# Staged MVP release plan — DEC-002 channels

| Version | Date | Status |
|---|---|---|
| 0.1.0 | 2026-05-15 | Initial draft alongside v1.0.0-rc.1 |

## Purpose

DEC-002 in `product-decision-register.md` accepts a five-platform
MVP target (Windows, macOS, Linux, Android, iOS) and explicitly
permits a **staged release** in which not all platforms ship on the
same day. This document records the staging plan for the MVP public
release.

## Channel definitions

* **GA — Linux desktop**: x86_64 GNU/Linux. Direct distribution
  via the GitHub Releases page (release tarball + AppImage when
  the bundle is added). No app store.
* **GA — Android**: arm64-v8a APK. Direct distribution from the
  Releases page during early MVP. Play Store submission deferred
  until DEC-012 legal sign-off includes Play-specific consumer-
  protection review (`docs/governance/legal-review-readiness.md`
  §9). Other Android ABIs (armeabi-v7a, x86_64) are deferred to
  v1.1.
* **Beta — Windows**: x86_64 MSI / portable zip. The build steps
  are documented in `docs/release/windows-build.md`; a live
  artefact has not yet been produced because the development
  toolchain ran on Linux. Public bits land once a Windows builder
  produces a signed artefact.
* **Beta — macOS**: Apple Silicon (`aarch64-apple-darwin`) + Intel
  (`x86_64-apple-darwin`) universal `.app`. Same gating as Windows:
  build documentation only at v1.0.0-rc.1; an Apple-side builder
  must produce a notarised artefact.
* **Beta — iOS**: arm64 IPA. Same gating; in addition the
  `mobile_voice_preset` AAudio engagement on Android is documented
  as a routing hint, and the iOS equivalent
  (`AVAudioSession.Mode.voiceChat`) is not yet wired.

## Promotion schedule

Each row triggers when the listed prerequisite is satisfied. There
is no calendar.

| Order | Channel | Prerequisite |
|---|---|---|
| 1 | Linux GA | DEC-012 legal sign-off; `v1.0.0` tag cut from `v1.0.0-rc.N` after all RC reviews close. |
| 2 | Android GA (sideload) | Same prerequisite; APK signed with the project key; Releases page updated. |
| 3 | Android Play Store | DEC-012 §9 Play-listing review complete; signing key migrated to Play App Signing if not already there. |
| 4 | Windows Beta | Live x86_64 Windows builder produces a signed MSI; smoke test on a Windows 11 host that the build host can verify. |
| 5 | macOS Beta | Live `aarch64-apple-darwin` build with code-signing certificate and notarisation; smoke test. |
| 6 | iOS Beta | TestFlight build cycle; per-device entitlement review; mic permission flow validated. |
| 7 | Windows / macOS / iOS GA | Each platform promoted from Beta after its first round of public-Beta feedback is triaged. |

## Per-platform readiness as of v1.0.0-rc.1

### Linux x86_64

* Cargo build: green (`cargo check --workspace`, `cargo test
  --workspace` with `CHANORA_DISABLE_KEYRING=1`).
* Flutter build: `flutter build linux --release` documented; live
  bundle exists at `apps/chanora_flutter/build/linux/x64/`.
* Audio: cpal-on-PipeWire / ALSA verified through Beta lifecycle.
* Secure storage: Secret Service via D-Bus when a session is
  available; file-fallback when not.
* Status: **GA-ready** pending DEC-012.

### Android arm64-v8a

* Cargo + cargo-ndk build: green; the APK pipeline produced
  `app-release.apk` for v0.4.0-beta.2.
* Audio: cpal-on-AAudio with `AudioManager.MODE_IN_COMMUNICATION`
  engaged via JNI on engine start.
* Secure storage: keyring crate falls back to file on Android in
  v1.0.0-rc.1 (no Android Keystore wiring yet). The identity and
  bookmark passwords remain ChaCha20-Poly1305-encrypted under the
  file-DEK in this configuration.
* Status: **GA-ready for sideload** pending DEC-012; Play Store
  promotion is a separate gate.

### Windows / macOS / iOS

* Build docs exist (`docs/release/windows-build.md`,
  `docs/release/ios-build.md`); macOS does not have a dedicated
  doc yet because the build is a straightforward
  `flutter build macos` once Apple-side signing is configured.
* Status: **Beta-track**. The RC tag still ships for these
  platforms in source form (anyone with the appropriate toolchain
  can build), but no signed binary is included.

## Rollback policy

Each platform's Releases-page artefact carries the exact `v1.0.0-rc.N`
or `v1.0.0` tag. If a critical regression surfaces in a channel:

1. Mark the affected Releases asset "deprecated — do not download" in
   the GitHub UI within 24h.
2. Cut a `v1.0.x` patch from the `release-1.0` branch (created
   when `v1.0.0` is tagged).
3. Re-promote per the schedule above; no platform fast-tracks the
   schedule, no platform skips a channel.

## Out-of-scope for MVP

* iOS hardware AEC engagement (`AVAudioSession.Mode.voiceChat`).
* Android `setInputPreset(VOICE_COMMUNICATION)` (RISK-AUDIO-MOBILE-001).
* Android Keystore-backed DEK (the file-fallback path is exercised in
  the current build).
* Multi-server connection (DEC-006: explicitly out of MVP).
* Crash reporting (DEC-017: explicitly disabled).
* Automatic diagnostic upload (DEC-016: user-initiated only).
