[SashaMIT]

Summary

• Extends the existing CI workflow (does not add a second system) so PRs and the candidate see source-gate plus source-home on every platform setup-source-home.sh supports: ubuntu-latest (linux-amd64), ubuntu-24.04-arm (linux-arm64), and macos-14 (darwin-arm64).
• This is infra on the freeze, not product authority. It does not claim a published installer, .dmg, passkey Home, Browser VZ, or “installs on all devices.” Intel Mac, Windows, and Jetson have no installer path, so there is nothing for CI to run there.
• workflow_dispatch accepts a ref input so a feat SHA can be tested without mixing this commit into feat(model-provider): offers/runs contract, openai_compat + h3_video adapters (stacked on collaboration-candidate) #17.
• scripts/installed-provider-verify.sh accepts macOS shasum when GNU sha256sum is absent (needed for the Mac source-home step).
• Source-home jobs set ELASTOS_COLLABORATION_STARTUP_MODE=isolated (required by the script; no config input on a clean runner).

What green means

source-gate + source-home provisioned on clean GitHub VMs for all three supported host tuples. Not curl | bash against the publisher, not just verify-release, not a running gateway / GUI.

Please do not mark these checks required until they have been green on the candidate several times.

Local commands the jobs run

source-gate (and the first half of source-macos):

bash scripts/check-wci-alignment.sh
node scripts/home-entropy-check.mjs
node scripts/browser-entropy-check.mjs
node scripts/home-shell-regression-smoke.mjs
node scripts/people-discovery-smoke.mjs
node --test scripts/browser-window-close-handshake.test.mjs
(cd elastos && cargo fmt --all -- --check && cargo clippy --workspace --all-targets -- -D warnings && cargo check --workspace && cargo test --workspace)

source-home-linux (ubuntu-latest and ubuntu-24.04-arm):

HOME="$SOURCE_HOME" XDG_DATA_HOME="$SOURCE_HOME/.local/share" \
  ELASTOS_COLLABORATION_STARTUP_MODE=isolated scripts/setup-source-home.sh
ELASTOS_DATA_DIR="$SOURCE_HOME/.local/share/elastos" scripts/installed-provider-verify.sh
scripts/local-carrier-setup-smoke.sh

source-macos (after the gate steps; host tools from docs/MAC.md only):

brew install e2fsprogs
HOME="$MAC_TEST_HOME" CARGO_HOME="$USER_HOME/.cargo" RUSTUP_HOME="$USER_HOME/.rustup" \
  ELASTOS_COLLABORATION_STARTUP_MODE=isolated \
  PATH="$USER_HOME/.cargo/bin:/opt/homebrew/bin:/opt/homebrew/opt/e2fsprogs/sbin:$PATH" \
  scripts/setup-source-home.sh
ELASTOS_DATA_DIR="$MAC_TEST_HOME/Library/Application Support/elastos" scripts/installed-provider-verify.sh

Does not start the gateway, mint a passkey, or run the Linux-only carrier smoke on Mac.

Test plan

• Push/PR on this branch runs source-gate, source-home-linux (amd64 + arm64), source-macos
• First reds are treated as real OS/script gates, not skipped
• workflow_dispatch with ref=feat/model-provider-rebase tests that SHA without adding a commit to feat(model-provider): offers/runs contract, openai_compat + h3_video adapters (stacked on collaboration-candidate) #17
• Required status checks stay off

[SashaMIT]

@andersalm — you asked what we had in mind for install/build signal across machines. This PR is it, and it is running.

What this is: the existing ci.yml, extended — not a second system. Three jobs:

• source-gate (ubuntu-latest): the existing fmt / WCI-alignment / entropy / product-UI proofs / clippy / check / workspace tests.
• source-home-linux (ubuntu-latest and ubuntu-24.04-arm): runs scripts/setup-source-home.sh into an isolated HOME, then scripts/installed-provider-verify.sh against the landed components.json, then the Linux carrier smoke.
• source-macos (macos-14): the same gate steps, then setup-source-home.sh into an isolated test home per docs/MAC.md, then provider verify.

What green proves: a clean machine can source-build and provision a Home on all three tuples the installer supports (linux-amd64, linux-arm64, darwin-arm64). Every PR gets this signal, and workflow_dispatch takes a ref input so any SHA can be tested without adding commits to a product PR — we ran it against feat/model-provider-rebase without touching #17.

Why it matters for your stated gates: "New providers and capsules are present in the normal installer before any installed-product claim" becomes mechanically checkable — when the extraction branches land capsules, installed-provider-verify is the step that proves the installer actually lands them. The matrix already caught its first real bug: setup-source-home.sh cross-builds the Browser VM guest helpers for linux-musl but never ensured the target on a clean machine (E0463 on all three tuples). Fixed in 3df7a3aba, following the script's own wasm32 pattern.

Honest limits: this is not the published curl | bash installer, not a running gateway / passkey / Browser VZ, not Jetson hardware (that needs a self-hosted runner), and not Windows / Intel Mac (no install path exists to test). Checks are deliberately not required; suggest keeping it that way until there is a green track record on the candidate.

Least-privilege by construction: contents: read, no secrets, no pull_request_target, 45/90-minute timeouts, cancel-in-progress, setup logs uploaded only on failure.

[SashaMIT]

Status update — the gate is doing its job. Since this PR opened it has caught four real clean-machine breaks that none of our dev machines surfaced:

1. musl cross-targets not ensured — setup-source-home.sh cross-builds the Browser VM guest helpers for *-unknown-linux-musl but only ensured the wasm target; clean runners failed with E0463. Fixed (3df7a3a).
2. Wrong target dir for self-workspace tools — four elastos/tools/* packages declare their own [workspace], so Cargo places their binaries in their own target/, not the shared one; install could not stat browser-local-exit. Fixed (37d5073).
3. Interactive Home check assumed a TTY — the Carrier-mediated install itself passed end to end (30 installed, 1 skipped, every checksum verified over Carrier, on both Linux legs); only the final interactive-banner check could not render on a headless runner. Now driven through a PTY when there is no terminal (2e27d09).
4. Undocumented coturn requirement on Apple Silicon — found by the local Mac dogfood: setup-source-home.sh hard-requires a VZ TURN program on darwin-arm64 in default mode, but MAC.md listed only node + e2fsprogs, so a fresh Mac following the guide failed at the final step. MAC.md now documents coturn and the macOS leg provisions it (9c0e03d).

Finds 1–2 are already proven green by the Linux legs in CI (setup + installed-provider verify both pass). Finds 3–4 are pushed and fresh runs are executing now — will confirm green here when they land.

Net: "installer before installed-product claim" is now an executable gate on every PR across Linux x86_64, Linux arm64, and Apple Silicon — and it is finding exactly the class of break it exists to catch.

[irzhywau]

Closing as fully absorbed: everything this PR introduced reached main through the 0.7 line (released 2026-08-31, 3585f340) and has kept evolving there.

Receipts, change by change against current main:

• CI matrix (source-gate + source-home on ubuntu-latest / ubuntu-24.04-arm / macos-14, workflow_dispatch ref input): today's .github/workflows/ci.yml is this workflow's direct descendant — since extended with staged test jobs, dependency caches, kubo seeding, release packaging, and the GitHub Release publisher.
• scripts/installed-provider-verify.sh shasum fallback: present verbatim (lines ~171–177).
• scripts/local-carrier-setup-smoke.sh "Home CLI /" banner expectation: present (line ~526).
• scripts/setup-source-home.sh [workspace] manifest guard + ensure_rust_target_installed: both present (lines ~75, ~352).
• docs/MAC.md coturn prerequisite: present (now alongside ffmpeg).

The base branch review/collaboration-candidate is itself superseded by the released 0.7 line, so there is nothing left for this PR to merge into. Thanks Sasha — this PR is the ancestor of the whole CI pipeline the release now runs on.