sync(desktop): propagate finalized transport into top epic

.env.example

@@ -87,7 +87,7 @@ GITHUB_EVENT_INTAKE_MODE=routing_websocket
 #                             without PROPR_UI_TUNNEL_TOKEN. Redundant when a token
 #                             is set, since a token alone already enables the tunnel
 #   PROPR_INSTANCE_ID       — this stack's instance id; must be a valid DNS label
-#                             (letters, digits, hyphens; 1-63 chars). Derives the
+#                             (letters, digits, hyphens; 1-61 chars). Derives the
 #                             public URL https://t-<id>.propr.dev when no
 #                             explicit URL is set
 #   PROPR_UI_PUBLIC_API_URL — explicit public API URL the hosted UI talks to (overrides the derived one)

.gitattributes

@@ -0,0 +1,2 @@
+# The packaged Darwin ACL helper is hash-pinned; keep its source canonical.
+packages/cli/native/darwin-authority-broker.c text eol=lf

.github/workflows/desktop-connect-discovery-guard.yml

@@ -0,0 +1,131 @@
+name: Packaged Connect Discovery Guard
+
+on:
+  pull_request:
+    paths:
+      - '.github/workflows/desktop-connect-discovery-guard.yml'
+      - 'apps/desktop/**'
+      - 'packages/cli/**'
+      - 'packages/client/**'
+      - 'packages/shared/**'
+      - 'propr-ui/**'
+      - 'package.json'
+      - 'package-lock.json'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: desktop-connect-discovery-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  packaged-connect-discovery:
+    name: Packaged Connect (${{ matrix.target }})
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 45
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - target: darwin-x64
+            runner: macos-15-intel
+            platform: darwin
+            arch: x64
+          - target: darwin-arm64
+            runner: macos-15
+            platform: darwin
+            arch: arm64
+          - target: linux-x64
+            runner: ubuntu-24.04
+            platform: linux
+            arch: x64
+          - target: linux-arm64
+            runner: ubuntu-24.04-arm
+            platform: linux
+            arch: arm64
+          - target: win32-x64
+            runner: windows-2025
+            platform: win32
+            arch: x64
+          - target: win32-arm64
+            runner: windows-11-arm
+            platform: win32
+            arch: arm64
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+
+      - name: Set up target-native Node.js
+        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
+        with:
+          node-version-file: '.nvmrc'
+          architecture: ${{ matrix.arch }}
+          cache: npm
+          cache-dependency-path: package-lock.json
+
+      - name: Verify selected host architecture
+        shell: bash
+        run: |
+          test "$(node -p process.platform)" = "${{ matrix.platform }}"
+          test "$(node -p process.arch)" = "${{ matrix.arch }}"
+
+      - name: Install locked dependencies
+        run: npm ci
+
+      - name: Install native Linux package and credential tools
+        if: matrix.platform == 'linux'
+        run: |
+          sudo apt-get update
+          sudo apt-get install --yes cpio dbus-x11 fakeroot gnome-keyring libsecret-1-0 rpm zip
+
+      - name: Verify encoded Windows PowerShell ACL helper success streams
+        if: matrix.platform == 'win32'
+        run: npm run test:windows-fixture-acl -w @propr/desktop
+
+      - name: Verify Windows packaged launcher authority
+        if: matrix.platform == 'win32'
+        run: node --test apps/desktop/scripts/windows-packaged-connect-staging.test.mjs
+
+      - name: Package the target-native desktop app
+        run: npm run desktop:package
+
+      - name: Inspect the unsigned target-native desktop app
+        run: npm run desktop:smoke:inspect
+
+      - name: Run packaged Linux main-to-renderer discovery
+        if: matrix.platform == 'linux'
+        shell: bash
+        run: |
+          sandbox="apps/desktop/out/propr-desktop-linux-${{ matrix.arch }}/chrome-sandbox"
+          sudo chown root:root "$sandbox"
+          sudo chmod 4755 "$sandbox"
+          test "$(stat -c '%U:%G:%a' "$sandbox")" = 'root:root:4755'
+          keyring_root="$(mktemp -d)"
+          trap 'rm -rf -- "$keyring_root"' EXIT
+          dbus-run-session -- bash -euo pipefail -c '
+            export XDG_DATA_HOME="$1"
+            export PROPR_DESKTOP_SMOKE_KEYRING_ROOT="$1"
+            eval "$(printf "%s\n" "propr-packaged-smoke" | gnome-keyring-daemon --unlock --components=secrets)"
+            xvfb-run --auto-servernum npm run smoke:connect-package -w @propr/desktop
+          ' bash "$keyring_root"
+
+      - name: Run packaged Darwin main-to-renderer discovery
+        if: matrix.platform == 'darwin'
+        shell: bash
+        run: >-
+          node apps/desktop/scripts/run-bounded-darwin-command.mjs
+          --timeout-ms 480000
+          --termination-grace-ms 90000
+          --max-output-bytes 1048576
+          --forward-output true
+          -- bash apps/desktop/scripts/run-packaged-darwin-connect-smoke.sh '${{ matrix.arch }}'
+
+      - name: Run packaged Windows main-to-renderer discovery as an ordinary user
+        if: matrix.platform == 'win32'
+        shell: powershell
+        run: >-
+          & apps/desktop/scripts/run-packaged-windows-connect-smoke.ps1
+          -Architecture '${{ matrix.arch }}'

.github/workflows/desktop-release-guard.yml

@@ -7,7 +7,9 @@ on:
       - 'apps/desktop/**'
       - 'package.json'
       - 'package-lock.json'
+      - 'packages/cli/**'
       - 'packages/client/**'
+      - 'packages/local-setup/**'
       - 'packages/shared/**'
       - 'propr-ui/**'
   push:
@@ -22,6 +24,44 @@ concurrency:
   cancel-in-progress: ${{ github.ref_type != 'tag' }}
 
 jobs:
+  native-windows-durability:
+    name: Native Windows durability (x64)
+    if: github.event_name == 'pull_request'
+    runs-on: windows-latest
+    timeout-minutes: 30
+    env:
+      PROPR_NATIVE_WINDOWS_DURABILITY_REQUIRED: '1'
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+
+      - name: Set up x64 Node.js
+        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
+        with:
+          node-version-file: '.nvmrc'
+          architecture: x64
+          cache: npm
+          cache-dependency-path: package-lock.json
+
+      - name: Install locked dependencies
+        run: npm ci
+
+      - name: Run production Windows child-process durability matrix
+        run: npm run test:native-durability -w @propr/desktop
+
+      - name: Typecheck desktop and renderer on Windows
+        run: npm run desktop:typecheck
+
+      - name: Test desktop runtime on Windows
+        run: npm run desktop:test
+
+      - name: Package Windows x64 desktop app
+        run: npm run desktop:package
+
+      - name: Launch packaged Windows desktop transport smoke
+        run: npm run desktop:smoke
+
   validation-version:
     name: Validate unsigned desktop package version
     if: github.event_name == 'pull_request'
@@ -149,7 +189,7 @@ jobs:
         if: matrix.platform == 'linux'
         run: |
           sudo apt-get update
-          sudo apt-get install --yes cpio fakeroot rpm zip
+          sudo apt-get install --yes cpio dbus-x11 fakeroot gnome-keyring libsecret-1-0 rpm zip
 
       - name: Package desktop app from clean checkout
         shell: bash
@@ -159,6 +199,10 @@ jobs:
           test ! -e apps/desktop/out
           npm run desktop:package
 
+      - name: Run Linux transaction durability parity
+        if: matrix.platform == 'linux'
+        run: npm run test:native-durability -w @propr/desktop
+
       - name: Assert Windows MVP package excludes update authority
         if: matrix.platform == 'win32'
         shell: bash
@@ -221,7 +265,14 @@ jobs:
         run: |
           sudo chown root:root "apps/desktop/out/propr-desktop-linux-${{ matrix.arch }}/chrome-sandbox"
           sudo chmod 4755 "apps/desktop/out/propr-desktop-linux-${{ matrix.arch }}/chrome-sandbox"
-          xvfb-run --auto-servernum npm run desktop:smoke
+          keyring_root="$(mktemp -d)"
+          trap 'rm -rf -- "$keyring_root"' EXIT
+          dbus-run-session -- bash -euo pipefail -c '
+            export XDG_DATA_HOME="$1"
+            export PROPR_DESKTOP_SMOKE_KEYRING_ROOT="$1"
+            eval "$(printf "%s\n" "propr-packaged-smoke" | gnome-keyring-daemon --unlock --components=secrets)"
+            xvfb-run --auto-servernum npm run desktop:smoke
+          ' bash "$keyring_root"
 
       - name: Launch packaged Windows application and exercise MVP desktop flows
         if: matrix.platform == 'win32'
@@ -497,7 +548,7 @@ jobs:
         if: matrix.platform == 'linux'
         run: |
           sudo apt-get update
-          sudo apt-get install --yes cpio fakeroot rpm zip
+          sudo apt-get install --yes cpio dbus-x11 fakeroot gnome-keyring libsecret-1-0 rpm zip
 
       - name: Configure required macOS signing and notarization
         if: matrix.platform == 'darwin'
@@ -683,7 +734,14 @@ jobs:
         run: |
           sudo chown root:root "apps/desktop/out/propr-desktop-linux-${{ matrix.arch }}/chrome-sandbox"
           sudo chmod 4755 "apps/desktop/out/propr-desktop-linux-${{ matrix.arch }}/chrome-sandbox"
-          xvfb-run --auto-servernum npm run desktop:smoke
+          keyring_root="$(mktemp -d)"
+          trap 'rm -rf -- "$keyring_root"' EXIT
+          dbus-run-session -- bash -euo pipefail -c '
+            export XDG_DATA_HOME="$1"
+            export PROPR_DESKTOP_SMOKE_KEYRING_ROOT="$1"
+            eval "$(printf "%s\n" "propr-packaged-smoke" | gnome-keyring-daemon --unlock --components=secrets)"
+            xvfb-run --auto-servernum npm run desktop:smoke
+          ' bash "$keyring_root"
 
       - name: Launch signed packaged Windows application and exercise MVP desktop flows
         if: matrix.platform == 'win32'