Add the package verifier and run it before release builds

[BunsDev]

Refs #356. This does the verifier part of the issue and encodes its decisions. It does not close the issue, because the signing secrets are still needed (decision 4).

What #356 asks

scripts/verify-package.mjs, wired into release.yml before the platform builds.

Decisions (made 2026-09-26, recorded on #356)

1. Window minimum: 480×520, the implemented and documented contract. The Phase 7 plan's 820×600 is superseded.
2. Deep-link protocol: deferred past v0.0.1. Nothing handles incoming links yet.
3. Updater: off for v0.0.1, as docs/releasing.md § 4 already documents.

What the verifier enforces

• Product name OpenCoven Chat and identifier ai.opencoven.chat.
• One window, main, with a 1180×780 default and a 480×520 minimum; withGlobalTauri: false.
• A strict CSP. default-src and script-src are 'self', and object-src, base-uri, form-action and frame-ancestors are 'none'. No unsafe-eval, *, http: or https: source is allowed. connect-src is required and holds only 'self', ipc: and http://ipc.localhost. Repeated directives are rejected.
• bundle.active, the six installer targets, and the five declared icons, which must exist on disk.
• The capability files: only the reviewed default.json may exist. It must grant exactly the reviewed allowlist to main, with no remote origins and no shell, fs, opener, http, process, os or dialog permission.
• No tauri-plugin-shell, -fs, -http, -opener or -process in Cargo.toml.
• The v0.0.1 decisions: createUpdaterArtifacts: false with no updater config or crate, and no deep-link config or crate. A release that enables either changes that decision in the same change that configures it.

Wiring and docs

• release.yml, verify-tag job: runs after checkout and before the tag check, so before every platform build, on rehearsal and production paths. release-workflow.test.ts pins the step and its position.
• docs/releasing.md § 1: the checklist says what it enforces.

Remaining on #356

Decision 4: the Apple Developer ID and notarization credentials and the Windows code-signing certificate in the release-signing environment, which holds no secrets today. Then push a signed v0.0.1 (or -rc.N) tag.

Verification

• src/verify-package.test.ts, 23 tests. The real configuration passes. Each mutation below fails:
  • product name, identifier, minimum window, a second window, and global Tauri;
  • unsafe-eval, a network origin, a repeated connect-src, and a missing connect-src;
  • a dropped installer target and a missing icon file;
  • a shell permission, an unreviewed core permission, a remote origin, and an extra capability file;
  • a filesystem plugin;
  • updater artifacts, an updater config, and the updater crate;
  • a deep-link scheme and the deep-link crate.
• release-workflow.test.ts pins the step's position. Biome and typecheck are clean.
• Pushed over SSH, as the change touches .github/workflows.

🤖 Generated with Claude Code

[Copilot]

Copilot review overview

🟡 Changes recommended

Unresolved verifier correctness, capability coverage, documentation, and workflow-test issues remain.

Review effort: Lite
Findings: 2 · 3

Open (5)

• Reject duplicate CSP directives · New
• Validate all Tauri capability files · New
• Add release test for verifier command and ordering · New
• Fail verification when connect-src is missing · New
• Validate deep-link scheme in exact plugin configuration · New

What changed in this PR

Adds a Tauri package-contract verifier, tests, release workflow integration, and documentation for pre-build validation.

Changes:

• Validates configuration, CSP, capabilities, icons, targets, and plugins.
• Reports updater and deep-link decisions as pending.
• Adds mutation tests and runs verification before release builds.
• Documents local verification and release checks.

File	Reviewed changes	Findings
src/​verify-package.test.ts	Adds verifier mutation tests.	No findings.
scripts/​verify-package.mjs	Implements package-contract validation.	Unresolved CSP duplicate handling, missing connect-src, deep-link validation, and incomplete capability-file coverage.
docs/​releasing.md	Documents verification and release requirements.	Updater checklist requirements contradict the documented opt-in state.
.github/​workflows/​release.yml	Runs verification before release builds.	Workflow tests do not assert the verifier step or its ordering.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[BunsDev]

The release owner's decisions on #356 are now recorded there. One affects this PR. The opencoven-chat deep-link protocol is deferred past v0.0.1, so --release should no longer fail on it. Only the updater (decision 3) stays pending, and it waits for the keypair. The 480×520 minimum is confirmed as the contract. I have not touched this branch.