Harden Fable Mode with evidence-bound System 3 control loops

.github/workflows/release.yml

@@ -8,7 +8,33 @@ permissions:
   contents: read
 
 jobs:
+  checks:
+    name: Release documentation and test gates
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0
+        with:
+          python-version: '3.12'
+      - name: Install source test dependencies
+        run: |
+          python -m pip install --upgrade pip
+          python -m pip install setuptools==75.8.0 wheel==0.45.1
+          python -m pip install -e .
+      - name: Documentation and API drift gate
+        run: python docs/check_docs.py
+      - name: Compile source gate
+        run: python -m compileall -q fable_mode fable_engine fable_v2
+      - name: Canonical V1 suite gate
+        run: python -m unittest discover -s tests -p 'test_server*.py' -v
+      - name: Full unittest suite gate
+        run: python -m unittest discover -s tests -p 'test_*.py' -v
+      - name: Shell wrapper syntax gate
+        shell: bash
+        run: sh -n install.sh
+
   build:
+    needs: checks
     name: "artifact-${{ matrix.artifact }}"
     runs-on: "${{ matrix.os }}"
     strategy:
@@ -17,12 +43,10 @@ jobs:
         include:
           - os: ubuntu-latest
             artifact: linux-x86_64
-          # macOS 13 is retired; macos-15-intel preserves the x86_64
-          # build while using the supported Intel runner image.
+          # macOS 13 is retired; the Intel image preserves the x86_64 artifact.
           - os: macos-15-intel
             artifact: macos-x86_64
-          # macOS 14 is being retired; use the supported macOS 15 arm64
-          # image for the Apple Silicon build.
+          # macOS 15 on the standard hosted image is Apple Silicon.
           - os: macos-15
             artifact: macos-arm64
           - os: windows-latest
@@ -198,6 +222,8 @@ jobs:
     permissions:
       contents: write
     steps:
+      # Generated release notes need the tag history, not a shallow default
+      # branch checkout. Keep this before the release-creation step.
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           ref: ${{ github.ref }}
@@ -212,33 +238,29 @@ jobs:
           tag="${GITHUB_REF_NAME:?GITHUB_REF_NAME must be set}"
           mkdir -p upload
 
-          # Each build artifact must contribute exactly one expected,
-          # versioned archive.  Keep those names unchanged, then copy the
-          # same bytes to a stable alias for the /releases/latest/download
-          # links documented in README.md.
+          # build_release.py emits the bare package version. The public
+          # release keeps the tag spelling and also provides stable
+          # /releases/latest/download aliases for README links.
           for descriptor in \
-            "windows-x86_64|fable-mode-${tag}-windows-x86_64.zip|fable-mode-windows-x86_64.zip" \
-            "macos-x86_64|fable-mode-${tag}-macos-x86_64.zip|fable-mode-macos-x86_64.zip" \
-            "macos-arm64|fable-mode-${tag}-macos-arm64.zip|fable-mode-macos-arm64.zip" \
-            "linux-x86_64|fable-mode-${tag}-linux-x86_64.tar.gz|fable-mode-linux-x86_64.tar.gz"; do
-            IFS='|' read -r artifact archive alias <<< "$descriptor"
+            "windows-x86_64|fable-mode-${tag#v}-windows-x86_64.zip|fable-mode-${tag}-windows-x86_64.zip|fable-mode-windows-x86_64.zip" \
+            "macos-x86_64|fable-mode-${tag#v}-macos-x86_64.zip|fable-mode-${tag}-macos-x86_64.zip|fable-mode-macos-x86_64.zip" \
+            "macos-arm64|fable-mode-${tag#v}-macos-arm64.zip|fable-mode-${tag}-macos-arm64.zip|fable-mode-macos-arm64.zip" \
+            "linux-x86_64|fable-mode-${tag#v}-linux-x86_64.tar.gz|fable-mode-${tag}-linux-x86_64.tar.gz|fable-mode-linux-x86_64.tar.gz"; do
+            IFS='|' read -r artifact source_archive archive alias <<< "$descriptor"
             source_dir="release/fable-mode-${artifact}"
-            source_file="${source_dir}/${archive}"
+            source_file="${source_dir}/${source_archive}"
             test -d "$source_dir"
             test -f "$source_file"
-            archive_count=$(find "$source_dir" -maxdepth 1 -type f \( -name '*.zip' -o -name '*.tar.gz' \) | wc -l)
+            archive_count=$(find "$source_dir" -maxdepth 1 -type f \(-name '*.zip' -o -name '*.tar.gz' \) | wc -l)
             test "$archive_count" -eq 1
-            test "$archive" != "$alias"
             test ! -e "upload/$archive"
             test ! -e "upload/$alias"
             cp -- "$source_file" "upload/$archive"
             cp -- "$source_file" "upload/$alias"
           done
 
-          # There must be four versioned archives plus four aliases.  The
-          # generated checksum file below therefore covers every uploaded
-          # ZIP/TAR asset, including each stable alias.
-          test "$(find upload -maxdepth 1 -type f \( -name '*.zip' -o -name '*.tar.gz' \) | wc -l)" -eq 8
+          # Four versioned archives and four aliases are checksummed together.
+          test "$(find upload -maxdepth 1 -type f \(-name '*.zip' -o -name '*.tar.gz' \) | wc -l)" -eq 8
           test ! -e upload/SHA256SUMS
           (
             cd upload
@@ -252,4 +274,3 @@ jobs:
           set -eu
           test -n "${GITHUB_REF_NAME}"
           gh release create "${GITHUB_REF_NAME}" upload/* --title "Fable Mode ${GITHUB_REF_NAME}" --generate-notes
-

.github/workflows/test.yml

@@ -31,7 +31,7 @@ jobs:
           python -m compileall -q fable_mode fable_engine fable_v2
           python -c "import fable_mode, fable_v2; from fable_engine import server; print(fable_mode.__version__)"
       - name: Canonical V1 suite
-        run: python fable_engine/test_server.py
+        run: python -m unittest discover -s tests -p 'test_server*.py' -v
       - name: Canonical V2 and packaging/security suites
         run: python -m unittest discover -s tests -p 'test_*.py' -v
       - name: Validate packaging definition