build: add the Darwin analysis runtime by Rajioba1 · Pull Request #6 · easyCris-software/easyCris

Rajioba1 · 2026-07-30T19:18:39Z

Summary

adds the bundled macOS CPython analysis runtime with fail-closed installed-app resolution
preserves the existing Windows release and Nuitka paths
adds identical native Intel and Apple Silicon fast CI lanes under Node.js 24
adds protected dual-architecture runtime provisioning, staging, manifest validation, inside-out signing, strict signature verification, and post-sign backend/export execution
prevents bundled backend child processes from writing bytecode into the immutable runtime

Validation status

complete clean local Node.js 24 gates pass on frozen candidate b4dff3b
all 254 frontend test files pass: 3,418 tests passed with one existing skip
targeted private M1 stats and RNA-seq parity gates pass with zero skips (37 statistical metrics; 19 RNA-seq models and 95 metrics)
fresh local Intel provisioning, staging, unsigned app packaging, installed backend/export validation, and deterministic GSEApy dependency smoke pass with no development reuse
source, staged, and installed runtimes remain free of bytecode-cache directories after execution
public Windows, Intel macOS, and Apple Silicon CI: pending/current run
protected Intel and Apple Silicon packaged-runtime validation: starts only after public CI passes

Public scope

Private E2E sources, generated runtimes, provisioning logs, signing credentials, and compiled macOS backend artifacts are intentionally excluded. This PR remains draft until complete M1 closeout evidence, dual-architecture protected validation, and independent reviews are green on the same frozen SHA.

Signed-off-by: Rajioba1 <196587943+Rajioba1@users.noreply.github.com>

macOS hardened builds select BackendMode::BundledRequired and launch stats/rnaseq/plot via the Task 6 staged interpreter with -I -B -m after a light manifest and module contract check. Dev/e2e stay Script; Windows Compiled paths are unchanged; RNA-seq script fallback remains Compiled-only. Signed-off-by: Rajioba1 <196587943+Rajioba1@users.noreply.github.com>

Keep the public macOS matrix on native Intel and arm runners, add provisioner unit tests and BundledRequired Rust filters to the fast lane, and tighten the privacy contract against release mutation. Signed-off-by: Rajioba1 <196587943+Rajioba1@users.noreply.github.com>

Pin Node 24 across .nvmrc, package engines/devEngines, routine CI, and the Windows release workflow so local and hosted toolchains match. Signed-off-by: Rajioba1 <196587943+Rajioba1@users.noreply.github.com>

Add a protected dual-architecture validation workflow that provisions the pinned Darwin runtime, stages and validates it, builds an ad-hoc app, signs nested Mach-O inside-out, and re-validates installed backends without touching private E2E or public release channels. Signed-off-by: Rajioba1 <196587943+Rajioba1@users.noreply.github.com>

Use a macOS validation Tauri overlay that disables updater artifacts and Windows PowerShell resources, run the public GSEApy dependency smoke on staged and installed runtimes, and invoke the lockfile Tauri CLI. Signed-off-by: Rajioba1 <196587943+Rajioba1@users.noreply.github.com>

GitHub Actions only applies GITHUB_ENV to later steps, so the protected validation sign step now exports APP_PATH in-shell and passes the path as python argv before writing GITHUB_ENV for the installed-validate step. Signed-off-by: Rajioba1 <196587943+Rajioba1@users.noreply.github.com>

Signed-off-by: Rajioba1 <196587943+Rajioba1@users.noreply.github.com>

Rajioba1 force-pushed the macos/01-runtime branch from 525f4e4 to 4d6030d Compare August 2, 2026 00:18

Rajioba1 added 29 commits August 1, 2026 19:13

build: define cross-platform backend artifact names

1d0b4b2

Signed-off-by: Rajioba1 <196587943+Rajioba1@users.noreply.github.com>

build: compile analysis backends for darwin

acfc4f6

Signed-off-by: Rajioba1 <196587943+Rajioba1@users.noreply.github.com>

fix: harden darwin backend compile verification

ce03575

Signed-off-by: Rajioba1 <196587943+Rajioba1@users.noreply.github.com>

fix: validate darwin compile prerequisites

d470b75

Signed-off-by: Rajioba1 <196587943+Rajioba1@users.noreply.github.com>

build: stage and validate darwin runtime artifacts

72fca16

Signed-off-by: Rajioba1 <196587943+Rajioba1@users.noreply.github.com>

fix: harden darwin runtime validation

2278c26

Signed-off-by: Rajioba1 <196587943+Rajioba1@users.noreply.github.com>

fix: resolve analysis backends on macos

1dc0579

Signed-off-by: Rajioba1 <196587943+Rajioba1@users.noreply.github.com>

ci: add fast macos quality gates

6ecf0a0

Signed-off-by: Rajioba1 <196587943+Rajioba1@users.noreply.github.com>

fix: name Darwin Nuitka launchers

4dc9a2d

Signed-off-by: Rajioba1 <196587943+Rajioba1@users.noreply.github.com>

fix: harden Darwin release validation

5c6994d

Signed-off-by: Rajioba1 <196587943+Rajioba1@users.noreply.github.com>

chore: disclose Darwin certifi license

f1ca578

Signed-off-by: Rajioba1 <196587943+Rajioba1@users.noreply.github.com>

fix: make license sync check cross-platform

68c4f10

Signed-off-by: Rajioba1 <196587943+Rajioba1@users.noreply.github.com>

fix: preserve PowerShell license gate parity

b647bff

Signed-off-by: Rajioba1 <196587943+Rajioba1@users.noreply.github.com>

fix: allow cold compiled backend startup

74c0c43

Signed-off-by: Rajioba1 <196587943+Rajioba1@users.noreply.github.com>

fix: enforce the Darwin runtime support floor

5e2451a

Signed-off-by: Rajioba1 <196587943+Rajioba1@users.noreply.github.com>

fix: support framework Python on macOS

d93d95b

Signed-off-by: Rajioba1 <196587943+Rajioba1@users.noreply.github.com>

build: define bundled macos runtime layout

c216917

Signed-off-by: Rajioba1 <196587943+Rajioba1@users.noreply.github.com>

build: provision bundled python on macos

e479633

Signed-off-by: Rajioba1 <196587943+Rajioba1@users.noreply.github.com>

fix: harden bundled python provisioning

bdeea48

Signed-off-by: Rajioba1 <196587943+Rajioba1@users.noreply.github.com>

fix: close bundled python review gaps

119b866

Signed-off-by: Rajioba1 <196587943+Rajioba1@users.noreply.github.com>

build: stage and validate bundled macos python

8fb8530

Signed-off-by: Rajioba1 <196587943+Rajioba1@users.noreply.github.com>

build: standardize on Node.js 24

4711ada

Pin Node 24 across .nvmrc, package engines/devEngines, routine CI, and the Windows release workflow so local and hosted toolchains match. Signed-off-by: Rajioba1 <196587943+Rajioba1@users.noreply.github.com>

fix: fail closed bundled macos runtime resolution

99f3691

Signed-off-by: Rajioba1 <196587943+Rajioba1@users.noreply.github.com>

fix: correct macos validation closeout

278f11f

Signed-off-by: Rajioba1 <196587943+Rajioba1@users.noreply.github.com>

fix: test macos validation dispatch boundary

cdff749

Signed-off-by: Rajioba1 <196587943+Rajioba1@users.noreply.github.com>

Rajioba1 force-pushed the macos/01-runtime branch from 4d6030d to cdff749 Compare August 3, 2026 02:48

Rajioba1 added 9 commits August 2, 2026 20:08

fix: bound AppShell grid stability setup timeout

b64b28b

Signed-off-by: Rajioba1 <196587943+Rajioba1@users.noreply.github.com>

fix: distinguish local runtime paths from wheel provenance

f053d5d

Signed-off-by: Rajioba1 <196587943+Rajioba1@users.noreply.github.com>

ci: bound protected macos build heap

15f1f80

Signed-off-by: Rajioba1 <196587943+Rajioba1@users.noreply.github.com>

fix: preserve runtime digest through macos packaging

ff6d7bb

Signed-off-by: Rajioba1 <196587943+Rajioba1@users.noreply.github.com>

test: await spreadsheet selection readiness

7ec6fb1

Signed-off-by: Rajioba1 <196587943+Rajioba1@users.noreply.github.com>

test: bound AppShell setup hooks

4127cde

Signed-off-by: Rajioba1 <196587943+Rajioba1@users.noreply.github.com>

fix: align provisioned runtime digest

cc1475c

Signed-off-by: Rajioba1 <196587943+Rajioba1@users.noreply.github.com>

build: harden macos runtime reproducibility

de9de31

Signed-off-by: Rajioba1 <196587943+Rajioba1@users.noreply.github.com>

fix: prevent bundled python bytecode writes

b4dff3b

Signed-off-by: Rajioba1 <196587943+Rajioba1@users.noreply.github.com>

Navigation Menu

Uh oh!

build: add the Darwin analysis runtime - #6

build: add the Darwin analysis runtime#6
Rajioba1 wants to merge 39 commits into
easyCris-software:mainfrom
Rajioba1:macos/01-runtime

Rajioba1 commented Jul 30, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

Rajioba1 commented Jul 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Validation status

Public scope

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Rajioba1 commented Jul 30, 2026 •

edited

Loading