/action-gh-release@v2
+        with:
+          tag_name: ${{ github.ref_name }}
+          draft: true
+          files: release-artifacts/**

.husky/commit-msg

@@ -0,0 +1,11 @@
+#!/usr/bin/env sh
+# codex-os-managed
+. "$(dirname -- "$0")/_/husky.sh" 2>/dev/null || true
+
+if command -v pnpm >/dev/null 2>&1; then
+  pnpm commitlint --edit "$1"
+elif command -v npm >/dev/null 2>&1; then
+  npx commitlint --edit "$1"
+else
+  yarn commitlint --edit "$1"
+fi

.husky/pre-commit

@@ -0,0 +1,23 @@
+#!/usr/bin/env sh
+# codex-os-managed
+. "$(dirname -- "$0")/_/husky.sh" 2>/dev/null || true
+
+run_script() {
+  if command -v pnpm >/dev/null 2>&1; then
+    pnpm "$@"
+  elif command -v npm >/dev/null 2>&1; then
+    npm run "$1" --if-present
+  elif command -v yarn >/dev/null 2>&1; then
+    yarn "$@"
+  else
+    echo "No supported package manager found."
+    exit 1
+  fi
+}
+
+run_script git:guard:branch
+run_script git:guard:atomic
+run_script lint-staged
+run_script git:guard:generated
+run_script git:guard:large-files
+run_script git:guard:secrets

.husky/pre-push

@@ -0,0 +1,11 @@
+#!/usr/bin/env sh
+# codex-os-managed
+. "$(dirname -- "$0")/_/husky.sh" 2>/dev/null || true
+
+if command -v pnpm >/dev/null 2>&1; then
+  pnpm git:guard:no-main-push
+elif command -v npm >/dev/null 2>&1; then
+  npm run git:guard:no-main-push --if-present
+else
+  yarn git:guard:no-main-push
+fi

.perf-baselines/build-time.json

@@ -0,0 +1,4 @@
+{
+  "buildMs": 0,
+  "capturedAt": "1970-01-01T00:00:00.000Z"
+}

.perf-baselines/bundle.json

@@ -0,0 +1,4 @@
+{
+  "totalBytes": 0,
+  "capturedAt": "1970-01-01T00:00:00.000Z"
+}

AGENTS.md

@@ -1,5 +1,15 @@
 ## Definition of Done: Tests + Docs (Blocking)
 
+<!-- comm-contract:start -->
+
+## Communication Contract (Global)
+
+- Follow `/Users/d/.codex/policies/communication/BigPictureReportingV1.md` for all user-facing updates.
+- Use exact section labels from `BigPictureReportingV1.md` for default status/progress updates.
+- Keep default updates beginner-friendly, big-picture, and low-noise.
+- Keep technical details in internal artifacts unless explicitly requested by the user.
+- Honor toggles literally: `simple mode`, `show receipts`, `tech mode`, `debug mode`.
+<!-- comm-contract:end -->
 - Any production code change must include meaningful test updates in the same PR.
 - Meaningful tests must include at least:
   - one primary behavior assertion