refactor(release): stop distributing bundled Git

.github/RELEASE_CHECKLIST.md

@@ -1,19 +1,21 @@
 # Product release checklist
 
-The `Release` workflow is Maka's convenience-artifact release entry point. Desktop, CLI/TUI, and
-bundled Git source materials are built from the exact IPMC-approved ASF source candidate commit.
-They share that source commit, the root product version, one convenience tag, one GitHub Release,
-one Draft decision, and one release gate. The workflow creates no Draft until every required
-artifact job succeeds.
+The `Release` workflow is Maka's convenience-artifact release entry point. Desktop and CLI/TUI are
+built from the exact IPMC-approved ASF source candidate commit. They share that source commit, the
+root product version, one convenience tag, one GitHub Release, one Draft decision, and one release
+gate. The workflow creates no Draft until every required artifact job succeeds.
 
 Phase 1 requires:
 
 - signed and notarized Apple Silicon macOS Desktop artifacts;
 - the unsigned Windows x64 Desktop installer and ZIP;
 - the signed, notarized, relocatable Apple Silicon CLI/TUI ZIP;
-- bundled Git source materials;
 - checksums generated after each artifact reaches its final form.
 
+The ASF Desktop artifacts must not contain a Git runtime, a bundled-Git manifest, or Git/Dugite
+redistribution notices. Managed-workspace execution remains unavailable until a separately reviewed,
+ASF-compatible verified runtime is connected before admission/T1.
+
 The first product release also requires the exact `maka-agent@<version>` npm package. The product
 tag and Draft must exist before npm staging, but the Draft must remain unpublished until npm is
 public, Finalize has verified it, and Desktop acceptance has exercised remote Runtime Host setup.
@@ -55,13 +57,13 @@ These controls close the check-to-upload and check-to-stage windows. Keep the Re
    version, and the CLI manifest exposes only the `maka` command.
 4. Dispatch `Release` from the exact approved candidate tag and supply the same tag as
    `source_reference_tag`. A rerun must use that same tag; never select current `main` instead.
-5. Confirm `release-identity`, both Desktop matrix entries, `cli-macos-arm64`, `source`, and
+5. Confirm `release-identity`, both Desktop matrix entries, `cli-macos-arm64`, and
    `publish` pass. A skipped or failed required job must prevent Draft creation.
 6. Confirm one Draft named `v<version>` targets the approved source SHA, identifies the ASF source
    reference in its notes, is marked as a GitHub prerelease exactly when the product version is a
    prerelease, is not marked Latest while it remains a Draft, and contains exactly the manifest
    reported by `node scripts/product-release-artifacts.mjs list`. The manifest covers both Desktop
-   platforms and update metadata, the standalone CLI/TUI, bundled source, and their required checksums.
+   platforms and update metadata, the standalone CLI/TUI, and their required checksums.
 7. Inspect the CLI ZIP. It must contain `bin/maka`, `RELEASE.json`, `DISCLAIMER-WIP`, `LICENSE`, `NOTICE`,
    `THIRD_PARTY_NOTICES.txt`, the pinned Node license, and no `bin/maka-agent`.
 8. Confirm `RELEASE.json` records the Draft's product version and source SHA, Apple Team ID
@@ -71,8 +73,8 @@ These controls close the check-to-upload and check-to-stage windows. Keep the Re
    entitlements must retain the required hardened-runtime capabilities and omit
    `com.apple.security.get-task-allow`, as required by Apple's
    [notarization guidance](https://developer.apple.com/documentation/security/resolving-common-notarization-issues).
-9. Extract the bundled Git source-materials archive. Confirm `SOURCE_MANIFEST.json`, `README.txt`,
-   all manifest archives, and the expected Dugite native release are present.
+9. Inspect both Desktop resource trees and confirm `git/`, `bundled-git.json`, `licenses/git/`, and
+   `licenses/dugite/` are absent.
 
 If the publish job created the product tag or Draft but failed before every asset was uploaded,
 rerun `Release` from the same approved ASF source candidate tag with the same

.github/workflows/release-windows-check.yml

@@ -17,7 +17,6 @@ on:
       - 'apps/desktop/package.json'
       - 'scripts/package-windows-x64.mjs'
       - 'scripts/verify-windows-sandbox-e2e.mjs'
-      - 'scripts/prepare-bundled-git.mjs'
       - 'scripts/verify-windows-x64.mjs'
       - 'scripts/verify-windows-sandbox-e2e.mjs'
       - 'scripts/verify-windows-installer-lifecycle.mjs'
@@ -38,7 +37,6 @@ on:
       - '.gitattributes'
       - 'package.json'
       - 'package-lock.json'
-      - 'apps/desktop/resources/licenses/git/NOTICE.txt'
       - 'apps/desktop/resources/licenses/cargo/THIRD_PARTY_NOTICES.txt'
       - '.github/workflows/release-windows-check.yml'
   workflow_dispatch:

.github/workflows/release.yml

@@ -28,7 +28,6 @@ jobs:
       dmg: ${{ steps.identity.outputs.dmg }}
       exe: ${{ steps.identity.outputs.exe }}
       cli_archive: ${{ steps.identity.outputs.cli_archive }}
-      source_archive: ${{ steps.identity.outputs.source_archive }}
       node_version: ${{ steps.identity.outputs.node_version }}
       npm_version: ${{ steps.identity.outputs.npm_version }}
       node_archive: ${{ steps.identity.outputs.node_archive }}
@@ -321,66 +320,10 @@ jobs:
         if: always()
         run: rm -f "${{ runner.temp }}/AuthKey_Maka.p8"
 
-  source:
-    needs: release-identity
-    runs-on: ubuntu-latest
-    timeout-minutes: 20
-    defaults:
-      run:
-        shell: bash
-
-    steps:
-      - name: Check out the dispatched commit
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          ref: ${{ needs.release-identity.outputs.source_commit }}
-          persist-credentials: false
-
-      - name: Set up the pinned release Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with:
-          node-version: ${{ needs.release-identity.outputs.node_version }}
-          cache: npm
-
-      - name: Select and verify the pinned npm release toolchain
-        run: |
-          npm install --global --no-audit --no-fund "npm@${{ needs.release-identity.outputs.npm_version }}"
-          test "$(npm --version)" = "${{ needs.release-identity.outputs.npm_version }}"
-
-      - name: Install pinned dependency metadata
-        run: npm ci --ignore-scripts
-
-      - name: Materialize bundled Git source materials
-        run: npm run prepare:bundled-git-source
-
-      - name: Archive and hash source materials
-        env:
-          SOURCE_ARCHIVE: ${{ needs.release-identity.outputs.source_archive }}
-        run: |
-          archive_dir="apps/desktop/release-sources"
-          archive="${archive_dir}/${SOURCE_ARCHIVE}"
-          tar -C apps/desktop/release-sources/bundled-git -czf "$archive" .
-          (cd "$archive_dir" && sha256sum "$SOURCE_ARCHIVE" > "${SOURCE_ARCHIVE}.sha256")
-
-      - name: Stage the exact product artifact group
-        run: >-
-          node scripts/product-release-artifacts.mjs stage
-          "source"
-          apps/desktop/release-sources
-          "${{ runner.temp }}/release-assets"
-
-      - name: Upload verified source assets
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: release-source
-          path: ${{ runner.temp }}/release-assets
-          if-no-files-found: error
-          retention-days: 7
-
   publish:
     # One draft release carries both platforms, so it is created once, after
     # every platform has been packaged and verified.
-    needs: [release-identity, desktop, cli-macos-arm64, source]
+    needs: [release-identity, desktop, cli-macos-arm64]
     runs-on: ubuntu-latest
     timeout-minutes: 15
     permissions:
@@ -447,9 +390,7 @@ jobs:
 
           The Windows build is unsigned: SmartScreen warns on first launch, and the download has to be checked against its .sha256 file.
 
-          Bundled Git source materials and their checksum are attached to this draft. The packaged applications also carry the GPLv2 license and written source offer.
-
-          Known limitation: Computer Use is not included in this release."
+          Known limitations: Computer Use and managed-workspace execution are not included in this release. The ASF Desktop artifacts do not distribute a Git runtime."
 
           classification=(--prerelease=false --latest=false)
           if [[ "$IS_PRERELEASE" == "true" ]]; then

apps/desktop/electron-builder.config.mjs

@@ -11,41 +11,6 @@ const { runtimeHostSetupPackage } = resolveProductManifestIdentity({
   cliManifest: readManifest('../../packages/cli/package.json'),
 });
 
-// Git Credential Manager and the .NET runtime it needs are 223 files and
-// ~103 MiB of the bundled Git distribution, and Maka never runs them: every
-// git invocation sets `credential.helper=` explicitly
-// (`git-workspace-service.ts:1257`, `:2873`), so the helper is not merely
-// unused — it is switched off at the call site. Credentials live in Maka's
-// own `credentials.json` under the SECURITY.md permission contract.
-//
-// Excluded by name because the payload is interleaved with git's own commands
-// inside one flat `libexec/git-core` — there is no directory to drop. `.dll`
-// and `.dylib` appear nowhere else in the distribution, and every one of the
-// 16 dylibs is a .NET, Avalonia or Skia runtime library.
-// `**/*` rather than `*`: the runtime is not flat. Alongside the assemblies at
-// the top level, GCM ships 13 localisation directories each holding one
-// `System.CommandLine.resources.dll`, and on Linux two native UI libraries
-// (`libSkiaSharp.so`, `libHarfBuzzSharp.so`). A top-level-only glob leaves all
-// of them behind — which it did, until a review caught it against a real
-// package.
-//
-// `.so` is listed for the Linux distribution, where GCM is self-contained and
-// its Skia/HarfBuzz libraries sit beside the binary. Git's own commands in
-// this directory are executables and shell scripts, never `.dll`/`.dylib`/
-// `.so`, so the extension globs cannot reach them.
-const GIT_CREDENTIAL_MANAGER_EXCLUDES = [
-  '!libexec/git-core/**/*.dll',
-  '!libexec/git-core/**/*.dylib',
-  '!libexec/git-core/**/*.so',
-  '!libexec/git-core/git-credential-manager*',
-  '!libexec/git-core/createdump',
-  // GCM's own installation leftovers. `NOTICE` is its third-party attribution
-  // file, not git's — git's own notices live in `share/doc`, which this filter
-  // does not touch.
-  '!libexec/git-core/NOTICE',
-  '!libexec/git-core/uninstall.sh',
-];
-
 export default {
   appId: 'com.maka.desktop',
   productName: 'Maka',
@@ -82,15 +47,6 @@ export default {
     'dist/renderer/computer-use-overlay/**',
   ],
   extraResources: [
-    {
-      from: '../../node_modules/dugite/git',
-      to: 'git',
-      filter: ['**/*', ...GIT_CREDENTIAL_MANAGER_EXCLUDES],
-    },
-    {
-      from: 'bundled-git.json',
-      to: 'bundled-git.json',
-    },
     {
       from: 'bundled-tools.json',
       to: 'bundled-tools.json',
@@ -129,22 +85,6 @@ export default {
       from: '../../LICENSE',
       to: 'licenses/maka/LICENSE',
     },
-    {
-      from: '../../node_modules/dugite/LICENSE',
-      to: 'licenses/dugite/LICENSE',
-    },
-    {
-      from: 'resources/licenses/git/NOTICE.txt',
-      to: 'licenses/git/NOTICE.txt',
-    },
-    {
-      from: 'resources/licenses/git/LICENSE.txt',
-      to: 'licenses/git/LICENSE.txt',
-    },
-    {
-      from: 'resources/licenses/git/SOURCE_OFFER.txt',
-      to: 'licenses/git/SOURCE_OFFER.txt',
-    },
     {
       from: '../../NOTICE',
       to: 'licenses/maka/NOTICE',