Integrate reproducible Windows baseline

.gitattributes

@@ -0,0 +1 @@
+*.swift text eol=lf

.github/PULL_REQUEST_TEMPLATE.md

@@ -12,11 +12,14 @@
 
 <!-- How did you verify this works? -->
 
--
+RED: <focused command> -> <failure proving the behavior was missing>
+GREEN: <same focused command> -> pass
+REGRESSION: <adjacent/full command> -> pass
 
 ## Checklist
 
 - [ ] I have read the [Contributing Guidelines](../CONTRIBUTING.md)
 - [ ] I have signed off my commits (`git commit -s`) per the DCO
 - [ ] Tests pass locally (`make test`)
 - [ ] Code follows the existing style (`make check`)
+- [ ] I added the test/contract before the implementation and observed the intended RED failure

.github/workflows/dco.yml

@@ -0,0 +1,32 @@
+name: DCO
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
+
+permissions:
+  contents: read
+
+jobs:
+  signoff:
+    name: DCO sign-off
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        with:
+          fetch-depth: 0
+      - name: Require Signed-off-by on every pull request commit
+        shell: bash
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+        run: |
+          missing=0
+          while read -r commit; do
+            if ! git show -s --format=%B "$commit" \
+              | grep -Eq '^Signed-off-by: .+ <[^>]+>$'; then
+              echo "::error title=DCO sign-off missing::$commit has no Signed-off-by trailer"
+              missing=1
+            fi
+          done < <(git rev-list "$BASE_SHA..$HEAD_SHA")
+          exit "$missing"

.github/workflows/linux.yml

@@ -17,7 +17,7 @@ jobs:
     container: swift:6.2
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
       # Formatting, before anything slower. Five releases in a row reached main with
       # `swift-format --strict` failing — #320, #350, #351, #352 and one in
       # ProjectPersistence — every one a line the formatter wraps on its own, and every

.github/workflows/macos-shared-regression.yml

@@ -0,0 +1,52 @@
+name: macOS shared Swift regression
+
+on:
+  workflow_dispatch:
+  pull_request:
+    paths:
+      - "GraphcodeKit/**"
+      - "graphcode/**"
+      - "graphcoded/**"
+      - "graphcode-cli/**"
+      - "investigation/spikes/swift-portable/**"
+      - "Project.swift"
+      - "Tuist.swift"
+      - "Tuist/**"
+      - "mise.toml"
+      - "Makefile"
+      - ".gitmodules"
+      - "ThirdParty/**"
+      - "**/Package.swift"
+      - "**/Package.resolved"
+      - ".swift-format"
+      - ".swiftlint.yml"
+      - ".github/workflows/macos-shared-regression.yml"
+
+permissions:
+  contents: read
+
+jobs:
+  macos:
+    runs-on: macos-26
+    steps:
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        with:
+          submodules: recursive
+          fetch-depth: 0
+      - name: Prepare portable Swift sources
+        run: python3 Tools/portable-prepare.py
+      - name: Install pinned mise tools
+        run: |
+          brew install mise
+          mise install
+      - name: Validate shared portable Swift package
+        run: mise exec -- swift test --package-path investigation/spikes/swift-portable
+      - name: Install Tuist dependencies
+        run: mise exec -- tuist install
+      - name: Build and install zmx
+        run: mise exec -- make install-zmx
+      - name: Validate macOS app, daemon, and CLI
+        timeout-minutes: 30
+        run: mise exec -- make test
+      - name: Validate macOS lint and formatting
+        run: mise exec -- make check

.github/workflows/tdd-evidence.yml

@@ -0,0 +1,18 @@
+name: TDD evidence
+
+on:
+  pull_request:
+    types: [opened, edited, synchronize, reopened]
+
+permissions:
+  contents: read
+
+jobs:
+  validate:
+    runs-on: windows-2022
+    steps:
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+
+      - name: Require RED, GREEN, and REGRESSION evidence
+        shell: pwsh
+        run: ./Tools/tdd/Test-TddEvidence.ps1 -EventPath $env:GITHUB_EVENT_PATH

.github/workflows/windows-hardening.yml

@@ -2,12 +2,80 @@ name: Windows release hardening
 
 on:
   workflow_dispatch:
+    inputs:
+      environment_target:
+        description: "Workspace-relative path to the owned environment harness"
+        required: false
+        type: string
+  schedule:
+    - cron: "17 3 * * 1"
+  pull_request:
+    paths:
+      - ".github/workflows/windows-hardening.yml"
+      - "Package.swift"
+      - "Package.resolved"
+      - "MailroomKit/**"
+      - "GraphcodeKit/**"
+      - "graphcode-cli/**"
+      - "graphcoded/**"
+      - "graphcode-windows/**"
+      - "windows-tests/**"
+      - "Tools/windows/**"
+      - "investigation/windows-implementation-plan.md"
+      - "Tools/windows/validation-matrix.md"
 
 permissions:
   contents: read
 
 jobs:
-  registration:
-    runs-on: ubuntu-latest
+  deterministic:
+    name: "Deterministic hardening (${{ matrix.os }}, ${{ matrix.powershell }})"
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [windows-2022, windows-2025]
+        powershell: [pwsh]
+    runs-on: ${{ matrix.os }}
     steps:
-      - run: echo "Dispatch this workflow with a ref that contains the Windows hardening implementation."
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+      - name: Run hardening contract
+        shell: pwsh
+        run: ./Tools/windows/validate.ps1 -Task hardening
+      - name: Verify runner contract
+        shell: pwsh
+        run: ./Tools/windows/Tests/ValidationRunner.Tests.ps1
+
+  full-pinned:
+    name: "Full pinned Windows validation"
+    if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
+    runs-on: windows-2022
+    steps:
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+      - uses: compnerd/gha-setup-swift@397094e75494a93fa8d81db0268dbc8f5d6cf7c6 # v0.4.1
+        with:
+          swift-version: swift-6.3.3-release
+          swift-build: 6.3.3-RELEASE
+          cache: true
+      - name: Bootstrap exact Windows dependencies
+        shell: pwsh
+        run: ./Tools/windows/bootstrap.ps1 -ToolRoot .ci-tools -ProviderRoot .ci-providers
+      - name: Run complete release gate
+        shell: pwsh
+        run: ./Tools/windows/validate.ps1 -Task all -SkipTrayLive -SkipWslRemoteE2E
+      - name: Run real hardening matrix after release products
+        shell: pwsh
+        env:
+          GRAPHCODE_HARDENING_TARGET: ${{ github.workspace }}\Tools\windows\Tests\EnvironmentFixture.ps1
+        run: ./Tools/windows/Tests/Hardening.Tests.ps1 -Environment -SkipTrayLive
+
+  environment:
+    name: "Gated environment hardening"
+    if: github.event_name == 'workflow_dispatch' && inputs.environment_target != ''
+    runs-on: windows-2022
+    steps:
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+      - name: Run explicitly selected environment tier
+        shell: pwsh
+        env:
+          GRAPHCODE_HARDENING_TARGET: ${{ inputs.environment_target }}
+        run: ./Tools/windows/Tests/Hardening.Tests.ps1 -Environment -SchemaOnly

.github/workflows/windows-port-validation.yml

@@ -2,12 +2,43 @@ name: Windows port validation
 
 on:
   workflow_dispatch:
+  pull_request:
+    paths:
+      - ".github/workflows/windows-port-validation.yml"
+      - "Package.swift"
+      - "Package.resolved"
+      - "MailroomKit/**"
+      - "GraphcodeKit/**"
+      - "graphcode-cli/**"
+      - "graphcoded/**"
+      - "graphcode-windows/**"
+      - "windows-tests/**"
+      - "Tools/windows/**"
+      - "investigation/**"
 
 permissions:
   contents: read
 
 jobs:
-  registration:
-    runs-on: ubuntu-latest
+  windows-spikes:
+    runs-on: windows-2022
     steps:
-      - run: echo "Dispatch this workflow with a ref that contains the Windows port implementation."
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+
+      - uses: compnerd/gha-setup-swift@397094e75494a93fa8d81db0268dbc8f5d6cf7c6 # v0.4.1
+        with:
+          swift-version: swift-6.3.3-release
+          swift-build: 6.3.3-RELEASE
+          cache: true
+
+      - name: Bootstrap exact Windows dependencies
+        shell: pwsh
+        run: ./Tools/windows/bootstrap.ps1 -ToolRoot .ci-tools -ProviderRoot .ci-providers
+
+      - name: Verify validation runner contract
+        shell: pwsh
+        run: ./Tools/windows/Tests/ValidationRunner.Tests.ps1
+
+      - name: Run Windows port validation
+        shell: pwsh
+        run: ./Tools/windows/validate.ps1 -Task all -SkipTrayLive -SkipWslRemoteE2E

.github/workflows/windows-shell.yml

@@ -2,12 +2,55 @@ name: Windows shell validation
 
 on:
   workflow_dispatch:
+  pull_request:
+    paths:
+      - ".github/workflows/windows-shell.yml"
+      - "Package.swift"
+      - "Package.resolved"
+      - "MailroomKit/**"
+      - "GraphcodeKit/**"
+      - "graphcode-cli/**"
+      - "graphcoded/**"
+      - "windows-tests/**"
+      - "graphcode-windows/**"
+      - "Tools/windows/bootstrap.ps1"
+      - "Tools/windows/windows-shell.ps1"
+      - "Tools/windows/uia-live-gate.ps1"
+      - "Tools/windows/validate.ps1"
+      - "Tools/windows/Tests/WindowsShell.Tests.ps1"
+      - "Tools/windows/Tests/TrayDaemon.Tests.ps1"
+      - "Tools/windows/Tests/TrayLive.Tests.ps1"
+      - "Tools/windows/Tests/ValidationRunner.Tests.ps1"
+      - "Tools/windows/package.ps1"
+      - "Tools/windows/PACKAGING.md"
+      - "Tools/windows/Tests/Packaging.Tests.ps1"
+      - "Tools/windows/Tests/Packaging.RealLifecycle.Tests.ps1"
+      - "graphcode-windows/package-metadata.json"
+      - "investigation/windows-implementation-plan.md"
 
 permissions:
   contents: read
 
 jobs:
-  registration:
-    runs-on: ubuntu-latest
+  windows-shell:
+    runs-on: windows-2022
     steps:
-      - run: echo "Dispatch this workflow with a ref that contains the Windows shell implementation."
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+
+      - uses: compnerd/gha-setup-swift@397094e75494a93fa8d81db0268dbc8f5d6cf7c6 # v0.4.1
+        with:
+          swift-version: swift-6.3.3-release
+          swift-build: 6.3.3-RELEASE
+          cache: true
+
+      - name: Bootstrap exact Windows dependencies
+        shell: pwsh
+        run: ./Tools/windows/bootstrap.ps1 -ToolRoot .ci-tools -ProviderRoot .ci-providers
+
+      - name: Verify shell contracts and pinned-provider smoke
+        shell: pwsh
+        run: ./Tools/windows/validate.ps1 -Task windows-shell -SkipTrayLive
+
+      - name: Validate release packaging
+        shell: pwsh
+        run: ./Tools/windows/validate.ps1 -Task packaging

.gitignore

@@ -19,6 +19,13 @@ xcuserdata/
 # SwiftPM
 .swiftpm/
 
+# Zig build outputs
+.zig-cache/
+zig-out/
+.graphcode-tools/
+.ci-tools/
+.ci-providers/
+
 # mise
 .mise.local.toml