CH-003: CI builds the native client on Linux only

.clue/id-ledger.yaml

@@ -20,3 +20,9 @@ events:
     - {id: CH-002, kind: numeric, state: live, prefix: CH, component: "2"}
     - {id: TASK-001, kind: numeric, state: reserved, prefix: TASK, component: "1"}
     - {id: TASK-001, kind: numeric, state: live, prefix: TASK, component: "1"}
+    - {id: CH-003, kind: numeric, state: reserved, prefix: CH, component: "3"}
+    - {id: ADR-002, kind: numeric, state: reserved, prefix: ADR, component: "2"}
+    - {id: CH-003, kind: numeric, state: live, prefix: CH, component: "3"}
+    - {id: ADR-002, kind: numeric, state: live, prefix: ADR, component: "2"}
+    - {id: TASK-002, kind: numeric, state: reserved, prefix: TASK, component: "2"}
+    - {id: TASK-002, kind: numeric, state: live, prefix: TASK, component: "2"}

.github/workflows/build.yml

@@ -10,10 +10,7 @@ permissions:
 
 jobs:
   build:
-    strategy:
-      matrix:
-        os: [ubuntu-latest, windows-latest, macos-latest]
-    runs-on: ${{ matrix.os }}
+    runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
       - name: Read the pinned Tank Royale commit
@@ -33,12 +30,8 @@ jobs:
             11
             17
           cache: gradle
-      - if: runner.os != 'Windows'
-        run: ./gradlew --no-configuration-cache -PtankRoyaleSource=tank-royale-source build
-      - if: runner.os == 'Windows'
-        run: .\gradlew.bat --no-configuration-cache "-PtankRoyaleSource=tank-royale-source" build
-      - if: runner.os == 'Linux'
-        uses: actions/upload-artifact@v4
+      - run: ./gradlew --no-configuration-cache -PtankRoyaleSource=tank-royale-source build
+      - uses: actions/upload-artifact@v4
         with:
           name: native-distributions
           path: build/distributions/*

CHANGELOG.md

@@ -6,15 +6,12 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 
 ## [Unreleased]
 
-### Changed
-
-- The `docker/rumble.sh` and `docker/rumble.ps1` launchers now default to the published `ghcr.io/robocode-dev/rumble-client:latest` image instead of the local-only `rumble-client:dev`, so you can pull and run without building or tagging an image. To use a locally built image, pass its name as the launcher's image argument.
-
 ## [0.1.0] - 2026-09-13
 
 ### Changed
 
 - Updated the pinned Tank Royale Battle Runner and container source to 1.3.1.
+- The `docker/rumble.sh` and `docker/rumble.ps1` launchers now default to the published `ghcr.io/robocode-dev/rumble-client:latest` image instead of the local-only `rumble-client:dev`, so you can pull and run without building or tagging an image. To use a locally built image, pass its name as the launcher's image argument.
 
 ### Added
 

README.md

@@ -65,7 +65,7 @@ Without `-PtankRoyaleSource`, `gradle build` runs the unit and contract tests an
 
 If you already have JDK 17 and Gradle installed on your machine, the equivalent host command is `./gradlew --no-configuration-cache clean build`.
 
-The build produces native ZIP and TAR archives under `build/distributions/`. Run `./gradlew run --args="--check-runtimes"` to verify the required native installations; the check never installs or changes them.
+The build produces native ZIP and TAR archives under `build/distributions/`. Run `./gradlew run --args="--check-runtimes"` to verify the required native installations; the check never installs or changes them. CI builds and tests the native client on Linux only, so running it natively on Windows or macOS works but is not CI-tested; the container image is the tested path on every host OS.
 
 <!-- runtime-versions:start -->
 The container and native preflight currently target Java 25, .NET 10, Python 3.14, and Node.js 24 (Node.js installer 24.21.0). This block is refreshed by the scheduled runtime update workflow.

docs/architecture/README.md

@@ -37,7 +37,7 @@ flowchart LR
   Submit --> Issues[GitHub Issues result inbox]
 ```
 
-Architecture documents describe the system's shape, not individual feature details. Durable choices include Java 17, Gradle, Gson for JSON contracts, the Tank Royale Battle Runner dependency, Docker/Podman isolation for runtime execution, and GHCR as the published-image distribution point (see [ADR-001](../decisions/ADR-001-ghcr-image-publishing-on-tag.md)).
+Architecture documents describe the system's shape, not individual feature details. Durable choices include Java 17, Gradle, Gson for JSON contracts, the Tank Royale Battle Runner dependency, Docker/Podman isolation for runtime execution, GHCR as the published-image distribution point (see [ADR-001](../decisions/ADR-001-ghcr-image-publishing-on-tag.md)), and CI verification of the native build on Linux only (see [ADR-002](../decisions/ADR-002-ci-native-build-linux-only.md)).
 
 <!-- clue:index:start -->
 <!-- clue:index:end -->

docs/decisions/ADR-002-ci-native-build-linux-only.md

@@ -0,0 +1,17 @@
+---
+id: ADR-002
+type: decision
+status: inferred
+author: agent
+accepted-by: []
+links: [CAP-001]
+title: CI builds and tests the native client on Linux only
+---
+
+# ADR-002 — CI builds and tests the native client on Linux only
+
+The `build` job in `.github/workflows/build.yml` builds and tests the native client on `ubuntu-latest` only, not on Windows or macOS. The published container image (CAP-001) is the default way to run the client, and Docker Desktop and Podman Desktop on Windows and macOS run that same Linux image, so the Linux build covers the supported default path on every host OS.
+
+Native execution remains supported (see `SECURITY.md`), but native Windows and macOS runs are not verified by CI. Restoring an OS to the matrix is the way to promise CI coverage for it again; do so when native use on that OS matters enough to pay its CI time.
+
+This affects the durable technology choices in the [architecture overview](../architecture/README.md).

docs/decisions/README.md

@@ -22,4 +22,5 @@ A decision that changes a methodology contract inventories every live carrier th
 
 <!-- clue:index:start -->
 - [ADR-001 — Publish the container image to GHCR, triggered only by version tags](ADR-001-ghcr-image-publishing-on-tag.md) · `inferred` — The container image (CAP-001) is published to GitHub Container Registry (`ghcr.io/robocode-dev/rumble-client`) rather than Docker Hub or another registry, because it authenticates with the workflow's…
+- [ADR-002 — CI builds and tests the native client on Linux only](ADR-002-ci-native-build-linux-only.md) · `inferred` — The `build` job in `.github/workflows/build.yml` builds and tests the native client on `ubuntu-latest` only, not on Windows or macOS.
 <!-- clue:index:end -->