From a426f25b88e776c03a8fb1f6a0ca586711d6d109 Mon Sep 17 00:00:00 2001 From: Wessel Verheij Date: Sun, 13 Sep 2026 19:52:31 +0200 Subject: [PATCH] docs(f1): nothing may ride along in the desktop bundle, and something must read it MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Every published desktop release from v1.0.1-beta to v1.3.0 carried a vendored package's README with a complete PEM private key in its usage example, and a second package's linting configuration. Neither is a secret of this product's and neither is autoloaded — what earns them a requirement is that no job in the release pipeline ever read a desktop artefact, so the next file to ride along would have been equally invisible. F8-R6 and F8-R7 already state this for a mobile bundle. F1-R19 states it for the desktop one, and F1-R20 states the half the mobile side learned the hard way: a read that cannot tell "found no bundle" from "found a clean bundle" is a check that can sit broken indefinitely. Co-authored-by: Claude Opus 5 (1M context) Signed-off-by: Wessel Verheij --- .../features/f-platform/f1-desktop-shell.md | 20 +++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/10-functional/features/f-platform/f1-desktop-shell.md b/10-functional/features/f-platform/f1-desktop-shell.md index a1f291c..a7e2b69 100644 --- a/10-functional/features/f-platform/f1-desktop-shell.md +++ b/10-functional/features/f-platform/f1-desktop-shell.md @@ -155,6 +155,24 @@ exit bucket stays bounded. `beatrax#442`. "built, pinned by test, awaiting hardware" — and the hardware is where the defect was. +### Nothing may ride along in the desktop bundle + +The packager does not build from a manifest of files it needs: it copies the +working tree, filtering as it walks, then runs `composer install --no-dev` in +the copy. Whatever the filter did not name is in the artefact. That is the same +hazard [F8-R6](f8-app-store-distribution.md) states for a mobile bundle, and it +has the same answer — the artefact is read, not the exclusion list, because a +list is a claim and an artefact is the evidence. + +It had no answer on this side until 2026-09-13. Every published desktop release +from `v1.0.1-beta` to `v1.3.0` carried a vendored package's documentation with a +complete PEM private key in its usage example, and a second package's linting +configuration. Neither is a secret of this product's — they are fixtures their +authors publish openly — and neither is reachable from any autoloader. What +made them worth a requirement is that nothing in the release pipeline read a +desktop artefact at all, so the next file to ride along would have been just as +invisible. + ## Edge cases | Situation | Behaviour | @@ -190,6 +208,8 @@ defect was. | **F1-R16** | Outside the bundle, the absence of the theme signal MUST be the documented fallback trigger. | | **F1-R17** | Storage paths MUST resolve through the single path authority, enforced by architecture test. | | **F1-R18** | Lock-on-window-close MUST act on the focused window's session, and MUST be verified to. | +| **F1-R19** | No key material, build credential, or populated database may ship inside a desktop bundle, verified by inspecting the built artefact rather than the exclusion rules. | +| **F1-R20** | Every job that builds a desktop bundle MUST read what it built, and MUST fail both when it finds something and when it finds no bundle to read. | ## Related