From 410144b9c105c4174b6b98f1752cd52637142caa Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?ClodoCap=C3=A9o?=
 <159788250+ClodoCapeo@users.noreply.github.com>
Date: Sun, 18 Oct 2026 21:39:18 +0200
Subject: [PATCH] build(release): pin CI-built native receivers for Solar 3

---
 .github/workflows/release.yml                 | 30 ++++++++++++-------
 docs/runbooks/release-deploy.md               | 10 +++++--
 .../eleven/20261018T193918Z-validation.md     |  8 +++++
 3 files changed, 34 insertions(+), 14 deletions(-)
 create mode 100644 evidence/local-20261018-solar-native-release/eleven/20261018T193918Z-validation.md

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 7f0d3a6..5f79e4e 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -26,7 +26,6 @@ jobs:
   build-and-release:
     name: Build and publish bundle tarball
     # The release uses the configured vps-ovh self-hosted runner pool.
-    # Native binary paths below must be provisioned on that runner.
     runs-on: [self-hosted, vps-ovh]
     timeout-minutes: 15
     steps:
@@ -43,17 +42,26 @@ jobs:
       - run: npm test
       - run: npm run build
       - run: npm run check:bundle
-      # Platform builds are an input to Solar's release, never compiled on the
-      # operator's machine at application startup. Missing binaries fail closed.
-      - name: Package unchanged native receiver binaries
-        env:
-          LSDP_WINDOWS_BINARY: ${{ vars.SOLAR_LSDP_WINDOWS_BINARY }}
-          LSDP_LINUX_BINARY: ${{ vars.SOLAR_LSDP_LINUX_BINARY }}
+      # Both binaries came from the same successful LSDP-native CI commit.
+      # The public staging release is immutable input; digest drift fails closed.
+      - name: Fetch and package pinned native receiver binaries
         run: |
-          test -f "$LSDP_WINDOWS_BINARY"
-          test -f "$LSDP_LINUX_BINARY"
-          npm run package:native -- --binary "$LSDP_WINDOWS_BINARY" --platform win32-x64 --revision e695e14f9f664f430ffc2e0e75d083fab88abc7f
-          npm run package:native -- --binary "$LSDP_LINUX_BINARY" --platform linux-x64 --revision e695e14f9f664f430ffc2e0e75d083fab88abc7f
+          set -eu
+          native_tag=native-lsdp-24c0517
+          native_revision=24c051785a178f5b514b9d2e21a6c44ba6c978d1
+          mkdir -p native-input
+          curl --fail --location --retry 3 --silent --show-error \
+            "https://github.com/ZabLaboratory/Solar/releases/download/$native_tag/lsdpd-win32-x64.exe" \
+            -o native-input/lsdpd-win32-x64.exe
+          curl --fail --location --retry 3 --silent --show-error \
+            "https://github.com/ZabLaboratory/Solar/releases/download/$native_tag/lsdpd-linux-x64" \
+            -o native-input/lsdpd-linux-x64
+          printf '%s  %s\n' \
+            '89d6885f21c123a12a5d51a9177ace039ef92b4f8ef002d57e32c5b5ef3f3676' native-input/lsdpd-win32-x64.exe \
+            'a6c76fdf699a908dedc937e2a34026876ef8352cbeeb1087b4dcb7f8a365204e' native-input/lsdpd-linux-x64 \
+            | sha256sum --check
+          npm run package:native -- --binary native-input/lsdpd-win32-x64.exe --platform win32-x64 --revision "$native_revision"
+          npm run package:native -- --binary native-input/lsdpd-linux-x64 --platform linux-x64 --revision "$native_revision"
           npm run check:native-package -- win32-x64 linux-x64
 
       - name: Resolve version from tag
diff --git a/docs/runbooks/release-deploy.md b/docs/runbooks/release-deploy.md
index ce4e6c3..b2c75d3 100644
--- a/docs/runbooks/release-deploy.md
+++ b/docs/runbooks/release-deploy.md
@@ -35,9 +35,13 @@ npm.cmd run package:native -- --binary <lsdpd> --platform linux-x64 --revision <
 npm.cmd run check:native-package -- win32-x64 linux-x64
 ```
 
-The release workflow takes `SOLAR_LSDP_WINDOWS_BINARY` and `SOLAR_LSDP_LINUX_BINARY` runner
-variables. Missing files fail assembly. The manifest pins platform binary digests and source
-revision; the installed application requires no Cargo, source checkout or esbuild.
+The release workflow downloads both native receiver binaries from the public
+[`native-lsdp-24c0517` staging release](https://github.com/ZabLaboratory/Solar/releases/tag/native-lsdp-24c0517).
+They were produced by the Windows and Ubuntu CI jobs for the same LSDP-native
+source revision `24c051785a178f5b514b9d2e21a6c44ba6c978d1`. The workflow checks
+their pinned SHA-256 digests before packaging; missing or changed bytes fail assembly.
+The manifest pins platform binary digests and source revision. The installed
+application requires no Cargo, source checkout or esbuild.
 
 ## Artifacts and layout
 
diff --git a/evidence/local-20261018-solar-native-release/eleven/20261018T193918Z-validation.md b/evidence/local-20261018-solar-native-release/eleven/20261018T193918Z-validation.md
new file mode 100644
index 0000000..f47d11d
--- /dev/null
+++ b/evidence/local-20261018-solar-native-release/eleven/20261018T193918Z-validation.md
@@ -0,0 +1,8 @@
+# Solar 3.0.0 native receiver release input
+
+- LSDP-native source: `24c051785a178f5b514b9d2e21a6c44ba6c978d1` (merged main); Windows and Ubuntu CI matrix: https://github.com/Lumencast/lumencast-lsdp-native/actions/runs/39158892003 (success).
+- Pinned public binary inputs: https://github.com/ZabLaboratory/Solar/releases/tag/native-lsdp-24c0517 (prerelease).
+- win32-x64 `lsdpd.exe`: SHA-256 `89d6885f21c123a12a5d51a9177ace039ef92b4f8ef002d57e32c5b5ef3f3676`.
+- linux-x64 `lsdpd`: SHA-256 `a6c76fdf699a908dedc937e2a34026876ef8352cbeeb1087b4dcb7f8a365204e`.
+- On this worktree: `npm ci`, `npm run build`, both `package:native` commands, `npm run check:native-package -- win32-x64 linux-x64`, `npm run check:bundle`, Prettier and `git diff --check` passed.
+- This proves package inputs and local assembly. Solar tag publication and installed Prism activation are separate gates.