Harden TimePrism project showcase

.github/workflows/ci.yml

@@ -7,25 +7,38 @@ on:
       - main
       - "refactor/**"
 
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
 jobs:
   checks:
     name: Typecheck, Vite build, Rust check/test
     runs-on: windows-latest
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
-          node-version: 20
+          node-version: 24
 
       - name: Enable pnpm
         run: |
           corepack enable
           corepack prepare pnpm@9.15.9 --activate
 
+      - name: Install Rust stable
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Cache Rust build output
+        uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: "./src-tauri -> target"
+          cache-on-failure: true
+
       - name: Install frontend dependencies
         run: pnpm install --frozen-lockfile
 
@@ -35,9 +48,9 @@ jobs:
       - name: Build frontend to temporary output
         run: pnpm run build:check
 
-      - name: Check Rust backend
+      - name: Check all Rust targets
         working-directory: src-tauri
-        run: cargo check
+        run: cargo check --all-targets
 
       - name: Test Rust backend
         working-directory: src-tauri

.github/workflows/release.yml

@@ -0,0 +1,111 @@
+name: Windows Release
+
+# Packaging PRs build real Windows installers without publishing a Release.
+on:
+  pull_request:
+    branches:
+      - main
+    paths:
+      - ".github/workflows/release.yml"
+      - "src-tauri/tauri.conf.json"
+      - "src-tauri/Cargo.toml"
+      - "src-tauri/Cargo.lock"
+      - "package.json"
+      - "pnpm-lock.yaml"
+  workflow_dispatch:
+  push:
+    tags:
+      - "v*"
+
+permissions:
+  contents: write
+
+jobs:
+  windows:
+    name: Build Windows installers
+    runs-on: windows-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+
+      - name: Setup Node
+        uses: actions/setup-node@v7
+        with:
+          node-version: 24
+
+      - name: Enable pnpm
+        run: |
+          corepack enable
+          corepack prepare pnpm@9.15.9 --activate
+
+      - name: Install Rust stable
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Cache Rust build output
+        uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: "./src-tauri -> target"
+
+      - name: Install frontend dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Validate synchronized versions
+        shell: pwsh
+        run: |
+          $tauriVersion = (Get-Content src-tauri/tauri.conf.json | ConvertFrom-Json).version
+          $packageVersion = (Get-Content package.json | ConvertFrom-Json).version
+          $cargoMetadata = cargo metadata --manifest-path src-tauri/Cargo.toml --no-deps --format-version 1 | ConvertFrom-Json
+          $cargoVersion = ($cargoMetadata.packages | Where-Object { $_.name -eq 'timeprism' } | Select-Object -First 1).version
+
+          if ($tauriVersion -ne $packageVersion -or $tauriVersion -ne $cargoVersion) {
+            throw "Version mismatch: tauri=$tauriVersion package=$packageVersion cargo=$cargoVersion"
+          }
+
+          if ($env:GITHUB_REF_TYPE -eq 'tag') {
+            $expectedTag = "v$tauriVersion"
+            if ($env:GITHUB_REF_NAME -ne $expectedTag) {
+              throw "Tag/version mismatch: pushed=$env:GITHUB_REF_NAME expected=$expectedTag"
+            }
+          }
+
+          "TIMEPRISM_VERSION=$tauriVersion" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
+
+      - name: Typecheck frontend
+        run: pnpm run typecheck
+
+      - name: Test Rust backend
+        working-directory: src-tauri
+        run: cargo test
+
+      - name: Build installers for validation
+        if: github.event_name == 'workflow_dispatch' || github.event_name == 'pull_request'
+        run: pnpm tauri build --bundles nsis msi
+
+      - name: Upload validation installers
+        if: github.event_name == 'workflow_dispatch' || github.event_name == 'pull_request'
+        uses: actions/upload-artifact@v7
+        with:
+          name: TimePrism-${{ env.TIMEPRISM_VERSION }}-windows-installers-${{ github.event_name }}
+          if-no-files-found: error
+          path: |
+            src-tauri/target/release/bundle/nsis/*-setup.exe
+            src-tauri/target/release/bundle/msi/*.msi
+
+      - name: Build and create draft GitHub Release
+        if: github.event_name == 'push' && github.ref_type == 'tag'
+        uses: tauri-apps/tauri-action@v1
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        with:
+          tagName: v__VERSION__
+          releaseName: TimePrism v__VERSION__
+          releaseBody: |
+            Windows-first, local-first TimePrism desktop release.
+
+            Download either the NSIS setup executable or MSI installer from the release assets.
+            This project is currently unsigned, so Windows SmartScreen may warn about an unknown publisher.
+          releaseDraft: true
+          prerelease: false
+          generateReleaseNotes: true
+          args: --bundles nsis msi

README.md

@@ -14,6 +14,7 @@
 </p>
 
 <p align="center">
+  <a href="https://github.com/Air000000/timeprism/releases"><strong>Windows Releases</strong></a> |
   <a href="#what-it-demonstrates">What It Demonstrates</a> |
   <a href="#architecture">Architecture</a> |
   <a href="#engineering-highlights">Engineering Highlights</a> |
@@ -31,6 +32,8 @@ Rather than relying on manual start/stop timers, it samples the foreground appli
 
 The project is intentionally scoped as a Windows-first, local-first desktop application. It does not depend on cloud accounts, remote sync, or external services for its core workflow.
 
+> **Release status:** the currently published `v0.1.0-preview` is an early portable build and predates the latest architecture/reliability work. The repository now includes a gated Windows release pipeline for NSIS `-setup.exe` and MSI installers; packaging changes are validated on Windows before merge, while public releases remain draft-first and require an interactive installer smoke test before publication.
+
 ## What It Demonstrates
 
 TimePrism is primarily a desktop full-stack engineering project. The repository demonstrates:
@@ -144,7 +147,7 @@ SQLite persistence
 | Backend | Rust |
 | Storage | SQLite / rusqlite |
 | Platform integration | Windows + Tauri window APIs |
-| Validation | GitHub Actions, `vue-tsc`, Vite build, `cargo check`, `cargo test` |
+| Validation | GitHub Actions, `vue-tsc`, Vite build, `cargo check --all-targets`, `cargo test` |
 
 ## Project Structure
 
@@ -178,18 +181,32 @@ timeprism/
 
 ## Validation
 
-Every push to `main` and `refactor/**`, plus pull requests, runs the repository CI workflow on Windows:
+Every push to `main` and `refactor/**`, plus pull requests, runs the repository CI workflow on Windows. Rust build output is cached between runs and all test targets are compiled before the test phase:
 
 ```text
 pnpm run typecheck
 pnpm run build:check
-cargo check
+cargo check --all-targets
 cargo test
 ```
 
+Release-related pull requests also run an independent Windows packaging gate that builds both NSIS and MSI installers and uploads them as workflow artifacts. This verifies that the current tree can reach real Tauri installer artifacts without publishing a Release.
+
 The current desktop flow has also been manually smoke-tested on Windows for startup behavior, main views, reminder workflows, pet interactions, and full-app quit behavior.
 
-CI and smoke tests are used as project-level regression evidence; they are not a claim of production-grade hardening.
+CI, packaging validation, and smoke tests are used as project-level regression evidence; they are not a claim of production-grade hardening.
+
+## Distribution
+
+`.github/workflows/release.yml` separates installer generation from publication on `windows-latest`:
+
+- **Packaging PR:** release-related pull requests validate synchronized versions, run frontend/Rust checks, build both NSIS and MSI installers, and upload the real installer artifacts without publishing anything.
+- **Manual dry run:** `workflow_dispatch` performs the same installer build on demand after merge and uploads the installers as workflow artifacts without creating a Release.
+- **Version tag:** requires the tag to exactly match the synchronized Cargo/Node/Tauri app version, then creates a **draft** GitHub Release with both installer formats.
+
+Automated packaging proves that the installers can be generated; it does not replace the interactive Windows gate. At least one generated installer must still be downloaded, installed, launched, and smoke-tested before the draft Release is made public.
+
+The project is currently unsigned, so Windows SmartScreen may warn about an unknown publisher. See [`docs/RELEASE_CHECKLIST.md`](docs/RELEASE_CHECKLIST.md) for the full publication gate.
 
 ## Privacy
 
@@ -210,7 +227,7 @@ Because active-window data can be sensitive, privacy is treated as part of the d
 
 Recommended local development environment:
 
-- Node.js 20
+- Node.js 24 LTS
 - pnpm 9
 - Rust toolchain
 - Tauri v2 system prerequisites
@@ -242,7 +259,7 @@ pnpm dev
 pnpm run typecheck
 pnpm run build:check
 cd src-tauri
-cargo check
+cargo check --all-targets
 cargo test
 ```
 
@@ -277,8 +294,12 @@ Engineering notes and design rationale live under `docs/`, including:
 - database and privacy notes
 - smoke-test catalog
 - testing strategy
+- release checklist
+- product-media capture guide
 - ADRs and refactor traceability
 
+Real product screenshots/GIF are only added from sanitized current Windows builds; the capture/privacy requirements are documented in [`docs/media/README.md`](docs/media/README.md) so generated or mock UI is not presented as implementation evidence.
+
 ## License
 
 TimePrism is licensed under the MIT License.

docs/RELEASE_CHECKLIST.md

@@ -0,0 +1,137 @@
+# Release Checklist
+
+TimePrism publishes Windows installers from GitHub Actions. Releases are created as **drafts** first so the generated installers can be smoke-tested before they become public.
+
+## Release artifacts
+
+The Windows release workflow builds both Tauri-supported installer formats:
+
+- NSIS setup executable: `*-setup.exe`
+- WiX/MSI installer: `*.msi`
+
+The current project is unsigned. Windows SmartScreen can therefore show an unknown-publisher warning until code signing is added.
+
+## Two-layer installer gate
+
+Installer validation is deliberately split into two layers:
+
+1. **Automated packaging gate:** release-related pull requests build both NSIS and MSI installers on `windows-latest` and upload them as workflow artifacts. This proves the current tree can reach real installer artifacts before merge.
+2. **Interactive Windows smoke:** a generated installer is downloaded to a real Windows desktop, installed, launched, exercised, and checked for restart/data/lifecycle behavior. CI cannot replace this interaction-level gate.
+
+A green packaging job is therefore necessary evidence, but it is not sufficient by itself to publish a Release.
+
+## Mandatory first-run and upgrade acceptance
+
+Before a public release, both tracking-state migration paths must pass on a real Windows machine using the exact release candidate build.
+
+### Fresh-install gate
+
+Use a clean or sandboxed TimePrism app-data directory and complete `S-050 Fresh Install And First-Run Tracking` in `docs/SMOKE_TESTS.md`.
+
+Release-blocking assertions include:
+
+- SQLite is initialized before product WebViews query it; no `no such table` startup failure appears.
+- No foreground capture occurs before the user accepts the first-run tracking disclosure.
+- The disclosure accurately describes foreground app/window metadata, local SQLite storage, browser privacy processing, no screenshot/keystroke-content capture, and the distinction between observed activity and classified `LEARN / REST` time.
+- Activation begins tracking without an application restart.
+- Pause persists across full quit/reopen; resume also persists and restores automatic tracking after restart.
+- The desktop pet reports active versus paused tracking while keeping `学 / 休` counters classification-based.
+
+### Upgrade gate
+
+Use a backed-up recognizable TimePrism database created before the tracking-state keys existed and complete `S-060 Upgrade From A Pre-Tracking-State Database`.
+
+Release-blocking assertions include:
+
+- existing rows survive migration;
+- onboarding does not unexpectedly reappear for an existing user;
+- the legacy database starts onboarded with capture enabled;
+- a later explicit pause is preserved across reinitialization and restart.
+
+Do not publish a release, mark a release candidate accepted, or promote a tracking-state PR solely from automated CI evidence if either interactive gate has not passed.
+
+## Before tagging
+
+1. Confirm `main` CI is green.
+2. Confirm the latest relevant packaging PR produced both installer formats successfully.
+3. Confirm both mandatory acceptance paths above passed on the release candidate:
+   - fresh install (`S-050`);
+   - pre-tracking-state upgrade (`S-060`).
+4. Update the same semantic version in:
+   - `package.json`
+   - `src-tauri/Cargo.toml`
+   - `src-tauri/tauri.conf.json`
+5. Run or verify:
+
+   ```text
+   pnpm install --frozen-lockfile
+   pnpm run typecheck
+   pnpm run build:check
+   cargo check --manifest-path src-tauri/Cargo.toml --all-targets
+   cargo test --manifest-path src-tauri/Cargo.toml
+   ```
+
+6. Smoke-test the remaining desktop flows listed in `docs/SMOKE_TESTS.md`.
+7. Commit the synchronized version bump to `main`.
+
+The release workflow rejects mismatched Node/Cargo/Tauri versions. Tag-triggered runs also reject a tag that does not equal `v<app-version>`.
+
+## Pull-request packaging validation
+
+When a pull request changes release/package inputs, **Windows Release** runs automatically.
+
+The pull-request path:
+
+1. validates version synchronization;
+2. runs frontend typecheck and Rust tests;
+3. builds both NSIS and MSI installers on `windows-latest`;
+4. uploads both installers as one workflow artifact;
+5. does **not** create a GitHub Release.
+
+The packaging job uses `if-no-files-found: error`, so a green upload step also verifies that both configured installer paths resolved to real files.
+
+## Manual dry-run installer build
+
+After the workflow is on `main`, **Windows Release** can also be started manually from GitHub Actions before creating a tag.
+
+The `workflow_dispatch` path performs the same version checks, tests, installer build, and artifact upload without creating a GitHub Release. Use this when you want a fresh installer candidate from the default branch even if no packaging-related pull request is open.
+
+Download the generated artifact and perform the interactive Windows smoke before publishing a version tag.
+
+## Interactive installer smoke
+
+At minimum, verify one generated installer end to end on Windows:
+
+- install from the NSIS `-setup.exe` or MSI artifact;
+- run the fresh-install tracking acceptance with a clean/sandboxed app-data directory;
+- separately run the upgrade acceptance against a backed-up pre-tracking-state database;
+- verify Home, Insights, Focus Guard, reminders, privacy settings, and desktop pet flows;
+- verify main-window close/background behavior and full-app quit behavior;
+- restart the app and confirm local data and tracking pause/resume state survive as expected;
+- uninstall the tested installer and confirm the uninstall flow completes normally;
+- retain the unsigned/SmartScreen note until Windows code signing exists.
+
+If the installer or installed application fails this gate, fix the issue and produce a fresh artifact before tagging.
+
+## Publish a release draft
+
+Create and push a tag that exactly matches the app version, for example:
+
+```text
+git tag v0.2.0
+git push origin v0.2.0
+```
+
+The tag-triggered workflow validates the tag/version match and uses `tauri-apps/tauri-action` to create a draft GitHub Release with the NSIS and MSI assets attached.
+
+## Verify the draft
+
+Before publishing the draft Release:
+
+- confirm the expected NSIS and MSI assets are attached;
+- install at least one draft asset if it differs from the previously smoke-tested artifact;
+- confirm both fresh-install and upgrade acceptance evidence corresponds to the same code/release candidate;
+- confirm Release notes describe any known limitations;
+- explicitly retain the unsigned/SmartScreen note until Windows code signing exists.
+
+Only after these checks should the GitHub Release be published.