@@ -1,5 +1,11 @@
 packages/core/migration/**/snapshot.json linguist-generated
 packages/core/src/database/migration.gen.ts linguist-generated
 packages/core/src/models-dev/snapshot.txt linguist-generated
+packages/core/src/database/schema.gen.ts linguist-generated
+packages/desktop/src/main/storage/migration.gen.ts linguist-generated
+packages/protocol/openapi.json linguist-generated
+packages/client/src/promise/generated/** linguist-generated
+packages/client/src/effect/generated/** linguist-generated
+packages/client/src/effect/api/** linguist-generated
 packages/core/src/**/*.txt text eol=lf
 packages/httpapi-codegen/test/generated/*.ts text eol=lf
@@ -1,3 +1,7 @@
 # web + desktop packages
 packages/app/      @Hona @Brendonovich
 packages/desktop/  @Hona @Brendonovich
+
+# CI and releases. Release jobs that hold secrets run only .github/workflows/release.yml and .github/release/,
+# which makes this path the release security boundary.
+/.github/ @anomalyco/releasers
@@ -58,6 +58,9 @@ runs:
       with:
         path: ${{ steps.cache.outputs.dir }}
         key: ${{ runner.os }}-${{ runner.arch }}-bun-${{ steps.cache.outputs.version }}-${{ hashFiles('bun.lock', 'patches/**') }}
+        # Each dev merge changes beta's bun.lock. Beta falls back to the newest cache for the same Bun version
+        # (Bun's cache stores every package version separately) instead of installing everything from npm.
+        restore-keys: ${{ (github.ref_name == 'beta' && format('{0}-{1}-bun-{2}-', runner.os, runner.arch, steps.cache.outputs.version)) || '' }}
 
     - name: Install setuptools for distutils compatibility
       run: python3 -m pip install setuptools || pip install setuptools || true
 
@@ -0,0 +1,66 @@
+#!/usr/bin/env bash
+# publish.sh <hashes.json>: run from a checkout of dev. Puts <hashes.json> on bot/nix-hashes as one commit on top of dev,
+# opens or updates the pull request into dev, dispatches its required checks and enables auto-merge. Closes the pull
+# request instead when dev already has these hashes. Uses git, gh and jq only; never runs repository code.
+set -euo pipefail
+
+here=$(cd "$(dirname "$0")" && pwd)
+new=$(realpath "$1")
+branch=bot/nix-hashes
+file=nix/hashes.json
+title="chore: update nix node_modules hashes"
+: "${GH_REPO:?}" "${GITHUB_SHA:?}"
+git=(git -c core.hooksPath=/dev/null -c user.name='github-actions[bot]' -c user.email='41898282+github-actions[bot]@users.noreply.github.com')
+
+bash "$here/validate.sh" "$new"
+
+"${git[@]}" fetch --no-tags --depth=1 origin "+refs/heads/dev:refs/remotes/origin/dev" "$GITHUB_SHA"
+
+# A newer push that changed the inputs has its own run, which publishes hashes for it. Mirrors on.push.paths.
+if ! git diff --quiet "$GITHUB_SHA" origin/dev -- bun.lock package.json ':(glob)packages/*/package.json' \
+  ':(glob)services/*/package.json' flake.lock nix/node_modules.nix nix/scripts patches; then
+  echo "::notice::dev changed the hash inputs since $GITHUB_SHA; leaving it to the newer run"
+  exit 0
+fi
+
+# Only a same-repository pull request is the bot's; a fork can use the same branch name.
+find_pr() {
+  gh pr list --repo "$GH_REPO" --base dev --head "$branch" --state open --json number,isCrossRepository \
+    --jq 'map(select(.isCrossRepository | not)) | .[0].number // empty'
+}
+pr=$(find_pr)
+
+"${git[@]}" checkout -B "$branch" origin/dev
+if cmp -s "$new" "$file"; then
+  echo "dev already has these hashes"
+  if [ -n "$pr" ]; then
+    gh pr close "$pr" --repo "$GH_REPO" --delete-branch --comment "dev already has these hashes."
+  fi
+  exit 0
+fi
+
+cp "$new" "$file"
+bash "$here/validate.sh" "$file"
+"${git[@]}" add -- "$file"
+"${git[@]}" commit --no-verify -m "$title"
+[ "$(git diff --name-only origin/dev HEAD)" = "$file" ] || {
+  echo "::error::the commit changes more than $file" >&2
+  exit 1
+}
+"${git[@]}" push --no-verify --force origin "HEAD:refs/heads/$branch"
+
+if [ -z "$pr" ]; then
+  gh pr create --repo "$GH_REPO" --base dev --head "$branch" --title "$title" \
+    --body "Updates \`$file\` to the node_modules hashes computed for $GITHUB_SHA by bot-nix-hashes. check-bot-scope keeps this branch to that file."
+  pr=$(find_pr)
+fi
+
+# Pushes and pull requests made with GITHUB_TOKEN start no workflows; dispatches do. These produce the checks dev
+# requires on the new head.
+for workflow in check.yml check-test.yml check-bot-scope.yml; do
+  gh workflow run "$workflow" --repo "$GH_REPO" --ref "$branch"
+done
+
+gh pr merge "$pr" --repo "$GH_REPO" --auto --squash
+echo "### Nix hashes" >> "${GITHUB_STEP_SUMMARY:-/dev/null}"
+echo "Updated pull request #$pr" >> "${GITHUB_STEP_SUMMARY:-/dev/null}"
@@ -0,0 +1,27 @@
+#!/usr/bin/env bash
+# validate.sh <file>: fails unless <file> has exactly the shape of nix/hashes.json, so the hashes bot can only ever publish
+# three SRI hashes. Used by bot-nix-hashes.yml before it commits and by check-bot-scope.yml on the bot's pull request.
+# Adding a system to the flake means adding it to SYSTEMS here.
+set -euo pipefail
+
+file=${1:?usage: validate.sh <file>}
+SYSTEMS='["aarch64-darwin","aarch64-linux","x86_64-linux"]'
+
+fail() {
+  echo "::error::$file: $*" >&2
+  exit 1
+}
+
+if [ ! -f "$file" ] || [ -L "$file" ]; then fail "not a regular file"; fi
+[ "$(wc -c < "$file")" -lt 4096 ] || fail "4096 bytes or larger"
+jq -se 'length == 1' "$file" > /dev/null 2>&1 || fail "not a single JSON value"
+jq -e --argjson systems "$SYSTEMS" '
+  type == "object"
+  and keys == ["nodeModules"]
+  and (.nodeModules | type == "object")
+  and (.nodeModules | keys == $systems)
+  and (.nodeModules | all(.[]; type == "string" and test("\\Asha256-[A-Za-z0-9+/]{43}=\\z")))
+' "$file" > /dev/null || fail "expected {\"nodeModules\": {<$SYSTEMS>: \"sha256-<44 base64 chars>\"}}"
+# The canonical form rules out duplicate keys and anything else jq would drop on parse.
+jq . "$file" | cmp -s - "$file" || fail "not formatted as jq . prints it"
+echo "$file: valid"
@@ -17,6 +17,13 @@ Please provide a description of the issue, the changes you made to fix it, and w
 
 ### How did you verify your code works?
 
+### Visual
+
+_Optional, for user-facing changes: a small looping animated SVG (240×72) of the change, shown in the desktop app's "What's new in beta". Replace the block below or delete this section._
+
+```svg
+```
+
 ### Screenshots / recordings
 
 _If this is a UI change, please include a screenshot or recording._
 
@@ -0,0 +1,21 @@
+name: Download release artifacts
+description: Downloads artifacts into $RUNNER_TEMP/in/<name> and verifies each against its SHA256SUMS.
+inputs:
+  pattern:
+    description: Artifact name pattern
+    required: true
+  digests:
+    description: Space-separated name=digest pairs for artifacts made by sign jobs, from their job outputs
+    required: false
+    default: ""
+runs:
+  using: composite
+  steps:
+    - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+      with:
+        pattern: ${{ inputs.pattern }}
+        path: ${{ runner.temp }}/in
+    - shell: bash
+      run: bash "${GITHUB_ACTION_PATH//\\//}/../verify-artifacts.sh" "$RUNNER_TEMP/in"
+      env:
+        OPENCODE_DIGESTS: ${{ inputs.digests }}