Lab: six-family OSS organ qualification

.github/workflows/cargo-dist-npm-windows-extraction-candidate.yml

@@ -0,0 +1,156 @@
+name: cargo-dist Windows npm extraction candidate
+
+on:
+  pull_request:
+    paths:
+      - ".github/workflows/cargo-dist-npm-windows-extraction-candidate.yml"
+      - "candidates/cargo-dist-npm-windows-extraction/**"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  restricted-policy-and-error-propagation:
+    runs-on: windows-2025
+    timeout-minutes: 20
+
+    steps:
+      - name: Check out public lab inputs
+        uses: actions/checkout@v7
+        with:
+          path: lab
+          persist-credentials: false
+
+      - name: Check out exact public cargo-dist source
+        uses: actions/checkout@v7
+        with:
+          repository: axodotdev/cargo-dist
+          ref: c65a1a932e2661e05d6640716850d36b0f47efd7
+          path: upstream
+          persist-credentials: false
+
+      - name: Verify upstream source identity
+        shell: pwsh
+        run: |
+          $sha = (git -C upstream rev-parse HEAD).Trim()
+          if ($sha -ne 'c65a1a932e2661e05d6640716850d36b0f47efd7') { throw "unexpected source $sha" }
+          Copy-Item upstream/cargo-dist/templates/installer/npm/binary-install.js upstream/baseline-binary-install.js
+          git -C upstream apply --check ../lab/candidates/cargo-dist-npm-windows-extraction/candidate.patch
+
+      - name: Set up Node
+        uses: actions/setup-node@v7
+        with:
+          node-version: '24'
+
+      - name: Set up Python for local fixture server
+        uses: actions/setup-python@v7
+        with:
+          python-version: '3.12'
+          architecture: x64
+
+      - name: Prepare ZIP fixtures and Package.install probe
+        shell: pwsh
+        run: |
+          New-Item -ItemType Directory -Force lab/fixture/valid | Out-Null
+          Set-Content -Encoding ascii lab/fixture/valid/fixture.exe 'fixture'
+          Compress-Archive -Path lab/fixture/valid/fixture.exe -DestinationPath lab/fixture/valid.zip -Force
+          Set-Content -Encoding ascii lab/fixture/invalid.zip 'not-a-zip'
+          @'
+          const path = require('path');
+
+          async function main() {
+            const modulePath = path.resolve(process.argv[2]);
+            const url = process.argv[3];
+            const filename = process.argv[4];
+            const { Package } = require(modulePath);
+            const pkg = new Package(
+              { artifactName: 'x86_64-pc-windows-msvc' },
+              'fixture',
+              url,
+              filename,
+              '.zip',
+              { fixture: 'fixture.exe' },
+            );
+            await pkg.install(true);
+            const existsAfter = pkg.exists();
+            console.log(JSON.stringify({ install_resolved: true, exists_after: existsAfter }));
+            if (!existsAfter) process.exit(91);
+          }
+
+          main().catch((err) => {
+            console.error(err);
+            process.exit(90);
+          });
+          '@ | Set-Content -Encoding utf8 lab/package-install-probe.js
+
+      - name: Exercise baseline and candidate under Restricted policy
+        shell: pwsh
+        run: |
+          $server = Start-Process python -ArgumentList '-m','http.server','8123','--bind','127.0.0.1','--directory','lab/fixture' -PassThru -WindowStyle Hidden
+          Start-Sleep -Seconds 2
+          $prior = (powershell.exe -NoProfile -NonInteractive -Command 'Get-ExecutionPolicy -Scope CurrentUser').Trim()
+          try {
+            powershell.exe -NoProfile -NonInteractive -Command 'Set-ExecutionPolicy -Scope CurrentUser Restricted -Force'
+
+            Remove-Item upstream/node_modules/.bin_real -Recurse -Force -ErrorAction SilentlyContinue
+            node lab/package-install-probe.js upstream/baseline-binary-install.js http://127.0.0.1:8123/valid.zip valid.zip *> baseline.log
+            $baselineExit = $LASTEXITCODE
+
+            git -C upstream apply ../lab/candidates/cargo-dist-npm-windows-extraction/candidate.patch
+            Remove-Item upstream/cargo-dist/templates/installer/npm/node_modules/.bin_real -Recurse -Force -ErrorAction SilentlyContinue
+            node lab/package-install-probe.js upstream/cargo-dist/templates/installer/npm/binary-install.js http://127.0.0.1:8123/valid.zip valid.zip *> candidate-valid.log
+            $candidateExit = $LASTEXITCODE
+
+            if ($candidateExit -ne 0) { Get-Content candidate-valid.log; throw "candidate failed under Restricted policy: exit $candidateExit" }
+            if ($baselineExit -eq 0) { Get-Content baseline.log; throw 'baseline unexpectedly installed successfully under Restricted policy' }
+
+            @{
+              upstream_commit = 'c65a1a932e2661e05d6640716850d36b0f47efd7'
+              baseline_exit = $baselineExit
+              baseline_silent_success_detected = ($baselineExit -eq 91)
+              candidate_exit = $candidateExit
+              candidate_install_verified_by_package_exists = $true
+              simulated_policy = 'CurrentUser Restricted'
+            } | ConvertTo-Json | Set-Content -Encoding utf8 restricted-policy-evidence.json
+          }
+          finally {
+            powershell.exe -NoProfile -NonInteractive -Command "Set-ExecutionPolicy -Scope CurrentUser $prior -Force"
+            Stop-Process -Id $server.Id -Force -ErrorAction SilentlyContinue
+          }
+
+      - name: Candidate must propagate genuine corrupt-ZIP failure
+        shell: pwsh
+        run: |
+          $server = Start-Process python -ArgumentList '-m','http.server','8124','--bind','127.0.0.1','--directory','lab/fixture' -PassThru -WindowStyle Hidden
+          Start-Sleep -Seconds 2
+          try {
+            Remove-Item upstream/cargo-dist/templates/installer/npm/node_modules/.bin_real -Recurse -Force -ErrorAction SilentlyContinue
+            node lab/package-install-probe.js upstream/cargo-dist/templates/installer/npm/binary-install.js http://127.0.0.1:8124/invalid.zip invalid.zip *> corrupt-zip.log
+            $exit = $LASTEXITCODE
+            if ($exit -eq 0 -or $exit -eq 91) { Get-Content corrupt-zip.log; throw "candidate did not propagate corrupt ZIP as extraction failure: exit $exit" }
+            @{
+              corrupt_zip_exit = $exit
+              failure_propagated = $true
+            } | ConvertTo-Json | Set-Content -Encoding utf8 corrupt-zip-evidence.json
+          }
+          finally {
+            Stop-Process -Id $server.Id -Force -ErrorAction SilentlyContinue
+          }
+          # The non-zero Node status above is the expected oracle. After recording it,
+          # do not let that expected child status become the workflow step status.
+          $global:LASTEXITCODE = 0
+
+      - name: Retain public candidate evidence
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: cargo-dist-npm-windows-extraction-candidate-evidence
+          path: |
+            restricted-policy-evidence.json
+            corrupt-zip-evidence.json
+            baseline.log
+            candidate-valid.log
+            corrupt-zip.log
+          if-no-files-found: warn
+          retention-days: 14

.github/workflows/oss-organ-qualification.yml

@@ -0,0 +1,70 @@
+name: OSS organ six-family qualification
+
+on:
+  pull_request:
+    paths:
+      - ".github/workflows/oss-organ-qualification.yml"
+      - "tools/oss-organ-qualify.py"
+      - "tools/oss-organ-reps.py"
+      - "tools/oss-organ-followup.py"
+      - "lab-fixtures/**"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  qualify:
+    name: ${{ matrix.name }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - name: linux-x64
+            runner: ubuntu-24.04
+          - name: linux-arm64
+            runner: ubuntu-24.04-arm
+          - name: windows-x64
+            runner: windows-2025
+          - name: windows-arm64
+            runner: windows-11-arm
+          - name: macos-x64
+            runner: macos-15-intel
+          - name: macos-arm64
+            runner: macos-15
+
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 30
+
+    steps:
+      - name: Check out public probe only
+        uses: actions/checkout@v5
+        with:
+          persist-credentials: false
+
+      - name: Record runner identity
+        run: python -c "import json,platform; print(json.dumps({'system':platform.system(),'machine':platform.machine(),'python':platform.python_version()}, indent=2))"
+
+      - name: Qualify pinned public artifacts
+        env:
+          QUAL_GITHUB_TOKEN: ${{ github.token }}
+        run: python tools/oss-organ-qualify.py
+
+      - name: Run bounded comparative reps
+        env:
+          QUAL_GITHUB_TOKEN: ${{ github.token }}
+        run: python tools/oss-organ-reps.py
+
+      - name: Run corrective follow-up reps
+        env:
+          QUAL_GITHUB_TOKEN: ${{ github.token }}
+        run: python tools/oss-organ-followup.py
+
+      - name: Retain structured qualification evidence
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: oss-organ-${{ matrix.name }}
+          path: qualification-results/*.json
+          if-no-files-found: warn
+          retention-days: 14

.github/workflows/xa11y-windows-arm64-candidate.yml

@@ -0,0 +1,153 @@
+name: xa11y Windows ARM64 Python candidate
+
+on:
+  pull_request:
+    paths:
+      - ".github/workflows/xa11y-windows-arm64-candidate.yml"
+      - "candidates/xa11y-windows-arm64-python-wheel/**"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  build-wheel:
+    name: cross-build Windows ARM64 wheel
+    runs-on: windows-latest
+    timeout-minutes: 45
+
+    steps:
+      - name: Check out exact public release-synchronized source
+        uses: actions/checkout@v5
+        with:
+          repository: xa11y/xa11y
+          ref: 44594a9705a3f3213a9b58bc205f4e6335c9606b
+          persist-credentials: false
+
+      - name: Verify source identity
+        shell: pwsh
+        run: |
+          $sha = (git rev-parse HEAD).Trim()
+          if ($sha -ne '44594a9705a3f3213a9b58bc205f4e6335c9606b') { throw "unexpected source $sha" }
+          Write-Host "source=$sha"
+
+      - name: Set up host Python
+        uses: actions/setup-python@v7
+        with:
+          python-version: "3.12"
+          architecture: x64
+
+      - name: Cross-build candidate wheel using upstream release machinery
+        uses: PyO3/maturin-action@v1
+        with:
+          target: aarch64
+          args: --release --out dist
+          working-directory: xa11y-python
+
+      - name: Verify and describe produced wheel
+        shell: pwsh
+        run: |
+          $wheel = Get-ChildItem xa11y-python/dist/*.whl | Select-Object -First 1
+          if (-not $wheel) { throw 'candidate wheel was not produced' }
+          if ($wheel.Name -notmatch 'win_arm64') { throw "candidate is not a Windows ARM64 wheel: $($wheel.Name)" }
+          $digest = (Get-FileHash -Algorithm SHA256 $wheel.FullName).Hash.ToLowerInvariant()
+          @{
+            source_commit = '44594a9705a3f3213a9b58bc205f4e6335c9606b'
+            build_host = 'windows-latest-x64'
+            maturin_target = 'aarch64'
+            wheel = $wheel.Name
+            wheel_sha256 = $digest
+          } | ConvertTo-Json | Set-Content -Encoding utf8 build-evidence.json
+          Get-Content build-evidence.json
+
+      - name: Publish exact candidate wheel for dogfood job
+        uses: actions/upload-artifact@v7
+        with:
+          name: xa11y-crossbuilt-windows-arm64-wheel
+          path: |
+            xa11y-python/dist/*.whl
+            build-evidence.json
+          if-no-files-found: error
+          retention-days: 14
+
+  dogfood-wheel:
+    name: dogfood exact wheel on native Windows ARM64
+    needs: build-wheel
+    runs-on: windows-11-arm
+    timeout-minutes: 20
+
+    steps:
+      - name: Set up native ARM64 Python
+        uses: actions/setup-python@v7
+        with:
+          python-version: "3.12"
+          architecture: arm64
+
+      - name: Download exact cross-built candidate
+        uses: actions/download-artifact@v8
+        with:
+          name: xa11y-crossbuilt-windows-arm64-wheel
+          path: candidate
+
+      - name: Install and exercise exact downloaded wheel
+        shell: pwsh
+        run: |
+          $wheel = Get-ChildItem candidate -Recurse -Filter *.whl | Select-Object -First 1
+          if (-not $wheel) { throw 'candidate wheel was not downloaded' }
+          if ($wheel.Name -notmatch 'win_arm64') { throw "candidate is not a Windows ARM64 wheel: $($wheel.Name)" }
+          $digest = (Get-FileHash -Algorithm SHA256 $wheel.FullName).Hash.ToLowerInvariant()
+          $build = Get-Content candidate/build-evidence.json | ConvertFrom-Json
+          if ($digest -ne $build.wheel_sha256) { throw "artifact digest changed in transfer" }
+          python -m pip install --disable-pip-version-check --no-index --no-deps --only-binary=:all: $wheel.FullName
+          @'
+          import importlib.metadata
+          import json
+          import platform
+          import xa11y
+
+          evidence = {
+              "source_commit": "44594a9705a3f3213a9b58bc205f4e6335c9606b",
+              "package_version": importlib.metadata.version("xa11y"),
+              "system": platform.system(),
+              "machine": platform.machine(),
+              "python": platform.python_version(),
+              "imported": xa11y.__name__ == "xa11y",
+              "app_api_present": hasattr(xa11y, "App") and hasattr(xa11y.App, "by_name"),
+          }
+          try:
+              xa11y.App.by_name("__agent_dispatch_candidate_missing_app__", timeout=0)
+              evidence["missing_app"] = "unexpected-success"
+          except Exception as exc:
+              evidence["missing_app_exception"] = type(exc).__name__
+              evidence["missing_app_message"] = str(exc)[:1000]
+              evidence["missing_app_is_xa11y_error"] = isinstance(exc, xa11y.XA11yError)
+
+          print(json.dumps(evidence, indent=2, sort_keys=True))
+          if evidence["package_version"] != "0.14.0":
+              raise SystemExit("wrong package version")
+          if evidence["machine"].upper() != "ARM64":
+              raise SystemExit("dogfood did not run on native ARM64")
+          if not evidence["imported"] or not evidence["app_api_present"]:
+              raise SystemExit("candidate API probe failed")
+          if evidence.get("missing_app") == "unexpected-success":
+              raise SystemExit("missing-app negative control unexpectedly succeeded")
+          if not evidence.get("missing_app_is_xa11y_error", False):
+              raise SystemExit("missing-app failure was not surfaced as xa11y error")
+          with open("candidate-evidence.json", "w", encoding="utf-8") as f:
+              json.dump(evidence, f, indent=2, sort_keys=True)
+              f.write("\n")
+          '@ | Set-Content -Encoding utf8 candidate_probe.py
+          python candidate_probe.py
+          xa11y --help
+
+      - name: Retain qualified installable public candidate and evidence
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: xa11y-0.14.0-windows-arm64-qualified-candidate
+          path: |
+            candidate/**/*.whl
+            candidate/build-evidence.json
+            candidate-evidence.json
+          if-no-files-found: warn
+          retention-days: 14