feat: ship evidence-backed alpha portfolio and optimize protocol

.env.example

@@ -21,3 +21,6 @@ STUN_HOST=stun.example.com
 # POSTGRES_DB=opencade
 # RFC 8489 server as a numeric IP:port. Both variables should identify the same service.
 # OPENCADE_STUN_SERVER=203.0.113.10:3478
+# Evidence-gated native route promotion. Leave disabled until physical-host evidence qualifies.
+# OPENCADE_EVIDENCE_TCP_TUNNEL=false
+# ROUTE_POLICY_MIN_ATTEMPTS=10

.github/workflows/ci.yml

@@ -183,6 +183,15 @@ jobs:
       - name: Build Windows LAN alpha tools
         run: cargo build -p opencade-networking --bins --release --locked
 
+      - name: Configure MSVC developer environment
+        uses: ilammy/msvc-dev-cmd@v1
+        with:
+          arch: x64
+
+      - name: Build deterministic OpenCade test core
+        shell: pwsh
+        run: .\scripts\alpha\Build-TestCore.ps1
+
       - name: Build Windows desktop alpha
         run: cargo build --manifest-path apps/client/src-tauri/Cargo.toml --release --locked
 

.github/workflows/release.yml

@@ -9,9 +9,65 @@ permissions:
   id-token: write
   attestations: write
 
+concurrency:
+  group: release-${{ github.ref }}
+  cancel-in-progress: false
+
 jobs:
+  validate:
+    name: Validate tagged commit
+    runs-on: ubuntu-latest
+    services:
+      postgres:
+        image: postgres:16-alpine
+        env:
+          POSTGRES_USER: opencade
+          POSTGRES_PASSWORD: opencade
+          POSTGRES_DB: opencade_test
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd "pg_isready -U opencade -d opencade_test"
+          --health-interval 5s
+          --health-timeout 5s
+          --health-retries 10
+    steps:
+      - uses: actions/checkout@v4
+      - uses: pnpm/action-setup@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 24
+          cache: pnpm
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          toolchain: "1.98"
+          components: rustfmt, clippy
+      - uses: Swatinem/rust-cache@v2
+      - run: pnpm install --frozen-lockfile
+      - name: Require a matching semantic version
+        shell: bash
+        run: |
+          [[ "$GITHUB_REF_NAME" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]
+          test "${GITHUB_REF_NAME#v}" = "$(node -p "require('./package.json').version")"
+      - run: cargo fmt --all -- --check
+      - run: cargo clippy --workspace --all-targets -- -D warnings
+      - run: cargo test --workspace --locked
+        env:
+          DATABASE_URL: postgres://opencade:opencade@localhost:5432/opencade_test
+          SESSION_SECRET: release-test-secret-at-least-32-bytes
+      - run: pnpm format:check
+      - run: pnpm typecheck
+      - run: pnpm test
+      - run: pnpm build
+      - name: Audit Rust dependencies
+        run: |
+          cargo install cargo-audit --locked
+          cargo audit --deny warnings
+      - run: pnpm audit --prod --audit-level high
+
   windows:
     runs-on: windows-latest
+    needs: validate
     steps:
       - uses: actions/checkout@v4
       - uses: pnpm/action-setup@v4
@@ -26,6 +82,13 @@ jobs:
       - run: pnpm build
       - run: cargo build -p opencade-networking --bins --release --locked
       - run: cargo build --manifest-path apps/client/src-tauri/Cargo.toml --release --locked
+      - name: Configure MSVC developer environment
+        uses: ilammy/msvc-dev-cmd@v1
+        with:
+          arch: x64
+      - name: Build deterministic OpenCade test core
+        shell: pwsh
+        run: .\scripts\alpha\Build-TestCore.ps1
       - name: Require and import Windows signing certificate
         shell: pwsh
         env:
@@ -49,7 +112,8 @@ jobs:
             "apps\client\src-tauri\target\release\opencade-client.exe",
             "target\release\opencade-match-probe.exe",
             "target\release\opencade-match-verify.exe",
-            "target\release\opencade-alpha-summary.exe"
+            "target\release\opencade-alpha-summary.exe",
+            "fixtures\libretro\opencade-test-core\build\opencade_test_libretro.dll"
           )
           foreach ($executable in $executables) {
             & $signTool sign /sha1 $env:OPENCADE_CERT_THUMBPRINT /fd SHA256 /tr http://timestamp.digicert.com /td SHA256 $executable

README.md

@@ -8,7 +8,7 @@
 
 > **Open-source arcade netplay — a clean-room, community-owned alternative for low-latency rollback matchmaking and emulation.**
 
-OpenCade is a monorepo for a modern arcade netplay platform: Rust server (Axum + PostgreSQL), Tauri + React + TypeScript desktop client, and a pluggable emulator adapter SDK. The repository contains an executable **Proof of Match** control plane, deterministic mock-adapter data plane, safe local FBNeo launch, direct UDP/STUN/hole-punching, authenticated readiness-probe relay fallback, and an experimental native-process RetroArch adapter. Standalone FBNeo netplay, physical cross-NAT results, behavior classification, and real two-machine RetroArch play remain explicitly unproven.
+OpenCade is a monorepo for a modern arcade netplay platform: Rust server (Axum + PostgreSQL), Tauri + React + TypeScript desktop client, and a pluggable emulator adapter SDK. The repository contains an executable **Proof of Match** control plane, deterministic mock-adapter data plane, an original no-ROM libretro Proof-of-Play fixture, safe local FBNeo launch, direct UDP/STUN/hole-punching, authenticated readiness-probe relay fallback, and an experimental native-process RetroArch adapter. Standalone FBNeo netplay, physical cross-NAT results, behavior classification, and real two-machine RetroArch play remain explicitly unproven.
 
 ## ☕ Support OpenCade — Keep Arcade Netplay Free & Independent
 
@@ -119,6 +119,7 @@ OpenCade/
 │   ├── adr/                            # Architecture decision records
 │   ├── alpha/                          # LAN test and match-report procedures
 │   ├── IMPLEMENTATION_STATUS.md        # Verified scope and explicit non-claims
+│   ├── OPPORTUNITIES_2026-08-28.md     # 20 screened bets + one recommended keystone
 │   └── reference-fightcade-install.md  # D:/Fightcade read-only notes (never copied)
 ├── docker/
 │   └── (compose at root: `docker-compose.yml` — see also `docker/` if present)