.github/workflows/evo-deploy.yml

@@ -1,11 +1,9 @@
 name: evo-deploy
 
-# Deploy evOo-local on the Evo host once Product CI has passed on main, or on manual dispatch.
+# Deploy evOo-local on the Evo host when main advances, or on manual dispatch.
 # Runs ON the self-hosted Evo runner (no SSH, no deploy secrets in the workflow).
 on:
-  workflow_run:
+  push:
-    workflows: [ci]
-    types: [completed]
     branches: [main]
   workflow_dispatch:
     inputs:
@@ -31,7 +29,7 @@ concurrency:
 
 jobs:
   deploy:
-    if: vars.EVO_DEPLOY_ENABLED == 'true' && (github.event_name == 'workflow_dispatch' || github.event.workflow_run.conclusion == 'success')
+    if: vars.EVO_DEPLOY_ENABLED == 'true'
     runs-on: [self-hosted, evoo-ci, Linux]
     timeout-minutes: 30
     steps:
@@ -39,12 +37,12 @@ jobs:
         uses: actions/checkout@v5
         with:
           persist-credentials: false
-          ref: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.ref || github.event.workflow_run.head_sha }}
+          ref: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.ref || github.sha }}
 
       - name: Deploy evOo-local on Evo
         env:
           EVO_DEPLOY_DIR: ${{ vars.EVO_DEPLOY_DIR }}
-          EVO_DEPLOY_REF: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.ref || github.event.workflow_run.head_sha }}
+          EVO_DEPLOY_REF: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.ref || github.sha }}
           EVO_DRY_RUN: ${{ github.event.inputs.dry_run || 'false' }}
           EVO_MIGRATE: ${{ github.event.inputs.skip_migrate == true && 'false' || 'true' }}
           EVO_RESTART_MODE: ${{ vars.EVO_RESTART_MODE || 'auto' }}
@@ -74,7 +72,7 @@ jobs:
           {
             echo "### Evo deploy"
             echo
-            echo "- Ref: \`${{ github.event_name == 'workflow_dispatch' && github.event.inputs.ref || github.event.workflow_run.head_sha }}\`"
+            echo "- Ref: \`${{ github.event_name == 'workflow_dispatch' && github.event.inputs.ref || github.sha }}\`"
             echo "- Dir: \`$EVO_DEPLOY_DIR\`"
             if [[ -f "$EVO_STATE_FILE" ]]; then
               echo "- State:"

.github/workflows/playwright.yml

@@ -111,24 +111,6 @@ jobs:
         env:
           BOX_API_KEY: ${{ secrets.BOX_API_KEY }}
         run: test -n "$BOX_API_KEY"
-      - name: Pick E2E ports for this runner
-        # Several runners share one host. Each runner gets its own port set so the
-        # port-freeing steps and the harness never touch another job's servers. No runner
-        # uses the harness defaults: jobs from branches that still free the fixed ports
-        # cannot kill ours, and we cannot kill theirs.
-        run: |
-          set -euo pipefail
-          suffix="${RUNNER_NAME##*-}"
-          offset=100
-          if [[ "$suffix" =~ ^[0-9]+$ ]]; then
-            offset=$((suffix * 100))
-          fi
-          {
-            echo "API_PORT=$((3110 + offset))"
-            echo "WEB_PORT=$((5180 + offset))"
-            echo "WWW_PORT=$((4321 + offset))"
-          } >> "$GITHUB_ENV"
-          echo "E2E ports for ${RUNNER_NAME}: api $((3110 + offset)), web $((5180 + offset)), www $((4321 + offset))"
       - name: Free stale E2E ports
         run: bash scripts/free-e2e-ports.sh
       - name: Run Playwright tests

.github/workflows/publish-server-image.yml

@@ -71,14 +71,10 @@ jobs:
         with:
           persist-credentials: false
       - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
-      - name: Resolve the lowercase image namespace
-        id: ns
-        # GHCR rejects repository names with capitals; the GitHub repository slug has them.
-        run: echo "repo=${GITHUB_REPOSITORY,,}" >> "$GITHUB_OUTPUT"
       - id: meta
         uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
         with:
-          images: ghcr.io/${{ steps.ns.outputs.repo }}/${{ matrix.name }}
+          images: ghcr.io/${{ github.repository }}/${{ matrix.name }}
           tags: type=sha,prefix=sha-
       - uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
         with:
@@ -97,8 +93,8 @@ jobs:
     name: Build ${{ matrix.name }} ${{ matrix.arch }}
     if: github.event_name != 'pull_request'
     # Each architecture builds natively on its own runner and pushes by digest only.
-    # amd64 on evo Linux runners. arm64 is paused: the macOS runners have no Docker buildx,
+    # amd64 on evo Linux runners; arm64 on Apple Silicon macOS runners (linux/arm64 via buildx).
-    # and QEMU emulation took hours for the desktop-sized computer image.
+    # No QEMU: emulated arm64 took hours for the desktop-sized computer image.
     # See docs/self-host.md (Published images and tags).
     runs-on: ${{ matrix.runner }}
     timeout-minutes: 90
@@ -109,7 +105,7 @@ jobs:
       fail-fast: false
       matrix:
         name: [app, updater, computer]
-        arch: [amd64]
+        arch: [amd64, arm64]
         include:
           # Only the updater image contains the Docker CLI; the application image stays unprivileged.
           # The supervisor is not a separate published image: it runs from `app` on the internal network.
@@ -124,6 +120,8 @@ jobs:
             context: infra/sandboxes/computer
           - arch: amd64
             runner: [self-hosted, evoo-ci, Linux]
+          - arch: arm64
+            runner: [self-hosted, evoo-ci, macOS]
     steps:
       - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
         with:
@@ -135,15 +133,11 @@ jobs:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
-      - name: Resolve the lowercase image namespace
-        id: ns
-        # GHCR rejects repository names with capitals; the GitHub repository slug has them.
-        run: echo "repo=${GITHUB_REPOSITORY,,}" >> "$GITHUB_OUTPUT"
       - id: meta
         uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
         with:
           # Labels only; the tagged manifest is assembled in the publish job.
-          images: ghcr.io/${{ steps.ns.outputs.repo }}/${{ matrix.name }}
+          images: ghcr.io/${{ github.repository }}/${{ matrix.name }}
           tags: type=sha,prefix=sha-
       - id: build
         uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
@@ -153,7 +147,7 @@ jobs:
           platforms: linux/${{ matrix.arch }}
           labels: ${{ steps.meta.outputs.labels }}
           # A fork can publish only to its own namespace; no credential can redirect this value.
-          outputs: type=image,name=ghcr.io/${{ steps.ns.outputs.repo }}/${{ matrix.name }},push-by-digest=true,name-canonical=true,push=true
+          outputs: type=image,name=ghcr.io/${{ github.repository }}/${{ matrix.name }},push-by-digest=true,name-canonical=true,push=true
           # GET /health can report the exact source commit without a deployment-supplied override.
           build-args: ${{ matrix.name == 'app' && format('GIT_SHA={0}', github.sha) || '' }}
           cache-from: type=gha,scope=${{ matrix.name }}-${{ matrix.arch }}
@@ -205,15 +199,11 @@ jobs:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
-      - name: Resolve the lowercase image namespace
-        id: ns
-        # GHCR rejects repository names with capitals; the GitHub repository slug has them.
-        run: echo "repo=${GITHUB_REPOSITORY,,}" >> "$GITHUB_OUTPUT"
       - id: meta
         uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
         with:
           # A fork can publish only to its own namespace; no credential can redirect this value.
-          images: ghcr.io/${{ steps.ns.outputs.repo }}/${{ matrix.name }}
+          images: ghcr.io/${{ github.repository }}/${{ matrix.name }}
           tags: |
             type=semver,pattern=v{{version}}
             type=semver,pattern=v{{major}}.{{minor}}
@@ -221,11 +211,11 @@ jobs:
             type=raw,value=edge,enable=${{ github.ref == 'refs/heads/main' }}
             # Stable releases only: a hyphen marks a prerelease (v1.0.0-rc.1) that must not move latest.
             type=raw,value=latest,enable=${{ startsWith(github.ref, 'refs/tags/v') && !contains(github.ref, '-') }}
-      - name: Assemble and verify the manifest
+      - name: Assemble and verify the multi-arch manifest
         id: manifest
         working-directory: /tmp/digests
         env:
-          IMAGE: ghcr.io/${{ steps.ns.outputs.repo }}/${{ matrix.name }}
+          IMAGE: ghcr.io/${{ github.repository }}/${{ matrix.name }}
           TAGS: ${{ steps.meta.outputs.tags }}
         run: |
           set -euo pipefail
@@ -237,7 +227,7 @@ jobs:
           for digest in *; do
             sources+=("${IMAGE}@sha256:${digest}")
           done
-          if [[ "${#sources[@]}" -ne 1 ]]; then
+          if [[ "${#sources[@]}" -ne 2 ]]; then
             echo "Expected one digest per architecture, found ${#sources[@]}." >&2
             exit 1
           fi
@@ -246,13 +236,13 @@ jobs:
           first_tag="$(head -n 1 <<< "$TAGS")"
           platforms="$(docker buildx imagetools inspect "$first_tag" \
             --format '{{range .Manifest.Manifests}}{{.Platform.OS}}/{{.Platform.Architecture}}{{"\n"}}{{end}}')"
-          for want in linux/amd64; do
+          for want in linux/amd64 linux/arm64; do
             grep -Fqx "$want" <<< "$platforms" || { echo "$first_tag is missing $want" >&2; exit 1; }
           done
           echo "digest=$(docker buildx imagetools inspect "$first_tag" --format '{{.Manifest.Digest}}')" >> "$GITHUB_OUTPUT"
       - name: Attest the published image
         uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
         with:
-          subject-name: ghcr.io/${{ steps.ns.outputs.repo }}/${{ matrix.name }}
+          subject-name: ghcr.io/${{ github.repository }}/${{ matrix.name }}
           subject-digest: ${{ steps.manifest.outputs.digest }}
           push-to-registry: true

apps/web/e2e/module-recovery.spec.ts

@@ -1,38 +0,0 @@
-import type { Page } from "@playwright/test";
-import { expect, test } from "@playwright/test";
-
-/** Abort the first request for a module once, then let every later request through. */
-async function abortFirstRequest(page: Page, pattern: string) {
-  const counter = { aborted: 0 };
-  await page.route(pattern, async (route) => {
-    if (counter.aborted === 0) {
-      counter.aborted += 1;
-      await route.abort("failed");
-      return;
-    }
-    await route.continue();
-  });
-  return counter;
-}
-
-test("the app reloads itself once when a module request aborts while booting", async ({ page }) => {
-  const counter = await abortFirstRequest(page, "**/src/App.tsx");
-
-  await page.goto("/sign-in", { waitUntil: "commit" });
-
-  await expect(page.getByRole("heading", { name: "Sign in to EvOo" })).toBeVisible();
-  expect(counter.aborted).toBe(1);
-  expect(await page.evaluate(() => sessionStorage.getItem("rakazo:boot-reload"))).toBeNull();
-});
-
-test("a lazy route recovers when its module request aborts", async ({ page }) => {
-  const counter = await abortFirstRequest(page, "**/src/pages/Auth.tsx");
-
-  await page.goto("/sign-in");
-
-  await expect(page.getByRole("heading", { name: "Sign in to EvOo" })).toBeVisible();
-  expect(counter.aborted).toBe(1);
-  expect(
-    await page.evaluate(() => sessionStorage.getItem("rakazo:module-reload:pages/Auth")),
-  ).toBeNull();
-});

apps/web/index.html

@@ -29,26 +29,6 @@
         if (meta) meta.setAttribute("content", theme === "light" ? "#fafaf8" : "#07080a");
       })();
     </script>
-    <script>
-      // Reload once when the browser aborts part of the module graph while the app
-      // boots (a network interface changed mid-request). main.tsx clears the flag
-      // after a successful boot; a second failure in a row is left to the browser.
-      addEventListener(
-        "error",
-        (event) => {
-          const target = event.target;
-          if (!(target instanceof HTMLScriptElement) || target.type !== "module") return;
-          try {
-            if (sessionStorage.getItem("rakazo:boot-reload")) return;
-            sessionStorage.setItem("rakazo:boot-reload", "1");
-          } catch {
-            return;
-          }
-          location.reload();
-        },
-        true,
-      );
-    </script>
   </head>
   <body>
     <div id="root"></div>

apps/web/src/App.tsx

@@ -1,11 +1,10 @@
 import { Trans, useLingui } from "@lingui/react/macro";
 import { LOCAL_SETTINGS_PAGE } from "@rakazo/contracts";
 import { Button, Skeleton } from "@rakazo/ui-web";
-import { Suspense, useEffect, useLayoutEffect, useRef, useState } from "react";
+import { lazy, Suspense, useEffect, useLayoutEffect, useRef, useState } from "react";
 import { Navigate, Route, Routes, useSearchParams } from "react-router-dom";
 import { LoadingState } from "./components/ai/primitives";
 import { authClient } from "./lib/auth";
-import { lazyWithRecovery } from "./lib/lazy-recovery";
 import { markAfterPaint, markOnce } from "./lib/performance";
 import {
   holdUnreachableGate,
@@ -18,16 +17,16 @@ import { LocalSettingsPage } from "./pages/LocalSettings";
 import { McpOAuthCallbackPage } from "./pages/McpOAuthCallback";
 import { ShellPage } from "./pages/Shell";
 
-const AuthPage = lazyWithRecovery("pages/Auth", () =>
+const AuthPage = lazy(() =>
   import("./pages/Auth").then((module) => ({ default: module.AuthPage })),
 );
-const PasswordResetPage = lazyWithRecovery("pages/Auth", () =>
+const PasswordResetPage = lazy(() =>
   import("./pages/Auth").then((module) => ({ default: module.PasswordResetPage })),
 );
-const OnboardingPage = lazyWithRecovery("pages/Onboarding", () =>
+const OnboardingPage = lazy(() =>
   import("./pages/Onboarding").then((module) => ({ default: module.OnboardingPage })),
 );
-const WelcomePage = lazyWithRecovery("pages/Welcome", () =>
+const WelcomePage = lazy(() =>
   import("./pages/Welcome").then((module) => ({ default: module.WelcomePage })),
 );
 

apps/web/src/lib/lazy-recovery.test.ts

@@ -1,78 +0,0 @@
-import { describe, expect, it, vi } from "vitest";
-import { loadWithRecovery } from "./lazy-recovery.js";
-
-function fakeStorage(initial: Record<string, string> = {}) {
-  const values = new Map(Object.entries(initial));
-  return {
-    getItem: (key: string) => values.get(key) ?? null,
-    setItem: (key: string, value: string) => void values.set(key, value),
-    removeItem: (key: string) => void values.delete(key),
-    values,
-  };
-}
-
-const fetchFailure = () => new TypeError("Failed to fetch dynamically imported module");
-const flag = "rakazo:module-reload:pages/Onboarding";
-
-describe("loadWithRecovery", () => {
-  it("returns the module and clears the reload flag when the import succeeds", async () => {
-    const storage = fakeStorage({ [flag]: "1" });
-    const reload = vi.fn();
-    const loaded = await loadWithRecovery("pages/Onboarding", async () => "module", {
-      storage,
-      reload,
-    });
-    expect(loaded).toBe("module");
-    expect(storage.values.has(flag)).toBe(false);
-    expect(reload).not.toHaveBeenCalled();
-  });
-
-  it("retries the import in place before touching the page", async () => {
-    const storage = fakeStorage();
-    const reload = vi.fn();
-    const load = vi
-      .fn<() => Promise<string>>()
-      .mockRejectedValueOnce(fetchFailure())
-      .mockResolvedValueOnce("module");
-    const loaded = await loadWithRecovery("pages/Onboarding", load, {
-      storage,
-      reload,
-      retryDelayMs: 0,
-    });
-    expect(loaded).toBe("module");
-    expect(load).toHaveBeenCalledTimes(2);
-    expect(reload).not.toHaveBeenCalled();
-    expect(storage.values.has(flag)).toBe(false);
-  });
-
-  it("reloads the page once when the retry fails as well", async () => {
-    const storage = fakeStorage();
-    const reload = vi.fn();
-    const load = vi.fn<() => Promise<string>>().mockRejectedValue(fetchFailure());
-    const pending = loadWithRecovery("pages/Onboarding", load, {
-      storage,
-      reload,
-      retryDelayMs: 0,
-    });
-    const outcome = await Promise.race([
-      pending.then(() => "resolved"),
-      new Promise<string>((resolve) => setTimeout(() => resolve("still pending"), 20)),
-    ]);
-    expect(outcome).toBe("still pending");
-    expect(load).toHaveBeenCalledTimes(2);
-    expect(reload).toHaveBeenCalledTimes(1);
-    expect(storage.values.get(flag)).toBe("1");
-  });
-
-  it("surfaces the failure instead of reloading again after a reload did not help", async () => {
-    const storage = fakeStorage({ [flag]: "1" });
-    const reload = vi.fn();
-    const failure = fetchFailure();
-    const load = vi.fn<() => Promise<string>>().mockRejectedValue(failure);
-    await expect(
-      loadWithRecovery("pages/Onboarding", load, { storage, reload, retryDelayMs: 0 }),
-    ).rejects.toBe(failure);
-    expect(reload).not.toHaveBeenCalled();
-    expect(storage.values.get(flag)).toBe("1");
-  });
-});

apps/web/src/lib/lazy-recovery.ts

@@ -1,58 +0,0 @@
-import type { ComponentType } from "react";
-import { lazy } from "react";
-
-export interface RecoveryOptions {
-  /** Pause before the in-place retry; the default covers a brief interface change. */
-  retryDelayMs?: number;
-  storage?: Pick<Storage, "getItem" | "setItem" | "removeItem">;
-  reload?: () => void;
-}
-
-const STORAGE_PREFIX = "rakazo:module-reload:";
-
-function delay(ms: number) {
-  return new Promise<void>((resolve) => setTimeout(resolve, ms));
-}
-
-/**
- * Load a lazily imported module, recovering from a fetch the browser aborted
- * (a network interface changed, the deploy behind the URL moved on). The first
- * recovery is a plain retry; when that fails too, the page reloads once, because
- * browsers keep a failed module in their module map and keep rejecting the same
- * import without touching the network. A second failure after the reload is
- * surfaced to the caller.
- */
-export async function loadWithRecovery<T>(
-  key: string,
-  load: () => Promise<T>,
-  options: RecoveryOptions = {},
-): Promise<T> {
-  const storage = options.storage ?? window.sessionStorage;
-  const reload = options.reload ?? (() => window.location.reload());
-  const storageKey = `${STORAGE_PREFIX}${key}`;
-  try {
-    const loaded = await load();
-    storage.removeItem(storageKey);
-    return loaded;
-  } catch {
-    await delay(options.retryDelayMs ?? 300);
-  }
-  try {
-    const loaded = await load();
-    storage.removeItem(storageKey);
-    return loaded;
-  } catch (error) {
-    if (storage.getItem(storageKey)) throw error;
-    storage.setItem(storageKey, "1");
-    reload();
-    return new Promise<never>(() => undefined);
-  }
-}
-
-/** `React.lazy` for route and overlay modules that must survive a failed module fetch. */
-export function lazyWithRecovery<T extends ComponentType<any>>(
-  key: string,
-  load: () => Promise<{ default: T }>,
-) {
-  return lazy(() => loadWithRecovery(key, load));
-}

apps/web/src/main.tsx

@@ -12,10 +12,6 @@ import { resolveUiLocale } from "./lib/ui-locale";
 import "./styles.css";
 
 markOnce("rk:renderer:module-evaluated");
-try {
-  // Set by the inline boot script in index.html before it reloads once.
-  sessionStorage.removeItem("rakazo:boot-reload");
-} catch {}
 installPreloadRecovery();
 applyUiDirection(resolveUiLocale());
 applyUiAppearance();

apps/web/src/pages/Shell.tsx

@@ -139,6 +139,7 @@ import {
 import {
   type ClipboardEvent,
   type DragEvent,
+  lazy,
   type MutableRefObject,
   memo,
   type RefObject,
@@ -200,7 +201,6 @@ import {
   resolveWorkingGroupBots,
 } from "../lib/group-stage";
 import { buildHeuteBrief } from "../lib/heute-brief";
-import { lazyWithRecovery } from "../lib/lazy-recovery";
 import { localTimezone } from "../lib/local-timezone";
 import { copyableMessageText } from "../lib/message-text";
 import { messageProviderLabel } from "../lib/messaging";
@@ -282,29 +282,27 @@ import {
 } from "./shell/message-cards";
 import { WindowChrome } from "./WindowChrome";
 
-const BotContextMenu = lazyWithRecovery("BotContextMenu", () =>
+const BotContextMenu = lazy(() =>
   import("./BotContextMenu").then((module) => ({ default: module.BotContextMenu })),
 );
-const MessagingSettingsOverlay = lazyWithRecovery("MessagingSettingsOverlay", () =>
+const MessagingSettingsOverlay = lazy(() =>
   import("./MessagingSettingsOverlay").then((module) => ({
     default: module.MessagingSettingsOverlay,
   })),
 );
-const SettingsOverlay = lazyWithRecovery("SettingsOverlay", () =>
+const SettingsOverlay = lazy(() =>
   import("./SettingsOverlay").then((module) => ({ default: module.SettingsOverlay })),
 );
-const PeerMessagesOverlay = lazyWithRecovery("PeerMessagesOverlay", () =>
+const PeerMessagesOverlay = lazy(() =>
   import("./PeerMessagesOverlay").then((module) => ({ default: module.PeerMessagesOverlay })),
 );
-const PluginsOverlay = lazyWithRecovery("PluginsOverlay", () =>
+const PluginsOverlay = lazy(() =>
   import("./PluginsOverlay").then((module) => ({ default: module.PluginsOverlay })),
 );
-const McpServersOverlay = lazyWithRecovery("McpServersOverlay", () =>
+const McpServersOverlay = lazy(() =>
   import("./McpServersOverlay").then((module) => ({ default: module.McpServersOverlay })),
 );
-const CallView = lazyWithRecovery("CallView", () =>
+const CallView = lazy(() => import("./CallView").then((module) => ({ default: module.CallView })));
-  import("./CallView").then((module) => ({ default: module.CallView })),
-);
 
 type Panel =
   | "computer"

apps/web/src/pages/shell/bot-panel.tsx

@@ -25,16 +25,15 @@ import {
   Toggle,
 } from "@rakazo/ui-web";
 import { X } from "lucide-react";
-import { Suspense, useEffect, useId, useRef, useState } from "react";
+import { lazy, Suspense, useEffect, useId, useRef, useState } from "react";
-import { lazyWithRecovery } from "../../lib/lazy-recovery";
 import { rpc } from "../../lib/rpc";
 import { AvatarStudioPopover } from "./avatar-studio-popover";
 
-const ScratchpadSection = lazyWithRecovery("ScratchpadSection", () =>
+const ScratchpadSection = lazy(() =>
   import("../ScratchpadSection").then((module) => ({ default: module.ScratchpadSection })),
 );
 
-const KnowledgeSection = lazyWithRecovery("KnowledgeSection", () =>
+const KnowledgeSection = lazy(() =>
   import("../KnowledgeSection").then((module) => ({ default: module.KnowledgeSection })),
 );
 

docs/self-host.md

@@ -36,9 +36,8 @@ Compose stack requires `SANDBOX_SUPERVISOR_TOKEN` for every provider; leave it e
 
 Optional: set `OPENROUTER_API_KEY` or connect a model in the UI after signup.
 
-The example defaults to `edge` (main builds). Published images are `linux/amd64` only for now;
+The example defaults to `edge` (main builds). Every publish is multi-arch (`amd64` + `arm64`), so
-arm64 publishing is paused until an arm64 runner with Docker buildx exists. Do not assume `latest`
+arm64 hosts need no special tag. Do not assume `latest` is present until a stable release exists.
-is present until a stable release exists.
 
 Open [http://127.0.0.1:5173](http://127.0.0.1:5173). The first registered user becomes the
 deployment owner. Put TLS in front of `:5173` for a public host and set the three public origins to
@@ -484,9 +483,8 @@ your CI cannot publish into someone else's.
 | `sha-<full-commit>` | every push and manual run | source-addressed; used by the updater sidecar |
 | `edge` | pushes to main | yes, to the newest main build |
 
-Every publish, including `edge` from main merges, is `linux/amd64` only for now: the image builds
+Every publish, including `edge` from main merges, is multi-arch (`amd64` + `arm64`): each
-natively on the Linux runner and one manifest is assembled per image. arm64 publishing is paused
+architecture builds natively on its own runner and one manifest is assembled per image. Until a
-until an arm64 runner with Docker buildx exists. Until a
 stable `vX.Y.Z` has been published, GHCR may only have `edge` and `sha-*` tags; do not pin
 `latest` unless that tag exists in the registry.
 

infra/updater/src/publish-workflow.test.ts

@@ -19,38 +19,31 @@ const workflow = parse(workflowText) as {
 };
 
 describe("server image publish workflow", () => {
-  it("builds amd64 natively on the Linux runner and keeps arm64 paused, not emulated", () => {
+  it("builds every architecture natively instead of emulating arm64", () => {
     expect(workflowText).not.toContain("setup-qemu-action");
-    expect(workflowText).toContain("arm64 is paused");
     const build = workflow.jobs.build;
     expect(build["runs-on"]).toContain("matrix.runner");
-    expect(build.strategy?.matrix?.arch).toEqual(["amd64"]);
+    expect(build.strategy?.matrix?.arch).toEqual(["amd64", "arm64"]);
     const runners = Object.fromEntries(
       (build.strategy?.matrix?.include ?? [])
         .filter((entry) => entry.arch !== undefined)
         .map((entry) => [entry.arch, entry.runner]),
     );
-    expect(runners).toEqual({ amd64: ["self-hosted", "evoo-ci", "Linux"] });
+    expect(runners).toEqual({
+      amd64: ["self-hosted", "evoo-ci", "Linux"],
+      arm64: ["self-hosted", "evoo-ci", "macOS"],
+    });
   });
 
-  it("publishes one verified manifest per image after the build", () => {
+  it("publishes one verified multi-arch manifest per image after both builds", () => {
     const publish = workflow.jobs.publish;
     expect(publish.needs).toBe("build");
     expect(workflowText).toContain("push-by-digest=true");
     expect(workflowText).toContain("docker buildx imagetools create");
-    expect(workflowText).toContain('if [[ "${#sources[@]}" -ne 1 ]]');
+    expect(workflowText).toContain("for want in linux/amd64 linux/arm64");
-    expect(workflowText).toContain("for want in linux/amd64; do");
     expect(workflowText).toContain("actions/attest-build-provenance@");
   });
 
-  it("names every image under the lowercase repository namespace", () => {
-    expect(workflowText).not.toContain("ghcr.io/${{ github.repository }}");
-    const references =
-      workflowText.match(/ghcr\.io\/\$\{\{ steps\.ns\.outputs\.repo \}\}\//g) ?? [];
-    expect(references.length).toBeGreaterThanOrEqual(6);
-    expect(workflowText).toContain("repo=${GITHUB_REPOSITORY,,}");
-  });
-
   it("keeps pull requests read-only and every action pinned to a commit", () => {
     const validate = workflow.jobs.validate;
     const build = workflow.jobs.build;

packages/testkit/src/e2e-ports.test.ts

@@ -1,12 +1,9 @@
-import { execFileSync } from "node:child_process";
+import { readFileSync } from "node:fs";
-import { chmodSync, mkdtempSync, readFileSync, writeFileSync } from "node:fs";
-import { tmpdir } from "node:os";
 import path from "node:path";
 import { describe, expect, it } from "vitest";
 
 const repoRoot = path.resolve(import.meta.dirname, "../../..");
 const scriptPath = path.join(repoRoot, "scripts/free-e2e-ports.sh");
-const script = readFileSync(scriptPath, "utf8");
 const playwrightWorkflow = readFileSync(
   path.join(repoRoot, ".github/workflows/playwright.yml"),
   "utf8",
@@ -18,62 +15,20 @@ function portsFromShellArray(source: string, name: string): number[] {
   return [...match![1].matchAll(/\b(\d+)\b/g)].map(([, port]) => Number(port));
 }
 
-/** Runs the script on a fake Linux host whose fuser never finds a listener, so nothing is killed. */
-function runScript(env: Record<string, string>): { status: number; output: string } {
-  const fakeBin = mkdtempSync(path.join(tmpdir(), "evoo-e2e-ports-"));
-  for (const [name, body] of [
-    ["uname", "echo Linux"],
-    ["fuser", "exit 1"],
-  ] as const) {
-    const file = path.join(fakeBin, name);
-    writeFileSync(file, `#!/usr/bin/env bash\n${body}\n`);
-    chmodSync(file, 0o755);
-  }
-  try {
-    const output = execFileSync("bash", [scriptPath], {
-      env: { PATH: `${fakeBin}:${process.env.PATH}`, ...env },
-      encoding: "utf8",
-      stdio: ["ignore", "pipe", "pipe"],
-    });
-    return { status: 0, output };
-  } catch (error) {
-    const failure = error as { status: number; stdout: string; stderr: string };
-    return { status: failure.status, output: `${failure.stdout}${failure.stderr}` };
-  }
-}
-
-function announcedPorts(output: string): number[] {
-  const match = output.match(/E2E ports \(([^)]*)\)/);
-  expect(match, "announced E2E ports").toBeTruthy();
-  return match![1].split(" ").map(Number);
-}
-
 describe("free-e2e-ports.sh", () => {
-  it("keeps the live dev ports apart from the default E2E ports", () => {
+  const script = readFileSync(scriptPath, "utf8");
-    const livePorts = portsFromShellArray(script, "LIVE_PORTS");
-    expect(livePorts).toEqual([3100, 5173]);
 
-    const run = runScript({});
+  it("declares dedicated E2E ports separate from live dev ports", () => {
-    expect(run.status).toBe(0);
+    const livePorts = portsFromShellArray(script, "LIVE_PORTS");
-    const e2ePorts = announcedPorts(run.output);
+    const e2ePorts = portsFromShellArray(script, "E2E_PORTS");
+
+    expect(livePorts).toEqual([3100, 5173]);
     expect(e2ePorts).toEqual([3110, 3111, 5180, 4321]);
     for (const livePort of livePorts) {
       expect(e2ePorts).not.toContain(livePort);
     }
   });
 
-  it("follows the harness port settings so runners on one host never touch each other", () => {
-    const run = runScript({ API_PORT: "3310", WEB_PORT: "5380", WWW_PORT: "4521" });
-    expect(run.status).toBe(0);
-    expect(announcedPorts(run.output)).toEqual([3310, 3311, 5380, 4521]);
-  });
-
-  it("refuses a port setting that is not a number", () => {
-    const run = runScript({ API_PORT: "abc" });
-    expect(run.status).toBe(1);
-    expect(run.output).toContain("API_PORT must be a port number");
-  });
-
   it("uses fuser and skips non-Linux hosts", () => {
     expect(script).toContain('fuser -k "$spec"');
     expect(script).toContain('uname -s)" != "Linux"');
@@ -89,13 +44,4 @@ describe("free-e2e-ports.sh", () => {
       playwrightWorkflow.indexOf("Run marketing homepage E2E"),
     );
   });
-
-  it("gets its ports from the workflow step that picks them per runner", () => {
-    const pickStep = playwrightWorkflow.indexOf("Pick E2E ports for this runner");
-    expect(pickStep).toBeGreaterThan(-1);
-    expect(pickStep).toBeLessThan(playwrightWorkflow.indexOf("free-e2e-ports.sh"));
-    for (const setting of ["API_PORT=", "WEB_PORT=", "WWW_PORT="]) {
-      expect(playwrightWorkflow).toContain(setting);
-    }
-  });
 });

scripts/free-e2e-ports.sh

@@ -1,22 +1,11 @@
 #!/usr/bin/env bash
 # Free stale listeners on dedicated Playwright/E2E ports before harness bind.
 # Never touches live dev stack ports 3100 (API) or 5173 (web).
-# The ports follow API_PORT, WEB_PORT and WWW_PORT so that runners sharing one host,
-# each with its own port set, never kill another job's servers.
 
 set -euo pipefail
 
-for setting in API_PORT WEB_PORT WWW_PORT; do
-  value="${!setting:-}"
-  if [[ -n "$value" && ! "$value" =~ ^[0-9]+$ ]]; then
-    echo "free-e2e-ports: $setting must be a port number, got: $value" >&2
-    exit 1
-  fi
-done
-
 readonly LIVE_PORTS=(3100 5173)
-api_port="${API_PORT:-3110}"
+readonly E2E_PORTS=(3110 3111 5180 4321)
-readonly E2E_PORTS=("$api_port" "$((api_port + 1))" "${WEB_PORT:-5180}" "${WWW_PORT:-4321}")
 
 if [[ "$(uname -s)" != "Linux" ]]; then
   echo "free-e2e-ports: skip (not Linux)"

scripts/publish-playwright-report.sh

@@ -1,13 +1,11 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-# Publishing is optional: without the S3 settings the gallery is skipped and the job stays green.
+: "${AWS_ACCESS_KEY_ID:?AWS_ACCESS_KEY_ID is required}"
-for setting in AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY S3_BUCKET S3_ENDPOINT PLAYWRIGHT_PUBLIC_BASE_URL; do
+: "${AWS_SECRET_ACCESS_KEY:?AWS_SECRET_ACCESS_KEY is required}"
-  if [[ -z "${!setting:-}" ]]; then
+: "${S3_BUCKET:?S3_BUCKET is required}"
-    echo "::notice::Skipping the Playwright report publish: $setting is not configured."
+: "${S3_ENDPOINT:?S3_ENDPOINT is required}"
-    exit 0
+: "${PLAYWRIGHT_PUBLIC_BASE_URL:?PLAYWRIGHT_PUBLIC_BASE_URL is required}"
-  fi
-done
 : "${PLAYWRIGHT_RESULT:?PLAYWRIGHT_RESULT is required}"
 : "${PLAYWRIGHT_RUN_ATTEMPT:?PLAYWRIGHT_RUN_ATTEMPT is required}"
 : "${PLAYWRIGHT_RUN_ID:?PLAYWRIGHT_RUN_ID is required}"