Windows cannot reliably execute the full Tauri lib test harness in CI because the process exits before Rust tests start in the desktop runtime loader path. Split the coordinator session state transitions into a Tauri-free Rust module used by coordinator.rs, and add a small Rust-only backend test crate that path-includes coordinator/hotkey/recorder/insertion logic for real Windows execution.
Constraint: User scoped this follow-up to backend-only Rust-to-Rust tests, not app/runtime smoke tests.
Constraint: Existing Windows CI still keeps full lib --no-run cfg/link coverage.
Rejected: Keep trying to execute cargo test --lib on Windows | it starts the full Tauri-linked test binary and fails before unit tests run.
Rejected: Rework release/runtime DLL handling | outside the backend unit-test scope.
Confidence: high
Scope-risk: moderate
Directive: Keep Windows actual unit execution on the Rust-only backend-tests manifest unless the full Tauri lib harness is proven runnable on clean Windows CI.
Tested: cargo test --manifest-path openless-all/app/src-tauri/backend-tests/Cargo.toml
Tested: cargo test --manifest-path openless-all/app/src-tauri/Cargo.toml --lib
Tested: cargo check --manifest-path openless-all/app/src-tauri/Cargo.toml
Tested: python yaml parse for .github/workflows/ci.yml; git diff --check
Not-tested: Windows runner execution; intended to be verified by GitHub Actions.
Related: #295
Co-authored-by: OmX <omx@oh-my-codex.dev>
The #295 unit suite now runs in CI, but the Windows clean runner exits before the lib test harness starts with STATUS_ENTRYPOINT_NOT_FOUND when optional native runtime entrypoints are absent. Windows still needs cfg/link coverage, while macOS and Linux can execute the shared Rust unit suite.
Constraint: Preserve the new Rust test gate without making optional Windows native runtime installation a CI prerequisite.
Rejected: Install Foundry/Windows App Runtime into every CI run | broader, slower, and unrelated to backend unit-test coverage.
Confidence: high
Scope-risk: narrow
Directive: Do not switch Windows back to executing the lib test binary until the optional native runtime dependency is present on the runner.
Tested: cargo test --manifest-path openless-all/app/src-tauri/Cargo.toml --lib
Not-tested: Windows CI rerun before push.
Issue #295 calls out that core Rust paths have been too dependent on manual app runs. Keep the change narrow by covering existing pure state/audio/clipboard helpers instead of refactoring coordinator or touching hardware-facing code, then wire the existing lib test suite into the lightweight CI lane.
Constraint: Global hotkey, recorder, and insertion integration still require real OS permissions and devices.
Rejected: Split coordinator before adding tests | broader refactor would raise review risk and is tracked separately.
Confidence: high
Scope-risk: narrow
Directive: Keep Rust CI on --lib unless integration tests get explicit OS fixtures.
Tested: npm run build
Tested: cargo test --manifest-path src-tauri/Cargo.toml --lib
Tested: cargo check --manifest-path src-tauri/Cargo.toml
Not-tested: Live microphone, global hotkey, clipboard, and insertion device paths.
Related: #295
CI only checked macOS and Windows before merge, so Linux-only Rust paths could fail cargo check for the first time during release packaging. The matrix now includes an Ubuntu lane that runs the same frontend build and backend cargo check, with only the Linux libraries needed for checking Tauri dependencies and no bundle step.
Constraint: Issue #300 asks for PR-time Linux validation while skipping Tauri bundle work.\nRejected: Add Linux release bundle to CI | too slow and duplicates release-tauri.yml.\nConfidence: high\nScope-risk: narrow\nTested: python ci.yml textual assertions; git diff --check; cd openless-all/app && npm run build; cd openless-all/app && cargo check --manifest-path src-tauri/Cargo.toml\nNot-tested: Full GitHub Actions ubuntu-latest runner execution before PR.\nRelated: https://github.com/appergb/openless/issues/300
Adds Casks/openless.rb + update-cask.yml workflow + README install docs. Closes#254#5.
Note: Formula/openless.rb known to fail in Homebrew sandbox (per author); will be removed in follow-up. Cask version will be bumped to current 1.2.23 in same follow-up.
The release matrix had kept Intel macOS disabled because the old macos-13 pool was deprecated and repeatedly stalled releases. GitHub now exposes an explicit Intel runner label, so the release lane can be restored without returning to the unstable macos-13 runner.
Constraint: Intel Mac release artifacts must be produced separately from Apple Silicon artifacts
Rejected: Re-enable macos-13 | that runner was explicitly disabled due to deprecation and queue instability
Confidence: high
Scope-risk: narrow
Directive: Keep macOS updater artifact names architecture-qualified when multiple darwin lanes are active
Tested: git diff --check
Tested: Parsed release-tauri.yml matrix and verified macOS arm64/x86_64 lanes plus arch-specific updater paths
Not-tested: Full GitHub Actions release run
The workflow must keep reviewing every PR and every pushed commit automatically, including fork PRs, so the hardening focuses on pinning the code that actually runs in the secrets-bearing job. The wrapper action commit still delegates to a mutable Docker tag, so the workflow now calls the PR-Agent container by immutable digest directly.
Constraint: Maintainer preference is automatic PR-Agent coverage for each PR and synchronize event.
Constraint: Issue #222 requires removing mutable third-party execution refs from the secrets-bearing path.
Rejected: Pin only the action repository commit | the wrapper Dockerfile still resolves pragent/pr-agent:github_action at runtime.
Rejected: Require trusted comment triggers for fork PRs | too inconvenient because new commits would not be reviewed automatically.
Confidence: medium
Scope-risk: moderate
Directive: If fork PR automation remains required, keep the runtime container digest-pinned and do not checkout PR head code in this workflow.
Tested: Parsed .github/workflows/pr-agent.yml with PyYAML and asserted docker:// sha256 form; git diff --check; grep confirmed no action ref or github_action tag remains in the workflow.
Not-tested: Live GitHub Actions execution or Docker Hub digest pull from this host.
Related: https://github.com/appergb/openless/issues/222
Intel and Apple Silicon macOS jobs produced the same updater bundle filename,
which let one matrix job overwrite the other release asset and could point
both architecture manifests to a single binary. Rename macOS updater bundles
per architecture before release upload and prefer arch-specific artifact lookup
when generating updater manifests.
Constraint: Keep existing updater manifest format and release action usage
Rejected: Split macOS uploads into separate release jobs | larger workflow churn
Confidence: high
Scope-risk: narrow
Reversibility: clean
Directive: Any new macOS updater lane must keep unique asset names to preserve manifest correctness
Tested: release-tauri.yml YAML parse; diff audit for rename+manifest path alignment
Not-tested: End-to-end tagged GitHub Actions release run
The release workflow only produced Apple Silicon macOS packages, so Intel
users had no official GitHub Release artifact. Extend the matrix with an
x86_64 macOS lane and align artifact naming and updater-manifest paths
with per-arch outputs.
Constraint: Keep existing release pipeline shape and signing flow unchanged
Rejected: Split Intel build into separate workflow file | higher maintenance and duplicated logic
Confidence: high
Scope-risk: narrow
Reversibility: clean
Directive: Keep macOS conditions architecture-agnostic so new mac runners are not skipped accidentally
Tested: YAML syntax parse via python yaml.safe_load; workflow diff reviewed for mac gating/artifact paths
Not-tested: Full GitHub Actions matrix run on tag push
weikeyi