chore: NAM Rack Auth Hotfix

.github/FUNDING.yml

@@ -0,0 +1 @@
+github: sdevil7th

.github/workflows/updater-installer.yml

@@ -0,0 +1,42 @@
+name: Updater installer safety
+on:
+  push:
+    paths:
+      - 'Source/UpdateInstaller*'
+      - 'Source/UpdateManifest*'
+      - 'Source/UpdatePublicKey.h'
+      - 'thirdparty/monocypher/**'
+      - 'tests/updater-installer/**'
+      - '.github/workflows/updater-installer.yml'
+  pull_request:
+    paths:
+      - 'Source/UpdateInstaller*'
+      - 'Source/UpdateManifest*'
+      - 'Source/UpdatePublicKey.h'
+      - 'thirdparty/monocypher/**'
+      - 'tests/updater-installer/**'
+      - '.github/workflows/updater-installer.yml'
+  workflow_dispatch:
+permissions:
+  contents: read
+jobs:
+  native-helper:
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-24.04, macos-15, macos-15-intel]
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v4
+      - name: Build the actual helper with warnings as errors
+        run: |
+          cmake -S tests/updater-installer -B build-installer -DCMAKE_BUILD_TYPE=Release
+          cmake --build build-installer --parallel 3
+      - name: Exercise native replacement and recovery primitives
+        run: ./build-installer/OpenStudioUpdateInstaller --self-test "$HOME/updater-installer-qualification"
+      - uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: installer-${{ matrix.os }}
+          path: ~/updater-installer-qualification/installer-result.json

.github/workflows/verify.yml

@@ -17,12 +17,44 @@ jobs:
     steps:
       - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
 
+      - uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # v6.1.0
+        with:
+          python-version: '3.12'
+
+      - name: Install audio routing test dependencies
+        run: python -m pip install numpy==2.4.2 soundfile==0.13.1 cryptography==46.0.3
+
+      - name: Check first-party product names
+        run: python3 tools/check-product-naming.py
+
       - name: Run Python tooling unit tests
         run: >-
           python3 -m unittest
+          tests.test_release_notes
+          tests.test_updater_manifest
+          tests.test_store_submission
           tests.test_ai_runtime_dependency_pins
           tests.test_install_ai_tools_feature_gating
           tests.test_install_ai_tools_runtime_repair
+          tests.test_prepare_diffusers_audio
+          tests.test_diffusers_memory_policy
+
+  verify-ai-policy:
+    name: AI execution policy (${{ matrix.os }})
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-24.04, windows-latest, macos-14]
+    steps:
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
+      - uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # v6.1.0
+        with:
+          python-version: '3.12'
+      - name: Install lightweight audio test dependencies
+        run: python -m pip install numpy==2.4.2 soundfile==0.13.1
+      - name: Verify device budgets and model routing without GPU dependencies
+        run: python -m unittest tests.test_ai_execution_policy tests.test_ai_benchmark tests.test_diffusers_memory_policy tests.test_ace_diffusers_generation tests.test_ai_generation_preflight
 
   verify-input-profiles:
     name: Input profiles (${{ matrix.os }})
@@ -66,6 +98,14 @@ jobs:
     steps:
       - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
 
+      - name: Test Windows signing safeguards
+        shell: pwsh
+        run: ./tools/test-windows-signing.ps1
+
+      - name: Test Microsoft Store packaging safeguards
+        shell: pwsh
+        run: ./tools/test-windows-store-package.ps1
+
       - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
         with:
           node-version-file: frontend/.nvmrc
@@ -171,6 +211,14 @@ jobs:
             throw "Windows startup self-test failed."
           }
 
+      - name: Verify signed updater and restart persistence (Windows Release)
+        shell: pwsh
+        run: |
+          $exe = Join-Path $env:GITHUB_WORKSPACE "$env:BUILD_DIR/OpenStudio_artefacts/Release/OpenStudio.exe"
+          $report = Join-Path $env:RUNNER_TEMP "updater-regression"
+          $process = Start-Process -FilePath $exe -ArgumentList @("--updater-self-test", "`"$report`"") -WindowStyle Hidden -Wait -PassThru
+          if ($process.ExitCode -ne 0) { throw "Signed updater regression failed." }
+
       - name: Run render and export regression matrix
         shell: pwsh
         run: |
@@ -299,13 +347,14 @@ jobs:
         shell: bash
         run: |
           cmake -S . -B "$BUILD_DIR" \
+            -DCMAKE_BUILD_TYPE=Release \
             -DOPENSTUDIO_APP_VERSION="$VERSION" \
             -DOPENSTUDIO_ENABLE_EXTERNAL_PYTHON_AI_FALLBACK=OFF \
             -DFETCHCONTENT_UPDATES_DISCONNECTED=ON
 
       - name: Build OpenStudio
         shell: bash
-        run: cmake --build "$BUILD_DIR" --config Release --target OpenStudio
+        run: cmake --build "$BUILD_DIR" --config Release --target OpenStudio --parallel 2
 
       - name: Find app bundle
         shell: bash
@@ -341,6 +390,12 @@ jobs:
             exit 1
           fi
 
+      - name: Verify signed updater and restart persistence (macOS Release)
+        shell: bash
+        run: |
+          "$APP_BUNDLE/Contents/MacOS/OpenStudio" --updater-self-test "$RUNNER_TEMP/updater-regression"
+          "$APP_BUNDLE/Contents/Helpers/OpenStudioUpdateInstaller" --self-test "$HOME/updater-installer-regression"
+
       - name: Run macOS native-window lifecycle smoke test
         shell: pwsh
         run: |
@@ -359,13 +414,17 @@ jobs:
   verify-linux:
     runs-on: ubuntu-24.04
     env:
-      VERSION: 0.0.0
+      # AppImage verification exercises the real release-notes gate.
+      VERSION: 0.1.02
       BUILD_DIR: build-verify-linux
       ONNXRUNTIME_VERSION: 1.24.4
       ONNXRUNTIME_LINUX_X64_SHA256: 3a211fbea252c1e66290658f1b735b772056149f28321e71c308942cdb54b747
     steps:
       - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
 
+      - name: Validate AppImage release notes
+        run: python3 tools/validate-release-notes.py --version "$VERSION"
+
       - name: Install system dependencies
         shell: bash
         run: |
@@ -389,7 +448,7 @@ jobs:
         shell: bash
         run: |
           URL="https://github.com/microsoft/onnxruntime/releases/download/v${ONNXRUNTIME_VERSION}/onnxruntime-linux-x64-${ONNXRUNTIME_VERSION}.tgz"
-          wget -q "$URL" -O onnxruntime.tgz
+          curl --fail --location --show-error --retry 3 --retry-delay 2 --output onnxruntime.tgz "$URL"
           echo "${ONNXRUNTIME_LINUX_X64_SHA256}  onnxruntime.tgz" | sha256sum --check --strict
           mkdir -p thirdparty/onnxruntime
           tar -xzf onnxruntime.tgz --strip-components=1 -C thirdparty/onnxruntime
@@ -427,6 +486,12 @@ jobs:
             exit 1
           fi
 
+      - name: Verify signed updater and restart persistence (Linux Release)
+        shell: bash
+        run: |
+          xvfb-run -a "$BUILD_DIR/OpenStudio_artefacts/Release/OpenStudio" --updater-self-test "$RUNNER_TEMP/updater-regression"
+          "$BUILD_DIR/OpenStudio_artefacts/Release/OpenStudioUpdateInstaller" --self-test "$HOME/updater-installer-regression"
+
       - name: Package AppImage
         shell: bash
         run: |

.gitignore

@@ -3,6 +3,7 @@
 /build-*/
 /out
 /tmp/
+/tmp_*
 /cmake-build-*
 CMakeCache.txt
 CMakeFiles
@@ -177,3 +178,7 @@ yarn-error.log*
 Thumbs.db
 ehthumbs.db
 Desktop.ini
+
+# Local cabinet presentation captures
+/tmp_cab_showcase/
+/tmp_cab_showcase_v2/