Add dependency-free Linux support and portable schema integrity

.github/workflows/linux.yml

@@ -0,0 +1,53 @@
+name: Linux CI
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+permissions:
+  contents: read
+concurrency:
+  group: linux-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+jobs:
+  qualification:
+    name: Linux / ${{ matrix.architecture }} / ${{ matrix.lane }}
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 60
+    strategy:
+      fail-fast: false
+      matrix:
+        lane: [linux, linux-safety]
+        architecture: [x86_64, arm64]
+        include:
+          - architecture: x86_64
+            runner: ubuntu-24.04
+          - architecture: arm64
+            runner: ubuntu-24.04-arm
+    container:
+      # Official Swift 6.4.0 Ubuntu 24.04 multi-architecture OCI index.
+      image: swift@sha256:31d14d727f4451f25e29bac9c42563a098c39ac66415e8bad970f48038e38aca
+    env:
+      PYTHONDONTWRITEBYTECODE: '1'
+    steps:
+      - name: Install the CI harness interpreter
+        run: |
+          apt-get update
+          apt-get install --yes --no-install-recommends python3
+          python3 --version
+          dpkg-query --show python3 python3-minimal
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        with:
+          persist-credentials: false
+          fetch-depth: 0
+      - run: python3 -B Scripts/ci.py --lane '${{ matrix.lane }}'
+      - name: Preserve Linux receipts
+        if: always()
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+        with:
+          name: linux-${{ matrix.architecture }}-${{ matrix.lane }}
+          if-no-files-found: error
+          retention-days: 30
+          path: |
+            .build/ci/
+            !.build/ci/**/reproduction/extracted/**

CONTRIBUTING.md

@@ -19,6 +19,10 @@ python3 Scripts/ci.py --lane safety
 python3 Scripts/ci.py --lane docs
 ```
 
+For Linux changes also run `python3 Scripts/ci.py --lane linux` and
+`--lane linux-safety` on an actual Swift 6.4+ Ubuntu 24.04/glibc runtime.
+Linux results supplement the Apple gates; see the [platform contract](Documentation/Architecture/Linux.md).
+
 Keep APIs neutral and exact, budgets cumulative and mutable state invocation-owned.
 Do not add platforms, permissive parsing, online schema resolution, fallback engines
 or runtime dependencies without an explicit design review. Benchmark and fixture

Documentation/Architecture/ExtractionManifest.json

@@ -193,7 +193,8 @@
   "original_implementation_notes": [
     "JSONNumber.swift reference reviewed; new bounded decimal storage and conversions written without copying upstream numeric implementation.",
     "Native codec, Codable, Pointer, Patch and streaming are original implementations from the integrated contract, not automatically attributed to candidates.",
-    "Schema graph, explicit evaluator, exact sets/assertions and scalar format recognizers are original implementations from Draft 2020-12, RFC3986/3987/3339/3492/5321/5891/5892/5893/6531/6570/6901 and fixed Unicode13 data."
+    "Schema graph, explicit evaluator, exact sets/assertions and scalar format recognizers are original implementations from Draft 2020-12, RFC3986/3987/3339/3492/5321/5891/5892/5893/6531/6570/6901 and fixed Unicode13 data.",
+    "Private FIPS 180-4 SHA-256 is an original Swift implementation with checked cumulative production accounting, bounded scratch and inner cancellation. The separate trusted fixture tool mirrors its primitive core byte-for-byte; public_check verifies parity. No CryptoKit fallback or runtime dependency is introduced."
   ],
   "policy": "Record actual adaptations and retain applicable upstream copyrights and licenses. Reference inputs and comparison experiments are not distributed runtime dependencies."
 }

Documentation/Architecture/Linux.md

@@ -0,0 +1,70 @@
+# Linux platform contract
+
+This additive development branch prepares all four public products for 64-bit
+Linux with Swift tools/compiler 6.4+ and Swift language mode 6. Initial execution
+qualification targets Ubuntu 24.04 with glibc on ARM64 and x86_64. A platform
+preflight identifies the actual runtime; cross-compilation alone cannot qualify
+behavior or safety. Architecture-specific receipts must pass before claiming
+that architecture qualified. Apple minimums remain macOS/SDK 27 and iOS/SDK 27.
+
+The root manifest keeps an empty dependency graph and the same four products.
+Linux does not need a SwiftPM deployment-platform entry. Foundation file/resource
+access remains platform infrastructure; JSON semantics come from the package's
+strict codec, exact decimal model and decoded scalar identity.
+
+## Portable schema integrity
+
+Packaged Draft 2020-12 resources retain their nine exact byte sizes and SHA-256
+pins. An original package-private FIPS 180-4 SHA-256 implementation replaces
+CryptoKit. It exposes no cryptography API or product and has no external dependency.
+There is one implementation on Apple and Linux, with no alternate engine.
+
+Schema loading passes its active cumulative compilation meter into hashing.
+Byte ingestion, schedule expansion, compression rounds and hex output charge
+work before execution and check cancellation at the configured quantum.
+336 logical scratch bytes are admitted before state/schedule allocation, then
+128 bytes cover the simultaneous hex buffer and returned string. Scratch is
+released after success, operational rejection or cancellation; callers account
+for the 64-byte returned digest until releasing it. These weights describe logical
+retention, not process RSS, allocator metadata or cryptographic throughput.
+Standard UInt32 wrapping arithmetic implements SHA-256; resource counters remain
+checked UInt64 arithmetic. Integrity mismatch is a compilation failure; exhausted
+quotas and cancellation remain operational errors.
+
+Independent Python hashlib vectors cover 24 deterministic lengths around padding
+and block boundaries. Standard empty/abc/56-byte/million-a answers, cumulative
+N/N-1 work, scratch admission, input quota, quantum, cancellation, corruption and
+concurrent invocation cases supplement the unchanged schema and Unicode corpora.
+The trusted qualification executable mirrors the core byte for byte, enforced
+by the public inventory check. Its fixture hashing is harness work; library
+operations always use the real checked meter.
+
+## Qualification boundary
+
+Run `python3 Scripts/ci.py --lane linux` and `--lane linux-safety` on the Linux
+runtime. These preserve exact test discovery, all 49 cap probes, both pinned
+independent suites, authored replay and the 20 explicitly rooted public consumer
+cases. SwiftData examples and Apple SDK/compiler ownership probes remain in the
+Apple lanes; they do not become Linux evaluated successes. DocC qualification
+continues on the supported Mac toolchain.
+
+The pinned Swift 6.4 Linux runtime leaks from an empty XCTest runner and
+Foundation's `Data(contentsOf:)` empty-file read. Isolated sanitizer probes
+reproduce both with no JSON imports. Linux safety starts only Swift Testing
+(all 180 functions and 173 invocations remain) and trusted fixture I/O uses
+explicitly closed FileHandle reads, including the zero-byte JSON rejection case.
+Address/Leak Sanitizer and Thread Sanitizer remain enabled without suppressions.
+Diagnostic upstream failures are recorded separately from package behavior.
+
+On Linux the public consumer resolves its copied Resources directory relative to
+bundleURL; Foundation can already point resourceURL into that directory. Apple
+uses resourceURL so it retains the platform's bundle Contents layout. Both layouts
+retain the same frozen definition/vector bytes and all 20 explicitly rooted cases.
+Linux qualification also verifies a byte-equal source archive, extracts it into a
+clean directory, builds all products and executes six integrity/resource cases
+and the four-product public consumer from that extracted source.
+
+WebAssembly, browser hosting, other distributions, musl deployment and 32-bit
+profile calibration require separate qualification. This change adds none of
+those claims. The concurrent schema-builder accounting change is a separate
+integration dependency; this branch preserves its base implementation untouched.

Documentation/CI/README.md

@@ -43,3 +43,18 @@ streaming regression is documented in ../Performance/README.md.
 
 Run locally with `python3 Scripts/ci.py --lane native`, `--lane safety` or `--lane docs`.
 The first hosted result must be inspected before marking CI qualified.
+
+## Linux development lanes
+
+The additive Linux workflow selects the pinned official Swift 6.4.0 Ubuntu 24.04
+multi-architecture image on ARM64 and x86_64 hosted runners. It runs `linux` and
+`linux-safety` with separate runtime preflight, source receipts and exact test,
+consumer, corpus and 49-cap discovery checks. SwiftData/Apple compiler probes
+remain in Native CI. The existing required `Native / native`, `Native / safety`
+and `Native / docs` names and protection settings are preserved. This workflow
+does not publish artifacts to a release or deploy documentation.
+
+Local ARM64 VM execution qualifies its observed Linux environment; an unexecuted
+x86_64 job is pending evidence. Workflow preparation does not establish hosted
+success. Read the [Linux contract](../Architecture/Linux.md) before extending
+distribution, architecture or libc claims.

Documentation/Qualification/LimitsMatrix.json

@@ -59,6 +59,10 @@
           "path": "Sources/JSONStreaming/NDJSON/NDJSONValueSequence.swift",
           "line": 41,
           "code": "try input.meter.require(.inputBytes, UInt64(line.count) + 1); try input.meter.retain(1); line.append(byte)"
+        },
+        {
+          "path": "Sources/JSON/Integrity/JSONSHA256Core.swift",
+          "owner": "SHA-256 production JSONWorkMeter context; bounded input, scratch, padding/schedule/compression and output"
         }
       ],
       "public_probe_outcome": "limitExceeded",
@@ -834,6 +838,10 @@
           "path": "Sources/JSONSchema/Formats/JSONSchemaFormats.swift",
           "line": 22,
           "code": "try meter.release(meter.used(.retainedBytes)-before); return true"
+        },
+        {
+          "path": "Sources/JSON/Integrity/JSONSHA256Core.swift",
+          "owner": "SHA-256 production JSONWorkMeter context; bounded input, scratch, padding/schedule/compression and output"
         }
       ],
       "public_probe_outcome": "limitExceeded",
@@ -864,6 +872,10 @@
           "path": "Sources/JSON/Limits/JSONWorkMeter.swift",
           "line": 114,
           "code": "counters[JSONResourceMetric.workUnits.index] = total"
+        },
+        {
+          "path": "Sources/JSON/Integrity/JSONSHA256Core.swift",
+          "owner": "SHA-256 production JSONWorkMeter context; bounded input, scratch, padding/schedule/compression and output"
         }
       ],
       "public_probe_outcome": "limitExceeded",
@@ -1254,6 +1266,10 @@
           "path": "Sources/JSON/Limits/JSONLimits.swift",
           "line": 138,
           "code": "Validate quantum in 1...1024 before invocation."
+        },
+        {
+          "path": "Sources/JSON/Integrity/JSONSHA256Core.swift",
+          "owner": "SHA-256 production JSONWorkMeter context; bounded input, scratch, padding/schedule/compression and output"
         }
       ],
       "public_probe_outcome": "invalidLimits",
@@ -1394,6 +1410,10 @@
           "path": "Sources/JSON/Limits/JSONWorkMeter.swift",
           "line": 102,
           "code": "case .schemaCompilation: domainMetric = .compileWorkUnits"
+        },
+        {
+          "path": "Sources/JSON/Integrity/JSONSHA256Core.swift",
+          "owner": "SHA-256 production JSONWorkMeter context; bounded input, scratch, padding/schedule/compression and output"
         }
       ],
       "public_probe_outcome": "limitExceeded",
@@ -1429,6 +1449,10 @@
           "path": "Sources/JSON/Limits/JSONWorkMeter.swift",
           "line": 145,
           "code": "counters[JSONResourceMetric.compiledPlanBytes.index] -= bytes"
+        },
+        {
+          "path": "Sources/JSON/Integrity/JSONSHA256Core.swift",
+          "owner": "SHA-256 production JSONWorkMeter context; bounded input, scratch, padding/schedule/compression and output"
         }
       ],
       "public_probe_outcome": "limitExceeded",

Documentation/Qualification/README.md

@@ -5,6 +5,13 @@ Each receipt identifies the source content, command exits and environment. CI
 artifacts contain raw logs, consumer outcomes and per-case corpus results.
 Safety and DocC lanes run separately. Unsupported hosts fail preflight.
 
+The Linux development increment adds four private integrity tests and one schema
+integrity test: exactly 180 root functions (JSON 101, JSONSchema 42, regex 12,
+streaming 14, Patch 11) with the 173 parameterized invocations retained. Targeted
+shared-state safety adds the sixth function for concurrent hashing. Historical
+counts below remain the receipts for their original stages. The
+[Linux contract](../Architecture/Linux.md) defines the separate runtime lanes.
+
 The 1.0 baseline has 122 Swift Testing functions across five bundles and
 173 parameterized invocations. The first 1.1 qualification milestone adds seven
 authored prototype cases in JSONTests (54 to 61), for 129 functions, with the existing 173 parameterized invocations retained
@@ -38,6 +45,13 @@ exact keys/numbers/order, separate compilation and callback replacement of the
 invocation ledger. The four-product external
 consumer also checks the 150-unit composed-budget regression.
 
+Integrating Linux support with that fix retains all nine builder cases and all
+five integrity cases: exactly 189 root functions (JSON 101, JSONSchema 51,
+JSONRegexRuntime 12, JSONStreaming 14, JSONPatch 11), 173 parameterized invocations
+and six shared-state safety functions. Both Linux architectures and the three
+Apple lanes qualify this combined source; historical counts above remain tied to
+their original snapshots.
+
 | Independent input | Observed policy |
 | --- | --- |
 | JSONTestSuite, pinned in FixtureRegistry.json | 318 discovered: 101 accepted, 186 rejected, 31 strict/finite-policy rejections |

Documentation/README.md

@@ -29,6 +29,7 @@ Compiled archives and public symbol graphs remain available in CI artifacts.
 - [Strict streaming and certified completion](Architecture/Streaming.md)
 - [Pointer, JSON Patch and Merge Patch](Architecture/Patch.md)
 - [Concurrency, cancellation and caller-work boundaries](Architecture/Concurrency.md)
+- [Linux platform and portable schema integrity](Architecture/Linux.md)
 
 ## Consumers, qualification and maintenance
 

README.md

@@ -70,6 +70,11 @@ Choose the products your application needs:
 SwiftPM dependency graph is empty. Qualification and benchmark tools are separate
 packages.
 
+The Linux development branch adds portable schema integrity for all four products
+without runtime dependencies. Its initial qualification scope is Swift 6.4+,
+64-bit Ubuntu 24.04/glibc; see the [Linux contract](Documentation/Architecture/Linux.md)
+for execution gates and limits. Apple platform requirements remain unchanged.
+
 ## Installation
 
 Add the package to your `Package.swift`:

Scripts/README.md

@@ -9,6 +9,9 @@ separate from the dependency-free library. Native lanes fail on unsupported host
 | `python3 Scripts/preflight.py` | Actual native OS/compiler/SDK receipt |
 | `python3 Scripts/ci.py --lane native` | Manifests, builds, Swift Testing, consumers and suites |
 | `python3 Scripts/ci.py --lane safety` | Address/Thread Sanitizer and strict memory safety |
+| `python3 Scripts/ci.py --lane linux` | Actual Linux preflight, all four products, exact root/cap/corpus/consumer counts |
+| `python3 Scripts/ci.py --lane linux-safety` | Linux Address/Thread Sanitizer and strict memory safety |
+| `python3 Scripts/qualify_linux_reproduction.py --output PATH` | Actual source archive, byte-equal rebuild, clean extraction, build/tests and public consumer |
 | `python3 Scripts/ci.py --lane docs` | Four DocC catalogs, authored API/parameter coverage, executed README examples and verified static Pages site |
 | `python3 Scripts/build_documentation_site.py` | Transform already-qualified DocC archives and verify static routes/assets |
 | `python3 Scripts/qualification_watchdog.py --timeout 900 --output PATH -- COMMAND` | Process-group timeout and native receipt |