[kiwidream]

	Files	Added	Deleted	Net
Test	2	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​91	$\color{#cf222e}{\Huge{\mathbf{−}}}$​47	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​44
Prod	1	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​66	$\color{#cf222e}{\Huge{\mathbf{−}}}$​56	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​10

ELI5

Since the 22 October sync, the fork's macOS build fails before it can publish. Release …202610221710 (build of 23cb211af5) went live with Linux assets only, so Mac users get no update from it. This PR moves each macOS architecture onto a GitHub runner of that architecture, so the failing check runs natively.

What Changed

build-mac in .github/workflows/swaplabs-build.yml is now a two-leg matrix:

• x64 builds on macos-15-intel;
• arm64 builds on macos-15.

Each leg packages, zips, signs, uploads and verifies only its own slice.

When a leg's update manifest fails verification, it removes only that slice's manifest and signature. Before, a failure removed both slices' manifests; a single job made that the same thing. Now one bad leg no longer takes away the other slice's verified update.

Why

Upstream stablyai#27021 (in the fork since #38) added a packaging check. After signing, it boots each slice's terminal-host helper and requires a working terminal within 20 s.

The fork packaged both slices on one arm64 runner, so the x64 helper ran under Rosetta. In build 23 it timed out at the 20 s mark on both attempts ("did not serve a PTY: no daemon token"). Upstream runs the same check on faster Blacksmith macOS runners.

Alternatives considered:

• A Blacksmith macOS runner, as upstream uses: availability for this org is unconfirmed, and the fork's tests require GitHub-hosted runners.
• Warming Rosetta before packaging: probably wouldn't help, because the signed helper is a different binary from any warmed copy.
• Raising the 20 s limit: that's upstream code.

The fork's own CI already runs on macos-15-intel (for example persistence (macos-15-intel) on #38).

Linked Issue

N/A. Found on build 23 after #38. Related: #39, the missing orcad template, which this doesn't change.

Visual Proof

N/A: CI only.

Testing

config/scripts/swaplabs-build-workflow.test.mjs and swaplabs-build-workflow-mac-signing.test.mjs are updated:

• runner per slice, matrix, per-arch package, zip and upload commands;
• the verify step's scenarios rewritten per slice, including that a bad arm64 upload leaves the x64 leg passing and its manifest attached.

Results:

• These two suites, the devvms-notify suite, the other swaplabs-* config tests and the workflow-scanning contract tests: 10 files, 252 passed, 1 skipped.
• oxfmt and oxlint are clean.

The workflow itself runs only on a push to swaplabs/main, so the real proof is the build that this merge triggers.

AI Disclosure

Prepared with Claude Code (Claude Opus 5.5).

Agent skill upstream boundary

• Not applicable: fork CI only.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-22T17:30:43.806243Z	8d41132	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.