[codex] T9.3 Linux x86_64 CI evidence workflow

.github/workflows/t9-3-cross-platform-linux.yml

@@ -0,0 +1,205 @@
+name: T9.3 Cross-Platform Evidence
+
+on:
+  workflow_dispatch:
+  pull_request:
+    paths:
+      - ".github/workflows/t9-3-cross-platform-linux.yml"
+      - "fixtures/**"
+      - "package-lock.json"
+      - "package.json"
+      - "scripts/**"
+      - "src/**"
+      - "tsconfig.json"
+
+permissions:
+  contents: read
+
+jobs:
+  linux-x86-64:
+    name: Linux x86_64 release-gate evidence
+    runs-on: ubuntu-24.04
+    timeout-minutes: 20
+    env:
+      T9_3_REPORT_DIR: reports/t9.3/linux-x86_64
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Assert native platform
+        shell: bash
+        run: |
+          set -euo pipefail
+          mkdir -p "$T9_3_REPORT_DIR"
+          platform="$(uname -sm)"
+          printf '%s\n' "$platform" | tee "$T9_3_REPORT_DIR/uname.txt"
+          test "$platform" = "Linux x86_64"
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+          cache: npm
+
+      - name: Install locked dependencies
+        run: npm ci
+
+      - name: Record toolchain
+        shell: bash
+        run: |
+          set -euo pipefail
+          {
+            printf 'node: '
+            node --version
+            printf 'npm: '
+            npm --version
+            printf 'typescript: '
+            npx tsc --version
+          } | tee "$T9_3_REPORT_DIR/toolchain.txt"
+
+      - name: Build release candidate
+        shell: bash
+        run: |
+          set -euo pipefail
+          npm run build 2>&1 | tee "$T9_3_REPORT_DIR/build.log"
+
+      - name: Level B fixtures and YAML write goldens
+        shell: bash
+        run: |
+          set -euo pipefail
+          npm run test:fixtures:all 2>&1 | tee "$T9_3_REPORT_DIR/level-b-fixtures.log"
+
+      - name: JSON stdout golden byte checks
+        shell: bash
+        run: |
+          set -euo pipefail
+          npm run check:goldens 2>&1 | tee "$T9_3_REPORT_DIR/goldens.log"
+
+      - name: C1-C12 metamorphic and isolation tests
+        shell: bash
+        run: |
+          set -euo pipefail
+          npm run test:metamorphic 2>&1 | tee "$T9_3_REPORT_DIR/c1-c12.log"
+
+      - name: Native atomic write cleanup and rename-boundary probe
+        shell: bash
+        run: |
+          set -euo pipefail
+          node --test "dist/infra/config-io.test.js" 2>&1 | tee "$T9_3_REPORT_DIR/atomic-write-rename-boundary.log"
+
+      - name: Archive fixture runner artifacts
+        if: always()
+        shell: bash
+        run: |
+          set -euo pipefail
+          if test -d .tmp/fixture-runs; then
+            find .tmp/fixture-runs -type f -print0 | sort -z | xargs -0 -r sha256sum > "$T9_3_REPORT_DIR/fixture-run-artifacts.sha256"
+          else
+            printf '.tmp/fixture-runs absent\n' > "$T9_3_REPORT_DIR/fixture-run-artifacts.sha256"
+          fi
+
+      - name: Archive T9.3 Linux x86_64 report
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: t9-3-linux-x86-64-report
+          path: |
+            reports/t9.3/linux-x86_64/**
+            .tmp/fixture-runs/**
+          include-hidden-files: true
+          if-no-files-found: error
+
+  macos-arm64:
+    name: macOS arm64 release-gate evidence
+    runs-on: macos-15
+    timeout-minutes: 30
+    env:
+      T9_3_REPORT_DIR: reports/t9.3/macos-arm64
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Assert native platform
+        shell: bash
+        run: |
+          set -euo pipefail
+          mkdir -p "$T9_3_REPORT_DIR"
+          platform="$(uname -sm)"
+          printf '%s\n' "$platform" | tee "$T9_3_REPORT_DIR/uname.txt"
+          test "$platform" = "Darwin arm64"
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+          cache: npm
+
+      - name: Install locked dependencies
+        run: npm ci
+
+      - name: Record toolchain
+        shell: bash
+        run: |
+          set -euo pipefail
+          {
+            printf 'node: '
+            node --version
+            printf 'npm: '
+            npm --version
+            printf 'typescript: '
+            npx tsc --version
+          } | tee "$T9_3_REPORT_DIR/toolchain.txt"
+
+      - name: Build release candidate
+        shell: bash
+        run: |
+          set -euo pipefail
+          npm run build 2>&1 | tee "$T9_3_REPORT_DIR/build.log"
+
+      - name: Level B fixtures and YAML write goldens
+        shell: bash
+        run: |
+          set -euo pipefail
+          npm run test:fixtures:all 2>&1 | tee "$T9_3_REPORT_DIR/level-b-fixtures.log"
+
+      - name: JSON stdout golden byte checks
+        shell: bash
+        run: |
+          set -euo pipefail
+          npm run check:goldens 2>&1 | tee "$T9_3_REPORT_DIR/goldens.log"
+
+      - name: C1-C12 metamorphic and isolation tests
+        shell: bash
+        run: |
+          set -euo pipefail
+          npm run test:metamorphic 2>&1 | tee "$T9_3_REPORT_DIR/c1-c12.log"
+
+      - name: Native atomic write cleanup and rename-boundary probe
+        shell: bash
+        run: |
+          set -euo pipefail
+          node --test "dist/infra/config-io.test.js" 2>&1 | tee "$T9_3_REPORT_DIR/atomic-write-rename-boundary.log"
+
+      - name: Archive fixture runner artifacts
+        if: always()
+        shell: bash
+        run: |
+          set -euo pipefail
+          if test -d .tmp/fixture-runs; then
+            find .tmp/fixture-runs -type f -print0 | sort -z | xargs -0 shasum -a 256 > "$T9_3_REPORT_DIR/fixture-run-artifacts.sha256"
+          else
+            printf '.tmp/fixture-runs absent\n' > "$T9_3_REPORT_DIR/fixture-run-artifacts.sha256"
+          fi
+
+      - name: Archive T9.3 macOS arm64 report
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: t9-3-macos-arm64-report
+          path: |
+            reports/t9.3/macos-arm64/**
+            .tmp/fixture-runs/**
+          include-hidden-files: true
+          if-no-files-found: error

docs/tasks.md

@@ -26,8 +26,8 @@
 - This section is the live execution cursor for the local task loop.
 - Update it on any explicit task-state transition in the local task loop, including task start (`implementing`), `needs_rework`, `blocked`, and task-level done (§19.1).
 - Current active task: `None recorded`
-- Next executable product task after blocker clearance: `T9.3 — Execute supported cross-platform matrix`
-- Last completed task: `T9.2 — Implement determinism and isolation tests C7 through C12`
+- Next executable product task after blocker clearance: `T9.4 — Implement release performance benchmarks`
+- Last completed task: `T9.3 — Execute supported cross-platform matrix`
 - Completed tasks recorded here:
   - `T0.0 — Bootstrap modern Node/npm/TypeScript CLI workspace and Git repo baseline for M1 harness`
   - `T0.0a — Install pinned Biome baseline for local formatting and linting`
@@ -95,6 +95,7 @@
   - `T8.6 — Complete B-map fixture family and YAML goldens`
   - `T9.1 — Implement metamorphic tests C1 through C6`
   - `T9.2 — Implement determinism and isolation tests C7 through C12`
+  - `T9.3 — Execute supported cross-platform matrix`
 - Blocked tasks:
   - `None recorded`
 - Open deviations: