Draft: validate reproducible Windows build baseline

.gitattributes

@@ -0,0 +1 @@
+*.swift text eol=lf

.github/PULL_REQUEST_TEMPLATE.md

@@ -12,11 +12,14 @@
 
 <!-- How did you verify this works? -->
 
--
+RED: <focused command> -> <failure proving the behavior was missing>
+GREEN: <same focused command> -> pass
+REGRESSION: <adjacent/full command> -> pass
 
 ## Checklist
 
 - [ ] I have read the [Contributing Guidelines](../CONTRIBUTING.md)
 - [ ] I have signed off my commits (`git commit -s`) per the DCO
 - [ ] Tests pass locally (`make test`)
 - [ ] Code follows the existing style (`make check`)
+- [ ] I added the test/contract before the implementation and observed the intended RED failure

.github/workflows/macos-shared-regression.yml

@@ -0,0 +1,47 @@
+name: macOS shared Swift regression
+
+on:
+  workflow_dispatch:
+  pull_request:
+    paths:
+      - "GraphcodeKit/**"
+      - "graphcode/**"
+      - "graphcoded/**"
+      - "graphcode-cli/**"
+      - "investigation/spikes/swift-portable/**"
+      - "Project.swift"
+      - "Tuist.swift"
+      - "Tuist/**"
+      - "mise.toml"
+      - "Makefile"
+      - ".gitmodules"
+      - "ThirdParty/**"
+      - "**/Package.swift"
+      - "**/Package.resolved"
+      - ".swift-format"
+      - ".swiftlint.yml"
+      - ".github/workflows/macos-shared-regression.yml"
+
+permissions:
+  contents: read
+
+jobs:
+  macos:
+    runs-on: macos-14
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          submodules: recursive
+          fetch-depth: 0
+      - name: Prepare portable Swift sources
+        run: python3 Tools/portable-prepare.py
+      - name: Install pinned mise tools
+        run: |
+          brew install mise
+          mise install
+      - name: Validate shared portable Swift package
+        run: mise exec -- swift test --package-path investigation/spikes/swift-portable
+      - name: Validate macOS app, daemon, and CLI
+        run: mise exec -- make test
+      - name: Validate macOS lint and formatting
+        run: mise exec -- make check

.github/workflows/tdd-evidence.yml

@@ -0,0 +1,18 @@
+name: TDD evidence
+
+on:
+  pull_request:
+    types: [opened, edited, synchronize, reopened]
+
+permissions:
+  contents: read
+
+jobs:
+  validate:
+    runs-on: windows-2022
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+
+      - name: Require RED, GREEN, and REGRESSION evidence
+        shell: pwsh
+        run: ./Tools/tdd/Test-TddEvidence.ps1 -EventPath $env:GITHUB_EVENT_PATH

.github/workflows/windows-hardening.yml

@@ -0,0 +1,81 @@
+name: Windows release hardening
+
+on:
+  workflow_dispatch:
+    inputs:
+      environment_target:
+        description: "Workspace-relative path to the owned environment harness"
+        required: false
+        type: string
+  schedule:
+    - cron: "17 3 * * 1"
+  pull_request:
+    paths:
+      - ".github/workflows/windows-hardening.yml"
+      - "Package.swift"
+      - "Package.resolved"
+      - "MailroomKit/**"
+      - "GraphcodeKit/**"
+      - "graphcode-cli/**"
+      - "graphcoded/**"
+      - "graphcode-windows/**"
+      - "windows-tests/**"
+      - "Tools/windows/**"
+      - "investigation/windows-implementation-plan.md"
+      - "Tools/windows/validation-matrix.md"
+
+permissions:
+  contents: read
+
+jobs:
+  deterministic:
+    name: "Deterministic hardening (${{ matrix.os }}, ${{ matrix.powershell }})"
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [windows-2022, windows-2025]
+        powershell: [pwsh]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - name: Run hardening contract
+        shell: pwsh
+        run: ./Tools/windows/validate.ps1 -Task hardening
+      - name: Verify runner contract
+        shell: pwsh
+        run: ./Tools/windows/Tests/ValidationRunner.Tests.ps1
+
+  full-pinned:
+    name: "Full pinned Windows validation"
+    if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
+    runs-on: windows-2022
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: compnerd/gha-setup-swift@397094e75494a93fa8d81db0268dbc8f5d6cf7c6 # v0.4.1
+        with:
+          swift-version: swift-6.3.3-release
+          swift-build: 6.3.3-RELEASE
+          cache: true
+      - name: Bootstrap exact Windows dependencies
+        shell: pwsh
+        run: ./Tools/windows/bootstrap.ps1 -ToolRoot .ci-tools -ProviderRoot .ci-providers
+      - name: Run complete release gate
+        shell: pwsh
+        run: ./Tools/windows/validate.ps1 -Task all -SkipTrayLive -SkipWslRemoteE2E
+      - name: Run real hardening matrix after release products
+        shell: pwsh
+        env:
+          GRAPHCODE_HARDENING_TARGET: ${{ github.workspace }}\Tools\windows\Tests\EnvironmentFixture.ps1
+        run: ./Tools/windows/Tests/Hardening.Tests.ps1 -Environment -SkipTrayLive
+
+  environment:
+    name: "Gated environment hardening"
+    if: github.event_name == 'workflow_dispatch' && inputs.environment_target != ''
+    runs-on: windows-2022
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - name: Run explicitly selected environment tier
+        shell: pwsh
+        env:
+          GRAPHCODE_HARDENING_TARGET: ${{ inputs.environment_target }}
+        run: ./Tools/windows/Tests/Hardening.Tests.ps1 -Environment -SchemaOnly

.github/workflows/windows-port-validation.yml

@@ -0,0 +1,44 @@
+name: Windows port validation
+
+on:
+  workflow_dispatch:
+  pull_request:
+    paths:
+      - ".github/workflows/windows-port-validation.yml"
+      - "Package.swift"
+      - "Package.resolved"
+      - "MailroomKit/**"
+      - "GraphcodeKit/**"
+      - "graphcode-cli/**"
+      - "graphcoded/**"
+      - "graphcode-windows/**"
+      - "windows-tests/**"
+      - "Tools/windows/**"
+      - "investigation/**"
+
+permissions:
+  contents: read
+
+jobs:
+  windows-spikes:
+    runs-on: windows-2022
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+
+      - uses: compnerd/gha-setup-swift@397094e75494a93fa8d81db0268dbc8f5d6cf7c6 # v0.4.1
+        with:
+          swift-version: swift-6.3.3-release
+          swift-build: 6.3.3-RELEASE
+          cache: true
+
+      - name: Bootstrap exact Windows dependencies
+        shell: pwsh
+        run: ./Tools/windows/bootstrap.ps1 -ToolRoot .ci-tools -ProviderRoot .ci-providers
+
+      - name: Verify validation runner contract
+        shell: pwsh
+        run: ./Tools/windows/Tests/ValidationRunner.Tests.ps1
+
+      - name: Run Windows port validation
+        shell: pwsh
+        run: ./Tools/windows/validate.ps1 -Task all -SkipTrayLive -SkipWslRemoteE2E

.github/workflows/windows-shell.yml

@@ -0,0 +1,56 @@
+name: Windows shell validation
+
+on:
+  workflow_dispatch:
+  pull_request:
+    paths:
+      - ".github/workflows/windows-shell.yml"
+      - "Package.swift"
+      - "Package.resolved"
+      - "MailroomKit/**"
+      - "GraphcodeKit/**"
+      - "graphcode-cli/**"
+      - "graphcoded/**"
+      - "windows-tests/**"
+      - "graphcode-windows/**"
+      - "Tools/windows/bootstrap.ps1"
+      - "Tools/windows/windows-shell.ps1"
+      - "Tools/windows/uia-live-gate.ps1"
+      - "Tools/windows/validate.ps1"
+      - "Tools/windows/Tests/WindowsShell.Tests.ps1"
+      - "Tools/windows/Tests/TrayDaemon.Tests.ps1"
+      - "Tools/windows/Tests/TrayLive.Tests.ps1"
+      - "Tools/windows/Tests/ValidationRunner.Tests.ps1"
+      - "Tools/windows/package.ps1"
+      - "Tools/windows/PACKAGING.md"
+      - "Tools/windows/Tests/Packaging.Tests.ps1"
+      - "Tools/windows/Tests/Packaging.RealLifecycle.Tests.ps1"
+      - "graphcode-windows/package-metadata.json"
+      - "investigation/windows-implementation-plan.md"
+
+permissions:
+  contents: read
+
+jobs:
+  windows-shell:
+    runs-on: windows-2022
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+
+      - uses: compnerd/gha-setup-swift@397094e75494a93fa8d81db0268dbc8f5d6cf7c6 # v0.4.1
+        with:
+          swift-version: swift-6.3.3-release
+          swift-build: 6.3.3-RELEASE
+          cache: true
+
+      - name: Bootstrap exact Windows dependencies
+        shell: pwsh
+        run: ./Tools/windows/bootstrap.ps1 -ToolRoot .ci-tools -ProviderRoot .ci-providers
+
+      - name: Verify shell contracts and pinned-provider smoke
+        shell: pwsh
+        run: ./Tools/windows/validate.ps1 -Task windows-shell -SkipTrayLive
+
+      - name: Validate release packaging
+        shell: pwsh
+        run: ./Tools/windows/validate.ps1 -Task packaging

.gitignore

@@ -19,6 +19,13 @@ xcuserdata/
 # SwiftPM
 .swiftpm/
 
+# Zig build outputs
+.zig-cache/
+zig-out/
+.graphcode-tools/
+.ci-tools/
+.ci-providers/
+
 # mise
 .mise.local.toml