ci: deliver explicitly unqualified Windows owner trials

.github/workflows/build.yml

@@ -12,6 +12,10 @@ on:
         description: Publish the verified installers as an unsigned Owner Dogfood prerelease
         type: boolean
         default: false
+      owner_trial:
+        description: Build a manual owner trial; browser acceptance may be failed and is explicitly disclosed
+        type: boolean
+        default: false
 
 permissions:
   contents: read
@@ -703,10 +707,10 @@ jobs:
           fi
 
   desktop-package:
-    if: ${{ github.event_name != 'pull_request' }}
+    if: ${{ !cancelled() && github.event_name != 'pull_request' && needs.backend-tests.result == 'success' && needs.frontend-quality.result == 'success' && needs.extension-quality.result == 'success' && needs.agent-runtime-quality.result == 'success' && needs.rust-security-audit.result == 'success' && needs.reliability-failure-recovery.result == 'success' && needs.migration-browser-smoke.result == 'success' && ((github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/main' && inputs.publish_candidate && inputs.owner_trial) || (needs.browser-smoke.result == 'success' && needs.critical-browser-repeatability.result == 'success')) }}
     name: Windows desktop package
     runs-on: windows-latest
-    needs: [backend-tests, frontend-quality, extension-quality, browser-smoke, reliability-failure-recovery, critical-browser-repeatability, migration-browser-smoke]
+    needs: [backend-tests, frontend-quality, extension-quality, agent-runtime-quality, rust-security-audit, browser-smoke, reliability-failure-recovery, critical-browser-repeatability, migration-browser-smoke]
 
     steps:
       - uses: actions/checkout@v4
@@ -856,7 +860,7 @@ jobs:
     secrets: inherit
 
   desktop-installed-smoke:
-    if: ${{ github.event_name != 'pull_request' }}
+    if: ${{ !cancelled() && github.event_name != 'pull_request' && needs.desktop-package.result == 'success' }}
     name: Windows installed-app and sidecar smoke
     runs-on: windows-latest
     needs: [desktop-package]
@@ -1036,8 +1040,8 @@ jobs:
 
   release:
     name: Publish verified installer assets
-    if: ${{ startsWith(github.ref, 'refs/tags/v') || (github.event_name == 'workflow_dispatch' && inputs.publish_candidate) }}
-    needs: [backend-tests, frontend-quality, rust-security-audit, browser-smoke, reliability-failure-recovery, critical-browser-repeatability, migration-browser-smoke, desktop-package, desktop-installed-smoke, macos-package]
+    if: ${{ !cancelled() && (startsWith(github.ref, 'refs/tags/v') || (github.event_name == 'workflow_dispatch' && inputs.publish_candidate)) && needs.backend-tests.result == 'success' && needs.frontend-quality.result == 'success' && needs.extension-quality.result == 'success' && needs.agent-runtime-quality.result == 'success' && needs.rust-security-audit.result == 'success' && needs.reliability-failure-recovery.result == 'success' && needs.migration-browser-smoke.result == 'success' && needs.desktop-package.result == 'success' && needs.desktop-installed-smoke.result == 'success' && needs.macos-package.result == 'success' && ((github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/main' && inputs.publish_candidate && inputs.owner_trial) || (needs.browser-smoke.result == 'success' && needs.critical-browser-repeatability.result == 'success')) }}
+    needs: [backend-tests, frontend-quality, extension-quality, agent-runtime-quality, rust-security-audit, browser-smoke, reliability-failure-recovery, critical-browser-repeatability, migration-browser-smoke, desktop-package, desktop-installed-smoke, macos-package]
     runs-on: ubuntu-latest
     permissions:
       contents: write
@@ -1102,11 +1106,11 @@ jobs:
         with:
           tag_name: ${{ github.event_name == 'workflow_dispatch' && format('dogfood-{0}-{1}', steps.artifact_version.outputs.version, github.run_number) || github.ref_name }}
           target_commitish: ${{ github.sha }}
-          name: ${{ github.event_name == 'workflow_dispatch' && format('OfferU {0} Owner Dogfood', steps.artifact_version.outputs.version) || format('OfferU {0}', github.ref_name) }}
+          name: ${{ (github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/main' && inputs.publish_candidate && inputs.owner_trial) && format('OfferU {0} Manual Owner Trial', steps.artifact_version.outputs.version) || (github.event_name == 'workflow_dispatch' && format('OfferU {0} Owner Dogfood', steps.artifact_version.outputs.version) || format('OfferU {0}', github.ref_name)) }}
           draft: ${{ github.event_name != 'workflow_dispatch' }}
           prerelease: ${{ github.event_name == 'workflow_dispatch' }}
           make_latest: false
-          body: ${{ github.event_name == 'workflow_dispatch' && 'Owner Dogfood prerelease. Installers are built and tested by GitHub Actions from the target commit. Windows installers are unsigned; full Public Release readiness and human product acceptance remain outstanding. This is not a stable public release.' || '' }}
+          body: ${{ (github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/main' && inputs.publish_candidate && inputs.owner_trial) && 'MANUAL OWNER TRIAL - full browser acceptance has not passed; the known Role Intelligence panel visibility flake is unresolved. Core, security, migration, recovery, artifact and installed-app checks remain required. Unsigned Windows installer; not a stable public release.' || (github.event_name == 'workflow_dispatch' && 'Owner Dogfood prerelease. Installers are built and tested by GitHub Actions from the target commit. Windows installers are unsigned; full Public Release readiness and human product acceptance remain outstanding. This is not a stable public release.' || '') }}
           generate_release_notes: true
           files: |
             release-assets/windows-x64/*.exe

backend/scripts/e2e/test_public_release_worker_soak.py

@@ -421,14 +421,14 @@ def main() -> None:
             raise AssertionError(
                 f"expected one Role Intelligence task per Job, found {len(role_tasks)}"
             )
+        role_tasks_by_job = {str(task["target_id"]): task for task in role_tasks}
         matching_events = _wait_for_job_saved_events(
             client,
             job_target_ids,
             director_tasks_by_job,
             role_tasks_by_job,
         )
         events_by_job = {str(event["target_id"]): event for event in matching_events}
-        role_tasks_by_job = {str(task["target_id"]): task for task in role_tasks}
         if set(role_tasks_by_job) != job_target_ids:
             raise AssertionError("Role Intelligence tasks do not cover every worker Job exactly once")
 

docs/09-quality-and-release.md

@@ -87,6 +87,8 @@ Codex、Claude Code、OpenCode、WorkBuddy、Pi 等宿主共用同一组业务
 
 Owner Dogfood 安装包可以通过 `Build & Release` 的手动输入 `publish_candidate=true` 在 GitHub runner 构建并发布为 `dogfood-<产品版本>-<run number>` 预发行版。它仍依赖完整 CI、产物校验、秘密审计和 installed-app smoke；产物明确标注未签名、尚未通过全部 Public Release / 真人验收。默认不发布，正式 `v*` tag 的签名和 readiness 门槛保持不变。
 
+用户明确选择手动试用时，可以同时设置 `publish_candidate=true`、`owner_trial=true`。此路径仅把浏览器 UI smoke / repeatability 从安装包依赖降为已披露的未通过验收；核心测试、生产依赖与 RustSec、迁移、恢复、产物与秘密审计、installed-app smoke 仍必须通过。Release 标题与正文明确写为 Manual Owner Trial，保留失败证据，不表示 Public Release 或真人验收通过；默认关闭，普通候选和正式 tag 路径不变。
+
 ## 10. 证据与报告规则
 
 - 新报告放在 `docs/evidence/reports/YYYY-MM-DD-<slug>.md`，格式遵循 `docs/evidence/report-schema.json`（EvolveBench 的格式见 `docs/evidence/evolve-bench-schema.json`）。