ray-hive 1.0__tar.gz

ray_hive-1.0/.gitattributes

@@ -0,0 +1,3 @@
+* text=auto eol=lf
+*.bat text eol=crlf
+src/ray_hive/_hs2/generated/idl/TCLIService.thrift -whitespace

ray_hive-1.0/.github/CODEOWNERS

@@ -0,0 +1 @@
+* @jiangxt2

ray_hive-1.0/.github/ISSUE_TEMPLATE/bug.yml

@@ -0,0 +1,39 @@
+name: Bug report
+description: Report a reproducible ray-hive defect without sensitive data
+title: "[Bug] "
+labels: [bug]
+body:
+  - type: markdown
+    attributes:
+      value: Do not include credentials, full connection URLs, private SQL, or row values.
+  - type: input
+    id: version
+    attributes:
+      label: ray-hive version or commit
+    validations:
+      required: true
+  - type: textarea
+    id: environment
+    attributes:
+      label: Environment
+      description: Include Python, Ray, PyArrow, Hive, driver, transport, and authentication mode.
+    validations:
+      required: true
+  - type: textarea
+    id: reproduction
+    attributes:
+      label: Minimal reproduction
+      description: Use sanitized identifiers and values.
+    validations:
+      required: true
+  - type: textarea
+    id: behavior
+    attributes:
+      label: Expected and actual behavior
+    validations:
+      required: true
+  - type: textarea
+    id: diagnostics
+    attributes:
+      label: Sanitized diagnostics
+      description: Include stable error code and operation state, but no full SQL or secrets.

ray_hive-1.0/.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,5 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Security vulnerability
+    url: https://github.com/jiangxt2/ray-hive/security/advisories/new
+    about: Report vulnerabilities privately; do not open a public issue.

ray_hive-1.0/.github/ISSUE_TEMPLATE/feature.yml

@@ -0,0 +1,33 @@
+name: Feature request
+description: Propose a scoped datasource capability
+title: "[Feature] "
+labels: [enhancement]
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem
+      description: Describe the user need independently of a proposed implementation.
+    validations:
+      required: true
+  - type: textarea
+    id: scope
+    attributes:
+      label: Proposed scope
+      description: Identify API, driver, transport, auth, type, consistency, and version boundaries.
+    validations:
+      required: true
+  - type: textarea
+    id: evidence
+    attributes:
+      label: Required conformance evidence
+      description: List real Hive, security, failure, or Ray cluster cases needed for the claim.
+    validations:
+      required: true
+  - type: checkboxes
+    id: purity
+    attributes:
+      label: Data-plane boundary
+      options:
+        - label: The proposal keeps all table and storage access behind HiveServer2.
+          required: true

ray_hive-1.0/.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,31 @@
+## What changes
+
+Describe the public behavior and the implementation boundaries changed by this pull request.
+
+## Why
+
+Explain the correctness, compatibility, security, or maintainability need.
+
+## User-facing impact
+
+Describe API, compatibility, performance, consistency, or migration impact. Write `None` only when
+the change is genuinely internal.
+
+## How tested
+
+- [ ] Ruff format and lint
+- [ ] mypy
+- [ ] Unit and contract tests with coverage
+- [ ] License, codespell, documentation, and conformance checks
+- [ ] Real Hive 4.2.0 integration tests when required
+- [ ] Ray cluster or slow infrastructure tests when required
+- [ ] Package build, isolated install, and import smoke
+
+List exact commands and infrastructure versions below.
+
+## Checklist
+
+- [ ] I used only public Ray APIs outside `ray_hive._compat`.
+- [ ] I added no storage, filesystem, HMS, or table-location fallback.
+- [ ] I documented any consistency or capability change without broadening unverified claims.
+- [ ] Every commit has a valid `Signed-off-by` trailer.

ray_hive-1.0/.github/workflows/ci.yml

@@ -0,0 +1,147 @@
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches: [master]
+  workflow_call:
+    inputs:
+      candidate_sha:
+        required: false
+        type: string
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  dco:
+    name: DCO
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Check out full history
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          fetch-depth: 0
+          ref: ${{ inputs.candidate_sha || github.sha }}
+      - name: Install Python for reusable release validation
+        if: github.event_name == 'workflow_call'
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: "3.12"
+      - name: Validate every commit trailer
+        env:
+          BEFORE_SHA: ${{ github.event.before }}
+          HEAD_SHA: ${{ github.sha }}
+          PR_BASE_SHA: ${{ github.event.pull_request.base.sha }}
+        run: |
+          set -euo pipefail
+          zero=0000000000000000000000000000000000000000
+          if [[ -n "${PR_BASE_SHA}" ]]; then
+            range="${PR_BASE_SHA}..${HEAD_SHA}"
+          elif [[ -n "${BEFORE_SHA}" && "${BEFORE_SHA}" != "${zero}" ]]; then
+            range="${BEFORE_SHA}..${HEAD_SHA}"
+          else
+            range="${HEAD_SHA}"
+          fi
+          failed=0
+          while read -r commit; do
+            if ! git show -s --format=%B "${commit}" | grep -Eiq '^Signed-off-by: .+ <[^>]+>$'; then
+              echo "Missing valid Signed-off-by trailer: ${commit}"
+              failed=1
+            fi
+          done < <(git rev-list "${range}")
+          exit "${failed}"
+      - name: Validate DCO for the release candidate
+        if: github.event_name == 'workflow_call'
+        run: python scripts/check_dco.py "${{ inputs.candidate_sha }}"
+
+  static:
+    name: Static and docs
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          ref: ${{ inputs.candidate_sha || github.sha }}
+      - name: Install uv and Python
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        with:
+          version: "0.12.0"
+          python-version: "3.12"
+          enable-cache: true
+      - run: uv sync --frozen --extra dev --extra telemetry
+      - run: uv run --frozen ruff format --check .
+      - run: uv run --frozen ruff check .
+      - run: uv run --frozen mypy
+      - run: uv run --frozen python scripts/check_license_headers.py
+      - run: uv run --frozen python scripts/check_spec.py
+      - run: uv run --frozen codespell
+      - run: uv run --frozen mkdocs build --strict
+
+  unit-contract:
+    name: Unit and contract (Python ${{ matrix.python-version }})
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.12", "3.13"]
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          ref: ${{ inputs.candidate_sha || github.sha }}
+      - name: Install uv and Python
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        with:
+          version: "0.12.0"
+          python-version: ${{ matrix.python-version }}
+          enable-cache: true
+          cache-suffix: py${{ matrix.python-version }}
+      - run: uv sync --frozen --extra dev --extra telemetry
+      - name: Run collected unit and contract gates
+        run: >-
+          uv run --frozen python -m pytest tests/unit tests/contract
+          --cov=ray_hive --cov-report=term-missing --cov-report=xml
+
+  thrift-codegen:
+    name: Reproducible Thrift bindings
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          ref: ${{ inputs.candidate_sha || github.sha }}
+      - name: Install uv and Python
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        with:
+          version: "0.12.0"
+          python-version: "3.12"
+      - run: uv sync --frozen --extra dev
+      - run: uv run --frozen python scripts/generate_thrift_stubs.py --build-image --check
+
+  package:
+    name: Package
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          ref: ${{ inputs.candidate_sha || github.sha }}
+      - name: Install uv and Python
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        with:
+          version: "0.12.0"
+          python-version: "3.12"
+      - run: uv sync --frozen --extra dev --extra telemetry
+      - run: uv run --frozen python -m build
+      - run: uv run --frozen twine check dist/*
+      - name: Isolated wheel import smoke
+        run: |
+          uv venv /tmp/ray-hive-wheel-smoke --python 3.12
+          uv pip install --python /tmp/ray-hive-wheel-smoke/bin/python dist/*.whl
+          /tmp/ray-hive-wheel-smoke/bin/python -c 'import ray_hive; print(ray_hive.__all__)'

ray_hive-1.0/.github/workflows/hive-integration.yml

@@ -0,0 +1,46 @@
+name: Hive integration
+
+on:
+  pull_request:
+  push:
+    branches: [master]
+  workflow_dispatch:
+  workflow_call:
+    inputs:
+      candidate_sha:
+        required: false
+        type: string
+
+permissions:
+  contents: read
+
+concurrency:
+  group: hive-it-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  hive-420:
+    name: Apache Hive 4.2.0
+    runs-on: ubuntu-latest
+    timeout-minutes: 40
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          ref: ${{ inputs.candidate_sha || github.sha }}
+      - name: Install uv and Python
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        with:
+          version: "0.12.0"
+          python-version: "3.12"
+          enable-cache: true
+      - run: uv sync --frozen --extra dev --extra telemetry
+      - name: Run exact ray-hive-it infrastructure
+        run: ./scripts/run_hive_it.sh
+      - name: Preserve Hive logs
+        if: always()
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+        with:
+          name: hive-420-${{ github.run_id }}-${{ github.run_attempt }}
+          path: tests/integration/logs/
+          if-no-files-found: error
+          retention-days: 14

ray_hive-1.0/.github/workflows/release.yml

@@ -0,0 +1,345 @@
+# Copyright 2026 ray-hive contributors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+name: Release
+
+on:
+  push:
+    tags: ["v*"]
+  workflow_dispatch:
+    inputs:
+      candidate_sha:
+        description: "Commit SHA to validate; required for a manual run"
+        required: true
+        type: string
+      expected_version:
+        description: "Expected project version, for example 1.0"
+        required: true
+        type: string
+      formal_publish:
+        description: "Publish to TestPyPI, PyPI, and GitHub Releases"
+        required: true
+        default: false
+        type: boolean
+      release_tag:
+        description: "Existing annotated tag to publish, for example v1.0"
+        required: true
+        default: "v1.0"
+        type: string
+
+permissions:
+  contents: read
+
+concurrency:
+  group: release-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  candidate:
+    name: Validate release candidate
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    outputs:
+      mode: ${{ steps.validate.outputs.mode }}
+      sha: ${{ steps.validate.outputs.sha }}
+      version: ${{ steps.validate.outputs.version }}
+      tag: ${{ steps.validate.outputs.tag }}
+      master_sha: ${{ steps.validate.outputs.master_sha }}
+    steps:
+      - name: Check out protected master and tags
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          ref: master
+          fetch-depth: 0
+          persist-credentials: false
+      - name: Set up Python
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: "3.12"
+      - name: Validate candidate ancestry, identity, and tag event
+        id: validate
+        env:
+          MODE: ${{ (github.event_name == 'push' || inputs.formal_publish == true) && 'tag' || 'dry-run' }}
+          CANDIDATE_REF: ${{ github.event_name == 'push' && github.sha || inputs.candidate_sha }}
+          EXPECTED_VERSION: ${{ github.event_name == 'push' && '' || inputs.expected_version }}
+          RELEASE_TAG: ${{ github.event_name == 'push' && github.ref_name || inputs.release_tag }}
+          EVENT_SHA: ${{ github.event_name == 'push' && github.sha || inputs.candidate_sha }}
+          EVENT_CREATED: ${{ github.event_name == 'push' && github.event.created || inputs.formal_publish }}
+          EVENT_DELETED: ${{ github.event_name == 'push' && github.event.deleted || 'false' }}
+          EVENT_FORCED: ${{ github.event_name == 'push' && github.event.forced || 'false' }}
+        run: >-
+          python scripts/validate_release_candidate.py
+          --mode "${MODE}"
+          --candidate-ref "${CANDIDATE_REF}"
+          --expected-version "${EXPECTED_VERSION}"
+          --tag "${RELEASE_TAG}"
+          --event-sha "${EVENT_SHA}"
+          --event-created "${EVENT_CREATED}"
+          --event-deleted "${EVENT_DELETED}"
+          --event-forced "${EVENT_FORCED}"
+          --github-output "${GITHUB_OUTPUT}"
+
+  gates:
+    name: Run complete CI gates on candidate
+    needs: candidate
+    uses: ./.github/workflows/ci.yml
+    with:
+      candidate_sha: ${{ needs.candidate.outputs.sha }}
+
+  hive:
+    name: Run real Hive gate on candidate
+    needs: candidate
+    uses: ./.github/workflows/hive-integration.yml
+    with:
+      candidate_sha: ${{ needs.candidate.outputs.sha }}
+
+  build:
+    name: Build and attest one immutable artifact
+    needs: [candidate, gates, hive]
+    if: needs.candidate.result == 'success' && needs.gates.result == 'success' && needs.hive.result == 'success'
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    outputs:
+      artifact-id: ${{ steps.upload.outputs.artifact-id }}
+    permissions:
+      contents: read
+      id-token: write
+      attestations: write
+    steps:
+      - name: Check out candidate
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          ref: ${{ needs.candidate.outputs.sha }}
+          fetch-depth: 0
+          persist-credentials: false
+      - name: Install uv and Python
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        with:
+          version: "0.12.0"
+          python-version: "3.12"
+          enable-cache: true
+      - run: uv sync --frozen --extra dev --extra telemetry
+      - name: Verify release identity and credential scan
+        run: uv run --frozen python scripts/check_release.py --tag "${{ needs.candidate.outputs.tag }}"
+      - run: uv run --frozen python scripts/check_spec.py
+      - name: Build distributions
+        run: uv run --frozen python -m build --outdir release-artifacts/packages
+      - name: Check distribution metadata
+        run: uv run --frozen twine check release-artifacts/packages/*
+      - name: Generate SHA-256 manifest
+        run: >-
+          uv run --frozen python scripts/verify_release_artifacts.py
+          release-artifacts/packages
+          --name ray-hive
+          --version "${{ needs.candidate.outputs.version }}"
+          --manifest release-artifacts/SHA256SUMS
+          --prepare
+      - name: Generate SPDX JSON SBOM
+        uses: anchore/sbom-action@a930d0ac434e3182448fe678398ba5713717112a # v0.21.0
+        with:
+          path: .
+          format: spdx-json
+          output-file: release-artifacts/ray-hive.spdx.json
+          upload-artifact: false
+      - name: Attest release artifacts
+        uses: actions/attest-build-provenance@8beda2b7ed98355c0e97c0a63bec38ae472e66c4 # v4
+        with:
+          subject-path: release-artifacts/packages/*
+      - name: Upload immutable release bundle
+        id: upload
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+        with:
+          name: release-bundle
+          path: release-artifacts/
+          if-no-files-found: error
+          retention-days: 14
+
+  install-smoke:
+    name: Install ${{ matrix.artifact }} / ${{ matrix.profile }} / Python ${{ matrix.python }}
+    needs: [candidate, build]
+    if: needs.build.result == 'success'
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    strategy:
+      fail-fast: false
+      matrix:
+        python: ["3.12", "3.13"]
+        artifact: [wheel, sdist]
+        profile: [base, telemetry]
+    steps:
+      - name: Download exact release bundle
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        with:
+          artifact-ids: ${{ needs.build.outputs.artifact-id }}
+          path: release
+          merge-multiple: true
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: ${{ matrix.python }}
+      - name: Install exact distribution
+        env:
+          PROFILE: ${{ matrix.profile }}
+          ARTIFACT: ${{ matrix.artifact }}
+        run: |
+          set -euo pipefail
+          if [[ "${ARTIFACT}" == "wheel" ]]; then
+            package="$(find release/packages -maxdepth 1 -name '*.whl' -print -quit)"
+          else
+            package="$(find release/packages -maxdepth 1 -name '*.tar.gz' -print -quit)"
+          fi
+          [[ -n "${package}" ]]
+          python -m venv smoke-venv
+          smoke-venv/bin/python -m pip install --upgrade pip
+          if [[ "${PROFILE}" == "base" ]]; then
+            requirement="ray-hive @ file://$(realpath "${package}")"
+          else
+            requirement="ray-hive[${PROFILE}] @ file://$(realpath "${package}")"
+          fi
+          smoke-venv/bin/python -m pip install "${requirement}"
+          smoke-venv/bin/python -c 'import ray_hive; print(ray_hive.__all__)'
+
+  testpypi-publish:
+    name: Publish the formal artifact to TestPyPI
+    needs: [candidate, build, install-smoke]
+    if: needs.candidate.outputs.mode == 'tag' && needs.build.result == 'success' && needs.install-smoke.result == 'success'
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    environment: testpypi
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - name: Check out candidate release notes
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          ref: ${{ needs.candidate.outputs.sha }}
+          persist-credentials: false
+      - name: Download exact release bundle
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        with:
+          artifact-ids: ${{ needs.build.outputs.artifact-id }}
+          path: release
+          merge-multiple: true
+      - name: Verify tag and artifact manifest
+        run: |
+          python scripts/verify_release_tag.py \
+            --tag "${{ needs.candidate.outputs.tag }}" \
+            --expected-sha "${{ needs.candidate.outputs.sha }}"
+          python scripts/verify_release_artifacts.py release/packages \
+            --name ray-hive \
+            --version "${{ needs.candidate.outputs.version }}" \
+            --manifest release/SHA256SUMS
+      - name: Publish to TestPyPI with trusted publishing
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
+        with:
+          repository-url: https://test.pypi.org/legacy/
+          packages-dir: release/packages/
+
+  testpypi-smoke:
+    name: TestPyPI install / ${{ matrix.profile }} / Python ${{ matrix.python }}
+    needs: [candidate, testpypi-publish]
+    if: needs.testpypi-publish.result == 'success'
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    strategy:
+      fail-fast: false
+      matrix:
+        python: ["3.12", "3.13"]
+        profile: [base, telemetry]
+    steps:
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: ${{ matrix.python }}
+      - name: Install published package from TestPyPI
+        env:
+          PROFILE: ${{ matrix.profile }}
+          VERSION: ${{ needs.candidate.outputs.version }}
+        run: |
+          set -euo pipefail
+          python -m venv smoke-venv
+          smoke-venv/bin/python -m pip install --upgrade pip
+          if [[ "${PROFILE}" == "base" ]]; then
+            requirement="ray-hive==${VERSION}"
+          else
+            requirement="ray-hive[${PROFILE}]==${VERSION}"
+          fi
+          for attempt in 1 2 3 4 5; do
+            if smoke-venv/bin/python -m pip install --no-cache-dir \
+              --index-url https://test.pypi.org/simple/ \
+              --extra-index-url https://pypi.org/simple/ "${requirement}"; then
+              break
+            fi
+            [[ "${attempt}" -lt 5 ]] || exit 1
+            sleep 15
+          done
+          smoke-venv/bin/python -c 'import ray_hive; print(ray_hive.__all__)'
+
+  publish:
+    name: Publish the same artifact to PyPI
+    needs: [candidate, build, testpypi-smoke]
+    if: needs.testpypi-smoke.result == 'success'
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    environment: pypi
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - name: Download exact release bundle
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        with:
+          artifact-ids: ${{ needs.build.outputs.artifact-id }}
+          path: release
+          merge-multiple: true
+      - name: Publish to PyPI with trusted publishing
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
+        with:
+          packages-dir: release/packages/
+
+  github-release:
+    name: Create the immutable GitHub Release
+    needs: [candidate, build, publish]
+    if: needs.publish.result == 'success'
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    environment: github-release
+    permissions:
+      contents: write
+    steps:
+      - name: Check out release notes
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          ref: ${{ needs.candidate.outputs.sha }}
+          persist-credentials: false
+      - name: Download exact release bundle
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        with:
+          artifact-ids: ${{ needs.build.outputs.artifact-id }}
+          path: release
+          merge-multiple: true
+      - name: Verify artifact manifest before release
+        run: >-
+          python scripts/verify_release_artifacts.py release/packages
+          --name ray-hive
+          --version "${{ needs.candidate.outputs.version }}"
+          --manifest release/SHA256SUMS
+      - name: Create immutable GitHub Release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: >-
+          gh release create "${{ needs.candidate.outputs.tag }}"
+          release/packages/* release/SHA256SUMS release/ray-hive.spdx.json
+          --verify-tag
+          --title "ray-hive ${{ needs.candidate.outputs.tag }}"
+          --notes-file "release-notes/v${{ needs.candidate.outputs.version }}.md"

ray_hive-1.0/.github/workflows/slow-integration.yml

@@ -0,0 +1,30 @@
+name: Slow integration
+
+on:
+  schedule:
+    - cron: "17 3 * * 0"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: slow-integration-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  current-core-evidence:
+    name: Current real-infrastructure evidence
+    uses: ./.github/workflows/hive-integration.yml
+
+  scope-notice:
+    name: Verify slow-suite scope remains explicit
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - name: Reject accidental production-ready claims
+        run: |
+          set -euo pipefail
+          ! grep -Eiq 'production[- ]ready|production Core status: supported' README.md
+          grep -Fq 'Production Core status requires' docs/conformance.md