[w3irdrobot]

Independent PR

Targets master directly and does not depend on #1331. Rebuilt as a single SSH-signed commit on current master; the old stacked history is preserved on a local backup branch. Production tauri.conf.json is unchanged.

Summary

• Extend the existing Maple Research Dev desktop profile to Linux using nix run --no-update-lock-file .#research-dev-desktop.
• Package a separate maple-research-dev RPM, command, launcher, icon, ONNX Runtime directory, app/storage identity, callback scheme, and single-instance identity. Dev updates stay disabled.
• Declare Dev runtime dependencies in desktop-dev-profile.json, using libwebkit2gtk-4.1.so.0()(64bit). The generated Dev config replaces any inherited production dependency policy and the Dev verifier checks its own requirement.
• Let the generic RPM builder consume an explicit Dev config without imposing Dev requirements on ordinary production packages.
• Preserve the payload isolation checks, unprivileged AppImage xattr handling, and RPM extraction SIGPIPE fix.

Independence checks

• Preserve WebKitGTK runtime requirements in Linux RPMs #1331’s commit is not an ancestor of this branch.
• No diff to production apps/maple-research/frontend/src-tauri/tauri.conf.json.
• Regression tests cover production RPM requirements being absent, Fedora-specific, or a different future policy; the Dev profile remains self-contained and leaves production config unchanged.
• A default production RPM fixture gains no Dev requirements. A real small Dev fixture RPM carries the Dev SONAME capability and separate name.
• Preserve WebKitGTK runtime requirements in Linux RPMs #1331 remains a separate draft for production dependency-policy review. The two PRs can be reviewed/merged in either order; overlapping generic builder edits may need normal merge reconciliation.

Try it

nix run --no-update-lock-file .#research-dev-desktop
sudo dnf install ./apps/maple-research/frontend/src-tauri/target/research-dev/maple-research-dev-3.4.6-1.x86_64.rpm

Open Maple Research Dev and use a hosted Dev account. No production endpoint changes, package signing, publication, or deployment are included.

Validation on the independent branch

• 10 Dev-profile tests, nine RPM-packaging tests, and five bundle-marker tests passed in the pinned CI shell, including a real small fixture RPM build.
• Bash syntax, git diff --cached --check, and just lane repo passed on x86_64 Linux.
• Commit 1a731bcf SSH signature verified locally and by GitHub (verified: true, reason: valid).
• Fresh full independent Dev RPM build passed. After the final verifier-routing amendment, re-extracted that RPM and passed the final Dev-only ELF, bundle-marker, profile, and dependency checks with the fixed Dev environment.
• Research Rust lane passed: 85 library tests and three binary tests; one model-backed OCR test ignored. The build/Rust run began before the final verifier-only amendment; native source was unchanged.
• Clean Fedora/openSUSE install-and-launch, simultaneous production/Dev use, storage separation, and real Dev OAuth smoke tests.
• macOS package rebuild/runtime validation.

Current master’s removal of embedded Research Agent Mode is preserved; no old Agent code or tests are restored.

[github-actions]

Maple Auth development preview: https://f052f027.maple-auth-dev.pages.dev

Commit: 1a731bcfbf2273c364028b4f4888525badd4b901

Uses development services. Cloudflare Access applies. Provider OAuth is not configured for PR URLs; use the stable Auth Dev host for OAuth rehearsal.

[github-actions]

Maple development preview: https://1e4e5622.maple-ca8.pages.dev

Commit: 1a731bcfbf2273c364028b4f4888525badd4b901

Uses development API, billing, flags and PCR configuration. Cloudflare Access applies.

[AnthonyRonning]

I'll take a look at this after some cicd cleanup. The main thing I'm worried about here is like every other distro we have. I don't think fedora is officially supported by tauri, i could be wrong. So I'm not sure how much we go out of our way here but this is not my wheelhouse.

[w3irdrobot]

Split as requested: #1331 contains only the WebKitGTK RPM dependency fix (four files); this PR now targets that branch and shows only side-by-side Dev packaging. Published history was preserved, and current master’s CI cleanup was retained while resolving the stack. Both branches passed their focused tests and the x86_64 Linux repo lane.

The cross-distro concern was confirmed: Fedora and openSUSE name the package differently but provide the same libwebkit2gtk-4.1.so.0()(64bit) capability. Research, sources, the synthetic RPM transaction experiment, and the proposed follow-up are recorded at #1331 (comment). The dependency PR remains a draft: the SONAME change and clean-distro install/launch evidence are still outstanding.

[AnthonyRonning]

I'm a bit confused by these PRs. This is a PR to another branch. This one is "ready" but not the one it is merging into. This one seems straight forward but it's still merging into one that still needs to be investigated further. Is that correct?

Does this PR actually depend on 1331? Should it just target master instead?

[w3irdrobot]

@AnthonyRonning You were right—the stack was unnecessary. I rebuilt this PR directly on master; #1331 also targets master, and neither depends on the other. Production’s Tauri config is unchanged here, and Dev owns and verifies its own RPM requirements.

The signed replacement commit is 1a731bcf (GitHub verified). The full Dev RPM build, final Dev-only artifact verification, focused packaging tests, repo lane, and Research Rust lane passed. The description now has the final results and remaining distro/runtime checks. #1331 remains draft pending its separate production dependency-policy work.

[AnthonyRonning]

Approving. Production packaging is unchanged, and the Dev package's identity, files and runtime state stay separate from production.

Non-blocking follow-up: the Linux Dev build will fail on aarch64 hosts. Tauri applies --config as an RFC 7396 merge onto tauri.conf.json, so production's bundle.linux.deb.files["/usr/lib/maple/libonnxruntime.so"] mapping survives the merge. That mapping points at the x64 ONNX Runtime. provide-linux-onnxruntime.sh only downloads the host architecture, so on aarch64 the deb bundler stops with "... does not exist" after the full compile. x86_64 is unaffected because the x64 file exists there, and stage-linux then removes the copied library. A one-line fix in linux_config would be to set that inherited key to None: merge-patch deletes it, and Tauri validates the schema against the merged config. That would also make the stage-linux unlink a pure safety net.

Heads-up: this conflicts with #1331 in scripts/ci/_common.sh and scripts/ci/test_linux_rpm_packaging.py. This PR already contains #1331's requires builder lines, so #1331 should shrink to the config change and its verifier after a rebase.