수정: 교차 플랫폼 릴리스 게이트 복구

스킬 자원 해시를 줄바꿈에 독립적으로 만들고 준비형 자산 경계를 명시했다.
공식 CPython 소스 잠금과 Pages COI 부트스트랩을 현재 배포 계약에 맞췄다.
검증: npm test, 계약 36개, 무헤더 예제 10개, 스킬 및 repoGraph 게이트

Author: eddmpython

.github/workflows/pages.yml

@@ -1,7 +1,6 @@
 # GitHub Pages 데모 배포. 빌드 없음(네이티브 ESM): 저장소 파일을 그대로 조립해 올린다.
-# GH Pages는 응답 헤더를 못 달지만 실측으로 경로를 확보했다(pythonMachine 캠페인):
-#   - SAB 없는 데모(machine/terminal/basic)는 헤더 없이 그대로 돈다(noCoiProbe 7/7).
-#   - SAB 필요한 processOs는 pyprocSw(?coi=1) 헤더 주입 + 1회 새로고침으로 연다(swCoiProbe 4/4).
+# GH Pages는 응답 헤더를 직접 달 수 없으므로 데모 전용 Service Worker가 COOP, COEP를
+# 주입하고 첫 방문에 한 번만 다시 연다. 패키지 소비자는 README의 서버 헤더 계약을 따른다.
 name: pages
 
 on:
@@ -33,18 +32,18 @@ jobs:
       # 의존성 0이라 여기서 도는 비용이 거의 없다(브라우저 게이트는 ci job이 본다).
       - run: npm ci
       - run: npm test
-      - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
-        with:
-          path: vendor/pyodide
-          key: pyodide-${{ hashFiles('src/runtime/pyodideDistribution.js', 'scripts/assetCatalog.json') }}
-      - run: npm run fetch:engine
-      - name: 데모 사이트 조립 (예제 + 라이브러리 + 브랜드 자산 + SW 루트 사본 + 랜딩 루트 승격)
+      - name: GitHub Pages 무헤더 환경에서 데모 COI 부트스트랩 검증
+        run: npm run test:examples
+        env:
+          PYPROC_BROWSER: /usr/bin/google-chrome
+          PYPROC_NO_COI: "1"
+      - name: 데모 사이트 조립 (예제 + 소유 엔진 + 브랜드 자산 + COI 진입점 + 랜딩 루트 승격)
         run: |
           mkdir -p _site
           # assets: 파비콘·헤더 로고가 참조하는 브랜드 마크 정본(랜딩은 assets/, 예제는 ../assets/).
-          cp -r examples src assets vendor _site/
+          cp -r examples src assets _site/
           cp index.js index.d.ts LICENSE _site/
-          cp src/capabilities/pyprocSw.js _site/pyprocSw.js
+          cp coiServiceWorker.js _site/coiServiceWorker.js
           # 랜딩은 examples/index.html이 정본이고 배포 루트로 승격된다(상대 경로가 루트 기준).
           mv _site/examples/index.html _site/index.html
       - uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3

coiServiceWorker.js

@@ -0,0 +1,22 @@
+// coiServiceWorker.js - 정적 데모 응답에 cross-origin isolation 헤더를 붙인다.
+
+self.addEventListener("install", () => self.skipWaiting());
+self.addEventListener("activate", (event) => event.waitUntil(self.clients.claim()));
+
+self.addEventListener("fetch", (event) => {
+  if (event.request.method !== "GET") return;
+  event.respondWith(fetch(event.request).then((response) => {
+    if (response.type === "opaque" || response.type === "opaqueredirect" || response.status === 0) return response;
+    const headers = new Headers(response.headers);
+    if (["document", "worker", "sharedworker"].includes(event.request.destination)) {
+      headers.set("Cross-Origin-Opener-Policy", "same-origin");
+      headers.set("Cross-Origin-Embedder-Policy", "require-corp");
+    }
+    headers.set("Cross-Origin-Resource-Policy", "cross-origin");
+    return new Response(response.body, {
+      status: response.status,
+      statusText: response.statusText,
+      headers,
+    });
+  }));
+});

examples/coiBootstrap.js

@@ -0,0 +1,30 @@
+// coiBootstrap.js - GitHub Pages 데모만 위한 첫 방문 COI 부트스트랩.
+
+const RELOAD_MARKER = "pyprocCoiReload";
+
+export async function ensureCrossOriginIsolation() {
+  if (globalThis.crossOriginIsolated && typeof globalThis.SharedArrayBuffer === "function") {
+    sessionStorage.removeItem(RELOAD_MARKER);
+    return Object.freeze({ ready: true, source: "headers" });
+  }
+  if (!("serviceWorker" in navigator)) {
+    throw new Error("This demo needs cross-origin isolation and Service Worker support.");
+  }
+  const script = new URL("../coiServiceWorker.js", import.meta.url);
+  const scope = new URL("../", import.meta.url);
+  await navigator.serviceWorker.register(script, { scope: scope.pathname });
+  await navigator.serviceWorker.ready;
+  if (!navigator.serviceWorker.controller) {
+    if (sessionStorage.getItem(RELOAD_MARKER) === "1") {
+      throw new Error("The demo Service Worker did not take control after reload.");
+    }
+    sessionStorage.setItem(RELOAD_MARKER, "1");
+    location.reload();
+    await new Promise(() => {});
+  }
+  if (!globalThis.crossOriginIsolated || typeof globalThis.SharedArrayBuffer !== "function") {
+    throw new Error("The controlled demo page is not cross-origin isolated.");
+  }
+  sessionStorage.removeItem(RELOAD_MARKER);
+  return Object.freeze({ ready: true, source: "serviceWorker" });
+}

examples/heroConsole.js

@@ -1,4 +1,7 @@
 // heroConsole.js - live landing proof built only on the public owned-kernel API.
+import { ensureCrossOriginIsolation } from "./coiBootstrap.js";
+
+await ensureCrossOriginIsolation();
 
 const PROMPT = '<span class="ok">&gt;&gt;&gt;</span>';
 const dim = (text) => `<span class="dim">${text}</span>`;

examples/ownedDemo.js

@@ -1,5 +1,8 @@
+import { ensureCrossOriginIsolation } from "./coiBootstrap.js";
 import { boot, open } from "../index.js";
 
+await ensureCrossOriginIsolation();
+
 const output = document.getElementById("output");
 const status = document.getElementById("status");
 const runButton = document.getElementById("run");

scripts/engineBuilder/engineBuildLock.json

@@ -7,8 +7,8 @@
     "version": "3.14.6",
     "tagObject": "8594736f5057fdc979d42d2135895d56274589a8",
     "commit": "c63aec69bd59c55314c06c23f4c22c03de76fe45",
-    "url": "https://api.github.com/repos/python/cpython/tarball/c63aec69bd59c55314c06c23f4c22c03de76fe45",
-    "archiveSha256": "c6b8133e056dd5992782b84eb7269a9ac7402f4c35b2f8ecd333cba9fc630d41"
+    "url": "https://www.python.org/ftp/python/3.14.6/Python-3.14.6.tgz",
+    "archiveSha256": "74d0d71d0600e477651a077101d6e62d1e2e69b8e992ba18c993dd643b7ba222"
   },
   "wasiSdk": {
     "version": "24.0",

scripts/skillOs/common.mjs

@@ -1,5 +1,10 @@
 import { createHash } from "node:crypto";
-import { isAbsolute, relative, resolve, sep } from "node:path";
+import { extname, isAbsolute, relative, resolve, sep } from "node:path";
+
+const PORTABLE_TEXT_EXTENSIONS = new Set([
+  ".css", ".html", ".js", ".json", ".jsonl", ".md", ".mjs", ".py", ".sh", ".toml", ".txt", ".yaml", ".yml",
+]);
+const UTF8 = new TextDecoder("utf-8", { fatal: true });
 
 export class SkillOsError extends Error {
   constructor(code, message, context = {}) {
@@ -15,6 +20,15 @@ export const utf8Compare = (left, right) => Buffer.from(String(left)).compare(Bu
 export const slash = (value) => String(value).replaceAll("\\", "/");
 export const canonicalJson = (value) => `${JSON.stringify(value, null, 2)}\n`;
 
+export function portableResourceBytes(path, bytes) {
+  const source = Buffer.from(bytes);
+  if (!PORTABLE_TEXT_EXTENSIONS.has(extname(String(path)).toLowerCase())) return source;
+  let text;
+  try { text = UTF8.decode(source); }
+  catch (error) { throw new SkillOsError("SKILL_STRUCTURE_INVALID", `text resource is not valid UTF-8: ${path}`, { cause: error }); }
+  return Buffer.from(text.replaceAll("\r\n", "\n").replaceAll("\r", "\n"));
+}
+
 export function containedPath(root, relativePath, code = "SKILL_REFERENCE_ESCAPE") {
   const text = String(relativePath || "");
   if (!text || isAbsolute(text) || /^[A-Za-z]:/u.test(text) || text.startsWith("\\\\")

scripts/skillOs/skillParser.mjs

@@ -1,7 +1,7 @@
 import { lstat, readFile, realpath, readdir } from "node:fs/promises";
 import { basename, dirname, relative, resolve } from "node:path";
 
-import { SkillOsError, containedPath, sha256, slash, stableName, utf8Compare } from "./common.mjs";
+import { SkillOsError, containedPath, portableResourceBytes, sha256, slash, stableName, utf8Compare } from "./common.mjs";
 
 const BODY_LIMIT = 96 * 1024;
 const REFERENCE_LIMIT = 256 * 1024;
@@ -112,7 +112,8 @@ async function resourceFiles(skillRoot, folder, limit) {
         if ((folder === "references" || folder === "scripts" || folder === "agents") && bytes.includes(0)) {
           fail("SKILL_STRUCTURE_INVALID", `text resource contains NUL: ${relativePath}`);
         }
-        output.push(Object.freeze({ path: relativePath, bytes: bytes.byteLength, sha256: sha256(bytes) }));
+        const portable = portableResourceBytes(relativePath, bytes);
+        output.push(Object.freeze({ path: relativePath, bytes: portable.byteLength, sha256: sha256(portable) }));
       }
     }
   }
@@ -131,6 +132,7 @@ export async function parseSkill(skillPath, { skillsRoot = dirname(skillPath) }
   try { text = TEXT_DECODER.decode(bytes); }
   catch { fail("SKILL_STRUCTURE_INVALID", "SKILL.md is not valid UTF-8"); }
   text = text.replaceAll("\r\n", "\n").replaceAll("\r", "\n");
+  const portable = Buffer.from(text);
   const frontmatter = parseFrontmatter(text);
   if (!stableName(frontmatter.name)) fail("SKILL_FRONTMATTER_INVALID", `invalid skill name: ${frontmatter.name}`);
   if (frontmatter.name !== basename(directory)) fail("SKILL_NAME_MISMATCH", `${frontmatter.name} does not match ${basename(directory)}`);
@@ -149,8 +151,8 @@ export async function parseSkill(skillPath, { skillsRoot = dirname(skillPath) }
   ]);
   if (references.length > 8) fail("SKILL_RESOURCE_LIMIT", "a skill may declare at most eight direct references");
   return Object.freeze({ name: frontmatter.name, description: frontmatter.description,
-    path: slash(relative(resolve(skillsRoot), path)), sourcePath: path, bytes: bytes.byteLength,
-    sha256: sha256(bytes), normalizedSha256: sha256(Buffer.from(text)), headings,
+    path: slash(relative(resolve(skillsRoot), path)), sourcePath: path, bytes: portable.byteLength,
+    sha256: sha256(portable), normalizedSha256: sha256(portable), headings,
     references, scripts, assets, agents });
 }
 

scripts/skillOs/skillReader.mjs

@@ -1,7 +1,7 @@
 import { lstat, readFile, realpath } from "node:fs/promises";
 import { dirname, relative, resolve } from "node:path";
 
-import { SkillOsError, containedPath, sha256, slash } from "./common.mjs";
+import { SkillOsError, containedPath, portableResourceBytes, sha256, slash } from "./common.mjs";
 import { findCatalogSkill, readSkillCatalog } from "./skillCatalog.mjs";
 
 const BODY_LIMIT = 96 * 1024;
@@ -50,7 +50,8 @@ export async function readSkillResource(skillsRoot, catalog, request) {
   }
   const limit = declared.kind === "body" ? BODY_LIMIT : REFERENCE_LIMIT;
   if (stat.size > limit) throw new SkillOsError("SKILL_RESOURCE_LIMIT", `${relativePath} exceeds read limit`);
-  const bytes = await readFile(path);
+  const sourceBytes = await readFile(path);
+  const bytes = portableResourceBytes(relativePath, sourceBytes);
   if (bytes.byteLength !== declared.bytes || sha256(bytes) !== declared.sha256) {
     throw new SkillOsError("SKILL_READ_STALE", `resource bytes do not match catalog: ${relativePath}`);
   }

skills/catalog.json

@@ -1,8 +1,8 @@
 {
   "format": "pyproc-skill-catalog",
   "version": 1,
-  "generatedFromDigest": "sha256:3700caf89256d04ac10458b34761ca874c11324a59279a67c77786ee61e4c627",
-  "catalogDigest": "sha256:3050266485b8f8473d1f988db32a6229d3b166e952c63f76d0631c9acf0a8e1f",
+  "generatedFromDigest": "sha256:98821f660c60b50575bba6710700605cf17f687c215785021159b62f95174be3",
+  "catalogDigest": "sha256:02b3fcd7d7f3af12ed97f74ade8f8912c1b0ef72b3b4ed08c6c0cf7683cd9890",
   "skills": [
     {
       "name": "automate-browser-with-pyproc",
@@ -349,8 +349,8 @@
     },
     {
       "path": "skills/ship-pyproc/references/demo-hosting.md",
-      "bytes": 765,
-      "sha256": "sha256:293510dad4f0261ad44ab0748f2ddf419aca42887c3967e358ca8fbc00ce9f52"
+      "bytes": 1132,
+      "sha256": "sha256:36e2122cdb3c06b93f2b91375cabf9c271691977d096f005ad6ccb7a805b0ced"
     },
     {
       "path": "skills/ship-pyproc/references/release.md",