[Copilot]

Summary

• Add deterministic SPDX inventories for shipped CLI archives and MCPBs, scoped to each platform's runtime components and embedded assets.
• Publish inventories with artifact digests, checksums, and attestations; preserve immutable recovery behavior.

Motivation

Release consumers need to identify the components in each distributed binary without mistaking development dependencies for shipped content.

Changes

• Inventory. Capture the configured Bazel runtime graph, production dashboard dependencies and assets, vendored sources, and NOTICE-attributed adaptations. Mark unknown metadata explicitly for review.
• Release and recovery. Generate inventories against final archive/MCPB bytes; publish them as detached assets and include them in checksum, attestation, and recovery flows.
• Signing documentation. Correct the Windows signing status; certificate and service provisioning remain external blockers.

Test plan

• Focused release inventory, recovery, and artifact checks pass through Bazel
• bazel build //... passes when the change crosses package boundaries
• Focused release inventory and recovery checks were run through Bazel after the latest master integration.

Current integration validation

Merge commit 131de35d6f30848260a4e67bae7245be2943c162 incorporates master through 44d8265c13a5feb70e7ea834c1d11ed413f3f2af. The only conflict was crates/tracedecay-code-index-runtime/tests/code_index_scheduler/serving.rs: all three master admission-progress regressions were retained, and the resolved file is byte-for-byte identical to master. No test, timeout, or production behavior was weakened by the resolution.

The following existing checks passed on the merged tree:

• bazel run //scripts:test-generate-release-inventory.py
• bazel run //scripts:test-plan-release-recovery.py
• bazel run //scripts:test-check-release-artifacts.py

The exported inventory test script needed its executable bit restored before Bazel could run it; that mode fix is included. Pinned Rust formatting, whitespace checks, and merge commit hooks passed. Full CI on the pushed head is required before merge; the previous two reported checks did not include Linux fleet execution because the old head conflicted with master.

Checklist

• CHANGELOG.md updated (under [Unreleased] if no version bump)
• No secrets, credentials, or .env files included
• Breaking changes documented (if any)

• Fixes release: attach an artifact-scoped component and license inventory to shipped distributions #4343

[changeset-bot]

⚠️ No Changeset found

Latest commit: 131de35

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[ScriptedAlchemy]

Cross-referenced #4343 and pushed 6ad658a with two review fixes.

1. Resolved package versions: a member using version.workspace = true previously generated version {'workspace': True} and the corresponding encoded dictionary in its Cargo purl. Inventory generation now uses the resolved Cargo.lock version. The existing fixture exercises workspace inheritance and verifies both the scope record and final SPDX versionInfo/purl.
2. Inventory-only recovery: the planner emits JSON boolean true, but 14 stable/beta workflow conditions compared it with string 'true'. They now compare with boolean true, so inventory recovery steps run and native build/package/upload steps are skipped as intended.

Validation: the inherited-version fixture failed before the generator fix and passed afterward; python3 scripts/test-generate-release-inventory.py and python3 scripts/test-plan-release-recovery.py passed; both workflow YAMLs parsed; git diff --check passed. The published tree exactly matches the locally tested tree. No release or native build was triggered by this review.

[ScriptedAlchemy]

Pushed 8060f45 for two release-inventory defects under #4343. The query now requests unfactored, untruncated DOT output, and traversal retains target/exec configuration identity so shared crates cannot pull build-only dependencies into the shipping inventory. Externally supplied factored graphs fail explicitly. The shared target/exec regression fails on the original parser and passes with this fix; inventory, recovery-planner, artifact-validator and shell checks pass.

[ScriptedAlchemy]

Pushed 5a120be. Both stable and beta packaging-helper checkouts now explicitly use non-cone sparse checkout so scripts/generate-release-inventory.py is available alongside the composite actions. Moved standard-library and optional YAML imports to module scope; scope-only generation still works without the optional lockfile reader.

Release-inventory, recovery-planner, and release-artifact-validator Python regressions pass. Both workflow files parse and select the generator through non-cone patterns; git diff --check and commitlint pass. No release was published as part of this validation.

[ScriptedAlchemy]

Pushed e435ec6 after the native CI failure reported four agent-hosts journeys timing out at their initial code-index generation.

The failing mount reaches a concrete pre-existing text-build admission defect: it added the watermark margin to the ledger reservation and then shrank it, so a build fitting the actual headroom could be refused by the larger temporary charge. This commit reuses the reviewed #4393 implementation that sizes and charges the build atomically under the canonical ledger, plus the cgroup-headroom regression already reviewed on #4379. It retains the existing ceiling, bounded reclamation, pressure/wakeup rules, and reservation owner.

The journey helper still uses its five-second deadline, 10 ms cadence, and original generation-ready condition. It now captures bounded park, worker, pressure, and ledger evidence inside that same deadline and signals the existing scheduler's cancellation on failure. Reporting after timeout performs no new readiness waits or diagnostic reads.

Validation: the transplanted production files match #4393 byte-for-byte; the added cgroup regression matches #4379. Independent source review, pinned rustfmt, diff checks, and commitlint pass. Native behavior remains for fresh CI. The old timeout log did not include enough admission state to prove this defect caused all four failures, so the diagnostic evidence remains necessary.