Document the Windows-first release trust programme

[Chris0Jeky]

Summary

• reconcile the live v0.1.2 Windows release, current release workflow, signing/distribution backlog, private-cloud boundary, and stale tracker facts
• add the active Windows-first release-trust programme and a sanitized external-services register
• update the masterplan, ops index, and human-action ledger with the capped [Release][Decision] Select the Windows publisher identity, canonical domain, and signing route #2148–[Release][Supply chain] Publish SBOMs, artifact attestations, and verification instructions #2152 dependency chain
• preserve ADR-0061's one-instance/one-SQLite-volume private boundary and explicitly reject a public SaaS plan
• record dated cost/timeline inputs without claiming any legal, account, purchase, benefit, credential, or subjective acceptance action

No product behavior, workflow, release asset, environment setting, or shipped-state claim changes in this PR.

Verification

• dotnet test backend/Taskdeck.sln -c Release — not run; documentation-only slice
• Push-Location frontend/taskdeck-web; npm run typecheck; if ($LASTEXITCODE -ne 0) { Pop-Location; exit $LASTEXITCODE }; npm run build; if ($LASTEXITCODE -ne 0) { Pop-Location; exit $LASTEXITCODE }; npx vitest --run; $code = $LASTEXITCODE; Pop-Location; if ($code -ne 0) { exit $code } — not run; no frontend change
• Playwright smoke/E2E executed — not applicable; no UI or runtime change
• node scripts/check-docs-governance.mjs
• node scripts/check-github-ops-governance.mjs
• $env:BASH_BIN='C:\Program Files\Git\bin\bash.exe'; node --test --test-name-pattern='pins|bootstrap boundary|checksum verifier' scripts/ci/actionlint-bootstrap.test.mjs — 5/5
• $env:BASH_BIN='C:\Program Files\Git\bin\bash.exe'; node --test scripts/ci/release-desktop-dispatch.test.mjs — 61/61
• git diff --cached --check

Documentation

• docs/STATUS.md updated — intentionally unchanged; shipped behavior did not change
• docs/IMPLEMENTATION_MASTERPLAN.md updated for the new dependency order and priority boundary
• docs/TESTING_GUIDE.md / docs/MANUAL_TEST_CHECKLIST.md updated — verification flow did not change
• Added docs/ops/RELEASE_TRUST_AND_DISTRIBUTION.md
• Added docs/ops/EXTERNAL_SERVICES_REGISTER.md
• Updated OUTSTANDING_TASKS.md; no human action was checked

Tracking

• Tracks [Release] Windows trust and direct-distribution programme tracker #1167 without replacing TRACKER: dogfooding UX sweep 2026-08-22 — dead affordances, core-loop legibility, board management #1947 or resolving the programme tracker
• Project status reviewed: dependency-gated [Release][Decision] Select the Windows publisher identity, canonical domain, and signing route #2148–[Release][Windows] Ship a signed user-grade installer with stable metadata #2151 plus Deploy a private shared Taskdeck instance for two-person collaboration dogfooding #1772/Migrate the private shared instance from self-host+tunnel to Render #1777 are Blocked; parallel [Release][Supply chain] Publish SBOMs, artifact attestations, and verification instructions #2152 is Pending; no first-wave item was promoted into Now/Next
• Exactly five new first-wave issues; all have one Priority label, matching touched-item Project Priority, and no milestone

CI Workflow Validation

• No workflow, deploy, script, or project file changed; local workflow/bootstrap and release-dispatch contracts are green
• Hosted CI Extended workflow lint — job 98643855243 succeeded at ab659d6; later commits changed docs only, and exact-head Required CI run 33110188466 succeeded at 175857e

Risk Notes

• Security impact: operational guidance tightens key custody, least privilege, fail-closed signing, and public/private evidence boundaries; it does not provision credentials or change permissions.
• Behavior/regression risk: documentation drift is the principal risk; live release assets, workflow semantics, issue state, and Project fields were reconciled before authoring.
• Follow-up tasks: implementation is explicitly owned by [Release][Decision] Select the Windows publisher identity, canonical domain, and signing route #2148–[Release][Supply chain] Publish SBOMs, artifact attestations, and verification instructions #2152. SmartScreen QA, Store/winget, macOS, Linux channels, and broader cloud splits remain deferred.

[Chris0Jeky]

Round 1 independent review: 1 HIGH owner-gate finding, fixed in 09d1d1b. The release programme, masterplan, and ops index now state that proposed ADR-0061/#1772 define only a maximum possible private-instance boundary; account creation, billing, and deployment remain blocked until the maintainer records the required decisions and accepts the ADR. No other findings were reported.

[Chris0Jeky]

Round 2 final independent review triage:

• HIGH fixed in 175857e: the Ops index and linked cloud runbook now require both recorded ADR-0061/Deploy a private shared Taskdeck instance for two-person collaboration dogfooding #1772 decisions and accepted ADR-0061 before any account, billing, provisioning, or deployment action.
• HIGH fixed in 175857e: the external-services register now states that release SBOMs/attestations are planned rather than shipped and that direct GitHub distribution must complete [Release][Decision] Select the Windows publisher identity, canonical domain, and signing route #2148-[Release][Windows] Ship a signed user-grade installer with stable metadata #2151 before it is described as signed or trustworthy.
• MEDIUM declined as non-blocking: the older archive-pivot paragraph in the masterplan is a dated retained historical record; the current 2026-08-27 planning update directly below it is the newest authority and grants no executable permission. The active programme document and [Release] Windows trust and direct-distribution programme tracker #1167 remain the execution seam.

Scoped post-fix verification passed: docs governance, GitHub operations governance, and git diff --check. This completes the two-round review ceiling; no third general review loop will be opened.