[steipete]

Move arm64 native and release-install checks from macos-15 to xcode-27. Retain x64 checks on macos-26-intel because they must prove native KERN_PROCARGS2 command inspection: the public API deliberately rejects that operation under Rosetta. The existing ARM lane separately proves Rosetta refusal; it now asserts or installs Rosetta first.

Preserve the shipped native addon deployment targets measured from the current 0.4.2 npm artifacts: macOS 10.12 for x64 and 11.0 for arm64. CI sets those targets explicitly and checks every built Darwin addon. Node retains its existing runtime requirements.

Add a dry-run-only manual release path on current main. It validates package versions, runs all native and installed-local-package checks, and assembles the complete release artifact set. Draft creation and all publishing/registry promotion jobs are skipped. Manual publication and non-main/stale source are rejected; live releases retain annotated protected-tag validation.

Validation: workflow lint, focused Darwin Rust test, full pnpm/native/Cargo checks on Crabbox, source-admission regression tests, and independent autoreview through P2. Exact-head and merged-main CI plus a merged-main dry run are required before completion. No tags, version bumps, or publications are included.

The Alpine test images now install Git, which the release source-admission fixtures require. The affected tests pass on both Node 22 and 24 Alpine containers; the full native matrix remains required on the final head.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-19T06:37:20.915160Z	bd59c15	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: d05d2f531e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[clawsweeper]

Codex review: needs changes before merge.

What this changes

This PR updates macOS runners, preserves native deployment targets, and adds a manual release dry run without publishing.

Example: A maintainer validates version 0.4.2 on current main.

• Before: The release workflow requires an annotated release tag.
• After: A manual dispatch with version 0.4.2 and dry_run=true validates and assembles packages while skipping publication.

Review scores

Measure	Result	What it means
Overall readiness	🦪 silver shellfish (2/6)	Useful, focused release maintenance with partial validation, but the new test prerequisite is missing from the musl environment.
Proof confidence	🦐 gold shrimp (3/6)	The maintainer-authored PR is exempt from the ordinary contributor proof gate; source-admission tests and successful macOS workflow checks support the implementation, but no completed manual release rehearsal was supplied.
Patch quality	🦪 silver shellfish (2/6)	2 actionable review findings remain.

Product

Kind: Maintenance · Worth it: Yes · Fix scope: Complete
User problem: Maintainers cannot exercise release assembly without a release tag, and macOS runner migration must preserve native inspection coverage and deployment targets.
Reason: The maintainer-authored direction adds a useful rehearsal path while retaining native Intel coverage and the existing publication safeguards.

Merge readiness

⛔ Needs changes before merge - 2 items remain

Keep this PR open: the maintainer-approved release tooling is useful and absent from main, but the new Git-dependent tests break the Alpine test environment.

Priority: P2
Reviewed head: d05d2f531e58bc1b956d0eb4f39d1623c9bbf865

Before merge

• Install Git in the Alpine lanes before running the new tests (P2) - Every new test reaches execFileSync("git") while creating its fixture. The musl jobs run the complete suite inside node:${NODE_MAJOR}-alpine, but their apk setup installs only build-base, curl, unzip, and bash. Git from the host checkout action is outside that container, so fixture initialization fails with ENOENT and prevents the musl bindings from reaching release collection. Add git to the container's apk dependencies while retaining these source-admission tests.
• Remove the maintenance-only changelog entry (P3) - This bullet describes internal CI and release rehearsal rather than a user-visible package outcome. Root AGENTS.md explicitly excludes maintenance-only CI changes from CHANGELOG.md, so the bullet would place prohibited internal details in the next package release notes. Remove it; RELEASE-PREREQS.md already documents the capability. This also confirms the concern in the existing review discussion.

Findings

• [P2] Install Git in the Alpine lanes before running the new tests — test/validate-release.test.ts:9-11
• [P3] Remove the maintenance-only changelog entry — CHANGELOG.md:5

Tests

• Missing end-to-end proof: No completed manual release run demonstrates artifact collection with publication skipped, and base-fail/head-pass evidence for the added tests was not supplied.

Agent review details

How this fits together

GitHub Actions feeds reviewed source into native build and package validation jobs, which produce release artifacts before protected tag runs publish and promote packages.

flowchart TD
  A[Manual dispatch or protected tag] --> B[Validate source and versions]
  B --> C[Native builds and runtime checks]
  C --> D[Assemble package artifacts]
  D --> E[Manual dry run finishes]
  D --> F[Tag release publishes packages]
  F --> G[Registry verification and install smoke]
  G --> H[Promote release]

Loading

Technical review

Best possible solution:

Keep the existing release pipeline, install Git in its Alpine test container, and leave CI-only details in the release documentation.

Do we have a high-confidence way to reproduce the issue?

The added fixture unconditionally executes Git, and the existing Alpine setup does not install it; no target code was run, and the failing jobs' detailed traces were inaccessible.

Is this the best way to solve the issue?

Reusing the native and collection jobs is a focused implementation that preserves publication ownership; supplying the new test prerequisite completes the integration.

Full review comments:

• [P2] Install Git in the Alpine lanes before running the new tests — test/validate-release.test.ts:9-11
  Every new test reaches execFileSync("git") while creating its fixture. The musl jobs run the complete suite inside node:${NODE_MAJOR}-alpine, but their apk setup installs only build-base, curl, unzip, and bash. Git from the host checkout action is outside that container, so fixture initialization fails with ENOENT and prevents the musl bindings from reaching release collection. Add git to the container's apk dependencies while retaining these source-admission tests.
  Confidence: 0.98
• [P3] Remove the maintenance-only changelog entry — CHANGELOG.md:5
  This bullet describes internal CI and release rehearsal rather than a user-visible package outcome. Root AGENTS.md explicitly excludes maintenance-only CI changes from CHANGELOG.md, so the bullet would place prohibited internal details in the next package release notes. Remove it; RELEASE-PREREQS.md already documents the capability. This also confirms the concern in the existing review discussion.
  Confidence: 1

Overall correctness: patch is incorrect
Overall confidence: 0.97

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 8a610a06e5ba.

Provenance checked

• Release source admission and publication gates keeps the original intent (5852b3e: The original workflow restricts publication to annotated protected tags pointing at latest main.)
• Installed-package promotion checks keeps the original intent (75a90ef: A published macOS install failure motivated real installed-package checks before release promotion, as documented in ci(release): gate promotion on a fresh public-registry install smoke #13.)
• Native Intel and Rosetta coverage keeps the original intent (f44b488: Native command inspection and deliberate Rosetta refusal require separate runtime coverage; the runner migration preserves both paths.)

Testing

Proof path: unit tests only.

Security

None.

Evidence

Acceptance criteria:

• pnpm test test/validate-release.test.ts
• pnpm check
• git diff --check
• Confirm the existing Lint workflows check passes.
• Confirm linux-x64-musl and linux-arm64-musl jobs pass on Node 22 and Node 24.

What I checked:

• Pinned PR change: The introduced diff adds manual dispatch, source admission checks, macOS runner changes, and seven source-admission tests; these changes are absent from the pinned main revision. (.github/workflows/release.yml:6, d05d2f531e58)
• Git prerequisite missing from Alpine: Every added test initializes a real Git repository, while the node Alpine container installs build-base, curl, unzip, and bash without Git before running the complete test suite. (test/validate-release.test.ts:10, d05d2f531e58)
• CI failure scope and inspection limit: All four musl checks failed; the inspected Node 24 x64 job failed in Build and execute on musl before artifact upload. Annotations give only exit code 1. Detailed logs redirected to a blocked Azure host, so the exact failure trace was unavailable; the Git dependency defect is independently source-reproducible. (.github/workflows/native.yml:166, d05d2f531e58)
• Applicable changelog policy: The complete root AGENTS.md excludes maintenance-only CI changes from the changelog. The existing review discussion identifies the same added dry-run bullet: ci: migrate ARM runners and add release dry runs #26 (comment). (CHANGELOG.md:5, d05d2f531e58)
• Existing release owner and intent: Feature history and ci(release): gate promotion on a fresh public-registry install smoke #13 establish the existing owner and the reason for registry verification followed by real installed-package checks; this PR retains those publication gates. (.github/workflows/release.yml:124, 75a90ef5f611)
• Read-only review and policy coverage: Only the root AGENTS.md was found; no nested policy, maintainer notes, or pr-simplify skill was present. The checkout remained clean and diff whitespace validation passed. One historical stat inspection encountered an unavailable promisor object; relevant base blobs and feature history were readable. (AGENTS.md:1, d05d2f531e58)

Labels

Label changes:

• add P2: This is useful release maintenance with a focused CI dependency defect, without evidence of a shipped runtime regression.
• add merge-risk: 🚨 automation: The added tests require Git inside Alpine containers that do not install it, preventing native validation and downstream release artifact collection.
• add rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🦐 gold shrimp and patch quality is 🦪 silver shellfish.
• add status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action.

Label justifications:

• P2: This is useful release maintenance with a focused CI dependency defect, without evidence of a shipped runtime regression.
• merge-risk: 🚨 automation: The added tests require Git inside Alpine containers that do not install it, preventing native validation and downstream release artifact collection.
• rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🦐 gold shrimp and patch quality is 🦪 silver shellfish.
• status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

Reviewed October 19, 2026, 2:00 AM ET / 06:00 UTC.