[iperev]

Part of the UI-DESIGN-01 chain. Base branch: chain/a0-go-1-27-3 (#228, the Go 1.27.3 fix). This PR is one commit on that branch's head. Merge after #228. This is the first PR of the chain; the visual-reference PR stacks on it.

README says Linux is supported on arm64, but no CI runner has ever executed Linux arm64. This PR adds a required native ARM job, so the arm64 claim is backed the way the macOS claims are.

What changes

New required job quality / platform smoke / linux-arm64 runs on the GitHub-hosted ubuntu-24.04-arm runner with a 15-minute timeout. Its steps:

1. The first step runs before checkout and fails unless uname -m is aarch64. The job declares no container, so this checks the runner host itself.
2. It sets up the same pinned actions as the two macOS jobs: checkout, Node 26.11.1, verified npm 12.2.0, Go from go.mod, and Python 3.15.0.
3. It runs the macOS jobs' filesystem and process invariant command natively (rootpath, repositorytransaction, processgroup, projectstatus). Those packages contain Linux build-tagged tests, including TestLinuxObservationClassification. They qualify the host for the source tools' process lifecycle, which platform:smoke and the CPython smoke use there.
4. It runs npm run npm:version and npm run platform:smoke. These build the native binary, run its --help, build the manylinux_2_17_aarch64 wheel and run verify-current.
5. It builds the complete current release wheel set (packagebuild all and pythonpackage build), which verify-minimum requires.
6. It runs go run ./internal/tools/pythonpackage verify-minimum. The command picks the wheel and image from the Docker daemon's native architecture, here the manylinux_2_17_aarch64 wheel and the arm64 CPython 3.11.0 image digest already pinned in internal/tools/pythonpackage/minimum.go (python@sha256:924c9f87…). It then runs the existing offline, unprivileged installed-wheel smoke.

Required aggregate. quality / required aggregate now needs the job and requires it to succeed. There are now five required leaf jobs.

Workflow oracles (scripts/workflow_*_test.go):

• They pin the job's name, runner, timeout and exact step list, the five-job needs list and the aggregate shell. The Python-runtime oracle now counts the job as a consumer of the pinned Python.
• New mutants are refused for a reason that names the defect:
  • x64, macOS or older ARM runners;
  • an architecture check that is missing, moved after checkout, expects x86_64, is masked with || true, or is replaced by the Darwin check;
  • an omitted, narrowed or neutralized invariant, smoke, wheel-set or CPython 3.11.0 step;
  • a job that is dropped from the aggregate needs, whose result is unchecked or masked, or that is removed consistently from both.
• The aggregate result test now proves that a failure, skipped or cancelled Linux arm64 result cannot produce aggregate success.

README. The platform block now says:

• Linux arm64 and x64 are executed by required CI on ubuntu-24.04-arm and ubuntu-24.04.
• The manylinux 2.17 floor is the wheel-tag declaration; CI does not run a host at that floor.
• The CPython 3.11.0 compatibility smoke runs on both Linux architectures.

The README projection test follows the new text. It also checks that each OS's architecture list is still arm64, x64, the order in which the README names the runners.

Requirements and docs.

• REQ-PROOFKIT-QUALITY-011 is changed explicitly, because "the same four required leaf jobs remain in the aggregate" would otherwise be false. It now names the Linux arm64 platform lane, the native-architecture first step, the CPython 3.11.0 step in that job, and exactly five required leaf jobs. The overview of the supply-chain-quality spec follows.
• CONTRIBUTING.md adds ubuntu-24.04-arm (arm64) to the source-check targets that need native host/API qualification, and the job now runs that qualification.
• NON_CLAIMS.md, REQ-PROOFKIT-QUALITY-013 and the REQ-PROOFKIT-PACKAGE-* requirements were checked and stay unchanged: none of their clauses becomes false.

Compatibility

Not breaking. The CLI binary, JSON contracts, wheel bytes and wheel tags are unchanged; the npm tarball changes only in README.md and the supply-chain-quality spec files. Branch protection may list the new check quality / platform smoke / linux-arm64. The aggregate already requires it, so protection that requires only quality / required aggregate needs no change.

Proof

Proof: A local npm run check sequence on darwin/arm64 passed (exit 0) on tree 557350793e08 with npm 12.2.0, CPython 3.15.0 and Go 1.27.3: 561/561 browser cases in Chromium, Firefox and WebKit with zero retries. One recorded deviation: the host firewall blocks Go-built binaries from the network, so go:vulncheck ran against a vulnerability-database snapshot fetched with curl (modified 2026-10-21T00:27:29Z): no vulnerabilities. The new arm64 job's success is proven only by hosted CI on this PR.

• Narrow checks on this tree (darwin/arm64 host) all passed: go test -p 2 ./scripts ./internal/tools/pythonpackage, the packaged requirement-source admission test, go tool actionlint (which knows the ubuntu-24.04-arm label and rejects an unknown one), npm run text-policy, npm run source-hygiene, npm run mermaid:check and git diff --check.
• Local evidence from the darwin/arm64 host with a linux/arm64 Docker daemon. It is not CI evidence.
  • The four invariant packages pass in an ubuntu:24.04 arm64 container as a non-root user. The cross-filesystem test is skipped there, as on every host without its fixture.
  • verify-minimum, run by the Go tool on the darwin/arm64 host, passes on this tree against the linux/arm64 CPython image digest and the manylinux_2_17_aarch64 wheel.
  • verify-minimum refuses a current-platform-only wheel set, which is why the job builds the full set first.

Non-claims

• The job has not run on a GitHub-hosted runner yet. Its duration and success on ubuntu-24.04-arm, including the Docker daemon and the Docker Hub pull there, are unverified until CI runs.
• No host at the manylinux 2.17 floor (glibc 2.17) is executed. Linux is executed only on Ubuntu 24.04 runners and in the pinned CPython 3.11.0 images.
• The Linux arm64 job runs the platform smoke, the process and filesystem invariant packages, and the CPython 3.11.0 smoke. It does not run the full Go suite, the npm tarball consumer verification or the browser proof on arm64.
• The cross-filesystem deletion test of the invariant packages skips on the arm64 runner; it runs only in the x86_64 source job.
• No branch-protection, release, registry or provider change.