release: v1.91.0 - atomic single-instance lock, gateway auth assertion, and daemon lifecycle instrumentation

.env.example

@@ -4,9 +4,12 @@
 # Optional - a release bakes this in, a source checkout runs without it.
 # Connect trackers in the setup wizard; tuning knobs are in CLAUDE.md.
 
-# Optional. Blank means a dev build skips sign-in entirely, so a fresh clone
-# just runs. Set a Clerk dev instance key (pk_test_...) to exercise the real
-# sign-in path locally. Packaged builds always require sign-in regardless.
-CLERK_PUBLISHABLE_KEY=
+# Optional. Blank means the OTP sign-in flow is disabled - the wizard's Email
+# step reports "not configured" on the first attempt and lets you continue
+# without signing in (the same dev-bypass shape the old Clerk key had). Set
+# these to a deployed infra/otp-worker instance (staging or your own) to
+# exercise the real send/verify path locally.
+OTP_API_URL=
+OTP_CLIENT_TOKEN=
 
 

.github/workflows/release-build.yml

@@ -458,7 +458,6 @@ jobs:
       MERIDIAN_GITHUB_OAUTH_CLIENT_ID: ${{ secrets.GH_OAUTH_CLIENT_ID }}
       MERIDIAN_POSTHOG_API_KEY: ${{ secrets.POSTHOG_API_KEY }}
       MERIDIAN_COUNTER_API_KEY: ${{ secrets.COUNTER_API_KEY }}
-      MERIDIAN_CLERK_PUBLISHABLE_KEY: ${{ secrets.CLERK_PUBLISHABLE_KEY_PROD }}
       MERIDIAN_OTP_API_URL: ${{ vars.MERIDIAN_OTP_API_URL }}
       MERIDIAN_OTP_CLIENT_TOKEN: ${{ secrets.MERIDIAN_OTP_CLIENT_TOKEN }}
       MERIDIAN_CHANNEL: ${{ needs.prepare.outputs.channel }}
@@ -521,6 +520,7 @@ jobs:
       # for v0-rust-macos-release-aarch64-apple-darwin" — so stale entries
       # stopped being reaped too, feeding the same eviction.
       - uses: Swatinem/rust-cache@v2
+        id: rust-cache
         with:
           # shared-key REPLACES rust-cache's automatic job-based key. That
           # matters: by default `add-job-id-key` is true, so ci.yml's
@@ -563,6 +563,70 @@ jobs:
           # nothing can restore from — which is exactly how the repo's 10 GiB
           # quota filled up and began evicting caches other jobs needed.
           save-if: ${{ github.ref == 'refs/heads/main' }}
+          # SAVE THE CACHE EVEN WHEN THE JOB FAILS.
+          #
+          # Defaults to false, so a run that compiles for 30 minutes and then
+          # dies in bundling, signing, notarization or upload throws that whole
+          # compile away, and the retry starts cold again - paying twice for one
+          # release. The compile is the expensive half and it SUCCEEDED; a later
+          # step failing says nothing about the artifacts it produced. A partial
+          # `target/` is not a hazard either: cargo fingerprints it correctly,
+          # which is the same property every incremental build already relies on.
+          cache-on-failure: true
+
+      # A COLD BUILD MUST NOT BE SILENT. This is the release pipeline's oldest
+      # and most expensive failure mode, and it has never once announced itself.
+      #
+      # The shape every time: the cache key drifts or the entry is evicted,
+      # `No cache found.` is written into a COLLAPSED log group, the build takes
+      # 20-30 extra minutes, and every check goes green with correct binaries at
+      # the end. It has only ever been caught by someone happening to watch the
+      # clock - most recently 2026-08-27, when the Windows job compiled for 36
+      # minutes while the cache it wanted sat unread on `main` (see the
+      # `runs-on` note in the windows job). The same silence let cache-warm.yml
+      # write an unreadable key for this pipeline's entire history.
+      #
+      # Deliberately an `::error::` ANNOTATION that does NOT fail the step. The
+      # asymmetry matters: a cache miss must never block shipping a release -
+      # the build is slow, not wrong, and failing here would turn a GitHub image
+      # roll into a release outage. But it must be impossible to overlook, so it
+      # lands as a red annotation on the run page and as a section in
+      # `$GITHUB_STEP_SUMMARY`, both of which sit ABOVE the logs rather than
+      # inside a collapsed group.
+      #
+      # The env dump is the other half, and it is what makes the NEXT occurrence
+      # cheap. rust-cache hashes the NAMES AND VALUES of every
+      # CARGO_*/CC*/CFLAGS/CXX/CMAKE*/RUST* variable into the key component that
+      # drifts, and nothing has ever recorded what those were on a run that
+      # missed - so each time the cause has to be re-derived from the cache API
+      # and guesswork. Printing them on a miss turns that into a diff between
+      # two runs. Values that look like credentials are dropped rather than
+      # printed; none of the hashed prefixes should carry one, and a build log
+      # is not the place to find out otherwise.
+      - name: Report the rust-cache outcome
+        run: |
+          if [ "${{ steps.rust-cache.outputs.cache-hit }}" = "true" ]; then
+            echo "rust-cache: HIT - this build starts warm."
+            exit 0
+          fi
+          msg="rust-cache MISSED on ${{ runner.os }}: this build compiles from scratch (~35 min on Windows, ~20 min on macOS). The key drifted or the entry was evicted - compare the environment below against a run that hit."
+          echo "::error title=Cold Rust build (${{ runner.os }})::${msg}"
+          {
+            echo "### rust-cache miss - ${{ runner.os }}"
+            echo
+            echo "${msg}"
+            echo
+            echo "<details><summary>Cache-key environment (rust-cache hashes these names and values)</summary>"
+            echo
+            echo '```'
+            env \
+              | grep -E '^(CARGO|CC|CFLAGS|CXX|CMAKE|RUST)' \
+              | grep -viE '(TOKEN|SECRET|PASSWORD|CREDENTIAL|_KEY)' \
+              | sort || true
+            echo '```'
+            echo
+            echo "</details>"
+          } >> "$GITHUB_STEP_SUMMARY"
 
       - uses: actions/setup-node@v7
         with:
@@ -838,7 +902,25 @@ jobs:
   windows:
     name: Windows x86_64
     needs: prepare
-    runs-on: windows-latest
+    # PINNED, not `windows-latest`. The macOS job is pinned to `macos-26` and
+    # this one was not, and that asymmetry is not cosmetic: on 2026-08-27 the
+    # release's Windows job asked for
+    # `...-Windows_NT-x64-cd9df261-fb0b6063` while a 1305 MiB entry sat on
+    # `main` under `...-Windows_NT-x64-581b1cd0-fb0b6063`, so it compiled for
+    # 36 minutes with the cache it needed one API call away. The same day's
+    # ci.yml Windows jobs asked for `581b1cd0` and missed a `cd9df261` entry -
+    # the two workflows had SWAPPED hashes overnight. Nothing in the repo
+    # changed (identical Cargo.lock, rust-toolchain, workflow file and env
+    # block), so the drift came from the runner image: the fleet was serving
+    # more than one Windows environment (`windows-2025-vs2026` observed), and
+    # rust-cache hashes the CARGO_*/CC*/CFLAGS/CXX/CMAKE*/RUST* vars, so which
+    # runner you land on decides whether you start warm.
+    #
+    # Pinning the label removes the 2022 -> 2025 major roll as a variable. It
+    # does NOT freeze the weekly image refresh, and it cannot fix a fleet that
+    # is heterogeneous within one label - which is exactly why this line is not
+    # treated as the fix. The cache-outcome report below is.
+    runs-on: windows-2025
     timeout-minutes: 60 # same cap as macos — bound a hung build instead of falling back to GitHub's 360-minute default
     permissions:
       contents: write # uploads assets into the draft
@@ -852,13 +934,12 @@ jobs:
       # comment) — these are cross-platform values (OAuth client ids, public
       # analytics keys), not macOS-specific ones, so skipping them here would
       # silently ship a Windows build with Jira sign-in, GitHub device flow,
-      # analytics, or Clerk sign-in missing. Keep this list in sync with the
-      # macOS job's, minus the Apple-only signing/notarization secrets.
+      # analytics, or email sign-in (the OTP Worker) missing. Keep this list in
+      # sync with the macOS job's, minus the Apple-only signing/notarization secrets.
       MERIDIAN_JIRA_OAUTH_CLIENT_SECRET: ${{ secrets.JIRA_OAUTH_CLIENT_SECRET }}
       MERIDIAN_GITHUB_OAUTH_CLIENT_ID: ${{ secrets.GH_OAUTH_CLIENT_ID }}
       MERIDIAN_POSTHOG_API_KEY: ${{ secrets.POSTHOG_API_KEY }}
       MERIDIAN_COUNTER_API_KEY: ${{ secrets.COUNTER_API_KEY }}
-      MERIDIAN_CLERK_PUBLISHABLE_KEY: ${{ secrets.CLERK_PUBLISHABLE_KEY_PROD }}
       MERIDIAN_OTP_API_URL: ${{ vars.MERIDIAN_OTP_API_URL }}
       MERIDIAN_OTP_CLIENT_TOKEN: ${{ secrets.MERIDIAN_OTP_CLIENT_TOKEN }}
       MERIDIAN_CHANNEL: ${{ needs.prepare.outputs.channel }}
@@ -933,6 +1014,7 @@ jobs:
       # equivalent step for the measurement (5288 cache entries evicting the
       # tarball that actually matters, for a 0.00% Rust hit rate).
       - uses: Swatinem/rust-cache@v2
+        id: rust-cache
         with:
           # Keyed by triple only, same reasoning as the macOS job — one warm
           # cache shared across every workflow that compiles this target.
@@ -945,6 +1027,70 @@ jobs:
           # compiled OpenSSL-from-source + SQLCipher + the daemon and tray from
           # a stone-cold cache, 35.7 min of a 37 min job, every single time.
           save-if: ${{ github.ref == 'refs/heads/main' }}
+          # SAVE THE CACHE EVEN WHEN THE JOB FAILS.
+          #
+          # Defaults to false, so a run that compiles for 30 minutes and then
+          # dies in bundling, signing, notarization or upload throws that whole
+          # compile away, and the retry starts cold again - paying twice for one
+          # release. The compile is the expensive half and it SUCCEEDED; a later
+          # step failing says nothing about the artifacts it produced. A partial
+          # `target/` is not a hazard either: cargo fingerprints it correctly,
+          # which is the same property every incremental build already relies on.
+          cache-on-failure: true
+
+      # A COLD BUILD MUST NOT BE SILENT. This is the release pipeline's oldest
+      # and most expensive failure mode, and it has never once announced itself.
+      #
+      # The shape every time: the cache key drifts or the entry is evicted,
+      # `No cache found.` is written into a COLLAPSED log group, the build takes
+      # 20-30 extra minutes, and every check goes green with correct binaries at
+      # the end. It has only ever been caught by someone happening to watch the
+      # clock - most recently 2026-08-27, when the Windows job compiled for 36
+      # minutes while the cache it wanted sat unread on `main` (see the
+      # `runs-on` note in the windows job). The same silence let cache-warm.yml
+      # write an unreadable key for this pipeline's entire history.
+      #
+      # Deliberately an `::error::` ANNOTATION that does NOT fail the step. The
+      # asymmetry matters: a cache miss must never block shipping a release -
+      # the build is slow, not wrong, and failing here would turn a GitHub image
+      # roll into a release outage. But it must be impossible to overlook, so it
+      # lands as a red annotation on the run page and as a section in
+      # `$GITHUB_STEP_SUMMARY`, both of which sit ABOVE the logs rather than
+      # inside a collapsed group.
+      #
+      # The env dump is the other half, and it is what makes the NEXT occurrence
+      # cheap. rust-cache hashes the NAMES AND VALUES of every
+      # CARGO_*/CC*/CFLAGS/CXX/CMAKE*/RUST* variable into the key component that
+      # drifts, and nothing has ever recorded what those were on a run that
+      # missed - so each time the cause has to be re-derived from the cache API
+      # and guesswork. Printing them on a miss turns that into a diff between
+      # two runs. Values that look like credentials are dropped rather than
+      # printed; none of the hashed prefixes should carry one, and a build log
+      # is not the place to find out otherwise.
+      - name: Report the rust-cache outcome
+        run: |
+          if [ "${{ steps.rust-cache.outputs.cache-hit }}" = "true" ]; then
+            echo "rust-cache: HIT - this build starts warm."
+            exit 0
+          fi
+          msg="rust-cache MISSED on ${{ runner.os }}: this build compiles from scratch (~35 min on Windows, ~20 min on macOS). The key drifted or the entry was evicted - compare the environment below against a run that hit."
+          echo "::error title=Cold Rust build (${{ runner.os }})::${msg}"
+          {
+            echo "### rust-cache miss - ${{ runner.os }}"
+            echo
+            echo "${msg}"
+            echo
+            echo "<details><summary>Cache-key environment (rust-cache hashes these names and values)</summary>"
+            echo
+            echo '```'
+            env \
+              | grep -E '^(CARGO|CC|CFLAGS|CXX|CMAKE|RUST)' \
+              | grep -viE '(TOKEN|SECRET|PASSWORD|CREDENTIAL|_KEY)' \
+              | sort || true
+            echo '```'
+            echo
+            echo "</details>"
+          } >> "$GITHUB_STEP_SUMMARY"
 
       - uses: actions/setup-node@v7
         with:

.releaserc.json

@@ -7,7 +7,13 @@
     [
       "@semantic-release/commit-analyzer",
       {
-        "preset": "conventionalcommits"
+        "preset": "conventionalcommits",
+        "releaseRules": [
+          {
+            "type": "revert",
+            "release": "patch"
+          }
+        ]
       }
     ],
     [

.releaserc.staging.json

@@ -11,7 +11,13 @@
     [
       "@semantic-release/commit-analyzer",
       {
-        "preset": "conventionalcommits"
+        "preset": "conventionalcommits",
+        "releaseRules": [
+          {
+            "type": "revert",
+            "release": "patch"
+          }
+        ]
       }
     ],
     [

ARCHITECTURE.md

@@ -65,10 +65,7 @@ listens on no port.
 | **MCP server** | `packages/meridian-mcp/` | TypeScript. Exposes the same data to AI clients over the Model Context Protocol. |
 | **OAuth** | `meridian-oauth/` | Browser-based OAuth flows for Jira and Trello. |
 
-The Rust workspace is `[".", "meridian-core", "meridian-oauth", "tray/src-tauri",
-"tray/src-tauri/vendor/tauri-plugin-clerk"]`. That last one is a patched copy of a
-third-party crate, and it is a member rather than excluded precisely so its regression
-tests run - see `tray/src-tauri/vendor/tauri-plugin-clerk/README.md`.
+The Rust workspace is `[".", "meridian-core", "meridian-oauth", "tray/src-tauri"]`.
 
 Because the repo root is itself a package, **`cargo test` and `cargo clippy` must be
 run with `--workspace`** or they silently test only the daemon. This is the single