fix(installer): make Runtime Pack install reversible

.dockerignore

@@ -21,6 +21,14 @@ tmp
 nohup.out
 
 operator-tui/target
+**/target
+**/build
+vibecrafted-app/target
+vibecrafted-server/target
+vibecrafted-app/shell-agent/build
+build
+dist
+.loctree
 scripts/installer/.venv
 **/__pycache__
 *.py[cod]

.github/workflows/portable.yml

@@ -90,41 +90,21 @@ jobs:
         run: bash scripts/check-portable.sh
 
   curl-bootstrap:
-    name: curl | bash bootstrap
-    if: github.event_name == 'merge_group'
+    name: Runtime Pack bootstrap (${{ matrix.os }})
     needs: portable
-    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - runner: macos-latest
+            os: macOS
+          - runner: ubuntu-latest
+            os: Linux
+    runs-on: ${{ matrix.runner }}
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
-      - name: Install build dependencies
-        run: |
-          sudo apt-get update
-          # install.sh -> make install builds voc, whose arboard clipboard dep
-          # links gtk-sys/glib-sys on Linux. libgtk-3-dev transitively provides
-          # the glib-2.0 pkg-config files the build needs. (Rust is preinstalled
-          # on ubuntu-latest with a default toolchain, and this job uses the real
-          # HOME, so no rustup pin is needed here.)
-          sudo apt-get install -y \
-            build-essential \
-            cmake \
-            libclang-dev \
-            libgtk-3-dev \
-            libxdo-dev \
-            libayatana-appindicator3-dev \
-            protobuf-compiler
-      - name: Provision leptos toolchain for the server shell build
-        shell: bash
-        run: |
-          # Same requirement as the portable job: install.sh -> make install
-          # -> install-bundle-tools hard-requires cargo-leptos once cargo is
-          # present, plus a Cargo.lock-matched wasm-bindgen-cli.
-          rustup target add wasm32-unknown-unknown
-          curl -L --proto '=https' --tlsv1.2 -sSf -o /tmp/install-binstall.sh https://raw.githubusercontent.com/cargo-bins/cargo-binstall/main/install-from-binstall-release.sh
-          bash /tmp/install-binstall.sh
-          cargo binstall -y cargo-leptos
-          lock_version="$(cargo tree --locked --manifest-path vibecrafted-server/Cargo.toml -p wasm-bindgen --depth 0 --prefix none | awk 'NR == 1 { sub(/^v/, "", $2); print $2 }')"
-          cargo binstall -y "wasm-bindgen-cli@${lock_version}"
-      - name: Serve install.sh locally and bootstrap
+      - uses: astral-sh/setup-uv@d0cc045d04ccac9d8b7881df0226f9e82c39688e # v6
+      - name: Build canonical source side of the release tuple
         run: |
           archive="/tmp/vibecrafted-bootstrap.tar.gz"
           source_revision="$(git rev-parse HEAD)"
@@ -134,26 +114,8 @@ jobs:
             --root-name vibecrafted-bootstrap \
             --owner-repo "$GITHUB_REPOSITORY" \
             --source-revision "$source_revision"
-          bash install.sh --archive-file "$archive"
-      - name: Verify bootstrap result
+      - name: Prove canonical carrier and bootstrap contract
         run: |
-          # install.sh stages the source snapshot under the RUNTIME home
-          # ($XDG_DATA_HOME/vibecrafted, default ~/.local/share/vibecrafted),
-          # not the skills home (~/.vibecrafted). Mirror install.sh's own
-          # tools-dir resolution (default_vibecrafted_runtime_home +
-          # VIBECRAFTED_TOOLS_HOME override) so verify checks the path the
-          # installer actually wrote.
-          if [ -n "${VIBECRAFTED_RUNTIME_HOME:-}" ]; then
-            runtime_home="$VIBECRAFTED_RUNTIME_HOME"
-          elif [ -n "${XDG_DATA_HOME:-}" ]; then
-            runtime_home="$XDG_DATA_HOME/vibecrafted"
-          else
-            runtime_home="$HOME/.local/share/vibecrafted"
-          fi
-          tools_dir="${VIBECRAFTED_TOOLS_HOME:-$runtime_home/tools}"
-          test -L "$tools_dir/vibecrafted-current"
-          test -f "$tools_dir/vibecrafted-current/vibecrafted-core/vibecrafted_core/runtime/scripts/codex_spawn.sh"
-          # Runtime contract: the default install lane does not wire legacy shell
-          # helpers (vc-skills.sh) — that is an explicit --with-shell opt-in — so
-          # the bootstrap verify no longer asserts the helper file here.
-          echo "Bootstrap OK"
+          env -u PYTHONPATH uv run --project vibecrafted-core --with pytest \
+            python -m pytest tests/tui/test_runtime_pack_cli.py \
+            tests/tui/test_install_bootstrap.py -q

.github/workflows/release-dmg.yml

@@ -109,7 +109,6 @@ jobs:
           # Vibecrafted Server shell (leptos); version matches the operator machine
           cargo install --locked cargo-leptos@0.3.7
       - uses: astral-sh/setup-uv@d0cc045d04ccac9d8b7881df0226f9e82c39688e # v6
-
       - name: Materialize signing keys from secrets
         env:
           VC_CERT_P12_B64: ${{ secrets.VC_CERT_P12_B64 }}

.github/workflows/release.yml

@@ -70,7 +70,7 @@ jobs:
       # later. It arrived in ef700e52 (3.7.1) and every tag since died
       # earlier, so it has never once executed. These are literal presence
       # assertions over enumerated files, which is what grep is for.
-      - name: Confirm publication boundary for both channels
+      - name: Confirm publication boundary for all carriers
         run: |
           set -euo pipefail
           test -x scripts/publish-vibecrafted-release.sh
@@ -83,3 +83,9 @@ jobs:
             scripts/build-portable-release.sh \
             scripts/publish-vibecrafted-release.sh \
             docs/RELEASE_KICKOFF.md
+          grep -nE 'RUNTIME_PACK_NAME|RuntimePack_.*tar\.gz|install-runtime-pack\.sh' \
+            scripts/build-vibecrafted-release.sh \
+            scripts/package-runtime-pack.sh \
+            scripts/install-runtime-pack.sh \
+            scripts/publish-vibecrafted-release.sh \
+            docs/RELEASE_KICKOFF.md

.gitignore

@@ -55,6 +55,7 @@ vibecrafted-io-link
 !/.loctree/canary/
 /.antigravitycli
 /vibecrafted-server/target
+/vibecrafted-app/shell-agent/app/Vibecrafted.xcodeproj/
 /docs/plans
 /.air
 /.venv/

.loctree/canary/JOURNAL.md

@@ -375,7 +375,7 @@ The map says otherwise:
   responsibilities already moved). `shell/lib` = the operator-terminal
   facade (self-described: "sourced only by the compatibility facade";
   consumers: `vetcoders.sh`, `install-foundations.sh`,
-  `sync-vc-alias-runtime.sh`, the vc-* verbs).
+  `sync-vc-alias-runtime.sh`, the vc-\* verbs).
 - `frontier.sh` ×2 is a **FALSE_PARALLEL**: same name, different powers
   (spawn shell selection vs frontier config resolution). Rename candidate,
   not a cut.

AGENTS.md

@@ -754,7 +754,7 @@ We ship.
 
 ### Checks Requiring Secrets Or External Services
 
-- DMG signing/notarization (Developer ID + notary credentials), `gh` for the release-gate probe, vibecrafted-io deploy — operator buttons, never run by workers. ***
+- DMG signing/notarization (Developer ID + notary credentials), `gh` for the release-gate probe, vibecrafted-io deploy — operator buttons, never run by workers. \*\*\*
 
 ## Safety Boundaries
 

CHANGELOG.md

@@ -5,6 +5,26 @@ Format follows [Keep a Changelog](https://keepachangelog.com/).
 
 ## Unreleased
 
+## 4.3.0 — prepared, not published
+
+### Changed
+
+- The root `VERSION` is the mechanical product-version authority for the core,
+  MCP, server, plugin and staged package metadata; the release gate rejects
+  drift before a carrier is built.
+- `make install` and the non-interactive bootstrap lane consume a signed,
+  provenance-closed Runtime Pack on macOS, Linux and WSL2. Maintainers can
+  still choose the explicitly named `make install-source` compiler lane.
+- Runtime Pack selection is platform/architecture specific and rejects a
+  carrier whose embedded version, platform, architecture or source/donor tuple
+  disagrees with the selected release asset.
+
+### Distribution status
+
+- v4.3.0 carrier metadata covers macOS plus Linux x86_64 and arm64. Publication,
+  production signing/notarization and the live channel update remain release
+  operator actions; this entry does not claim those outward steps occurred.
+
 > **4.2.0 scope — measured truths, finished seams.** Release integrity from the
 > donor snapshot through to the payload a stranger downloads, and one identity
 > order shared by every surface that reads a run.

Makefile

@@ -36,13 +36,13 @@ if [ ! -d "$$stable_root/vibecrafted-core" ]; then \
 fi
 endef
 
-.PHONY: help help-dev vibecrafted app dmg dmg-signed release-local notarize release portable publish-release release-rehearsal gui-install wizard wizard-dev check test test-core test-skills test-install test-parity test-vc-frame test-iterm2-migrate test-memex test-aicx-sync test-hammerspoon test-keychain-session dispatch-test unified-product-contract-gate payload-hygiene install install-auto install-all install-python-tools install-bundle-tools install-tools install-tools-held install-vendored-binaries install-app-binaries install-hammerspoon skills helpers setup-dev dry-run doctor list update uninstall restore migrate migrate-dry init-hooks seed-commit-msg-hooks bundle bundle-check foundations foundations-check semgrep version version-show version-bump bump-patch bump-minor bump-major iterm-plugin iterm-plugin-refresh iterm-plugin-show iterm-plugin-uninstall iterm-plugin-migrate demo demo-full commit-safe test-race-protection skill-new server server-build build-server-release server-check server-test install-server install-server-payload install-server-service server-smoke
+.PHONY: help help-dev vibecrafted app dmg dmg-signed release-local notarize release runtime-pack portable publish-release release-rehearsal gui-install wizard wizard-dev check test test-core test-skills test-install test-parity test-vc-frame test-iterm2-migrate test-memex test-aicx-sync test-hammerspoon test-keychain-session dispatch-test unified-product-contract-gate release-version-gate payload-hygiene install install-source install-auto install-all install-python-tools install-bundle-tools install-tools install-tools-held install-vendored-binaries install-app-binaries install-hammerspoon skills helpers setup-dev dry-run doctor list update uninstall restore migrate migrate-dry init-hooks seed-commit-msg-hooks bundle bundle-check foundations foundations-check semgrep version version-show version-bump bump-patch bump-minor bump-major iterm-plugin iterm-plugin-refresh iterm-plugin-show iterm-plugin-uninstall iterm-plugin-migrate demo demo-full commit-safe test-race-protection skill-new server server-build build-server-release server-check server-test install-server install-server-payload install-server-service server-smoke
 
 help:
 	@printf "\n"
 	@printf "  \033[1m\033[38;5;173m⚒  𝚅𝚒𝚋𝚎𝚌𝚛𝚊𝚏𝚝𝚎𝚍. %s\033[0m\n" "$$(cat $(VERSION_FILE) 2>/dev/null || echo dev)"
 	@printf "\n"
-	@printf "  make install      \033[2mGuided install\033[0m\n"
+	@printf "  make install      \033[2mInstall the receipted Runtime Pack\033[0m\n"
 	@printf "  make doctor       \033[2mHealth check\033[0m\n"
 	@printf "  make update       \033[2mPull latest + reinstall\033[0m\n"
 	@printf "  make uninstall    \033[2mReverse the install\033[0m\n"
@@ -59,7 +59,7 @@ help-dev:
 	@printf "\n"
 	@printf "  \033[1m\033[38;5;173m⚒  𝚅𝚒𝚋𝚎𝚌𝚛𝚊𝚏𝚝𝚎𝚍. dev targets\033[0m\n"
 	@printf "\n"
-	@printf "  \033[1minstall\033[0m   install · install-auto · install-all · install-python-tools · install-vendored-binaries · install-app-binaries · install-server · install-server-service · install-hammerspoon\n"
+	@printf "  \033[1minstall\033[0m   install · install-source · install-auto · install-all · install-python-tools · install-vendored-binaries · install-app-binaries · install-server · install-server-service · install-hammerspoon\n"
 	@printf "            skills · helpers · setup-dev · wizard · wizard-dev · gui-install · dry-run · restore\n"
 	@printf "            migrate · migrate-dry · foundations · foundations-check · bundle · bundle-check\n"
 	@printf "  \033[1mtests\033[0m     test · test-core · test-skills · test-install · test-parity · test-vc-frame · test-iterm2-migrate\n"
@@ -79,6 +79,9 @@ vibecrafted: install
 
 RELEASE_SCRIPT := scripts/build-vibecrafted-release.sh
 PORTABLE_SCRIPT := scripts/build-portable-release.sh
+RUNTIME_PACK_INSTALLER := scripts/install-runtime-pack.sh
+RUNTIME_PACK_PACKAGER := scripts/package-runtime-pack.sh
+RUNTIME_PACK ?=
 KEYS ?= $(HOME)/.keys
 # Extra builder flags, e.g. RELEASE_FLAGS=--snapshot-donors to build from
 # detached worktrees at each donor HEAD instead of refusing a dirty donor.
@@ -107,6 +110,19 @@ notarize:
 release:
 	@VC_RELEASE_FLAGS='$(RELEASE_FLAGS)' zsh -ic 'cd "$(CURDIR)" && KEYS="$(KEYS)" exec bash "$(RELEASE_SCRIPT)" $${=VC_RELEASE_FLAGS}'
 
+# Build the standalone macOS CLI carrier from the exact same Runtime Pack bytes
+# embedded in Vibecrafted.app. The packager adds only the two native helpers
+# that AppDelegate normally supplies from Contents/Helpers.
+runtime-pack: app
+	@version="$$(tr -d '[:space:]' < VERSION)"; \
+	revision="$$(git rev-parse --short=8 HEAD)"; \
+	date="$${VIBECRAFTED_RELEASE_DATE:-$$(date -u +%Y%m%d)}"; \
+	arch="$$(uname -m | sed 's/^arm64$$/arm64/; s/^aarch64$$/arm64/; s/^x86_64$$/x64/')"; \
+	output="dist/Vibecrafted_RuntimePack_$${version}-$${date}-$${revision}-darwin-$${arch}.tar.gz"; \
+	test -s "$$output" \
+		|| { echo 'release builder produced no standalone Runtime Pack' >&2; exit 1; }; \
+	printf '%s\n' "$$output"
+
 # The portable channel needs no signing identity and no notary account: it is a
 # provenance-bound source distribution, so it builds anywhere git and python3 do.
 portable:
@@ -148,6 +164,7 @@ publish-release:
 	@zsh -ic 'cd "$(CURDIR)" && exec bash scripts/publish-vibecrafted-release.sh'
 
 unified-product-contract-gate:
+	@$(MAKE) --no-print-directory release-version-gate
 	@set -eu; \
 	uv run --project vibecrafted-core --with pytest python -m pytest \
 		tests/tui/test_unified_app_contract.py \
@@ -180,6 +197,9 @@ unified-product-contract-gate:
 		rc=0; env -u PYTHONPATH PYTHONNOUSERSITE=1 "$$runner" walkaround --release-output "$$tmp/release-output.json" --signature "$$tmp/release-output.json.sig" --output "$$tmp/walkaround.json" >/dev/null 2>&1 || rc=$$?; test "$$rc" -eq 22; \
 		test ! -e "$$tmp/walkaround.json")
 
+release-version-gate:
+	@$(PYTHON) scripts/version_bump.py --check --file "$(VERSION_FILE)"
+
 tui-installer: init-hooks
 	@if ! command -v uv >/dev/null 2>&1; then \
 		echo "bootstrapping uv..."; \
@@ -261,6 +281,13 @@ endif
 install-auto: install
 
 install:
+	@VIBECRAFTED_RUNTIME_PACK="$(RUNTIME_PACK)" bash "$(RUNTIME_PACK_INSTALLER)"
+
+# Explicit source/compiler lane retained for the portable Linux/WSL carrier.
+# It is not the normal customer installer: it may require Rust, cargo-leptos,
+# sibling donors, and platform targets. macOS CLI/App install the exact same
+# closed Runtime Pack through `make install` and AppDelegate respectively.
+install-source:
 	@mkdir -p "$(HOME)/.vibecrafted"
 	@: > "$(INSTALL_LOG)"
 	@printf "Installing Vibecrafted\n"
@@ -276,9 +303,8 @@ install:
 	  printf "\nVibecrafted is ready (headless: the vc-frame cockpit is not installed; vc-start needs it).\n\nStart here:\n  export PATH=\"\$$HOME/.local/bin:\$$PATH\"\n  vibecrafted doctor\n  vibecrafted implement claude --prompt \"describe this repo\"\n  vibecrafted await claude --last\n\nLog:\n  ~/.vibecrafted/install.log\n"; \
 	fi
 
-# `make install` calls `install-python-tools`; it was an empty .PHONY name
-# (no recipe) so the uv-tool install never ran during `make install`. Alias it
-# to the real recipe.
+# The explicit source/compiler lane calls `install-python-tools`; retain the
+# alias for that portable residual without putting it back on `make install`.
 install-python-tools: install-tools
 
 # Full install keeps the installer, runtime publication, Python-tool replacement,
@@ -391,7 +417,7 @@ install-tools-held:
 		fi; \
 		resolved_real="$$($(PYTHON) -c 'from pathlib import Path; import sys; print(Path(sys.argv[1]).resolve())' "$$resolved")"; \
 		if [ "$$entrypoint" = "vibecrafted" ]; then \
-			expected_path="$$stable_root/vibecrafted-core/vibecrafted_core/deck/vibecrafted"; \
+			expected_path="$$stable_root/bin/vibecrafted"; \
 		else \
 			expected_path="$$tool_root/bin/$$entrypoint"; \
 		fi; \
@@ -622,7 +648,7 @@ update:
 	fi
 
 uninstall:
-	@$(PYTHON) $(INSTALLER) uninstall
+	@VIBECRAFTED_RUNTIME_PACK="$(RUNTIME_PACK)" bash "$(RUNTIME_PACK_INSTALLER)" --uninstall
 
 restore:
 	@$(PYTHON) $(INSTALLER) restore

README.md

@@ -177,15 +177,31 @@ wsl --install
 wsl bash -c 'curl -fsSL https://vibecrafted.io/install.sh | bash'
 ```
 
-**From source** (power users, maintainers, anyone who wants the gates):
+**macOS CLI Runtime Pack** (power users who do not want the App): download the
+signed binary carrier and both sidecars from the latest release, then point the
+checkout front door at it:
 
 ```bash
 git clone https://github.com/vetcoders/vibecrafted.git
-cd vibecrafted && make install
+cd vibecrafted
+make install RUNTIME_PACK=../Vibecrafted_RuntimePack_<version>-<YYYYMMDD>-<sha8>-darwin-<arch>.tar.gz
+make uninstall  # same installer, same receipt
+```
+
+Maintainers who intentionally want local compilation use the explicit source
+lane:
+
+```bash
+make install-source
 make help-dev   # the full target surface
 ```
 
-A source install gives you the complete headless runtime — `vibecrafted
+`make install` never compiles a product for a stranger. It selects a closed
+Runtime Pack for the current platform and architecture; Linux and WSL2 use the
+Linux x86_64 or arm64 carrier. `make install-source` is the explicit maintainer
+lane and may require the full build toolchain.
+
+A Runtime Pack install gives you the complete headless runtime — `vibecrafted
 doctor`, every skill launcher, `observe`/`await`, reports and transcripts under
 `~/.vibecrafted`. The visual cockpit (`vc-frame`, `vc-start`) is not part of it:
 it ships inside the desktop app below, and `vibecrafted init <agent>` falls back
@@ -208,6 +224,12 @@ verify the checksum, then open the DMG. The build path (`make release`) is
 exercised and produces a Developer ID signed, notarized and stapled artifact;
 until the release carrying it is published, use the bootstrap.
 
+The same release also carries
+`Vibecrafted_RuntimePack_<version>-<YYYYMMDD>-<sha8>-darwin-<arch>.tar.gz`, its
+`.sha256`, and detached `.sig`. It contains the exact runtime embedded in the
+App plus the same terminal/frame helpers; the DMG is an optional onboarding
+overlay, not a second runtime authority.
+
 **Every other system** (Linux, WSL2, or macOS without the desktop app): the
 same release carries `Vibecrafted_<version>-<YYYYMMDD>-<sha8>-portable.tar.gz`
 and its adjacent `.sha256`. It is not a convenience copy of the repository — it

VERSION

@@ -1 +1 @@
-4.2.4
+4.3.0