Feature/v0.2

.github/workflows/ci.yml

@@ -19,7 +19,7 @@ jobs:
           - macos-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@1.85.0
+      - uses: dtolnay/rust-toolchain@1.88.0
         with:
           components: clippy,rustfmt
       - uses: Swatinem/rust-cache@v2
@@ -32,7 +32,7 @@ jobs:
     runs-on: windows-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@1.85.0
+      - uses: dtolnay/rust-toolchain@1.88.0
         with:
           components: clippy,rustfmt
       - uses: Swatinem/rust-cache@v2
@@ -55,6 +55,14 @@ jobs:
           }
           $env:AGENTMESH_LATEST_VERSION = "v$($versionLine.Matches[0].Groups[1].Value)"
           powershell -NoProfile -ExecutionPolicy Bypass -File installers/install.ps1 -PrintUrl
+          $devUrl = powershell -NoProfile -ExecutionPolicy Bypass -File installers/install.ps1 -Channel dev -PrintUrl
+          if ($devUrl -notmatch "/dev/agentmesh-dev-x86_64-pc-windows-msvc\.tar\.gz$") {
+            throw "unexpected dev installer URL: $devUrl"
+          }
+          $devWrapperUrl = powershell -NoProfile -ExecutionPolicy Bypass -File installers/install-dev.ps1 -PrintUrl
+          if ($devWrapperUrl -notmatch "/dev/agentmesh-dev-x86_64-pc-windows-msvc\.tar\.gz$") {
+            throw "unexpected install-dev.ps1 URL: $devWrapperUrl"
+          }
       - name: Verify Windows installer banner rendering
         shell: powershell
         run: |
@@ -124,7 +132,10 @@ jobs:
                   && args[3] == "--bundle"
                   && Path::new(&args[4]).is_file()
                   && args[5] == "--certificate-identity-regexp"
-                  && args[6] == r"^https://github.com/aranticlabs/agentmesh/.github/workflows/release.yml@refs/tags/v.*"
+                  && (
+                      args[6] == r"^https://github.com/aranticlabs/agentmesh/.github/workflows/release.yml@refs/tags/v.*"
+                      || args[6] == r"^https://github.com/aranticlabs/agentmesh/.github/workflows/dev-release.yml@refs/heads/dev$"
+                  )
                   && args[7] == "--certificate-oidc-issuer"
                   && args[8] == "https://token.actions.githubusercontent.com"
                   && Path::new(&args[9]).is_file();
@@ -146,6 +157,23 @@ jobs:
           & (Join-Path $install "agentmesh.exe") --version
           Assert-LastExitCode "installed agentmesh.exe did not run"
 
+          $devRelease = Join-Path $tmp "releases\dev"
+          $devStage = Join-Path $tmp "dev-stage\agentmesh"
+          $devInstall = Join-Path $tmp "dev-install"
+          New-Item -ItemType Directory -Path $devRelease, $devStage, $devInstall -Force | Out-Null
+          Copy-Item target\release\agentmesh.exe (Join-Path $devStage "agentmesh.exe")
+          $devArtifact = "agentmesh-dev-x86_64-pc-windows-msvc.tar.gz"
+          tar -czf (Join-Path $devRelease $devArtifact) -C (Join-Path $tmp "dev-stage") agentmesh
+          Assert-LastExitCode "failed to create dev test release archive"
+          $devHash = (Get-FileHash -Algorithm SHA256 -Path (Join-Path $devRelease $devArtifact)).Hash.ToLowerInvariant()
+          Set-Content -NoNewline -Path (Join-Path $devRelease "SHA256SUMS") -Value "$devHash  $devArtifact`n"
+          New-Item -ItemType File -Path (Join-Path $devRelease "SHA256SUMS.sig"), (Join-Path $devRelease "SHA256SUMS.bundle") -Force | Out-Null
+
+          powershell -NoProfile -ExecutionPolicy Bypass -File installers/install.ps1 -Channel dev -InstallDir $devInstall
+          Assert-LastExitCode "install.ps1 failed for valid fake dev release"
+          & (Join-Path $devInstall "agentmesh.exe") --version
+          Assert-LastExitCode "installed dev agentmesh.exe did not run"
+
           Set-Content -NoNewline -Path (Join-Path $release "SHA256SUMS") -Value "0000  $artifact`n"
           powershell -NoProfile -ExecutionPolicy Bypass -File installers/install.ps1 -Channel stable -InstallDir (Join-Path $tmp "bad-install")
           $badExitCode = $LASTEXITCODE
@@ -159,7 +187,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@1.85.0
+      - uses: dtolnay/rust-toolchain@1.88.0
         with:
           targets: x86_64-unknown-linux-musl
       - uses: Swatinem/rust-cache@v2
@@ -172,21 +200,19 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@1.85.0
+      - uses: dtolnay/rust-toolchain@1.88.0
       - uses: Swatinem/rust-cache@v2
       - uses: taiki-e/install-action@v2
         with:
           tool: cargo-deny,cargo-audit
       - run: make ci-supply-chain
-      - run: cargo deny --manifest-path fuzz/Cargo.toml check
-      - run: cargo audit --file fuzz/Cargo.lock
 
   installers:
     name: installer smoke
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@1.85.0
+      - uses: dtolnay/rust-toolchain@1.88.0
       - uses: Swatinem/rust-cache@v2
       - run: cargo build --locked --release -p agentmesh
       - run: make ci-installers
@@ -240,13 +266,17 @@ jobs:
           case "$stable_tag" in v[0-9]*.[0-9]*.[0-9]*) ;; *) echo "failed to parse stable installer URL: $stable_artifact_url" >&2; exit 1 ;; esac
           case "$stable_version" in [0-9]*.[0-9]*.[0-9]*) ;; *) echo "failed to parse stable installer URL: $stable_artifact_url" >&2; exit 1 ;; esac
           nightly="$(sh installers/install.sh --print-url --channel=nightly)"
+          dev="$(sh installers/install.sh --print-url --channel=dev)"
+          dev_wrapper="$(sh installers/install-dev.sh --print-url)"
           case "$stable" in */"$stable_tag"/agentmesh-v"$stable_version"-*) ;; *) exit 1 ;; esac
           case "$nightly" in */nightly/*) ;; *) exit 1 ;; esac
+          case "$dev" in */dev/agentmesh-dev-*) ;; *) exit 1 ;; esac
+          case "$dev_wrapper" in */dev/agentmesh-dev-*) ;; *) exit 1 ;; esac
 
           tmp="$(mktemp -d)"
           trap 'rm -rf "$tmp"' EXIT
           platform="$(sh installers/install.sh --print-platform)"
-          mkdir -p "$tmp/releases/$stable_tag" "$tmp/releases/nightly" "$tmp/cosign-base"
+          mkdir -p "$tmp/releases/$stable_tag" "$tmp/releases/nightly" "$tmp/releases/dev" "$tmp/cosign-base"
 
           cosign_artifact="$tmp/cosign-base/cosign-linux-amd64"
           cat >"$cosign_artifact" <<'EOF'
@@ -259,7 +289,11 @@ jobs:
           test "$4" = "--bundle"
           test -f "$5"
           test "$6" = "--certificate-identity-regexp"
-          test "$7" = "^https://github.com/aranticlabs/agentmesh/.github/workflows/release.yml@refs/tags/v.*"
+          case "$7" in
+            "^https://github.com/aranticlabs/agentmesh/.github/workflows/release.yml@refs/tags/v.*") ;;
+            "^https://github.com/aranticlabs/agentmesh/.github/workflows/dev-release.yml@refs/heads/dev$") ;;
+            *) exit 1 ;;
+          esac
           test "$8" = "--certificate-oidc-issuer"
           test "$9" = "https://token.actions.githubusercontent.com"
           test -f "${10}"
@@ -284,8 +318,10 @@ jobs:
 
           stable_artifact="agentmesh-v$stable_version-$platform.tar.gz"
           nightly_artifact="agentmesh-nightly-$platform.tar.gz"
+          dev_artifact="agentmesh-dev-$platform.tar.gz"
           create_release "$stable_tag" "$stable_artifact"
           create_release "nightly" "$nightly_artifact"
+          create_release "dev" "$dev_artifact"
 
           export AGENTMESH_BASE_URL="file://$tmp/releases"
           export AGENTMESH_COSIGN_BASE_URL="file://$tmp/cosign-base"
@@ -295,6 +331,10 @@ jobs:
           "$tmp/shell-stable/agentmesh" --version
           PATH="/usr/bin:/bin" AGENTMESH_COSIGN_DIR="$tmp/cosign-shell-nightly" sh installers/install.sh --channel=nightly --install-dir="$tmp/shell-nightly"
           "$tmp/shell-nightly/agentmesh" --version
+          PATH="/usr/bin:/bin" AGENTMESH_COSIGN_DIR="$tmp/cosign-shell-dev" sh installers/install.sh --channel=dev --install-dir="$tmp/shell-dev"
+          "$tmp/shell-dev/agentmesh" --version
+          PATH="/usr/bin:/bin" AGENTMESH_COSIGN_DIR="$tmp/cosign-shell-dev-wrapper" sh installers/install-dev.sh --install-dir="$tmp/shell-dev-wrapper"
+          "$tmp/shell-dev-wrapper/agentmesh" --version
 
           e2e_repo="$tmp/e2e-repo"
           mkdir -p "$e2e_repo/.claude/skills/demo"

.github/workflows/dev-release.yml

@@ -0,0 +1,134 @@
+name: dev release
+
+on:
+  push:
+    branches:
+      - dev
+
+concurrency:
+  group: dev-release
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  gate:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - uses: dtolnay/rust-toolchain@1.88.0
+        with:
+          components: clippy,rustfmt
+      - uses: Swatinem/rust-cache@v2
+      - uses: taiki-e/install-action@v2
+        with:
+          tool: cargo-deny,cargo-audit
+      - run: make release-gate PERF_FULL_SYNC_BUDGET_SECONDS=5 PERF_HOOK_P99_BUDGET_MS=100
+      - run: make ci-installers
+      - run: sh installers/install-dev.sh --smoke
+
+  build-artifacts:
+    name: build ${{ matrix.target }}
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-latest
+            target: x86_64-unknown-linux-gnu
+          - os: ubuntu-latest
+            target: x86_64-unknown-linux-musl
+          - os: ubuntu-latest
+            target: aarch64-unknown-linux-gnu
+          - os: macos-latest
+            target: x86_64-apple-darwin
+          - os: macos-latest
+            target: aarch64-apple-darwin
+          - os: windows-latest
+            target: x86_64-pc-windows-msvc
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - uses: dtolnay/rust-toolchain@1.88.0
+        with:
+          targets: ${{ matrix.target }}
+      - uses: Swatinem/rust-cache@v2
+      - name: Install Linux cross linker
+        if: matrix.target == 'aarch64-unknown-linux-gnu'
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y gcc-aarch64-linux-gnu
+          echo 'CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER=aarch64-linux-gnu-gcc' >> "$GITHUB_ENV"
+      - name: Install musl tools
+        if: matrix.target == 'x86_64-unknown-linux-musl'
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y musl-tools
+      - name: Build
+        run: cargo build --locked --release --target ${{ matrix.target }} -p agentmesh
+      - name: Stage artifact
+        shell: bash
+        run: |
+          set -euo pipefail
+          name="agentmesh-dev-${{ matrix.target }}"
+          mkdir -p "dist/${name}"
+          binary="target/${{ matrix.target }}/release/agentmesh"
+          suffix=""
+          if [[ "${{ matrix.target }}" == *windows* ]]; then
+            binary="${binary}.exe"
+            suffix=".exe"
+          fi
+          cp "$binary" "dist/${name}/agentmesh${suffix}"
+          tar -C dist -czf "dist/${name}.tar.gz" "${name}"
+      - name: Upload artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: agentmesh-dev-${{ matrix.target }}
+          path: dist/agentmesh-dev-${{ matrix.target }}.tar.gz
+          if-no-files-found: error
+
+  publish:
+    runs-on: ubuntu-latest
+    needs:
+      - gate
+      - build-artifacts
+    permissions:
+      contents: write
+      id-token: write
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - uses: actions/download-artifact@v4
+        with:
+          path: dist
+          merge-multiple: true
+      - name: Generate checksum manifest
+        run: |
+          cd dist
+          sha256sum agentmesh-dev-* > SHA256SUMS
+      - uses: sigstore/cosign-installer@v3
+      - name: Sign checksum manifest
+        run: cosign sign-blob --yes --output-signature dist/SHA256SUMS.sig --bundle dist/SHA256SUMS.bundle dist/SHA256SUMS
+      - name: Publish dev release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          cat >release-notes.md <<EOF
+          AgentMesh dev build from ${GITHUB_SHA}.
+
+          This release is mutable and is intended for testing the dev installer only.
+          EOF
+          gh release delete dev --yes --cleanup-tag >/dev/null 2>&1 || true
+          git tag -f dev "$GITHUB_SHA"
+          git push --force origin refs/tags/dev
+          gh release create dev dist/* \
+            --title "AgentMesh dev" \
+            --notes-file release-notes.md \
+            --prerelease \
+            --target "$GITHUB_SHA"