reorg: public plumbing for the in-repo Rust workspace and the two-release flow

The engine binaries move from the impeccable-dist channel to this repo's own
GitHub Releases (tag engine-v<ENGINE_VERSION>), and the closed detector the
engine links arrives as detector-v<DETECTOR_VERSION> releases on the same
repo. This commit wires the public side for that; the crates themselves land
in the next commit.

- Launcher (sh + cmd), npm shim, fetch-engine and check-engine-release now
  download from github.com/pbakaus/impeccable/releases/download/engine-v<X>/.
- release.mjs gains `engine`: verifies ENGINE_VERSION against the platform
  package pins and the detector release, tags, pushes; release-engine.yml
  builds the five targets and publishes. check-detector-release.mjs is the
  matching release-order guard (with tests).
- Root Cargo.toml (workspace, lto = false with the reason), rust-toolchain.toml
  (exact pin), DETECTOR_VERSION, /target ignored.
- CI: rust + rust-windows jobs and an oracle job that replays the goldens
  against a source build, warn-only until the first detector release exists;
  ci-test-plan exposes a `rust` output.
- docs/ENGINE.md (the crate map and the closed-detector mechanism) and the
  CLAUDE.md engine, release-order and rules sections.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Vau2X53xGTjjTCXWMVBoNY
This commit is contained in:
Paul Bakaus
2026-09-01 14:05:39 -07:00
co-authored by Claude Fable 5.1
parent 6c474b1c79
commit e355ebf714
20 changed files with 714 additions and 58 deletions
+4 -4
View File
@@ -11,10 +11,10 @@
* node scripts/fetch-engine.mjs --lenient # a target that cannot be fetched warns instead of failing
*
* Environment (same names the launcher honors):
* IMPECCABLE_DOWNLOAD_BASE release channel root (default: the public dist releases)
* IMPECCABLE_DOWNLOAD_BASE release channel root (default: the public repo's GitHub Releases)
* IMPECCABLE_BIN copy this local binary for the current platform instead of downloading
*
* The URL scheme is the launcher's: <base>/v<version>/impeccable-<os>-<arch>[.exe],
* The URL scheme is the launcher's: <base>/engine-v<version>/impeccable-<os>-<arch>[.exe],
* with an optional <asset>.sha256 next to it that is verified when present.
*/
import fs from 'node:fs';
@@ -24,7 +24,7 @@ import { createHash } from 'node:crypto';
import { fileURLToPath } from 'node:url';
const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
export const DEFAULT_DOWNLOAD_BASE = 'https://github.com/renaissance-geek-inc/impeccable-dist/releases/download';
export const DEFAULT_DOWNLOAD_BASE = 'https://github.com/pbakaus/impeccable/releases/download';
export const ENGINE_TARGETS = ['darwin-arm64', 'darwin-x64', 'linux-x64', 'linux-arm64', 'windows-x64'];
export function readEngineVersion(root = ROOT) {
@@ -43,7 +43,7 @@ export function binaryName(target) {
export function assetUrl(version, target, base = process.env.IMPECCABLE_DOWNLOAD_BASE || DEFAULT_DOWNLOAD_BASE) {
const asset = `impeccable-${target}${target.startsWith('windows-') ? '.exe' : ''}`;
return `${base.replace(/\/$/, '')}/v${version}/${asset}`;
return `${base.replace(/\/$/, '')}/engine-v${version}/${asset}`;
}
export function binaryPath(target, dest = path.join(ROOT, 'skill', 'scripts', 'bin')) {