feat: prepare Mesh 0.2.0 beta source

.github/CODEOWNERS

@@ -1,9 +1,15 @@
 * @dhawal-ss
 
 # Release publication and its security policy require an owner review.
+/.github/workflows/ @dhawal-ss
+/.github/dependabot.yml @dhawal-ss
+/.github/CODEOWNERS @dhawal-ss
 /.github/workflows/release-beta.yml @dhawal-ss
 /.github/workflows/security.yml @dhawal-ss
 /.github/dependency-review-config.yml @dhawal-ss
+/mesh/release/ @dhawal-ss
+/mesh/infra/ @dhawal-ss
+/mesh/docs/operations/ @dhawal-ss
 /mesh/scripts/beta-release-preflight.ps1 @dhawal-ss
 /mesh/scripts/check-matrix-release-dependencies.ps1 @dhawal-ss
 /mesh/scripts/rust-dependency-policy.json @dhawal-ss

.github/dependabot.yml

@@ -45,3 +45,50 @@ updates:
     labels:
       - dependencies
       - rust
+
+  - package-ecosystem: npm
+    directory: /mesh/feature-deps/matrix-voice
+    schedule:
+      interval: weekly
+      day: monday
+      time: "08:35"
+      timezone: America/Chicago
+    open-pull-requests-limit: 3
+    labels: [dependencies, matrix-voice]
+
+  - package-ecosystem: npm
+    directory: /mesh/feature-deps/legacy-lan
+    schedule:
+      interval: weekly
+      day: monday
+      time: "08:40"
+      timezone: America/Chicago
+    open-pull-requests-limit: 3
+    labels: [dependencies, legacy-lan]
+
+  - package-ecosystem: docker
+    directory: /mesh/infra/homeserver
+    schedule:
+      interval: weekly
+      day: monday
+      time: "08:45"
+      timezone: America/Chicago
+    labels: [dependencies, containers, homeserver]
+
+  - package-ecosystem: docker
+    directory: /mesh/infra/matrixrtc
+    schedule:
+      interval: weekly
+      day: monday
+      time: "08:50"
+      timezone: America/Chicago
+    labels: [dependencies, containers, matrixrtc]
+
+  - package-ecosystem: docker
+    directory: /mesh/infra/matrix-spike
+    schedule:
+      interval: weekly
+      day: monday
+      time: "08:55"
+      timezone: America/Chicago
+    labels: [dependencies, containers, matrix-spike]

.github/workflows/ci.yml

@@ -21,7 +21,7 @@ jobs:
       matrix:
         os: [ubuntu-latest, windows-latest]
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@d0befba8b9ddf874327619e84c39b094edd58b66 # 1.93.0
@@ -41,7 +41,7 @@ jobs:
             libsqlcipher-dev
 
       - name: Cache cargo registry & build
-        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: |
             ~/.cargo/registry
@@ -78,7 +78,7 @@ jobs:
     name: Legacy LAN Rust
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@d0befba8b9ddf874327619e84c39b094edd58b66 # 1.93.0
@@ -95,7 +95,7 @@ jobs:
             libsqlcipher-dev
 
       - name: Cache cargo registry & legacy build
-        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: |
             ~/.cargo/registry
@@ -120,18 +120,21 @@ jobs:
     name: Frontend Build & Browser E2E
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           # The readiness validator binds sourceTreeHash to an exact historical
           # sourceCommit, so a synthetic depth-one PR merge is insufficient.
           fetch-depth: 0
 
       - name: Setup Node.js
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 22
           cache: npm
-          cache-dependency-path: mesh/package-lock.json
+          cache-dependency-path: |
+            mesh/package-lock.json
+            mesh/feature-deps/matrix-voice/package-lock.json
+            mesh/feature-deps/legacy-lan/package-lock.json
 
       - name: Install dependencies
         working-directory: mesh
@@ -157,6 +160,10 @@ jobs:
         working-directory: mesh
         run: npm run check:icons
 
+      - name: Check bundled interface sounds
+        working-directory: mesh
+        run: npm run check:interface-sounds
+
       - name: Check reviewed public services
         working-directory: mesh
         run: npm run check:public-services
@@ -177,6 +184,10 @@ jobs:
         working-directory: mesh
         run: npm run check:public-site
 
+      - name: Check approved owner decisions
+        working-directory: mesh
+        run: npm run check:owner-decisions
+
       - name: Check beta product boundary
         working-directory: mesh
         run: npm run check:beta-contract
@@ -206,13 +217,23 @@ jobs:
         working-directory: mesh
         run: npm run test -- --maxWorkers=4
 
+      - name: Test isolated voice dependency graphs
+        working-directory: mesh
+        run: npm run test:voice-features
+
+      - name: Build isolated acceptance frontends
+        working-directory: mesh
+        run: |
+          npm run build:matrix-voice
+          npm run build:lan
+
       - name: Build frontend
         working-directory: mesh
         run: npm run build
 
       - name: Enforce frontend entry bundle budget
         working-directory: mesh
-        run: npm run check:bundle-size
+        run: npm run check:bundle-size -- --report release/bundle-report.json
 
       - name: Install Playwright browser
         working-directory: mesh
@@ -221,3 +242,57 @@ jobs:
       - name: Run browser E2E tests and WCAG scans
         working-directory: mesh
         run: npm run e2e
+
+  protected-evidence:
+    name: Protected CI evidence manifest
+    if: always()
+    needs: [matrix-rust, legacy-rust, check-frontend]
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 22
+      - name: Fail closed unless every protected job passed
+        env:
+          MATRIX_RUST: ${{ needs.matrix-rust.result }}
+          LEGACY_RUST: ${{ needs.legacy-rust.result }}
+          FRONTEND: ${{ needs.check-frontend.result }}
+        run: |
+          node -e "const fs=require('fs'); const results={matrixRust:process.env.MATRIX_RUST,legacyRust:process.env.LEGACY_RUST,frontend:process.env.FRONTEND}; fs.mkdirSync('mesh/release',{recursive:true}); fs.writeFileSync('mesh/release/ci-run-results.json',JSON.stringify({schemaVersion:1,sourceSha:process.env.GITHUB_SHA,results},null,2)+'\n'); if(Object.values(results).some(v=>v!=='success')) process.exit(1)"
+      - name: Upload protected CI payload
+        id: payload
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: ci-r0-payload-${{ github.sha }}
+          path: mesh/release/ci-run-results.json
+          if-no-files-found: error
+          retention-days: 90
+      - name: Generate protected CI evidence manifest
+        working-directory: mesh
+        run: |
+          node scripts/protected-evidence-manifest.mjs \
+            --source-sha "${{ github.sha }}" \
+            --tree-hash "$(git rev-parse HEAD^{tree})" \
+            --workflow-name CI \
+            --run-id "${{ github.run_id }}" \
+            --run-attempt "${{ github.run_attempt }}" \
+            --workflow-uri "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}" \
+            --payload-path release/ci-run-results.json \
+            --payload-name ci-r0-payload-${{ github.sha }} \
+            --payload-uri "${{ steps.payload.outputs.artifact-url }}" \
+            --payload-digest "${{ steps.payload.outputs.artifact-digest }}" \
+            --command "matrix-rust + legacy-rust + check-frontend protected jobs" \
+            --build-mode matrix-text \
+            --features matrix-backend,legacy-p2p \
+            --retention-days 90 \
+            --output release/ci-protected-evidence-manifest.json
+      - name: Upload protected CI evidence manifest
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: ci-protected-evidence-${{ github.sha }}
+          path: mesh/release/ci-protected-evidence-manifest.json
+          if-no-files-found: error
+          retention-days: 90

.github/workflows/developer-preview.yml

@@ -20,8 +20,8 @@ jobs:
       id-token: write
       attestations: write
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 22
           cache: npm
@@ -56,6 +56,10 @@ jobs:
         shell: pwsh
         run: npm run tauri -- build --features matrix-backend -- --no-default-features --locked --jobs 1
 
+      - name: Verify compiled installer coexistence controls
+        shell: pwsh
+        run: ./mesh/scripts/check-compiled-installer-coexistence.ps1 -BundleRoot mesh/src-tauri/target/release/bundle
+
       - name: Generate SBOMs and preview evidence
         shell: pwsh
         run: |
@@ -105,7 +109,7 @@ jobs:
           subject-path: "mesh/developer-preview-staging/*"
 
       - name: Upload developer-preview artifact
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: Mesh-Windows-UNSIGNED-DEVELOPER-PREVIEW-${{ github.sha }}
           path: mesh/developer-preview-staging/

.github/workflows/matrix-federation-acceptance.yml

@@ -28,10 +28,10 @@ jobs:
       RUST_BACKTRACE: "1"
       RUST_LOG: warn
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup Node.js
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 22
           cache: npm
@@ -54,7 +54,7 @@ jobs:
             gnome-keyring
 
       - name: Cache Matrix test build
-        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: |
             ~/.cargo/registry
@@ -123,7 +123,7 @@ jobs:
 
       - name: Upload acceptance logs
         if: ${{ always() }}
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: matrix-federation-acceptance-${{ github.sha }}-${{ github.run_number }}
           path: mesh/matrix-spike-logs/

.github/workflows/nightly-soak.yml

@@ -42,7 +42,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Repeatedly restore real Synapse backups into isolated services
         working-directory: mesh
@@ -78,7 +78,7 @@ jobs:
 
       - name: Upload repeated restore evidence
         if: always()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: homeserver-restore-drill-${{ github.sha }}-${{ github.run_number }}
           path: mesh/restore-drill-evidence/
@@ -90,7 +90,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@d0befba8b9ddf874327619e84c39b094edd58b66 # 1.93.0
@@ -107,7 +107,7 @@ jobs:
             libsqlcipher-dev
 
       - name: Cache cargo registry & build
-        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: |
             ~/.cargo/registry
@@ -140,7 +140,7 @@ jobs:
 
       - name: Upload soak logs
         if: always()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: soak-logs-${{ github.run_number }}
           path: mesh/soak-logs/
@@ -151,10 +151,10 @@ jobs:
     runs-on: windows-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup Node.js
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 22
           cache: npm
@@ -172,7 +172,7 @@ jobs:
 
       - name: Upload resource evidence
         if: always()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: browser-resource-budget-${{ github.run_number }}
           path: mesh/test-results/resource-budget-browser.json
@@ -188,7 +188,7 @@ jobs:
     if: ${{ vars.MESH_NIGHTLY_TURN_ENABLED == 'true' }}
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@d0befba8b9ddf874327619e84c39b094edd58b66 # 1.93.0
@@ -199,7 +199,7 @@ jobs:
           sudo apt-get install -y libsqlcipher-dev libssl-dev
 
       - name: Cache cargo
-        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: |
             ~/.cargo/registry

.github/workflows/pages.yml

@@ -22,8 +22,8 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 22
           cache: npm
@@ -52,7 +52,7 @@ jobs:
       pages: write
       id-token: write
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Configure Pages
         uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5
       - name: Upload static site