pi-oracle 0.7.21 → 0.7.23

package/scripts/platform-smoke/invariants.mjs

@@ -3,12 +3,13 @@
 
 import assert from "node:assert/strict";
 import { spawnSync } from "node:child_process";
-import { mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { chmodSync, existsSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { fileURLToPath } from "node:url";
 import config from "../../platform-smoke.config.mjs";
 import { writeManifest } from "./artifacts.mjs";
+import { buildTargetBaseArgs } from "./crabbox-runner.mjs";
 import { buildPlatformBuildCommand, buildRealExtensionCommand } from "./targets.mjs";
 
 const repoRoot = fileURLToPath(new URL("../..", import.meta.url));
@@ -27,10 +28,23 @@ function testHelpTextIncludesTargetsAndExamples() {
 }
 
 function testTargetSelection() {
-  const result = runNode(["scripts/platform-smoke.mjs", "run", "--target", "not-a-target", "--suite", "platform-build"]);
-  assert.notEqual(result.status, 0, "unsupported targets should fail before Crabbox runs");
-  assert.ifError(result.error);
-  assert.match(`${result.stdout ?? ""}\n${result.stderr ?? ""}`, /unsupported target: not-a-target/);
+  for (const command of ["doctor", "run"]) {
+    const result = withEnv({ PI_ORACLE_SMOKE_CRABBOX: "/nonexistent/crabbox" }, () =>
+      runNode(["scripts/platform-smoke.mjs", command, "--target", "not-a-target"]));
+    assert.notEqual(result.status, 0, `${command}: unsupported targets should fail before Crabbox runs`);
+    assert.ifError(result.error);
+    assert.match(`${result.stdout ?? ""}\n${result.stderr ?? ""}`, /unsupported target: not-a-target/);
+  }
+}
+
+function testEmptyTargetSelectionRejected() {
+  for (const command of ["doctor", "run"]) {
+    const result = withEnv({ PI_ORACLE_SMOKE_CRABBOX: "/nonexistent/crabbox" }, () =>
+      runNode(["scripts/platform-smoke.mjs", command, "--target", ",,"]));
+    assert.notEqual(result.status, 0, `${command}: an empty target selection must fail instead of running nothing`);
+    assert.ifError(result.error);
+    assert.match(`${result.stdout ?? ""}\n${result.stderr ?? ""}`, /--target did not resolve to any targets/);
+  }
 }
 
 function testPackedInstallCommandRendering() {
@@ -61,17 +75,230 @@ function testManifestFailure() {
   }
 }
 
-function testCleanupFailureInvariant() {
-  const source = readFileSync(new URL("./targets.mjs", import.meta.url), "utf8");
-  assert.match(source, /recordStopResultOnSuite/, "multi-suite runs should record stop evidence on suite artifacts");
-  assert.match(source, /lease-stop/, "cleanup results should be asserted as lease-stop");
-  assert.match(source, /stop exit/, "cleanup failure should surface a stop exit error");
+function withEnv(overrides, run) {
+  const names = Object.keys(overrides);
+  const saved = {};
+  for (const name of names) {
+    saved[name] = process.env[name];
+    if (overrides[name] === undefined) delete process.env[name];
+    else process.env[name] = overrides[name];
+  }
+  try {
+    return run();
+  } finally {
+    for (const name of names) {
+      if (saved[name] === undefined) delete process.env[name];
+      else process.env[name] = saved[name];
+    }
+  }
+}
+
+function testTargetBaseArgsEnvPrecedence() {
+  withEnv({
+    PI_ORACLE_SMOKE_UBUNTU_IMAGE: undefined,
+    PLATFORM_SMOKE_UBUNTU_IMAGE: undefined,
+    PI_ORACLE_SMOKE_MAC_WORK_ROOT: undefined,
+    PLATFORM_SMOKE_MAC_WORK_ROOT: undefined,
+    PI_ORACLE_SMOKE_MAC_PORT: undefined,
+    PLATFORM_SMOKE_MAC_PORT: undefined,
+    PI_ORACLE_SMOKE_WINDOWS_NATIVE_WORK_ROOT: undefined,
+    PLATFORM_SMOKE_WINDOWS_WORK_ROOT: undefined,
+  }, () => {
+    const baseline = buildTargetBaseArgs("ubuntu", {});
+    assert.deepEqual(
+      baseline,
+      ["--provider", "local-container", "--target", "linux", "--local-container-image", "pi-oracle-platform-smoke:node24"],
+      "default ubuntu target args should use the documented default image",
+    );
+
+    process.env.PLATFORM_SMOKE_UBUNTU_IMAGE = "invariants-shared-image";
+    let args = buildTargetBaseArgs("ubuntu", {});
+    assert(args.includes("invariants-shared-image"), "shared PLATFORM_SMOKE_UBUNTU_IMAGE override should reach target args");
+
+    process.env.PI_ORACLE_SMOKE_UBUNTU_IMAGE = "invariants-private-image";
+    args = buildTargetBaseArgs("ubuntu", {});
+    assert(args.includes("invariants-private-image") && !args.includes("invariants-shared-image"), "private PI_ORACLE_SMOKE_UBUNTU_IMAGE alias should win over the shared alias");
+
+    delete process.env.PI_ORACLE_SMOKE_UBUNTU_IMAGE;
+    delete process.env.PLATFORM_SMOKE_UBUNTU_IMAGE;
+
+    process.env.PLATFORM_SMOKE_MAC_WORK_ROOT = "/invariants/shared-work";
+    args = buildTargetBaseArgs("macos", {});
+    assert(args.includes("/invariants/shared-work"), "shared PLATFORM_SMOKE_MAC_WORK_ROOT override should reach target args");
+
+    process.env.PI_ORACLE_SMOKE_MAC_WORK_ROOT = "/invariants/private-work";
+    args = buildTargetBaseArgs("macos", {});
+    assert(args.includes("/invariants/private-work") && !args.includes("/invariants/shared-work"), "private PI_ORACLE_SMOKE_MAC_WORK_ROOT alias should win over the shared alias");
+
+    assert.equal(args[args.indexOf("--static-port") + 1], "22", "macOS SSH defaults to port 22");
+    process.env.PLATFORM_SMOKE_MAC_PORT = "2200";
+    args = buildTargetBaseArgs("macos", {});
+    assert.equal(args[args.indexOf("--static-port") + 1], "2200", "shared macOS port reaches Crabbox");
+    process.env.PI_ORACLE_SMOKE_MAC_PORT = "2201";
+    args = buildTargetBaseArgs("macos", {});
+    assert.equal(args[args.indexOf("--static-port") + 1], "2201", "project macOS port takes precedence");
+
+    process.env.PLATFORM_SMOKE_WINDOWS_WORK_ROOT = "C:\\invariants\\shared-work";
+    args = buildTargetBaseArgs("windows-native", {});
+    assert(args.includes("C:\\invariants\\shared-work"), "shared PLATFORM_SMOKE_WINDOWS_WORK_ROOT override should reach target args");
+
+    process.env.PI_ORACLE_SMOKE_WINDOWS_NATIVE_WORK_ROOT = "C:\\invariants\\private-work";
+    args = buildTargetBaseArgs("windows-native", {});
+    assert(args.includes("C:\\invariants\\private-work") && !args.includes("C:\\invariants\\shared-work"), "private PI_ORACLE_SMOKE_WINDOWS_NATIVE_WORK_ROOT alias should win over the shared alias");
+  });
+}
+
+const DRIVER_SOURCE = [
+  "import { writeFileSync } from 'node:fs';",
+  "import { pathToFileURL } from 'node:url';",
+  "const [targetsPath, artifactRoot, payloadPath] = process.argv.slice(2);",
+  "const { runTargetSuites } = await import(pathToFileURL(targetsPath).href);",
+  "const config = {",
+  "  packageName: 'pi-oracle',",
+  "  artifactRoot,",
+  "  realSmoke: { authEnvByProvider: { zai: ['ZAI_API_KEY'] } },",
+  "};",
+  "const result = await runTargetSuites(config, 'ubuntu', ['real-extension']);",
+  "writeFileSync(payloadPath, `${JSON.stringify({",
+  "  ok: result.ok,",
+  "  results: result.results.map((entry) => ({ ok: entry.ok, suiteDir: entry.suiteDir })),",
+  "})}\n`);",
+].join("\n");
+
+function fakeCrabboxScript(argvLogPath) {
+  return [
+    "#!/bin/sh",
+    `printf '%s\\n' "$*" >> ${JSON.stringify(argvLogPath)}`,
+    "case \"$1\" in",
+    "  warmup)",
+    "    printf '%s\\n' 'leased invariants-fake-lease'",
+    "    exit 0",
+    "    ;;",
+    "  run)",
+    "    printf '%s\\n' 'Oracle real smoke doctor ok provider: zai'",
+    "    printf '%s\\n' 'mode=packed extension=./node_modules/pi-oracle'",
+    "    printf '%s\\n' 'Oracle real smoke passed: invariants-fake-run'",
+    "    exit 0",
+    "    ;;",
+    "  stop)",
+    "    if [ -n \"${FAKE_STOP_FAILURE:-}\" ]; then",
+    "      printf '%s\\n' 'stop failed FAKE_STOP_TOKEN=abcdefghijklmnop1234' >&2",
+    "      exit 3",
+    "    fi",
+  "    if [ -n \"${FAKE_STOP_SECRET:-}\" ]; then",
+  "      printf '%s\\n' 'FAKE_STOP_TOKEN=abcdefghijklmnop1234' >&2",
+  "      exit 0",
+  "    fi",
+    "    printf '%s\\n' 'stopped'",
+    "    exit 0",
+    "    ;;",
+    "esac",
+    "printf '%s\\n' \"unexpected subcommand: $1\" >&2",
+    "exit 9",
+    "",
+  ].join("\n");
+}
+
+function runFakeLeaseSuites({ dir, modelAgent }) {
+  const runRoot = mkdtempSync(join(dir, "run-"));
+  const argvLog = join(runRoot, "argv.log");
+  const fakeCrabbox = join(runRoot, "crabbox");
+  const artifactRoot = join(runRoot, "artifacts");
+  const payloadPath = join(runRoot, "payload.json");
+  const driverPath = join(runRoot, "driver.mjs");
+  writeFileSync(fakeCrabbox, fakeCrabboxScript(argvLog), { mode: 0o700 });
+  chmodSync(fakeCrabbox, 0o700);
+  writeFileSync(driverPath, DRIVER_SOURCE);
+  const childEnv = { ...process.env };
+  childEnv.PI_ORACLE_SMOKE_CRABBOX = fakeCrabbox;
+  childEnv.PLATFORM_SMOKE_CRABBOX = fakeCrabbox;
+  childEnv.PLATFORM_SMOKE_UBUNTU_IMAGE = "invariants-override-image";
+  delete childEnv.PI_ORACLE_SMOKE_UBUNTU_IMAGE;
+  delete childEnv.PI_ORACLE_REAL_TEST_PROVIDER;
+  delete childEnv.PI_ORACLE_REAL_TEST_MODEL;
+  delete childEnv.PI_ORACLE_REAL_TEST_MODEL_AGENT;
+  if (modelAgent) childEnv.PI_ORACLE_REAL_TEST_MODEL_AGENT = "1";
+  const result = spawnSync(process.execPath, [driverPath, join(repoRoot, "scripts", "platform-smoke", "targets.mjs"), artifactRoot, payloadPath], {
+    cwd: repoRoot,
+    encoding: "utf8",
+    env: childEnv,
+  });
+  assert.equal(result.status, 0, `fake-lease driver should exit cleanly: ${result.stderr}`);
+  return { payload: JSON.parse(readFileSync(payloadPath, "utf8")), argvLog, runRoot };
+}
+
+function testLeaseStopFailureSurfacesAndRescansEvidence() {
+  if (process.platform === "win32") return; // owner-waived Windows gates; execCrabbox cannot spawn a .cmd fake without a shell
+  const dir = mkdtempSync(join(tmpdir(), "pi-oracle-stop-invariants-"));
+  const savedStopFailure = process.env.FAKE_STOP_FAILURE;
+  const savedStopSecret = process.env.FAKE_STOP_SECRET;
+  try {
+    // Failing stop with a secret in stop stderr: the failure must surface in
+    // the overall result, per-suite assertions, and the appended stop evidence
+    // must be rescanned for secrets after it exists.
+    process.env.FAKE_STOP_FAILURE = "1";
+    const failure = runFakeLeaseSuites({ dir, modelAgent: false });
+    assert.equal(failure.payload.ok, false, "a failing lease stop must fail the overall multi-suite result");
+    const [suite, leaseCleanup] = failure.payload.results;
+    assert.ok(suite, "multi-suite run should record the executed suite result");
+    const suiteChecks = JSON.parse(readFileSync(join(suite.suiteDir, "assertions.json"), "utf8")).checks;
+    const leaseStop = suiteChecks.find((check) => check.id === "lease-stop");
+    assert.ok(leaseStop && leaseStop.ok === false && leaseStop.error === "stop exit 3", `failing stop must be recorded as a lease-stop assertion failure, got ${JSON.stringify(leaseStop)}`);
+    const noSecrets = suiteChecks.find((check) => check.id === "no-secrets");
+    assert.ok(noSecrets && noSecrets.ok === false, "secrets in appended stop output must fail the suite's no-secrets assertion");
+    const violationsPath = join(suite.suiteDir, "redaction-violations.json");
+    assert.ok(existsSync(violationsPath), "stop-output secrets must be recorded in redaction-violations.json");
+    const violations = JSON.parse(readFileSync(violationsPath, "utf8"));
+    assert(violations.some((entry) => String(entry).includes("crabbox.stop.stderr.txt")), `recorded violations must attribute the stop-secret to its artifact, got ${JSON.stringify(violations)}`);
+    assert.ok(existsSync(join(suite.suiteDir, "crabbox.stop.exit-code.txt")), "stop artifacts must be appended to the suite directory");
+    assert.ok(existsSync(join(suite.suiteDir, "failures.md")), "a failing stop must leave a failures.md trail");
+    assert.ok(leaseCleanup && leaseCleanup.ok === false, "a failing stop must surface a lease-cleanup result");
+    assert.match(readFileSync(failure.argvLog, "utf8"), /invariants-override-image/, "target base args must deliver the env image override to the actual crabbox wrapper");
+
+    // Clean stop: lease-stop passes, evidence stays clean, and the suite stays green.
+    delete process.env.FAKE_STOP_FAILURE;
+    const clean = runFakeLeaseSuites({ dir, modelAgent: true });
+    assert.equal(clean.payload.ok, true, `a clean stop must keep the suite green, got ${JSON.stringify(readFileSync(join(clean.payload.results[0].suiteDir, "assertions.json"), "utf8"))}`);
+    const cleanSuite = clean.payload.results[0];
+    const cleanLeaseStop = JSON.parse(readFileSync(join(cleanSuite.suiteDir, "assertions.json"), "utf8")).checks.find((check) => check.id === "lease-stop");
+    assert.ok(cleanLeaseStop && cleanLeaseStop.ok === true, "a clean stop must be recorded as a passing lease-stop assertion");
+    assert.ok(!existsSync(join(cleanSuite.suiteDir, "redaction-violations.json")), "clean stop evidence must not create redaction violations");
+    const cleanArgv = readFileSync(clean.argvLog, "utf8");
+    assert.match(cleanArgv, /--allow-env ZAI_API_KEY/, "provider auth env may only be forwarded on the opt-in model-agent path");
+
+    const off = runFakeLeaseSuites({ dir, modelAgent: false });
+    assert.equal(off.payload.ok, true, "default (non-model-agent) run with a clean stop should stay green");
+    const offArgv = readFileSync(off.argvLog, "utf8");
+    const offRunLines = offArgv.split("\n").filter((line) => line.startsWith("run "));
+    assert.ok(offRunLines.length > 0 && offRunLines.every((line) => !line.includes("--allow-env ZAI_API_KEY")), "default real-extension runs must not forward provider auth env");
+
+    // Clean stop (exit 0) that still emits a secret: the aggregate result must
+    // fail with the persisted evidence, not just rewrite artifacts on disk.
+    process.env.FAKE_STOP_SECRET = "1";
+    const cleanStopSecret = runFakeLeaseSuites({ dir, modelAgent: false });
+    assert.equal(cleanStopSecret.payload.ok, false, "a stop-secret failure must propagate into the overall multi-suite result, not only the persisted artifacts");
+    const secretSuite = cleanStopSecret.payload.results[0];
+    assert.equal(secretSuite.ok, false, "a stop-secret failure must propagate into the suite result object");
+    const secretChecks = JSON.parse(readFileSync(join(secretSuite.suiteDir, "assertions.json"), "utf8")).checks;
+    const secretNoSecrets = secretChecks.find((check) => check.id === "no-secrets");
+    assert.ok(secretNoSecrets && secretNoSecrets.ok === false, "a clean stop with a secret must still flip the suite's no-secrets assertion");
+    const secretLeaseStop = secretChecks.find((check) => check.id === "lease-stop");
+    assert.ok(secretLeaseStop && secretLeaseStop.ok === true, "a zero-exit stop must still record a passing lease-stop while its evidence fails the secret scan");
+  } finally {
+    if (savedStopFailure === undefined) delete process.env.FAKE_STOP_FAILURE;
+    else process.env.FAKE_STOP_FAILURE = savedStopFailure;
+    if (savedStopSecret === undefined) delete process.env.FAKE_STOP_SECRET;
+    else process.env.FAKE_STOP_SECRET = savedStopSecret;
+    rmSync(dir, { recursive: true, force: true });
+  }
 }
 
 function testPackageExclusion() {
   const result = spawnSync("npm", ["pack", "--dry-run", "--json"], { cwd: repoRoot, encoding: "utf8", shell: process.platform === "win32" });
   assert.equal(result.status, 0, `npm pack dry-run failed: ${result.stderr}`);
-  const files = JSON.parse(result.stdout)[0].files.map((file) => file.path);
+  // npm 11 returns an array; npm 12 keys the same records by package name.
+  const [pack] = Object.values(JSON.parse(result.stdout));
+  const files = pack.files.map((file) => file.path);
   for (const forbidden of [".artifacts/", ".crabbox/", ".debug/", ".platform-smoke-runs/", ".env", "context.md"]) {
     assert(!files.some((file) => file === forbidden || file.startsWith(forbidden)), `package should exclude ${forbidden}`);
   }
@@ -85,39 +312,40 @@ function testSourceSmokeExplicitlyDebugOnly() {
 
 function testCanonicalWorkflowConfig() {
   const pkg = JSON.parse(readFileSync(new URL("../../package.json", import.meta.url), "utf8"));
-  assert.deepEqual(config.workflows?.everyday?.commands, ["npm run verify:oracle"], "everyday workflow should use the local verification gate");
-  assert(config.workflows?.platformSensitive?.commands?.includes("npm run smoke:platform:doctor"), "platform-sensitive workflow should start with doctor");
-  assert(config.workflows?.platformSensitive?.commands?.some((command) => command.includes("--target <target> --suite <suite>")), "platform-sensitive workflow should document focused target/suite runs");
-  assert.deepEqual(config.workflows?.platformMatrix?.commands, ["npm run smoke:platform:all"], "platform matrix workflow should use the full target matrix");
-  assert.deepEqual(config.workflows?.release?.commands, ["npm run release:check"], "release workflow should use the full local-plus-platform release gate");
   assert.equal(config.requiredCrabbox?.minVersion, "0.26.0", "Crabbox baseline should match the documented provider contract");
   assert.equal(pkg.scripts["smoke:platform:all"], "npm run smoke:platform:doctor && node scripts/platform-smoke.mjs run --target macos,ubuntu,windows-native", "full platform smoke should remain doctor-first and cover all required targets");
   assert.match(pkg.scripts["release:check"], /npm run verify:oracle && npm run release:proof:chatgpt-presets && npm run smoke:platform:all/, "release check should combine local verification, ChatGPT preset proof, and full platform smoke");
-  const runnerSource = readFileSync(new URL("./crabbox-runner.mjs", import.meta.url), "utf8");
-  assert.match(runnerSource, /PLATFORM_SMOKE_CRABBOX/, "runner should honor reusable Crabbox binary override");
-  assert.match(runnerSource, /PLATFORM_SMOKE_MAC_WORK_ROOT/, "runner should honor reusable macOS work-root override");
-  assert.match(runnerSource, /PLATFORM_SMOKE_WINDOWS_WORK_ROOT/, "runner should honor reusable Windows work-root override");
 }
 
 function testRealSmokeExpensiveAgentPathsAreOptIn() {
   const source = readFileSync(new URL("../oracle-real-smoke.mjs", import.meta.url), "utf8");
   assert.match(source, /runPiLoaderStatus/, "default real smoke should execute a deterministic command through Pi's extension loader");
   assert.doesNotMatch(source, /tsx\/cli|runDirectOracleSubmit/, "default real smoke must not bypass Pi's loader through checkout tsx");
-  assert.match(source, /PI_ORACLE_REAL_TEST_MODEL_AGENT/, "real smoke should expose the optional model-agent toggle");
-  const targetsSource = readFileSync(new URL("./targets.mjs", import.meta.url), "utf8");
-  assert.match(targetsSource, /PI_ORACLE_REAL_TEST_MODEL_AGENT/, "platform real-extension command should forward the optional model-agent toggle");
-  assert.match(targetsSource, /realSmokeUsesModelAgent\(\) \? config\.realSmoke\?\.authEnvByProvider/, "platform smoke should allow provider auth env only for the optional model-agent path");
-  assert.match(source, /truthy\(env\("PI_ORACLE_REAL_TEST_MODEL_AGENT"\)\)/, "model-agent real smoke path should be opt-in");
+  assert.match(source, /const modelAgent = truthy\(env\("PI_ORACLE_REAL_TEST_MODEL_AGENT"\)\);/, "real smoke model-agent dispatch must read the env toggle, not default to the expensive path (full dispatch proof lives in the default packed real-smoke assertions)");
   assert.match(source, /PI_ORACLE_REAL_TEST_NEGATIVE_SYMLINK/, "real smoke should expose the optional negative symlink toggle");
   assert.match(source, /truthy\(env\("PI_ORACLE_REAL_TEST_NEGATIVE_SYMLINK"\)\)/, "negative symlink real-agent check should be opt-in");
+
+  // Rendered-command boundary: the model-agent toggle is off by default and
+  // only a truthy env value turns it on. (The credential boundary — auth env
+  // forwarding only on the opt-in path — is proven at the crabbox transport
+  // boundary in testLeaseStopFailureSurfacesAndRescansEvidence.)
+  withEnv({ PI_ORACLE_REAL_TEST_MODEL_AGENT: undefined }, () => {
+    const off = buildRealExtensionCommand("ubuntu", {});
+    assert.match(off, /export PI_ORACLE_REAL_TEST_MODEL_AGENT=''/, "default real smoke must render the model-agent toggle off");
+    process.env.PI_ORACLE_REAL_TEST_MODEL_AGENT = "1";
+    const on = buildRealExtensionCommand("ubuntu", {});
+    assert.match(on, /export PI_ORACLE_REAL_TEST_MODEL_AGENT='1'/, "opt-in model-agent real smoke should render the toggle on");
+  });
 }
 
 testHelpTextIncludesTargetsAndExamples();
 testTargetSelection();
+testEmptyTargetSelectionRejected();
 testPackedInstallCommandRendering();
 testRealExtensionPackedInstallRendering();
 testManifestFailure();
-testCleanupFailureInvariant();
+testTargetBaseArgsEnvPrecedence();
+testLeaseStopFailureSurfacesAndRescansEvidence();
 testPackageExclusion();
 testSourceSmokeExplicitlyDebugOnly();
 testCanonicalWorkflowConfig();

package/scripts/platform-smoke/platform-build-windows.ps1

@@ -1,6 +1,8 @@
 param(
   [string]$PackageName = "pi-oracle",
-  [int]$NodeValidationMajor = 24
+  [int]$NodeValidationMajor = 24,
+  [string]$CandidatePath = "",
+  [string]$CandidateSha256 = ""
 )
 
 $ErrorActionPreference = "Continue"
@@ -24,11 +26,9 @@ Write-Output "Starting pi-oracle platform-build in $(Get-Location) at $(Get-Date
 $SourceRoot = (Get-Location).Path
 $RunRoot = Join-Path $SourceRoot (Join-Path ".platform-smoke-runs" ("platform-build-" + (Get-Date -Format "yyyyMMddTHHmmssZ") + "-" + $PID))
 $PackDir = Join-Path $RunRoot "pack"
-$TestWorkspace = Join-Path $RunRoot "test-workspace"
 $PiProject = Join-Path $RunRoot "pi-project"
-New-Item -ItemType Directory -Force -Path $PackDir, $TestWorkspace, $PiProject | Out-Null
+New-Item -ItemType Directory -Force -Path $PackDir, $PiProject | Out-Null
 Write-Output "PLATFORM_RUN_ROOT=$RunRoot"
-Write-Output "PLATFORM_TEST_WORKSPACE=$TestWorkspace"
 Write-Output "PLATFORM_PI_PROJECT=$PiProject"
 
 $NodeVersion = (& node.exe --version).Trim()
@@ -79,19 +79,23 @@ Write-Output "PLATFORM_NPM_PACK_EXIT=$PACK_EXIT"
 if ($PackTarball -and (Test-Path -LiteralPath $PackTarball)) {
   Move-Item -LiteralPath $PackTarball -Destination (Join-Path $PackDir $PackTarball) -Force
 }
+if ($CandidatePath) {
+  if (-not (Test-Path -LiteralPath $CandidatePath)) {
+    Write-Output "Retained release candidate is missing"
+    exit 1
+  }
+  $CandidateHash = (Get-FileHash -LiteralPath $CandidatePath -Algorithm SHA256).Hash.ToLowerInvariant()
+  Write-Output "PLATFORM_CANDIDATE_SHA256=$CandidateHash"
+  if ($CandidateHash -ne $CandidateSha256.ToLowerInvariant()) {
+    Write-Output "Retained release candidate checksum changed"
+    exit 1
+  }
+  Copy-Item -LiteralPath $CandidatePath -Destination (Join-Path $PackDir "release-candidate.tgz") -ErrorAction Stop
+  $PackTarball = "release-candidate.tgz"
+}
 Write-Output "PLATFORM_PACKED_TARBALL=$PackTarball"
 Set-Content -Path (Join-Path $PackDir "packed-tarball.txt") -Value $PackTarball
 
-Write-Output "=== fixture workspace ==="
-Copy-Item -LiteralPath package.json, README.md -Destination $TestWorkspace -ErrorAction SilentlyContinue
-Copy-Item -LiteralPath extensions, prompts, docs -Destination $TestWorkspace -Recurse -ErrorAction SilentlyContinue
-if ((Test-Path -LiteralPath (Join-Path $TestWorkspace "package.json")) -and (Test-Path -LiteralPath (Join-Path $TestWorkspace "README.md")) -and (Test-Path -LiteralPath (Join-Path $TestWorkspace "extensions")) -and (Test-Path -LiteralPath (Join-Path $TestWorkspace "prompts")) -and (Test-Path -LiteralPath (Join-Path $TestWorkspace "docs"))) {
-  $FIXTURE_EXIT = 0
-} else {
-  $FIXTURE_EXIT = 1
-}
-Write-Output "PLATFORM_FIXTURE_EXIT=$FIXTURE_EXIT"
-
 $PiCli = Join-Path (Get-Location) "node_modules\.bin\pi.cmd"
 if (-not (Test-Path -LiteralPath $PiCli)) { $PiCli = Join-Path (Get-Location) "node_modules\.bin\pi" }
 if (-not (Test-Path -LiteralPath $PiCli)) {
@@ -160,9 +164,9 @@ Write-Output "PLATFORM_PI_LIST_EXIT=$PI_LIST_EXIT"
 Write-SectionFile "PI_LIST_STDOUT" $PiListOut
 Write-SectionFile "PI_LIST_STDERR" $PiListErr
 
-Write-Output "node=$NODE_VERSION_EXIT ci=$CI_EXIT deps=$DEPS_EXIT test=$TEST_EXIT pack=$PACK_EXIT fixture=$FIXTURE_EXIT packedNodeInstall=$PACKED_NODE_INSTALL_EXIT install=$PI_INSTALL_EXIT list=$PI_LIST_EXIT"
-if ($NODE_VERSION_EXIT -ne 0 -or $CI_EXIT -ne 0 -or $DEPS_EXIT -ne 0 -or $TEST_EXIT -ne 0 -or $PACK_EXIT -ne 0 -or $FIXTURE_EXIT -ne 0 -or $PACKED_NODE_INSTALL_EXIT -ne 0 -or $PI_INSTALL_EXIT -ne 0 -or $PI_LIST_EXIT -ne 0) {
-  Write-Output "PLATFORM_BUILD_FAILED: node=$NODE_VERSION_EXIT ci=$CI_EXIT deps=$DEPS_EXIT test=$TEST_EXIT pack=$PACK_EXIT fixture=$FIXTURE_EXIT packedNodeInstall=$PACKED_NODE_INSTALL_EXIT install=$PI_INSTALL_EXIT list=$PI_LIST_EXIT"
+Write-Output "node=$NODE_VERSION_EXIT ci=$CI_EXIT deps=$DEPS_EXIT test=$TEST_EXIT pack=$PACK_EXIT packedNodeInstall=$PACKED_NODE_INSTALL_EXIT install=$PI_INSTALL_EXIT list=$PI_LIST_EXIT"
+if ($NODE_VERSION_EXIT -ne 0 -or $CI_EXIT -ne 0 -or $DEPS_EXIT -ne 0 -or $TEST_EXIT -ne 0 -or $PACK_EXIT -ne 0 -or $PACKED_NODE_INSTALL_EXIT -ne 0 -or $PI_INSTALL_EXIT -ne 0 -or $PI_LIST_EXIT -ne 0) {
+  Write-Output "PLATFORM_BUILD_FAILED: node=$NODE_VERSION_EXIT ci=$CI_EXIT deps=$DEPS_EXIT test=$TEST_EXIT pack=$PACK_EXIT packedNodeInstall=$PACKED_NODE_INSTALL_EXIT install=$PI_INSTALL_EXIT list=$PI_LIST_EXIT"
   exit 1
 }
 Write-Output "PLATFORM_BUILD_OK"

package/scripts/platform-smoke/targets.mjs

@@ -3,7 +3,7 @@
  * The suites prove the package builds, packs, installs, loads, and runs through pi's package path.
  */
 
-import { readFileSync, writeFileSync } from "node:fs";
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import { resolve } from "node:path";
 
 import { runAssertions } from "./assertions.mjs";
@@ -95,6 +95,10 @@ export function buildRealExtensionCommand(targetName = "ubuntu", config = {}) {
       `$env:PI_ORACLE_REAL_TEST_PROVIDER = ${powershellSingleQuote(provider)}`,
       `$env:PI_ORACLE_REAL_TEST_MODEL = ${powershellSingleQuote(model)}`,
       `$env:PI_ORACLE_REAL_TEST_MODEL_AGENT = ${powershellSingleQuote(useModelAgent ? "1" : "")}`,
+      ...(config.releaseCandidate ? [
+        `$env:PI_ORACLE_RELEASE_TARBALL = Join-Path (Get-Location) ${powershellSingleQuote(config.releaseCandidate.path)}`,
+        `$env:PI_ORACLE_RELEASE_SHA256 = ${powershellSingleQuote(config.releaseCandidate.sha256)}`,
+      ] : []),
       "$env:PI_ORACLE_REAL_TEST_TIMEOUT_MS = '360000'",
       "if (-not (Test-Path -LiteralPath 'node_modules')) { npm.cmd ci; if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE } }",
       "npm.cmd run smoke:real:doctor",
@@ -108,15 +112,22 @@ export function buildRealExtensionCommand(targetName = "ubuntu", config = {}) {
     `export PI_ORACLE_REAL_TEST_PROVIDER=${shellQuote(provider)}`,
     `export PI_ORACLE_REAL_TEST_MODEL=${shellQuote(model)}`,
     `export PI_ORACLE_REAL_TEST_MODEL_AGENT=${shellQuote(useModelAgent ? "1" : "")}`,
+    ...(config.releaseCandidate ? [
+      `export PI_ORACLE_RELEASE_TARBALL="$PWD"/${shellQuote(config.releaseCandidate.path)}`,
+      `export PI_ORACLE_RELEASE_SHA256=${shellQuote(config.releaseCandidate.sha256)}`,
+    ] : []),
     'if [ ! -d node_modules ]; then npm ci; fi',
     "npm run smoke:real:doctor",
     "npm run smoke:real:packed",
   ].join("\n");
 }
 
-export function buildPlatformBuildCommand(targetName = "ubuntu", packageName = "pi-oracle", nodeValidationMajor = 24) {
+export function buildPlatformBuildCommand(targetName = "ubuntu", packageName = "pi-oracle", nodeValidationMajor = 24, releaseCandidate) {
   if (targetName === "windows-native") {
-    return `powershell.exe -NoLogo -NoProfile -ExecutionPolicy Bypass -File .\\scripts\\platform-smoke\\platform-build-windows.ps1 -PackageName ${packageName} -NodeValidationMajor ${nodeValidationMajor}`;
+    const candidate = releaseCandidate
+      ? ` -CandidatePath ${powershellSingleQuote(releaseCandidate.path)} -CandidateSha256 ${powershellSingleQuote(releaseCandidate.sha256)}`
+      : "";
+    return `powershell.exe -NoLogo -NoProfile -ExecutionPolicy Bypass -File .\\scripts\\platform-smoke\\platform-build-windows.ps1 -PackageName ${packageName} -NodeValidationMajor ${nodeValidationMajor}${candidate}`;
   }
   const lines = [];
   lines.push("set -o pipefail");
@@ -127,11 +138,9 @@ export function buildPlatformBuildCommand(targetName = "ubuntu", packageName = "
   lines.push('RUN_ROOT=".platform-smoke-runs/platform-build-$(date -u +%Y%m%dT%H%M%SZ)-$$"');
   lines.push('SOURCE_ROOT="$(pwd)"');
   lines.push('PACK_DIR="$SOURCE_ROOT/$RUN_ROOT/pack"');
-  lines.push('TEST_WORKSPACE="$SOURCE_ROOT/$RUN_ROOT/test-workspace"');
   lines.push('PI_PROJECT="$SOURCE_ROOT/$RUN_ROOT/pi-project"');
-  lines.push('mkdir -p "$PACK_DIR" "$TEST_WORKSPACE" "$PI_PROJECT"');
+  lines.push('mkdir -p "$PACK_DIR" "$PI_PROJECT"');
   lines.push('echo "PLATFORM_RUN_ROOT=$RUN_ROOT"');
-  lines.push('echo "PLATFORM_TEST_WORKSPACE=$TEST_WORKSPACE"');
   lines.push('echo "PLATFORM_PI_PROJECT=$PI_PROJECT"');
   lines.push("");
   lines.push('NODE_VERSION=$(node --version)');
@@ -174,18 +183,15 @@ export function buildPlatformBuildCommand(targetName = "ubuntu", packageName = "
   lines.push('cat "$PACK_DIR/npm-pack.stderr.txt"');
   lines.push('echo "PLATFORM_NPM_PACK_EXIT=$PACK_EXIT"');
   lines.push('if [ -n "$PACK_TARBALL" ] && [ -f "$PACK_TARBALL" ]; then mv "$PACK_TARBALL" "$PACK_DIR/$PACK_TARBALL"; fi');
+  if (releaseCandidate) {
+    lines.push(`CANDIDATE="$SOURCE_ROOT"/${shellQuote(releaseCandidate.path)}`);
+    lines.push('CANDIDATE_SHA256=$(node -e \'const {createHash}=require("node:crypto");const {readFileSync}=require("node:fs");console.log(createHash("sha256").update(readFileSync(process.argv[1])).digest("hex"))\' "$CANDIDATE")');
+    lines.push('echo "PLATFORM_CANDIDATE_SHA256=$CANDIDATE_SHA256"');
+    lines.push(`if [ "$CANDIDATE_SHA256" = ${shellQuote(releaseCandidate.sha256)} ]; then cp "$CANDIDATE" "$PACK_DIR/release-candidate.tgz" || exit 1; PACK_TARBALL=release-candidate.tgz; else echo "Retained release candidate checksum changed"; exit 1; fi`);
+  }
   lines.push('echo "PLATFORM_PACKED_TARBALL=$PACK_TARBALL"');
   lines.push('printf "%s\\n" "$PACK_TARBALL" > "$PACK_DIR/packed-tarball.txt"');
   lines.push("");
-  lines.push('echo "=== fixture workspace ==="');
-  lines.push('cp package.json README.md "$TEST_WORKSPACE"/ 2>"$PACK_DIR/fixture.stderr.txt"');
-  lines.push('FIXTURE_COPY_EXIT=$?');
-  lines.push('cp -R extensions prompts docs "$TEST_WORKSPACE"/ 2>>"$PACK_DIR/fixture.stderr.txt"');
-  lines.push('TREE_COPY_EXIT=$?');
-  lines.push('if [ "$FIXTURE_COPY_EXIT" -eq 0 ] && [ "$TREE_COPY_EXIT" -eq 0 ]; then FIXTURE_EXIT=0; else FIXTURE_EXIT=1; fi');
-  lines.push('cat "$PACK_DIR/fixture.stderr.txt"');
-  lines.push('echo "PLATFORM_FIXTURE_EXIT=$FIXTURE_EXIT"');
-  lines.push("");
   lines.push('echo "=== pi install packed package ==="');
   lines.push('PI_CLI="$(pwd)/node_modules/.bin/pi"');
   lines.push('if [ ! -x "$PI_CLI" ]; then PI_CLI="$(command -v pi || true)"; fi');
@@ -205,9 +211,9 @@ export function buildPlatformBuildCommand(targetName = "ubuntu", packageName = "
   lines.push(...posixSection("PI_LIST_STDOUT", 'cat "$PACK_DIR/pi-list.stdout.txt" 2>/dev/null || true'));
   lines.push(...posixSection("PI_LIST_STDERR", 'cat "$PACK_DIR/pi-list.stderr.txt" 2>/dev/null || true'));
   lines.push("");
-  lines.push('echo "node=$NODE_VERSION_EXIT ci=$CI_EXIT deps=$DEPS_EXIT test=$TEST_EXIT pack=$PACK_EXIT fixture=$FIXTURE_EXIT packedNodeInstall=$PACKED_NODE_INSTALL_EXIT install=$PI_INSTALL_EXIT list=$PI_LIST_EXIT"');
-  lines.push('if [ "$NODE_VERSION_EXIT" -ne 0 ] || [ "$CI_EXIT" -ne 0 ] || [ "$DEPS_EXIT" -ne 0 ] || [ "$TEST_EXIT" -ne 0 ] || [ "$PACK_EXIT" -ne 0 ] || [ "$FIXTURE_EXIT" -ne 0 ] || [ "$PACKED_NODE_INSTALL_EXIT" -ne 0 ] || [ "$PI_INSTALL_EXIT" -ne 0 ] || [ "$PI_LIST_EXIT" -ne 0 ]; then');
-  lines.push('  echo "PLATFORM_BUILD_FAILED: node=$NODE_VERSION_EXIT ci=$CI_EXIT deps=$DEPS_EXIT test=$TEST_EXIT pack=$PACK_EXIT fixture=$FIXTURE_EXIT packedNodeInstall=$PACKED_NODE_INSTALL_EXIT install=$PI_INSTALL_EXIT list=$PI_LIST_EXIT"');
+  lines.push('echo "node=$NODE_VERSION_EXIT ci=$CI_EXIT deps=$DEPS_EXIT test=$TEST_EXIT pack=$PACK_EXIT packedNodeInstall=$PACKED_NODE_INSTALL_EXIT install=$PI_INSTALL_EXIT list=$PI_LIST_EXIT"');
+  lines.push('if [ "$NODE_VERSION_EXIT" -ne 0 ] || [ "$CI_EXIT" -ne 0 ] || [ "$DEPS_EXIT" -ne 0 ] || [ "$TEST_EXIT" -ne 0 ] || [ "$PACK_EXIT" -ne 0 ] || [ "$PACKED_NODE_INSTALL_EXIT" -ne 0 ] || [ "$PI_INSTALL_EXIT" -ne 0 ] || [ "$PI_LIST_EXIT" -ne 0 ]; then');
+  lines.push('  echo "PLATFORM_BUILD_FAILED: node=$NODE_VERSION_EXIT ci=$CI_EXIT deps=$DEPS_EXIT test=$TEST_EXIT pack=$PACK_EXIT packedNodeInstall=$PACKED_NODE_INSTALL_EXIT install=$PI_INSTALL_EXIT list=$PI_LIST_EXIT"');
   lines.push('  exit 1');
   lines.push('fi');
   lines.push('echo "PLATFORM_BUILD_OK"');
@@ -224,7 +230,7 @@ export async function runTargetSuite(config, targetName, suiteName, leaseSession
   writeFileSync(resolve(suiteDir, "suite.json"), JSON.stringify({ suiteName, writtenAt: new Date().toISOString() }, null, 2));
 
   const command = suiteName === "platform-build"
-    ? buildPlatformBuildCommand(targetName, config.packageName ?? "pi-oracle", config.nodeValidationMajor ?? 24)
+    ? buildPlatformBuildCommand(targetName, config.packageName ?? "pi-oracle", config.nodeValidationMajor ?? 24, config.releaseCandidate)
     : buildRealExtensionCommand(targetName, config);
   writeCommand(suiteDir, command);
 
@@ -239,7 +245,6 @@ export async function runTargetSuite(config, targetName, suiteName, leaseSession
   const startedAt = Date.now();
   console.log(`  executing ${suiteName} on ${targetName}...`);
   const result = await runOnLease(config, targetName, warmup.leaseId, command, {
-    shell: true,
     timeout: suiteName === "real-extension" ? 900_000 : 900_000,
     sync: leaseSession?.sync,
     allowEnvNames: suiteName === "real-extension" ? realSmokeAllowedEnvNames(config) : undefined,
@@ -281,11 +286,12 @@ export async function runTargetSuite(config, targetName, suiteName, leaseSession
       { id: "platform-dependencies", fn: () => /PLATFORM_DEPS_EXIT=0/.test(stdout) },
       { id: "platform-verification", fn: () => /PLATFORM_NPM_TEST_EXIT=0/.test(stdout) },
       { id: "npm-pack", fn: () => /PLATFORM_NPM_PACK_EXIT=0/.test(stdout) && /PLATFORM_PACKED_TARBALL=\S+/.test(stdout) },
-      { id: "fixture-workspace", fn: () => /PLATFORM_FIXTURE_EXIT=0/.test(stdout) },
+      ...(config.releaseCandidate ? [{ id: "release-candidate-sha256",
+        fn: () => markerValue(stdout, "PLATFORM_CANDIDATE_SHA256") === config.releaseCandidate.sha256 }] : []),
       { id: "packed-node-install", fn: () => /PLATFORM_PACKED_NODE_INSTALL_EXIT=0/.test(stdout) },
       { id: "pi-install", fn: () => /PLATFORM_PI_INSTALL_EXIT=0/.test(stdout) },
       { id: "pi-list", fn: () => /PLATFORM_PI_LIST_EXIT=0/.test(stdout) && listOutput.includes(packageName) && packageInstallPattern.test(listOutput) },
-      { id: "no-source-extension-path", fn: () => !/\bpi\s+(?:-e|--extension)\s+\./.test(stdout) },
+      { id: "no-source-extension-path", fn: () => !/\bpi\s+(?:-e|--extension)\s+\./.test(command), error: "platform-build must execute through the packed install path, not a source extension" },
       { id: "no-secrets", fn: () => violations.length === 0, error: "redaction violations found" },
     ];
     expectedFiles = [
@@ -302,7 +308,9 @@ export async function runTargetSuite(config, targetName, suiteName, leaseSession
       { id: "real-smoke-doctor", fn: () => stdout.includes("Oracle real smoke doctor") && stdout.includes(`provider: ${provider}`) },
       { id: "real-smoke-marker", fn: () => stdout.includes("Oracle real smoke passed:") },
       { id: "real-smoke-packed-install", fn: () => stdout.includes("mode=packed") && stdout.includes("extension=./node_modules/pi-oracle") },
-      { id: "real-smoke-no-source-extension", fn: () => !stdout.includes("extensions/oracle/index.ts") && !/\bpi\s+(?:-e|--extension)\s+extensions\/oracle/.test(stdout) },
+      ...(config.releaseCandidate ? [{ id: "release-candidate-sha256",
+        fn: () => markerValue(stdout, "ORACLE_RELEASE_CANDIDATE_SHA256") === config.releaseCandidate.sha256 }] : []),
+      { id: "real-smoke-no-source-extension", fn: () => !command.includes("extensions/oracle/index.ts") && !/\bpi\s+(?:-e|--extension)\s+extensions\/oracle/.test(command) },
       { id: "no-secrets", fn: () => violations.length === 0, error: "redaction violations found" },
     ];
     expectedFiles = [
@@ -338,7 +346,13 @@ export async function runTargetSuites(config, targetName, suiteNames) {
     }
   } finally {
     stopResult = await stopLease(config, targetName, warmup.leaseId);
-    for (const result of results) recordStopResultOnSuite(result.suiteDir, stopResult);
+    for (const result of results) {
+      const stopAssertions = recordStopResultOnSuite(result.suiteDir, stopResult);
+      if (stopAssertions) {
+        result.ok = Boolean(result.ok && stopAssertions.ok);
+        result.assertions = stopAssertions;
+      }
+    }
   }
   if (stopResult?.code !== 0) results.push(createStopFailureResult(config, targetName, warmup.leaseId, stopResult));
   return { ok: results.every((result) => result.ok), results };
@@ -351,15 +365,33 @@ function writeStopArtifacts(suiteDir, stopResult) {
 }
 
 function recordStopResultOnSuite(suiteDir, stopResult) {
-  if (!suiteDir || !stopResult) return;
+  if (!suiteDir || !stopResult) return undefined;
   writeStopArtifacts(suiteDir, stopResult);
+  // Stop output is appended after the suite ran; rescan the final evidence so
+  // secrets in stop stdout/stderr cannot slip past the no-secrets gate.
+  const violationsPath = resolve(suiteDir, "redaction-violations.json");
+  const stopViolations = [
+    ...scanForSecrets(stopResult.stdout ?? "").map((violation) => `crabbox.stop.stdout.txt: ${violation}`),
+    ...scanForSecrets(stopResult.stderr ?? "").map((violation) => `crabbox.stop.stderr.txt: ${violation}`),
+  ];
+  if (stopViolations.length > 0) {
+    const previousViolations = existsSync(violationsPath) ? JSON.parse(readFileSync(violationsPath, "utf8")) : [];
+    writeFileSync(violationsPath, JSON.stringify([...new Set([...previousViolations, ...stopViolations])], null, 2));
+  }
   const assertionsPath = resolve(suiteDir, "assertions.json");
   const summaryPath = resolve(suiteDir, "summary.json");
   const manifestPath = resolve(suiteDir, "artifact-manifest.json");
   const assertions = JSON.parse(readFileSync(assertionsPath, "utf8"));
   const summary = JSON.parse(readFileSync(summaryPath, "utf8"));
   const stopCheck = { id: "lease-stop", ok: stopResult.code === 0, ...(stopResult.code === 0 ? {} : { error: `stop exit ${stopResult.code}` }) };
-  assertions.checks = [...(assertions.checks ?? []).filter((check) => check.id !== "lease-stop"), stopCheck];
+  const checks = (assertions.checks ?? []).filter((check) => check.id !== "lease-stop");
+  if (stopViolations.length > 0) {
+    const noSecretsIndex = checks.findIndex((check) => check.id === "no-secrets");
+    const failingNoSecrets = { id: "no-secrets", ok: false, error: "redaction violations found" };
+    if (noSecretsIndex === -1) checks.push(failingNoSecrets);
+    else checks[noSecretsIndex] = failingNoSecrets;
+  }
+  assertions.checks = [...checks, stopCheck];
   assertions.ok = assertions.checks.every((check) => check.ok);
   writeFileSync(assertionsPath, JSON.stringify({ ...assertions, writtenAt: new Date().toISOString() }, null, 2));
   if (!assertions.ok) {
@@ -370,6 +402,7 @@ function recordStopResultOnSuite(suiteDir, stopResult) {
   const previousManifest = JSON.parse(readFileSync(manifestPath, "utf8"));
   const expected = [...new Set([...(previousManifest.expected ?? []), "crabbox.stop.stdout.txt", "crabbox.stop.stderr.txt", "crabbox.stop.exit-code.txt", "artifact-manifest.json"])]
   writeManifest(suiteDir, expected);
+  return assertions;
 }
 
 function finalizeSuiteArtifacts(suiteDir, checks, summary, expectedFiles) {
@@ -428,7 +461,3 @@ function createStopFailureResult(config, targetName, leaseId, stopResult) {
   );
   return { ok: false, suiteDir, assertions };
 }
-
-export function readSuiteSummary(suiteDir) {
-  return JSON.parse(readFileSync(resolve(suiteDir, "summary.json"), "utf8"));
-}