refactor(build): migrate construction and qualification to native Bazel

.bazelignore

@@ -0,0 +1,5 @@
+.git
+target
+.moon
+.proto
+.venv

.bazelrc

@@ -0,0 +1,33 @@
+# Keep local executions independent from hosted cache or execution configuration.
+startup --max_idle_secs=300
+startup --shutdown_on_low_sys_mem
+startup --host_jvm_args=-Xmx2048m
+common --repo_env=DO_NOT_TRACK=1
+common --lockfile_mode=error
+build --incompatible_strict_action_env
+build --verbose_failures
+# Compiler and quality tools use the runtime acquired by pinned rules_java.
+build --java_runtime_version=remotejdk_17
+build --tool_java_runtime_version=remotejdk_17
+test --test_output=errors
+
+# Cross-platform runtime tests need manifest or directory runfiles.
+# Windows native file symlinks require Developer Mode or administrator privileges.
+startup --windows_enable_symlinks
+build --enable_runfiles
+
+# Native C++ links need the allocator ABI generated by the selected Rust compiler.
+build --@rules_rust//rust/settings:experimental_use_allocator_libraries_with_mangled_symbols=true
+
+# Native Clippy checks use the same configuration as conventional Cargo checks.
+build --@rules_rust//rust/settings:clippy.toml=//:clippy.toml
+build --@rules_rust//rust/settings:clippy_flags=-Dwarnings
+
+# Darwin sandbox reuse otherwise traverses the complete SDK forest per action.
+build:macos-sandbox --experimental_inmemory_sandbox_stashes
+
+# The LLVM serializer runs on Linux; serialized product targets remain separate.
+build:wasix-aot --extra_execution_platforms=//build_defs/wasix:llvm_serializer_linux_x86_64
+
+# Optional CI disk cache: callers supply an absolute --disk_cache path.
+build:ci-cache --experimental_remote_merkle_tree_cache

.bazelversion

@@ -0,0 +1 @@
+8.8.1

.codex/skills/release-oliphaunt/SKILL.md

@@ -11,19 +11,17 @@ The `publish` operation prepares the complete candidate once, conditionally
 runs frozen installed consumers, requires Publication ready, bootstraps missing names, and publishes it. Dependent jobs install the same
 immutable candidate and verify its complete contents against the lock.
 
-Qualification may be exhaustive or selected through CI's
-`release_products_json` input with every platform selector at `all`. The
-existing candidate record binds product scope, required tasks and exact SHA;
-publication rejects a product outside that scope. Generated release PRs and
-their main merge derive scope automatically from the actual manifest transition;
-only main push or eligible main dispatch can produce publishable evidence.
-Publication first reuses covering completed CI or awaits an active main/requested
-run. If none exists, a separate dispatch-only job requests CI for the selected
-products, provided main still equals the exact candidate SHA. Failed causal
-runs stop with their URL; resume by rerunning that run. An ambiguous dispatch
-is never retried automatically. Pre-publication recovery may reuse an explicit
-exact-source CI run after allowlisted release-control fixes; source and binary
-identities remain unchanged.
+Native qualification records configured shipping roots, required tests and
+original final archives for the exact source SHA/tree and producing Actions
+run. Preparation requires complete product/platform coverage before choosing
+release scope. Generated release PR qualification imports its source-bound
+Prepare inputs; an ordinary source run imports one immutable public-input pool.
+Only exact-main qualification can admit publication. PR evidence remains
+construction evidence. Publication reuses authenticated original files and
+rejects missing, failed or wrong-source coverage. Pre-publication recovery may
+reuse an explicit exact-source run after allowlisted release-control fixes;
+source and binary identities remain unchanged. During migration, legacy CI is
+retained for parity until the complete native run and seed adoption anchor pass.
 
 Local checks use `bash tools/release/release-check.sh` for source
 metadata/release-tool tests and `bash tools/release/release-check-registries.sh
@@ -72,11 +70,12 @@ and do not treat target/ecosystem carriers as additional products.
    solo-release blocker. The bootstrap job still checks required credentials
    against the approved lock immediately before it publishes.
 7. Generate trusted-publisher work from the approved publication lock with `bash tools/release/trusted-publisher-config.sh`. Its default mode is offline/read-only. Use authenticated `--audit` before considering `--apply`; mutation additionally requires the exact printed lock digest. Run npm audit and apply directly in a terminal because each classification pass starts with a discarded read-only TTY authentication warm-up before the bounded captured reads, and supply a fresh `--output` path for the atomically created mode-`0600` JSON evidence. Configure the direct workflow `release.yml` and `release-publish` environment. Keep release credentials only in their protected environments; do not add repository-level copies or a reusable-workflow secret bridge.
-8. On a generated release PR, treat Release Please as the candidate authority
-   and `sync-release-pr.mts` as the deterministic selected-candidate metadata
-   closer. The pinned Release Please library selects shared-contrib candidates
-   through the declared release-ownership graph; sync chooses no new versions
-   or changelogs. Ordinary task dependencies are not automatic release bumps.
+8. On a generated release PR, native preparation supplies delivery and necessary
+   compatibility-adoption selection. Pinned Release Please owns version and
+   changelog calculation; `sync-release-pr.mts` closes the selected candidate's
+   metadata and chooses no new versions or changelogs. Contrib follows its
+   actual native/WASIX shipping owners. Ordinary build or test dependencies are
+   not automatic release bumps.
    In an isolated clean checkout, `bash tools/release/prepare-release-pr.sh OUTPUT_DIR`
    generates locally. If `OUTPUT_DIR/required` is `true`,
    `bash tools/release/close-release-candidate.sh OUTPUT_DIR` commits locally,
@@ -125,8 +124,10 @@ another repository mutation.
 - Prepare: synchronize release-owned files, run release checks, create the generated release PR, and stop for review.
 - Bootstrap: use the dedicated bootstrap environment only for identities that cannot use trusted publishing until their first package exists, including generated part identities introduced by a future lock. For npm, require a short-lived granular token with explicit `@oliphaunt` scope selection, Packages and scopes `Read and write`, and 2FA bypass, owned by a 2FA-enabled actor with scope write access; an ordinary token can authenticate yet fail the noninteractive publish with `EOTP`. The `publish` operation prepares `oliphaunt-publication-lock` and `oliphaunt-publication-candidate` first, then passes immutable artifact IDs to this conditional job. Publish only those frozen Cargo/npm bytes without rebuilding. Inventory the exact lock first and freeze only wholly absent names into the carrier-level bootstrap ledger; leave existing names awaiting the locked version for normal trusted publication. Provision only the registry token required by that scope. On rerun, a scoped name that exists without the exact version is a conflict. Model crates.io's documented token bucket; never accept an unverifiable numeric capacity assertion. Execute one sequential Cargo lane and one sequential npm lane, overlap only independent carriers, and preserve dependencies within the absent-name scope. A scoped npm package may leave an optional dependency on an existing name to the normal trusted-publication graph; other unavailable locked dependencies fail closed. If one hosted job cannot finish, drain in-flight uploads, reconcile receipts, upload the canonical hash-chained checkpoint, and fail as incomplete with the exact manual rerun command and not-before time. The maintainer reruns the failed job of that original workflow run; the rerun restores only the same release/lock/candidate identity and skips byte-matching public versions. A valid `429 Retry-After` may defer; ambiguous uploads, timeouts, integrity mismatches, malformed responses, and checkpoint failures remain hard failures. After every scoped identity has a receipt, use that exact lock with `tools/release/trusted-publisher-config.sh`: its default plan has no network access, `--audit` is read-only, and mutation requires both `--apply` and the exact `--confirm-lock-digest`. Run npm audit/apply in a real TTY and retain each fresh `--output` JSON report, never the discarded authentication warm-up display. Require workflow `release.yml`, environment `release-publish`, and npm publish-only permission; reject extra or mismatched configurations. Publication continues automatically. Configure trusted publishers and revoke bootstrap credentials before the next release.
 - Publish: prepare the frozen candidate, bootstrap absent Cargo/npm names if
-  needed, then publish in the same run. Require a successful exact-SHA `Qualified` gate, complete artifact
-  set, frozen publication lock, and exact Release Please PR markability proof.
+  needed, then publish in the same run. Require the exact-source
+  `Native Bazel qualification` workflow with its successful `Required` gate,
+  complete artifacts, frozen publication lock and exact Release Please PR
+  markability proof.
   Pin the immutable transport, stage GitHub drafts/assets/attestations, attempt
   the complete dependency-ordered registry plan once, verify public consumers,
   and promote last in one protected job. Do not predict registry capacity or
@@ -168,15 +169,16 @@ bash tools/release/release-check.sh
 bash src/extensions/tools/check-extension-model.sh --check
 ```
 
-Release Please selects direct candidates from configured product paths. The
-ownership plugin also supplies commits affecting declared shared shipped sources,
-bounded by each product's published history. Review that selection against the
-actual changed behavior; correct missing ownership in the graph rather than
-copying source or adding repository-meta fingerprints to force a candidate.
+Native preparation compares configured production observations and delivered
+payloads with each product's authenticated completed publication. It selects
+changed owners and necessary compatibility adoption, then passes bounded commit
+intent to pinned Release Please for version calculation. Unknown history or
+incomplete carrier coverage blocks preparation. Review the decision against
+actual delivery changes; fix missing production inputs instead of copying source
+or adding repository fingerprints to force a candidate.
 
-For a normalized generated release PR, ordinary Moon task dependencies affect
-qualification; declared release ownership controls shared-source candidate
-selection. Native, WASIX, SDKs, bindings, resources, tools and external extensions are
+For a normalized generated release PR, Bazel dependencies determine construction
+and verification. A dependency edge alone does not select another release. Native, WASIX, SDKs, bindings, resources, tools and external extensions are
 independently versioned. Sync preserves authored requirements and projects the actual input versions for
 selected compiled payloads. Release Please ecosystem updates remain authoritative;
 unselected consumers retain their older published pins. A selected
@@ -220,7 +222,7 @@ External extension host references declare `public_support = true`; private
 references declare `false`. Public host removal requires breaking intent before
 version selection and verification against the previous immutable product tag.
 
-Source `Qualified` and capsule preparation precede final installed consumer
+Source qualification and capsule preparation precede final installed consumer
 checks. Require `Frozen consumers` and `Publication ready` before bootstrap or
 normal mutation. The immutable consumer proof binds the lock, expected cases,
 test configuration, producing run/attempt and resolver/log evidence. Recovery

.codex/skills/release-oliphaunt/references/invariants.md

@@ -14,11 +14,12 @@
   record that publishing identity separately.
 - Extension evidence runs are immutable observations. Claim regeneration never changes them, and current WASIX support is qualified only by the full lifecycle collector running against same-workflow exact-SHA artifacts and recording that commit/tree/run identity.
 - The publication lock is exhaustive: reject undeclared and missing packages/assets as well as hash, size, dependency, target, or version drift.
-- Release Please selects direct candidates from configured product paths and
-  receives shared shipped-source commits from the declared release-ownership
-  graph, bounded by each product's published history. Ordinary task dependency
-  edges alone do not bump consumers. Correct missing ownership instead of copying
-  source or creating repository-meta fingerprints to force selection.
+- Native preparation selects delivery changes against each product's authenticated
+  completed publication, then closes necessary compatibility adoption. Release
+  Please alone calculates the selected owners' versions from bounded commit
+  intent. A build or test dependency alone does not require a release. Source,
+  tool and recipe ownership comes from configured production actions; do not
+  copy source or add repository fingerprints to force selection.
 - The preparation job generates the lock after artifact assembly and freezes
   every locked file in one candidate. Installed consumer cases must prove that
   candidate and Publication ready must succeed before any bootstrap or normal

.github/actions/bazel-cache/action.yml

@@ -0,0 +1,150 @@
+name: Transport bounded Bazel action cache
+description: Restore or save the standard Bazel action cache for one qualification cohort.
+
+inputs:
+  phase:
+    description: restore before qualification or save after its final Bazel invocation.
+    required: true
+  cohort:
+    description: Stable qualification job identity; operating system and architecture remain separate.
+    required: true
+  output-base:
+    description: Exact output base used by this cohort, if explicitly selected.
+    default: ""
+  jvm-args:
+    description: Exact host JVM argument used by this cohort, if explicitly selected.
+    default: ""
+  server-log:
+    description: Exact server JVM output path used by this cohort, if explicitly selected.
+    default: ""
+  disk-cache-hit:
+    description: Primary action cache hit returned by the restore phase.
+    default: "false"
+
+outputs:
+  disk-cache-hit:
+    description: Whether the immutable action cache key already exists.
+    value: ${{ steps.disk-restore.outputs.cache-hit }}
+
+runs:
+  using: composite
+  steps:
+    - name: Select canonical cache identity
+      id: identity
+      if: ${{ inputs.phase == 'save' || !cancelled() }}
+      shell: bash
+      env:
+        PHASE: ${{ inputs.phase }}
+        COHORT: ${{ inputs.cohort }}
+      run: |
+        set -euo pipefail
+        case "$PHASE" in restore|save) ;; *) exit 1 ;; esac
+        [[ "$COHORT" =~ ^[a-z0-9][a-z0-9-]*$ ]]
+        version="$(tr -d '\r' < .bazelversion)"
+        [[ "$version" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]
+        source_commit="$(git rev-parse HEAD)"
+        [[ "$source_commit" =~ ^[0-9a-f]{40}$ ]]
+        gc_max_size=2G
+        cache_limit_kib=3145728
+        # These three observed cache populations reached 3.4 to 3.6 GiB before collection.
+        case "$RUNNER_OS/$RUNNER_ARCH/$COHORT" in
+          macOS/ARM64/portable|Linux/X64/linux|Linux/X64/portable) gc_max_size=4G; cache_limit_kib=5242880 ;;
+        esac
+        printf 'prefix=bazel-ci-v1-%s-%s-%s-%s\nsource=%s\n' \
+          "$RUNNER_OS" "$RUNNER_ARCH" "$COHORT" "$version" "$source_commit" >> "$GITHUB_OUTPUT"
+        printf 'gc_max_size=%s\ncache_limit_kib=%s\n' \
+          "$gc_max_size" "$cache_limit_kib" >> "$GITHUB_OUTPUT"
+
+    - name: Restore Bazel action cache
+      id: disk-restore
+      if: inputs.phase == 'restore'
+      continue-on-error: true
+      uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
+      with:
+        path: ~/.cache/oliphaunt/bazel-ci/disk
+        key: ${{ steps.identity.outputs.prefix }}-disk-${{ steps.identity.outputs.source }}
+        restore-keys: |
+          ${{ steps.identity.outputs.prefix }}-disk-
+
+    - name: Configure standard hosted Bazel caches
+      if: inputs.phase == 'restore'
+      shell: bash
+      run: |
+        set -euo pipefail
+        cache_root="$HOME/.cache/oliphaunt/bazel-ci"
+        # Downloads remain a per-job content-addressed cache, not hosted archives.
+        mkdir -p "$cache_root/disk" "$cache_root/repositories"
+        if [[ "$RUNNER_OS" == Windows ]]; then
+          cache_root="$(cygpath -m "$cache_root")"
+        fi
+        # Hosted user configuration stays outside source and cache transport.
+        printf '\nbuild --config=ci-cache\nbuild --disk_cache="%s/disk"\ncommon --repository_cache="%s/repositories"\n' \
+          "$cache_root" "$cache_root" >> "$HOME/.bazelrc"
+
+    - name: Freeze, collect and bound cache transport
+      id: ready
+      if: ${{ always() && inputs.phase == 'save' && steps.identity.outcome == 'success' && inputs.disk-cache-hit != 'true' }}
+      continue-on-error: true
+      shell: bash
+      env:
+        OUTPUT_BASE: ${{ inputs.output-base }}
+        JVM_ARGS: ${{ inputs.jvm-args }}
+        SERVER_LOG: ${{ inputs.server-log }}
+        GC_MAX_SIZE: ${{ steps.identity.outputs.gc_max_size }}
+        CACHE_LIMIT_KIB: ${{ steps.identity.outputs.cache_limit_kib }}
+      run: |
+        set -euo pipefail
+        startup=(bash tools/dev/bazel.sh)
+        [[ -z "$OUTPUT_BASE" ]] || startup+=("--output_base=$OUTPUT_BASE")
+        [[ -z "$JVM_ARGS" ]] || startup+=("--host_jvm_args=$JVM_ARGS")
+        [[ -z "$SERVER_LOG" ]] || startup+=("--server_jvm_out=$SERVER_LOG")
+        freeze_writer() {
+          if ! "${startup[@]}" shutdown; then
+            printf 'Bazel cache writer shutdown: failure\n' >&2
+            return 1
+          fi
+          printf 'Bazel cache writer shutdown: success\n'
+        }
+        # Later commands can need lazy outputs from this cache. Collect only
+        # after final qualification; snapshots within the budget need no GC.
+        freeze_writer || exit 0
+        cache_limit_kib="$CACHE_LIMIT_KIB"
+        cache_root="$HOME/.cache/oliphaunt/bazel-ci/disk"
+        if [[ -d "$cache_root" ]]; then
+          printf 'Bazel cache disk: present=true\n'
+          cache_kib="$(du -sk "$cache_root" | cut -f1)"
+          if [[ "$cache_kib" =~ ^[0-9]+$ ]] && (( cache_kib > cache_limit_kib )); then
+            gc_target=//tools/ci:bazel_disk_cache_gc
+            "${startup[@]}" build --jobs=2 "$gc_target"
+            gc_tool="$("${startup[@]}" cquery "config($gc_target, target)" --output=starlark \
+              '--starlark:expr=providers(target)["DefaultInfo"].files_to_run.executable.path')"
+            freeze_writer || exit 0
+            gc_root="$cache_root"
+            if [[ "$RUNNER_OS" == Windows ]]; then
+              gc_root="$(cygpath -m "$gc_root")"
+            fi
+            # The stock collector returns after collection completes. Its
+            # logical-byte target does not replace the allocated archive bound.
+            JAVABIN= "$gc_tool" "--disk_cache=$gc_root" "--max_size=$GC_MAX_SIZE"
+            cache_kib="$(du -sk "$cache_root" | cut -f1)"
+          fi
+          printf 'Bazel cache disk: allocated_kib=%s limit_kib=%s\n' \
+            "$cache_kib" "$cache_limit_kib"
+          # An unused directory must not replace a useful fallback snapshot.
+          if [[ "$cache_kib" =~ ^[0-9]+$ ]] && (( cache_kib <= cache_limit_kib )) &&
+             [[ -n "$(find "$cache_root" -type f -print -quit)" ]]; then
+            printf 'disk=true\n' >> "$GITHUB_OUTPUT"
+          fi
+        else
+          printf 'Bazel cache disk: present=false\n'
+        fi
+
+    # GitHub isolates pull_request saves under refs/pull/<number>/merge.
+    # This optional cache contains action results, never release authority.
+    - name: Save bounded Bazel action cache
+      if: ${{ always() && inputs.phase == 'save' && steps.ready.outputs.disk == 'true' }}
+      continue-on-error: true
+      uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
+      with:
+        path: ~/.cache/oliphaunt/bazel-ci/disk
+        key: ${{ steps.identity.outputs.prefix }}-disk-${{ steps.identity.outputs.source }}