fix(ci): align nightly build contracts on 1.0.0-explore

.github/workflows/ci.yml

@@ -60,7 +60,7 @@ jobs:
           exit "$rc"
 
       - name: Verify release and version-generation contracts
-        run: node --test scripts/tauri-release-manifest.test.mjs scripts/linux-binaries-manifest.test.mjs scripts/version-generation.test.mjs
+        run: node --test scripts/release-channel.test.mjs scripts/tauri-release-manifest.test.mjs scripts/linux-binaries-manifest.test.mjs scripts/version-generation.test.mjs
 
       - name: Verify minisign download fallback
         run: |
@@ -82,7 +82,7 @@ jobs:
   cli-test:
     name: CLI Tests (${{ matrix.os }})
     runs-on: ${{ matrix.os }}
-    timeout-minutes: 15
+    timeout-minutes: 30
     strategy:
       fail-fast: false
       matrix:
@@ -91,6 +91,8 @@ jobs:
             cache_key: ubuntu
           - os: macos-15
             cache_key: macos
+          - os: windows-latest
+            cache_key: windows
     steps:
       - uses: actions/checkout@v5
 
@@ -126,6 +128,13 @@ jobs:
         if: runner.os == 'Linux'
         run: cargo test --locked -p bitfun-cli -p bitfun-acp -p bitfun-agent-runtime
 
+      # ConPTY is a Windows-only execution path. Keep its interactive contracts
+      # serialized: concurrent native PTYs contend on hosted runners and used to
+      # race action delivery, TUI restoration, and output observation in Nightly.
+      - name: Run Windows CLI terminal contracts
+        if: runner.os == 'Windows'
+        run: cargo test --locked -p bitfun-cli --test terminal_process_contracts -- --test-threads=1
+
       - name: Run SDK Host tests
         if: runner.os == 'Linux'
         run: cargo test --locked -p bitfun-sdk-host -p bitfun-sdk-host-app
@@ -156,6 +165,12 @@ jobs:
     steps:
       - uses: actions/checkout@v5
 
+      - name: Setup Node.js
+        uses: actions/setup-node@v5
+        with:
+          node-version-file: package.json
+          package-manager-cache: false
+
       # Tauri code generation only requires its configured resource roots to
       # exist during check/test; distributable assets remain frontend-build's owner.
       - name: Create Tauri resource directories
@@ -204,6 +219,11 @@ jobs:
           save-if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}
           cache-on-failure: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}
 
+      # Validate the committed manifests and lockfile before any release
+      # projection is allowed to rewrite workspace package entries.
+      - name: Verify committed Cargo metadata
+        run: cargo metadata --locked --no-deps
+
       # rust-cache prunes the workspace target directory before saving it, so
       # native libraries stored under target need an independent cache lifecycle.
       - name: Restore Sherpa native libraries
@@ -240,7 +260,7 @@ jobs:
       # so the workspace check above cannot catch drift in its shared Rust APIs.
       - name: Check installer compilation
         if: runner.os == 'Windows'
-        run: cargo check --manifest-path BitFun-Installer/src-tauri/Cargo.toml
+        run: cargo check --locked --manifest-path BitFun-Installer/src-tauri/Cargo.toml
 
       - name: Run core library tests
         run: cargo test --locked -p bitfun-core --lib
@@ -299,16 +319,10 @@ jobs:
         run: cargo test --locked -p bitfun-ai-adapters --features subscription-auth --lib subscription_auth
 
       # File watching is backed by a different OS API on every platform
-      # (ReadDirectoryChangesW / FSEvents / inotify), so watch registration
-      # regressions surface per-OS. The suite is behind a non-default feature
-      # and would otherwise never run anywhere.
-      #
-      # macOS is excluded: this suite already fails there before any of this
-      # branch's changes (the debounce/atomic-rename contracts time out under
-      # FSEvents coalescing), which is worth fixing separately rather than
-      # blocking unrelated work.
+      # (ReadDirectoryChangesW / FSEvents / inotify), so watch registration,
+      # debounce, and atomic-rename regressions must stay in the full OS matrix.
+      # The suite is behind a non-default feature and would otherwise never run.
       - name: Run file watch contract tests
-        if: runner.os != 'macOS'
         run: cargo test --locked -p bitfun-services-integrations --no-default-features --features file-watch --test file_watch_contracts
 
       # Search tools resolve paths and symlinks directly, which also differs
@@ -318,6 +332,21 @@ jobs:
       - name: Run search tool tests
         run: "cargo test --locked -p tool-runtime --lib search::"
 
+  # Execute the exact five-platform Nightly artifact producers with publishing
+  # disabled. This is the build contract: a required CI result cannot be green
+  # unless the same release linking, Tauri bundling, Installer, macOS CLI, and
+  # Linux CLI/Relay paths used by Nightly all succeed.
+  nightly-build-contract:
+    name: Nightly Build Contract
+    uses: ./.github/workflows/nightly-artifacts.yml
+    permissions:
+      contents: read
+    with:
+      checkout_ref: ${{ github.sha }}
+      version: 0.0.0-nightly.ci.${{ github.run_id }}
+      artifact_prefix: ci-${{ github.run_id }}
+      artifact_retention_days: 1
+
   # ── DeepSeek Harness bridge: profile packaging on Windows ──────────
   # `prepare:dsh-profile` runs from `frontend:build-all` / official desktop
   # packaging, not from desktop:dev or cargo check. Until this job existed,

.github/workflows/desktop-package.yml

@@ -277,6 +277,11 @@ jobs:
           shared-key: "package-v2-${{ matrix.platform.name }}"
           cache-bin: false
 
+      - name: Verify committed Cargo metadata
+        run: |
+          cargo metadata --locked --no-deps
+          cargo metadata --locked --no-deps --manifest-path BitFun-Installer/src-tauri/Cargo.toml
+
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
 
@@ -298,6 +303,11 @@ jobs:
         if: needs.prepare.outputs.release_channel == 'beta'
         run: node scripts/set-build-version.mjs --version "${{ needs.prepare.outputs.version }}"
 
+      - name: Verify build Cargo metadata
+        run: |
+          cargo metadata --locked --no-deps
+          cargo metadata --locked --no-deps --manifest-path BitFun-Installer/src-tauri/Cargo.toml
+
       - name: Verify release version metadata
         run: node scripts/verify-release-version-sync.mjs --version "${{ needs.prepare.outputs.version }}"
 

.github/workflows/linux-binaries.yml

@@ -15,6 +15,11 @@ on:
         description: "Stable prefix that isolates artifacts in the caller run."
         required: true
         type: string
+      artifact_retention_days:
+        description: "Retention for uploaded build artifacts."
+        required: false
+        default: 7
+        type: number
     secrets:
       release_signing_key:
         description: "Tauri/minisign private key, base64. Absent on forks: archives ship unsigned."
@@ -57,6 +62,12 @@ jobs:
         with:
           ref: ${{ inputs.checkout_ref }}
 
+      - name: Setup Node.js
+        uses: actions/setup-node@v5
+        with:
+          node-version-file: package.json
+          package-manager-cache: false
+
       - name: Install Linux system dependencies
         shell: bash
         run: |
@@ -85,6 +96,9 @@ jobs:
           shared-key: "linux-binaries-v1-${{ matrix.platform.name }}"
           cache-bin: false
 
+      - name: Verify committed Cargo metadata
+        run: cargo metadata --locked --no-deps
+
       - name: Patch build version
         shell: bash
         env:
@@ -97,12 +111,10 @@ jobs:
           # the same way, which also keeps the two asset sets on one version string.
           ASSET_VERSION="${RELEASE_VERSION%%+*}"
           echo "ASSET_VERSION=${ASSET_VERSION}" >>"$GITHUB_ENV"
-          sed -i \
-            "s/^version = \".*\" # x-release-please-version/version = \"${ASSET_VERSION}\" # x-release-please-version/" \
-            Cargo.toml
-          sed -i \
-            "s/^version = \".*\" # x-release-please-version/version = \"${ASSET_VERSION}\" # x-release-please-version/" \
-            src/apps/relay-server/Cargo.toml
+          node scripts/set-build-version.mjs --version "$ASSET_VERSION"
+
+      - name: Verify projected Cargo metadata
+        run: cargo metadata --locked --no-deps
 
       - name: Build CLI and Relay Server
         shell: bash
@@ -112,7 +124,7 @@ jobs:
           # checksum-only.
           BITFUN_RELEASE_PUBKEY: ${{ secrets.release_pubkey }}
         run: |
-          cargo build --release \
+          cargo build --locked --release \
             --target ${{ matrix.platform.target }} \
             -p bitfun-cli \
             -p bitfun-relay-server \
@@ -175,7 +187,7 @@ jobs:
         with:
           name: bitfun-linux-${{ inputs.artifact_prefix }}-${{ matrix.platform.name }}
           if-no-files-found: error
-          retention-days: 7
+          retention-days: ${{ inputs.artifact_retention_days }}
           path: |
             ${{ steps.cli-stage.outputs.archive }}
             ${{ steps.cli-stage.outputs.checksum }}