ci(desktop): keep unsigned verification out of updater signing

.github/workflows/ci.yml

@@ -1193,7 +1193,14 @@ jobs:
 
       - name: Build unsigned desktop app
         working-directory: desktop
-        run: bunx tauri build --ci --bundles app
+        # `createUpdaterArtifacts` is on and the updater public key is committed, so a plain
+        # `tauri build` stops with "A public key has been found, but no private key" unless
+        # TAURI_SIGNING_PRIVATE_KEY is set. This job proves the appex and the app bundle build
+        # and that the widget is embedded; it does not ship an update, and a verification
+        # build has no business holding the release key. Updater artifacts are therefore off
+        # here and the signing path stays in release.yml, which already reads the secret and
+        # refuses to publish a manifest when it is absent.
+        run: bunx tauri build --ci --bundles app --config '{"bundle":{"createUpdaterArtifacts":false}}'
 
       - name: Verify WidgetKit appex and desktop app
         run: |

src/lab/conformance/fixture-provider.ts

@@ -3,9 +3,10 @@ import type { OcxProviderConfig } from "../../types";
 export function fixtureProviderConfig(adapter: string): OcxProviderConfig {
   return {
     adapter,
-    // The Chat fixture intentionally exercises native OpenAI Chat semantics (including
-    // role:"developer" and named single-tool selection). Other fixture adapters remain
-    // loopback-only and never perform network I/O.
+    // The Chat fixture uses the native OpenAI URL for native-only request fields such as named
+    // single-tool selection. It deliberately leaves optional developer-role acceptance
+    // undeclared, so the canonical mapping vector exercises the safe folding default. Other
+    // fixture adapters remain loopback-only and never perform network I/O.
     baseUrl: adapter === "openai-chat" ? "https://api.openai.com/v1" : "http://127.0.0.1:1/v1",
     apiKey: "fixture-key",
     allowPrivateNetwork: true,

src/lab/conformance/fixtures/protocol-v1-cases.json

@@ -119,7 +119,7 @@
       "requirements": { "inboundProtocols": ["openai-responses"], "upstreamProtocols": ["openai-chat"], "surfaces": ["responses-http"], "requiredClaims": [], "requiredHarnessFeatures": ["adapter_vector"], "platforms": [], "routePreconditions": [] },
       "fixture": { "id": "chat-request-mapping", "role": "adapter_vector", "mediaType": "application/vnd.opencodex.adapter-vector+json", "bytesUtf8": "{\"context\":{\"systemPrompt\":[\"SYS\"],\"messages\":[{\"role\":\"developer\",\"content\":\"DEV\",\"timestamp\":0},{\"role\":\"user\",\"content\":\"PING\",\"timestamp\":1}]},\"options\":{\"textFormat\":{\"type\":\"json_object\"}}}", "digest": "0a9c319b3a6dadbf581d0d2185f57527cd28aa57127e0eac91a421735b4c2ad9" },
       "assertions": [
-        { "id": "roles", "operator": "json_path_equals", "selector": "/upstream/requests/0/json/messages", "expected": [{"role":"system","content":"SYS"},{"role":"developer","content":"DEV"},{"role":"user","content":"PING"}], "required": true },
+        { "id": "roles", "operator": "json_path_equals", "selector": "/upstream/requests/0/json/messages", "expected": [{"role":"system","content":"SYS"},{"role":"system","content":"DEV"},{"role":"user","content":"PING"}], "required": true },
         { "id": "format", "operator": "json_path_equals", "selector": "/upstream/requests/0/json/response_format", "expected": {"type":"json_object"}, "required": true }
       ]
     },