100yenadmin · 100yenadmin · Jun 28, 2026 · Jun 28, 2026 · Jun 28, 2026 · Jun 28, 2026
diff --git a/.github/workflows/_build-reusable.yml b/.github/workflows/_build-reusable.yml
@@ -449,6 +449,7 @@ jobs:
           identity: ${{ secrets.IDENTITY }}
           CSC_NAME: ${{ secrets.IDENTITY }}
           CSC_IDENTITY_AUTO_DISCOVERY: false
+          EVAOS_DESKTOP_BRIDGE_REQUIRE_REAL: 'true'
           npm_config_cache: ${{ runner.temp }}/.npm
           ELECTRON_CACHE: ${{ runner.temp }}/.cache/electron
           ELECTRON_BUILDER_CACHE: ${{ runner.temp }}/.cache/electron-builder

diff --git a/.github/workflows/pr-checks.yml b/.github/workflows/pr-checks.yml
@@ -652,6 +652,9 @@ jobs:
           echo "✓Unpacked app build passed for macos-arm64"
         env:
           NODE_OPTIONS: '--max-old-space-size=8192'
+          EVAOS_DESKTOP_BRIDGE_ALLOW_PLACEHOLDER: '1'
+          EVAOS_DESKTOP_BRIDGE_DISABLE_DEFAULT_CANDIDATES: '1'
+          EVAOS_DESKTOP_BRIDGE_SOURCE_REF: 207f6528461ecae51c39efd2654733c1b07d39a4
           npm_config_arch: arm64
           npm_config_target_arch: arm64
           npm_config_runtime: electron
@@ -677,6 +680,8 @@ jobs:
 
           AIONCORE_DIR="$APP_PATH/Contents/Resources/bundled-aioncore"
           HUB_DIR="$APP_PATH/Contents/Resources/hub"
+          BRIDGE="$APP_PATH/Contents/Resources/Bridge/evaos-desktop-bridge"
+          BRIDGE_MANIFEST="$APP_PATH/Contents/Resources/Bridge/manifest.json"
 
           for required_dir in "$AIONCORE_DIR" "$HUB_DIR"; do
             if [ ! -d "$required_dir" ]; then
@@ -685,6 +690,16 @@ jobs:
               exit 1
             fi
           done
+          if [ ! -f "$BRIDGE" ] || [ ! -x "$BRIDGE" ]; then
+            echo "::error::Missing executable bundled Bridge CLI: $BRIDGE"
+            find "$APP_PATH/Contents/Resources" -maxdepth 3 -print || true
+            exit 1
+          fi
+          if [ ! -f "$BRIDGE_MANIFEST" ]; then
+            echo "::error::Missing bundled Bridge manifest: $BRIDGE_MANIFEST"
+            find "$APP_PATH/Contents/Resources/Bridge" -maxdepth 3 -print || true
+            exit 1
+          fi
 
           AIONCORE_BIN="$AIONCORE_DIR/darwin-arm64/aioncore"
           AIONCORE_MANIFEST="$AIONCORE_DIR/darwin-arm64/manifest.json"
@@ -710,6 +725,7 @@ jobs:
 
           BUNDLE_ID="$(/usr/libexec/PlistBuddy -c 'Print :CFBundleIdentifier' "$APP_PATH/Contents/Info.plist")"
           VERSION="$(/usr/libexec/PlistBuddy -c 'Print :CFBundleShortVersionString' "$APP_PATH/Contents/Info.plist")"
+          BRIDGE_SUMMARY="$(node -e "const fs=require('fs'); const m=JSON.parse(fs.readFileSync(process.argv[1], 'utf8')); if (m.placeholder !== true) { console.error('::error::Expected thin-app-smoke to bundle the diagnostic Bridge placeholder'); process.exit(1); } console.log('diagnostic-placeholder')" "$BRIDGE_MANIFEST")"
           node scripts/evaosVerifyRendererDependencyPrune.js "$APP_PATH"
 
           {
@@ -719,9 +735,10 @@ jobs:
             echo "- Version: \`$VERSION\`"
             echo "- Bundle ID: \`$BUNDLE_ID\`"
             echo "- Package smoke reasons: \`$PACKAGE_SMOKE_REASONS\`"
+            echo "- Bridge manifest: \`$BRIDGE_SUMMARY\`"
             echo "- Renderer dependency prune: verified \`app.asar\` and \`app.asar.unpacked/node_modules\`"
             echo
-            echo "This PR artifact is intentionally unpacked and may be ad-hoc/non-Developer-ID signed by packaging hooks. It produces no DMG, no release metadata, no notarization/stapling proof, no TCC or permission proof, and no public release proof."
+            echo "This PR artifact is intentionally unpacked and may use a diagnostic Bridge placeholder when private source access is unavailable. It may be ad-hoc/non-Developer-ID signed by packaging hooks. It produces no DMG, no release metadata, no notarization/stapling proof, no TCC or permission proof, and no public release proof."
             echo
             echo "### Size"
             echo '```'

diff --git a/.github/workflows/workbench-functional-smoke.yml b/.github/workflows/workbench-functional-smoke.yml
@@ -16,6 +16,11 @@ on:
         required: false
         default: true
         type: boolean
+      bridge_ref:
+        description: evaos-desktop-bridge ref to bundle
+        required: false
+        default: 207f6528461ecae51c39efd2654733c1b07d39a4
+        type: string
 
 concurrency:
   group: workbench-functional-smoke-${{ github.event.inputs.ref }}
@@ -30,6 +35,7 @@ env:
   EVAOS_FINALIZE_MAC_DMG: 'false'
   EVAOS_DMG_CODESIGN: 'false'
   ELECTRON_BUILDER_COMPRESSION_LEVEL: '1'
+  WORKBENCH_SMOKE_BRIDGE_REF: ${{ inputs.bridge_ref }}
 
 jobs:
   macos-arm64-app:
@@ -106,25 +112,35 @@ jobs:
         shell: bash
         run: |
           set -euo pipefail
-          node scripts/evaosBetaReleaseGate.js audit-config
-          node scripts/evaosUpstreamGuardrailAudit.js
+          if [ -f scripts/evaosBetaReleaseGate.js ] && [ -f packages/desktop/src/process/evaosBetaSafety.ts ]; then
+            node scripts/evaosBetaReleaseGate.js audit-config
+          else
+            echo "::notice::Skipping beta release config audit; beta safety guardrail source is absent on this ref."
+          fi
+          if [ -f scripts/evaosUpstreamGuardrailAudit.js ]; then
+            node scripts/evaosUpstreamGuardrailAudit.js
+          else
+            echo "::notice::Skipping upstream guardrail audit; script is absent on this ref."
+          fi
 
       - name: Verify bridge source access
         shell: bash
         env:
-          BRIDGE_SOURCE_TOKEN: ${{ secrets.GH_TOKEN }}
+          BRIDGE_SOURCE_TOKEN: ${{ secrets.EVAOS_DESKTOP_BRIDGE_SOURCE_TOKEN || secrets.GH_TOKEN }}
         run: |
           set -euo pipefail
           if [ -z "${BRIDGE_SOURCE_TOKEN:-}" ]; then
-            echo "::error::GH_TOKEN secret is required to fetch electricsheephq/evaos-desktop-bridge for functional smoke."
+            echo "::error::A private bridge source token is required to fetch electricsheephq/evaos-desktop-bridge for functional smoke."
             exit 1
           fi
 
       - name: Build unpacked app only
         shell: bash
         env:
-          EVAOS_DESKTOP_BRIDGE_SOURCE_TOKEN: ${{ secrets.GH_TOKEN }}
-          GH_TOKEN: ${{ secrets.GH_TOKEN }}
+          EVAOS_PACKAGING_PROFILE: functional-smoke
+          EVAOS_DESKTOP_BRIDGE_DISABLE_DEFAULT_CANDIDATES: '1'
+          EVAOS_DESKTOP_BRIDGE_SOURCE_REF: ${{ env.WORKBENCH_SMOKE_BRIDGE_REF }}
+          EVAOS_DESKTOP_BRIDGE_SOURCE_TOKEN: ${{ secrets.EVAOS_DESKTOP_BRIDGE_SOURCE_TOKEN || secrets.GH_TOKEN }}
           NODE_OPTIONS: '--max-old-space-size=8192'
         run: |
           set -euo pipefail
@@ -157,7 +173,25 @@ jobs:
 
           BUNDLE_ID="$(/usr/libexec/PlistBuddy -c 'Print :CFBundleIdentifier' "$APP_PATH/Contents/Info.plist")"
           VERSION="$(/usr/libexec/PlistBuddy -c 'Print :CFBundleShortVersionString' "$APP_PATH/Contents/Info.plist")"
-          BRIDGE_VERSION="$(node -e "const fs=require('fs'); const m=JSON.parse(fs.readFileSync(process.argv[1], 'utf8')); console.log(m.version || m.commit || 'unknown')" "$BRIDGE_MANIFEST")"
+          if ! [[ "$WORKBENCH_SMOKE_BRIDGE_REF" =~ ^[0-9a-fA-F]{40}$ ]]; then
+            echo "::error::Workbench Functional Smoke requires a full 40-character Bridge commit SHA, got: $WORKBENCH_SMOKE_BRIDGE_REF"
+            exit 1
+          fi
+
+          BRIDGE_VERSION="$(node -e "const fs=require('fs'); const m=JSON.parse(fs.readFileSync(process.argv[1], 'utf8')); const commit=m.sourceCommit || m.commit || ''; if (m.placeholder || !/^[0-9a-f]{40}$/i.test(commit)) process.exit(2); console.log(commit)" "$BRIDGE_MANIFEST")" || {
+            echo "::error::Bundled bridge manifest does not record a resolved 40-character source commit."
+            exit 1
+          }
+          BRIDGE_REQUESTED_REF="$(node -e "const fs=require('fs'); const m=JSON.parse(fs.readFileSync(process.argv[1], 'utf8')); console.log(m.requestedSourceRef || '')" "$BRIDGE_MANIFEST")"
+
+          if [ "$BRIDGE_REQUESTED_REF" != "$WORKBENCH_SMOKE_BRIDGE_REF" ]; then
+            echo "::error::Bundled bridge requested ref ($BRIDGE_REQUESTED_REF) does not match workflow input ($WORKBENCH_SMOKE_BRIDGE_REF)"
+            exit 1
+          fi
+          if [ "$BRIDGE_VERSION" != "$WORKBENCH_SMOKE_BRIDGE_REF" ]; then
+            echo "::error::Bundled bridge resolved commit ($BRIDGE_VERSION) does not match workflow input ($WORKBENCH_SMOKE_BRIDGE_REF)"
+            exit 1
+          fi
 
           {
             echo "app_path=$APP_PATH"
@@ -175,9 +209,10 @@ jobs:
             echo "- Version: \`$VERSION\`"
             echo "- Bundle ID: \`$BUNDLE_ID\`"
             echo "- Bridge manifest: \`$BRIDGE_VERSION\`"
+            echo "- Requested bridge ref: \`$WORKBENCH_SMOKE_BRIDGE_REF\`"
             echo
-            echo "This artifact is intentionally unsigned/unnotarized and contains no DMG or release metadata."
-            echo "Use it for functional proof only. Public release still requires the normal signed/notarized gate."
+            echo "Functional Smoke may prove packaged runtime-resource shape and non-TCC functional wiring for the named artifact only."
+            echo "It does not prove release, TCC/permissions, signed identity, Mac-control closure, customer readiness, public updater/feed readiness, or final installed-app behavior."
             echo
             echo "### Size"
             echo '```'

diff --git a/.gitignore b/.gitignore
@@ -204,6 +204,7 @@ docs/superpowers/
 resources/bundled-bun
 resources/bundled-aioncore
 resources/hub
+resources/Bridge
 
 # Server build output
 dist-server/

diff --git a/packages/desktop/electron-builder.yml b/packages/desktop/electron-builder.yml
@@ -133,6 +133,9 @@ nsis:
   differentialPackage: false
 
 mac:
+  extraResources:
+    - from: resources/Bridge
+      to: Bridge
   target:
     - dmg
     - zip