decisions: run the local checkpoints on-device (clef-flash-9b / clef-flash-mlx)

.env.example

@@ -0,0 +1,16 @@
+# wally build configuration — local file, never committed.
+#
+# Copy `.env.example` to `.env` and fill in the two console endpoints.
+# Read by cmake/env-loader.cmake at configure time. Configure fails without
+# these; the values end up compiled into the binary, so they never appear in
+# committed source or on a command line.
+
+# The control plane: /auth/cli/*, /v1/me, /v1/cli/*.
+WALLY_BAKED_CONSOLE_API_URL=
+
+# The browser origin allowed to host the approval page.
+WALLY_BAKED_CONSOLE_WEB_ORIGIN=
+
+# Optional: one more browser origin allowed to host the approval page, for a
+# deployment that answers under a second name.
+#WALLY_BAKED_CONSOLE_WEB_ORIGIN_ALT=

.github/actions/build-wally/action.yml

@@ -2,9 +2,9 @@ name: Build wally
 description: >-
   Configure, build, and optionally package a wally bottle from a pinned C++
   desktop kit. The configure→build sequence is identical across ci.yml and
-  release.yml and every platform; this is the one place it lives. The dev/prod
-  bake is read from the WALLY_BAKED_CONSOLE_* environment the caller sets (empty
-  for prod), so nothing endpoint-shaped is passed here.
+  release.yml and every platform; this is the one place it lives. The console
+  endpoints are read from the WALLY_BAKED_CONSOLE_* environment the caller sets,
+  so nothing endpoint-shaped is passed here.
 
 inputs:
   platform:
@@ -13,10 +13,6 @@ inputs:
   kit-dir:
     description: Path to the fetched kit (CMAKE_PREFIX_PATH).
     required: true
-  variant:
-    description: prod | dev — only affects the packaged filename (-dev).
-    required: false
-    default: prod
   package:
     description: 'true to also produce the release bottle; false to only build.'
     required: false
@@ -29,13 +25,14 @@ runs:
       with:
         platform: ${{ inputs.platform }}
 
-    - name: Configure + build (${{ inputs.variant }})
+    - name: Configure + build
       shell: bash
-      env:
-        # Declared so configure can refuse a dev build whose endpoint variables
-        # never arrived, instead of quietly producing a production binary under
-        # a -dev name (wally #87).
-        WALLY_CHANNEL: ${{ inputs.variant }}
+      # WALLY_BAKED_CONSOLE_* and WALLY_CONSOLE_OPTIONAL come from the caller's
+      # job environment; composite steps inherit job-level env. Configure
+      # requires the endpoints so a binary can never silently ship with no
+      # control plane; a fork pull request receives no repository variables, so
+      # the caller sets WALLY_CONSOLE_OPTIONAL=1 there and the resulting binary
+      # resolves no default console.
       run: |
         set -euo pipefail
         prefix="${{ inputs.kit-dir }}"
@@ -59,7 +56,7 @@ runs:
           *)           cmake --build build --config Release ;;
         esac
 
-    - name: Package (${{ inputs.variant }})
+    - name: Package
       if: ${{ inputs.package == 'true' }}
       shell: bash
       env:
@@ -69,13 +66,13 @@ runs:
         ver="${WALLY_VERSION#v}"
         case "${{ inputs.platform }}" in
           macos-arm64)
-            WALLY_VERSION="$ver" bash scripts/build/package-wally.sh build macos-arm64 "${{ inputs.variant }}" ;;
+            WALLY_VERSION="$ver" bash scripts/build/package-wally.sh build macos-arm64 ;;
           linux-x64)
-            WALLY_VERSION="$ver" bash scripts/build/package-wally.sh build linux-x86_64 "${{ inputs.variant }}" ;;
+            WALLY_VERSION="$ver" bash scripts/build/package-wally.sh build linux-x86_64 ;;
           linux-arm64)
-            WALLY_VERSION="$ver" bash scripts/build/package-wally.sh build linux-arm64 "${{ inputs.variant }}" ;;
+            WALLY_VERSION="$ver" bash scripts/build/package-wally.sh build linux-arm64 ;;
           windows-x64)
-            pwsh -File scripts/build/package-wally-windows.ps1 -BuildDir build -Version "$ver" -KitDir "${{ inputs.kit-dir }}" -Channel "${{ inputs.variant }}" ;;
+            pwsh -File scripts/build/package-wally-windows.ps1 -BuildDir build -Version "$ver" -KitDir "${{ inputs.kit-dir }}" ;;
           windows-arm64)
-            pwsh -File scripts/build/package-wally-windows.ps1 -BuildDir build -Version "$ver" -KitDir "${{ inputs.kit-dir }}" -Platform windows-arm64 -Channel "${{ inputs.variant }}" ;;
-        esac
+            pwsh -File scripts/build/package-wally-windows.ps1 -BuildDir build -Version "$ver" -KitDir "${{ inputs.kit-dir }}" -Platform windows-arm64 ;;
+        esac

.github/workflows/ci.yml

@@ -18,6 +18,16 @@ on:
 permissions:
   contents: read
 
+# The console endpoints configure and bake into the binary. They are repository
+# variables, not secrets: nothing here grants access, and a fork pull request
+# receives neither. WALLY_CONSOLE_OPTIONAL lets a fork PR build without them
+# (the binary then resolves no default console). Builds on this repo use the
+# existing dev-console variables. The alt origin is optional and unset here.
+env:
+  WALLY_BAKED_CONSOLE_API_URL: ${{ vars.WALLY_DEV_CONSOLE_API_URL }}
+  WALLY_BAKED_CONSOLE_WEB_ORIGIN: ${{ vars.WALLY_DEV_CONSOLE_WEB_ORIGIN }}
+  WALLY_CONSOLE_OPTIONAL: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork && '1' || '' }}
+
 concurrency:
   group: ci-${{ github.ref }}
   cancel-in-progress: true
@@ -101,7 +111,7 @@ jobs:
         with:
           persist-credentials: false
           repository: RunanywhereAI/runanywhere-sdks
-          ref: b3a2b0147d8c66190c14a53bc04286efd6a4d64a
+          ref: e595580a72452595a4a5b8abc137cad10132ba75
           path: .deps/runanywhere-sdks
       - name: Install ninja
         run: brew install ninja

.github/workflows/release.yml

@@ -10,26 +10,61 @@ on:
       version:
         description: 'Version to release (e.g. 0.5.0 — no leading v)'
         required: true
+      dry_run:
+        description: 'Build, package and verify everything without creating a tag or release (version must match versions.toml)'
+        required: false
+        default: false
+        type: boolean
 
 permissions:
   contents: write
 
 env:
   WALLY_VERSION: ${{ github.event.inputs.version || github.ref_name }}
+  # Required at configure time; a release never falls back to an un-configured
+  # binary, so these must be set as repository variables before tagging.
+  WALLY_BAKED_CONSOLE_API_URL: ${{ vars.WALLY_CONSOLE_API_URL }}
+  WALLY_BAKED_CONSOLE_WEB_ORIGIN: ${{ vars.WALLY_CONSOLE_WEB_ORIGIN }}
+  WALLY_BAKED_CONSOLE_WEB_ORIGIN_ALT: ${{ vars.WALLY_CONSOLE_WEB_ORIGIN_ALT }}
 
-# Every platform builds one bottle from one kit: `prod` (empty bake -> the
-# production console defaults in credentials.cpp). The configure→build→package
+# Every platform builds one bottle from one kit, with the console endpoints from
+# the repository variables above compiled in. The configure→build→package
 # sequence lives in .github/actions/build-wally; e2e runs on the binary it
 # produced, so the bottle is built exactly once.
+#
+# Dry run: dispatch with dry_run=true and the current versions.toml version.
+# Everything builds, packages and verifies, but the final release step is
+# skipped, so no tag and no GitHub Release are created.
 jobs:
+  validate-dispatch:
+    # Fails fast on a bad manual input instead of burning five platform
+    # builds. Always runs so `needs` below never sees a skipped job on push.
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - name: Validate dispatch inputs
+        if: ${{ github.event_name == 'workflow_dispatch' }}
+        env:
+          VERSION: ${{ inputs.version }}
+          DRY_RUN: ${{ inputs.dry_run }}
+        run: |
+          set -euo pipefail
+          if ! [[ "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "::error::version must be X.Y.Z (no leading v); got '$VERSION'" >&2
+            exit 1
+          fi
+          pinned="$(awk '/^\[product\]/{p=1} p && /^version = "/{gsub(/"/, "", $3); print $3; exit}' versions.toml)"
+          if [[ "$DRY_RUN" == "true" && "$VERSION" != "$pinned" ]]; then
+            echo "::error::dry_run needs version=$pinned (versions.toml [product]); got '$VERSION'" >&2
+            exit 1
+          fi
   macos:
+    needs: [validate-dispatch]
     # SDK Package.swift is swift-tools-version 6.2 (Xcode 26).
     runs-on: macos-26
     timeout-minutes: 90
-    strategy:
-      fail-fast: false
-      matrix:
-        variant: [prod]
     env:
       WALLY_SDK_SWIFT_PATH: ${{ github.workspace }}/.deps/runanywhere-sdks
     steps:
@@ -41,7 +76,7 @@ jobs:
         with:
           persist-credentials: false
           repository: RunanywhereAI/runanywhere-sdks
-          ref: b3a2b0147d8c66190c14a53bc04286efd6a4d64a
+          ref: e595580a72452595a4a5b8abc137cad10132ba75
           path: .deps/runanywhere-sdks
       - name: Install ninja
         run: brew install ninja
@@ -75,7 +110,6 @@ jobs:
         with:
           platform: macos-arm64
           kit-dir: ${{ github.workspace }}/kit
-          variant: ${{ matrix.variant }}
           package: 'true'
       - name: Product e2e
         env:
@@ -89,16 +123,13 @@ jobs:
             "dist/wally-${VERSION}-macos-arm64.tar.gz.sha256"
       - uses: actions/upload-artifact@v4
         with:
-          name: wally-macos-arm64-${{ matrix.variant }}
+          name: wally-macos-arm64
           path: dist/wally-*-macos-arm64*.tar.gz*
 
   windows-arm64:
+    needs: [validate-dispatch]
     runs-on: windows-11-arm
     timeout-minutes: 60
-    strategy:
-      fail-fast: false
-      matrix:
-        variant: [prod]
     steps:
       - uses: actions/checkout@v4
         with:
@@ -139,7 +170,6 @@ jobs:
         with:
           platform: windows-arm64
           kit-dir: ${{ github.workspace }}/kit
-          variant: ${{ matrix.variant }}
           package: 'true'
       - name: Product e2e
         shell: bash
@@ -160,19 +190,16 @@ jobs:
             "dist/wally-$ver-windows-arm64.zip.sha256"
       - uses: actions/upload-artifact@v4
         with:
-          name: wally-windows-arm64-${{ matrix.variant }}
+          name: wally-windows-arm64
           path: |
             dist/*.zip
             dist/*.zip.sha256
           if-no-files-found: error
 
   windows:
+    needs: [validate-dispatch]
     runs-on: windows-2022
     timeout-minutes: 60
-    strategy:
-      fail-fast: false
-      matrix:
-        variant: [prod]
     steps:
       - uses: actions/checkout@v4
         with:
@@ -211,7 +238,6 @@ jobs:
         with:
           platform: windows-x64
           kit-dir: ${{ github.workspace }}/kit
-          variant: ${{ matrix.variant }}
           package: 'true'
       - name: Product e2e
         shell: bash
@@ -232,21 +258,18 @@ jobs:
             "dist/wally-$ver-windows-x86_64.zip.sha256"
       - uses: actions/upload-artifact@v4
         with:
-          name: wally-windows-x64-${{ matrix.variant }}
+          name: wally-windows-x64
           path: |
             dist/*.zip
             dist/*.zip.sha256
           if-no-files-found: error
 
   linux:
+    needs: [validate-dispatch]
     # Release compatibility floor. Ubuntu 24.04 produced a bottle requiring
     # GLIBC_2.38 and GLIBCXX_3.4.31/32, which fails on Ubuntu 22.04.
     runs-on: ubuntu-22.04
     timeout-minutes: 60
-    strategy:
-      fail-fast: false
-      matrix:
-        variant: [prod]
     steps:
       - uses: actions/checkout@v4
         with:
@@ -285,7 +308,6 @@ jobs:
         with:
           platform: linux-x64
           kit-dir: ${{ github.workspace }}/kit
-          variant: ${{ matrix.variant }}
           package: 'true'
       - name: Product e2e
         env:
@@ -312,10 +334,11 @@ jobs:
           bash scripts/test/linux-install-matrix.sh dist "${VERSION}"
       - uses: actions/upload-artifact@v4
         with:
-          name: wally-linux-x86_64-${{ matrix.variant }}
+          name: wally-linux-x86_64
           path: dist/wally-*-linux-x86_64*.tar.gz*
 
   linux-arm64:
+    needs: [validate-dispatch]
     # Built on the arm64 compat floor (glibc 2.34) so wally's own code stays
     # low; the kit's Sherpa prebuilt (glibc 2.38) sets the bottle floor. The
     # arm64 kit's cpp-httplib (zstd, brotli) and libarchive (bz2) reference
@@ -327,10 +350,6 @@ jobs:
     # floor from the ELF files instead.
     runs-on: ubuntu-22.04-arm
     timeout-minutes: 60
-    strategy:
-      fail-fast: false
-      matrix:
-        variant: [prod]
     steps:
       - uses: actions/checkout@v4
         with:
@@ -370,7 +389,6 @@ jobs:
         with:
           platform: linux-arm64
           kit-dir: ${{ github.workspace }}/kit
-          variant: ${{ matrix.variant }}
           package: 'true'
       - name: Verify archive
         run: |
@@ -388,7 +406,7 @@ jobs:
             "dist/wally-${VERSION}-linux-arm64.tar.gz"
       - uses: actions/upload-artifact@v4
         with:
-          name: wally-linux-arm64-${{ matrix.variant }}
+          name: wally-linux-arm64
           path: dist/wally-*-linux-arm64*.tar.gz*
 
   publish:
@@ -455,6 +473,10 @@ jobs:
             ( cd artifacts && shasum -a 256 "$f" > "${f}.sha256" )
           done
       - name: Create the release
+        # Dry runs stop here: bottles and metadata stay workflow artifacts,
+        # no tag and no GitHub Release. On tag pushes `inputs` is empty, so
+        # this still runs for real releases.
+        if: ${{ inputs.dry_run != true }}
         uses: softprops/action-gh-release@v2
         with:
           tag_name: ${{ github.event_name == 'push' && github.ref_name || format('v{0}', github.event.inputs.version) }}

.gitignore

@@ -30,6 +30,9 @@ deps/
 BEST_PRACTISES.md
 BEST_PRACTICES.md
 
+# Local build configuration (copy .env.example; see cmake/WallyRust.cmake).
+.env
+
 # IDE / editor caches
 .cache/
 .vscode/