Harden validation evidence handling

.github/workflows/build-pi-villani-runtime-release.yml

@@ -0,0 +1,99 @@
+name: Build pi-villani runtime release
+
+on:
+  workflow_dispatch:
+  push:
+    tags:
+      - "pi-villani-runtime-v*"
+
+permissions:
+  contents: write
+
+env:
+  RUNTIME_VERSION: "0.1.0"
+
+jobs:
+  runtime:
+    name: ${{ matrix.platform }}
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - platform: win32-x64
+            os: windows-latest
+            extension: zip
+            executable: dist/runtime/villani-code/villani-code.exe
+          - platform: darwin-arm64
+            os: macos-14
+            extension: tar.gz
+            executable: dist/runtime/villani-code/villani-code
+          - platform: darwin-x64
+            os: macos-15-intel
+            extension: tar.gz
+            executable: dist/runtime/villani-code/villani-code
+          - platform: linux-x64
+            os: ubuntu-latest
+            extension: tar.gz
+            executable: dist/runtime/villani-code/villani-code
+
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+      - name: Install build dependencies
+        run: |
+          python -m pip install --upgrade pip
+          python -m pip install -e . pyinstaller
+      - name: Build runtime
+        run: pyinstaller --distpath dist/runtime --workpath build/runtime packaging/villani_runtime.spec
+      - name: Smoke test runtime
+        run: python packaging/smoke_test_runtime.py "${{ matrix.executable }}"
+      - name: Compute asset name
+        shell: bash
+        run: |
+          RUNTIME_VERSION="${GITHUB_REF_NAME#pi-villani-runtime-v}"
+          ASSET="villani-runtime-v${RUNTIME_VERSION}-${{ matrix.platform }}.${{ matrix.extension }}"
+          echo "RUNTIME_VERSION=${RUNTIME_VERSION}" >> "$GITHUB_ENV"
+          echo "ASSET=${ASSET}" >> "$GITHUB_ENV"
+      - name: Archive runtime (Windows)
+        if: matrix.extension == 'zip'
+        shell: pwsh
+        run: Compress-Archive -Path dist/runtime/villani-code -DestinationPath "$env:ASSET"
+      - name: Archive runtime (macOS/Linux)
+        if: matrix.extension == 'tar.gz'
+        run: tar -czf "$ASSET" -C dist/runtime villani-code
+      - name: Generate checksum
+        shell: bash
+        run: |
+          if command -v sha256sum >/dev/null 2>&1; then
+            sha256sum "$ASSET" > "$ASSET.sha256"
+          else
+            shasum -a 256 "$ASSET" > "$ASSET.sha256"
+          fi
+      - uses: actions/upload-artifact@v4
+        with:
+          name: ${{ matrix.platform }}-runtime
+          path: |
+            ${{ env.ASSET }}
+            ${{ env.ASSET }}.sha256
+
+  publish:
+    needs: runtime
+    runs-on: ubuntu-latest
+    if: startsWith(github.ref, 'refs/tags/pi-villani-runtime-v')
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          path: artifacts
+      - name: Flatten artifacts and checksums
+        run: |
+          find artifacts -type f -name 'villani-runtime-*' -exec cp {} . \;
+          cat *.sha256 > checksums.txt
+      - uses: softprops/action-gh-release@v2
+        with:
+          files: |
+            villani-runtime-v*.zip
+            villani-runtime-v*.tar.gz
+            checksums.txt

.github/workflows/ci.yml

@@ -61,10 +61,4 @@ jobs:
           . .venv-smoke/bin/activate
           pip install dist/*.whl
           villani-code --help > /dev/null
-          python - <<'PY'
-import importlib.util
-assert importlib.util.find_spec("villani_code") is not None
-assert importlib.util.find_spec("villani_code.cli") is not None
-assert importlib.util.find_spec("ui") is None
-print("packaging smoke ok")
-PY
+          python -c 'import importlib.util; assert importlib.util.find_spec("villani_code") is not None; assert importlib.util.find_spec("villani_code.cli") is not None; assert importlib.util.find_spec("ui") is None; print("packaging smoke ok")'

.gitignore

@@ -145,3 +145,6 @@ Thumbs.db
 # Local secrets / config
 *.env
 .env.*
+
+# Local backup files
+*.bak

CHANGELOG.md

@@ -2,10 +2,4 @@
 
 ## 0.1.0rc1
 
-- Hardened benchmark validation command resolution with explicit allowlisting and clear environment-failure classification.
-- Added benchmark interpretation-status policy (`headline_comparable`, `informational_only`, `internal_only`) with blunt report banners.
-- Expanded aggregate provenance reporting so environment/harness instability is separated from agent weakness in summaries.
-- Added benchmark preflight checks for task packs, agent names, command structure, and likely executable-resolution issues.
-- Curated benchmark starting packs with distinct task instructions and pack lint validation tests.
-- Tightened CI release surface for Python 3.11 and Windows/core behavior, plus packaging smoke assertions.
-- Updated benchmark documentation and added a practical release checklist.
+- Added minimal validation evidence hygiene: shell pipefail execution, weak-evidence labeling for filtered commands, unresolved failed-validation warnings, and last-successful-validation drift warnings.