<div align="center">

```text
██╗    ██╗██╗██████╗ ███████╗
██║    ██║██║██╔══██╗██╔════╝
██║ █╗ ██║██║██████╔╝█████╗
██║███╗██║██║██╔══██╗██╔══╝
╚███╔███╔╝██║██║  ██║███████╗
 ╚══╝╚══╝ ╚═╝╚═╝  ╚═╝╚══════╝
        BOUNDED EXECUTION
```

**Rust execution core · typed TypeScript tools · signed admission**

`v1.0.0 source release` · `AGPL core / MIT integrations` · `sealed 2026-10-30; performance cleared`

</div>

Wire puts bounded parsing, Ed25519 budgets, rate limits, schemas and a pure-output cache behind
one native boundary. `@wire-runtime/sdk` and `@wire-runtime/cli` connect these tools to local MCP clients.
The archive name does not establish production clearance or npm publication.

## The problem

Tool servers repeatedly decode JSON, allocate transient objects and serialize responses.
Large frames and unrestricted handlers amplify memory use. Permissive adapters can lose session
identity or skip admission. Language runtimes, pipes and editor rendering add costs beyond parsing.
Wire isolates native work and makes its resource and trust boundaries explicit.

## Architecture

| Pillar | Contract |
|---|---|
| SIMD JSON | Borrowed input; runtime-selected AVX2/NEON with scalar fallback |
| Native hot paths | Allocation counters cover tested parsing/admission/cache/error paths; setup allocates |
| Ed25519 admission | Strict verification of 112-byte tokens, independent session binding, bounded nonce ledger |
| Sandbox | Opt-in lazy Wasmtime, fresh stores, instruction fuel, 239-page guest linear-memory ceiling (<15 MiB) |
| FFI containment | `release-ffi` requires `panic=unwind`; panic/poison produces closed errors |
| Observability | Optional fixed histograms and Prometheus scrape; disabled observers compile out |

JavaScript serialization and handlers allocate. Node/V8, JIT compilation, stacks and host state
are outside the guest memory ceiling. JavaScript handlers and native administration are trusted.

## Performance with scope

Latest controlled Windows x64 measurements (2026-10-30): Rust 1.94.0 GNU, native AVX2/FMA,
least-busy-core pin, `HIGH_PRIORITY_CLASS` for the runner and EcoQoS disabled for the child.
Latest gate outcome: **PASS on every gate**, in **two consecutive controlled runs**
(fresh-signature upper95 **43.1371 us** and **48.7001 us** against the strict `<50 us` bound).
No threshold was relaxed and no sample was discarded; the audit lists all seven attempts, including
the two that an externally loaded host invalidated.
Upper bounds apply to the mean's 95% confidence interval, not individual request deadlines.

| Operation | Mean (us) | Upper 95% CI (us) |
|---|---:|---:|
| budget/fresh_signature | 35.5717 | 43.1371 |
| budget/registered_admission | 0.0244 | 0.0245 |
| budget/exact_token_revalidation | 0.0844 | 0.0848 |
| budget/revalidation_4096 | 0.0848 | 0.0855 |
| cache/admitted_hit | 0.4127 | 0.4153 |
| cache/admitted_hit_10k | 39.1943 | 50.8786 |
| parse/strings/10240/Auto | 0.7508 | 0.7528 |
| parse/structural/10240/Auto | 8.8249 | 8.9508 |
| parse/whitespace/10240/Auto | 0.4458 | 0.4533 |
| parse/escaped/10240/Auto | 3.5230 | 4.0458 |

Standalone signed core peak RSS is **4,968,448 bytes (4.74 MiB)**, the highest of five 100-process
runs on 2026-10-30 (three reported an identical 4,964,352-byte peak; two added a single 4 KiB page).
The strict <7.20 MiB gate passes with 2,581,299 bytes (2.46 MiB) of headroom against its integer-byte
cutoff. This is an observed Windows working-set peak, not an OS memory cap. Guest linear memory is bounded to 239 pages, strictly below 15 MiB.
Node's process RSS is separate: SDK 46.15 MiB and direct native
44.51 MiB after 510,001 calls; both sustained-growth checks pass.
The optional Wasmtime compiler's host RSS is outside the guest ceiling.

The requested 12.16 us parse and 54.66 us cache figures are historical targets, not substituted
for these measurements. No controlled Python/Node parser/full-call comparison is available.
CPU flags and cached keys do not guarantee a wall-clock deadline under arbitrary host load.
Workspace defaults and the native build helper enforce host CPU tuning. Native artifacts require
the build host CPU features; platform and architecture matching alone does not establish CPU compatibility.
Use `python scripts/performance.py benchmark` for the host-native gate. The configuration behind the
published numbers is `--cpu auto --high-priority --performance-mode --cooldown 120`: it probes every
logical CPU, pins the least busy one, raises the runner's priority class without any privilege,
disables EcoQoS for the child, and idles after compilation so the package returns to its cool turbo
bins before the first timed sample. POSIX runners can add `--nice -10`; `--cpu 7 --above-normal`
reproduces the earlier configuration. Windows-only scheduling switches are optional and never change
system power policy. Seven attempts and their conditions are recorded in the audit: two failed only
because an unrelated process stalled ~580 ms of a four-second window or held the package at a lower
clock, and no gate was adjusted afterwards.

Native executors raise the calling thread **only for the duration of a transaction** with
`THREAD_PRIORITY_TIME_CRITICAL` on Windows, `SCHED_FIFO` (falling back to `nice -10` when
unprivileged) on Linux, and `QOS_CLASS_USER_INTERACTIVE` on macOS. Escalation is lazy and
scope-scoped: `rt::elevate()` is entered immediately before signature verification or IPC frame
processing and its guard restores the previous thread class on drop, including unwind paths.
`initialize` also runs a bounded strict Ed25519 warm-up (`WIRE_PREWARM_MS`, default 25 ms, `0`
disables) before publishing the engine. Affinity is opt-in with `WIRE_PIN_CPU=<index>` and every
hook is disabled with `WIRE_RT=off`. `schedulingStatus()` reports the active class without
mutating it. These hooks reduce scheduler and P-state jitter; they cannot create a wall-clock
deadline on a saturated host. The 2026-10-29 post-hook runs and the 2026-10-30 re-measurement are
recorded in the audit report.

**Idle behavior.** No polling loop, timer, sleep or background thread exists in the runtime path:
an idle dispatcher sits in its caller's blocking read and contributes 0.0% CPU between
transactions. Wasm guest execution is joined per invocation and never outlives the call; the
express-mcp SSE keepalive is `unref`'d so it cannot hold a process open. Elevation, cache and
nonce state are released when the guard drops, so no priority, affinity or timer state survives
the completed transaction.

## Build and quickstart

Use Rust 1.94.0, Node >=20 and pnpm 9.15.0. CI selects Node 24.22.1. The core without sandbox retains
MSRV 1.85; Wasmtime 36 needs >=1.86. Windows release addons need MSVC build tools and Windows SDK.
Verification tooling uses Python >=3.11 and `PyYAML==6.0.3`.
This source archive contains no native modules, npm tarballs, dependency stores or build caches.

```sh
pnpm install --frozen-lockfile
node scripts/native.mjs build
pnpm build
pnpm typecheck
node scripts/native.mjs native-tests
pnpm test
```

The SDK loads a matching platform package or the locally built `packages/sdk/native/` fallback.
Supported release targets: Linux x64/ARM64 glibc >=2.28, macOS ARM64, Windows x64 MSVC.
Installation never compiles native code. All four native CI runners must pass before publication.

For a local consumer, pack your verified build instead of assuming the npm namespace is published:

```sh
mkdir release-packages
pnpm --dir packages/sdk pack --pack-destination ../../release-packages
pnpm --dir packages/cli pack --pack-destination ../../release-packages
# Select the directory matching your local verified native build:
pnpm --dir packages/native/linux-x64-gnu pack --pack-destination ../../../release-packages
node packages/cli/dist/index.js init demo --yes
cd demo
# Replace these with absolute paths to the three tarballs just built:
npm install --ignore-scripts /ABS/sdk.tgz /ABS/cli.tgz /ABS/native.tgz @sinclair/typebox@0.34.52
npm run dev
```

`wire dev --calls 2 --metrics` demonstrates native exhaustion through a loopback development
console. Its signing keys are ephemeral. `wire build` emits `dist/tools.mjs` and `dist/server.mjs`.
Production startup requires externally issued credentials and independently configured trust.

## Quick-start and integration templates

Build the native addon and TypeScript packages once, then run any template check from the
repository root. The checks use the local SDK/addon and contact no network.

```sh
node scripts/native.mjs build
pnpm build

node templates/claude-desktop/verify.mjs     # MCP handshake + tampered-token rejection
npm --prefix templates/agent-harness test     # two tool calls + native budget debit
node templates/express-mcp/smoke-test.js      # HTTP/SSE wrapper + JSON-RPC framing
```

| Template | What it proves |
|---|---|
| `templates/claude-desktop/` | `claude_desktop_config.json` (with `WIRE_RT`/`WIRE_PREWARM_MS`) and `verify.mjs`: rejects a tampered budget, negotiates MCP, lists tools, executes a call and checks one allowance was charged |
| `templates/agent-harness/` | `agent_integration.ts` typed tool/session/budget example, plus `test.mjs` proving two admitted calls debit exactly two allowances |
| `templates/express-mcp/` | Zero-dependency `node:http` MCP endpoint (`POST /mcp`, `GET /sse`, `GET /healthz`) and a fetch-based smoke test covering JSON and event-stream framing |

Outside this repository the primary `@wire-runtime/sdk` import resolves the published SDK and its
matching platform package; the relative fallback is only for this checkout. One loaded addon
instance is one trust domain: run N agents as N processes, each with its own token, session and
trust map. See [Security and threat model](#security-and-threat-model).

## Production credentials

On the **issuer's separate trusted machine**, run `wire budget keygen --out issuer-keys`, then
`wire budget mint --key issuer-keys/private.pem --session <32-lowercase-hex> --calls 1000
--ttl 3600 --key-id 7 --out budget.bin`. Deliver only the raw 112-byte token, independently
established session identity and public-key trust map to the runtime. Keep private keys with the issuer.

Set these values through the process supervisor or editor configuration:

```text
WIRE_BUDGET_FILE=/ABSOLUTE/PATH/secrets/budget.bin
WIRE_SESSION_ID=<independently-authenticated-32-lowercase-hex>
WIRE_TRUSTED_KEYS_FILE=/ABSOLUTE/PATH/secrets/trusted-keys.json
WIRE_SESSION_GUARD_DIR=/ABSOLUTE/PATH/durable-session-guard
WIRE_PROTOCOL=mcp
WIRE_TELEMETRY=0
WIRE_RT=on
WIRE_PREWARM_MS=25
```

`WIRE_RT=off` disables the per-thread scheduling hooks, `WIRE_PREWARM_MS` bounds the Ed25519
warm-up (default 25, `0` disables) and `WIRE_PIN_CPU=<index>` opts into affinity.

The trust-map format is `{"7":"<64-lowercase-hex-public-key>"}`. Invalid signatures, expiry and
missing credentials fail startup. Precreate the restricted durable guard directory. Exclusive,
verified session markers prevent restarting a process from restoring a spent allowance. Preserve
markers and issue a fresh session after restart. Replicas need deliberately partitioned allowances.
Without a durable guard or external accounting, replay protection remains process-local.

## Codex CLI, Claude Desktop, Cursor and VS Code

1. Build the app and provision credentials above. Use absolute paths for Node, `dist/server.mjs`,
   credentials and guard directory. Escape backslashes in Windows JSON paths.
2. Copy or merge the matching configuration below, replacing every placeholder.
3. Reload the client and confirm Wire's tool list. Approve a harmless call, then test exhaustion
   and restart rejection with a test session before assigning a production allowance.

| Client | Template | Configuration location |
|---|---|---|
| Claude Desktop | `templates/ecosystems/claude/claude_desktop_config.json` | Settings → Developer → Edit Config; merge `mcpServers.wire` |
| Cursor | `templates/ecosystems/cursor/mcp.json`, `.cursorrules` | Project `.cursor/mcp.json`; project-root `.cursorrules` |
| VS Code | `templates/ecosystems/vscode/mcp.json`, `extensions.json`, `settings.json` | Project `.vscode/`; review workspace trust and server approval |
| Codex | `templates/ecosystems/codex/config.toml`, `AGENTS.md`, `.codexrules` | Merge TOML into `~/.codex/config.toml` or trusted project `.codex/config.toml`; merge instructions into project-root `AGENTS.md` |

The bounded legacy MCP adapter negotiates 2025-11-25, 2025-06-18, 2025-03-26 or 2024-11-05 and
supports initialize/initialized, ping, tools/list and tools/call. Modern 2026-07-28 MCP is not
implemented. Clients must negotiate a supported version. Templates cannot guarantee editor
roundtrip latency; stdio pipes and MCP serialization have separate costs.

Configuration references: [Claude Desktop](https://modelcontextprotocol.io/docs/develop/connect-local-servers),
[Cursor](https://cursor.com/docs/mcp), [VS Code](https://code.visualstudio.com/docs/agent-customization/mcp-servers),
[Codex MCP](https://learn.chatgpt.com/docs/extend/mcp?surface=cli). Live client UI acceptance remains an operator check.

## Enterprise Docker and Kubernetes

Use `templates/ecosystems/enterprise/` with a complete app context: package lockfile, production
dependencies, built app and verified matching native package. Build the Dockerfile with a verified
immutable `NODE_IMAGE` digest for your architecture. Replace image digests, per-session Secret and
PVC names in `sidecar.yaml`, render the manifest and run cluster validation before applying it.

The sidecar serves bounded local Unix RPC and loopback Prometheus at `127.0.0.1:9464/metrics`.
`prometheus.yaml` supports a same-pod scraper; the OpenTelemetry collector forwards local scrapes.
Container limits include Node/JIT overhead. Templates use non-root users, read-only roots, dropped
capabilities, runtime-default seccomp and default-deny networking. Supply narrowly scoped required
egress. Actual image builds and cluster acceptance need real deployment runners.
The gateway is local Wire JSON RPC, not a public MCP/HTTP endpoint. Route application calls through the pod-local socket, provide app tools at `dist/tools.mjs`, and keep telemetry loopback-only. Rotate sessions after restarts; never delete guard markers to recover an allowance.

`deploy/` contains the single-host production manifests: `wire-runtime.service` sets `Nice=-20`,
`CPUSchedulingPolicy=fifo`, priority 99 and `CPUAffinity=2`; `docker-compose.yml` sets `cpuset`,
read-only roots, dropped capabilities and a 7.20 MiB native-probe gate. Run
`deploy/verify-deployment.sh --static` anywhere to check the invariants; `--container` also builds
the probe, checks Docker's memory limit and cgroup `memory.max`, and executes the binary inside the
7.20 MiB cgroup. A Node gateway cannot run in 7.20 MiB, so its ceiling is 96M; the 7.20 MiB limit
applies only to the measured 4.74 MiB standalone core.

## Security and threat model

**Confused deputy:** admission checks issuer trust and independent session identity; cache keys
include authorization scope and policy generation. Budgets limit calls, not arbitrary business
permissions. Handlers must authorize each actual resource.

**Process per trust domain:** one loaded addon instance owns one initialized trust domain and one
authenticated session; `initialize` is single-use. Run N agents as N processes or containers, each
with its own signed token, session id, trust map and durable guard directory. Replicas require
deliberately partitioned allowances; do not clone a shared allowance across processes.

**Prompt injection:** signed allowances, rate limits, schemas and explicit sandbox capabilities
bound tool activity. They cannot identify all malicious natural-language instructions. Treat tool
results/descriptions as untrusted, retain client approvals and enforce handler authorization.

**Resource exhaustion:** bounded frames, fixed ledgers/cache/pending slots, atomic allowance debits
and guest fuel/memory limits constrain their respective layers. Trusted handlers, compilation and
OS exhaustion still need process/container supervision.

**Panic containment:** exported work uses unwind guards; poison fails closed. Allocation failure,
abort, external termination and native undefined behavior cannot be recovered by `catch_unwind`.
Fault injection is test-only and excluded from production prebuilds. Never commit live credentials.

### Security reporting

Report suspected vulnerabilities privately through GitHub Security Advisories
(**Security → Advisories → Report a vulnerability**). If private reporting is unavailable, contact
the maintainers at `security@wire.example`; repository owners must replace this placeholder with a
monitored security mailbox before publication. Do not open a public issue, pull request or
discussion for an undisclosed vulnerability.

Include the affected Wire version or commit, operating system and architecture, configuration,
reproduction steps, observed impact and any suggested mitigation. Do not attach live signing
keys, budget tokens, session identifiers or customer data. Maintainers will acknowledge the
report, triage it privately, coordinate a fix and disclosure timeline, and credit reporters who
request attribution once a coordinated disclosure is agreed.

## Verification and packaging

```sh
python scripts/release.py audit
python tests/performance.py
cargo test --workspace --features wire-core/sandbox,wire-core/telemetry --locked
cargo run -p wire-core --release --example parser_stress --locked
python scripts/performance.py benchmark
node --max-old-space-size=32 --max-semi-space-size=2 --expose-gc scripts/native.mjs rss-native
python scripts/release.py package
```

Template and deployment checks:

```sh
node templates/claude-desktop/verify.mjs
npm --prefix templates/agent-harness test
node templates/express-mcp/smoke-test.js
deploy/verify-deployment.sh --static      # use Git Bash on Windows
```

`deploy/verify-deployment.sh --container` requires Docker and additionally validates Docker's
memory limit, the cgroup `memory.max` and probe execution; the static mode validates the manifests
without a container runtime.

The public harness contains exactly four runners:

| Runner | Actions |
|---|---|
| `scripts/release.py` | `audit`, `ecosystems`, `package` |
| `scripts/performance.py` | `benchmark`, `signature`, `parse`, `rss`, `isolation`, `telemetry`, `stress` |
| `scripts/native.mjs` | `build`, `smoke`, `verify`, `prepare`, `consumer`, `license-output`, `native-tests`, `rss-sdk`, `rss-native` |
| `scripts/safety.mjs` | Fault-enabled addon panic/unwind verification |

`tests/performance.py` checks strict gate rejection behavior. Workflows call these runners directly.
Build the standalone probe with `cargo build -p wire-core --release --features std --bin core_memory_probe --locked`,
then run `python scripts/performance.py rss target/release/core_memory_probe` (append `.exe` on Windows).
The RSS runner fails at or above 7.20 MiB; the separate guest-memory bound remains 239 pages.

Trusted verification keys are decoded once and stored immutably. Fresh signature computation
reads them without a key-cache lock and runs outside the session ledger mutex. Registration
rechecks the clock and token ledger before insertion; simultaneous registration cannot reset
spent counters. Admission accounting and the FFI engine retain synchronization for joint state changes.

The campaign defaults to 5,000,000 deterministic inputs with available SIMD/scalar parity checks.
Guard pages, forgery/replay tests, hostile guests, concurrent FFI fault injection and supported
Unix transport checks complement it. Finite tests do not prove freedom from all defects.
Publication requires exact-commit native-release and production-validation success. Standalone core RSS, guest limits, Node stability and latency are distinct gates; the latency gate is now green in two consecutive controlled runs on this host and toolchain. A failed required gate remains blocking; acceptance on other operating systems, container runtimes and live editors is still pending.

## Component licensing and contributions

This distribution uses two component licenses, rather than offering an unrestricted choice
of licenses for the entire runtime:

| Component | SPDX license | License text |
|---|---|---|
| `crates/wire-core`, `crates/wire-ffi`, native npm addons, internal Rust/release tooling | AGPL-3.0-only | `LICENSE`, `LICENSES/AGPL-3.0-only.txt` |
| `packages/sdk`, `packages/cli`, `templates/`, `wire-portal` | MIT | Their `LICENSE` files and `LICENSES/MIT.txt` |

MIT wrappers do not relicense the AGPL native addon they load. Distributing a combined application
must preserve applicable component obligations and upstream notices. Third-party licenses remain
intact in `third-party-licenses/`, platform package license folders and
`LICENSES/THIRD_PARTY_NOTICES.txt`. Strict JSON stays valid; `REUSE.toml` supplies component-specific
SPDX annotations instead of injecting comments or unknown schema properties.

Contributions require permission to contribute under the destination component's license and
DCO sign-off (`git commit -s`, real contributor identity, `Signed-off-by: Name <email>`).
The maintainer also requires an executed CLA before merging external contributions. It must
identify the contributor, actual recipient legal entity, covered work, granted rights and
signatures. DCO does not replace the CLA; no unsigned submission implies copyright assignment.
The maintainer supplies the operative agreement. Do not relicense third-party contributions
without authority. Keep changes reviewable and run the checks below.

## Codex modes and transport contract

The template was checked against Codex CLI `0.163.0-alpha.11.1` and current official MCP docs.
After replacing absolute paths and provisioning credentials, verify discovery with `codex mcp list`.
Use `codex --sandbox read-only --ask-for-approval on-request` for review and
`codex --sandbox workspace-write --ask-for-approval on-request` for editing. Unattended jobs can
use `codex exec --sandbox workspace-write --ask-for-approval never` inside an appropriately
restricted runner; failures return to the caller. Check `codex exec --help` for your installed version.
The historical `--suggest`, `--auto-edit` and `--full-auto` switches are absent in the verified CLI.
`codex_env.json` is not a native Codex configuration format; the supplied TOML is the supported
launch/environment mapping. `.codexrules` is a compatibility note; Codex reads `AGENTS.md`.
Instructions guide tool selection. They cannot disable arbitrary other tools: server-side
signed admission and OS policy enforce the actual trust boundary.

MCP clients exchange newline-delimited JSON over standard pipes. Wire's synchronous N-API
buffer ABI is binary internally; it does not turn MCP stdio into end-to-end zero-copy transport.
The stdio adapters share the same native admission checks. No signing key is passed to an editor.
See [official Codex MCP configuration](https://learn.chatgpt.com/docs/extend/mcp?surface=cli) and
[CLI command reference](https://learn.chatgpt.com/docs/developer-commands?surface=cli).

All editor and Docker launch examples set `--max-old-space-size=32 --max-semi-space-size=2`.
These tune V8's heap/young-generation collection thresholds; they do not cap process RSS or
force GC in an embedding process. Native output, control and diagnostic buffers are allocated
once per dispatcher. Tickets and returned replies keep independent ownership across asynchronous
calls. Runtime configuration bounds request/output buffers, cache entries and native pending slots.
Node stability tests execute 510,001 calls and reject more than 8 MiB sustained growth between
the first and last measured batches. Operators must still bound handler concurrency/work and use
supervisor/container memory limits appropriate to V8 overhead.

## Rust sandbox lifecycle

Enable `wire-core/sandbox` for the pinned Wasmtime/wasmtime-wasi 36.0.19 packages. Default
normal dependencies exclude them. Retain a lazy `Sandbox`; compile trusted registered tool
binaries (<=1 MiB, fuel 1..=10,000,000) once. Bind `ModuleGrant` entries to the exact immutable
compiled handles and trusted key policy. Retain one `BudgetAuthority<N>` per trust domain.
`authorize(token, independently_authenticated_session, tool, capabilities)` debits a call and
returns a single-use `InvocationPermit`; consume it using `Sandbox::execute`.

Every invocation creates a fresh store, globals, memory and WASI state. The export ABI is
`(i64) -> i64`; `wire.call(i32, i64) -> i64` invokes explicit capability bits 0..63 through a
trusted host bridge. No unchecked guest pointer crosses that interface. Requested rights must
fit both the issuer's module grant and compiled tool policy. Failed calls still consume budget.

Guest linear memory is limited to 239 pages (15,663,104 bytes), one memory/instance/table,
1024 table elements, and a 256 KiB guest stack. Initial allocation and growth are checked;
denied growth fails the call even if ignored by guest code. WASI arguments/environment are
empty; filesystem, sockets, DNS, inherited stdio, clocks and entropy imports are denied.
Only a narrow Preview 1 import allowlist and explicit bridge are available. Threads, GC,
memory64, shared/multiple memories and unknown imports are denied by policy/feature selection.

Fuel charges guest instructions including start functions, not compiler or trusted callback work.
The host must bound compilation counts, callbacks and wall time. `release-sandbox` enables unwind
containment; abort/OOM cannot be caught. A 239-page guest bound is not a <15 MiB Wasmtime host RSS
guarantee: JIT code, WASI metadata, stacks and compiler state consume separate host memory.
`core_memory_probe` measures a standalone signed native engine with 64 cache entries, 32 pending
slots, 16 KiB frame/output bounds and 100,000 calls, excluding the optional Wasmtime compiler.

## Required developer checks

```sh
cargo fmt --all -- --check
cargo check --workspace --all-targets --locked
cargo clippy --workspace --all-targets --features wire-core/sandbox,wire-ffi/telemetry,wire-ffi/test-fault-injection --locked -- -D warnings
cargo test --workspace --features wire-core/sandbox,wire-core/telemetry --locked
cargo check -p wire-core --no-default-features --locked
pnpm build
pnpm typecheck
WIRE_NATIVE_TESTS=1 pnpm test
python -m pip install PyYAML==6.0.3
python scripts/release.py ecosystems
python tests/performance.py
python scripts/performance.py benchmark
python scripts/release.py audit
python scripts/release.py package
```

Use the platform's environment-variable syntax on Windows. Build FFI with `--profile release-ffi`;
plain `--release` intentionally fails its abort guard. Build sandbox hosts with
`--profile release-sandbox`. Every release profile uses opt-level 3, fat LTO and one codegen unit;
`release` additionally sets `panic=abort` and strips symbols for standalone binaries and the probe,
while `release-ffi` and `release-sandbox` pin `panic=unwind` and keep symbols so panic containment
and native export checks still work.
Workspace and native helper CPU flags require host AVX2/FMA on x64 or NEON on ARM64.
The helper rejects mismatched build-host architectures and overrides caller flags with native
tuning. Native artifacts can require additional features selected by `target-cpu=native`; deploy
only to compatible CPUs. A portable baseline needs a separate build and validation process.

The ZIP is deterministic source: sorted paths, fixed timestamps/permissions, embedded
`SOURCE_SHA256SUMS`, CRC and byte-for-byte verification. Dependencies, native binaries, temporary
reports, build tools and raw measurement dumps are excluded. Rebuild on each release target
and run the exact source revision through native/platform and production-validation CI before
publishing packages. The single official audit records what was actually executed locally.

Before source packaging, remove generated dependency/build/tool directories and native prebuild outputs;
`python scripts/release.py audit --release-clean` must pass. Keep verified platform binaries in
the separate native release pipeline; the pristine source ZIP intentionally contains none.

The v1.0.0 source tree is initialized as a Git repository with a multi-tier `.gitignore`; build
outputs, dependency stores, native addons and local logs stay untracked. The live audit verdict,
including any unmet gate, is authoritative over the archive or repository name.