refactor: model product dependencies and simplify qualification

[f0rr0]

Product builds previously depended on shared release machinery, bundled optional resources, and inconsistent task boundaries. This change gives runtimes, SDKs, database resources, PostgreSQL tools, extensions, and the PG-wire server explicit ownership and dependency edges.

• SDKs expose ecosystem-native build, test and package commands through Moon. Transitive source changes invalidate dependent checks; jobs consuming transferred artifacts execute against those bytes without rebuilding producers or reusing incomplete consumer hashes.
• Seeds and ICU data are separately selectable resources. WASIX core compilation is separated from optional tools and extensions. Native bindings are shared across Rust, Node and mobile adapters; the desktop broker uses PostgreSQL wire messages for database operations.
• Release Please generates and validates one local candidate before the PR is pushed. Publication consumes qualified outputs, freezes packages, bootstraps only missing names, reconciles immutable public bytes and promotes last. Candidate assembly no longer installs product compilers; GitHub request coordination retains bounded state.
• Maintainer orchestration uses Shell and Bun TypeScript. Tests and fixtures live with their owners; redundant layout/source assertions and obsolete wrappers are removed. Docs describe current ownership and distinguish source qualification from publication controls.

Validation includes the complete release aggregate, workflow/affectedness and artifact-transfer checks, 58 JavaScript/TypeScript formatting and lint tasks, 18 Rust formatting checks, archive corruption and recovery scenarios, and native/WASIX consumer tests. Installed Node, Bun, Deno and Rust consumers pass with independently differing SDK/runtime/extension/resource versions; SQL, pgTAP and ICU behavior pass, and repeated candidate preparation produces identical Git trees.

Clean-runner fixes keep offline Cargo consumers on the candidate lockfile, stop failed producers from starting artifact consumers, and separate Kotlin source checks from Android native builds. Kotlin lint and unit checks pass locally. The WASIX postmaster now publishes completed build generations; a real build and repeat produced the same generation hash, and concurrent SQL plus installed regressions passed. Packaged WASIX carriers require their own payloads, while a TypeScript-only release can test exact published dependencies when all pinned versions exist.

Packed Rust runtime checks now run in the SDK consumer job and cover direct, broker and server operations against shipped artifacts. Expo consumers use the candidate query package, reject mismatched dependency versions, and preserve locked registry resolutions without borrowing checkout source. ICU carriers also require their own payloads; generated extension build scripts use sha2 instead of handwritten cryptography. External extension releases select their existing native/WASIX producers and lifecycle checks.

This does not complete platform qualification. Deno retains its FFI path; final native target, Windows/MSVC, Apple/SwiftPM and mobile-device qualification remains pending. No release or registry publication is performed by this PR.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
oliphaunt-docs	Error		Sep 12, 2026 2:44pm UTC