build(ssh): assemble relay runtime artifacts

[Jinwoo-H]

Scope

Work Package 2 for #8450: target-native relay runtime assembly and artifact verification only.

• pins and authenticates the official Node 24.18.0 inputs and release key
• builds patched node-pty against the bundled Node headers
• assembles a runtime-only relay/PTY/watcher tree with deterministic identity and tar.xz
• emits unpublished SBOM, provenance, and identity evidence
• adds a read-only four-runner POSIX artifact workflow

Safety boundary

This PR does not connect a desktop resolver, cache, SSH transfer/install path, fallback state machine, target setting, or production launch path. It publishes no GitHub Release and enables no tuple. Existing relay behavior remains the default.

The eventual bundled path remains a per-SSH-target Beta opt-in, default off; any default-on change requires separate review and completed evidence gates.

Local evidence

• 4 focused suites, 15/15 tests
• pnpm run typecheck
• pnpm run lint
• focused format/max-lines/diff gates
• fresh native Linux/arm64 build in the pinned container
• full 49-entry archive/tree verification before bundled Node/native smoke
• PTY input/resize/exit and watcher create/update/rename/delete

Exact commands, hashes, timings, resource observations, and residual gaps are in the living implementation checklist.

Open gates

GitHub native POSIX runner results, oldest-baseline checks, macOS native trust/signing, Windows runtime/zip, SSH transfer, relay RPC conformance, cancellation/resource metrics, and all tuple-enablement/default-path gates remain open.

Made with Orca 🐋

[coderabbitai]

Caution

Review failed

An error occurred during the review process. Please try again later.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Jinwoo-H]

Milestone 4 downloaded-archive execution is closed at exact head 3779838f66a57e3688367256510e096d17d78011.

• All six target-native build jobs passed the 10-test path/identity/cancellation/cleanup contract and executed their real first-build archive through exclusive extraction, complete tree verification, bundled Node, PTY, and watcher smoke.
• PR Checks 29438280473 and Golden E2E 29438284781 are green.
• Artifact run 29438285824 is red only at the retained Windows arm64 floor gate: runtime smoke passed, then hosted build 26200 failed the required build-26100 qualification.
• No release write, publication, desktop/SSH consumer, tuple enablement, or default-path change is connected.

Exact runner/archive/smoke/RSS evidence is checkpointed locally in E-M4-READBACK-ARCHIVE-EXECUTION-CI-001; the next safe slice is disconnected draft-release failure composition.

[Jinwoo-H]

Milestone 4 disconnected draft-release failure composition is closed at exact head 8c925c24990ac93f6d2dd8de2081a50a74f30d97.

• The 10-test bounded identity/order/timeout/retry/partial-output/cancellation/ownership-cleanup contract passed on all six target-native Node 24 jobs.
• Every job also rebuilt, compared, reconstructed, and executed its real target-native archive.
• PR Checks 29440804969 and Golden E2E 29440804978 are green.
• Artifact run 29440806947 is red only at the retained Windows arm64 build-26100 floor gate after successful runtime smoke on hosted build 26200.
• No real release write, publication, desktop/SSH consumer, tuple enablement, or default-path change is connected.

A real draft release write is not PR-contained and remains no-write by default. The next independent safe package is Milestone 5 offline tuple/content/immutable-URL selection.