8. Distribution (v1)

Delivered by .github/workflows/release.yml on a pushed v* tag (ADR-0038, ADR-0115). One archive per artifact — zips, and a .tar.gz for Linux — attached to a GitHub prerelease: a plain download URL, no account needed, because the repository is public. The studio’s archives are its own (ADR-0178) and are not listed here.

• Windows: ritmolux.exe, x64, unsigned (SmartScreen warning accepted).
• macOS: a universal (arm64 + Intel) Ritmolux.app, ad-hoc signed and unnotarized. Ad-hoc signing buys a stable code identity for the Screen Recording grant to bind to; it is not Developer ID, so Gatekeeper still quarantines the download and the grant does not survive a rebuild. Requires macOS 13+.
• Linux: ritmolux, x86_64, in a .tar.gz, built on ubuntu-24.04, so that image’s glibc is the floor (Ubuntu 24.04). Links libpulse.so.0 and will not start without it (ADR-0131).
• foobar2000 component: foo_ritmolux.fb2k-component, x64 only, for foobar2000 v2. Built by packaging/foobar/build-component.ps1 against a pinned, checksummed SDK release that the workflow fetches (packaging/foobar/sdk-pin.ps1). Unsigned, like the rest.
• Every archive carries a READ-ME-FIRST.txt; the standalone ones also carry a reference copy of presets/*.toml.

The component ships as of Plan 0102 (2026-08-16). This paragraph previously read “Standalone only — CI does not ship a .fb2k-component”, on the grounds that the SDK is third-party, separately licensed and .gitignore’d, so no runner could build the shim. The licence was then read rather than assumed: it is BSD-style, permits binary redistribution, and puts a notice obligation only on redistributed source — so the workflow fetches the SDK and the component is a released artifact. The SDK is still never committed (ADR-0115 Alternative A).

Nothing in CI can test the component. No runner loads foobar2000, so its installation and visualisation_stream behaviour are checked by hand and recorded in On-device validation — the same gap the macOS path has, named rather than solved.

No installer, no Developer ID signing, no notarization, no DMG in v1. Signing, if ever, is a later plan + human task.