Qwen desktop alpha with resource controls and verified installers

.github/workflows/desktop.yaml

@@ -10,6 +10,11 @@ on:
       - "src/**"
       - "scripts/build_hivemind_windows.py"
       - "scripts/hivemind-win32.patch"
+      - "scripts/gate13_linux_packaged_lifecycle.py"
+      - "scripts/gateq38_linux_host_runtime.py"
+      - "tests/test_runtime_archive_hardlinks.py"
+      - "tests/test_windows_download_helper.py"
+      - "tests/test_windows_online_integration.py"
       - "docs/REVIVAL.md"
       - "docs/REVIVAL_TEST_RESULTS.md"
   workflow_dispatch:
@@ -21,7 +26,7 @@ jobs:
       matrix:
         # Public-alpha packaging is Windows/Linux only; macOS is explicitly deferred.
         include:
-          - os: ubuntu-latest
+          - os: ubuntu-22.04
             platform: linux
             install_archive: communityai-desktop-linux.tar.gz
           - os: windows-latest
@@ -49,7 +54,10 @@ jobs:
         if: runner.os == 'Linux'
         run: |
           sudo apt-get update
-          sudo apt-get install --no-install-recommends --yes libdbus-1-3 libegl1 libgl1 libxkbcommon0
+          sudo apt-get install --no-install-recommends --yes \
+            libdbus-1-3 libegl1 libgl1 libglib2.0-0 libfontconfig1 libfreetype6 \
+            libxkbcommon0 libxkbcommon-x11-0 libxcb-cursor0 libxcb-icccm4 \
+            libxcb-image0 libxcb-keysyms1 libxcb-render-util0 libxcb-shape0 libwayland-cursor0 xvfb xauth
       - name: Build patched Windows Hivemind runtime
         if: runner.os == 'Windows'
         run: |
@@ -58,8 +66,7 @@ jobs:
           $wheel = Get-ChildItem ../dist/hivemind-1.1.12-*-win_amd64.whl | Select-Object -Last 1
           if (-not $wheel) { throw "Hivemind wheel build produced no artifact" }
           python -m pip install $wheel.FullName
-      - name: Install qualified Windows CUDA runtime
-        if: runner.os == 'Windows'
+      - name: Install qualified CUDA runtime
         run: >-
           python -m pip install
           --index-url https://download.pytorch.org/whl/cu124
@@ -68,35 +75,115 @@ jobs:
         run: |
           python -m pip install -e "..[api]"
           python -m pip install -e ".[dev]"
-      - name: Verify qualified Windows CUDA runtime
-        if: runner.os == 'Windows'
+      - name: Verify qualified CUDA runtime
         run: python -c "import torch; assert torch.__version__ == '2.6.0+cu124'"
       - name: Run protocol and runtime-boundary tests
         working-directory: .
         run: |
           python -m unittest discover -s desktop/tests -v
           communityai-desktop --self-test
+      - name: Verify normalized archive consumers
+        working-directory: .
+        run: python -m unittest discover -s tests -p test_runtime_archive_hardlinks.py -v
+      - name: Verify Linux installer process ownership as package-maintenance user
+        if: runner.os == 'Linux'
+        working-directory: .
+        run: sudo "$(command -v python)" -m unittest discover -s desktop/tests -p test_installers.py -v
       - name: Reverify qualified CUDA runtime before bundling
         run: python -c "import torch; assert torch.__version__ == '2.6.0+cu124'"
       - name: Build and smoke unsigned public-alpha bundle
         run: >-
           python build_desktop.py
-          --publication-bundle ../public-alpha/catalog-v1
+          --publication-bundle ../public-alpha/catalog-qwen-v2
           --source-commit "${{ github.sha }}"
           --build-workflow "${{ github.workflow_ref }}"
       - name: Independently verify release checksums and expected provenance
         run: >-
           python build_desktop.py
           --verify-release-output dist/desktop
-          --publication-bundle ../public-alpha/catalog-v1
+          --publication-bundle ../public-alpha/catalog-qwen-v2
           --source-commit "${{ github.sha }}"
           --build-workflow "${{ github.workflow_ref }}"
           --verify-build-environment
+      - name: Exercise frozen native CPU runtime without model downloads
+        run: ./dist/desktop/CommunityAI/node/CommunityAI-Node --native-self-test
+      - name: Exercise frozen desktop through X11
+        if: runner.os == 'Linux'
+        env:
+          QT_QPA_PLATFORM: xcb
+        run: |
+          xvfb-run --auto-servernum dist/desktop/CommunityAI/CommunityAI --ui-self-test
+          xvfb-run --auto-servernum dist/desktop/CommunityAI/CommunityAI --onboarding-ui-self-test
       - name: Exercise packaged node, native credentials, and public seed
         if: runner.os == 'Windows'
         run: >-
           python ../scripts/smoke_desktop_managed_node.py
           --node-command dist/desktop/CommunityAI/node/CommunityAI-Node.exe
+      - name: Build unsigned Windows engineering installer
+        if: runner.os == 'Windows'
+        shell: pwsh
+        run: |
+          $innoInstaller = Join-Path $env:RUNNER_TEMP 'innosetup-6.7.3.exe'
+          $innoDirectory = Join-Path $env:RUNNER_TEMP 'inno-compiler'
+          Invoke-WebRequest -Uri 'https://github.com/jrsoftware/issrc/releases/download/is-6_7_3/innosetup-6.7.3.exe' -OutFile $innoInstaller
+          $signature = Get-AuthenticodeSignature -LiteralPath $innoInstaller
+          if ($signature.Status -ne 'Valid' -or $signature.SignerCertificate.Subject -notmatch 'Pyrsys') {
+            throw 'Unexpected Inno Setup publisher signature'
+          }
+          $process = Start-Process -FilePath $innoInstaller -ArgumentList @('/VERYSILENT','/SUPPRESSMSGBOXES','/NORESTART','/CURRENTUSER','/NOICONS',"/DIR=$innoDirectory") -WindowStyle Hidden -Wait -PassThru
+          if ($process.ExitCode -ne 0) { throw 'Inno Setup compiler installation failed' }
+          ./installers/build_windows_installer.ps1 -Bundle dist/desktop/CommunityAI -OutputDirectory dist/installers -Version '0.1.0-alpha.${{ github.run_number }}' -Compiler (Join-Path $innoDirectory 'ISCC.exe') -UnsignedEngineering
+      - name: Compile online downloader with inert fixture metadata
+        if: runner.os == 'Windows'
+        shell: pwsh
+        run: |
+          # Compile the Pascal boundary without publishing or running a downloader.
+          # This intentionally unreachable fixture is kept outside uploaded artifacts.
+          $fixtureDirectory = Join-Path $env:RUNNER_TEMP 'communityai-online-compile-fixture'
+          New-Item -ItemType Directory -Path $fixtureDirectory -Force | Out-Null
+          $fixtureManifest = Join-Path $fixtureDirectory 'release-downloads.json'
+          @{
+            schema_version = 1
+            artifacts = @{
+              'windows-x64' = @{
+                platform = 'windows-x64'
+                kind = 'offline-installer'
+                format = 'exe'
+                version = '0.0.0-test'
+                filename = 'communityai-0.0.0-test-windows-setup.exe'
+                url = 'https://example.invalid/releases/0.0.0-test/communityai-0.0.0-test-windows-setup.exe'
+                sha256 = ('a' * 64)
+                size_bytes = 2519046440
+              }
+            }
+          } | ConvertTo-Json -Depth 10 | Set-Content -LiteralPath $fixtureManifest -Encoding utf8
+          ./installers/build_windows_online_installer.ps1 -Manifest $fixtureManifest -OutputDirectory (Join-Path $fixtureDirectory 'output') -Compiler (Join-Path $env:RUNNER_TEMP 'inno-compiler/ISCC.exe') -UnsignedAlpha
+      - name: Verify resumable Windows downloader and owned setup handoff
+        if: runner.os == 'Windows'
+        working-directory: .
+        shell: pwsh
+        run: |
+          $env:COMMUNITYAI_INNO_COMPILER = Join-Path $env:RUNNER_TEMP 'inno-compiler/ISCC.exe'
+          python -m unittest discover -s tests -p test_windows_download_helper.py -v
+          if ($LASTEXITCODE -ne 0) { throw 'Resumable downloader tests failed' }
+          python -m unittest discover -s tests -p test_windows_online_integration.py -v
+          if ($LASTEXITCODE -ne 0) { throw 'Online setup integration tests failed' }
+      - name: Build Debian engineering package
+        if: runner.os == 'Linux'
+        run: >-
+          python installers/build_deb.py
+          --bundle dist/desktop/CommunityAI
+          --output dist/installers
+          --version '0.1.0~alpha.${{ github.run_number }}'
+          --maintainer 'CommunityAI engineering <engineering@example.invalid>'
+      - name: Upload engineering setup artifacts
+        uses: actions/upload-artifact@v6
+        with:
+          name: communityai-setup-${{ matrix.platform }}
+          path: desktop/dist/installers/*
+          if-no-files-found: error
+          compression-level: 0
+          retention-days: 7
       - name: Upload self-contained install archive
         uses: actions/upload-artifact@v6
         with:

.github/workflows/run-tests.yaml

@@ -55,21 +55,34 @@ jobs:
             tests/test_api_keys.py \
             tests/test_cache.py \
             tests/test_catalog_bootstrap.py \
+            tests/test_catalog_desktop_cleanup.py \
             tests/test_catalog_publication.py \
+            tests/test_catalog_refresh.py \
             desktop/tests/test_build_desktop.py \
+            desktop/tests/test_native_runtime_self_test.py \
+            desktop/tests/test_release_downloads.py \
+            desktop/tests/test_runtime_packaging.py \
             desktop/tests/test_startup.py \
+            desktop/tests/test_windows_online_installer.py \
             tests/test_deepseek_v3.py \
             tests/test_discovery.py \
             tests/test_edge_benchmark.py \
             tests/test_external_qualification.py \
             tests/test_device_portability.py \
+            tests/test_gate16_catalog_channel.py \
+            tests/test_gate16_catalog_drill.py \
             tests/test_gemma4_block.py \
             tests/test_gemma4_multimodal_loading.py \
             tests/test_gemma4_unified.py \
             tests/test_inference_recovery.py \
             tests/test_join_token.py \
             tests/test_kv_cache_strategy.py \
             tests/test_loading_diagnostics.py \
+            tests/test_linux_online_installer.py \
+            tests/test_login_startup_linux.py \
+            tests/test_login_startup_windows_cycle.py \
+            tests/test_login_startup_windows_safety.py \
+            tests/test_login_startup_windows_state.py \
             tests/test_model_catalog.py \
             tests/test_model_manager.py \
             tests/test_model_manifest.py \
@@ -87,9 +100,11 @@ jobs:
             tests/test_qualification_matrix.py \
             tests/test_qualification_cost_guard.py \
             tests/test_qualification_image_contract.py \
+            tests/test_qualify_catalog_desktop.py \
             tests/test_qwen3_5_block.py \
             tests/test_qwen3_5_multimodal_loading.py \
             tests/test_route_health.py \
+            tests/test_runtime_archive_hardlinks.py \
             tests/test_server_registry.py \
             tests/test_startup_guard.py \
             tests/test_tied_embeddings_from_pretrained.py \
@@ -102,7 +117,10 @@ jobs:
           # Atomic config exchange and shared admission are Windows/Linux public-alpha contracts.
           # The production desktop workflow separately exercises the packaged Windows node.
           # macOS remains outside the supported release matrix.
+          # Gate 16 additionally uses actual loopback-only TLS p2pd and the real handler,
+          # with no model allocation, external peers or public route mutation.
           python -m pytest -v --durations=0 --durations-min=1.0 \
+            tests/test_gate16_live_rpc.py \
             tests/test_policy_store.py \
             tests/test_server_admission.py
 

.gitignore

@@ -132,3 +132,6 @@ dmypy.json
 
 .idea/
 /.gate*
+
+# Owner-requested local emergency publisher backup; never commit key material.
+/.publisher-secrets/