fix(ci) [BRNS-DESK-033]: the artifact paths point where cargo actually writes

[stefan-ssv-labs]

The clean-room rebuild moved the cargo workspace root to the repo root, and the release workflows never learned it.

Ticket: BRNS-DESK-033 on the shared findings board.

This PR was two tickets and is now one. It also carried BRNS-DESK-034, the ledger-net separator fix — but #62 landed the identical fix first, in commit e87d525, written by the person who reported the bug. Dev's version is the better one and this branch now takes it verbatim. See The ticket that left at the bottom.

The defect

./Cargo.toml declares the workspace and lists the seven engine crates plus src-tauri as members, so every build output lands in repo-root target/. src-tauri/target/ does not exist and never has in this tree. Nine paths across release.yml and ci.yml still carried the old prefix, inherited from the original single-crate layout.

Requirement	Change
macOS smoke-launch reads the built app	release.yml:150
Notarize step finds the DMG	release.yml:193
Final verify reads app + DMG	release.yml:206-207
macOS release artifact uploads	release.yml:260
Windows verify reads the release dir	release.yml:299 ($exe at :301 derives from it)
Windows NSIS + MSI artifacts upload	release.yml:335-336
Label-gated test DMG uploads	ci.yml:323
The manual window check names a real directory	scripts/eval/specs/01-window.yaml:8

dev-release.yml already used repo-root target/, and its runs publish real signed, notarized, installable artifacts — so every new path here is copied from a proven-correct reference rather than derived a second time. It is deliberately left byte-identical.

The last row is one line of prose beyond the ticket's stated .github/ surface: a manual-test note telling a human to watch src-tauri/target for HMR-retriggering writes. Same wrong fact, last tracked file repeating it. scripts/cef-dev-bundle.mjs:29 is left alone — it names the path in order to say it does not exist, which is correct.

Out of scope and correct as they stand: the Recall source paths under src-tauri/recall/ and src-tauri/binaries/, and cargo fmt/clippy --manifest-path src-tauri/Cargo.toml, which select the shell crate on purpose.

Reproduction

ls src-tauri/target on a clean checkout: no such directory. Every path in the table resolved into it. The macOS find … -print -quit sites fail quietly (empty string, step still exits 0); the upload-artifact sites fail loudly via if-no-files-found: error. That asymmetry is how it survived: the noisy site was never reached, because the quiet one had already stopped verifying anything.

Evidence

• The label-gated Build macOS job ran and uploaded a real universal DMG from the corrected path — test-build-macos, 99,861,209 bytes, with if-no-files-found: error armed. That job had never executed once in this tree before; its first run is green. This is the live proof the fix works, and it is the only end-to-end proof obtainable before a tag.
• actionlint .github/workflows/*.yml — clean.
• Zero src-tauri/target references remain in any tracked file except the comment stating it does not exist.
• npm run check (svelte-check), lint:size, lint:imports, lint:manifests, lint:css-vars, npm run build — all pass. No manifest churn.
• npm run eval -- --no-agent needs node scripts/dev/recall/stub-bundle-artifacts.mjs first, which is exactly what CI's Rust and eval jobs do. Without it, five cargo checks fail on any checkout of this tree: the declared externalBin binaries/recall-node is absent locally and tauri_build::build() hard-fails on a declared binary it cannot find. Unrelated to this branch, which contains no Rust and no tauri config.

What is not proven here

The end-to-end proof is a tagged release, which this PR cannot produce. release.yml fires on v* only, and no v* tag yet contains the workspace-root move (git tag --contains 2e0e247 is empty) — which is precisely why nothing has caught this. The eight release.yml paths are verified by inspection plus the fact that they are now byte-identical in scheme to dev-release.yml, whose runs publish real installers. The ci.yml path is verified by execution, above.

Shipping impact

No runtime code changes — nothing a user installs differs. The impact is that the next v* tag can produce a release at all. Before this, both build jobs would have died at their verify steps or at if-no-files-found: error, and publish (needs: [build, build-windows]) would never have run: a tag with no assets.

Regression provenance

Not a regression. 2e0e247 ("sync: 2026-08-06 tree snapshot") both added the root workspace Cargo.toml and imported these workflows verbatim from the original repo, where cargo was rooted at src-tauri/ and the paths were correct. The move made them dead without touching them. dev-release.yml was born later and got the correct paths; these two never did. Found by the PR #47 parity review, not by CI.

The ticket that left

BRNS-DESK-034 — the ledger-net audit comparing join()-built native paths against forward-slash literals — was fixed twice, independently, on the same day.

#62 (fix/windows-build, merged into dev as 17a3b21) carries commit e87d525, which does the identical thing this branch did: import relative and sep from node:path, and replace the process.cwd().length + 1 slice with relative(process.cwd(), p).split(sep).join("/"). Amir reported that bug and then fixed it inside the Windows lane that motivated it.

Dev's version is better and this branch now holds it byte-for-byte: it names the normalization repoPath() rather than inlining it in the .map, and it carries the explanation of why a phantom Windows-only failure is worse than no net at all. Merging dev conflicted on exactly that file and on nothing else; ci.yml merged clean, because #62 restructured the Rust job above the Build macOS upload, moving it without touching it.

One thing did not change with the merge: #62 does not make that test run on Windows. Its new Windows leg is the Rust matrix. The frontend job — the only npm test, so the only vitest — is still ubuntu-latest. So the normalization is correct-by-construction and locally mutation-checked in both directions, but its first real Windows execution still belongs to future work.

Follow-ups filed, not folded in

Each has its own row rather than widening an XS ticket. #62 changed the standing of the first two and neither is closed by it:

1. [BRNS-DESK-035] Swatinem/rust-cache is given workspaces: src-tauri — the same stale assumption, in cache config rather than artifact paths. The action resolves its cached target dir as <workspaces>/target, so no compiled artifact is ever saved or restored and every Rust leg is a cold full rebuild. Windows: make dev build, compile and test on Windows #62 makes this cost more, not less: the Rust job is now a two-OS matrix, so there are two cold rebuilds per run.
2. [BRNS-DESK-036] cargo fmt --check and clippy are scoped --manifest-path src-tauri/Cargo.toml, which selects the shell crate alone — all seven engine crates go unformatted and unlinted. Windows: make dev build, compile and test on Windows #62 explicitly declines to widen it, for the stated reason that the base is ~160 fmt-dirty sites and widening would land red.
3. [BRNS-DESK-037] The ledger audit cannot see a builder written the idiomatic way. BUILDS_A_BLOCK matches only a marker in a string literal, but handover.ts:37 builds HANDOVER_PREFIX from the shared CONTEXT_MARKER constant — a live, wire-bound [context] block, absent from BUILDERS, invisible to the net. Untouched by Windows: make dev build, compile and test on Windows #62, which fixed how the audit compares paths, not what it can see. Same row covers code()'s block-comment stripper treating the /* inside import.meta.glob("./apps/*/app.json") as a comment opener, silently deleting a span of main.ts.

Merge method: squash (do not merge-commit or rebase-merge).

[stefan-ssv-labs]

✅ review-pr (self-review, cannot approve own PR): Clean — BRNS-DESK-033 requirements are met.