Integration/atlas complete 20261015

.github/workflows/atlas-apk.yml

@@ -0,0 +1,160 @@
+name: Build Atlas APK
+
+# Builds an installable Android APK (arm64 phones) on every push to atlas-voice,
+# and publishes it on the Releases page so it can be downloaded on the phone.
+on:
+  push:
+    branches: [atlas-voice]
+  workflow_dispatch:
+
+jobs:
+  apk:
+    permissions:
+      contents: write
+    runs-on: ubuntu-latest
+    timeout-minutes: 120
+    steps:
+      - uses: actions/checkout@v5
+      - uses: actions/setup-node@v5
+        with:
+          node-version: '24'
+          cache: 'npm'
+      - uses: actions/setup-java@v5
+        with:
+          distribution: 'temurin'
+          java-version: '17'
+      - name: Use the runner's Android SDK
+        run: |
+          echo "ANDROID_HOME=$ANDROID_SDK_ROOT" >> $GITHUB_ENV
+          yes | "$ANDROID_SDK_ROOT/cmdline-tools/latest/bin/sdkmanager" --licenses > /dev/null || true
+      - name: Free disk space
+        run: sudo rm -rf /usr/share/dotnet /opt/ghc || true
+      - uses: actions/cache@v5
+        with:
+          path: |
+            ~/.gradle/caches
+            ~/.gradle/wrapper
+          key: gradle-${{ hashFiles('android/**/*.gradle*', 'android/gradle/wrapper/gradle-wrapper.properties') }}
+          restore-keys: gradle-
+      - name: Install JS dependencies
+        run: npm ci --ignore-scripts
+      - name: Install llama.rn native artifacts
+        run: node node_modules/llama.rn/install/download-native-artifacts.js
+      - name: Apply audited native dependency patches
+        run: ./node_modules/.bin/patch-package
+      - name: Reconciled feature contract gate
+        run: node scripts/release/check-reconciled-release.cjs
+      - name: TypeScript gate
+        run: ./node_modules/.bin/tsc --noEmit -p .
+      - name: Core regression gate
+        run: ./node_modules/.bin/jest --runInBand --forceExit --coverage=false --silent
+      - name: Checkout pinned public llama.kt sources (exclude private Pro)
+        run: |
+          set -euo pipefail
+          git submodule sync -- vendor/llama-kt
+          git submodule update --init --depth=1 -- vendor/llama-kt
+          git -C vendor/llama-kt submodule update --init --recursive --depth=1
+          node scripts/check-llamakt-source.cjs
+          test -f vendor/llama-kt/llama-kt/src/main/cpp/CMakeLists.txt
+          echo "Pinned llama.kt native CMake source is present."
+      - name: Install Vulkan shader-generator dependencies
+        run: |
+          set -euo pipefail
+          sudo apt-get update -qq
+          sudo apt-get install -y --no-install-recommends glslc spirv-headers libvulkan-dev ninja-build cmake python3
+          command -v glslc
+      - name: Bootstrap pinned llama.kt Vulkan sources
+        working-directory: vendor/llama-kt
+        run: |
+          set -euo pipefail
+          bash scripts/bootstrap.sh
+          test -s llama-kt/src/main/cpp/ggml-vulkan/ggml-vulkan.cpp
+          test -n "$(find llama-kt/src/main/cpp/ggml-vulkan/shaders -name '*.cpp' -print -quit)"
+      - name: Isolate llama.kt Vulkan backend from llama.rn OpenCL
+        run: |
+          set -euo pipefail
+          node scripts/prepare-llamakt-vulkan.cjs
+          node scripts/check-llamakt-vulkan-cmake.cjs
+          node scripts/verify-llamakt-gradle.cjs
+      - name: Get natural-voice engine (sherpa-onnx)
+        run: |
+          mkdir -p android/app/libs
+          curl --fail --silent --show-error --location --retry 3 --proto '=https' --proto-redir '=https' -o android/app/libs/sherpa-onnx.aar https://github.com/k2-fsa/sherpa-onnx/releases/download/v1.13.7/sherpa-onnx-1.13.7.aar
+          echo "c4ef49e309f24fcee5c106b8a279481aaecaabb078cd37b2cd6e9a62cc8a73c8  android/app/libs/sherpa-onnx.aar" | sha256sum -c -
+          # phones only need 64-bit ARM: drop the other CPU types to keep the APK small
+          zip -q -d android/app/libs/sherpa-onnx.aar 'jni/armeabi-v7a/*' 'jni/x86/*' 'jni/x86_64/*' || true
+          ls -la android/app/libs
+      - name: Require permanent release-signing keystore
+        env:
+          ATLAS_UPLOAD_KEYSTORE_B64: ${{ secrets.KEYSTORE_BASE64 }}
+          ATLAS_UPLOAD_STORE_PASSWORD: ${{ secrets.KEYSTORE_PASSWORD }}
+          ATLAS_UPLOAD_KEY_ALIAS: ${{ secrets.KEY_ALIAS }}
+          ATLAS_UPLOAD_KEY_PASSWORD: ${{ secrets.KEY_PASSWORD }}
+        run: |
+          set -euo pipefail
+          for variable in ATLAS_UPLOAD_KEYSTORE_B64 ATLAS_UPLOAD_STORE_PASSWORD ATLAS_UPLOAD_KEY_ALIAS ATLAS_UPLOAD_KEY_PASSWORD; do
+            if [ -z "${!variable}" ]; then
+              echo "::error::Missing required release-signing secret: $variable"
+              exit 1
+            fi
+          done
+          umask 077
+          printf '%s' "$ATLAS_UPLOAD_KEYSTORE_B64" | base64 --decode > android/app/atlas-upload-keystore.p12
+          test -s android/app/atlas-upload-keystore.p12
+          keytool -list -keystore android/app/atlas-upload-keystore.p12 \
+            -storetype PKCS12 -storepass:env ATLAS_UPLOAD_STORE_PASSWORD \
+            -alias "$ATLAS_UPLOAD_KEY_ALIAS" >/dev/null
+          keytool -exportcert -keystore android/app/atlas-upload-keystore.p12 \
+            -storetype PKCS12 -storepass:env ATLAS_UPLOAD_STORE_PASSWORD \
+            -alias "$ATLAS_UPLOAD_KEY_ALIAS" | sha256sum | awk '{print $1}' > android/app/signing-cert.sha256
+      - name: Build release APK
+        working-directory: android
+        env:
+          OFFGRID_UPLOAD_STORE_FILE: atlas-upload-keystore.p12
+          OFFGRID_UPLOAD_STORE_PASSWORD: ${{ secrets.KEYSTORE_PASSWORD }}
+          OFFGRID_UPLOAD_KEY_ALIAS: ${{ secrets.KEY_ALIAS }}
+          OFFGRID_UPLOAD_KEY_PASSWORD: ${{ secrets.KEY_PASSWORD }}
+        run: |
+          set -o pipefail
+          ./gradlew assembleRelease -PatlasRequireReleaseSigning=true -PreactNativeArchitectures=arm64-v8a --no-daemon 2>&1 | tee ../gradle.log || {
+            grep -E "^e: |error:|What went wrong|Could not|Execution failed|Unresolved|Duplicate|Manifest merger|Attribute |Suggestion|> Task .*FAILED|Caused by" ../gradle.log | grep -v "^w: " | head -40 | while IFS= read -r l; do echo "::error::$l"; done
+            exit 1
+          }
+      - name: Verify release native runtime
+        run: |
+          APK=android/app/build/outputs/apk/release/app-release.apk
+          test -f "$APK"
+          unzip -l "$APK" > apk-contents.txt
+          grep -q 'lib/arm64-v8a/librnllama.so' apk-contents.txt
+          grep -q 'lib/arm64-v8a/librnllama_v8.so' apk-contents.txt
+          grep -q 'lib/arm64-v8a/librnllama_v8_2.so' apk-contents.txt
+          node -e "const p=require('./node_modules/llama.rn/package.json'); if(p.version!=='0.13.0-rc.4') { console.error('Unexpected llama.rn version:',p.version); process.exit(1) } console.log('Verified llama.rn',p.version)"
+          echo "Verified Atlas release contains the ARM64 llama.rn native runtime."
+          APKSIGNER="$ANDROID_SDK_ROOT/build-tools/$(ls "$ANDROID_SDK_ROOT/build-tools" | sort -V | tail -1)/apksigner"
+          "$APKSIGNER" verify --verbose --print-certs "$APK"
+          # Confirm exact GitHub keystore identity, rejecting other valid certificates.
+          expected_cert_sha="$(cat android/app/signing-cert.sha256)"
+          actual_cert_sha="$("$APKSIGNER" verify --print-certs "$APK" |
+            sed -nE 's/^.*certificate SHA-256 digest:[[:space:]]*([[:xdigit:]]{64})[[:space:]]*$/\1/p' | head -1)"
+          if [ -z "$expected_cert_sha" ] || [ -z "$actual_cert_sha" ] ||
+             [ "${expected_cert_sha,,}" != "${actual_cert_sha,,}" ]; then
+            echo "::error::APK signing certificate does not match the configured release keystore"
+            exit 1
+          fi
+          echo "::notice title=Signing verified::APK certificate matches configured GitHub release key"
+      - name: Rename APK
+        run: |
+          mkdir -p out
+          cp android/app/build/outputs/apk/release/app-release.apk out/Atlas-${{ github.run_number }}.apk
+      - uses: actions/upload-artifact@v4
+        with:
+          name: Atlas-apk
+          path: out/*.apk
+      - name: Publish release (stable branch only)
+        if: github.ref == 'refs/heads/atlas-voice'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          gh release create atlas-${{ github.run_number }} out/*.apk --latest \
+            --target ${{ github.sha }} --title "Atlas build ${{ github.run_number }}" \
+            --notes "Install this APK on your Android phone or tablet (download it, open it, allow installing from this source)."

.github/workflows/atlas-core-audit.yml

@@ -0,0 +1,36 @@
+name: Atlas Core Audit
+
+on:
+  pull_request:
+  workflow_dispatch:
+  push:
+    branches:
+      - atlas-voice
+      - 'audit/**'
+
+permissions:
+  contents: read
+
+concurrency:
+  group: atlas-core-audit-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  core:
+    name: TypeScript and Jest
+    runs-on: ubuntu-latest
+    timeout-minutes: 35
+    steps:
+      - uses: actions/checkout@v5
+      - uses: actions/setup-node@v5
+        with:
+          node-version: '24'
+          cache: npm
+      - name: Install dependencies without native Android SDK
+        run: npm ci --ignore-scripts
+      - name: Apply audited dependency patches
+        run: ./node_modules/.bin/patch-package
+      - name: Type check
+        run: ./node_modules/.bin/tsc --noEmit -p .
+      - name: Run all available core regression tests
+        run: ./node_modules/.bin/jest --runInBand --forceExit --coverage=false --silent