Release: start the macOS and Flatpak builds after publishing

.github/workflows/release-flatpak.yml

@@ -5,6 +5,9 @@ name: Flatpak release
 # attached to the published GitHub release with
 # ShadowCode_<version>_flatpak.sha256. Pull requests already build the
 # Flatpak in ci.yml; this runs only for releases.
+# release.yml dispatches this after it publishes (its GITHUB_TOKEN-made
+# release does not trigger `release: published`); a release published by
+# hand still does.
 on:
   release:
     types: [published]

.github/workflows/release-macos.yml

@@ -5,6 +5,9 @@ name: macOS release
 # The images are ad-hoc signed, not notarized: GitHub is the distribution
 # channel. On pull requests that touch macOS packaging this only builds and
 # smoke-tests the app (nothing is uploaded).
+# release.yml dispatches this after it publishes (its GITHUB_TOKEN-made
+# release does not trigger `release: published`); a release published by
+# hand still does.
 on:
   release:
     types: [published]

.github/workflows/release.yml

@@ -254,7 +254,8 @@ jobs:
     timeout-minutes: 30
     permissions:
       contents: write
-      actions: read
+      # actions: write starts the macOS and Flatpak workflows after publishing.
+      actions: write
     steps:
       - name: Checkout independently approved publication tooling and public trust
         uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
@@ -280,6 +281,15 @@ jobs:
         env:
           GH_TOKEN: ${{ github.token }}
         run: node scripts/publish-native-release.mjs "$RUNNER_TEMP/signed-download/x86_64" release/trust "$RUNNER_TEMP/signed-download/aarch64"
+      # A release this job publishes with GITHUB_TOKEN does not trigger other
+      # workflows' `release: published`; a dispatch does. They build from the
+      # tag and attach the macOS images and Flatpak bundles.
+      - name: Start the macOS and Flatpak builds for this release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          gh workflow run release-macos.yml --repo "$GITHUB_REPOSITORY" --ref "$GITHUB_REF_NAME" -f tag="$GITHUB_REF_NAME"
+          gh workflow run release-flatpak.yml --repo "$GITHUB_REPOSITORY" --ref "$GITHUB_REF_NAME" -f tag="$GITHUB_REF_NAME"
   # Signed APT repository on GitHub Pages (gh-pages branch, path apt/). Only
   # the .deb that passed publisher authentication is indexed; the repository
   # signing key is a separate OpenPGP key held in the protected environment.

docs/FLAGSHIP_IMPLEMENTATION.md

@@ -4,7 +4,7 @@ Goal: a dependable, easy-to-use native workspace combining supported vendor logi
 
 Baseline: `e371baaa4c690527173a322f7e0e1cfae4db329a`. Implementation branch: `flagship/reliability-foundation`. Preserve the existing architecture and provider integrations. The complete [acceptance specification](FLAGSHIP_ACCEPTANCE_SPEC.md) remains in scope; this ledger is not a narrowed definition of completion.
 
-Current release checkpoint (October 11, 2026): **2.1.0 is published and installed** ([run 38169859337](https://github.com/ShadowfetchStudio/ShadowCode/actions/runs/38169859337), attempt 3: all 15 gates on x86_64 and aarch64, signing, publication and the signed APT repository passed from `a32c2af`; installed here with the authenticated installer, first-window check passed). Earlier pending statements below describe their historical checkpoints. Broader physical desktop, GPU endurance and live provider lifecycle acceptance remain open.
+Current release checkpoint (October 17, 2026): **2.2.0 is published and installed** ([run 39059462934](https://github.com/ShadowfetchStudio/ShadowCode/actions/runs/39059462934), attempt 1: all 15 gates on x86_64 and aarch64, signing, publication and the signed APT repository passed from `444e75f`; macOS `.dmg` for Apple silicon and Intel and the Flatpak bundles attached by their release workflows; installed here with the authenticated installer, first-window check passed). Earlier pending statements below describe their historical checkpoints. Broader physical desktop, GPU endurance and live provider lifecycle acceptance remain open.
 
 ## 1.0.1 window fix
 

docs/MACOS_PORT_ESTIMATE.md

@@ -1,6 +1,6 @@
 # macOS port: build estimate
 
-Status: ShadowCode builds, installs and runs as a macOS app and is released on GitHub (see Progress). The estimate below is the original one. Figures are judgement from a source survey
+Status: released. ShadowCode 2.2.0 (October 17, 2026) is the first release with macOS disk images for Apple silicon and Intel (see Progress). The estimate below is the original one. Figures are judgement from a source survey
 (~135k lines of Rust in `native/core` and `src-tauri`), not measurements.
 
 ## Summary

docs/RELEASE_AUTHENTICATION.md

@@ -4,7 +4,11 @@ The helpers in `scripts/native-release-auth.mjs` and `scripts/verify-native-rele
 
 The Bash verifier loads `scripts/native-release-auth-lib.sh` from its own script directory. Keep both reviewed code files together in the trusted tooling bundle; do not obtain the library from the candidate download or source metadata as shell code. The installer uses the same reviewed routines for current candidates and signed historical receipts; it never sources release metadata as code.
 
-## Published release: 2.1.0
+## Published release: 2.2.0
+
+[Version 2.2.0](https://github.com/ShadowfetchStudio/ShadowCode/releases/tag/v2.2.0) was published on October 17, 2026 from `444e75f13c3512d57c226b39d6edf59fdb08a4c6` by [run 39059462934](https://github.com/ShadowfetchStudio/ShadowCode/actions/runs/39059462934) (attempt 1), for x86_64 and aarch64. Before approving the signing review, all 15 receipts of each target were checked: passed for that commit, run and attempt, no required skips, exit status 0, script digests matching the tagged gate definitions for that architecture, and artifact hashes matching the handoff files. The published packages are byte-identical to the verified handoff; the authenticated installer installed it over 2.1.0 on the release machine and its first-window check passed. The APT repository lists 2.2.0 for amd64 and arm64 and verifies with `gpgv` against the key recorded in `release/trust/APT-SIGNING-KEY`. The macOS disk images and Flatpak bundles were then built from the tag by `release-macos.yml` and `release-flatpak.yml` and attached with their SHA-256 files; they are not covered by the publisher signature. Those two workflows had to be started by hand for 2.2.0 (a release published with `GITHUB_TOKEN` does not trigger them); from the next release the publish job dispatches them.
+
+## Earlier published release: 2.1.0
 
 [Version 2.1.0](https://github.com/ShadowfetchStudio/ShadowCode/releases/tag/v2.1.0) was published on October 11, 2026 from `a32c2af917b30d7104c4d12aa6a343e73dabb4f6` by [run 38169859337](https://github.com/ShadowfetchStudio/ShadowCode/actions/runs/38169859337) (attempt 3), for x86_64 and, for the first time, aarch64. Before approving the signing review, all 15 receipts of each target were checked: passed for that commit, run and attempt, no required skips, and script digests matching the tagged gate definitions for that architecture. All four packages verify with `verify-native-release.sh` against the tracked trust bundle; the authenticated installer installed it over the existing copy on the release machine, and its new first-window check passed. The APT repository at `https://shadowfetchstudio.github.io/ShadowCode/apt` is signed by the key recorded in `release/trust/APT-SIGNING-KEY` and verifies with `gpgv`.
 

docs/RELEASING.md

@@ -1,6 +1,6 @@
 # Release procedure
 
-The most recent documented release is [**2.1.0**](https://github.com/ShadowfetchStudio/ShadowCode/releases/tag/v2.1.0), published on October 11, 2026 from `a32c2af` by [run 38169859337](https://github.com/ShadowfetchStudio/ShadowCode/actions/runs/38169859337) (attempt 3) with all 15 gates on both x86_64 and aarch64, protected signing, publication and the signed APT repository passing. Attempt 1 stopped when one aarch64 unit test (a stale-socket check in `native/core/src/control.rs`) failed once on the hosted ARM runner; it passes in CI. Re-running only the failed job would have mixed attempts, which signing refuses, so the whole run was re-run and the `v2.1.0` tag was not moved. Updating version files or
+The most recent documented release is [**2.2.0**](https://github.com/ShadowfetchStudio/ShadowCode/releases/tag/v2.2.0), published on October 17, 2026 from `444e75f` by [run 39059462934](https://github.com/ShadowfetchStudio/ShadowCode/actions/runs/39059462934) (attempt 1) with all 15 gates on both x86_64 and aarch64, protected signing, publication and the signed APT repository passing. The macOS disk images (Apple silicon and Intel) and the Flatpak bundles were attached afterwards by `release-macos.yml` and `release-flatpak.yml`, dispatched by hand because a release published with `GITHUB_TOKEN` does not trigger other workflows; `release.yml` now dispatches them itself. Before it, [**2.1.0**](https://github.com/ShadowfetchStudio/ShadowCode/releases/tag/v2.1.0), published on October 11, 2026 from `a32c2af` by [run 38169859337](https://github.com/ShadowfetchStudio/ShadowCode/actions/runs/38169859337) (attempt 3). Updating version files or
 these instructions does not publish or sign a release. Bind final build, test
 and authentication receipts to the exact candidate before publication.
 

scripts/test-native-release-signing.mjs

@@ -140,6 +140,10 @@ test('release workflow separates untrusted build from protected signing and writ
   assert.match(publication, /artifact-ids: \$\{\{ needs.sign.outputs.artifact-id \}\}/);
   assert.match(publication, /needs: \[configuration, build, sign\]/); assert.match(publication, /contents: write/);
   assert(!/SIGNING_KEY|secrets\./.test(publication));
+  // After publishing, the macOS images and Flatpak bundles are built from the tag.
+  assert.match(publication, /actions: write/);
+  assert.match(publication, /gh workflow run release-macos\.yml [^\n]*-f tag="\$GITHUB_REF_NAME"/);
+  assert.match(publication, /gh workflow run release-flatpak\.yml [^\n]*-f tag="\$GITHUB_REF_NAME"/);
   assert.equal([...workflow.matchAll(/secrets\.NATIVE_RELEASE_SIGNING_KEY_PEM/g)].length, 1);
   assert.match(apt, /needs: \[configuration, sign, publish\]/); assert.match(apt, /environment: \$\{\{ needs.configuration.outputs.environment \}\}/);
   assert.match(apt, /artifact-ids: \$\{\{ needs.sign.outputs.artifact-id \}\}/);