feat: harden local runtime, entitlements, and Store delivery

.dockerignore

@@ -0,0 +1,5 @@
+**
+!services/
+!services/entitlement-authority/
+!services/entitlement-authority/server.mjs
+!services/entitlement-authority/Dockerfile

.github/workflows/axiom.yml

@@ -0,0 +1,38 @@
+name: Axiom Enforcement
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: read
+  pull-requests: read
+
+jobs:
+  axiom_validate:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Checkout downstream repository
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+
+      - name: Setup Node
+        uses: actions/setup-node@v6
+        with:
+          node-version: 24
+
+      - name: Load changed files
+        run: |
+          mkdir -p .axiom-runtime
+          if [ "${{ github.event_name }}" = "pull_request" ]; then
+            git diff --name-only "origin/${{ github.base_ref }}"...HEAD > .axiom-runtime/changed-files.txt
+          else
+            git diff --name-only "${{ github.event.before }}" "${{ github.sha }}" > .axiom-runtime/changed-files.txt
+          fi
+
+      - name: Verify signed Axiom intent and change boundary
+        run: node scripts/verify-axiom-intent.mjs --changed-files .axiom-runtime/changed-files.txt

.github/workflows/chrome-store-release.yml

@@ -0,0 +1,45 @@
+name: Chrome Web Store release candidate
+
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  package:
+    environment: chrome-web-store-production
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: pnpm/action-setup@v6
+        with:
+          version: 10.33.0
+      - uses: actions/setup-node@v7
+        with:
+          node-version: 22
+          cache: pnpm
+          cache-dependency-path: pnpm-lock.yaml
+      - uses: actions/setup-python@v7
+        with:
+          python-version: "3.12"
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+      - name: Install local billing runtime dependencies
+        run: python -m pip install --requirement requirements-billing.txt
+      - name: Verify source and runtime contracts
+        run: pnpm lint && pnpm typecheck && pnpm test && pnpm test:privacy
+      - name: Package authorized Store candidate
+        env:
+          SELECTPILOT_ENTITLEMENT_PUBLIC_KEYS_JSON: ${{ secrets.SELECTPILOT_ENTITLEMENT_PUBLIC_KEYS_JSON }}
+          SELECTPILOT_SOURCE_SHA: ${{ github.sha }}
+        run: pnpm package:store
+      - name: Upload exact-revision Store candidate
+        uses: actions/upload-artifact@v7
+        with:
+          name: selectpilot-chrome-web-store-${{ github.sha }}
+          path: |
+            dist/chrome-web-store/*.zip
+            dist/chrome-web-store/*.zip.json
+          if-no-files-found: error
+          retention-days: 30

.github/workflows/ci.yml

@@ -11,6 +11,28 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
+  python-runtime-compat:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Use Python 3.9
+        uses: actions/setup-python@v7
+        with:
+          python-version: "3.9"
+
+      - name: Install local billing runtime dependencies
+        run: python -m pip install --requirement requirements-billing.txt
+
+      - name: Smoke macOS system-Python bridge import
+        run: python server/nano_server.py --help
+
+      - name: Test server on Python 3.9
+        run: python -m unittest discover -s tests/server -p 'test_*.py'
+
   validate:
     runs-on: ubuntu-latest
     permissions:
@@ -21,34 +43,43 @@ jobs:
         node-version: [20.x, 22.x]
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
+
+      - name: Use pnpm
+        uses: pnpm/action-setup@v6
+        with:
+          version: 10.33.0
 
       - name: Use Node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version: ${{ matrix.node-version }}
           cache: pnpm
           cache-dependency-path: pnpm-lock.yaml
 
-      - name: Use pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 10.33.0
-
       - name: Use Python 3.12
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v7
         with:
           python-version: "3.12"
 
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
 
+      - name: Install local billing runtime dependencies
+        run: python -m pip install --requirement requirements-billing.txt
+
+      - name: Install Playwright Chromium
+        run: pnpm exec playwright install --with-deps chromium
+
       - name: Lint
         run: pnpm lint
 
       - name: Lint manifest
         run: pnpm lint:manifest
 
+      - name: Lint shell contracts
+        run: shellcheck scripts/*.sh
+
       - name: Sync manifest version
         run: pnpm sync:manifest-version
 
@@ -58,5 +89,66 @@ jobs:
       - name: Build
         run: pnpm build
 
+      - name: Verify committed JavaScript matches TypeScript sources
+        run: git diff --exit-code -- '*.js'
+
+      - name: Validate Chrome Web Store assets
+        run: pnpm validate:store
+
+      - name: Verify Store packaging fails closed without production identity
+        env:
+          SELECTPILOT_ENTITLEMENT_PUBLIC_KEYS_JSON: ""
+        run: |
+          if node scripts/package-chrome-store.mjs >store-package.log 2>&1; then
+            echo "Store packaging unexpectedly succeeded without an authorized public identity." >&2
+            exit 1
+          fi
+          grep -q "SELECTPILOT_ENTITLEMENT_PUBLIC_KEYS_JSON is required" store-package.log
+          test ! -d dist/chrome-web-store
+
+      - name: Smoke direct server entrypoint
+        run: python3 server/nano_server.py --help
+
       - name: Test
         run: pnpm test
+
+      - name: Verify local billing runtime
+        run: pnpm test:billing
+
+      - name: Verify privacy boundary
+        run: pnpm test:privacy
+
+      - name: Verify unpacked extension E2E
+        run: pnpm test:e2e
+
+      - name: Compile fail-closed benchmark evidence
+        run: pnpm bench:frontier
+
+      - name: Compile runtime policy
+        run: pnpm runtime:compile-policy
+
+      - name: Validate runtime policy
+        run: pnpm runtime:validate-policy
+
+      - name: Verify deterministic stress contracts
+        run: node scripts/stress-runner.mjs
+
+      - name: Verify exact-SHA code admission evidence
+        run: pnpm verify:admission
+        env:
+          SELECTPILOT_SOURCE_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
+          SELECTPILOT_WORKFLOW_SHA: ${{ github.sha }}
+          SELECTPILOT_REF: ${{ github.ref }}
+
+      - name: Upload exact-SHA code admission evidence
+        if: matrix.node-version == '22.x'
+        uses: actions/upload-artifact@v7
+        with:
+          name: selectpilot-code-admission-${{ github.sha }}
+          path: reports/code_admission_evidence.json
+          if-no-files-found: error
+          retention-days: 30
+
+      - name: Build entitlement authority image
+        if: matrix.node-version == '22.x'
+        run: docker build -f services/entitlement-authority/Dockerfile -t selectpilot-entitlement:${{ github.sha }} .

.github/workflows/codeql.yml

@@ -27,32 +27,39 @@ jobs:
         language: ["javascript-typescript", "python"]
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v3
+        uses: github/codeql-action/init@v4
         with:
           languages: ${{ matrix.language }}
 
+      - name: Use pnpm
+        if: matrix.language == 'javascript-typescript'
+        uses: pnpm/action-setup@v6
+        with:
+          version: 10.33.0
+
       - name: Use Node.js 22
         if: matrix.language == 'javascript-typescript'
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version: 22
-          cache: npm
+          cache: pnpm
+          cache-dependency-path: pnpm-lock.yaml
 
       - name: Use Python 3.12
         if: matrix.language == 'python'
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v7
         with:
           python-version: "3.12"
 
       - name: Install dependencies
         if: matrix.language == 'javascript-typescript'
-        run: npm ci
+        run: pnpm install --frozen-lockfile
 
       - name: Autobuild
-        uses: github/codeql-action/autobuild@v3
+        uses: github/codeql-action/autobuild@v4
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v3
+        uses: github/codeql-action/analyze@v4

.github/workflows/deploy-site.yml

@@ -0,0 +1,45 @@
+name: Deploy public site
+
+on:
+  workflow_dispatch:
+  push:
+    branches: [main]
+    paths: ["site/**", "scripts/build-site-config.mjs", ".github/workflows/deploy-site.yml"]
+
+permissions:
+  contents: read
+  pages: write
+  id-token: write
+
+concurrency:
+  group: pages
+  cancel-in-progress: false
+
+jobs:
+  deploy:
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
+        with:
+          node-version: 22
+      - name: Build configured public site
+        run: node scripts/build-site-config.mjs
+        env:
+          PADDLE_ENVIRONMENT: production
+          PADDLE_CLIENT_TOKEN: ${{ secrets.PADDLE_CLIENT_TOKEN }}
+          PADDLE_PRICE_ESSENTIAL: ${{ vars.PADDLE_PRICE_ESSENTIAL }}
+          PADDLE_PRICE_PLUS: ${{ vars.PADDLE_PRICE_PLUS }}
+          PADDLE_PRICE_PRO: ${{ vars.PADDLE_PRICE_PRO }}
+          ENTITLEMENT_AUTHORITY_URL: ${{ vars.ENTITLEMENT_AUTHORITY_URL }}
+          CHROME_WEB_STORE_URL: ${{ vars.CHROME_WEB_STORE_URL }}
+      - uses: actions/configure-pages@v5
+      - uses: actions/upload-pages-artifact@v4
+        with:
+          path: site-dist
+      - name: Deploy
+        id: deployment
+        uses: actions/deploy-pages@v4

.github/workflows/macos-helper.yml

@@ -0,0 +1,35 @@
+name: macOS helper
+
+on:
+  workflow_dispatch:
+  pull_request:
+    branches: [main]
+    paths: ["installer/macos/**", "server/**", "scripts/package-macos-helper.sh", "scripts/release-macos-helper.sh", ".github/workflows/macos-helper.yml"]
+
+permissions:
+  contents: read
+
+jobs:
+  package:
+    runs-on: macos-15
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
+        with:
+          node-version: 22
+      - name: Package helper release candidate
+        run: sh scripts/package-macos-helper.sh
+      - name: Inspect package
+        run: pkgutil --payload-files dist/macos-helper/SelectPilot-Installer-unsigned.pkg | sort
+      - name: Verify production release remains fail-closed without identities
+        run: |
+          if sh scripts/release-macos-helper.sh; then
+            echo "Production release unexpectedly succeeded without signing authority." >&2
+            exit 1
+          fi
+      - uses: actions/upload-artifact@v7
+        with:
+          name: selectpilot-macos-helper-unsigned-${{ github.sha }}
+          path: dist/macos-helper/SelectPilot-Installer-unsigned.pkg
+          if-no-files-found: error
+          retention-days: 14

.gitignore

@@ -1,9 +1,13 @@
 .DS_Store
 __pycache__/
+.venv/
 node_modules/
 package-lock.json
 npm-debug.log*
 test-results/
 playwright-report/
+reports/code_admission_evidence.json
+dist/
+site-dist/
 /usr/local/var/log/chromeai/
 /usr/local/var/run/chromeai/