docs(plan): Desktop 签名与原子发布提案 (PROPOSAL, 不 merge)

[DeliciousBuding]

产出

docs/plan/proposal-desktop-release-signing.md — 状态 PROPOSAL（待管理员批准）

回答了什么

1. 现状差距表：AgentHub vs Codeg 发布链 16 项逐项比对
2. 原子发布改造：draft-flip 模式 + 7 版本源统一为 tauri.conf.json SSOT + tag 双守卫
3. 签名矩阵：macOS Developer ID + notarytool 三件套（含 secrets 清单与管理员采购表）、Windows Authenticode 选项评估
4. Tauri updater 通道：latest.json 多平台聚合、回滚评估、NSIS sidecar 锁风险
5. 安装脚本评估（含首装验签红线——Codeg 的反面教材）
6. 证据闭环：roadmap P1 packaged boundary + AH-SR-036 precondition 闭合路径
7. 分阶段清单：Phase 1（无 secrets）→ Phase 2（需 macOS secrets）→ Phase 3（可选）

纪律

• 禁碰 .github/workflows/** 实文件
• 不含真实密钥/证书内容
• 实施须逐 Phase 另开任务并获管理员批准

Closes #1403

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[coderabbitai]

Warning

Review limit reached

@DeliciousBuding, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 37 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: c211484b-64df-49eb-b748-3cc5a407aac7

📥 Commits

Reviewing files that changed from the base of the PR and between 5891cbe and 6f1a28b.

📒 Files selected for processing (1)

• docs/plan/proposal-desktop-release-signing.md

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch docs/spec-release-signing

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[DeliciousBuding]

独立审查结论（fable，只读，不 merge）

Verdict: NEEDS_FIX

方向对、范围克制，但 Phase 1「$0 / 无 secrets 可独立」与 updater 产物前提写得过满。

阻断

1. B1 现网无 createUpdaterArtifacts；bundle.targets=["nsis"]；workflow 对 updater 软收集。Phase 1 必须写清产物生成 + 签名对象格式。
2. B2 「$0 可独立」不诚实：TAURI_SIGNING_PRIVATE_KEY 未盘点；release still needs mobile/EAS；本 PR validate 有 trailing whitespace。
3. B3 原子性语义不准：draft 内校验齐全再 flip；tag 上 cancel-in-progress 须处理。
4. B4 仓外 Temp/codeg-research 链接不可审。

Phase 1

原文 否；修正后可为「近 $0 Desktop 切片」：secret 盘点 + updater 生成 + mobile 解耦 + draft 校验后 flip + NSIS hooks 杀 edge + 收敛多入口。

验收

• 更新通道（P1 主）：latest.json 200 + minisign 对 updater 实际下载物 + 负例篡改拒绝。
• 首装 分通道：不得用 updater 通了关闭首装/AH-SR-036；NSIS/DMG/install 脚本属 P2/P3。

不要按当前正文批准 Phase 1 开工。修完再 APPROVE_AS_PROPOSAL。未 merge。

[DeliciousBuding]

Approved direction (admin): Desktop 签名与原子发布 proposal approved in principle. Phased impl via #1403 (Phase 2/3 need admin secrets). Author marked 不 merge — closing. Reopen when implementation PRs reference it.