feat(desktop): native one-click installer (Electron + embedded PGlite) + signing CI

[Weegy]

What

A native, no-Docker one-click desktop installer for omadia under desktop/. It's an Electron shell that bundles and supervises the existing middleware kernel and web-ui — no UI or kernel rewrite — plus an embedded Postgres (PGlite) so there's no database to install. First run shows an onboarding wizard (provider key, capabilities, data location, recovery key).

A separate workflow (.github/workflows/desktop-apps.yml) builds + signs installers for macOS / Windows / Linux on a published Release and uploads them as assets.

How it works

Electron main (supervisor)
 ├─ embedded Postgres (PGlite + pgvector + pg_trgm) over the wire protocol, loopback
 ├─ kernel   ← forked from Electron-as-Node, DATABASE_URL → embedded engine, GRAPH_POOL_MAX=1
 ├─ web-ui   ← forked from Electron-as-Node, MIDDLEWARE_URL → fixed kernel port 8769
 ├─ secrets  ← vault key + provider keys via OS keychain (Electron safeStorage)
 └─ tray · auto-update · onboarding wizard

The embedded DB speaks the Postgres wire protocol, so the kernel connects through its normal pg / DATABASE_URL path and runs all existing migrations unchanged.

Kernel seams (small, backward-compatible — no fork)

• GRAPH_POOL_MAX — harness-knowledge-graph-neon caps the shared graphPool (default 5). The embedded engine is single-connection, so the installer sets 1.
• HOST — the kernel listen address (default ::, identical to the prior hard-coded bind). A local install sets 127.0.0.1 (loopback-only).
• pgcrypto — migrations drop CREATE EXTENSION pgcrypto; the only function used was gen_random_uuid(), core since Postgres 13 (PGlite has no pgcrypto module).
• copy-build-assets — mirrors auth / routines / profileStorage / profileSnapshots migrations + builder/prompts into dist, so a plain npm run build (not only the Dockerfile) produces a complete dist.

Signing CI

desktop-apps.yml (matrix macOS/Windows/Linux): build middleware + web-ui → rebuild middleware native modules for Electron's ABI (@electron/rebuild) → stage → electron-builder → upload to the Release. Signing is fail-soft (unsigned artifacts ship without secrets).

• macOS reuses the proven omadia-ui flow (same *_HIGH5 Apple secrets): keychain import before packaging, afterPack signs nested native modules, electron-builder notarizes, notarytool + stapler on the DMG, verify gate rejects ad-hoc.
• Windows Authenticode (optional WINDOWS_CSC_*).

Secrets must be added to this repo's Actions secrets before signed builds work.

Validation

• ✅ Booted end-to-end locally on macOS: embedded DB → kernel (/health 200) → web-ui → admin UI, with the UI proxying to the kernel correctly.
• ✅ Two rounds of adversarial review (Forge / codex) + fixes — incl. the native-module notarization signing path and the embedded-DB single-connection constraint.
• ⚠️ Not yet CI-validated: the cross-platform installer build and macOS notarization have only run locally on macOS. The first signed Release run is the acceptance test for Windows/Linux build + notarization.

Notes for reviewers

• This PR's pull_request CI exercises the middleware build/tests with the four kernel seams above.
• desktop-apps.yml triggers on Release published (+ workflow_dispatch), not on this PR.
• Repo footprint of the new code is ~270 KB (mostly the desktop lockfile); all build artifacts (Electron, bundled runtime, native modules) are produced in CI, never committed.