[GoDeskio]

Summary

Signed-in vaults no longer show the upstream onboarding rail. Downloads is a persistent sidebar item, and the public marketing Downloads page is generated from the same release manifest. A link exists only when a build recorded a real file and its sha256. This branch does not deploy, change DNS, submit stores, or add signing credentials.

Commits: ca69ab1a (branding and vault layout), 69d8236d (downloads manifest), 71c4b843 (marketing page reads that manifest).

What is actually downloadable

Nothing in the committed manifest is a downloadable app. GitHub Releases have no assets. This checkout does not contain the Chromium zip, a production Android APK, or current desktop installers. The pages say "Not available" for each platform and do not show a download button or a QR code.

App	Downloadable from this PR	Blocker
Chromium extension 2026.10.1 (Chrome, Edge, Brave, Opera, Vivaldi, Cerebro)	No	Zip exists on the VM403 extension volume, not in git and not on a GitHub Release. The next komboe-clients image build copies the zip it compiles into the vault and fills the manifest. Unsigned. No store listing. Load-unpacked instructions are linked.
Firefox / Tor extension	No	No komboe-firefox.zip in the artifact directory.
Windows desktop	No	No verified current installer. Older unsigned builds are not republished.
Linux desktop (.deb and AppImage)	No	Same.
macOS desktop	No	No build. Needs Apple signing and notarization.
Android	No	Internal debug APK is refused. Device login, autofill, PIN, and biometric are unverified. Needs a release build and a signing identity. No Play listing.
iPhone	No	No build, App Store listing, or TestFlight. No QR code.

Downloads

scripts/build-downloads-manifest.py writes distribution/komboe-downloads.json. The vault page and apps/web-marketing/build.py both read it. The marketing site also copies it to apps/web-marketing/komboe-downloads.json.

docker/Dockerfile.clients runs the script after it builds komboe-chrome-mv3.zip, copies the zip into the web vault, and rewrites the manifest. The vault QR is drawn with the bundled qrious script from that install URL. The marketing page emits a QR only for an absolute https:// URL, generated locally with no third-party QR service. The same destination is a text link.

The public pages are the files in apps/web-marketing. Putting them on komboe.com is a hosting step. This change does not claim that domain is serving this commit.

Branding already on this branch

Terms, Privacy, help, and install links no longer go to bitwarden.com. Web favicons and the empty-vault mark use the Komboe kit. Import format names such as Bitwarden (json) stay. Cloud API hosts, WebAuthn callbacks, SMTP, ADMIN_TOKEN, and Traefik are unchanged.

Checks

• python3 tests/features/downloads_manifest.py passed. It published a fixture zip, downloaded it over HTTP, matched sha256 3141b338fe5ee7da23b659dc222207866d0a310aa890e4ce115793fc52db1317, refused a debug APK, decoded a locally generated QR back to that download URL, and checked the marketing page lists every unavailable platform from the same JSON.
• python3 tests/features/branding_surface.py passed on the earlier commit (link scan, favicon bytes, route inventory, screenshots). It was updated so the downloads page is no longer required to say "coming soon".
• Angular and Rust builds were not run. No image was built here, so this commit has no registry digest.

Screenshots

Public marketing Downloads page, generated from the shared manifest:

Vault Downloads with nothing published:

Fixture of the publisher after a zip exists. The QR is for that local test file, not a store listing and not the debug APK:

Vault before the onboarding rail was removed:

Still required outside this PR

• Rebuild and publish ghcr.io/godeskio/komboe-clients from this commit, then redeploy, before #/downloads can serve komboe-chrome-mv3.zip.
• Host apps/web-marketing if komboe.com should show this page. No DNS change was made, and the live domain was not verified.
• Windows and Linux installers need a verified rebuild. macOS also needs Apple signing and notarization.
• A production Android APK needs a release build and a signing identity. The debug APK must not be shipped.
• iOS needs an Apple build, signing, and App Store or TestFlight.
• Store submission and billing were not done.
• Per-user email 2FA interval and pattern unlock were not part of this change.

Rollback

Revert 71c4b843, 69d8236d, and ca69ab1a. No schema migration and no account-key change. The previous clients image does not contain this manifest.