fix(catalog): resolve a bare model name to its one namespaced row

.config/nextest.toml

@@ -73,14 +73,14 @@ filter = 'binary(telemetry_kill_switch_dispatch)'
 test-group = 'telemetry-contract'
 
 [[profile.default.overrides]]
-filter = 'package(codewhale-tui) & kind(lib) & test(/^fleet::manager::tests::/)'
+filter = 'package(codewhale-engine) & kind(lib) & test(/^fleet::manager::tests::/)'
 test-group = 'fleet-manager-lifecycle'
 
 [[profile.default.overrides]]
 # DSH preparation also launches the isolated host against the shared hermetic
 # home. OCR/PDF consumers also launch real hosts outside extension_host's
 # namespace. Keep their process lifecycle checks in this existing serial lane.
-filter = 'package(codewhale-tui) & kind(lib) & (test(/^extension_host::/) | test(/^tools::image_ocr::host_tests::/) | test(/^tools::pdf::host_tests::/) | test(/^core::engine::.*extension/) | test(/^plugins::install::dsh::/) | test(/^plugins::tests::dsh_/) | test(/^runtime_api::tests::dsh_package_preview_then_exact_install_over_http$/) | test(/^commands::contract::tests::plugin_adapter_dsh_preview_runs_from_live_runtime$/) | test(/^commands::groups::plugins::tests::dsh_import_reviews_without_installing_then_installs_the_exact_bundle$/))'
+filter = '(package(codewhale-engine) | package(codewhale-tui)) & kind(lib) & (test(/^extension_host::/) | test(/^tools::image_ocr::host_tests::/) | test(/^tools::pdf::host_tests::/) | test(/^core::engine::.*extension/) | test(/^plugins::install::dsh::/) | test(/^plugins::tests::dsh_/) | test(/^runtime_api::tests::dsh_package_preview_then_exact_install_over_http$/) | test(/^commands::contract::tests::plugin_adapter_dsh_preview_runs_from_live_runtime$/) | test(/^commands::groups::plugins::tests::dsh_import_reviews_without_installing_then_installs_the_exact_bundle$/))'
 test-group = 'extension-host'
 
 [[profile.default.overrides]]
@@ -116,5 +116,5 @@ path = "junit.xml"
 report-name = "codewhale-native-host"
 
 [[profile.ci.overrides]]
-filter = 'package(codewhale-tui) & kind(lib) & (test(/^extension_host::tests::compiled_native_host_cannot_read_secrets_or_write_outside_its_data_dir$/) | test(/^extension_host::tests::compiled_native_host_memory_cap_is_enforced$/))'
+filter = 'package(codewhale-engine) & kind(lib) & (test(/^extension_host::tests::compiled_native_host_cannot_read_secrets_or_write_outside_its_data_dir$/) | test(/^extension_host::tests::compiled_native_host_memory_cap_is_enforced$/))'
 junit.store-success-output = true

.gitattributes

@@ -3,9 +3,9 @@
 # produces different compiled binaries on Windows vs Linux/macOS.
 # Cover nested mode/approval/personality prompts — a top-level *.md glob alone
 # left modes/*.md on CRLF under Windows autocrlf and blew the agent token budget.
-crates/tui/src/prompts/**/*.md text eol=lf
-crates/tui/src/prompts/*.md text eol=lf
-crates/tui/src/prompts/*.txt text eol=lf
+crates/engine/src/prompts/**/*.md text eol=lf
+crates/engine/src/prompts/*.md text eol=lf
+crates/engine/src/prompts/*.txt text eol=lf
 
 # The rest of the include_str!() inputs. `* text=auto` below converts these to
 # CRLF on a Windows checkout, which is invisible for the ones that are only
@@ -58,12 +58,12 @@ scripts/fixtures/dsh-web-app/** text eol=lf
 # the generator's LF output (protocol/tests.rs), and its dist bundle is
 # include_bytes!()'d and digest-checked at launch; a CRLF Windows checkout
 # failed the former and would embed different bytes.
-crates/tui/extension-host/src/protocol.generated.ts text eol=lf
-crates/tui/extension-host/dist/** text eol=lf
+crates/engine/extension-host/src/protocol.generated.ts text eol=lf
+crates/engine/extension-host/dist/** text eol=lf
 # Reviewed extension-host fixtures carry exact source SHA-256 receipts.
 # A Windows checkout must not rewrite their admitted source closure to CRLF.
-crates/tui/tests/fixtures/extension_host/** text eol=lf
-crates/tui/extension-host/src/dsh/dsh-message-compat.js text eol=lf
+crates/engine/tests/fixtures/extension_host/** text eol=lf
+crates/engine/extension-host/src/dsh/dsh-message-compat.js text eol=lf
 
 # Rustfmt writes LF; keep Rust sources stable across Windows/Linux/macOS.
 *.rs text eol=lf

.github/AUTHOR_MAP

@@ -272,3 +272,6 @@ henrikdukef@gmail.com = Henrik Bakke Dukefoss <76407537+henrikdukefoss@users.nor
 dhruvsingalabc@gmail.com = Dhruv Singal <170742396+dsingal0@users.noreply.github.com>
 aboyskyi@gmail.com = Boyce <52989177+Aboysky@users.noreply.github.com>
 Boyce = Boyce <52989177+Aboysky@users.noreply.github.com>
+Felixkw12 = Felix Wunderlich <151852644+Felixkw12@users.noreply.github.com>
+felix@opper.ai = Felix Wunderlich <151852644+Felixkw12@users.noreply.github.com>
+Felix Wunderlich = Felix Wunderlich <151852644+Felixkw12@users.noreply.github.com>

.github/scripts/release-workflows.test.js

@@ -362,6 +362,7 @@ const expectedTargets = [
   "x86_64-unknown-linux-musl",
   "aarch64-unknown-linux-musl",
   "aarch64-linux-android",
+  "aarch64-unknown-linux-ohos",
   "x86_64-apple-darwin",
   "aarch64-apple-darwin",
   "x86_64-pc-windows-msvc",
@@ -395,7 +396,7 @@ const builtAssetNames = [
   ...valuesForKey(artifacts, "shim_artifact"),
   ...valuesForKey(artifacts, "compat_tui_artifact"),
 ];
-assert.equal(builtAssetNames.length, 21);
+assert.equal(builtAssetNames.length, 24);
 assert.deepEqual(
   [...new Set(builtAssetNames)].sort(),
   [
@@ -417,6 +418,44 @@ const bundleInvocations = [...bundles.matchAll(
 assert.deepEqual(bundleInvocations.sort(), [...BUNDLE_ASSET_NAMES].sort());
 assert.match(artifacts, /aarch64-pc-windows-msvc/);
 assert.match(artifacts, /aarch64-linux-android/);
+// HarmonyOS bytes cannot be shipped unsigned: the device refuses to execute an
+// unsigned ELF, so the leg must self-sign and prove the signature before
+// staging. Assert the order too — signing after staging would publish the
+// unsigned copy.
+assert.match(artifacts, /aarch64-unknown-linux-ohos/);
+const ohosSdk = namedStep(artifacts, "Install OpenHarmony native SDK");
+assert.match(ohosSdk, /components: 'native;toolchains'/, "the SDK must include the binary signer");
+assert.match(ohosSdk, /cache: false/, "a release must download the SDK, not publish a new cache entry");
+// A step header glued onto the previous line because a `run:` block lost its
+// trailing newline parses as valid YAML (the header becomes script text) and
+// silently drops the step. Every `- name:` in these workflows must start its
+// own line.
+for (const [file, source] of [
+  ["release-artifacts.yml", artifacts],
+  ["release.yml", release],
+  ["nightly.yml", nightly],
+]) {
+  for (const match of source.matchAll(/- name:/g)) {
+    const lineStart = source.lastIndexOf("\n", match.index) + 1;
+    assert.match(
+      source.slice(lineStart, match.index),
+      /^\s*$/,
+      `${file}: a step header must start its own line, not follow other content`,
+    );
+  }
+}
+
+const ohosBuild = namedStep(artifacts, "Cross-compile and code-sign the OpenHarmony binary");
+assert.match(ohosBuild, /matrix\.platform == 'ohos-arm64'/);
+assert.match(ohosBuild, /binary-sign-tool\.jar/);
+assert.match(ohosBuild, /-selfSign 1/);
+assert.match(ohosBuild, /code signature is self-sign/);
+assert.match(ohosBuild, /scripts\/ohos-env\.sh/);
+assert.ok(
+  ohosBuild.indexOf("codesign") === -1 ||
+    ohosBuild.indexOf("binary-sign-tool.jar") < ohosBuild.indexOf("display-sign"),
+  "the signature must be applied before it is verified",
+);
 assert.match(artifacts, /codew-windows-arm64\.exe/);
 assert.match(artifacts, /CodeWhaleSetup\.exe/);
 assert.match(artifacts, /assemble-release-assets\.js --verify release-assets/);
@@ -491,7 +530,7 @@ const parityRustCache = [...parity[1].matchAll(/uses: Swatinem\/rust-cache@[\s\S
 assert.equal(parityRustCache.length, 1, "parity must pin exactly one rust-cache");
 assert.doesNotMatch(parityRustCache[0], /github\.(event|ref|sha)|inputs\./);
 
-assert.equal(allReleaseAssetNames().length, 34);
+assert.equal(allReleaseAssetNames().length, 38);
 assert.match(release, /^  artifacts:\n/m);
 assert.match(release, /uses: \.\/\.github\/workflows\/release-artifacts\.yml/);
 assert.doesNotMatch(release, /^  (build|bundle|windows-installer):/m);
@@ -620,7 +659,7 @@ assert.doesNotMatch(
 
 assert.match(runbook, /release[- ]candidate/i);
 assert.match(runbook, /expected_sha/);
-assert.match(runbook, /34/);
+assert.match(runbook, /38/);
 assert.match(runbook, /does not create a tag/i);
 assert.match(runbook, /explicit.*approval/i);
 assert.match(runbook, /last[- ]useful[- ]log/i, "runbook must document the last-useful-log rule (#5496)");
@@ -866,5 +905,5 @@ assert.ok(
 );
 
 console.log(
-  "Workflow contracts OK: 6-target/12-asset single-runtime nightly and exact-head 7-target/34-asset release candidate.",
+  "Workflow contracts OK: 6-target/12-asset single-runtime nightly and exact-head 8-target/38-asset release candidate.",
 );

.github/workflows/ci.yml

@@ -172,7 +172,7 @@ jobs:
             # push to main still runs it unconditionally as the pre-release
             # safety net for anything this filter misses.
             case "${path}" in
-              crates/app-server/*|crates/tui/src/runtime_api*|crates/tui/src/runtime_mobile.html|crates/tui/src/runtime_threads*|crates/tui/src/main.rs|scripts/mobile-smoke.sh|.github/workflows/ci.yml|Cargo.lock|Cargo.toml)
+              crates/app-server/*|crates/tui/src/runtime_api*|crates/tui/src/runtime_mobile.html|crates/engine/src/runtime_threads*|crates/tui/src/main.rs|scripts/mobile-smoke.sh|.github/workflows/ci.yml|Cargo.lock|Cargo.toml)
                 mobile=true
                 ;;
             esac
@@ -327,7 +327,7 @@ jobs:
         # testing; then reject any bundle drift. Node 22 matches the host floor.
         run: |
           set -euo pipefail
-          cd crates/tui/extension-host
+          cd crates/engine/extension-host
           npm ci --ignore-scripts
           npm test
           npm run typecheck
@@ -344,7 +344,7 @@ jobs:
         # suites only; the Rust host tests run on Node.
         run: |
           set -euo pipefail
-          cd crates/tui/extension-host
+          cd crates/engine/extension-host
           npm run test:bun
 
   extension-host-runtimes:
@@ -359,7 +359,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     defaults:
       run:
-        working-directory: crates/tui/extension-host
+        working-directory: crates/engine/extension-host
         shell: bash
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
@@ -384,7 +384,7 @@ jobs:
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: extension-host-runtime-${{ matrix.os }}
-          path: crates/tui/extension-host/dist/builtin-modules.json
+          path: crates/engine/extension-host/dist/builtin-modules.json
           if-no-files-found: error
 
   vscode-extension:
@@ -470,7 +470,7 @@ jobs:
         # codewhale-runtime owns `safe_label` (its hostile-authority test)
         # since RS-2; add the next package when another safety module moves.
         run: |
-          sh scripts/with-hermetic-test-home.sh cargo nextest run -p codewhale-tui -p codewhale-runtime --lib --locked --no-tests=fail -E 'test(auto_review) | test(authority) | test(sandbox)'
+          sh scripts/with-hermetic-test-home.sh cargo nextest run -p codewhale-engine -p codewhale-tui -p codewhale-runtime --lib --locked --no-tests=fail -E 'test(auto_review) | test(authority) | test(sandbox)'
           sh scripts/with-hermetic-test-home.sh cargo test -p codewhale-execpolicy --locked
 
   lint:
@@ -896,7 +896,7 @@ jobs:
           set -euo pipefail
           bun_binary="$(bun -p 'process.execPath')"
           host_binary="$(node -p "require('path').join(process.env.RUNNER_TEMP, 'codewhale-extension-host' + (process.platform === 'win32' ? '.exe' : ''))")"
-          compiled_info="$(node crates/tui/extension-host/compile-host.mjs --bun "$bun_binary" --output "$host_binary")"
+          compiled_info="$(node crates/engine/extension-host/compile-host.mjs --bun "$bun_binary" --output "$host_binary")"
           printf 'CODEWHALE_COMPILED_HOST_TEST_BINARY=%s\n' "$host_binary" >> "$GITHUB_ENV"
           node - "$host_binary" "$bun_binary" "$compiled_info" >> "$GITHUB_ENV" <<'JS'
           const fs = require('node:fs'), crypto = require('node:crypto');
@@ -908,7 +908,7 @@ jobs:
           console.log('CODEWHALE_COMPILED_HOST_TEST_SHA256=' + digest(process.argv[2]));
           console.log('CODEWHALE_COMPILED_HOST_TEST_BUN=' + process.argv[3]);
           console.log('CODEWHALE_COMPILED_HOST_TEST_RUNTIME_SHA256=' + digest(process.argv[3]));
-          console.log('CODEWHALE_COMPILED_HOST_TEST_BUNDLE_SHA256=' + digest('crates/tui/extension-host/dist/codewhale-extension-host.mjs'));
+          console.log('CODEWHALE_COMPILED_HOST_TEST_BUNDLE_SHA256=' + digest('crates/engine/extension-host/dist/codewhale-extension-host.mjs'));
           JS
           # The required hermetic full invocation executes the shared actual
           # compiled Native secret/history/write scenario on each OS; Windows
@@ -1149,7 +1149,7 @@ jobs:
           python3 scripts/compiled-host-native-receipt.py \
             --junit target/nextest/ci/junit.xml \
             --compiled-image "$CODEWHALE_COMPILED_HOST_TEST_BINARY" \
-            --bundle crates/tui/extension-host/dist/codewhale-extension-host.mjs \
+            --bundle crates/engine/extension-host/dist/codewhale-extension-host.mjs \
             --bun "$CODEWHALE_COMPILED_HOST_TEST_BUN" --source-sha "$GITHUB_SHA" \
             --image-platform "$CODEWHALE_COMPILED_HOST_TEST_PLATFORM" --image-arch "$CODEWHALE_COMPILED_HOST_TEST_ARCH" \
             --host-sha256 "$CODEWHALE_COMPILED_HOST_TEST_SHA256" \