wip: M2 backend

.gitattributes

@@ -1,2 +1,4 @@
 * text=auto eol=lf
 *.md text eol=lf
+*.ico binary
+tests/fuzz/corpus/** -text

.github/CODEOWNERS

@@ -0,0 +1,3 @@
+# Every path is owned by the maintainer; 04 section 6 (TM-R39) requires this review at least for .github/,
+# installer/, cmake/SdSign.cmake and tools/sd-release/.
+* @FacuM

.github/workflows/ci.yml

@@ -1,7 +1,10 @@
 # CI (04 §11.2): build + unit tests + import audit for x64-modern, x64-xp, x86-ia32 and x86-sse2, plus the
 # x64-analysis (/analyze) build. The x86 flavours also run the ISA audit and the constant-time helper-call
 # gate (sd-isacheck) as post-build steps and CTests; their test binaries run under WOW64 on the x64
-# runner (Dokany tests skip there). TM-R39: first-party actions only, pinned by commit SHA; read-only token.
+# runner (Dokany tests skip there). The arm64 and arm32 entries are build-only (M6, 04 §1.1, §5.1): they
+# cross-compile on the x64 runner, the build-time tools run from a nested x64 build, and no test runs (ARM
+# binaries cannot run there; the ARM64 test job belongs to windows-11-arm, §11.2; arm32 has no test job, D5).
+# TM-R39: first-party actions only, pinned by commit SHA; read-only token.
 name: ci
 
 on:
@@ -24,7 +27,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        preset: [x64-modern, x64-xp, x86-ia32, x86-sse2]
+        preset: [x64-modern, x64-xp, x86-ia32, x86-sse2, arm64, arm32]
     env:
       SD_BUILD_NUMBER: ${{ github.run_number }}
     steps:
@@ -34,7 +37,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up v141_xp toolset
-        if: matrix.preset != 'x64-modern'
+        if: matrix.preset != 'x64-modern' && matrix.preset != 'arm64' && matrix.preset != 'arm32'
         uses: ./.github/actions/setup-xp-toolset
 
       - name: Configure
@@ -51,13 +54,16 @@ jobs:
         shell: pwsh
         run: cmake --build --preset ${{ matrix.preset }}-debug
 
+      # arm64 and arm32 are build-only (ARM test binaries cannot run on the x64 runner, 04 §11.4): ctest is skipped.
       - name: Test Release
+        if: matrix.preset != 'arm64' && matrix.preset != 'arm32'
         shell: pwsh
-        run: ctest --preset ${{ matrix.preset }} --output-junit "${{ github.workspace }}/build/ctest-${{ matrix.preset }}.xml"
+        run: ctest --preset ${{ matrix.preset }} --output-on-failure --output-junit "${{ github.workspace }}/build/ctest-${{ matrix.preset }}.xml"
 
       - name: Test Debug
+        if: matrix.preset != 'arm64' && matrix.preset != 'arm32'
         shell: pwsh
-        run: ctest --preset ${{ matrix.preset }}-debug
+        run: ctest --preset ${{ matrix.preset }}-debug --output-on-failure
 
       - name: Upload binaries
         uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
@@ -89,4 +95,20 @@ jobs:
 
       - name: Test
         shell: pwsh
-        run: ctest --preset x64-analysis
+        run: ctest --preset x64-analysis --output-on-failure
+
+  # TM-R39 / TST-32: the workflow lint (tools/check-workflows.ps1). Read-only; CODEOWNERS is reported as a warning
+  # until the maintainer review owner is recorded.
+  workflow-lint:
+    name: workflow lint
+    runs-on: ${{ vars.SD_BUILD_RUNNER || 'windows-2022' }}
+    timeout-minutes: 10
+    steps:
+      - name: Check out
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Lint the workflows
+        shell: pwsh
+        run: ./tools/check-workflows.ps1

.github/workflows/nightly.yml

@@ -0,0 +1,130 @@
+# Nightly checks (docs/design/04 §11.2; M6 notes in docs/dev/m6-notes.md): libFuzzer runs of the parser targets with a
+# time budget per target, and the dudect-style constant-time timing tests (tests/ct, D1; SD_CT_TIMING).
+#
+#   fuzz  one job per target (tests/fuzz/CMakeLists.txt, sd_add_fuzz_target): the x86-fuzz preset (libFuzzer and
+#         AddressSanitizer, never shipped), 600 s per target, the repository corpus copied to a scratch folder first so
+#         the repository is never written. A crash or a timeout uploads its input and fails the job.
+#   ct    dudect timing tests on the quiet-machine flavours of the matrix (x86-ia32, x64-modern). Hosted runners are
+#         noisy: a failure here is a signal to rerun on the lab machine (04 §11.2), not a release decision.
+#   lint  the workflow lint (tools/check-workflows.ps1): read-only, runs on every night as well.
+#
+# Secrets: none are referenced and no cache is restored (TM-R39). Actions: first-party, pinned by commit SHA, the
+# same pins as ci.yml. Token: read-only. Triggers: schedule and workflow_dispatch only; no pull_request trigger.
+
+name: nightly
+
+on:
+  schedule:
+    - cron: "17 3 * * *"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: nightly-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  workflow-lint:
+    name: workflow lint
+    runs-on: windows-2022
+    timeout-minutes: 10
+    steps:
+      - name: Check out
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Lint the workflows
+        shell: pwsh
+        run: ./tools/check-workflows.ps1
+
+  fuzz:
+    name: fuzz ${{ matrix.target }}
+    runs-on: windows-2022
+    timeout-minutes: 45
+    strategy:
+      fail-fast: false
+      matrix:
+        target: [json, ini, utf_names, text_sanitize, keyfile, known_hosts, cert, kexinit, sftp_reply, wd_http, wd_xml, state, manifest, inflate]
+    steps:
+      - name: Check out
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Configure (x86-fuzz)
+        shell: pwsh
+        run: cmake --preset x86-fuzz
+
+      - name: Build the libFuzzer target
+        shell: pwsh
+        run: cmake --build build/x86-fuzz --config Debug --target sd-fuzz-${{ matrix.target }}-libfuzzer
+
+      - name: Run for 600 seconds on a scratch copy of the corpus
+        shell: pwsh
+        env:
+          SD_FUZZ_TARGET: ${{ matrix.target }}
+        run: |
+          $exe = Get-ChildItem -Path build/x86-fuzz -Recurse -Filter "sd-fuzz-$env:SD_FUZZ_TARGET-libfuzzer.exe" | Select-Object -First 1
+          if (-not $exe) { throw "libFuzzer target not found" }
+          $work = Join-Path $env:RUNNER_TEMP "corpus-$env:SD_FUZZ_TARGET"
+          New-Item -ItemType Directory -Force -Path $work | Out-Null
+          Copy-Item -Path (Join-Path "tests/fuzz/corpus" $env:SD_FUZZ_TARGET) -Destination $work -Recurse -Force
+          $artifacts = Join-Path $env:RUNNER_TEMP "fuzz-artifacts-$env:SD_FUZZ_TARGET"
+          New-Item -ItemType Directory -Force -Path $artifacts | Out-Null
+          Push-Location $artifacts
+          try {
+            & $exe.FullName (Join-Path $work $env:SD_FUZZ_TARGET) -max_total_time=600 -timeout=20 "-artifact_prefix=$artifacts/"
+            if ($LASTEXITCODE -ne 0) { throw "fuzzer exit $LASTEXITCODE" }
+          } finally {
+            Pop-Location
+          }
+
+      - name: Upload crashes and timeouts
+        if: failure()
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: fuzz-crash-${{ matrix.target }}
+          path: ${{ runner.temp }}/fuzz-artifacts-${{ matrix.target }}
+          if-no-files-found: ignore
+          retention-days: 30
+
+  ct:
+    name: dudect (${{ matrix.preset }})
+    runs-on: windows-2022
+    timeout-minutes: 90
+    strategy:
+      fail-fast: false
+      matrix:
+        preset: [x86-ia32, x64-modern]
+    steps:
+      - name: Check out
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Configure with the timing tests
+        shell: pwsh
+        run: cmake --preset ${{ matrix.preset }} "-DSD_CT_TIMING=ON"
+
+      - name: Build sd-ct-dudect
+        shell: pwsh
+        run: cmake --build build/${{ matrix.preset }} --config Release --target sd-ct-dudect
+
+      - name: Run the timing tests (all primitives, default samples)
+        shell: pwsh
+        run: |
+          $exe = Join-Path "build/${{ matrix.preset }}/bin/Release" "sd-ct-dudect.exe"
+          & $exe 2>&1 | Tee-Object -FilePath "ct-${{ matrix.preset }}.txt"
+          if ($LASTEXITCODE -ne 0) { throw "dudect reports a timing difference or bad inputs (exit $LASTEXITCODE)" }
+
+      - name: Upload the timing report
+        if: always()
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: ct-${{ matrix.preset }}
+          path: ct-${{ matrix.preset }}.txt
+          if-no-files-found: ignore
+          retention-days: 30