RELEASE-3 W3: test exact built artifacts before publishing the same files (G-C)

[AminDhouib]

RELEASE-3 (W3) — gap G-C: build once, test those exact files, publish those exact files

Stacked on audit/release-fix-c (95ddb75). Zero src/ production edits.

Topology

The distribution is built exactly once per run, in build-dist, which hashes it
into release-manifest.json and uploads dist/ as the run's one immutable artifact.
Everything downstream downloads that artifact:

job	what it proves
build-dist	one uv build; metadata + package data valid; SHA-256 + version recorded
package-verify	the downloaded bytes are the built bytes, and the artifacts are structurally complete — plus three in-job bite proofs
install-smoke	{wheel, sdist} × cells: fresh venv, local install by absolute path with caches disabled, then W1's canonical journey, unchanged

publish.yml no longer has its own test/build path: at the tag SHA it calls the same
reusable gate with ref + release_tag, then downloads that run's already-hashed
dist/, re-verifies it, and uploads those very files. It never runs uv build, never
rebuilds from the checkout, and never re-downloads the version from PyPI. A failed,
skipped, or cancelled cell leaves needs.gate non-success and nothing is published.

All three new edges are direct needs of the stable release-gate aggregate.

One home, not a second mechanism

Every packaging fact lives in tools/package_verify.py (stdlib only) — manifest,
verify, hash-check, assert-version. build-dist, package-verify,
install-smoke, and publish.yml all call that same code instead of four shell blocks
that can drift. tools/install_smoke.py imports W1's journey from
tests/release_gate_harness.py unchanged; there is no second journey and no second
fixture mechanism.

embedded/js is real package data

The cloner engine reads those seven scripts at runtime, so a wheel that omits them
installs and imports fine and only fails on first use. verify proves the wheel and the
sdist carry byte-identical copies (comparing the two artifacts to each other, not
to the git checkout, so no runner's line-ending policy can make the check lie), and the
smoke proves the files landing in a fresh site-packages are those same bytes.

Bite proofs — no repository mutation

Run in package-verify against throwaway copies. tools/corrupt_artifact.py is
copy-only by construction: it refuses to write to its source and re-checks the source
size afterwards. No temp branch, commit, push, tag, or publication.

1. flipped byte → hash-check rejects it.
2. wheel missing extract_styles.js → the copy is re-hashed into its own manifest
   first, so only the membership rule can reject it, independent of hashing. Both
   manifest and verify reject.
3. wrong tag → assert-version (the publish precondition) rejects it.

Then the job re-verifies that the real artifact is still intact. The same rules are
pinned hermetically in tests/test_package_verify.py (23 tests, synthetic wheels/sdists,
no network) so each one is proven to bite rather than merely to pass.

macOS install-smoke and F-773 - the experiment, and its answer

The six cells were pushed unexcluded in the first round, because whether F-773
reaches this lane is an empirical question, not one to assume. It does.

Round 1 (run 30161880495): 4 of 6 green - wheel+sdist on Linux/X64 and
Windows/X64. Both macOS/ARM64 cells failed with F-773's exact signature:
about:blank ok in 1.1s/3.1s, a connection to the closed port 127.0.0.1:1
hung 35.3s, the fixture server served nothing, the network.mojom.NetworkService
process alive throughout, workspace already under RUNNER_TEMP.

New information: this reproduced from a fresh install of the built wheel and
sdist, not from the editable checkout - so install layout is eliminated as a
factor. The hang happens through the exact files a user downloads. Recorded in
finding_F773_macos_detached_navigation.md (now 13/13 reproductions).

The macOS cells therefore now run a declared partial stage: install + launcher
resolve + initialize + tools/list (94) + list_instances, and no
navigation. run_release_gate_journey gained a stages parameter selecting how
far the ONE journey runs - never which journey. This is not an xfail and
not continue-on-error: nothing failing is marked expected-to-fail, and no
cell is silently skipped. A strictly smaller claim is made, and it is named in the
check name (NO-NAVIGATION partial), in a per-cell warning annotation, in the
tool's stdout, in the result record (stages, navigation_verified: false), and
in the known-gaps job (renamed from transport-known-gaps - one home for gap
declarations, now that the same root cause bounds two lanes).

So the gate claims, on macOS/ARM64: the published artifacts install and serve.
It does not claim they navigate.

Topology pins

tests/test_release_workflows.py (14 tests) turns the properties nothing executes
on a normal PR into assertions: publish never builds, publish calls the reusable
gate and re-verifies what it downloads, the aggregate's needs equals every other
job in the file, every edge's result is actually checked, if: always() is intact,
nothing sets continue-on-error, and the macOS cells stay handshake while the
others stay full. Each was proven to bite by temporarily mutating the workflow
and watching the specific test go red.

Observed flake (routed, NOT fixed)

Chrome cold start intermittently fails outright on hosted Ubuntu runners with
nodriver's Failed to connect to browser, after the harness's two warmup attempts
are exhausted. Seen 3 times across 3 runs (transport (Linux/X64) once;
both install-smoke (*/Linux/X64) cells once), each time passing on a plain
re-run with identical code and identical Chrome (150.0.7871.128). It is not
specific to W3 - it hit W1's transport lane too - and it is environmental, not a
packaging defect. Flagged to the team lead for an F-id; deliberately not fixed
here, since the remedy lives in the harness's warmup/retry policy which W3 does
not own.

Incidental find

.claude/worktrees/ (a full repo checkout per agent worktree) was untracked and
un-ignored, so hatchling swept it into the sdist: a local uv build produced a 56 MB
sdist of which 55 MB was that directory. Now gitignored → 14 MB. It also stops ruff
linting three extra copies of the source tree (501 files scanned → 129).

Local verification

ruff format/check, ty (76-diagnostic baseline), vulture, file budgets, and
suppression owners all clean. Unit lane 784 passed (761 pre-existing + 23 new).
actionlint 1.7.7 clean on all three workflows. Both artifact kinds were additionally
smoked end-to-end on Windows against the real uv build output, and all three bite
proofs rehearsed against it, before the first CI round.