ADR-0004: Signed standalone distribution

Context

The CLI is implemented in TypeScript on Node.js, but end users should not need a JavaScript toolchain or package-registry identity. A private source repository also cannot serve anonymous artifacts directly without exposing source access assumptions.

Decision

GitHub Actions will build standalone artifacts for macOS arm64, Linux x64, and Windows x64. If source remains private, CI publishes only binaries, installers, checksums, a signed manifest, and release notes to a separate public distribution repository. Install and update use a signed Ed25519 manifest, artifact size and SHA-256 verification, atomic activation, and one-version rollback.

Consequences

• Packaging and release workflow tests are product-critical.
• Signing-key protection and recovery become operational responsibilities.
• Git tags and release assets are immutable; bad releases use a higher version.
• The Lovable site may provide branded links but is not the artifact source of truth.
• A later move to object storage or a CDN can preserve the same manifest contract and public verification key.

Validation required

Accept this decision after a clean tagged build installs, updates, fails safely on tampering, and rolls back on all supported targets without Node.js, npm, GitHub credentials, or administrator privileges.