simplify(release): retire unpublished-crate distribution

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -33,7 +33,7 @@ body:
     attributes:
       label: Installation method
       options:
-        - cargo install
+        - Built from source (Bazel)
         - Homebrew (brew)
         - Scoop
         - Built from source

.github/workflows/ci.yml

@@ -205,18 +205,11 @@ jobs:
         run: |
           python3 scripts/test-check-packaged-lsp-bridge.py
           python3 scripts/test-build-mcpb.py
-          python3 scripts/test-resolve-installed-binary.py
-          python3 scripts/test-check-packaged-mcp-stdio.py
-          python3 scripts/test-check-distribution-feature-wiring.py
-          python3 scripts/test-resolve-release-source-profile.py
           python3 scripts/test-package-release-archive.py
           python3 scripts/test-plan-release-recovery.py
           python3 scripts/test-check-release-artifacts.py
           python3 scripts/test-update-release-checksums.py
           python3 scripts/test-neutralize-release-pr-closing-keywords.py
-          bash scripts/test-check-distribution-clean-source.sh
-          bash scripts/test-check-distribution-snapshot.sh
-          bash scripts/test-check-distribution-reuse.sh
           bash tests/macos_stable_codesign_test.sh
 
       # Exercise the release guard scripts when admitting proposed changes.
@@ -702,6 +695,16 @@ jobs:
           archive: tar.gz
           epoch: ${{ steps.packaging.outputs.epoch }}
 
+      - name: Exercise shipped MCP and LSP transports
+        shell: bash
+        run: |
+          set -euo pipefail
+          binary="$GITHUB_WORKSPACE/target/x86_64-unknown-linux-gnu/release/tracedecay"
+          smoke_work="$(mktemp -d)"
+          trap 'rm -rf -- "$smoke_work"' EXIT
+          TRACEDECAY_BIN="$binary" bazel run //scripts:mcp-conformance-smoke.sh
+          bazel run //scripts:packaged_lsp_bridge -- "$binary" "$smoke_work/lsp"
+
   # Frontend checks require no Rust compilation and must also validate drafts.
   # Do not serialize them behind repository-wide Rust formatting and gates.
   dashboard:

.github/workflows/hawk.yml

@@ -6,8 +6,7 @@
 # softening -D warnings.
 name: Hawk
 
-# On demand only; see distribution-acceptance.yml for why nothing runs on a
-# timer here.
+# On demand only; an optional diagnostic should run when someone will read it.
 on:
   workflow_dispatch:
 

README.md

@@ -269,9 +269,9 @@ bazel build //...
 bazel test //... --test_output=errors
 ```
 
-Use Cargo when you need to validate Cargo packaging, a feature combination that
-has no Bazel target, or a platform-specific workflow. The release workflows
-continue to build the published Cargo artifact.
+Bazel owns workspace builds, tests, checks, and code generation. Release
+workflows package its production CLI as binary archives and MCP bundles;
+Rust workspace crates are private and are not published to crates.io.
 
 On macOS `tracedecay` is ad-hoc signed as `dev.tracedecay.cli` with
 designated requirement `identifier "dev.tracedecay.cli"`. macOS TCC keys
@@ -280,14 +280,9 @@ requirement is the binary's cdhash, so an Allow does not survive the next
 rebuild; the linker default identifier (`tracedecay-<hash>`) changes every
 build as well, and the daemon blocks in `open()` until the prompt is
 answered. A release build strips after linking, which mints that identifier
-again from the deps filename. Export
-`CARGO_BUILD_RUSTC_WORKSPACE_WRAPPER="$PWD/scripts/macos-rustc-wrapper.sh"`
-from the checkout root (the macOS CI and release jobs do) and the wrapper
-signs the product once rustc has finished, so `cargo build --release` and
-`cargo install --path crates/tracedecay-cli` keep the stable identity on
-the binary cargo copies into place. The committed Cargo config cannot set
-it, because Cargo has no per-target wrapper and Windows cannot run the
-script. `install.sh` and `tracedecay update`
+again from the deps filename. The shared release build action applies
+`scripts/macos-stable-codesign.sh` to the Bazel-built binary before packaging.
+`install.sh` and `tracedecay update`
 apply the same identity to the installed file after the archive checksum
 check when the binary is unsigned or ad-hoc signed, including an ad-hoc
 signature whose identifier already matches but whose requirement is still

crates/tracedecay-application/Cargo.toml

@@ -6,7 +6,6 @@ edition.workspace = true
 license = "MIT"
 repository = "https://github.com/ScriptedAlchemy/tracedecay"
 description = "TraceDecay product use cases shared by CLI, MCP, HTTP, hooks, and daemon adapters"
-include = ["/src/**"]
 
 [features]
 default = []

crates/tracedecay-capture/Cargo.toml

@@ -10,7 +10,6 @@ description = "Bounded event capture primitives for TraceDecay"
 readme = "README.md"
 keywords = ["ai", "code-intelligence", "observability", "capture"]
 categories = ["development-tools", "parsing"]
-include = ["/src/**", "/tests/**", "/README.md"]
 
 [dependencies]
 chrono = { version = "0.4.45", default-features = false, features = ["std"] }

crates/tracedecay-cli/Cargo.toml

@@ -6,18 +6,6 @@ edition.workspace = true
 description = "TraceDecay command-line interface and daemon binary"
 license = "MIT"
 repository = "https://github.com/ScriptedAlchemy/tracedecay"
-# Packaged-crate whitelist. `/dashboard/app-dist/**` is staged into the crate
-# directory by release packaging (the distribution gate validates it); the
-# packaged-crate mode in build.rs embeds it from there, mirroring the old
-# root-crate arrangement.
-include = [
-    "/build.rs",
-    "/build-support/**",
-    "/src/**",
-    "/tests/**",
-    "/dashboard/app-dist/**",
-    "!/src/resources/logo.png",
-]
 
 [[bin]]
 name = "tracedecay"

crates/tracedecay-cli/build.rs

@@ -110,22 +110,6 @@ impl EmbeddedDashboard {
         )
     }
 
-    fn packaged(
-        asset_paths: Vec<String>,
-        digest_hex: String,
-        app_dist: &Path,
-        out_dir: &Path,
-    ) -> Result<Self, Box<dyn Error>> {
-        Self::from_sources(
-            &asset_paths,
-            "CARGO_MANIFEST_DIR",
-            "/dashboard/app-dist",
-            app_dist,
-            out_dir,
-            digest_hex,
-        )
-    }
-
     fn from_sources(
         asset_paths: &[String],
         identity_include_env: &'static str,
@@ -233,30 +217,18 @@ impl EmbeddedDashboard {
 /// `TRACEDECAY_SKIP_DASHBOARD_BUILD` is set the prebuilt `dashboard/app-dist`
 /// is staged instead and must match the digest
 /// `TRACEDECAY_DASHBOARD_BUNDLE_SHA256` names, so a skip can never embed
-/// unproven bytes. Packaged crates carry a staged `dashboard/app-dist` whose
-/// integrity Cargo's package checksums already guarantee. A missing or invalid
-/// bundle always fails the build; there is no empty-assets fallback.
+/// unproven bytes. A missing or invalid bundle always fails the build;
+/// there is no empty-assets fallback.
 fn embed_dashboard(
     manifest_dir: &Path,
     out_dir: &Path,
 ) -> Result<EmbeddedDashboard, Box<dyn Error>> {
-    let package_local_dashboard = manifest_dir.join("dashboard");
-    if package_local_dashboard.is_dir() {
-        // Packaged-crate mode: release packaging staged the bundle into the
-        // crate directory and Cargo's checksums are the integrity authority.
-        let app_dist = package_local_dashboard.join("app-dist");
-        let asset_paths = dashboard_manifest::dashboard_asset_paths(&app_dist)?;
-        let digest_hex = dashboard_bundle::bundle_digest(&app_dist, &asset_paths)?;
-        return EmbeddedDashboard::packaged(asset_paths, digest_hex, &app_dist, out_dir);
-    }
-
     let repository_root = manifest_dir.join(REPOSITORY_ROOT_FROM_CRATE);
     let dashboard = repository_root.join("dashboard");
     if !dashboard.join("package.json").is_file() {
         return Err(format!(
-            "no dashboard to embed: {} has no package-local dashboard/ and {} has no \
-             package.json; a tracedecay binary cannot build without its dashboard bundle",
-            manifest_dir.display(),
+            "no dashboard to embed: {} has no package.json; a tracedecay binary cannot \
+             build without its dashboard bundle",
             dashboard.display(),
         )
         .into());

crates/tracedecay-code-extraction/Cargo.toml

@@ -7,15 +7,6 @@ license = "MIT"
 repository = "https://github.com/ScriptedAlchemy/tracedecay"
 description = "Tree-sitter language extraction for TraceDecay"
 build = "build.rs"
-include = [
-    "/src/**",
-    "/fixtures/**",
-    "/tests/**",
-    "/vendor/tree-sitter-wgsl/src/**",
-    "/vendor/tree-sitter-wgsl/LICENSE",
-    "/vendor/tree-sitter-wgsl/PROVENANCE.md",
-    "/build.rs",
-]
 
 [features]
 default = ["lite", "medium", "full"]

crates/tracedecay-code-index/Cargo.toml

@@ -6,7 +6,6 @@ edition.workspace = true
 license = "MIT"
 repository = "https://github.com/ScriptedAlchemy/tracedecay"
 description = "In-process structural code search for TraceDecay"
-include = ["/src/**"]
 
 [features]
 default = [

crates/tracedecay-global-db/Cargo.toml

@@ -6,7 +6,6 @@ edition.workspace = true
 license = "MIT"
 description = "TraceDecay user-level global database: project registry, observations, session temporal store"
 repository = "https://github.com/ScriptedAlchemy/tracedecay"
-include = ["/src/**"]
 
 [features]
 # Explicit opt-in (same policy as the query kernel): exposes the registered

crates/tracedecay-graph-db/Cargo.toml

@@ -6,7 +6,6 @@ edition.workspace = true
 license = "MIT"
 description = "Embedded graph storage boundary for TraceDecay"
 repository = "https://github.com/ScriptedAlchemy/tracedecay"
-include = ["/src/**"]
 
 [features]
 test-helpers = []

crates/tracedecay-graph-query/Cargo.toml

@@ -6,7 +6,6 @@ edition.workspace = true
 license = "MIT"
 repository = "https://github.com/ScriptedAlchemy/tracedecay"
 description = "Generation-pinned verified code-graph queries and code-index-backed source readers"
-include = ["/src/**"]
 
 [dependencies]
 serde_json = "1"

crates/tracedecay-lcm/Cargo.toml

@@ -6,7 +6,6 @@ edition.workspace = true
 license = "MIT"
 description = "Lossless context memory engine: contracts, raw ingest, summary DAG, payload authority, retrieval, GC, and retention"
 repository = "https://github.com/ScriptedAlchemy/tracedecay"
-include = ["/src/**", "/tests/**"]
 
 [features]
 # Repo-wide `test-helpers` convention: exposes this crate's test-only helper

crates/tracedecay-privacy/Cargo.toml

@@ -6,7 +6,6 @@ edition.workspace = true
 license = "MIT"
 repository = "https://github.com/ScriptedAlchemy/tracedecay"
 description = "TraceDecay privacy authority: credential detection, record sanitization, and protected structural identifiers"
-include = ["/src/**"]
 
 [features]
 default = []

crates/tracedecay-query/Cargo.toml

@@ -6,7 +6,6 @@ edition.workspace = true
 license = "MIT"
 repository = "https://github.com/ScriptedAlchemy/tracedecay"
 description = "TraceDecay exact/lexical/graph code retrieval query kernel and search-quality candidate/profile inputs"
-include = ["/src/**", "/assets/**"]
 
 [dependencies]
 # Raw deflate for lexical row text; already in the tree through

crates/tracedecay-search-eval/Cargo.toml

@@ -6,7 +6,6 @@ edition.workspace = true
 license = "MIT"
 description = "TraceDecay search-quality evaluator: exact/lexical/graph candidate generation and direct evaluation"
 repository = "https://github.com/ScriptedAlchemy/tracedecay"
-include = ["/assets/**", "/src/**"]
 
 [dependencies]
 clap = { version = "4.6", features = ["derive"] }

crates/tracedecay-session-memory/Cargo.toml

@@ -6,7 +6,6 @@ edition.workspace = true
 license = "MIT"
 repository = "https://github.com/ScriptedAlchemy/tracedecay"
 description = "Session retrieval, project memory, provider usage, and runtime telemetry use cases shared by CLI, MCP, and host-admission adapters"
-include = ["/src/**"]
 
 [features]
 default = []

crates/tracedecay-session-temporal-store/Cargo.toml

@@ -6,7 +6,6 @@ edition.workspace = true
 license = "MIT"
 description = "Session-temporal projection, retrieval, and LCM hydration store"
 repository = "https://github.com/ScriptedAlchemy/tracedecay"
-include = ["/src/**"]
 
 [features]
 # Exposes package-owned fixture constructors to dependent package tests only.

crates/tracedecay-sessions/Cargo.toml

@@ -6,7 +6,6 @@ edition.workspace = true
 license = "MIT"
 repository = "https://github.com/ScriptedAlchemy/tracedecay"
 description = "TraceDecay session parsing and retrieval primitives"
-include = ["/src/**", "/tests/**"]
 
 [features]
 # Repo-wide `test-helpers` convention: exposes this crate's test-only helper

crates/tracedecay-temporal-query/Cargo.toml

@@ -6,7 +6,6 @@ edition.workspace = true
 license = "MIT"
 repository = "https://github.com/ScriptedAlchemy/tracedecay"
 description = "TraceDecay temporal retrieval and context assembly kernel"
-include = ["/src/**"]
 
 [dependencies]
 hex = "0.4"