Lab: six-family OSS organ qualification

[mark-e-deyoung]

Public, zero-secret qualification lab for a small set of upstream OSS primitives we want to dogfood.

Scope:

• Linux, Windows, macOS on x64 and ARM64 GitHub-hosted runners.
• Exact pinned public release artifacts for go-task, just, Nushell, and MiniZinc.
• Verify GitHub release SHA-256 digest before execution.
• Exercise structured/static discovery plus a bounded execution/optimization probe.
• Retain machine-readable per-runner evidence as short-lived Actions artifacts.

Safety/authority:

• public evidence only;
• read-only workflow permissions;
• checkout credentials are not persisted;
• no private fixtures, rationale, endpoints, or secrets;
• no upstream/public mutation beyond this lab PR.

This is qualification evidence, not a claim of universal portability. Interactive desktop behavior (for example xa11y with macOS TCC or a real Linux desktop session) remains a separate dogfood class.

[mark-e-deyoung]

Qualification run 34409205709 completed successfully: 6/6 PASS across Linux, Windows, and macOS on x64 and ARM64.

Each cell downloaded the exact pinned native public release artifacts for Task v3.53.1, just 1.58.0, Nushell 0.115.1, and MiniZinc 2.10.1; required the GitHub-published SHA-256 digest to match before extraction/execution; then exercised discovery/execution or the bounded optimization probe. Structured per-cell evidence is retained as short-lived Actions artifacts.

One earlier macOS ARM64 failure was an unauthenticated GitHub API rate-limit in the harness, not a candidate/platform failure. The harness now uses the workflow's read-only token only for release metadata and strips both QUAL_GITHUB_TOKEN and GITHUB_TOKEN before any downloaded executable is launched.

Keeping this PR draft while deciding whether the qualification harness should become a permanent public capability or remain a disposable lab.

[mark-e-deyoung]

Rep tranche complete on the public lab surface.

Successful six-family evidence:

• E-004: native shell, Task, just, and Nushell all preserved the same bounded workload result, repeated idempotently, and surfaced deliberate failure across Linux/Windows/macOS x64+ARM64. Task maps child failure to its own stable nonzero status; the others preserved exit 7 in this fixture.
• C-003: MiniZinc/Gecode agreed 20/20 with an independent exact allocation oracle on the same fixed-seed corpus in all six runner families (16 feasible, 4 infeasible).
• A-002: public-source lifecycle fixture passed install, idempotent reinstall, upgrade, and remove on all six families.
• E-005: corrected Task fixture confirms --list-all --json discovers both bounded tasks on all six families; the earlier apparent discovery gap was a fixture error.
• A-003: two same-runner artifact rebuilds were byte-identical on all six families. Cross-runner byte identity is a separate property: Windows checkout source bytes differed from Unix, and Unix families with identical source bytes still produced different naive zipapp hashes.
• D-002 boundary probe: xa11y 0.14.0 binary Python install/import succeeded on five families; Windows ARM64 had no matching binary distribution. This is a packaging observation only, not interactive-desktop qualification.

Run 34431345364 is 6/6 green after correcting a Windows temp-cleanup race in the harness. The PR remains draft/disposable; these results do not claim universal portability or justify merging the lab machinery into the product.

[mark-e-deyoung]

xa11y Windows ARM64 Python candidate update (public-safe):

• Upstream public release-synchronized source pinned at 44594a9705a3f3213a9b58bc205f4e6335c9606b.
• Native windows-11-arm + ARM64 CPython 3.12.10.
• Upstream PyO3/maturin-action@v1, target aarch64.
• Built xa11y-0.14.0-cp39-abi3-win_arm64.whl successfully.
• Installed exactly that local wheel with pip --no-index --only-binary=:all:.
• import xa11y succeeded; App.by_name present.
• Missing-app negative control surfaced SelectorNotMatchedError, an XA11yError.
• xa11y --help succeeded.
• Retained artifact: xa11y-0.14.0-windows-arm64-candidate, workflow run 34433964860, artifact id 10135517568.

The earlier control against the annotated tag target also built a native ARM64 wheel but exposed xa11y's post-tag version synchronization (wheel metadata remained 0.13.0), so the successful rep deliberately pinned the release-synchronized public source instead of overriding metadata.

Disposition: candidate is qualified in the public lab. No upstream issue/PR has been opened; next gate is reconstruction in an actual public xa11y fork and fork-produced artifact dogfood.