feat: ship isolated GraphKit.Auth runtime

.build/ReleaseProof.tasks.ps1

@@ -0,0 +1,20 @@
+<#
+    Invoke-Build integration for the canonical tested-release proof.
+
+    Capture runs before Pester and deletes stale proof/result material. Finalize runs only
+    after Pester and coverage gates, rechecks the captured candidate and complete result,
+    then writes tested-release-proof.json. The scripts hold the behavior so the exact same
+    boundary is exercised by focused subprocess tests.
+#>
+
+task Capture_Tested_Release_Proof_Candidate {
+    & (Join-Path $BuildRoot 'scripts/New-GraphKitTestedReleaseProof.ps1') `
+        -Stage Capture `
+        -RepositoryRoot $BuildRoot
+}
+
+task Record_Tested_Release_Proof {
+    & (Join-Path $BuildRoot 'scripts/New-GraphKitTestedReleaseProof.ps1') `
+        -Stage Finalize `
+        -RepositoryRoot $BuildRoot
+}

.gitattributes

@@ -0,0 +1,2 @@
+* text=auto eol=lf
+tests/Fixtures/GraphKitAuthParityCases.json text eol=lf

.github/powershell-release-sha256.json

@@ -0,0 +1,27 @@
+{
+  "schemaVersion": 1,
+  "provenance": {
+    "7.4.19": {
+      "releaseUrl": "https://github.com/PowerShell/PowerShell/releases/tag/v7.4.19",
+      "hashesUrl": "https://github.com/PowerShell/PowerShell/releases/download/v7.4.19/hashes.sha256"
+    },
+    "7.6.5": {
+      "releaseUrl": "https://github.com/PowerShell/PowerShell/releases/tag/v7.6.5",
+      "hashesUrl": "https://github.com/PowerShell/PowerShell/releases/download/v7.6.5/hashes.sha256"
+    }
+  },
+  "sha256": {
+    "7.4.19/PowerShell-7.4.19-win-arm64.zip": "ac3a0249c0cd9f5b55f198f681485099ea73f45838dfd676457571a94d793463",
+    "7.4.19/PowerShell-7.4.19-win-x64.zip": "cd62ad6d8174cc6fb85b335a0058444bc934fe27c39fa97fe342134286d28af9",
+    "7.4.19/powershell-7.4.19-linux-arm64.tar.gz": "2b11aafacf574222abaf691a0b3b2d463e617d17fe337343c2fb93ea871a4691",
+    "7.4.19/powershell-7.4.19-linux-x64.tar.gz": "1b023e097b0e0546ad9566f7a2126cbe0eb8455fa7b0c5de558e317b8ddc16c8",
+    "7.4.19/powershell-7.4.19-osx-arm64.tar.gz": "fb9d6656d0c78c6d3f6e8d08ff15e5e0d867f886bf4ebecfde6484d2fa06c042",
+    "7.4.19/powershell-7.4.19-osx-x64.tar.gz": "bb67378d9b9d469d0c3863aa8a5576a38ad8eaa0fd7aae2c4819e7caf06cb79c",
+    "7.6.5/PowerShell-7.6.5-win-arm64.zip": "20514a755d16428dc4355c85e0883c859531e71cc3e122670aa1fccdbf96ba7e",
+    "7.6.5/PowerShell-7.6.5-win-x64.zip": "32eb8f6cdce08f86e987d625a2733e54ac3e289ae7e1621b14c0b5bcec2434ea",
+    "7.6.5/powershell-7.6.5-linux-arm64.tar.gz": "ed4084f215d8bce2edd23aa7cb1f1e7b0818e41363a635a22065d2701b6141df",
+    "7.6.5/powershell-7.6.5-linux-x64.tar.gz": "b34ab3b19acac1d3d4d0d3cfdb02acf62f457b0b6a962ff008132033f7566844",
+    "7.6.5/powershell-7.6.5-osx-arm64.tar.gz": "8196d4b4e7c21b7f6df9d45687bb4e42dc8335f330b580d9eb15f3ef5042a8c3",
+    "7.6.5/powershell-7.6.5-osx-x64.tar.gz": "3db1d177ab39511c1b6b73b05a1630a5db4e8dce22857ca76f14c5d98f2733fd"
+  }
+}

.github/scripts/Install-VerifiedPowerShellArchive.ps1

@@ -0,0 +1,42 @@
+[CmdletBinding()]
+param(
+    [Parameter(Mandatory)][string] $Version,
+    [Parameter(Mandatory)][string] $AssetName,
+    [Parameter(Mandatory)][string] $ArchivePath,
+    [Parameter(Mandatory)][string] $InstallDirectory,
+    [Parameter(Mandatory)][string] $HashMapPath
+)
+
+$ErrorActionPreference = 'Stop'
+Set-StrictMode -Version 3.0
+
+$hashMap = Get-Content -LiteralPath $HashMapPath -Raw | ConvertFrom-Json -AsHashtable
+if ([int]$hashMap.schemaVersion -ne 1) {
+    throw 'The reviewed PowerShell release hash map has an unsupported schema version.'
+}
+$key = "$Version/$AssetName"
+$matchingKeys = @($hashMap.sha256.Keys | Where-Object { [string]$_ -ceq $key })
+if ($matchingKeys.Count -ne 1) {
+    throw "PowerShell release asset '$key' has no reviewed SHA-256 mapping."
+}
+$expectedHash = [string]$hashMap.sha256[$matchingKeys[0]]
+if ($expectedHash -cnotmatch '^[0-9a-f]{64}$') {
+    throw "The reviewed digest for PowerShell release asset '$key' is not a lowercase 64-character SHA-256."
+}
+$actualHash = (Get-FileHash -LiteralPath $ArchivePath -Algorithm SHA256).Hash.ToLowerInvariant()
+if (-not [string]::Equals($actualHash, $expectedHash, [StringComparison]::Ordinal)) {
+    throw "PowerShell release asset '$key' does not match its reviewed SHA-256."
+}
+Write-Host "Verified SHA-256 for $AssetName."
+
+$null = New-Item -ItemType Directory -Path $InstallDirectory -Force
+if ($AssetName.EndsWith('.zip', [StringComparison]::Ordinal)) {
+    Expand-Archive -LiteralPath $ArchivePath -DestinationPath $InstallDirectory -Force
+}
+elseif ($AssetName.EndsWith('.tar.gz', [StringComparison]::Ordinal)) {
+    & tar -xzf $ArchivePath -C $InstallDirectory
+    if ($LASTEXITCODE -ne 0) { throw "PowerShell archive extraction failed for '$AssetName'." }
+}
+else {
+    throw "PowerShell release asset '$AssetName' is not a supported archive."
+}

.github/workflows/ci.yml

@@ -2,8 +2,9 @@ name: CI
 
 on:
   push:
-    branches: [main]
+    branches: [main, 'codex/**']
   pull_request:
+  workflow_dispatch:
 
 permissions:
   contents: read
@@ -21,11 +22,34 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v4
+        with:
+          repository: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name || github.repository }}
+          ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Assert exact source revision
+        shell: pwsh
+        env:
+          EXPECTED_SOURCE_SHA: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
+        run: |
+          $ErrorActionPreference = 'Stop'
+          $expected = $env:EXPECTED_SOURCE_SHA
+          $actual = (& git rev-parse HEAD).Trim()
+          if (-not [string]::Equals($actual, $expected, [StringComparison]::Ordinal)) {
+              throw "Checked-out source mismatch: expected $expected, got $actual"
+          }
+          Write-Host "Exact source revision asserted: $actual"
+
+      - name: Setup .NET SDK
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: '10.0.400'
 
       # Each row installs its exact PowerShell version rather than trusting the
       # runner image, then asserts the running version matches before doing work.
-      # Pinned release tags + direct GitHub release assets: no third-party action,
-      # no secrets, fork-safe.
+      # Pinned release tags + direct GitHub release assets + committed official
+      # checksums: no third-party action, no secrets, fork-safe.
       - name: Install PowerShell ${{ matrix.pwsh-version }}
         shell: pwsh
         run: |
@@ -45,16 +69,13 @@ jobs:
 
           $installDir = Join-Path $env:RUNNER_TOOL_CACHE "pwsh-$version"
           $archive = Join-Path $env:RUNNER_TEMP $asset
+          $hashMap = Join-Path $env:GITHUB_WORKSPACE '.github/powershell-release-sha256.json'
 
-          New-Item -ItemType Directory -Path $installDir -Force | Out-Null
           Write-Host "Downloading $asset"
           Invoke-WebRequest -Uri "https://github.com/PowerShell/PowerShell/releases/download/v$version/$asset" -OutFile $archive
-
-          if ($IsWindows) {
-              Expand-Archive -Path $archive -DestinationPath $installDir -Force
-          } else {
-              tar -xzf $archive -C $installDir
-          }
+          & (Join-Path $env:GITHUB_WORKSPACE '.github/scripts/Install-VerifiedPowerShellArchive.ps1') `
+              -Version $version -AssetName $asset -ArchivePath $archive `
+              -InstallDirectory $installDir -HashMapPath $hashMap
 
           Add-Content -Path $env:GITHUB_PATH -Value $installDir
           Write-Host "Installed PowerShell $version to $installDir"
@@ -63,19 +84,17 @@ jobs:
         shell: pwsh
         run: |
           $expected = '${{ matrix.pwsh-version }}'
-          $actual = $PSVersionTable.PSVersion
-          $expectedMajorMinor = (($expected -split '\.')[0..1] -join '.')
-          $actualMajorMinor = "$($actual.Major).$($actual.Minor)"
-          if ($actualMajorMinor -ne $expectedMajorMinor) {
-              throw "PowerShell version mismatch: expected $expectedMajorMinor.x, got $actual"
+          $actual = $PSVersionTable.PSVersion.ToString()
+          if (-not [string]::Equals($actual, $expected, [StringComparison]::Ordinal)) {
+              throw "PowerShell version mismatch: expected $expected, got $actual"
           }
           Write-Host "PowerShell version asserted: $actual"
 
       - name: Resolve build dependencies
         shell: pwsh
         run: pwsh -File ./build.ps1 -ResolveDependency -Tasks noop
 
-      - name: Pack candidate
+      - name: Pack candidate with Build_GraphKitAuth
         shell: pwsh
         run: pwsh -File ./build.ps1 -Tasks pack
 
@@ -93,4 +112,21 @@ jobs:
           if ($resultFiles.Count -gt 1) {
               throw "Multiple NUnit result files produced: $($resultFiles.Name -join ', ')"
           }
-          pwsh -File ./tests/QA/Assert-GateResult.ps1 -ResultPath $resultFiles[0].FullName -MinimumTests 777 -AllowedSkips 0
+          pwsh -File ./tests/QA/Assert-GateResult.ps1 -ResultPath $resultFiles[0].FullName -MinimumTests 1482 -AllowedSkips 0
+          if ($LASTEXITCODE -ne 0) {
+              throw 'The standalone whole-result gate failed.'
+          }
+
+          $proofPath = 'output/testResults/tested-release-proof.json'
+          if (-not (Test-Path -LiteralPath $proofPath -PathType Leaf)) {
+              throw "No canonical tested-release proof was produced at $proofPath"
+          }
+          $packageFiles = @(Get-ChildItem -Path 'output/GraphKit.*.nupkg' -File -ErrorAction SilentlyContinue)
+          if ($packageFiles.Count -ne 1) {
+              throw "Expected exactly one GraphKit package, found $($packageFiles.Count): $($packageFiles.Name -join ', ')"
+          }
+          & ./scripts/Test-GraphKitReleaseProof.ps1 `
+              -PackagePath $packageFiles[0].FullName `
+              -ProofPath $proofPath `
+              -TestResultPath $resultFiles[0].FullName `
+              -RepositoryRoot $PWD | Out-Null