The last two items of M4.
Blocked on credentials, not on code. A signed .dmg cannot be verified on
this machine without signing identity and notarisation credentials, and shipping
an installer nobody has opened is worse than not claiming one.
What exists already
- Craft has release workflows (
.github/workflows/release.yml) that cross-compile and publish binaries. - Craft has an updater bridge (
packages/zig/src/bridge_updater.zig), exercised bytest/bridge_updater_test.zig. ./buddy harness:desktoplaunches the window today; packaging is the gap.
Size context
The ReleaseFast craft binary is 7.30MB with the zig-js JavaScript runtime and
1.10MB with -Djs-runtime=false. Both are far under the 15MB budget in
PLAN.md §11, but the flag exists because 6.2MB is real for a menubar utility
that never evaluates JavaScript. Decide deliberately which one harness ships.
Done when
A notarised .dmg under 15MB installs and launches on a machine that has never
had the repository, and the updater moves it from one version to the next.