build.yml

name: Build

on:
  push:
    branches: [main]
    tags: ['v*']
  # Qualify every review branch, including stacked acquisition repairs.
  pull_request: {}
  workflow_dispatch:
    inputs:
      build_candidates:
        description: Build the sixteen unsigned candidate artifacts without creating a tag or release
        type: boolean
        default: false
      expected_source:
        description: Exact 40-character source commit required when build_candidates is true
        type: string
        default: ''

permissions:
  contents: read

# Only superseded PR work is obsolete. Never cancel a version-tag build.
concurrency:
  group: build-${{ github.event.pull_request.number || github.run_id }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

env:
  CARGO_TERM_COLOR: always
  CARGO_INCREMENTAL: '0'

jobs:
  lint-workflows:
    name: Workflow and release contracts
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@v6
      - uses: actions/setup-node@v6
        with:
          node-version-file: .node-version
      - uses: actions/setup-python@v6
        with:
          python-version-file: .python-version
      - name: Verify explicit build-only source selection
        if: github.event_name == 'workflow_dispatch' && inputs.build_candidates
        env:
          EXPECTED_SOURCE: ${{ inputs.expected_source }}
        run: |
          python - <<'PYTHON'
          import os, re, subprocess
          expected = os.environ['EXPECTED_SOURCE']
          actual = subprocess.check_output(['git', 'rev-parse', 'HEAD'], text=True).strip()
          if re.fullmatch('[0-9a-f]{40}', expected) is None or expected != actual:
              raise SystemExit('build-only dispatch requires the exact checked-out source commit')
          PYTHON
      - name: Run checksum-pinned actionlint with shell and Python checks
        shell: bash
        run: |
          set -euo pipefail
          python -m pip install pyflakes==3.3.2
          command -v shellcheck
          command -v pyflakes
          tool_dir="$(mktemp -d)"
          trap 'rm -rf "$tool_dir"' EXIT
          curl --fail --location --retry 3 \
            https://github.com/rhysd/actionlint/releases/download/v1.7.8/actionlint_1.7.8_linux_amd64.tar.gz \
            --output "$tool_dir/actionlint.tar.gz"
          echo "be92c2652ab7b6d08425428797ceabeb16e31a781c07bc388456b4e592f3e36a  $tool_dir/actionlint.tar.gz" | sha256sum --check
          tar -xzf "$tool_dir/actionlint.tar.gz" -C "$tool_dir" actionlint
          "$tool_dir/actionlint" -color
      - run: npm run check:dependency-ownership
      - run: npm run check:release-versions
      - run: node scripts/release/check-attribution.cjs
      - run: node scripts/release/check-attribution.cjs --features s3
      - run: node --test scripts/release/*.test.mjs
      - uses: actions/setup-python@v6
        with:
          python-version-file: .python-version
      - run: python scripts/release/test_s3_build_provenance.py

  rust-quality:
    name: Rust quality
    needs: lint-workflows
    runs-on: ubuntu-24.04
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@v6
      # Reads the repository's rust-toolchain.toml; no second toolchain pin.
      - name: Install repository Rust toolchain
        run: rustup toolchain install --no-self-update
      - uses: Swatinem/rust-cache@v2
        with:
          workspaces: rust -> target
          key: quality
      - run: ./scripts/rust/check.sh

  headless:
    name: Headless without inference plugins
    needs: lint-workflows
    runs-on: ubuntu-24.04
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@v6
      - name: Install repository Rust toolchain
        run: rustup toolchain install --no-self-update
      - uses: Swatinem/rust-cache@v2
        with:
          workspaces: rust -> target
          key: headless
      - run: cargo fetch --locked --manifest-path rust/Cargo.toml
      - run: python3 scripts/release/check-dependency-features.py --s3
      # Ordinary default/headless jobs omit the optional reader. These explicit
      # local-protocol checks qualify enabled S3 without cloud credentials.
      - name: Test enabled S3 reader and shared acquisition
        run: cargo test --locked --offline --manifest-path rust/Cargo.toml -p pumas-library --no-default-features --features s3 --test s3_reader --test s3_acquisition -- --test-threads=1
      - name: Test enabled S3 signing and bounded prefix discovery
        run: 'cargo test --locked --offline --manifest-path rust/Cargo.toml -p pumas-library --no-default-features --features s3 --lib acquisition::s3:: -- --test-threads=1'
      - name: Lint enabled S3 implementation
        run: cargo clippy --locked --offline --manifest-path rust/Cargo.toml -p pumas-library --no-default-features --features s3,test-support --all-targets -- -D warnings
      # Separate package invocations prevent workspace feature unification from
      # silently enabling the features this gate is supposed to exclude.
      - run: cargo test --locked --manifest-path rust/Cargo.toml -p pumas-library --no-default-features
      - name: Require actual Linux audio read-confinement proof
        run: cargo test --locked --manifest-path rust/Cargo.toml -p pumas-library --no-default-features platform::audio_read_boundary::tests::kernel_exec_denies_unselected_reads_and_ambient_descriptors -- --ignored --exact --nocapture
      - run: cargo test --locked --manifest-path rust/Cargo.toml -p pumas-library --no-default-features --features hf-client
      - run: cargo test --locked --manifest-path rust/Cargo.toml -p pumas-rpc --no-default-features
      - name: Build inference-disabled release backend
        if: (github.ref_type == 'tag' && startsWith(github.ref_name, 'v')) || (github.event_name == 'workflow_dispatch' && inputs.build_candidates)
        run: cargo build --locked --manifest-path rust/Cargo.toml -p pumas-rpc --release --no-default-features
      - name: Verify inference-disabled release backend
        if: (github.ref_type == 'tag' && startsWith(github.ref_name, 'v')) || (github.event_name == 'workflow_dispatch' && inputs.build_candidates)
        run: python3 scripts/release/smoke-rpc.py rust/target/release/pumas-rpc --inference-disabled

  headless-rpc:
    name: Headless archive (${{ matrix.headless_os }})
    needs: lint-workflows
    if: (github.ref_type == 'tag' && startsWith(github.ref_name, 'v')) || (github.event_name == 'workflow_dispatch' && inputs.build_candidates)
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-24.04
            headless_os: linux
          - os: macos-15
            headless_os: macos
          - os: windows-2025
            headless_os: windows
    runs-on: ${{ matrix.os }}
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@v6
      - name: Install repository Rust toolchain
        run: rustup toolchain install --no-self-update
      - uses: Swatinem/rust-cache@v2
        with:
          workspaces: rust -> target
          key: headless-archive
      - run: cargo fetch --locked --manifest-path rust/Cargo.toml
      - run: python scripts/release/check-dependency-features.py
      - name: Build inference-disabled backend
        run: cargo build --locked --manifest-path rust/Cargo.toml -p pumas-rpc --release --no-default-features
      - name: Verify inference routes are absent
        run: python scripts/release/smoke-rpc.py rust/target/release --inference-disabled
      - name: Assemble headless archive
        run: python scripts/release/make-headless-archive.py --binary rust/target/release --output-dir headless-output --os ${{ matrix.headless_os }}
      - name: Verify expected archive
        run: node scripts/release/check-artifacts.mjs headless-output headless-${{ matrix.headless_os }}
      - uses: actions/upload-artifact@v7.0.1
        with:
          name: headless-${{ matrix.headless_os }}
          path: headless-output/
          if-no-files-found: error

  headless-inference:
    name: Inference headless candidate (${{ matrix.target }})
    needs: lint-workflows
    if: (github.ref_type == 'tag' && startsWith(github.ref_name, 'v')) || (github.event_name == 'workflow_dispatch' && inputs.build_candidates)
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-24.04
            target: linux-x86_64
            binary: pumas-rpc
            check: linux
          - os: windows-2025
            target: windows-x86_64
            binary: pumas-rpc.exe
            check: windows
          - os: macos-15
            target: macos-arm64
            binary: pumas-rpc
            check: macos
    runs-on: ${{ matrix.os }}
    timeout-minutes: 150
    steps:
      - uses: actions/checkout@v6
        with:
          persist-credentials: false
      - uses: actions/setup-python@v6
        with:
          python-version-file: .python-version
      - uses: actions/setup-node@v6
        with:
          node-version-file: .node-version
      - name: Install repository Rust toolchain
        run: rustup toolchain install --no-self-update
      - uses: Swatinem/rust-cache@v2
        with:
          workspaces: rust -> target
          key: headless-inference-${{ matrix.target }}
      - name: Prefetch locked source dependencies
        run: cargo fetch --locked --manifest-path rust/Cargo.toml
      - name: Provision pinned official CPU runtime
        run: python scripts/release/onnx_runtime_stage.py --target ${{ matrix.target }} --download --output-dir "${{ runner.temp }}/pumas-ort"
      - name: Verify native ORT loader and C API before candidate compilation
        run: python scripts/release/onnx_runtime_probe.py --target ${{ matrix.target }} --runtime-dir "${{ runner.temp }}/pumas-ort" --output "${{ runner.temp }}/native-loader.json"
      - name: Build, extract and authenticate native inference candidate
        env:
          ORT_SKIP_DOWNLOAD: '1'
          CARGO_BUILD_JOBS: '1'
        run: python scripts/release/headless_inference_ci.py --target ${{ matrix.target }} --runtime-dir "${{ runner.temp }}/pumas-ort" --output-dir "${{ runner.temp }}/inference-candidate" --build-id "ci-${{ github.run_id }}-${{ github.run_attempt }}"
      - name: Create bounded untrained native fixture
        run: python scripts/release/synthetic_onnx_fixture.py --output-dir "${{ runner.temp }}/native-synthetic-fixture"
      - name: Verify packaged native untrained model lifecycle
        timeout-minutes: 5
        run: python scripts/release/verify-packaged-onnx.py "${{ runner.temp }}/inference-candidate/extracted/${{ matrix.binary }}" "${{ runner.temp }}/native-synthetic-fixture" > "${{ runner.temp }}/inference-candidate/native-synthetic-lifecycle.log"
      - name: Verify required inference archive
        run: node scripts/release/check-artifacts.mjs "${{ runner.temp }}/inference-candidate" headless-inference-${{ matrix.check }}
      - uses: actions/upload-artifact@v7.0.1
        with:
          name: headless-inference-${{ matrix.target }}
          path: |
            ${{ runner.temp }}/inference-candidate/*.tar.gz
            ${{ runner.temp }}/inference-candidate/*.zip
          if-no-files-found: error
      - name: Preserve bounded build and startup evidence
        if: always()
        uses: actions/upload-artifact@v7.0.1
        with:
          name: inference-evidence-${{ matrix.target }}
          path: |
            ${{ runner.temp }}/inference-candidate/*.json
            ${{ runner.temp }}/inference-candidate/*.jsonl
            ${{ runner.temp }}/inference-candidate/*.log
            ${{ runner.temp }}/inference-candidate/*.sha256
            ${{ runner.temp }}/native-loader.json
          if-no-files-found: ignore

  review-inference-linux:
    name: Review Linux inference candidate
    needs: lint-workflows
    if: github.event_name == 'pull_request' || (github.event_name == 'workflow_dispatch' && !inputs.build_candidates)
    runs-on: ubuntu-24.04
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@v6
        with:
          ref: ${{ github.event.pull_request.head.sha || github.sha }}
          persist-credentials: false
      - uses: actions/setup-python@v6
        with:
          python-version-file: .python-version
      - uses: actions/setup-node@v6
        with:
          node-version-file: .node-version
      - name: Install repository Rust toolchain
        run: rustup toolchain install --no-self-update
      - uses: Swatinem/rust-cache@v2
        with:
          workspaces: rust -> target
          key: review-inference-linux-x86_64
      - name: Prefetch locked source dependencies
        run: cargo fetch --locked --manifest-path rust/Cargo.toml
      - name: Provision pinned official CPU runtime
        run: python scripts/release/onnx_runtime_stage.py --target linux-x86_64 --download --output-dir "${{ runner.temp }}/review-ort"
      - name: Verify native ORT loader and C API before candidate compilation
        run: python scripts/release/onnx_runtime_probe.py --target linux-x86_64 --runtime-dir "${{ runner.temp }}/review-ort" --output "${{ runner.temp }}/review-native-loader.json"
      - name: Build, extract and authenticate exact review-head candidate
        env:
          EXPECTED_SOURCE_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
          ORT_SKIP_DOWNLOAD: '1'
          CARGO_BUILD_JOBS: '1'
        shell: bash
        run: |
          set -euo pipefail
          test "$(git rev-parse HEAD)" = "$EXPECTED_SOURCE_SHA"
          unset GIT_PAGER
          python scripts/release/headless_inference_ci.py --target linux-x86_64 --runtime-dir "${{ runner.temp }}/review-ort" --output-dir "${{ runner.temp }}/review-inference-candidate" --build-id "review-ci-${{ github.run_id }}-${{ github.run_attempt }}"
      - name: Verify required review inference archive
        run: node scripts/release/check-artifacts.mjs "${{ runner.temp }}/review-inference-candidate" headless-inference-linux
      - name: Verify extracted Pumas with an untrained synthetic ONNX graph
        timeout-minutes: 3
        env:
          EXPECTED_SOURCE_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
        shell: bash
        run: |
          set -euo pipefail
          python scripts/release/verify_synthetic_packaged_onnx.py --candidate-dir "${{ runner.temp }}/review-inference-candidate" --expected-source "$EXPECTED_SOURCE_SHA"
      - uses: actions/upload-artifact@v7.0.1
        with:
          name: review-inference-linux-x86_64
          path: ${{ runner.temp }}/review-inference-candidate/*.tar.gz
          if-no-files-found: error
          retention-days: 7
          compression-level: 0
      - name: Preserve bounded review build and startup evidence
        if: always()
        uses: actions/upload-artifact@v7.0.1
        with:
          name: review-inference-evidence-linux-x86_64
          path: |
            ${{ runner.temp }}/review-inference-candidate/*.json
            ${{ runner.temp }}/review-inference-candidate/*.jsonl
            ${{ runner.temp }}/review-inference-candidate/*.log
            ${{ runner.temp }}/review-inference-candidate/*.sha256
            ${{ runner.temp }}/review-native-loader.json
          if-no-files-found: ignore
          retention-days: 7

  review-audio-dependencies:
    name: Review confined audio dependencies
    needs: lint-workflows
    if: github.event_name == 'pull_request' || (github.event_name == 'workflow_dispatch' && !inputs.build_candidates)
    runs-on: ubuntu-24.04
    timeout-minutes: 60
    env:
      CARGO_BUILD_JOBS: '1'
      CARGO_INCREMENTAL: '0'
      CARGO_PROFILE_DEV_DEBUG: '0'
    steps:
      - uses: actions/checkout@v6
        with:
          ref: ${{ github.event.pull_request.head.sha || github.sha }}
          persist-credentials: false
      - uses: actions/setup-python@v6
        with:
          python-version-file: .python-version
      - name: Install repository Rust toolchain
        run: rustup toolchain install --no-self-update
      - uses: Swatinem/rust-cache@v2
        with:
          workspaces: rust -> target
          key: review-audio-dependencies-linux
      - name: Qualify exact frozen dependencies under required confinement
        timeout-minutes: 50
        env:
          EXPECTED_SOURCE_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
          EVIDENCE_DIR: ${{ runner.temp }}/review-audio-evidence
          QUALIFICATION_ROOT: ${{ runner.temp }}/review-audio-runtime
        shell: bash
        run: |
          set -euo pipefail
          test "$(git rev-parse HEAD)" = "$EXPECTED_SOURCE_SHA"
          mkdir -p "$EVIDENCE_DIR"
          python -c 'import json, os, subprocess; print(json.dumps({"head": os.environ["EXPECTED_SOURCE_SHA"], "tree": subprocess.check_output(["git", "rev-parse", "HEAD^{tree}"], text=True).strip(), "scope": "confined dependencies only", "pretrained_model_acceptance": False}))' > "$EVIDENCE_DIR/source.json"
          timeout --kill-after=30s 45m cargo run --locked --manifest-path rust/Cargo.toml -p pumas-app-manager --features test-support --example qualify_audio_dependencies -- "$QUALIFICATION_ROOT" 2>&1 | tee "$EVIDENCE_DIR/probe.log"
          test -s "$QUALIFICATION_ROOT/audio-confined-dependency-probe.json"
          cp "$QUALIFICATION_ROOT/audio-confined-dependency-probe.json" "$EVIDENCE_DIR/"
      - name: Check controlled session lifecycle with the managed interpreter
        timeout-minutes: 25
        env:
          QUALIFICATION_ROOT: ${{ runner.temp }}/review-audio-runtime
          EVIDENCE_DIR: ${{ runner.temp }}/review-audio-evidence
        shell: bash
        run: |
          set -euo pipefail
          PUMAS_AUDIO_SESSION_PYTHON="$(python - <<'PY'
          import hashlib, json, os
          from pathlib import Path
          root = Path(os.environ['QUALIFICATION_ROOT']).resolve(strict=True)
          record = json.loads((root / 'torch-versions/v2.10.0/runtime.json').read_text())['managed_python']
          pin = json.loads(Path('rust/crates/pumas-core/src/runtime_read_source/audio_candidate_recipe.json').read_text())
          assert {key: record[key] for key in ('provider', 'distribution')} == pin['managed_python']
          executable = Path(record['executable']['path'])
          assert executable.is_absolute() and executable.resolve(strict=True) == executable
          assert executable.is_relative_to(root) and '\n' not in str(executable) and '\r' not in str(executable)
          assert record['executable']['sha256'] == pin['interpreter_executable_sha256']
          with executable.open('rb') as source:
              assert hashlib.file_digest(source, 'sha256').hexdigest() == pin['interpreter_executable_sha256']
          print(executable)
          PY
          )"
          export PUMAS_AUDIO_SESSION_PYTHON
          timeout --kill-after=30s 20m cargo test --locked --manifest-path rust/Cargo.toml -p pumas-library --no-default-features --features test-support runtime_profiles::audio_session::protocol_tests -- --nocapture 2>&1 | tee "$EVIDENCE_DIR/controlled-session-protocol.log"
      - name: Preserve installed audio selection for recipe diagnosis
        if: always()
        env:
          QUALIFICATION_ROOT: ${{ runner.temp }}/review-audio-runtime
          EVIDENCE_DIR: ${{ runner.temp }}/review-audio-evidence
        shell: bash
        run: |
          set -euo pipefail
          selection="$QUALIFICATION_ROOT/torch-versions/v2.10.0/runtime.json"
          if test -f "$selection"; then
            mkdir -p "$EVIDENCE_DIR"
            cp "$selection" "$EVIDENCE_DIR/installed-runtime.json"
          fi
      - name: Preserve confined dependency evidence only
        if: always()
        uses: actions/upload-artifact@v7.0.1
        with:
          name: review-audio-dependency-evidence-linux
          path: |
            ${{ runner.temp }}/review-audio-evidence/source.json
            ${{ runner.temp }}/review-audio-evidence/probe.log
            ${{ runner.temp }}/review-audio-evidence/installed-runtime.json
            ${{ runner.temp }}/review-audio-evidence/audio-confined-dependency-probe.json
            ${{ runner.temp }}/review-audio-evidence/controlled-session-protocol.log
          if-no-files-found: ignore
          retention-days: 7

  build-frontend:
    name: Frontend and desktop contracts
    needs: lint-workflows
    runs-on: ubuntu-24.04
    timeout-minutes: 45
    steps:
      - uses: actions/checkout@v6
      - uses: pnpm/action-setup@v6.1.0
      - uses: actions/setup-node@v6
        with:
          node-version-file: .node-version
          cache: pnpm
      - name: Install repository Rust toolchain
        run: rustup toolchain install --no-self-update
      - uses: Swatinem/rust-cache@v2
        with:
          workspaces: rust -> target
          key: contracts
      - run: pnpm install --frozen-lockfile
      - run: pnpm --dir frontend lint
      - run: pnpm --dir frontend check:types
      - run: pnpm --dir frontend test:run
      - name: Build library-only renderer
        if: (github.ref_type == 'tag' && startsWith(github.ref_name, 'v')) || (github.event_name == 'workflow_dispatch' && inputs.build_candidates)
        run: pnpm --dir frontend build:library-only
      # Restore the default renderer before publishing the packaging input.
      - name: Build default renderer
        if: (github.ref_type == 'tag' && startsWith(github.ref_name, 'v')) || (github.event_name == 'workflow_dispatch' && inputs.build_candidates)
        run: pnpm --dir frontend build
      - run: pnpm --dir electron lint
      - run: pnpm --dir electron validate
      - run: npm run test:launcher
      - run: pnpm --dir electron test
      - run: cargo fetch --locked --manifest-path rust/Cargo.toml
      - run: pnpm --dir electron check:desktop-contract
      - run: pnpm --dir electron test:desktop-contract-generator
      - run: pnpm --dir electron test:desktop-contract-conformance
      - run: pnpm --dir frontend test:desktop-contract
      - uses: actions/upload-artifact@v7.0.1
        if: (github.ref_type == 'tag' && startsWith(github.ref_name, 'v')) || (github.event_name == 'workflow_dispatch' && inputs.build_candidates)
        with:
          name: frontend-dist
          path: frontend/dist/
          if-no-files-found: error

  torch-quality:
    name: Torch native QA (${{ matrix.os }})
    needs: lint-workflows
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-24.04, windows-2025, macos-15]
    runs-on: ${{ matrix.os }}
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@v6
        with:
          persist-credentials: false
      - name: Install repository Rust toolchain
        run: rustup toolchain install --no-self-update
      - uses: Swatinem/rust-cache@v2
        with:
          workspaces: rust -> target
          key: torch-native-${{ runner.os }}
      - uses: actions/setup-python@v6
        with:
          python-version-file: .python-version
          cache: pip
          cache-dependency-path: torch-server/requirements-dev.txt
      - run: python -m pip install -r torch-server/requirements-dev.txt
      - run: python -m ruff check torch-server scripts/release
      - run: python -m ruff format --check torch-server scripts/release
      - name: Test native packaged release contracts
        working-directory: scripts/release
        run: python -m unittest -v test_inference_release test_release_metadata
      - name: Test native headless owner root identity
        working-directory: scripts/release
        run: python -m unittest -v test_headless_inference.OwnerContractTests
      # Fixtures validate tags and resolver behavior; the native tests below
      # validate host APIs without claiming GPU inference or model support.
      - run: python -m unittest discover -s torch-server/tests
      - uses: actions/setup-python@v6
        with:
          python-version: '3.14'
      - name: Self-test native Torch acceptance script
        run: python scripts/release/torch-managed-python-acceptance.py --self-test
      - name: Test native Torch wheel filtering
        run: cargo test --locked --manifest-path rust/Cargo.toml -p pumas-app-manager torch_alternatives
      - name: Test native managed Python candidate selection
        run: cargo test --locked --manifest-path rust/Cargo.toml -p pumas-app-manager version_manager::managed_python::tests
      - name: Test native Torch preview provider paths
        if: runner.os == 'Linux'
        run: cargo test --locked --manifest-path rust/Cargo.toml -p pumas-app-manager version_manager::torch_preview::tests
      - name: Test native Torch preview Python fallback selection
        if: runner.os == 'Windows' || runner.os == 'macOS'
        shell: pwsh
        run: |
          $testName = 'auto_python_fallback_requires_a_definite_unsupported_attempt'
          $testList = @(cargo test --locked --manifest-path rust/Cargo.toml -p pumas-app-manager $testName -- --list)
          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
          if (@($testList | Where-Object { $_ -match '::auto_python_fallback_requires_a_definite_unsupported_attempt: test$' }).Count -eq 0) {
            throw "No tests matched $testName"
          }
          cargo test --locked --manifest-path rust/Cargo.toml -p pumas-app-manager $testName
          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
      - name: Test Windows Torch activation fixture
        if: runner.os == 'Windows'
        run: cargo test --locked --manifest-path rust/Cargo.toml -p pumas-app-manager restart_falls_back_from_invalid_active_torch_to_verified_default
      - name: Test Windows locked-stage cleanup ownership
        if: runner.os == 'Windows'
        run: cargo test --locked --manifest-path rust/Cargo.toml -p pumas-app-manager locked_stage_stays_owned
      - name: Self-test acquisition qualification oracles
        run: python scripts/release/test_acquisition_qualification.py
      - name: Test cross-owner core acquisition joins
        run: python scripts/release/test-acquisition-integration.py --package pumas-library --minimum 5
      - name: Test cross-owner core joins with HF-only features
        run: python scripts/release/test-acquisition-integration.py --package pumas-library --no-default-features --features hf-client --minimum 5
      - name: Test cross-owner RPC and native acquisition shutdown
        run: python scripts/release/test-acquisition-integration.py --package pumas-rpc --features test-support --minimum 2
      - name: Test cross-owner inference-disabled RPC shutdown
        run: python scripts/release/test-acquisition-integration.py --package pumas-rpc --no-default-features --features test-support --minimum 1
      - name: Test inference-disabled native HTTP drainage
        run: cargo test --locked --manifest-path rust/Cargo.toml -p pumas-rpc --no-default-features http_transport::tests
      - name: Test reserved acquisition workspace custody
        run: cargo test --locked --manifest-path rust/Cargo.toml -p pumas-library acquisition::workspace::tests
      - name: Test native acquisition workspace cleanup
        run: cargo test --locked --manifest-path rust/Cargo.toml -p pumas-app-manager native_
      - name: Test native owned HTTP shutdown boundaries
        run: cargo test --locked --manifest-path rust/Cargo.toml -p pumas-rpc http_transport::tests
      - name: Test RPC-owned shutdown on the native host
        run: cargo test --locked --manifest-path rust/Cargo.toml -p pumas-rpc --test integration_tests rpc_shutdown_exits_after_delivering_acknowledgement_and_ending_sse
      # Exercise the integrated filesystem and registry repairs on each host;
      # compilation of these modules alone is not native behavioral evidence.
      - name: Test native Windows nested import publication
        if: runner.os == 'Windows'
        run: cargo test --locked --manifest-path rust/Cargo.toml -p pumas-library copied_import_nested_native_publication_rebinds_exact_payload -- --nocapture
      - name: Test native GGUF file-type inspection
        run: cargo test --locked --manifest-path rust/Cargo.toml -p pumas-library model_library::package_facts::gguf::tests
      - name: Test native GGUF inspector cache invalidation
        run: cargo test --locked --manifest-path rust/Cargo.toml -p pumas-library gguf_inspector_revision_invalidates_legacy_fingerprint_only_for_gguf
      - name: Test native GGUF intent evidence
        run: cargo test --locked --manifest-path rust/Cargo.toml -p pumas-library --test intent_api_tests gguf_header_quantization_matches_canonical_label_but_filename_is_not_proof
      - name: Test native GGUF legacy cache reinspection
        run: cargo test --locked --manifest-path rust/Cargo.toml -p pumas-library --test package_facts_resolution stale_gguf_detail_and_summary_reinspect_raw_header_before_becoming_fresh
      - name: Test native import integrity
        run: cargo test --locked --manifest-path rust/Cargo.toml -p pumas-library model_library::importer::tests
      - name: Test native copied import custody and settlement
        run: cargo test --locked --manifest-path rust/Cargo.toml -p pumas-library --lib copied_import -- --nocapture
      - name: Test native held destination publication and cleanup
        run: cargo test --locked --manifest-path rust/Cargo.toml -p pumas-library --lib model_library::download_recovery::tests
      - name: Test native import metadata projection compatibility
        run: cargo test --locked --manifest-path rust/Cargo.toml -p pumas-library --lib model_library::library::tests
      - name: Test native HF path identity containment
        run: cargo test --locked --manifest-path rust/Cargo.toml -p pumas-library --lib path_identity_tests
      - name: Test native Windows canonical display prefixes
        if: runner.os == 'Windows'
        run: cargo test --locked --manifest-path rust/Cargo.toml -p pumas-library --lib display_identity_strips_drive_and_unc_verbatim_prefixes_without_io
      - name: Test native shard completeness
        run: cargo test --locked --manifest-path rust/Cargo.toml -p pumas-library model_library::sharding::tests
      - name: Test native canonical shard discovery
        run: cargo test --locked --manifest-path rust/Cargo.toml -p pumas-library --lib shard_discovery
      - name: Test read-only startup shard observation
        run: cargo test --locked --manifest-path rust/Cargo.toml -p pumas-library --lib shard_startup_tests
      - name: Test shard recovery compatibility projection
        run: cargo test --locked --manifest-path rust/Cargo.toml -p pumas-library --lib test_recover_incomplete_shards_async_detects_missing_shard_set
      - name: Test unchanged interrupted download discovery
        run: cargo test --locked --manifest-path rust/Cargo.toml -p pumas-library --lib test_find_interrupted_downloads_async_detects_partial_download_dir
      - name: Test native registry startup ownership
        run: cargo test --locked --manifest-path rust/Cargo.toml -p pumas-library registry::library_registry::tests
      - name: Test native failed-start claim release
        run: cargo test --locked --manifest-path rust/Cargo.toml -p pumas-library startup_guard_cannot_delete_a_successor_or_promoted_instance
      - name: Test native intent IPC readiness and lifecycle
        run: cargo test --locked --manifest-path rust/Cargo.toml -p pumas-library --test intent_ipc_tests
      - name: Test native local RPC request admission
        run: cargo test --locked --manifest-path rust/Cargo.toml -p pumas-rpc --test integration_tests http_admission_rejects_untrusted_sources_before_rpc_dispatch
      - name: Test native Unix RPC signal drain
        if: runner.os != 'Windows'
        run: cargo test --locked --manifest-path rust/Cargo.toml -p pumas-rpc --test integration_tests unix_termination_signals_complete_the_owned_shutdown
      - name: Test native managed Python paths
        run: cargo test --locked --manifest-path rust/Cargo.toml -p pumas-library test_venv_python_path
      - name: Test Linux incomplete process observations
        if: runner.os == 'Linux'
        run: cargo test --locked --manifest-path rust/Cargo.toml -p pumas-library platform::linux_group
      - name: Test Linux router observer shutdown regression
        if: runner.os == 'Linux'
        run: cargo test --locked --manifest-path rust/Cargo.toml -p pumas-library owned_sse_observes_external_load_unload_reconnect_and_drains_before_replacement
      - name: Test Linux silent-SSE cleanup regression
        if: runner.os == 'Linux'
        run: cargo test --locked --manifest-path rust/Cargo.toml -p pumas-library silent_sse_expires_its_lease_and_retains_rows_without_gateway_authority
      - name: Test Unix managed process-group ownership
        if: runner.os != 'Windows'
        run: cargo test --locked --manifest-path rust/Cargo.toml -p pumas-library platform::managed_child
      - name: Test Windows managed Job ownership
        if: runner.os == 'Windows'
        run: cargo test --locked --manifest-path rust/Cargo.toml -p pumas-library platform::managed_child

  torch-native-e2e:
    name: Torch native RPC E2E (${{ matrix.os }})
    needs: lint-workflows
    if: (github.event_name == 'workflow_dispatch' && !inputs.build_candidates) || (github.ref_type == 'tag' && startsWith(github.ref_name, 'v'))
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-24.04, windows-2025, macos-15]
    runs-on: ${{ matrix.os }}
    timeout-minutes: 120
    steps:
      - uses: actions/checkout@v6
        with:
          persist-credentials: false
      - name: Install repository Rust toolchain
        run: rustup toolchain install --no-self-update
      - uses: Swatinem/rust-cache@v2
        with:
          workspaces: rust -> target
          key: torch-native-e2e-${{ runner.os }}
      - uses: actions/setup-python@v6
        with:
          python-version: '3.14'
      - name: Build native RPC for Torch acceptance
        run: cargo build --locked --manifest-path rust/Cargo.toml -p pumas-rpc
      - name: Accept v2.14 CPU/Core via native RPC (${{ runner.os }})
        env:
          PUMAS_RELEASE_API_TOKEN: ${{ github.token }}
        run: python scripts/release/torch-managed-python-acceptance.py rust/target/debug --evidence-dir torch-native-evidence
      - name: Upload native Torch acceptance evidence
        if: always()
        uses: actions/upload-artifact@v7.0.1
        with:
          name: torch-native-${{ runner.os }}
          path: torch-native-evidence/
          if-no-files-found: ignore

  build-rust:
    name: Rust release (${{ matrix.os }})
    needs: lint-workflows
    if: (github.ref_type == 'tag' && startsWith(github.ref_name, 'v')) || (github.event_name == 'workflow_dispatch' && inputs.build_candidates)
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-24.04
            ort_target: linux-x86_64
          - os: macos-15
            ort_target: macos-arm64
    runs-on: ${{ matrix.os }}
    timeout-minutes: 120
    steps:
      - uses: actions/checkout@v6
      - name: Install repository Rust toolchain
        run: rustup toolchain install --no-self-update
      - uses: Swatinem/rust-cache@v2
        with:
          workspaces: rust -> target
          key: release
      - name: Check platform warnings
        env:
          RUSTFLAGS: -D warnings
        run: cargo check --locked --manifest-path rust/Cargo.toml --workspace --exclude pumas_rustler --all-targets
      - name: Provision official desktop CPU runtime
        run: python scripts/release/onnx_runtime_stage.py --target ${{ matrix.ort_target }} --download --output-dir "${{ runner.temp }}/desktop-ort"
      - name: Probe desktop native CPU runtime
        run: python scripts/release/onnx_runtime_probe.py --target ${{ matrix.ort_target }} --runtime-dir "${{ runner.temp }}/desktop-ort" --output "${{ runner.temp }}/desktop-native-loader.json"
      - name: Build release backend
        run: cargo build --locked --manifest-path rust/Cargo.toml -p pumas-rpc --release
      - name: Test release workspace
        run: cargo test --locked --manifest-path rust/Cargo.toml --workspace --exclude pumas_rustler --profile ci-test
      - name: Verify backend startup from isolated staging
        shell: bash
        run: |
          python scripts/release/stage-rpc.py --target ${{ matrix.ort_target }} --runtime-dir "${{ runner.temp }}/desktop-ort"
          python scripts/release/smoke-rpc.py electron/resources/bin
      - uses: actions/upload-artifact@v7.0.1
        with:
          name: rpc-${{ matrix.os }}
          path: electron/resources/bin/
          if-no-files-found: error

  build-electron:
    name: Desktop package (${{ matrix.platform }})
    needs: [build-rust, build-frontend]
    if: (github.ref_type == 'tag' && startsWith(github.ref_name, 'v')) || (github.event_name == 'workflow_dispatch' && inputs.build_candidates)
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-24.04
            platform: linux
          - os: macos-15
            platform: mac
    runs-on: ${{ matrix.os }}
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@v6
      - uses: pnpm/action-setup@v6.1.0
      - uses: actions/setup-node@v6
        with:
          node-version-file: .node-version
          cache: pnpm
      - run: pnpm install --frozen-lockfile
      - uses: actions/download-artifact@v8.0.1
        with:
          name: rpc-${{ matrix.os }}
          path: electron/resources/bin
      - uses: actions/download-artifact@v8.0.1
        with:
          name: frontend-dist
          path: frontend/dist
      - name: Restore executable permission lost in artifact transport
        if: runner.os != 'Windows'
        run: chmod +x electron/resources/bin/pumas-rpc
      - run: npm run test:launcher
      - name: Install Electron runtime before native tests
        timeout-minutes: 10
        run: node electron/node_modules/electron/install.js
      - run: pnpm --dir electron test
      - name: Package desktop
        env:
          CSC_IDENTITY_AUTO_DISCOVERY: 'false'
        run: pnpm --dir electron exec electron-builder --${{ matrix.platform }} --publish never
      - name: Verify expected installers
        run: node scripts/release/check-artifacts.mjs electron/release ${{ matrix.platform }}
      - name: Verify extracted Linux installers
        if: runner.os == 'Linux'
        run: python3 scripts/release/smoke-linux-packages.py electron/release
      - uses: actions/setup-python@v6
        if: runner.os == 'macOS'
        with:
          python-version-file: .python-version
      - name: Verify installed macOS application
        if: runner.os == 'macOS'
        run: python3 scripts/release/smoke-macos-package.py electron/release/*.dmg
      - uses: actions/upload-artifact@v7.0.1
        with:
          name: desktop-${{ matrix.platform }}
          path: |
            electron/release/*.AppImage
            electron/release/*.deb
            electron/release/*.exe
            electron/release/*.dmg
          if-no-files-found: error

  build-electron-no-inference:
    name: Desktop package without inference (${{ matrix.platform }})
    needs: [headless-rpc, build-frontend]
    if: (github.ref_type == 'tag' && startsWith(github.ref_name, 'v')) || (github.event_name == 'workflow_dispatch' && inputs.build_candidates)
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-24.04
            platform: linux
            headless: headless-linux
            check: linux-no-inference
          - os: macos-15
            platform: mac
            headless: headless-macos
            check: mac-no-inference
    runs-on: ${{ matrix.os }}
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@v6
      - uses: pnpm/action-setup@v6.1.0
      - uses: actions/setup-node@v6
        with:
          node-version-file: .node-version
          cache: pnpm
      - run: pnpm install --frozen-lockfile
      # The no-inference desktop embeds the exact backend bytes shipped in the
      # headless archive; it never rebuilds the backend with other features.
      - uses: actions/download-artifact@v8.0.1
        with:
          name: ${{ matrix.headless }}
          path: ${{ runner.temp }}/headless-archive
      - uses: actions/download-artifact@v8.0.1
        with:
          name: frontend-dist
          path: frontend/dist
      - name: Stage inference-disabled backend
        run: |
          mkdir -p electron/resources/bin
          tar -xzf ${{ runner.temp }}/headless-archive/*.tar.gz -C electron/resources/bin pumas-rpc
          chmod +x electron/resources/bin/pumas-rpc
      - run: npm run test:launcher
      - name: Install Electron runtime before native tests
        timeout-minutes: 10
        run: node electron/node_modules/electron/install.js
      - run: pnpm --dir electron test
      # The config file carries the distinct application identity and installer
      # names that keep this line installable alongside the full desktop.
      - name: Package Linux desktop without inference
        if: matrix.platform == 'linux'
        env:
          CSC_IDENTITY_AUTO_DISCOVERY: 'false'
        run: pnpm --dir electron exec electron-builder --linux --publish never -c ./electron-builder.no-inference.cjs
      - name: Package macOS desktop without inference
        if: matrix.platform == 'mac'
        env:
          CSC_IDENTITY_AUTO_DISCOVERY: 'false'
        run: pnpm --dir electron exec electron-builder --mac --publish never -c ./electron-builder.no-inference.cjs
      - name: Verify expected installers
        run: node scripts/release/check-artifacts.mjs electron/release ${{ matrix.check }}
      - name: Verify extracted Linux installers
        if: runner.os == 'Linux'
        run: python3 scripts/release/smoke-linux-packages.py electron/release --variant no-inference
      - uses: actions/setup-python@v6
        if: runner.os == 'macOS'
        with:
          python-version-file: .python-version
      - name: Verify installed macOS application
        if: runner.os == 'macOS'
        run: python3 scripts/release/smoke-macos-package.py electron/release/*.dmg --variant no-inference
      - uses: actions/upload-artifact@v7.0.1
        with:
          name: desktop-${{ matrix.platform }}-no-inference
          path: |
            electron/release/*.AppImage
            electron/release/*.deb
            electron/release/*.exe
            electron/release/*.dmg
          if-no-files-found: error

  windows-release:
    name: Rust release (windows-2025)
    needs: [lint-workflows, build-frontend]
    if: (github.ref_type == 'tag' && startsWith(github.ref_name, 'v')) || (github.event_name == 'workflow_dispatch' && inputs.build_candidates)
    runs-on: windows-2025
    timeout-minutes: 150
    steps:
      - uses: actions/checkout@v6
      - name: Install repository Rust toolchain
        run: rustup toolchain install --no-self-update
      - uses: Swatinem/rust-cache@v2
        with:
          workspaces: rust -> target
          key: windows-release
          cache-on-failure: true
      - uses: actions/setup-node@v6
        with:
          node-version-file: .node-version
      # action-setup v6 invokes a deprecated shell/argument combination on Windows.
      - name: Install repository pnpm version
        run: |
          $packageManager = (Get-Content package.json | ConvertFrom-Json).packageManager
          npm install --global $packageManager
      - run: pnpm install --frozen-lockfile
      - uses: actions/download-artifact@v8.0.1
        with:
          name: frontend-dist
          path: ${{ runner.temp }}/frontend-archive
          skip-decompress: true
      # Avoid the action's deprecated Windows Buffer API; digest checks still run above.
      - name: Extract frontend artifact
        run: |
          $archives = @(Get-ChildItem -LiteralPath "$env:RUNNER_TEMP/frontend-archive" -File)
          if ($archives.Count -ne 1) { throw "Expected exactly one frontend archive" }
          Expand-Archive -LiteralPath $archives[0].FullName -DestinationPath frontend/dist
      - run: npm run test:launcher
      - name: Install Electron runtime before native tests
        timeout-minutes: 10
        run: node electron/node_modules/electron/install.js
      - run: pnpm --dir electron test
      - name: Check Windows warnings
        env:
          RUSTFLAGS: -D warnings
        run: cargo check --locked --manifest-path rust/Cargo.toml --workspace --exclude pumas_rustler --all-targets
      - name: Provision official desktop CPU runtime
        run: python scripts/release/onnx_runtime_stage.py --target windows-x86_64 --download --output-dir "${{ runner.temp }}/desktop-ort"
      - name: Probe desktop native CPU runtime
        run: python scripts/release/onnx_runtime_probe.py --target windows-x86_64 --runtime-dir "${{ runner.temp }}/desktop-ort" --output "${{ runner.temp }}/desktop-native-loader.json"
      - name: Build Windows backend
        run: cargo build --locked --manifest-path rust/Cargo.toml -p pumas-rpc --release
      - run: python scripts/release/stage-rpc.py --target windows-x86_64 --runtime-dir "${{ runner.temp }}/desktop-ort"
      - run: python scripts/release/smoke-rpc.py electron/resources/bin
      - name: Package Windows installers
        env:
          CSC_IDENTITY_AUTO_DISCOVERY: 'false'
        run: pnpm --dir electron exec electron-builder --win --publish never
      - name: Verify installed and portable Windows applications
        run: python scripts/release/smoke-windows-packages.py electron/release
      - name: Run Windows release tests
        run: cargo test --locked --manifest-path rust/Cargo.toml --workspace --exclude pumas_rustler --profile ci-test
      - name: Verify and assemble Windows release
        run: node scripts/release/check-artifacts.mjs electron/release win windows-release
      - uses: actions/upload-artifact@v7.0.1
        with:
          name: desktop-windows
          path: windows-release/
          if-no-files-found: error

  windows-no-inference:
    name: Desktop package without inference (win)
    needs: [lint-workflows, build-frontend, headless-rpc]
    if: (github.ref_type == 'tag' && startsWith(github.ref_name, 'v')) || (github.event_name == 'workflow_dispatch' && inputs.build_candidates)
    runs-on: windows-2025
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@v6
      - uses: actions/setup-node@v6
        with:
          node-version-file: .node-version
      # action-setup v6 invokes a deprecated shell/argument combination on Windows.
      - name: Install repository pnpm version
        run: |
          $packageManager = (Get-Content package.json | ConvertFrom-Json).packageManager
          npm install --global $packageManager
      - run: pnpm install --frozen-lockfile
      - uses: actions/download-artifact@v8.0.1
        with:
          name: frontend-dist
          path: ${{ runner.temp }}/frontend-archive
          skip-decompress: true
      # Avoid the action's deprecated Windows Buffer API; digest checks still run above.
      - name: Extract frontend artifact
        run: |
          $archives = @(Get-ChildItem -LiteralPath "$env:RUNNER_TEMP/frontend-archive" -File)
          if ($archives.Count -ne 1) { throw "Expected exactly one frontend archive" }
          Expand-Archive -LiteralPath $archives[0].FullName -DestinationPath frontend/dist
      # The no-inference desktop embeds the exact backend bytes shipped in the
      # headless archive; it never rebuilds the backend with other features.
      - uses: actions/download-artifact@v8.0.1
        with:
          name: headless-windows
          path: ${{ runner.temp }}/headless-archive
      - name: Stage inference-disabled backend
        run: |
          New-Item -ItemType Directory -Force electron/resources/bin | Out-Null
          $archive = @(Get-ChildItem -LiteralPath "$env:RUNNER_TEMP/headless-archive" -Filter *.zip)
          if ($archive.Count -ne 1) { throw "Expected exactly one headless archive" }
          Expand-Archive -LiteralPath $archive[0].FullName -DestinationPath "$env:RUNNER_TEMP/headless-staged"
          Copy-Item "$env:RUNNER_TEMP/headless-staged/pumas-rpc.exe" electron/resources/bin/
      - run: npm run test:launcher
      - name: Install Electron runtime before native tests
        timeout-minutes: 10
        run: node electron/node_modules/electron/install.js
      - run: pnpm --dir electron test
      - name: Package Windows installers without inference
        env:
          CSC_IDENTITY_AUTO_DISCOVERY: 'false'
        run: pnpm --dir electron exec electron-builder --win --publish never -c ./electron-builder.no-inference.cjs
      - name: Verify installed and portable Windows applications
        run: python scripts/release/smoke-windows-packages.py electron/release --variant no-inference
      - name: Verify and assemble Windows release
        run: node scripts/release/check-artifacts.mjs electron/release win-no-inference windows-no-inference-release
      - uses: actions/upload-artifact@v7.0.1
        with:
          name: desktop-windows-no-inference
          path: windows-no-inference-release/
          if-no-files-found: error

  verify-launcher:
    name: Linux release startup
    needs: [build-rust, build-frontend]
    if: (github.ref_type == 'tag' && startsWith(github.ref_name, 'v')) || (github.event_name == 'workflow_dispatch' && inputs.build_candidates)
    runs-on: ubuntu-24.04
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@v6
      - uses: pnpm/action-setup@v6.1.0
      - uses: actions/setup-node@v6
        with:
          node-version-file: .node-version
          cache: pnpm
      - run: pnpm install --frozen-lockfile
      - uses: actions/download-artifact@v8.0.1
        with:
          name: rpc-ubuntu-24.04
          path: rust/target/release
      - uses: actions/download-artifact@v8.0.1
        with:
          name: frontend-dist
          path: frontend/dist
      - run: chmod +x rust/target/release/pumas-rpc
      - name: Install Electron runtime before launcher smoke
        timeout-minutes: 10
        run: node electron/node_modules/electron/install.js
      - run: pnpm --dir electron build
      - run: sudo apt-get update && sudo apt-get install -y xvfb
      - name: Smoke an isolated library
        run: |
          mkdir -p "$RUNNER_TEMP/pumas-smoke/shared-resources/models" "$RUNNER_TEMP/pumas-smoke-config"
          PUMAS_LAUNCHER_ROOT="$RUNNER_TEMP/pumas-smoke" XDG_CONFIG_HOME="$RUNNER_TEMP/pumas-smoke-config" \
            xvfb-run -a bash launcher.sh --release-smoke

  release-candidate:
    name: Assemble release candidate
    needs: [rust-quality, headless, headless-rpc, headless-inference, torch-quality, build-electron, build-electron-no-inference, windows-release, windows-no-inference, verify-launcher]
    if: (github.ref_type == 'tag' && startsWith(github.ref_name, 'v')) || (github.event_name == 'workflow_dispatch' && inputs.build_candidates)
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@v6
      - uses: actions/setup-node@v6
        with:
          node-version-file: .node-version
      - uses: actions/download-artifact@v8.0.1
        with:
          pattern: desktop-*
          path: candidate-input
      - uses: actions/download-artifact@v8.0.1
        with:
          pattern: headless-*
          path: candidate-input
      - run: node scripts/release/check-artifacts.mjs candidate-input required release-candidate
      - uses: actions/setup-python@v6
        with:
          python-version-file: .python-version
      - name: Describe every final candidate artifact and metadata byte
        run: python scripts/release/write-release-metadata.py release-candidate --build-id "github-${{ github.run_id }}-${{ github.run_attempt }}"
      - uses: actions/upload-artifact@v7.0.1
        with:
          name: release-candidate
          path: release-candidate/
          if-no-files-found: error
      # Metadata is an unsigned artifact-level inventory. Native workflows,
      # trained models and maintainer license review remain acceptance gates.