Hmbown · Oct 16, 2026 · Oct 13, 2026 · Oct 13, 2026 · Oct 13, 2026 · Oct 13, 2026
@@ -795,9 +795,9 @@ jobs:
     # (fork PRs #6431, #6417), too close to the old 90-minute limit.
     # On 2026-10-04 a PR leg spent 111 minutes compiling with no cache and
     # was cancelled at 120 with 12,356 tests passed and none failed. The
-    # limit stays a literal (release-workflows.test.js, #5496); 165 bounds
-    # hangs for every leg until the CI speed redesign lands.
-    timeout-minutes: 165
+    # limit stays a literal (release-workflows.test.js, #5496); 210 bounds
+    # cold compilation and the complete suite without disabling test deadlines.
+    timeout-minutes: 210
     # macOS legs go to the self-hosted Mac ONLY when all three hold: the
     # change is heavy, the event is trusted (not a fork PR), and the
     # CW_SELF_HOSTED_MAC repo variable is 'true'. That variable is the kill
@@ -870,12 +870,12 @@ jobs:
       - name: Install macOS LLVM tools
         if: needs.changes.outputs.heavy == 'true' && matrix.os == 'macos-latest'
         run: rustup component add llvm-tools --toolchain stable
-      - name: Omit macOS test debug metadata
+      - name: Omit macOS build debug metadata
         if: needs.changes.outputs.heavy == 'true' && matrix.os == 'macos-latest'
         shell: bash
         # Match the existing full-workspace CNB gate. Keep debug assertions and
-        # every test; only disposable test debug tables change on this lane.
-        run: echo "CARGO_PROFILE_TEST_DEBUG=0" >> "$GITHUB_ENV"
+        # every test; only disposable build debug tables change on this lane.
+        run: printf '%s\n' 'CARGO_PROFILE_DEV_DEBUG=0' 'CARGO_PROFILE_TEST_DEBUG=0' >> "$GITHUB_ENV"
       - uses: mozilla-actions/sccache-action@v0.0.11
         id: sccache
         continue-on-error: true
@@ -1259,7 +1259,7 @@ jobs:
     if: needs.changes.outputs.heavy == 'true' && github.event_name != 'pull_request' && ((github.event_name == 'workflow_dispatch' && inputs.workspace_test_mode == 'shared-process-twice') || !(needs.changes.outputs.trusted == 'true' && vars.CW_SELF_HOSTED_MAC == 'true'))
     # Cold hosted builds consumed 73 minutes before eval could start (F run
     # 37497498829). Match Test's compile allowance; RSS/eval limits stay intact.
-    timeout-minutes: 165
+    timeout-minutes: 210
     runs-on: macos-latest
     steps:
       - uses: actions/checkout@v7

@@ -27,7 +27,7 @@ jobs:
   build:
     name: Build ${{ matrix.platform }}
     # Native builds use the same finite cold-build allowance as release/CI.
-    timeout-minutes: 165
+    timeout-minutes: 210
     strategy:
       fail-fast: false
       matrix:

@@ -86,7 +86,7 @@ jobs:
     name: Build ${{ matrix.platform }}
     # Both cold macOS artifact builds on 0.10.1 exhausted 90 minutes inside
     # compilation. Keep the full CI build budget; packaging stays capped below.
-    timeout-minutes: 165
+    timeout-minutes: 210
     # FreeBSD is a source-build target validated via `cargo check --target x86_64-unknown-freebsd -p codewhale-cli --locked`
     # (see packaging/freebsd/README.md and docs/INSTALL.md#freebsd). The 7×1 prebuilt matrix stays 7 targets;
     # FreeBSD has no prebuilt asset, no npm binary, and no matrix bloat — it builds from source.
@@ -326,6 +326,27 @@ jobs:
           extension=""
           if [[ "${TARGET_PLATFORM}" == windows-* ]]; then extension=.exe; fi
           node scripts/release/stage-compiled-host.mjs --bun "${bun_binary}" --compiled-image "${proof_dir}/codewhale-extension-host${extension}" --native-receipt "${proof_dir}/native-receipt.json" --runtime-closure "${RUNTIME_CLOSURE_DIR}/${TARGET_PLATFORM}.json" --target "${TARGET_PLATFORM}" --version "${RELEASE_VERSION}" --source-sha "${GITHUB_SHA}" --output-dir "compiled-host-${TARGET_PLATFORM}"
+      - name: Check every staged Windows executable import
+        if: startsWith(matrix.platform, 'windows-')
+        shell: pwsh
+        run: |
+          $ErrorActionPreference = 'Stop'
+          $binaries = @('${{ matrix.cli_artifact }}', '${{ matrix.shim_artifact }}', '${{ matrix.compat_tui_artifact }}')
+          $hostDirectory = 'compiled-host-${{ matrix.platform }}'
+          if (Test-Path $hostDirectory) {
+            $binaries += @(Get-ChildItem -Path $hostDirectory -Filter *.exe -Recurse -File | ForEach-Object { $_.FullName })
+          }
+          python scripts/release/check-windows-imports.py --expected-machine '${{ matrix.platform }}' --output '${{ runner.temp }}/windows-imports-${{ matrix.platform }}' @binaries
+          if ($LASTEXITCODE -ne 0) { throw 'Windows static import qualification failed' }
+      - name: Retain Windows import receipts
+        if: always() && startsWith(matrix.platform, 'windows-')
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
+        with:
+          name: windows-imports-${{ matrix.platform }}-${{ github.sha }}
+          path: ${{ runner.temp }}/windows-imports-${{ matrix.platform }}/
+          if-no-files-found: warn
+          retention-days: ${{ inputs.retention_days }}
+          overwrite: true
       - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         if: inputs.compiled_host_delivery && contains(format(',{0},', inputs.compiled_host_targets), format(',{0},', matrix.platform))
         with:
@@ -453,6 +474,33 @@ jobs:
           if (!(Test-Path "scripts\installer\CodeWhaleSetup.exe")) {
             throw "CodeWhaleSetup.exe was not produced"
           }
+      - name: Check Windows installer and embedded executables
+        shell: pwsh
+        run: |
+          $ErrorActionPreference = 'Stop'
+          $evidenceDirectory = '${{ runner.temp }}/windows-installer-imports'
+          $embeddedDirectory = Join-Path $evidenceDirectory 'embedded'
+          New-Item -Path $evidenceDirectory -ItemType Directory -Force | Out-Null
+          & 7z l 'scripts/installer/CodeWhaleSetup.exe' | Out-File (Join-Path $evidenceDirectory 'archive-listing.txt') -Encoding utf8
+          if ($LASTEXITCODE -ne 0) { throw 'NSIS embedded payload inventory failed' }
+          & 7z x 'scripts/installer/CodeWhaleSetup.exe' "-o$embeddedDirectory" '$PLUGINSDIR/*.dll' | Out-File (Join-Path $evidenceDirectory 'archive-extraction.txt') -Encoding utf8
+          if ($LASTEXITCODE -ne 0) { throw 'NSIS embedded plugin extraction failed' }
+          $plugins = @(Get-ChildItem -Path $embeddedDirectory -Filter *.dll -Recurse -File)
+          if ($plugins.Name -notcontains 'System.dll' -or $plugins.Name -notcontains 'nsDialogs.dll') { throw 'Expected MUI2 System and nsDialogs plugin payloads' }
+          $binaries = @(Get-ChildItem -Path scripts/installer -Filter *.exe -File | ForEach-Object { $_.FullName })
+          if ($binaries.Count -lt 3) { throw 'Expected installer, CLI and shim executables' }
+          $binaries += @($plugins | ForEach-Object { $_.FullName })
+          python scripts/release/check-windows-imports.py --output $evidenceDirectory @binaries
+          if ($LASTEXITCODE -ne 0) { throw 'Windows installer static import qualification failed' }
+      - name: Retain Windows installer import receipts
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
+        with:
+          name: windows-installer-imports-${{ github.sha }}
+          path: ${{ runner.temp }}/windows-installer-imports/
+          if-no-files-found: warn
+          retention-days: ${{ inputs.retention_days }}
+          overwrite: true
       - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: CodeWhaleSetup.exe

@@ -23,7 +23,7 @@ jobs:
     name: Workspace parity
     # Cold check, Clippy, executable and test builds exceeded the old 45m
     # limit before the suite started. Retain the full CI test-job budget.
-    timeout-minutes: 165
+    timeout-minutes: 210
     runs-on: ubuntu-latest
     steps:
       # Every caller's resolve job already proved GITHUB_SHA equals the

@@ -88,12 +88,15 @@ base prompt". Two more corollaries earned here:
 - **Write down what a design does not do**, beside the behaviour it owns — a
   short known-limitations note in the owning module. A stated limit stops the
   next reader from assuming a capability that was never built.
-- **Agents do not comment on issues or PRs** (founder, 2026-09-22). Spend the
-  time on code: evidence goes in the commit message and PR body, claims go in
-  Linear. Do not reply to review bots or post status, "superseded", or
-  "for the record" notes. The one exception is closing or superseding a human
-  contributor's PR or issue: one sentence saying why, with the link. The PR and
-  issue review workflows are disabled; re-enable one only by founder decision.
+- **Substantive contributor replies are authorized for the 0.10.2 release**
+  (founder, 2026-10-13). Thank people specifically for their reports, diagnosis,
+  fixes and testing; link the carrying commit or PR and distinguish candidate
+  work from a shipped release. Status, answers and useful questions are welcome;
+  repetitive progress posts and bot noise are not. Evidence stays in commits
+  and PR bodies; ownership stays in Linear. Outside this release, the previous
+  no-comment rule remains, except a one-sentence reason when closing or
+  superseding a human contribution. Review workflows remain disabled unless
+  the founder separately authorizes enabling them.
 - **A user feature lands with its registry row.** A new command, `[features]`
   flag, provider or user-visible feature adds or updates its row in
   `docs/features.toml` in the same change;