Integrate final world content, bundled activation and hosted release verification

.gitattributes

@@ -159,3 +159,6 @@ content/source-materials/objects/e4a41af2ea8dc344c0c1ce36b26cba741b7f393cb74197e
 content/source-materials/objects/e79bc66c053da9499dad75ddc543656d988ede83e9e84cc1e18624f421e9a0e1 filter=lfs diff=lfs merge=lfs -text
 content/source-materials/objects/ef5518c5a3aaa7458e074a7e41e87837f8a1c74da00938244019e2e8c0428b4a filter=lfs diff=lfs merge=lfs -text
 # END retained world original objects
+
+# Exact stable shipped catalogs; small manifests/notices remain ordinary blobs.
+content/release-packs/**/catalog.json filter=lfs diff=lfs merge=lfs -text

.github/workflows/package-windows.yml

@@ -31,7 +31,7 @@ jobs:
     name: Windows installer and addon package
     runs-on: windows-2025
     # A release-signing request waits for a manual SignPath approval.
-    timeout-minutes: ${{ github.ref_type == 'tag' && 170 || 50 }}
+    timeout-minutes: ${{ github.ref_type == 'tag' && 170 || 110 }}
     permissions:
       contents: read
       actions: read # the SignPath connector reads this job and downloads the unsigned artifact
@@ -69,12 +69,36 @@ jobs:
       - name: Release material transport tests (PowerShell 7)
         shell: pwsh
         run: ./scripts/windows/Test-ReleaseMaterials.ps1
+      - name: Schema-bound release contract tests (Windows PowerShell 5.1)
+        shell: powershell
+        run: ./scripts/windows/Test-ReleaseContractBounds.ps1
+      - name: Schema-bound release contract tests (PowerShell 7)
+        shell: pwsh
+        run: ./scripts/windows/Test-ReleaseContractBounds.ps1
       - name: Acceptance candidate transport tests (Windows PowerShell 5.1)
         shell: powershell
         run: ./scripts/windows/Test-AcceptanceCandidate.ps1
       - name: Acceptance candidate transport tests (PowerShell 7)
         shell: pwsh
         run: ./scripts/windows/Test-AcceptanceCandidate.ps1
+      - name: Stable preparation and hosted evidence tests (Windows PowerShell 5.1)
+        shell: powershell
+        run: ./scripts/windows/Test-StablePreparation.ps1
+      - name: Hosted producer helper tests (Windows PowerShell 5.1 mocks)
+        shell: powershell
+        run: ./scripts/windows/Test-StableAcceptanceHelpers.ps1
+      - name: Hosted producer helper tests (PowerShell 7 mocks)
+        shell: pwsh
+        run: ./scripts/windows/Test-StableAcceptanceHelpers.ps1
+      - name: Stable preparation and hosted evidence tests (PowerShell 7)
+        shell: pwsh
+        run: ./scripts/windows/Test-StablePreparation.ps1
+      - name: Stable source and tag gate tests (Windows PowerShell 5.1 mocks)
+        shell: powershell
+        run: ./scripts/windows/Test-StableWorkflowGate.ps1
+      - name: Stable source and tag gate tests (PowerShell 7 mocks)
+        shell: pwsh
+        run: ./scripts/windows/Test-StableWorkflowGate.ps1
       - name: Guided acceptance kit tests (Windows PowerShell 5.1)
         shell: powershell
         run: ./scripts/windows/Test-AcceptanceKit.ps1
@@ -119,13 +143,14 @@ jobs:
           package-manager-cache: false
       - name: Native smoke pure-helper tests (synthetic, not native acceptance)
         shell: bash
-        run: node --test scripts/windows/native-smoke-lib.test.mjs scripts/windows/native-command-boundaries.test.mjs scripts/windows/verify-installed-tree.test.mjs
+        run: node --test scripts/windows/stable-workload-lib.test.mjs scripts/windows/native-smoke-lib.test.mjs scripts/windows/native-command-boundaries.test.mjs scripts/windows/verify-installed-tree.test.mjs scripts/windows/package-windows-workflow.test.mjs
       - name: Install isolated Corepack
         shell: bash
         run: |
           npm install --prefix "$RUNNER_TEMP/corepack" --no-package-lock --no-audit --no-fund corepack@0.36.0
           echo "$RUNNER_TEMP/corepack/node_modules/.bin" >> "$GITHUB_PATH"
       - name: Build installer and addon package (Windows PowerShell 5.1)
+        id: build_windows
         shell: powershell
         env:
           REF_TYPE: ${{ github.ref_type }}
@@ -140,7 +165,18 @@ jobs:
           $unsigned = Get-UnsignedReleasePolicy $PWD $expected.TrimStart('v')
           if ($null -ne $unsigned -and $env:NAVZEROTH_SIGN_COMMAND) { throw 'Declared unsigned releases forbid NAVZEROTH_SIGN_COMMAND' }
           $candidate = $env:ACCEPTANCE_CANDIDATE -eq 'true'
-          ./scripts/windows/Build-Windows.ps1 -SkipTests -ExpectedVersion $expected -OutputDirectory dist/windows -AcceptanceCandidate:$candidate
+          $phaseOptions = @{}
+          $stable = -not $candidate -and $expected -ceq 'v1.0.0'
+          [IO.File]::AppendAllText($env:GITHUB_OUTPUT, ('stable=' + $stable.ToString().ToLowerInvariant() + "`n"), (New-Object Text.UTF8Encoding($false)))
+          if ($stable) {
+            New-Item -ItemType Directory -Path dist -Force | Out-Null
+            cargo run --locked -p azeroth-cli -- assemble-bundled-content --root . --output dist/bundled-content --identity release/v1/bundled-content-build-identity.json
+            if ($LASTEXITCODE -ne 0) { throw 'Source-bound signed bundle assembly failed' }
+            $phaseOptions['ReadinessPhase'] = 'prebuild'
+            $phaseOptions['BundledContentDirectory'] = 'dist/bundled-content'
+            $phaseOptions['BundleBuildIdentityPath'] = 'release/v1/bundled-content-build-identity.json'
+          }
+          ./scripts/windows/Build-Windows.ps1 -SkipTests -ExpectedVersion $expected -OutputDirectory dist/windows -AcceptanceCandidate:$candidate @phaseOptions
       # ADR 0008: only source-declared versions may publish unsigned stable assets.
       - name: Signing mode
         id: signing
@@ -215,7 +251,7 @@ jobs:
             $hash = (Get-FileHash -LiteralPath $setup[0].FullName -Algorithm SHA256).Hash.ToLowerInvariant()
             $evidence = Join-Path $env:RUNNER_TEMP 'native-smoke'
             New-Item -ItemType Directory -Path $evidence -Force | Out-Null
-            ./scripts/windows/Verify-DownloadedRelease.ps1 -Directory dist/windows -Version $version -InstallerSha256 $hash -Receipt (Join-Path $evidence 'prepared-release-verification.json')
+            ./scripts/windows/Verify-DownloadedRelease.ps1 -Directory dist/windows -Version $version -InstallerSha256 $hash -Receipt (Join-Path $evidence 'prepared-release-verification.json') -Phase prepared
             if ($LASTEXITCODE -ne 0) { throw 'Prepared release verification rehearsal failed' }
           }
       - name: Silent install, first start and uninstall
@@ -302,6 +338,8 @@ jobs:
         id: native_smoke
         continue-on-error: true
         shell: pwsh
+        env:
+          NAVZEROTH_NATIVE_STARTUP_MS: ${{ steps.build_windows.outputs.stable == 'true' && '1200000' || '30000' }}
         run: |
           . ./scripts/windows/Native-Smoke-Helpers.ps1
           $evidence = Join-Path $env:RUNNER_TEMP 'native-smoke'
@@ -328,7 +366,8 @@ jobs:
         shell: pwsh
         env:
           GH_TOKEN: ${{ github.token }}
-          BASELINE_TAG: v0.9.2
+          NAVZEROTH_NATIVE_STARTUP_MS: ${{ steps.build_windows.outputs.stable == 'true' && '1200000' || '30000' }}
+          BASELINE_TAG: ${{ github.ref_name == 'v1.0.0' && 'v1.0.0-rc.1' || 'v0.9.2' }}
         run: |
           . ./scripts/windows/Native-Smoke-Helpers.ps1
           $evidence = Join-Path $env:RUNNER_TEMP 'native-smoke'
@@ -423,6 +462,71 @@ jobs:
           echo "smoke=${{ steps.native_smoke.outcome }} upgrade=${{ steps.native_upgrade.outcome }}"
           [ "${{ steps.native_smoke.outcome }}" != failure ] && [ "${{ steps.native_upgrade.outcome }}" != failure ]
 
+      - name: Actual schema4 hosted Windows acceptance over the signed full bundle
+        id: stable_acceptance
+        if: steps.build_windows.outputs.stable == 'true'
+        continue-on-error: true
+        shell: pwsh
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          . ./scripts/windows/Native-Smoke-Helpers.ps1
+          . ./scripts/windows/Release-Materials.ps1
+          $baseline = Join-Path $env:RUNNER_TEMP 'stable-rc1'
+          New-Item -ItemType Directory -Path $baseline | Out-Null
+          $start = [Diagnostics.ProcessStartInfo]::new()
+          $start.FileName = (Get-Command gh).Source
+          $start.UseShellExecute = $false
+          foreach ($arg in @('release','download','v1.0.0-rc.1','--repo',$env:GITHUB_REPOSITORY,'--dir',$baseline,'--pattern','*-x64-setup.exe')) { $start.ArgumentList.Add($arg) }
+          $download = [Diagnostics.Process]::new(); $download.StartInfo = $start
+          try {
+            if (-not $download.Start()) { throw 'Cannot start baseline download' }
+            if (-not $download.WaitForExit(300000)) { $download.Kill($true); throw 'RC1 baseline download exceeded five minutes' }
+            if ($download.ExitCode -ne 0) { throw 'RC1 baseline download failed' }
+          } finally { $download.Dispose() }
+          $published = Read-BoundedReleaseText 'docs/releases/1.0.0-rc.1-publication.json' | ConvertFrom-Json
+          $pin = @($published.assets | Where-Object name -CEQ 'AzerothNavigator-1.0.0-rc.1-x64-setup.exe')
+          if ($pin.Count -ne 1) { throw 'Missing independently retained RC baseline hash' }
+          $setup = Get-NativeSmokeSetup dist/windows
+          $hash = (Get-FileHash $setup.FullName -Algorithm SHA256).Hash.ToLowerInvariant()
+          $baselineSetup = Get-NativeSmokeSetup $baseline
+          ./scripts/windows/Stable-Acceptance.ps1 -Root . -Directory dist/windows -InstallerSha256 $hash -BaselineInstaller $baselineSetup.FullName -BaselineSha256 $pin[0].sha256 -BuildIdentity release/v1/bundled-content-build-identity.json -OutputDirectory (Join-Path $env:RUNNER_TEMP 'native-smoke/stable-cases')
+      - name: Record schema4 hosted observations without inventing missing cases
+        id: hosted_evidence
+        if: always() && steps.build_windows.outputs.stable == 'true' && steps.stable_acceptance.outcome != 'skipped'
+        shell: pwsh
+        run: |
+          ./scripts/windows/Write-HostedAcceptanceEvidence.ps1 -Root . -Version '1.0.0' -InstallerDirectory dist/windows -ResultsDirectory (Join-Path $env:RUNNER_TEMP 'native-smoke/stable-cases') -OutputDirectory dist/acceptance-evidence
+      - name: Retain schema4 acceptance evidence separately from release assets
+        if: always() && steps.build_windows.outputs.stable == 'true'
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: stable-acceptance-evidence-${{ github.sha }}
+          path: dist/acceptance-evidence/
+          if-no-files-found: error
+          retention-days: 90
+
+      - name: Retain raw actual stable case reports on success or failure
+        if: always() && steps.build_windows.outputs.stable == 'true'
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: stable-case-reports-${{ github.sha }}
+          path: |
+            ${{ runner.temp }}/native-smoke/stable-cases/*.json
+            ${{ runner.temp }}/native-smoke/stable-cases/raw/*.json
+          if-no-files-found: warn
+          retention-days: 90
+      - name: Verify stable hosted evidence and exact materials before accepting source or tag artifacts
+        id: stable_draft_gate
+        if: always() && steps.build_windows.outputs.stable == 'true'
+        shell: pwsh
+        run: |
+          if ('${{ steps.stable_acceptance.outcome }}' -ne 'success' -or '${{ steps.hosted_evidence.outcome }}' -ne 'success') { throw 'Actual full-bundle hosted acceptance or its evidence is missing or failed' }
+          # All eight exact-installer hosted rows must pass. Only pristine pending
+          # owner smoke may remain; preparation never authorizes publication.
+          ./scripts/windows/Verify-ReleaseArtifacts.ps1 -Version '1.0.0' -Directory dist/windows -ReadinessPhase draft -Evidence dist/acceptance-evidence/acceptance-evidence.json
+          if ($LASTEXITCODE -ne 0) { throw 'Stable source/tag draft readiness or exact release materials verification failed' }
+
   draft-release:
     name: Draft GitHub release
     if: github.ref_type == 'tag'
@@ -440,18 +544,32 @@ jobs:
         with:
           name: azeroth-navigator-windows-${{ github.sha }}
           path: dist/release-artifacts
+      - name: Download schema4 hosted evidence
+        if: github.ref_name == 'v1.0.0'
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          name: stable-acceptance-evidence-${{ github.sha }}
+          path: dist/acceptance-evidence
       - name: Verify checksums
         working-directory: dist/release-artifacts
         run: sha256sum --check --strict SHA256SUMS.txt
       - name: Verify release evidence before drafting
         env:
           TAG: ${{ github.ref_name }}
-        run: cargo run --locked -p azeroth-cli -- release-readiness --root . --version "${TAG#v}"
+        run: |
+          command=release-readiness
+          if [ "$TAG" = v1.0.0 ]; then command=release-draft-readiness; fi
+          args=()
+          if [ -f dist/acceptance-evidence/acceptance-evidence.json ]; then args+=(--evidence dist/acceptance-evidence/acceptance-evidence.json); fi
+          cargo run --locked -p azeroth-cli -- "$command" --root . --version "${TAG#v}" "${args[@]}"
       - name: Verify exact release assets and offline materials against source
         shell: pwsh
         env:
           TAG: ${{ github.ref_name }}
-        run: ./scripts/windows/Verify-ReleaseArtifacts.ps1 -Version $env:TAG.Substring(1) -Directory dist/release-artifacts
+        run: |
+          $options = @{}
+          if ($env:TAG -ceq 'v1.0.0') { $options['ReadinessPhase'] = 'draft'; $options['Evidence'] = 'dist/acceptance-evidence/acceptance-evidence.json' }
+          ./scripts/windows/Verify-ReleaseArtifacts.ps1 -Version $env:TAG.Substring(1) -Directory dist/release-artifacts @options
       - name: Create the draft release (never published here)
         env:
           GH_TOKEN: ${{ github.token }}

.github/workflows/verify-release-downloads.yml

@@ -7,6 +7,11 @@ on:
         type: string
         default: 1.0.0-rc.1
         required: true
+      evidence_run_id:
+        description: Optional reviewed workflow run containing stable-acceptance-evidence-<source_commit>
+        type: string
+        default: ''
+        required: false
       phase:
         description: Release state to verify
         type: choice
@@ -22,13 +27,15 @@ on:
         required: true
 permissions:
   contents: read
+  actions: read
 jobs:
   verify:
     name: Verify downloaded unsigned release
     # GitHub hides draft releases from contents-read workflow tokens. This manual
     # verifier only reads/downloads; write scope is needed for draft visibility.
     permissions:
       contents: write
+      actions: read
     runs-on: windows-2025
     timeout-minutes: 30
     steps:
@@ -49,6 +56,14 @@ jobs:
           npm install --prefix "$RUNNER_TEMP/corepack" --no-package-lock --no-audit --no-fund corepack@0.36.0
           "$RUNNER_TEMP/corepack/node_modules/.bin/corepack" pnpm install --frozen-lockfile
           cargo fetch --locked
+      - name: Download separately reviewed acceptance evidence
+        if: inputs.evidence_run_id != ''
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          name: stable-acceptance-evidence-${{ inputs.source_commit }}
+          path: dist/acceptance-evidence
+          run-id: ${{ inputs.evidence_run_id }}
+          github-token: ${{ github.token }}
       - name: Download and verify exact release
         shell: pwsh
         env:
@@ -78,7 +93,9 @@ jobs:
           $receiptDir = Join-Path $env:RUNNER_TEMP 'download-receipt'
           New-Item -ItemType Directory -Path $receiptDir | Out-Null
           $json | Set-Content -LiteralPath (Join-Path $receiptDir 'github-release.json') -Encoding utf8
-          ./scripts/windows/Verify-DownloadedRelease.ps1 -Directory $downloads -Version $version -InstallerSha256 $env:EXPECTED_INSTALLER -Receipt (Join-Path $receiptDir 'verification.json')
+          $options = @{}
+          if (Test-Path -LiteralPath 'dist/acceptance-evidence/acceptance-evidence.json') { $options['Evidence'] = 'dist/acceptance-evidence/acceptance-evidence.json' }
+          ./scripts/windows/Verify-DownloadedRelease.ps1 -Directory $downloads -Version $version -InstallerSha256 $env:EXPECTED_INSTALLER -Receipt (Join-Path $receiptDir 'verification.json') -Phase $env:RELEASE_PHASE @options
           if ($LASTEXITCODE -ne 0) { throw 'Downloaded release verification failed' }
           [ordered]@{ schema_version = 2; version = $version; signature = $policy.signature; prerelease = $policy.prerelease; phase = $env:RELEASE_PHASE; tag = $tag; commit = $env:EXPECTED_COMMIT; run_id = $env:GITHUB_RUN_ID; repository = $env:GITHUB_REPOSITORY } | ConvertTo-Json | Set-Content -LiteralPath (Join-Path $receiptDir 'identity.json') -Encoding utf8
       - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2

apps/desktop/src-tauri/build.rs

@@ -1,3 +1,10 @@
 fn main() {
+    println!("cargo:rerun-if-env-changed=NAVZEROTH_BUNDLE_IDENTITY_JSON");
+    let identity = std::env::var("NAVZEROTH_BUNDLE_IDENTITY_JSON").unwrap_or_default();
+    assert!(
+        identity.len() <= 65536 && !identity.contains(['\r', '\n']),
+        "bundle identity must use canonical single-line JSON"
+    );
+    println!("cargo:rustc-env=NAVZEROTH_BUNDLE_IDENTITY_JSON={identity}");
     tauri_build::build()
 }

apps/desktop/src-tauri/src/lib.rs

@@ -1167,7 +1167,16 @@ pub fn run() -> i32 {
             let directory = app.path().app_data_dir()?;
             std::fs::create_dir_all(&directory)?;
             let database = directory.join("snapshots.sqlite3");
-            let service = azeroth_app::recovery::DatabaseHost::start(&database);
+            let resources = app.path().resource_dir()?.join("bundled-content");
+            let service = azeroth_app::bundled_content::start(
+                &database,
+                &resources,
+                env!("CARGO_PKG_VERSION"),
+                option_env!("NAVZEROTH_BUNDLE_IDENTITY_JSON")
+                    .filter(|raw| !raw.is_empty())
+                    .map(str::as_bytes),
+                include_bytes!("../../../../content/bundled/signers-v1.json"),
+            )?;
             app.manage(service);
             app.manage(Arc::new(azeroth_app::local_data::LocalDataService::new(
                 directory.join("local-data-v1"),

apps/desktop/src/commands/dungeonPreparation.ts

@@ -5,7 +5,7 @@ export type Observed<T> = { status: "known"; value: T } | { status: Exclude<Avai
 export interface Declared<T> { observation: Observed<T>; evidence: string[] }
 export interface ConditionAssessment { availability: Availability; evaluation: { truth: "true" | "false" | "unknown"; reasons: unknown[]; warnings: unknown[]; steps: number } | null }
 export interface LocalPreparationPackage {
-  schema_version: 1 | 2; id: string; title: string; context: DataContext; fixture: boolean; revision: string;
+  schema_version: 1 | 2 | 3; id: string; title: string; context: DataContext; fixture: boolean; revision: string;
   entrance: Declared<{ id: string; map: unknown }>; access: Declared<unknown>; quests: Declared<string[]>;
   rewards: Declared<{ item: ItemKey; source: string; declared_role: Observed<string> }[]>;
   checks: Declared<{ id: string; label: string; category: "role" | "consumables" | "equipment" | "before_departure" | "before_entry"; requirement: Declared<unknown> }[]>;