feat(authoring): add accelerated Milestone A E2E gate

.github/workflows/authoring-milestone-a-e2e.yml

@@ -0,0 +1,149 @@
+name: Authoring Milestone A E2E
+
+on:
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: authoring-milestone-a-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  prepare:
+    name: Exact candidate package
+    runs-on: ubuntu-24.04
+    timeout-minutes: 20
+    env:
+      EXPECTED_HEAD: ${{ github.event.pull_request.head.sha || github.sha }}
+      NODE_OPTIONS: --max-old-space-size=384
+      GOTOOLCHAIN: local
+      GOMAXPROCS: '2'
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        with:
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+          persist-credentials: false
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e
+        with:
+          go-version: '1.25.13'
+          cache: false
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
+        with:
+          node-version: '22.23.2'
+          check-latest: false
+      - name: Assemble sealed exact-head native and npm candidate
+        shell: bash
+        run: |
+          set -euo pipefail
+          root="$RUNNER_TEMP/milestone-a-prepare-$GITHUB_RUN_ID-$GITHUB_RUN_ATTEMPT"
+          test ! -e "$root"
+          mkdir -m 700 "$root"
+          mkdir -m 700 "$root/evidence"
+          printf 'MILESTONE_A_BUNDLE=%s\n' "$root" >> "$GITHUB_ENV"
+          export MILESTONE_A_FAILURE="$root/evidence/workflow-failure.json"
+          trap 'status=$?; if (( status != 0 )) && [[ ! -e "$MILESTONE_A_FAILURE" ]]; then node -e '\''require("fs").writeFileSync(process.argv[1],JSON.stringify({schema:"milestone-a-e2e-workflow-failure/v1",status:Number(process.argv[2]),publication:false},null,2)+"\\n",{flag:"wx",mode:0o600})'\'' "$MILESTONE_A_FAILURE" "$status" || true; fi' EXIT
+          config="$RUNNER_TEMP/milestone-a-prepare.json"
+          modcache="$RUNNER_TEMP/milestone-a-modcache-$GITHUB_RUN_ID-$GITHUB_RUN_ATTEMPT"
+          test ! -e "$modcache"
+          mkdir -m 700 "$modcache"
+          # Go dependency acquisition precedes local exact-candidate packing.
+          # Runtime package acquisition uses only the resulting local tarballs;
+          # production security checks retain credential-free read-only access
+          # to their pinned public feed and scanner-release endpoints.
+          GOMODCACHE="$modcache" go mod download
+          node -e 'const fs=require("fs"),h=require("./npm/agentplugins/scripts/milestone-a-e2e"),tools=h.resolveTrustedTools(process.argv[3],process.argv[5]); fs.writeFileSync(process.argv[1],JSON.stringify({root:process.argv[2],precreatedRoot:true,repo:process.env.GITHUB_WORKSPACE,expectedHead:process.env.EXPECTED_HEAD,...tools,modCache:process.argv[4]}))' \
+            "$config" "$root" "$(command -v go)" "$modcache" "$(command -v npm)"
+          node npm/agentplugins/scripts/milestone-a-e2e.js prepare "$config"
+      - name: Upload exact candidate bundle and failure evidence
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
+        with:
+          name: milestone-a-exact-candidate-${{ github.run_id }}-${{ github.run_attempt }}
+          path: ${{ env.MILESTONE_A_BUNDLE }}
+          include-hidden-files: true
+          if-no-files-found: error
+          retention-days: 14
+
+  e2e:
+    name: Milestone A / ${{ matrix.platform }}-${{ matrix.arch }}
+    needs: prepare
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - {runner: ubuntu-24.04, platform: linux, arch: amd64}
+          - {runner: windows-2022, platform: windows, arch: amd64}
+          - {runner: macos-14, platform: darwin, arch: arm64}
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 12
+    env:
+      NODE_OPTIONS: --max-old-space-size=384
+      EXPECTED_HEAD: ${{ github.event.pull_request.head.sha || github.sha }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        with:
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+          persist-credentials: false
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
+        with:
+          node-version: '22.23.2'
+          check-latest: false
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
+        with:
+          name: milestone-a-exact-candidate-${{ github.run_id }}-${{ github.run_attempt }}
+          path: ${{ runner.temp }}/milestone-a-input
+      - name: Restore sealed candidate modes
+        if: runner.os != 'Windows'
+        shell: bash
+        run: chmod -R a-w "${RUNNER_TEMP}/milestone-a-input/candidate"
+      - name: Place candidate on the Darwin packageview read-only profile
+        if: runner.os == 'macOS'
+        shell: bash
+        run: |
+          set -euo pipefail
+          image="$RUNNER_TEMP/milestone-a-candidate-$GITHUB_RUN_ID-$GITHUB_RUN_ATTEMPT.dmg"
+          mount="$RUNNER_TEMP/milestone-a-candidate-$GITHUB_RUN_ID-$GITHUB_RUN_ATTEMPT"
+          test ! -e "$image"
+          test ! -e "$mount"
+          mkdir -m 700 "$mount"
+          hdiutil create -quiet -srcfolder "$RUNNER_TEMP/milestone-a-input/candidate" -fs APFS -format UDRO "$image"
+          hdiutil attach -quiet -readonly -nobrowse -mountpoint "$mount" "$image"
+          printf 'MILESTONE_A_CANDIDATE=%s\n' "$mount" >> "$GITHUB_ENV"
+      - name: Run both packaged public entrypoints in fresh roots
+        shell: bash
+        run: |
+          set -euo pipefail
+          outer="$RUNNER_TEMP/milestone-a-outer-$GITHUB_RUN_ID-$GITHUB_RUN_ATTEMPT"
+          test ! -e "$outer"
+          root="$outer/run"
+          native_root="$(node -e 'process.stdout.write(require("./npm/agentplugins/scripts/milestone-a-e2e").nativeAbsolute(process.argv[1]))' "$root")"
+          native_outer="$(node -e 'process.stdout.write(require("./npm/agentplugins/scripts/milestone-a-e2e").nativeAbsolute(process.argv[1]))' "$outer")"
+          native_input="$(node -e 'process.stdout.write(require("./npm/agentplugins/scripts/milestone-a-e2e").nativeAbsolute(process.argv[1]))' "$RUNNER_TEMP/milestone-a-input")"
+          native_candidate="$(node -e 'process.stdout.write(require("./npm/agentplugins/scripts/milestone-a-e2e").nativeAbsolute(process.argv[1]))' "${MILESTONE_A_CANDIDATE:-$RUNNER_TEMP/milestone-a-input/candidate}")"
+          npm_cli="$(node -e 'process.stdout.write(require("./npm/agentplugins/scripts/milestone-a-e2e").resolveNpmCLI())')"
+          printf 'MILESTONE_A_EVIDENCE=%s\n' "$(node -e 'process.stdout.write(require("path").join(process.argv[1],"evidence"))' "$native_root")" >> "$GITHUB_ENV"
+          node -e 'require("./npm/agentplugins/scripts/milestone-a-e2e").precreate(process.argv[1])' "$native_root"
+          config="$RUNNER_TEMP/milestone-a-run.json"
+          native_config="$(node -e 'process.stdout.write(require("./npm/agentplugins/scripts/milestone-a-e2e").nativeAbsolute(process.argv[1]))' "$config")"
+          node -e 'require("fs").writeFileSync(process.argv[1], JSON.stringify({root:process.argv[2],precreatedRoot:true,outerRoot:process.argv[3],input:process.argv[4],candidateRoot:process.argv[5],npm:process.argv[6],platform:process.argv[7],arch:process.argv[8],expectedHead:process.env.EXPECTED_HEAD}))' \
+            "$native_config" "$native_root" "$native_outer" "$native_input" "$native_candidate" "$npm_cli" '${{ matrix.platform }}' '${{ matrix.arch }}'
+          node npm/agentplugins/scripts/milestone-a-e2e.js run "$native_config"
+          test -z "$(git status --porcelain)"
+      - name: Detach Darwin packageview candidate
+        if: always() && runner.os == 'macOS'
+        shell: bash
+        run: |
+          if [[ -n "${MILESTONE_A_CANDIDATE:-}" ]]; then
+            hdiutil detach -quiet "$MILESTONE_A_CANDIDATE"
+          fi
+      - name: Upload run evidence, including failures
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
+        with:
+          name: milestone-a-${{ matrix.platform }}-${{ matrix.arch }}-${{ github.run_id }}-${{ github.run_attempt }}
+          path: ${{ env.MILESTONE_A_EVIDENCE }}
+          if-no-files-found: error
+          retention-days: 14