feat: productize desktop and phone onboarding

[wolfiesch]

What changed

• show the desktop window before backend recovery finishes
• bundle, verify, and automatically install the exact compatible OMP backend in the Mac app
• add one-button private phone setup with a QR code
• adopt the merged Developer ID signing and notarization release contract
• document the production download and automatic setup flow

Verified

• pnpm check
• desktop: 115 tests passed
• protocol and fixture server: 77 tests passed
• packaging: 45 tests passed
• unsigned arm64 Mac package built and its DMG inspected
• packaged OMP reports 17.0.5 and matches the published artifact SHA-256
• release metadata is consistent for v0.1.24
• all actionable review threads are resolved

Backend release

Bundles OMP 17.0.5 appserver-3, including the startup fix, cross-session attention, and cross-session transcript search.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 3577858233

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Copilot]

Pull request overview

This PR productizes the desktop/phone onboarding flow by shipping a pinned OMP backend inside the macOS app bundle, adding a one-button Tailnet phone-setup flow (QR code), and introducing a fail-closed signed+notarized macOS release path with post-build signature verification.

Changes:

• Add a bundled/pinned OMP runtime staging + packaging pipeline (and preflight verification) for Apple Silicon macOS builds.
• Add “phone setup” IPC + desktop service logic and a web UI card that configures Tailnet-only access and renders a QR code.
• Add signed+notarized macOS release workflow steps and a verification script for Developer ID/Gatekeeper/notarization.

Reviewed changes

Copilot reviewed 31 out of 33 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
scripts/verify-macos-signature.mjs	Adds a CI verification step for macOS code signing, Gatekeeper assessment, and notarization tickets.
scripts/tailnet-service.mjs	Adds --electron-run-as-node support to run the gateway using Electron’s bundled Node runtime.
scripts/t4-maintainer-integration.test.mjs	Increases integration spawn timeouts for maintainer scripts.
scripts/stage-omp-runtime.mjs	Stages the pinned OMP runtime artifact from the compatibility matrix into .artifacts/.
scripts/package-preflight.mjs	Adds a preflight check requiring the staged/bundled OMP runtime to match the matrix (when enabled).
scripts/package-mac-unsigned.mjs	Ensures the pinned runtime is staged and required for unsigned macOS packaging.
scripts/package-mac-signed.mjs	Adds a fail-closed signed+notarized macOS packaging entrypoint.
scripts/check-release-consistency.test.mjs	Extends release consistency tests to detect missing macOS signing secrets.
scripts/check-release-consistency.mjs	Documents/validates new macOS signing+verification steps as part of release consistency.
pnpm-lock.yaml	Adds qrcode.react and updates lockfile snapshots accordingly.
packages/protocol/test/desktop-ipc.test.ts	Adds protocol boundary tests for phone setup URL validation.
packages/protocol/src/desktop-ipc.ts	Adds phone setup IPC channels and PhoneSetupState decoder/typing.
packages/client/src/desktop-runtime-contracts.ts	Extends the DesktopShellPort contract with phone setup calls.
package.json	Adds package:mac and stage:omp-runtime:mac scripts.
electron-builder.config.mjs	Enables signed mac builds, adds entitlements/notarization, and bundles runtime + gateway resources.
docs/TAILNET_REMOTE.md	Documents automatic Mac phone setup flow and clarifies manual/source prerequisites.
docs/MACOS_RELEASE.md	Adds documentation for signed macOS release credential setup and local verification steps.
compat/omp-app-matrix.json	Adds published runtime artifact metadata (name/size/sha256) for darwin-arm64.
apps/web/src/router.tsx	Wires phone setup API into the Hosts route when available.
apps/web/src/features/targets/TargetsScreen.tsx	Adds the Phone Setup UI card and QR code rendering + copy flow.
apps/web/package.json	Adds qrcode.react dependency.
apps/site/src/docs/content.ts	Updates site docs copy to reflect bundled backend + phone setup flow on Mac.
apps/desktop/test/phone-setup.test.ts	Adds unit coverage for Tailnet phone setup behavior and serve config.
apps/desktop/test/lifecycle-runtime.test.ts	Updates lifecycle expectations to reflect showing a window earlier during startup/recovery.
apps/desktop/test/bundled-runtime.test.ts	Adds tests for atomic install + integrity validation of the bundled runtime.
apps/desktop/src/preload.ts	Exposes phone setup IPC methods to the renderer bridge.
apps/desktop/src/phone-setup.ts	Implements phone setup inspect/configure logic and Tailnet-only Serve configuration.
apps/desktop/src/lifecycle.ts	Installs bundled runtime on packaged darwin/arm64 and wires PhoneSetupService into IPC runtime.
apps/desktop/src/ipc.ts	Adds IPC handlers for phone setup inspect/configure.
apps/desktop/src/bundled-runtime.ts	Implements integrity-checked, atomic installation of the bundled runtime into user data.
apps/desktop/build/entitlements.mac.plist	Adds hardened-runtime entitlements for signed macOS builds.
.gitignore	Ignores staged .artifacts/ output.
.github/workflows/release.yml	Switches to signed+notarized macOS packaging, restores notarization key, and verifies signatures.

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.