[lukewilliamboswell]

Move repository orchestration into Roc, include the complete immutable semantic suite in nightly/release checks, and bind SBOMs to every final platform deliverable. Declare Windows in Blueprint and scope Nix tools to Linux/macOS.

Changes

• Upgrade Blueprint to 0.11.0, script tooling to nightly-2026-11-01-48d3369, and shared automation to full SHA 8afe656ea7de5586233683088eb6972b770f6832.
• Use Roc for build/bootstrap, release selection/assembly, semantic archive planning, SBOM composition and evidence handoff. Retain native-format adapters and independent harnesses in Python.
• Package all 426 semantic cases across 34 applications/benchmarks in the canonical examples ZIP. The production host classifies each SCM; archive execution does not apply working-tree intermittent-case exclusions. Preserve original fixture names and deduplicated payloads through measured aliases. Keep native window checks separate.
• Use the shared three-platform nightly/archive workflows. Test the immutable examples ZIP against the exact candidate platform with a cold package cache. Missing releases and incomplete targets fail closed.
• Wire separate SPDX 3.0.1, SPDX 2.3, CycloneDX 1.7 and binding manifests for eight final subjects: platform bundle, three native source companions, examples ZIP, docs ZIP, PDF and release manifest. Compose the sealed Cargo closures and exact linker identities. Correct legacy Cargo slash-license syntax while retaining the original declaration; retain immutable Git tree references and distinct source-archive identities.
• Stage the validated native release host before generating production fixtures and prevent nested tests from rebuilding it. Resolve bundle paths before entering the temporary platform directory.

Validation

Current head: 46c4006fadfe4650da2b73d7751bd5f5ab09d976. CI and release dry run are running; their outcomes remain gates. The first Windows release attempt failed on an immutable package download before native work. Linux/macOS hosts succeeded; the same-commit failed-job retry is now running.

• All 187 local Python tests pass. The changed Roc release script checks and formats successfully. Prior exact-commit Roc checks passed all 34 applications and their expectations.
• All three ordinary semantic suites, all three sealed host builds, Windows/macOS window checks, and Windows smoke/gallery passed in the preceding run. The follow-up push superseded it and cancelled its remaining stages; it is not a green complete run.
• Production bundle assembly succeeded locally using all six real sealed CI host/source archives and the adopted linker release. The 114,083,720-byte compressed platform expands to 312,248,304 bytes and lists 220 regular members. Its complete SBOM inventory has 1698 components. No graph or target was removed to fit a limit.
• The 426-case ZIP passed the pinned archive verifier and Counter executed through the archived harness with a production capture. Complete three-platform execution of the final archived suite remains unproven.
• Local production release execution staged the sealed host and generated real semantic/A/A/long-session fixtures, then correctly refused a window fixture because the screen was locked. The window gate was preserved.

Release dependencies

The refreshed linker inputs are published and adopted. Producer 41420530917 and trusted publisher 41420512450 succeeded at exact source a306c91. The publisher created signed lock-only commit 6fae0bc and immutable content-addressed release. All adopted sizes/hashes were independently checked. This satisfies the stale-lock prerequisite in#59.

Final SBOM admission still needs an official fixed Blueprint release. Blueprint #82 fixes required build-file inventory, bounded complete documents and full profile IDs; its updated CI is running. Real full-platform generation exposed two further issues: the 1 MiB reader / 8 MiB codec limits, and shortening valid local component IDs over 64 bytes during readback. The submitted follow-up selects a measured 16 MiB SBOM-only budget while preserving generic JSON's 8 MiB default and existing graph/cardinality limits; all 576 SBOM tests pass, including full 256-byte ID round trips. The real SPDX3 rendering is 8,706,167 bytes; all five available final subjects now pass all three formats against their original inventories and exact artifact bytes. Shared descriptor/subject/manifest subchecks pass on those files; the complete 9,127,782-byte supplier-import record also passes actual consumer inspection with every component retained. These local subchecks do not establish released-generator admission. Unreleased candidates are not substituted for reviewed release identities.

Blueprint's latest-compiler release prerequisite remains blocked byRoc #12795. The unchanged cold Linux interpreter check still crashes on combined compiler-upgrade/build-files/capacity source. No backend switch, warm-cache bypass or removed assertion is used.

Native linker-input sidecar distribution is separately tracked byroc-automation #116. Its isolated schema3 extension reuses transferred-binding verification, independently binds run/attempt attestations and preserves complete immutable publication. The updated local controller suite passes 240 tests with 48 platform-gated skips. It preserves 1 MiB control records, adds reviewed per-tool payload capacities and bounds escaped aggregate imports. Upstream review, official tool hashes, a trusted default-controller pin update and a fresh schema3 input release remain dependencies; the successful schema2 release does not close them.

A published nightly compatibility pass also requires an eligible final product release. No release/settings changes or compatibility success are claimed from the existing missing-release scheduled run. Existing Observatory window exclusions remain tracked in#60.