ci(platform): verify Linux arm64 on native ARM runners

.github/workflows/ci.yml

@@ -258,6 +258,61 @@ jobs:
           npm run npm:version
           npm run platform:smoke
 
+  platform-smoke-linux-arm64:
+    name: quality / platform smoke / linux-arm64
+    runs-on: ubuntu-24.04-arm
+    timeout-minutes: 15
+    steps:
+      - name: Verify native Linux architecture
+        run: |
+          set -euo pipefail
+          machine="$(uname -m)"
+          printf 'uname -m=%s\n' "$machine"
+          test "$machine" = "aarch64"
+
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Setup Node
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        with:
+          node-version: 26.11.1
+          package-manager-cache: false
+
+      - name: Install verified npm
+        uses: ./.github/actions/setup-verified-npm
+
+      - name: Setup Go
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version-file: go.mod
+          cache: true
+
+      - name: Setup Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: '3.15.0'
+
+      - name: Run Linux filesystem and process invariants
+        run: go test ./internal/kernel/rootpath ./internal/kernel/repositorytransaction ./internal/kernel/processgroup ./internal/command/projectstatus -count=1
+
+      - name: Run platform smoke
+        run: |
+          set -euo pipefail
+          npm run npm:version
+          npm run platform:smoke
+
+      - name: Build release wheel set
+        run: |
+          set -euo pipefail
+          go run ./internal/tools/packagebuild all
+          go run ./internal/tools/pythonpackage build
+
+      - name: Verify Python 3.11.0 installed wheel
+        run: go run ./internal/tools/pythonpackage verify-minimum
+
   browser-runtime:
     name: quality / browser runtime
     runs-on: ubuntu-24.04
@@ -324,6 +379,7 @@ jobs:
       - source-quality
       - platform-smoke
       - platform-smoke-intel
+      - platform-smoke-linux-arm64
     steps:
       - name: Verify required quality results
         run: |
@@ -332,4 +388,5 @@ jobs:
           test "${{ needs.source-quality.result }}" = "success"
           test "${{ needs.platform-smoke.result }}" = "success"
           test "${{ needs.platform-smoke-intel.result }}" = "success"
+          test "${{ needs.platform-smoke-linux-arm64.result }}" = "success"
           printf 'OK: all required quality checks passed\n'

CONTRIBUTING.md

@@ -115,12 +115,12 @@ SZOMB. A truncated record or a permission error remains an ordinary observation
 failure: the observer runs only before the sole reap, so the unreaped child
 still pins its PID and group and retained cleanup may signal them. Linux
 uses fresh `waitid(P_PID, WEXITED|WNOWAIT|WNOHANG)` records. Source-check targets
-are the configured Ubuntu 24.04, macos-15 (arm64) and macos-15-intel (x86_64)
-jobs and the native Linux wheel verifier profile, each requiring actual
-host/API qualification. A CI label, cross-build or one local run is not native
-qualification of another host. macOS 13 and 14 are not executed: no hosted
-macOS 13 image exists, and GitHub retires `macos-14` on 2026-11-02 after failing
-brownouts (actions/runner-images#13518).
+are the configured Ubuntu 24.04 (x86_64), ubuntu-24.04-arm (arm64), macos-15
+(arm64) and macos-15-intel (x86_64) jobs and the native Linux wheel verifier
+profile, each requiring actual host/API qualification. A CI label, cross-build
+or one local run is not native qualification of another host. macOS 13 and 14
+are not executed: no hosted macOS 13 image exists, and GitHub retires
+`macos-14` on 2026-11-02 after failing brownouts (actions/runner-images#13518).
 This package is outside the CLI dependency closure on all four shipped targets;
 consumer wheel tags and platform minima are unchanged. Import or payload changes
 require a fresh closure proof, and unsupported hosts fail before child Start.

README.md

@@ -149,15 +149,17 @@ Supported binary targets are macOS 15 or later on arm64 or x64, executed by
 required CI on the GitHub-hosted `macos-15` and `macos-15-intel` runners. Darwin
 binaries declare a macOS 13.0 minimum in their Mach-O build metadata; macOS 13
 and 14 are binary-compatible by that metadata only, not executed or verified.
-Linux manylinux 2.17 or later is supported on arm64 or x64. Windows is unsupported. The Python
-runner requires Python 3.11 or later and wraps the same Go CLI; it is not a
-Python SDK.
+Linux manylinux 2.17 or later is supported on arm64 or x64, executed by
+required CI on the GitHub-hosted `ubuntu-24.04-arm` and `ubuntu-24.04` runners.
+The manylinux 2.17 floor is the wheel-tag declaration; CI does not execute a
+host at that floor. Windows is unsupported. The Python runner requires Python
+3.11 or later and wraps the same Go CLI; it is not a Python SDK.
 
 Linux wheel installation requires pip 20.3 or later for the manylinux tag.
 Use an installer compatible with the selected Python. The bounded compatibility
-smoke exercises the initial Python 3.11 release with a checksum-pinned compatible
-installer. This is compatibility evidence, not a recommendation to use an
-obsolete interpreter.
+smoke exercises the initial Python 3.11 release on Linux arm64 and x64 with a
+checksum-pinned compatible installer. This is compatibility evidence, not a
+recommendation to use an obsolete interpreter.
 
 After an exact Python package version is available from an admitted channel,
 use one complete package-manager chain:

docs/specs/proofkit-supply-chain-quality/overview.md

@@ -73,18 +73,21 @@ vulnerability absence, or consumer rollout safety by itself.
   tests does not prove assertion-branch execution, mutation adequacy, or
   exhaustive command semantics.
 - `REQ-PROOFKIT-QUALITY-011`: CI separates the OS-independent full
-  source/package gate from macOS platform smoke, executes the complete Go
-  package set through its owner command, uses explicit hosted runner labels
-  instead of floating latest labels, and exposes one fail-closed aggregate gate
-  whose exact expression and script reject neutralization and require every
-  required leaf check to finish with success, while the aggregate job omits
-  job defaults and `continue-on-error` entirely. Exact workflow-level bash
-  defaults plus a closed inventory require exact provider-check names and
-  scalar runners, bind each macOS job's (required arm64 `macos-15` and x86_64
-  `macos-15-intel`) presence-aware exact ordered step inventory and exact
-  local setup-action bytes to the fail-closed package-script owner command,
-  require every required leaf job and step to
-  omit conditions except for exact named owner conditions, and reject
+  source/package gate from macOS and Linux arm64 platform smoke, executes the
+  complete Go package set through its owner command, uses explicit hosted
+  runner labels instead of floating latest labels, and exposes one fail-closed
+  aggregate gate whose exact expression and script reject neutralization and
+  require every required leaf check to finish with success, while the
+  aggregate job omits job defaults and `continue-on-error` entirely. Exact
+  workflow-level bash defaults plus a closed inventory require exact
+  provider-check names and scalar runners, bind each platform job's (required
+  arm64 `macos-15`, x86_64 `macos-15-intel` and aarch64 `ubuntu-24.04-arm`)
+  presence-aware exact ordered step inventory, whose first step checks the
+  native architecture, and exact local setup-action bytes to the fail-closed
+  package-script owner command, require the minimum-version CPython installed-wheel
+  smoke in both the Linux x86_64 source job and the Linux arm64 job, require
+  every required leaf job and step to omit conditions except for exact named
+  owner conditions, and reject
   dynamically false or explicit-null conditions, dual `run`/`uses` keys,
   non-string runner labels, nested or top-level semantic shadow steps,
   reusable-job substitution, inherited or local environment entries, shell,