[Olize]

Purpose

Prepare next approved MCH release only with two additional, distinct ARM64 archives. The already published v0.2.1 release must remain unchanged.

Exact changes

• Extend public CI with native Linux ARM64 runner (ubuntu-22.04-arm) and Android Bionic ARM64 cross-build (aarch64-linux-android, NDK clang + llvm-ar). Verify ARM64 ELF architecture and Android /system/bin/linker64 interpreter.
• Extend tag-gated .github/workflows/release-packages.yml with linux-aarch64 and android-aarch64-termux binary artifacts, preserving all three original binaries and both source archives.
• Verify seven expected source/binary archives; append all SHA-256 sums and require eight total release assets (including SHA256SUMS.txt).
• Keep the version/tag/public-main/published-release verification gate. Refuse packaging on v0.2.1 to avoid modifying historical assets.
• The Android cross-build is not represented as an executed Android runtime test: before publication, the exact Android-built binary must pass native Termux smoke tests.

Safety / provenance

• This public branch descends only from public main 48cb0268c436595674454623c9611ea10c4f56f1.
• Only two public CI/release workflow files are changed. No private repository files or Git history.
• No version bump, no release tag, no release created or assets uploaded; publish workflow remains gated by an existing public stable release tag.
• Public CI success + private CI + real target smoke tests + independent review are required before merge and before any future release.

Draft PR — do not auto-merge or run release-packages workflow against v0.2.1.

Verification performed

Public PR CI 39695866928 succeeded on all five jobs, including native Linux AArch64 and Android/Termux AArch64 cross-compile; the prior three-platform CI remains green. In private repo CI 39695806659 also passed both ARM64 targets. Its actual Android NDK-created ELF ran natively on AArch64 Termux, including verified copy, single-file resume, nested directory resume and restart recheck. The new release packaging workflow has not been run on a future release tag; archive publish and asset verification still require the next separately approved stable release and review. Public v0.2.1 assets remain untouched.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-22T11:30:26.937599Z	d4a9d51	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: d4a9d515c6

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Make the Termux runtime gate block publication

For every future published tag, the Android branch succeeds after static ELF checks and this informational echo; publish then depends only on binary/source and immediately uploads the archive. A repo-wide search found no native-Termux job or approval that gates that upload, so the exact binary built here cannot undergo the stated native smoke test before becoming public, allowing a linker-valid but nonfunctional Termux binary to ship. Add a blocking test or approval that validates this artifact before the publish job proceeds.

Useful? React with 👍 / 👎.