Release assurance: validate registry-installed FlowProof on Linux, Windows, and macOS ARM64

[AminChirazi]

Parent

Split from #377.

Why this is human-owned

Checkout-local tests cannot prove that PyPI and npm contain installable artifacts. This work requires public registry access, hosted runners on three operating systems, and changes under .github/workflows/**, which is constitution-protected. It may also require release-environment and website coordination outside this repository. Keep needs-human throughout.

Current baseline

• .github/workflows/npx-smoke.yml already installs the published npm package without a checkout on Ubuntu, macOS, and Windows.
• .github/workflows/publish.yml builds PyPI artifacts on those platforms, but no equivalent post-publish clean installation from PyPI exists.
• This work must extend existing npm smoke coverage rather than duplicate it.

Scope

Create one post-publish validation path for an exact release version. Prove that clean environments can resolve and execute both public distribution channels on Linux x64, Windows x64, and macOS ARM64.

Because registry artifacts must exist before testing, this is a post-publish gate before release announcement—not validation of an unpublished version.

Acceptance criteria

• Provide a human-dispatched protected workflow requiring an exact semantic-version input; latest is insufficient as release evidence.
• Exercise Linux x64, Windows x64, and macOS ARM64, asserting runner architecture so image changes cannot silently weaken coverage.
• Without a repository checkout or local package cache, install flowproof==<version> from PyPI.
• Prove the native extension imports, flowproof --version reports the exact requested version, and flowproof --help exposes the expected command surface.
• From a clean npm cache, run npx --yes flowproof@<version> --version, install that version, and execute its resolved platform binary.
• Reuse or factor the existing npm smoke behavior so missing optional platform packages continue to fail loudly.
• Fail closed if either registry lacks the requested version. Any propagation retries must be bounded and end non-zero rather than falling back to latest or checkout artifacts.
• Produce a summary naming requested version, OS, architecture, distribution channel, resolved package version, and result for every matrix leg.
• Add a maintainer checklist requiring successful exact-version validation before announcing a release.
• Include separate human verification that the website and GitHub installation paths still point to supported PyPI and npm commands.
• Document that darwin-x64 is architecture-checked during publishing but cannot be executed until a schedulable Intel macOS runner is available.

Out of scope

• Choosing canonical metadata sources or implementing documentation-truth checks.
• Correcting README, CONTRIBUTING.md, or SDK prose.
• Publishing, deleting, or republishing registry artifacts during smoke validation.
• Treating locally built wheels, npm tarballs, or checkout binaries as evidence that public registry artifacts work.

[padsbanger]

A possible coordination route for one independently reviewable slice of this work: TaskMarket currently supports project-created guest tasks, so FlowProof could publish a genuine, tightly scoped task there—for example, an exact-version clean-install verification matrix/checklist for one supported runner, with evidence that feeds this parent issue.

Full disclosure: I am evaluating an escrowed TaskMarket onboarding bounty and may receive 18.5 USDC if a relevant outside project independently creates a real guest task and I submit the required public evidence. There is no guaranteed payment to me. I am not asking for credentials, reimbursement, or control of the task; FlowProof would choose the scope, funding, acceptance criteria, and whether the venue is useful at all.

Onboarding bounty/details: https://taskmarket.dev/tasks/0xd7bf7ea36750f0f552cd488f6c658a3af2b00b47c32ab03d4d3d3d8377a3c4ad
TaskMarket instructions: https://taskmarket.dev/skill.md

If this is not a fit for the project, no action is needed.