[TESTING ONLY] Combined improvements for macOS validation

.github/workflows/ci.yaml

@@ -33,13 +33,24 @@ env:
 jobs:
   build-win:
     runs-on: windows-2025-vs2026
+    outputs:
+      run_attempt: ${{ steps.build_identity.outputs.run_attempt }}
+    permissions:
+      actions: read
+      contents: read
     env:
       STFC_MSVC_SCCACHE: "1"
       WINDOWS_SCCACHE_SCHEMA: "v1"
       SCCACHE_DIR: ${{ github.workspace }}/build/.windows-sccache
       SCCACHE_CACHE_SIZE: "2G"
 
     steps:
+      - name: Capture build identity
+        id: build_identity
+        shell: pwsh
+        run: |
+          "run_attempt=${{ github.run_attempt }}" >> $env:GITHUB_OUTPUT
+
       - name: Checkout
         uses: actions/checkout@v7
         with:
@@ -58,7 +69,7 @@ jobs:
           key: xmake-tool-${{ runner.os }}-${{ runner.arch }}-${{ env.XMAKE_VERSION }}-${{ env.XMAKE_CACHE_SCHEMA }}
 
       - name: Setup XMake
-        uses: xmake-io/github-action-setup-xmake@v1
+        uses: xmake-io/github-action-setup-xmake@v1.2.5
         with:
           xmake-version: ${{ env.XMAKE_VERSION }}
 
@@ -119,7 +130,27 @@ jobs:
       - name: Configure
         id: configure_windows
         timeout-minutes: 30
-        run: xmake f -m release -y -v
+        shell: pwsh
+        run: |
+          $commit = (git rev-parse HEAD).Trim()
+          if ($commit -notmatch '^[0-9a-f]{40}$') {
+            throw "Unable to resolve the checked-out commit for DLL provenance."
+          }
+
+          $sourceState = "git:$commit"
+          $buildInvocation = "github:${{ github.run_id }}:${{ github.run_attempt }}:windows"
+          $identity = "stfc-identity-v1;distribution=netniv.stfc-community-mod;source=$sourceState;" +
+            "base=$commit;build=$buildInvocation;mode=release;channel=ci"
+          "STFC_EXPECTED_IDENTITY=$identity" >> $env:GITHUB_ENV
+
+          $xmakeArgs = @(
+            'f', '-m', 'release', '-y', '-v',
+            "--stfc_source_state_id=$sourceState",
+            "--stfc_base_commit=$commit",
+            "--stfc_build_invocation_id=$buildInvocation",
+            '--stfc_build_channel=ci'
+          )
+          xmake @xmakeArgs
 
       - name: Verify dependency lock
         shell: pwsh
@@ -146,7 +177,7 @@ jobs:
 
       - name: Upload configure diagnostics
         if: ${{ failure() && steps.configure_windows.outcome == 'failure' }}
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v7.0.1
         with:
           name: xmake-configure-diagnostics-windows
           path: ~/.xmake/cache/packages/**/installdir.failed/logs/install.txt
@@ -172,8 +203,18 @@ jobs:
             "build/windows/x64/release/stfc-community-mod.dll" `
             "version.dll"
 
+      - name: Verify DLL provenance
+        shell: pwsh
+        run: |
+          $dll = (Resolve-Path -LiteralPath 'version.dll').Path
+          $comments = [System.Diagnostics.FileVersionInfo]::GetVersionInfo($dll).Comments
+          if (-not [string]::Equals($comments, $env:STFC_EXPECTED_IDENTITY, [System.StringComparison]::Ordinal)) {
+            throw "DLL provenance mismatch. Expected '$env:STFC_EXPECTED_IDENTITY'; found '$comments'."
+          }
+          Write-Host "Verified DLL provenance: $comments"
+
       - name: Upload
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v7.0.1
         with:
           name: stfc-community-mod
           path: version.dll
@@ -208,6 +249,63 @@ jobs:
           path: ${{ runner.tool_cache }}/xmake
           key: ${{ steps.restore_xmake.outputs.cache-primary-key }}
 
+  attest-win:
+    name: attest-win
+    needs: build-win
+    if: >-
+      github.event_name == 'push' &&
+      github.repository == 'netniV/stfc-mod' &&
+      github.ref_protected &&
+      (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/dev')
+    runs-on: windows-2025-vs2026
+    permissions:
+      actions: read
+      contents: read
+      id-token: write
+      attestations: write
+
+    steps:
+      - name: Download Windows DLL
+        uses: actions/download-artifact@v8.0.1
+        with:
+          name: stfc-community-mod
+          path: .artifacts/windows
+
+      - name: Verify DLL provenance
+        shell: pwsh
+        env:
+          STFC_SOURCE_COMMIT: ${{ github.sha }}
+          STFC_RUN_ID: ${{ github.run_id }}
+          STFC_BUILD_RUN_ATTEMPT: ${{ needs.build-win.outputs.run_attempt }}
+        run: |
+          $dll = (Resolve-Path -LiteralPath '.artifacts/windows/version.dll').Path
+          $commit = $env:STFC_SOURCE_COMMIT
+          $runId = $env:STFC_RUN_ID
+          $buildAttempt = $env:STFC_BUILD_RUN_ATTEMPT
+
+          if ($commit -notmatch '^[0-9a-f]{40}$') {
+            throw "Unable to resolve the workflow commit for DLL provenance."
+          }
+          if ($runId -notmatch '^[1-9][0-9]*$') {
+            throw "Unable to resolve the workflow run ID for DLL provenance."
+          }
+          if ($buildAttempt -notmatch '^[1-9][0-9]*$') {
+            throw "The producing build did not provide a valid run attempt."
+          }
+
+          $expected = "stfc-identity-v1;distribution=netniv.stfc-community-mod;source=git:$commit;" +
+            "base=$commit;build=github:${runId}:${buildAttempt}:windows;mode=release;channel=ci"
+          $comments = [System.Diagnostics.FileVersionInfo]::GetVersionInfo($dll).Comments
+          if (-not [string]::Equals($comments, $expected, [System.StringComparison]::Ordinal)) {
+            throw "DLL provenance mismatch. Expected '$expected'; found '$comments'."
+          }
+          Write-Host "Verified DLL provenance: $comments"
+
+      - name: Attest Windows DLL
+        uses: actions/attest@v4.2.1
+        with:
+          subject-path: .artifacts/windows/version.dll
+
   build-mac:
     name: build-mac (${{ matrix.arch }})
 
@@ -249,7 +347,7 @@ jobs:
           key: xmake-tool-${{ runner.os }}-${{ runner.arch }}-${{ env.XMAKE_VERSION }}-${{ env.XMAKE_CACHE_SCHEMA }}
 
       - name: Setup XMake
-        uses: xmake-io/github-action-setup-xmake@v1
+        uses: xmake-io/github-action-setup-xmake@v1.2.5
         with:
           xmake-version: ${{ env.XMAKE_VERSION }}
 
@@ -359,7 +457,7 @@ jobs:
 
       - name: Upload configure diagnostics
         if: ${{ failure() && steps.configure.outcome == 'failure' }}
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v7.0.1
         with:
           name: xmake-configure-diagnostics-macos-${{ matrix.arch }}
           path: ~/.xmake/cache/packages/**/installdir.failed/logs/install.txt
@@ -468,7 +566,7 @@ jobs:
           fi
 
       - name: Upload intermediate build
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v7.0.1
         with:
           name: ${{ matrix.artifact }}
           path: macos-${{ matrix.arch }}-build.tar
@@ -532,13 +630,13 @@ jobs:
           show-progress: false
 
       - name: Download ARM64 build
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@v8.0.1
         with:
           name: macos-arm64-build
           path: .artifacts/arm64
 
       - name: Download x86_64 build
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@v8.0.1
         with:
           name: macos-x86_64-build
           path: .artifacts/x86_64
@@ -740,15 +838,15 @@ jobs:
             "$DMG_SOURCE/"
 
       - name: Upload installer
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v7.0.1
         with:
           name: stfc-community-mod-installer
           path: stfc-community-mod-installer.dmg
           compression-level: 0
           if-no-files-found: error
 
       - name: Upload macOS mod archive
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v7.0.1
         with:
           name: stfc-community-mod-macos-universal
           path: stfc-community-mod-macos-universal

AGENTS.md

@@ -84,6 +84,7 @@ void SomeFunction_Hook(auto original, SomeClass* _this, ...) {
 ```
 macOS does not tolerate repeated hooks of the same function. If multiple features need to intercept the same game method, consolidate the behavior behind one detour or add platform guards instead of installing overlapping hooks.
 Do not over-focus on hidden IL2CPP `MethodInfo*` parameters during drift repair; match the game-visible signature from `dump.cs` unless there is concrete runtime evidence that the hidden parameter is the issue.
+Before adding a detour to a small IL2CPP wrapper or thunk, verify its native method extent against SPUD's architecture-specific overwrite size on every supported architecture for the exact client build. A successful platform build does not validate hook fit; prefer a substantive downstream method when exact per-architecture extent is unavailable.
 
 **IL2CPP class resolution** — Game classes are resolved at runtime using helpers:
 ```cpp

README.md

@@ -55,6 +55,9 @@ This project is maintained solely at my own cost of time, energy and money. Any
 
 Please see the [INSTALL.md](INSTALL.md) instructions which has steps on how to use this mod with Star Trek Fleet Command.
 
+For the Windows DLL identity marker, artifact-attestation trust boundary, and verification command, see
+[Windows DLL provenance](docs/WINDOWS_DLL_PROVENANCE.md).
+
 Please note, that whilst Mac support was added in this version, it's supported on an as-is basis due to lack of Mac development environments.
 
 ## Keyboard shortcuts
@@ -69,10 +72,10 @@ been applied. Valid values for any short can be found in [KEYMAPPING.md](KEYMAPP
 | -----------: | -------------------------------- |
 |          F10 | Bug fixer (exits game)           |
 |        F1-F5 | Zoom presets                     |
-|            Q | Zoom Out                         |
-|            E | Zoom In                          |
+|            Q | Zoom In                          |
+|            E | Zoom Out                         |
 |        MINUS | Zoom (min)                       |
-|       EQUALS | Zoom (default)                   |
+|            = | Zoom (default)                   |
 |    BACKSPACE | Zoom (max)                       |
 |            C | Open/Focus Chat - Full Screen    |
 |        Alt-C | Open/Focus Chat - Side of Screen |
@@ -109,9 +112,12 @@ action items such as:
 
 |     Key | Shortcut         |
 | ------: | ---------------- |
-|       T | Events           |
+|       T | Away Teams       |
 |       G | Galaxy           |
+|  Ctrl-G | Galaxy (native)  |
 |       H | System           |
+| Shift-E | Events           |
+|  Ctrl-E | Events (native)  |
 | Shift-G | Exterior View    |
 | Shift-H | Interior View    |
 |       B | Bookmarks        |
@@ -125,7 +131,6 @@ action items such as:
 |       O | Command Center   |
 | Shift-O | Officers         |
 | Shift-Q | Q-Trials         |
-| Shift-T | Away Teams       |
 |       X | ExoComp          |
 |       Z | Daily Missions   |
 

docs/WINDOWS_DLL_PROVENANCE.md

@@ -0,0 +1,34 @@
+# Windows DLL provenance
+
+Windows builds publish a `stfc-identity-v1` marker in the DLL's standard `Comments` version resource. The marker is
+minimal, descriptive, and self-declared. It helps identify a build, but it is not evidence of authenticity and must
+not be used as an authorization or trust decision by itself.
+
+For protected `main` and `dev` pushes in `netniV/stfc-mod`, the upstream Build workflow creates a GitHub/Sigstore
+build-provenance attestation for the exact `version.dll` bytes after verifying the embedded marker. Pull requests,
+fork runs, unprotected refs, tags, and other repositories do not create authoritative attestations.
+
+After downloading and extracting an attested DLL, verify its byte integrity, expected upstream workflow identity,
+protected source ref, and reviewed source commit with a current GitHub CLI. Replace `<expected-commit-sha>` with the
+40-character commit for the artifact:
+
+```shell
+gh attestation verify version.dll \
+  --repo netniV/stfc-mod \
+  --signer-workflow netniV/stfc-mod/.github/workflows/ci.yaml \
+  --source-ref refs/heads/main \
+  --source-digest <expected-commit-sha>
+```
+
+For a reviewed `dev` artifact, use `--source-ref refs/heads/dev` instead. Do not omit the source ref or digest when
+making a trust decision.
+
+Successful verification establishes that the exact file digest is covered by an attestation issued for the named
+repository and signer workflow, including source commit provenance. It does not establish that the source,
+dependencies, build environment, or resulting behavior are free from malicious or unsafe behavior. It also does not,
+by itself, authorize the artifact as an official release.
+
+The first authoritative upstream attestation can exist only after the attestation workflow is merged and then runs on
+an eligible protected upstream push. Existing releases are unattested. Downstream consumers, including STFC Mod
+Bridge, must continue to use exact reviewed file size and SHA-256 allowlists until an attested upstream artifact is
+actually available and their attestation policy is separately reviewed.