feat(runtime): complete Bun-only runtime custody

.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
   "plugins": [
     {
       "name": "harness-native-plugin-prototype",
-      "description": "Prove native plugin distribution with a Bun-authored portable runtime",
+      "description": "Dependency-closed skills using a verified, plugin-managed Bun runtime",
       "author": {
         "name": "Prototype"
       },

.fallowrc.json

@@ -1,5 +1,4 @@
 {
   "$schema": "https://docs.fallow.tools/config-schema.json",
-  "entry": ["scripts/*.ts", "runtime/src/bun-proof-adapter.ts", "runtime/src/quickjs-adapter.ts"],
-  "ignoreDependencies": ["qjs:std"]
+  "entry": ["scripts/*.ts", "runtime/src/bun-proof-adapter.ts"]
 }

.github/release-please-config.json

@@ -24,9 +24,7 @@
         { "type": "json", "path": "plugin.config.json", "jsonpath": "$.version" },
         { "type": "json", "path": ".claude-plugin/marketplace.json", "jsonpath": "$.metadata.version" },
         { "type": "json", "path": "plugin/.claude-plugin/plugin.json", "jsonpath": "$.version" },
-        { "type": "json", "path": "plugin/.codex-plugin/plugin.json", "jsonpath": "$.version" },
-        { "type": "generic", "path": "plugin/hooks/codex/hooks.json" },
-        { "type": "generic", "path": "plugin/runtime/hello-world.js" }
+        { "type": "json", "path": "plugin/.codex-plugin/plugin.json", "jsonpath": "$.version" }
       ]
     }
   }

.github/workflows/plugin-ci.yml

@@ -16,8 +16,35 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
+  candidate:
+    name: Build candidate once
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6
+        with:
+          bun-version: 1.3.14
+      - name: Package the exact workflow commit
+        env:
+          SOURCE_COMMIT: ${{ github.sha }}
+        run: bun run package
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: runtime-candidate-${{ github.sha }}
+          overwrite: true
+          path: |
+            dist/*.tar.gz
+            dist/*.checksums.json
+          if-no-files-found: error
+
   compatibility:
     name: Compatibility (${{ matrix.target }})
+    needs: candidate
+    permissions:
+      actions: read
+      contents: read
     strategy:
       fail-fast: false
       matrix:
@@ -36,11 +63,31 @@ jobs:
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6
         with:
           bun-version: 1.3.14
-      - run: bun run spike:quickjs:ci
+      - name: Download the single packaged candidate
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: gh run download "$GITHUB_RUN_ID" --repo "$GITHUB_REPOSITORY" --name "runtime-candidate-${GITHUB_SHA}" --dir "$RUNNER_TEMP/platform-candidate"
+      - name: Prove packaged runtime custody on this target
+        shell: bash
+        run: |
+          set -euo pipefail
+          archive=$(find "$RUNNER_TEMP/platform-candidate" -maxdepth 1 -name '*.tar.gz' -print -quit)
+          checksums=$(find "$RUNNER_TEMP/platform-candidate" -maxdepth 1 -name '*.checksums.json' -print -quit)
+          [[ -n "$archive" && -n "$checksums" ]]
+          bun run prove:runtime-platform -- \
+            --archive "$archive" \
+            --checksums "$checksums" \
+            --target "${{ matrix.target }}" \
+            --fixture-acknowledged
 
   package:
     name: Deterministic package
-    needs: compatibility
+    needs:
+      - candidate
+      - compatibility
+    permissions:
+      actions: read
+      contents: read
     runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -49,20 +96,36 @@ jobs:
           bun-version: 1.3.14
       - name: Install pinned native marketplace CLIs
         run: bun add --global "@anthropic-ai/claude-code@2.1.222" "@openai/codex@0.146.1"
+      - name: Download the platform-proven candidate
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: gh run download "$GITHUB_RUN_ID" --repo "$GITHUB_REPOSITORY" --name "runtime-candidate-${GITHUB_SHA}" --dir "$RUNNER_TEMP/platform-candidate"
       - run: bun run generate:check
       - run: bun test
-      - run: bun run prove:harness-install -- --require-native
+      - run: bun run prove:harness-install -- --require-native --fixture-acknowledged
       - run: bun run release:validate
       - run: bun run prove:distribution
       - run: bun run prove:dx
-      - name: Prove generated runtime was merged with its source
-        run: git diff --exit-code -- plugin/runtime/hello-world.js
+      - name: Compare the rebuilt package with the platform-proven candidate
+        shell: bash
+        run: |
+          set -euo pipefail
+          candidate_archive=$(find "$RUNNER_TEMP/platform-candidate" -maxdepth 1 -name '*.tar.gz' -print -quit)
+          candidate_checksums=$(find "$RUNNER_TEMP/platform-candidate" -maxdepth 1 -name '*.checksums.json' -print -quit)
+          rebuilt_archive=$(find dist -maxdepth 1 -name '*.tar.gz' -print -quit)
+          rebuilt_checksums=$(find dist -maxdepth 1 -name '*.checksums.json' -print -quit)
+          [[ -n "$candidate_archive" && -n "$candidate_checksums" && -n "$rebuilt_archive" && -n "$rebuilt_checksums" ]]
+          cmp --silent "$candidate_archive" "$rebuilt_archive"
+          cmp --silent "$candidate_checksums" "$rebuilt_checksums"
+      - name: Prove generated payload was merged with its sources
+        run: git diff --exit-code -- plugin/
       - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: agent-plugin-${{ github.sha }}
+          overwrite: true
           path: |
-            dist/*.tar.gz
-            dist/*.checksums.json
+            ${{ runner.temp }}/platform-candidate/*.tar.gz
+            ${{ runner.temp }}/platform-candidate/*.checksums.json
           if-no-files-found: error
 
   attest:
@@ -71,6 +134,7 @@ jobs:
     needs: package
     runs-on: ubuntu-24.04
     permissions:
+      actions: read
       contents: read
       id-token: write
       attestations: write

.github/workflows/release.yml

@@ -325,10 +325,44 @@ jobs:
           manifest-file: .github/.release-please-manifest.json
           release-as: ${{ steps.bootstrap-version.outputs.release_as }}
 
+  candidate:
+    name: Build release candidate once
+    if: needs.resolve.outputs.mode == 'publish' || needs.resolve.outputs.mode == 'repair'
+    needs: resolve
+    permissions:
+      actions: read
+      contents: read
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ needs.resolve.outputs.candidate_sha }}
+          persist-credentials: false
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6
+        with:
+          bun-version: 1.3.14
+      - name: Package the resolved release candidate
+        env:
+          SOURCE_COMMIT: ${{ needs.resolve.outputs.candidate_sha }}
+        run: bun run package
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: release-platform-candidate-${{ github.run_id }}
+          overwrite: true
+          path: |
+            dist/*.tar.gz
+            dist/*.checksums.json
+          if-no-files-found: error
+
   compatibility:
     name: Release compatibility (${{ matrix.target }})
     if: needs.resolve.outputs.mode == 'publish' || needs.resolve.outputs.mode == 'repair'
-    needs: resolve
+    needs:
+      - resolve
+      - candidate
+    permissions:
+      actions: read
+      contents: read
     strategy:
       fail-fast: false
       matrix:
@@ -349,14 +383,34 @@ jobs:
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6
         with:
           bun-version: 1.3.14
-      - run: bun run spike:quickjs:ci
+      - name: Download the single packaged candidate
+        env:
+          GH_TOKEN: ${{ github.token }}
+          ARTIFACT_NAME: release-platform-candidate-${{ github.run_id }}
+        run: gh run download "$GITHUB_RUN_ID" --repo "$GITHUB_REPOSITORY" --name "$ARTIFACT_NAME" --dir "$RUNNER_TEMP/platform-candidate"
+      - name: Prove packaged runtime custody on this target
+        shell: bash
+        run: |
+          set -euo pipefail
+          archive=$(find "$RUNNER_TEMP/platform-candidate" -maxdepth 1 -name '*.tar.gz' -print -quit)
+          checksums=$(find "$RUNNER_TEMP/platform-candidate" -maxdepth 1 -name '*.checksums.json' -print -quit)
+          [[ -n "$archive" && -n "$checksums" ]]
+          bun run prove:runtime-platform -- \
+            --archive "$archive" \
+            --checksums "$checksums" \
+            --target "${{ matrix.target }}" \
+            --fixture-acknowledged
 
   package:
     name: Prove release candidate
     if: needs.resolve.outputs.mode == 'publish' || needs.resolve.outputs.mode == 'repair'
     needs:
       - resolve
+      - candidate
       - compatibility
+    permissions:
+      actions: read
+      contents: read
     runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -367,22 +421,37 @@ jobs:
           bun-version: 1.3.14
       - name: Install pinned native marketplace CLIs
         run: bun add --global "@anthropic-ai/claude-code@2.1.222" "@openai/codex@0.146.1"
+      - name: Download the platform-proven release candidate
+        env:
+          GH_TOKEN: ${{ github.token }}
+          ARTIFACT_NAME: release-platform-candidate-${{ github.run_id }}
+        run: gh run download "$GITHUB_RUN_ID" --repo "$GITHUB_REPOSITORY" --name "$ARTIFACT_NAME" --dir "$RUNNER_TEMP/platform-candidate"
       - name: Validate and prove release payload
         env:
           SOURCE_COMMIT: ${{ needs.resolve.outputs.candidate_sha }}
         run: |
           bun run prove:all
-          bun run prove:distribution
+      - name: Compare the rebuilt package with the platform-proven candidate
+        shell: bash
+        run: |
+          set -euo pipefail
+          candidate_archive=$(find "$RUNNER_TEMP/platform-candidate" -maxdepth 1 -name '*.tar.gz' -print -quit)
+          candidate_checksums=$(find "$RUNNER_TEMP/platform-candidate" -maxdepth 1 -name '*.checksums.json' -print -quit)
+          rebuilt_archive=$(find dist -maxdepth 1 -name '*.tar.gz' -print -quit)
+          rebuilt_checksums=$(find dist -maxdepth 1 -name '*.checksums.json' -print -quit)
+          [[ -n "$candidate_archive" && -n "$candidate_checksums" && -n "$rebuilt_archive" && -n "$rebuilt_checksums" ]]
+          cmp --silent "$candidate_archive" "$rebuilt_archive"
+          cmp --silent "$candidate_checksums" "$rebuilt_checksums"
       - name: Reject generated release-surface drift
-        run: git diff --exit-code -- plugin/runtime/hello-world.js plugin/hooks/codex/hooks.json
+        run: git diff --exit-code -- plugin/
       - name: Bind checksum metadata to candidate
         env:
           CANDIDATE_SHA: ${{ needs.resolve.outputs.candidate_sha }}
           RELEASE_TAG: ${{ needs.resolve.outputs.release_tag }}
           VERSION: ${{ needs.resolve.outputs.version }}
         run: |
           set -euo pipefail
-          checksums=$(find dist -maxdepth 1 -name '*.checksums.json' -print -quit)
+          checksums=$(find "$RUNNER_TEMP/platform-candidate" -maxdepth 1 -name '*.checksums.json' -print -quit)
           [[ -n "$checksums" ]]
           checksums_repository=$(jq -er .repository "$checksums")
           checksums_repository_identity=$(bun -e 'import { canonicalGitHubRepositoryIdentity } from "./scripts/release-validate.ts"; process.stdout.write(canonicalGitHubRepositoryIdentity(process.argv.at(-1) ?? ""))' "$checksums_repository")
@@ -402,8 +471,8 @@ jobs:
           name: release-candidate-${{ github.run_id }}
           overwrite: true
           path: |
-            dist/*.tar.gz
-            dist/*.checksums.json
+            ${{ runner.temp }}/platform-candidate/*.tar.gz
+            ${{ runner.temp }}/platform-candidate/*.checksums.json
           if-no-files-found: error
 
   release: