Qualify exact release artifacts with supervised real smoke checks

.github/workflows/check.yml

@@ -30,10 +30,6 @@ jobs:
           --health-interval 5s
           --health-timeout 5s
           --health-retries 10
-    env:
-      CARGO_HOME: /home/runner/.oac/cache/executor-cargo
-      CARGO_TARGET_DIR: /home/runner/.oac/cache/executor-target
-      CARGO_BUILD_JOBS: 4
     steps:
       - uses: actions/checkout@v7
       - uses: actions/setup-go@v7
@@ -47,13 +43,6 @@ jobs:
           npm install --global pnpm@10.30.3
           sudo apt-get update
           sudo apt-get install -y build-essential pkg-config libssl-dev
-          rustup toolchain install 1.95.0 --profile minimal --component rustfmt --component clippy
-      - uses: actions/cache@v6
-        with:
-          path: |
-            ~/.oac/cache/executor-cargo
-            ~/.oac/cache/executor-target
-          key: core-executor-${{ runner.os }}-${{ hashFiles('packages/codex-executor/Cargo.lock') }}
       - name: Install Web acceptance browser
         run: |
           pnpm install --frozen-lockfile

.github/workflows/native-daemon.yml

@@ -0,0 +1,79 @@
+name: native-daemon
+
+on:
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  native:
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-22.04, macos-14, windows-2022]
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 30
+    defaults:
+      run:
+        shell: bash
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-go@v7
+        with:
+          go-version-file: go.mod
+      - name: Build the native daemon
+        run: go build -o "$RUNNER_TEMP/oac-daemon${{ runner.os == 'Windows' && '.exe' || '' }}" ./apps/parsar-daemon/cmd/parsar-daemon
+      - name: Native filesystem, authentication and process lifecycle
+        run: >-
+          go test -race -count=1
+          ./internal/runtimefs
+          ./apps/parsar-daemon/internal/auth
+          ./apps/parsar-daemon/internal/paths
+          ./apps/parsar-daemon/internal/daemonize
+          ./apps/parsar-daemon/internal/agent/clirunner
+      - name: Native Harness ownership and environment identity
+        run: >-
+          go test -race -count=1
+          ./apps/parsar-daemon/internal/agent/codex
+          ./apps/parsar-daemon/internal/agent/claudesdk
+          ./apps/parsar-daemon/internal/agent/mcode
+          -run 'TestJSONRPCClientOwnsToolDescendants|TestSelfHostedToolEnvironment'
+      - name: Native capability snapshots, files and installation
+        run: >-
+          go test -race -count=1
+          ./apps/parsar-daemon/internal/localworkspace
+          ./apps/parsar-daemon/internal/cli
+          -run 'TestNative|TestRuntimeInit|TestRuntimePreparationRejects|TestPreparationFreezesLocalContentsAcrossReconnect|TestSnapshotMarker'
+      - uses: actions/setup-node@v6
+        with:
+          node-version: '22'
+      - name: Windows npm and npx stdio launchers without network
+        if: runner.os == 'Windows'
+        run: >-
+          go test -race -count=1 -timeout=2m
+          ./apps/parsar-daemon/internal/localworkspace
+          ./apps/parsar-daemon/internal/cli
+          -run 'TestWindowsPackageManager|TestWindowsRuntimeMCP'
+      - name: Install pinned native Harness dependencies
+        run: |
+          npm install --global pnpm@10.30.3
+          pnpm install --frozen-lockfile --filter @parsar/claude-sdk-adapter...
+          pnpm --filter @parsar/claude-sdk-adapter build
+          npm install --prefix "$RUNNER_TEMP/native-tools" --no-save @openai/codex@0.153.4
+          mkdir -p "$RUNNER_TEMP/claude-runtime"
+          cp packages/claude-sdk-adapter/package.json "$RUNNER_TEMP/claude-runtime/"
+          cp -R packages/claude-sdk-adapter/dist "$RUNNER_TEMP/claude-runtime/"
+          npm install --prefix "$RUNNER_TEMP/claude-runtime" --omit=dev --ignore-scripts --package-lock=false
+      - name: Verify native Harness startup without model requests
+        run: |
+          if [[ "$RUNNER_OS" == Windows ]]; then
+            export CLAUDE_CODE_GIT_BASH_PATH='C:\Program Files\Git\bin\bash.exe'
+          fi
+          node scripts/native-harness-smoke.mjs --codex-package "$RUNNER_TEMP/native-tools/node_modules/@openai/codex" --claude-runtime "$RUNNER_TEMP/claude-runtime"
+      - uses: actions/upload-artifact@v6
+        with:
+          name: oac-daemon-${{ runner.os }}-${{ runner.arch }}
+          path: ${{ runner.temp }}/oac-daemon*
+          if-no-files-found: error

.github/workflows/native-installer.yml

@@ -0,0 +1,81 @@
+name: native-installer
+
+on:
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  bundle:
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-22.04, macos-14, windows-2022]
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 30
+    defaults:
+      run:
+        shell: bash
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-go@v7
+        with:
+          go-version-file: go.mod
+      - uses: actions/setup-node@v6
+        with:
+          node-version: '22.22.0'
+      - name: Build the native daemon and test bundle boundaries
+        run: |
+          go build -ldflags "-X github.com/MiniMax-AI-Dev/parsar/apps/parsar-daemon/internal/cli.Version=$GITHUB_SHA" -o "$RUNNER_TEMP/oac-daemon${{ runner.os == 'Windows' && '.exe' || '' }}" ./apps/parsar-daemon/cmd/parsar-daemon
+          node --test scripts/build-native-installer.test.mjs
+      - name: Build pinned native components
+        run: |
+          npm install --global pnpm@10.30.3
+          pnpm install --frozen-lockfile --filter @parsar/claude-sdk-adapter...
+          pnpm --filter @parsar/claude-sdk-adapter build --outDir "$RUNNER_TEMP/claude-compiled"
+          pnpm --config.inject-workspace-packages=true --config.extend-node-path=false --filter @parsar/claude-sdk-adapter deploy --prod "$RUNNER_TEMP/claude-runtime"
+          rm -rf "$RUNNER_TEMP/claude-runtime/dist"
+          mv "$RUNNER_TEMP/claude-compiled" "$RUNNER_TEMP/claude-runtime/dist"
+          # Reify the dedicated frozen export lock without pnpm's symlink layout.
+          # Flattening isolated package links changes Node dependency resolution.
+          rm -rf "$RUNNER_TEMP/claude-runtime/node_modules"
+          pnpm --dir "$RUNNER_TEMP/claude-runtime" install --prod --frozen-lockfile --config.node-linker=hoisted --ignore-scripts
+          npm install --prefix "$RUNNER_TEMP/native-tools" --no-save @openai/codex@0.153.4
+      - name: Build the pinned MiniMax companion on Unix
+        if: runner.os != 'Windows'
+        run: |
+          source_repository="$(node -p 'require("./packages/mcode-harness/source.json").repository')"
+          source_revision="$(node -p 'require("./packages/mcode-harness/source.json").revision')"
+          source_version="$(node -p 'require("./packages/mcode-harness/source.json").version')"
+          git init --quiet "$RUNNER_TEMP/mcode-source"
+          git -C "$RUNNER_TEMP/mcode-source" remote add origin "$source_repository"
+          git -C "$RUNNER_TEMP/mcode-source" fetch --depth 1 origin "$source_revision"
+          git -C "$RUNNER_TEMP/mcode-source" checkout --detach FETCH_HEAD
+          npm install --prefix "$RUNNER_TEMP/mcode-native" --no-audit --no-fund --include=optional --install-strategy=nested "@minimax-ai/code@$source_version"
+          MCODE_NATIVE_SOURCE="$RUNNER_TEMP/mcode-source" \
+          MCODE_CLI_DIR="$RUNNER_TEMP/mcode-native/node_modules/@minimax-ai/code" \
+          MCODE_HARNESS_BUILD_DIR="$RUNNER_TEMP/minimax-runtime" \
+            bash scripts/build-mcode-harness.sh
+      - name: Package and exercise CLI-only installation, additions and reuse
+        run: |
+          if [[ "$RUNNER_OS" == Windows ]]; then
+            export CLAUDE_CODE_GIT_BASH_PATH='C:\Program Files\Git\bin\bash.exe'
+          fi
+          node scripts/build-native-installer-ci.mjs
+      - name: Verify native Harness protocols without model requests
+        run: |
+          if [[ "$RUNNER_OS" == Windows ]]; then
+            export CLAUDE_CODE_GIT_BASH_PATH='C:\Program Files\Git\bin\bash.exe'
+          fi
+          node scripts/native-harness-smoke.mjs --codex-binary "$RUNNER_TEMP/native-installer/components/codex/bin/codex${{ runner.os == 'Windows' && '.exe' || '' }}" --claude-runtime "$RUNNER_TEMP/native-installer/components/claude"
+      - name: Archive the native distribution
+        run: |
+          cd "$RUNNER_TEMP"
+          tar -C native-installer -czf "oac-native-installer-${{ runner.os }}-${{ runner.arch }}.tar.gz" .
+      - uses: actions/upload-artifact@v6
+        with:
+          name: oac-native-installer-${{ runner.os }}-${{ runner.arch }}
+          path: ${{ runner.temp }}/oac-native-installer-*.tar.gz
+          if-no-files-found: error

.github/workflows/release.yml

@@ -11,7 +11,7 @@ on:
         type: string
       offline:
         description: Also create the full offline archive
-        default: false
+        default: true
         type: boolean
       draft_release:
         description: Upload files to a new draft release; never publish
@@ -70,15 +70,12 @@ jobs:
           npm install --global pnpm@10.30.3
           sudo apt-get update
           sudo apt-get install -y build-essential pkg-config libssl-dev
-          rustup toolchain install 1.95.0 --profile minimal
       - uses: actions/cache@v6
         with:
           path: |
             ~/.oac/cache/go-build
             ~/.oac/cache/go-mod
-            ~/.oac/cache/executor-cargo
-            ~/.oac/cache/executor-target
-          key: core-release-${{ runner.os }}-${{ hashFiles('go.sum', 'packages/codex-executor/Cargo.lock') }}
+          key: core-release-${{ runner.os }}-${{ hashFiles('go.sum') }}
       - name: Check release metadata and prepare pinned harnesses
         run: |
           PYTHONDONTWRITEBYTECODE=1 python3 scripts/core-distribution-manifest.test.py
@@ -88,7 +85,7 @@ jobs:
           RELEASE_REVISION: ${{ steps.source.outputs.revision }}
           RELEASE_TAG: ${{ steps.source.outputs.release_tag }}
           RELEASE_REPOSITORY: ${{ github.repository }}
-          CORE_DISTRIBUTION_OFFLINE: ${{ inputs.offline && '1' || '0' }}
+          CORE_DISTRIBUTION_OFFLINE: ${{ (github.event_name == 'push' || inputs.offline) && '1' || '0' }}
         run: |
           inputs="$HOME/.oac/build/release-inputs/inputs.json"
           AGENTS_RUNTIME_CODEX_PACKAGE="$(python3 -c 'import json,sys; print(json.load(open(sys.argv[1]))["codex"])' "$inputs")"

AGENTS.md

@@ -1,55 +1,14 @@
 # OpenAgentCore development
 
-OpenAgentCore is the independent execution service behind Parsar. Product business
-code, its database and migrations stay in the Parsar repository. Read
-[CONTRIBUTING.md](CONTRIBUTING.md) before changing code.
+Read [CONTRIBUTING.md](CONTRIBUTING.md) before changing code. It owns repository
+boundaries, architecture, workflow, required checks and independent blind review.
+Use [docs/development.md](docs/development.md) for checkout and component guidance.
 
-## Interfaces and credentials
-
-Core serves three namespaces. Each has one kind of caller and its own credential;
-no credential works in another namespace.
-
-| Namespace | Caller | Credential | Contents |
-| --- | --- | --- | --- |
-| `/v1` | Applications | Project API key | Exactly the pinned OpenAI Agents API route set ([upstream.json](contracts/agents-api/upstream.json): SDK 3.13.0, `agents=v1`). Fields the official types lack live only in `x_agents_core` on Agents and Sessions (`harness`, `model_provider`). Nothing about deployment belongs here. |
-| `/core/v1` | Core Web's server and operator scripts | Core key; Core stores its digest | Everything about operating the deployment: Projects and keys, resource reads and deletion, Session archive, credential issuance (node enrollment tokens, executor credentials), observability, audit, sandbox deployment and nodes. |
-| `/api/v1` | Nodes, Runtime daemons, self-hosted executors | Machine credentials: enrollment tokens and executor credentials issued through `/core/v1`; nodes register their own credential with an enrollment token; Core writes daemon credentials into hosted sandboxes | Machine connections only; each credential works only on its own routes. |
-
-- Core Web calls only `/core/v1`, through the Core clients in
-  `packages/agents-client` (`AdminClient`, `SandboxAdminClient`,
-  `CoreMetricsClient`). It never calls `/v1` or `/api/v1`, never uses
-  `OpenAIAgentsClient` and never forwards machine transport.
-- Users sign in to Web with the Core key. Web's server forwards signed-in,
-  same-origin `/core/v1` requests with that key and never sends it to a browser.
-  The Core key cannot call `/v1`; a Project API key cannot call `/core/v1`.
-- A new console need becomes a `/core/v1` route. Never add console or operations
-  features to `/v1`, or application features to `/core/v1`.
-- List every route with its caller and credential in [docs/api/README.md](docs/api/README.md).
-
-## Ownership
-
-Backend: Core, `contracts/`, `packages/agents-client`, `services/core-console`,
-the daemon, adapters, node service and installer. Frontend: `apps/web` and
-`docs/web`. Agree on API shapes across the boundary; do not edit the other side's
-code to make a test pass.
-
-## Making changes
-
-- Work in an isolated Git worktree on a feature branch and submit a PR.
+- Keep Core, Runtime, Harness and Sandbox Provider ownership separate through the
+  shared protocols; see [decoupling](CONTRIBUTING.md#decoupling-principle).
+- Identify every API route's caller and credential in [the API index](docs/api/README.md).
 - Run `make sqlc-generate` after query changes and `make openapi` after handler
-  annotation changes; review the generated diffs. `make openapi` writes
-  `openapi.yaml` (`/v1`), `core.openapi.yaml` (`/core/v1`) and
-  `runtime.openapi.yaml` (`/api/v1`) in `contracts/agents-api/`. Update the
-  matching contract there and the API index in the same change.
-- Do not add product database dependencies, bypass Core execution ownership, or
-  reproduce execution truth in a client.
+  changes; review and commit the generated contracts with their source changes.
 - Run `make check` before reporting completion.
-
-## Review
-
-Choose independent blind review by risk: security, shared lifecycle ownership or
-cross-package behavior. Give the reviewer only requirements, acceptance criteria,
-boundaries, the repository path and the comparison baseline. Small verified fixes
-may use self-review. Never use `codex exec` as a reviewer.
-
-Documentation and code comments are English; user-facing copy may be bilingual.
+- Update the canonical documentation in the same branch when changing a rule,
+  boundary, workflow or generated contract. Keep this file a short index.