Calliope: a native macOS client for Muse

# Calliope — release artifacts only

This repository holds **release artifacts only**. It contains **no source code**.

Calliope is an unofficial, independent native macOS client for Meta's Muse. The
application source, issues, and development history live in a separate, private
repository.

## What is here

Each GitHub Release in this repository carries exactly two assets:

| Asset | Purpose |
| --- | --- |
| `appcast.xml` | The Sparkle 2 update feed the shipped app polls |
| `Calliope-<version>.dmg` | The Developer ID-signed, notarized installer |

The shipped app reads its feed from the tag-independent permalink:

```
https://github.com/willsigmon/calliope-releases/releases/latest/download/appcast.xml
```

`releases/latest/download/<asset>` resolves to the newest **non-draft,
non-prerelease** release's asset of that exact name, so the feed URL is stable
across versions and only the asset content changes.

## Why this repository is public

Sparkle's default fetcher sends no credentials. GitHub serves release assets of a
private repository only to authenticated clients, so a feed hosted in the private
source repository returns **HTTP 404** to the app. Publishing the feed here, in a
public repository with no source in it, is what makes it reachable anonymously.

Nothing in this repository is sensitive: the DMG is publicly distributed anyway,
and the appcast carries an Ed25519 signature over the DMG that the app verifies
against the `SUPublicEDKey` baked into the shipped binary. A tampered feed cannot
deliver a forged update.

## Do not

- Do not add source code, secrets, or configuration here.
- Do not make this repository private — that would break auto-update for every
  installed copy.
- Do not rename the release assets; `appcast.xml` in particular is what
  `releases/latest/download/` resolves.

Release mechanics live in the private source repository's `docs/RELEASING.md`.