feat(storage): add durable managed dependency artifact authority

.github/workflows/ci.yml

@@ -223,90 +223,36 @@ jobs:
           require_lane "Runtime Host tests" "$RUNTIME_HOST_SELECTED" "$RUNTIME_HOST_RESULT"
           require_lane "Headless tests" "$HEADLESS_SELECTED" "$HEADLESS_RESULT"
 
-  e2e_shard:
+  # One Electron job: install once, run the (now small) e2e suite, then the
+  # CDP alignment audit against the same built renderer. Dual shards plus a
+  # separate audit job each paid full npm ci + cold build after the suite
+  # slash; that was pure wall-clock and runner waste.
+  e2e:
     needs: changes
     if: needs.changes.outputs.e2e == 'true'
-    name: e2e_shard (${{ matrix.shard }}/2)
     runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        shard: [1, 2]
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: '24'
           cache: npm
-      - run: npm ci
-      # Each shard keeps one Playwright worker on its own runner and X display.
-      # This overlaps independent Electron cold starts without reintroducing
-      # the OS-focus races observed with multiple workers on one display.
-      - name: Ensure xvfb
-        run: command -v xvfb-run >/dev/null 2>&1 || { sudo apt-get update && sudo apt-get install -y xvfb; }
-      - name: E2E shard ${{ matrix.shard }}/2
-        run: xvfb-run -a npm --workspace @maka/desktop run e2e -- --shard=${{ matrix.shard }}/2
-
-  # Design governance: the CDP alignment auditor walks the e2e-fixture fixtures
-  # and fails on same-type height mismatches, mixed-type centerline drift, or
-  # radius-family splits. It shares the e2e selection gate and the built
-  # renderer, but not the suite's critical path: it has no data dependency on
-  # Playwright, and riding shard 1 made that shard ~51s longer than shard 2 for
-  # work the shard did not need. Its own runner pays one extra checkout and
-  # build in exchange for balanced shards.
-  alignment_audit:
-    needs: changes
-    if: needs.changes.outputs.e2e == 'true'
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - name: Restore Electron artifact cache
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
-          node-version: '24'
-          cache: npm
+          path: ~/.cache/electron
+          key: electron-${{ runner.os }}-${{ hashFiles('package-lock.json') }}
+          restore-keys: electron-${{ runner.os }}-
       - run: npm ci
       - name: Ensure xvfb
         run: command -v xvfb-run >/dev/null 2>&1 || { sudo apt-get update && sudo apt-get install -y xvfb; }
-      - name: Build renderer
-        run: npm --workspace @maka/desktop run build:with-deps
+      - name: Desktop e2e
+        run: xvfb-run -a npm --workspace @maka/desktop run e2e
       - name: Alignment audit
         run: xvfb-run -a node scripts/audit-alignment.mjs
-
-  # Preserve the existing required check while every selected shard retains
-  # its own failure and diagnostic output. The audit lane joins the same gate
-  # so splitting it out does not drop it from the required check.
-  e2e:
-    needs: [changes, e2e_shard, alignment_audit]
-    if: always()
-    runs-on: ubuntu-latest
-    steps:
-      - name: Require successful E2E shards
-        env:
-          CHANGES_RESULT: ${{ needs.changes.result }}
-          E2E_SELECTED: ${{ needs.changes.outputs.e2e }}
-          SHARDS_RESULT: ${{ needs.e2e_shard.result }}
-          AUDIT_RESULT: ${{ needs.alignment_audit.result }}
-        run: |
-          if [[ "$CHANGES_RESULT" != "success" ]]; then
-            echo "changes failed: $CHANGES_RESULT" >&2
-            exit 1
-          fi
-          expected="skipped"
-          if [[ "$E2E_SELECTED" == "true" ]]; then
-            expected="success"
-          fi
-          if [[ "$SHARDS_RESULT" != "$expected" ]]; then
-            echo "E2E shards expected $expected but were $SHARDS_RESULT" >&2
-            exit 1
-          fi
-          if [[ "$AUDIT_RESULT" != "$expected" ]]; then
-            echo "Alignment audit expected $expected but was $AUDIT_RESULT" >&2
-            exit 1
-          fi
-
-  # Storybook build + render smoke. Independent of Electron e2e: the smoke
-  # launches Playwright Chromium, not `_electron.launch`, so it does not
-  # need xvfb or the desktop cold-start suite. See stories/FIDELITY.md.
+  # Storybook build + initial render smoke. Embedded mode disables every play
+  # function, so this lane never duplicates desktop interaction or layout E2E.
+  # It launches Chromium only to catch catalog runtime errors. See FIDELITY.md.
   storybook:
     needs: changes
     if: needs.changes.outputs.storybook == 'true'

.github/workflows/windows-baseline.yml

@@ -15,7 +15,31 @@ permissions:
   contents: read
 
 jobs:
+  changes:
+    runs-on: ubuntu-latest
+    outputs:
+      windows: ${{ steps.plan.outputs.windows }}
+      windows_runtime: ${{ steps.plan.outputs.windows_runtime }}
+      windows_storage: ${{ steps.plan.outputs.windows_storage }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+      - id: plan
+        name: Select affected Windows surfaces
+        env:
+          BASE_SHA: ${{ github.event_name == 'push' && github.event.before || github.event.pull_request.base.sha }}
+          HEAD_SHA: ${{ github.event_name == 'push' && github.sha || github.event.pull_request.head.sha }}
+        run: |
+          if [[ "$BASE_SHA" =~ ^0+$ ]] || ! git cat-file -e "${BASE_SHA}^{commit}"; then
+            node scripts/ci-test-plan.mjs --full >> "$GITHUB_OUTPUT"
+          else
+            node scripts/ci-test-plan.mjs --base "$BASE_SHA" --head "$HEAD_SHA" >> "$GITHUB_OUTPUT"
+          fi
+
   windows_baseline:
+    needs: changes
+    if: needs.changes.outputs.windows == 'true'
     name: windows_baseline (non-blocking)
     runs-on: windows-latest
     timeout-minutes: 45
@@ -101,18 +125,22 @@ jobs:
 
       - id: smoke
         name: Run CLI and Electron startup smoke
-        if: always() && steps.install.outcome == 'success'
+        if: always() && steps.build.outcome == 'success'
         continue-on-error: true
         shell: pwsh
         run: |
-          npm.cmd run smoke:windows *> "$env:WINDOWS_BASELINE_LOG_DIR/smoke.log"
+          npm.cmd --workspace @maka/desktop run build:smoke *> "$env:WINDOWS_BASELINE_LOG_DIR/smoke-build.log"
+          $exitCode = $LASTEXITCODE
+          Get-Content "$env:WINDOWS_BASELINE_LOG_DIR/smoke-build.log"
+          if ($exitCode -ne 0) { exit $exitCode }
+          npm.cmd run smoke:windows:dist *> "$env:WINDOWS_BASELINE_LOG_DIR/smoke.log"
           $exitCode = $LASTEXITCODE
           Get-Content "$env:WINDOWS_BASELINE_LOG_DIR/smoke.log"
           exit $exitCode
 
       - id: runtime_pty_input
         name: Run Runtime PTY input gates
-        if: always() && steps.build.outcome == 'success'
+        if: always() && steps.build.outcome == 'success' && needs.changes.outputs.windows_runtime == 'true'
         continue-on-error: true
         timeout-minutes: 5
         shell: pwsh
@@ -129,7 +157,7 @@ jobs:
 
       - id: storage
         name: Capture storage test baseline
-        if: always() && steps.build.outcome == 'success'
+        if: always() && steps.build.outcome == 'success' && needs.changes.outputs.windows_storage == 'true'
         continue-on-error: true
         shell: pwsh
         run: |
@@ -140,7 +168,7 @@ jobs:
 
       - id: managed_workspace_crash
         name: Run managed workspace crash recovery gates
-        if: always() && steps.build.outcome == 'success'
+        if: always() && steps.build.outcome == 'success' && needs.changes.outputs.windows_storage == 'true'
         continue-on-error: true
         shell: pwsh
         run: |

CHANGELOG.md

@@ -2,6 +2,53 @@
 
 ## Unreleased
 
+## 0.1.9 - 2026-08-09
+
+### Highlights
+
+- Completed the Runtime Host M5 production cutover (#2420), then established
+  the local standalone service (#2583), authenticated WebSocket access
+  (#2591), and Host-owned project catalog authority (#2603).
+- Added external session import end to end: the shared foundation (#2500), a
+  Codex session adapter (#2502), and the Desktop import flow (#2507).
+- Shipped Visual System 2.0 from its foundations through the full theme sweep
+  and detail polish (#2525, #2536, #2538), aligned high-traffic chrome with
+  Astryx primitives (#2580), and closed the remaining elevation, rhythm, and
+  primitive review debt (#2593).
+- Made task submission readiness a shared product contract (#2498), exposed it
+  in Desktop (#2519), added CLI preflight (#2524), and consumed the readiness
+  result at submission time (#2523).
+- Expanded implementation-agent capabilities with portable terminal input
+  (#2526), semantic terminal mouse input (#2533), interactive shell controls
+  (#2561), and OpenAI native ApplyPatch (#2532).
+- Replaced the CodeMode `Self` evaluator with QuickJS (#2549).
+
+### Reliability and developer experience
+
+- Runtime recovery now handles idle and incomplete provider streams (#2535,
+  #2604), preserves compaction projection after overflow (#2602), retains
+  imported session context (#2579), and keeps full access available in Plan
+  mode (#2581).
+- Stabilized Runtime Host session lifecycle races (#2548), added client request
+  backpressure (#2539), made task refusals actionable (#2527), recovered CLI
+  sessions after workspace moves (#2531), and kept renamed Claude model ids
+  stable across catalog refreshes (#2482).
+- Matured the generated-files workbar (#2506), kept generated files under user
+  control (#2585), restored composer drafts across remounts (#2584), exposed
+  diagnostics from error toasts (#2540), and added per-connection model request
+  customization (#2565).
+- Cut CI wall-clock time with impact gates and a single end-to-end job (#2589),
+  reduced Storybook to render smoke (#2582), and expanded Windows process,
+  named-pipe, artifact, workspace, and crash-recovery coverage.
+
+### Distribution
+
+- Ships for Apple Silicon macOS as a signed and notarized DMG and ZIP, and for
+  Windows x64 as an unsigned NSIS installer and ZIP, built and verified in the
+  same release run.
+- The bundled Computer Use skill ships with the app, but the Computer Use
+  executor remains excluded from this release.
+
 ## 0.1.8 - 2026-08-08
 
 ### Highlights