Prepare the compatible RC host for GitHub app publishing

.cargo/config.toml

@@ -27,6 +27,10 @@ OCTOSENSE_SYSTEM_APPS = { value = "desktop/system-apps.json", relative = true }
 # The locked aws-lc-sys supports its CC builder on Android arm64. Use the
 # installed NDK Clang directly; no additional CMake installation is needed.
 AWS_LC_SYS_CMAKE_BUILDER_aarch64_linux_android = "0"
+# The Android packager also forces its global CMake setting into host-side
+# bundle validation dependencies. On Apple arm64, use the supported CC builder
+# there too. This changes only the build driver, not crypto or assembly features.
+AWS_LC_SYS_CMAKE_BUILDER_aarch64_apple_darwin = "0"
 
 # iOS gives the main thread a 1 MB stack, and the shell's widget tree is
 # built on it through nested script_apply/script_new calls that overflowed

.github/workflows/desktop.yml

@@ -107,6 +107,8 @@ jobs:
           shared-key: native-host-api
       - name: Build the native acceptance host and pinned Hub CLI
         run: |
+          # Fresh child processes catch native response keys missing from the string lookup table.
+          cargo test --manifest-path .sources/makepad/Cargo.toml -p makepad-widgets splash_host::tests
           cargo build --locked --release -p octosense-shell --example host-api-lab --features acceptance-fixtures
           cargo build --locked -p octosense-app-hub --bin hub
       - name: Signed app tool calls a real OS permission API

.github/workflows/embedded-browser.yml

@@ -0,0 +1,77 @@
+name: Embedded browser
+
+on:
+  pull_request:
+    paths:
+      - 'crates/browser-smoke/**'
+      - 'tools/browser-smoke.py'
+      - 'tools/browser_smoke_x11.py'
+      - 'tools/runtime-patches/**'
+      - 'runtime-patches.lock.json'
+      - 'native-runtime.lock.json'
+      - 'Cargo.toml'
+      - 'Cargo.lock'
+      - '.github/workflows/embedded-browser.yml'
+  push:
+    branches: [main]
+    paths:
+      - 'crates/browser-smoke/**'
+      - 'tools/browser-smoke.py'
+      - 'tools/browser_smoke_x11.py'
+      - 'tools/runtime-patches/**'
+      - 'runtime-patches.lock.json'
+      - 'native-runtime.lock.json'
+      - 'Cargo.toml'
+      - 'Cargo.lock'
+      - '.github/workflows/embedded-browser.yml'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: embedded-browser-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  windows:
+    runs-on: windows-2022
+    timeout-minutes: 40
+    env:
+      PYTHONUTF8: '1'
+    steps:
+      - name: Preserve runtime patch bytes
+        run: git config --global core.autocrlf false
+      - uses: actions/checkout@v6
+      - uses: actions/setup-python@v6
+        with:
+          python-version: '3.12'
+      - uses: dtolnay/rust-toolchain@stable
+      - name: Prepare the exact native runtime
+        run: python tools/setup.py
+      - uses: Swatinem/rust-cache@v2
+        with:
+          shared-key: embedded-browser-windows
+          cache-on-failure: true
+      - name: Build the native acceptance host
+        run: cargo build --locked --release -p octosense-browser-smoke
+      - name: Navigation and callback policy tests
+        run: cargo test --locked --release -p octosense-browser-smoke
+      - name: Real embedded WebView2 acceptance
+        # The runner must already provide WebView2. No installer, fake engine
+        # or external-browser fallback converts a missing runtime into a pass.
+        run: python tools/browser-smoke.py --binary target/release/octosense-browser-smoke.exe --out "$env:RUNNER_TEMP/browser-smoke" --require-snapshot --software-graphics
+      - name: Native fixture diagnostics on failure
+        if: failure()
+        run: |
+          $log = Join-Path $env:RUNNER_TEMP 'browser-smoke/native.log'
+          if (Test-Path $log) { Get-Content $log -Tail 100 }
+      - uses: actions/upload-artifact@v7
+        if: always()
+        with:
+          name: embedded-browser-windows
+          if-no-files-found: ignore
+          path: |
+            ${{ runner.temp }}/browser-smoke/receipt.json
+            ${{ runner.temp }}/browser-smoke/inspect-*.json
+            ${{ runner.temp }}/browser-smoke/snapshot-*.png

.github/workflows/phone.yml

@@ -125,6 +125,10 @@ jobs:
           # The linked Terminal (the desktop's default): its AI tools reach
           # the live emulator behind the module's TermTabs root.
           cargo test --locked --features mobile-apps,app-terminal -p octosense-shell terminal
+          # The opt-in Wasm service must keep fresh per-call guest state and
+          # enforce resource, cancellation and current-admission boundaries.
+          cargo test --locked -p octosense-wasm-host
+          cargo test --locked --features mobile-apps,wasm-lab -p octosense-shell wasm_service::tests
           cargo test --locked -p makepad-widgets splash_policy
           cargo test --locked -p makepad-script-std gate::tests
       # The two-lane scenario (crates/shell/src/host_tools/scenario_tests.rs):

.github/workflows/platform-vault.yml

@@ -0,0 +1,76 @@
+name: Platform accounts
+
+on:
+  pull_request:
+    paths:
+      - 'crates/oauth-service/**'
+      - 'crates/shell/examples/connected-app-host.rs'
+      - 'crates/shell/examples/connected-install.rs'
+      - 'crates/shell/examples/connected_support/**'
+      - 'tools/connected-e2e/backend_login.py'
+      - 'tools/connected-e2e/webdriver_browser.py'
+      - 'tools/connected-e2e/native.py'
+      - 'tools/connected-e2e/backend-login/**'
+      - 'tools/backend-login-fixture.py'
+      - 'Cargo.toml'
+      - 'Cargo.lock'
+      - 'native-runtime.lock.json'
+      - 'runtime-patches.lock.json'
+      - 'tools/runtime-patches/**'
+      - '.github/workflows/platform-vault.yml'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: platform-vault-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  windows:
+    runs-on: windows-2022
+    timeout-minutes: 55
+    env:
+      PYTHONUTF8: '1'
+      MAKEPAD_D3D11_WARP: '1'
+    steps:
+      - name: Preserve runtime patch bytes
+        run: git config --global core.autocrlf false
+      - uses: actions/checkout@v6
+      - uses: actions/setup-python@v6
+        with:
+          python-version: '3.12'
+      - uses: dtolnay/rust-toolchain@stable
+      - run: python tools/setup.py
+      - uses: Swatinem/rust-cache@v2
+        with:
+          shared-key: embedded-browser-windows
+          cache-on-failure: true
+      - name: Actual Windows Credential Manager lifecycle
+        # A fresh synthetic profile on a disposable runner. Missing/unusable
+        # native credentials are a failure, never replaced by a file vault.
+        # This checks storage/revocation, not provider login or user approval.
+        run: cargo test --locked --release -p octosense-oauth-service --features host host_vault_acceptance::platform_vault_persists_across_reopen_without_plaintext_credentials -- --ignored --exact --nocapture
+      - name: Build real connected-app host and signed installer
+        run: |
+          cargo build --locked --release -p octosense-shell --features acceptance-fixtures --example connected-app-host --example connected-install
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+          cargo build --locked --release -p octosense-app-hub --bin hub
+      - name: Browser automation client only
+        # Use the runner's existing Edge browser. No downloaded browser engine,
+        # developer profile, provider account, or credential injection.
+        run: python -m pip install 'playwright==1.55.0'
+      - name: Actual synthetic backend browser and callback
+        run: |
+          $edge = Join-Path ${env:ProgramFiles(x86)} 'Microsoft/Edge/Application/msedge.exe'
+          if (-not (Test-Path $edge)) { throw 'The runner must already provide Edge' }
+          python tools/connected-e2e/backend_login.py --binary target/release/examples/connected-app-host.exe --installer target/release/examples/connected-install.exe --hub target/release/hub.exe --chrome "$edge" --out "$env:RUNNER_TEMP/backend-login"
+      - uses: actions/upload-artifact@v7
+        if: always()
+        with:
+          name: windows-backend-account-receipt
+          if-no-files-found: ignore
+          # Never upload the whole private directory: it contains OAuth URLs,
+          # fictional tokens and raw failure diagnostics.
+          path: ${{ runner.temp }}/backend-login/receipt.json

.github/workflows/release-desktop.yml

@@ -41,6 +41,9 @@ on:
       - 'desktop/packaging/**'
       - 'desktop/scripts/package.py'
       - 'tools/release-scan.py'
+      - 'tools/release-scan-public-assets.json'
+      - 'tools/test_release_scan.py'
+      - 'tools/fixtures/release-scan/**'
       - 'tools/kernel-artifact.py'
       - '.github/workflows/release-desktop.yml'
   workflow_dispatch:
@@ -172,7 +175,7 @@ jobs:
           sudo apt-get install -y --no-install-recommends pkg-config libssl-dev libx11-dev libxcursor-dev \
             libxkbcommon-dev libxkbcommon-x11-dev libwayland-dev libgl1-mesa-dev libegl1-mesa-dev libgles2-mesa-dev \
             libasound2-dev libpulse-dev libdbus-1-dev libudev-dev libdrm-dev libgbm-dev libva-dev dpkg-dev file \
-            desktop-file-utils libfuse2
+            desktop-file-utils libfuse2 squashfs-tools
       - name: Install cargo-packager
         run: cargo install cargo-packager --locked --version 0.11.8
       - name: Neutral build paths
@@ -405,7 +408,6 @@ jobs:
       contents: write
     env:
       TAG: ${{ needs.plan.outputs.tag }}
-      GH_TOKEN: ${{ github.token }}
       GH_REPO: ${{ github.repository }}
     steps:
       - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
@@ -415,6 +417,7 @@ jobs:
           persist-credentials: false
       - name: HEAD is the tag's commit
         env:
+          GH_TOKEN: ${{ github.token }}
           WANT: ${{ needs.plan.outputs.commit }}
         run: |
           head=$(git rev-parse HEAD)
@@ -441,6 +444,10 @@ jobs:
           cd packages
           sha256sum -- * | sort -k2 > SHA256SUMS
           cat SHA256SUMS
+      - name: Install the non-executing AppImage extractor
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends squashfs-tools
       - name: Scan again what is attached
         env:
           RELEASE_SCAN_EXTRA: ${{ secrets.RELEASE_SCAN_EXTRA }}
@@ -449,6 +456,8 @@ jobs:
           # before signing, and the same app is in the .app.zip scanned now.
           python3 tools/release-scan.py --dmg-bytes-only packages/*
       - name: Attach to the tag's draft release
+        env:
+          GH_TOKEN: ${{ github.token }}
         run: |
           version="${TAG#desktop-v}"
           if gh release view "$TAG" > /dev/null 2>&1; then