HumanAssisted
diff --git a/‎.githooks/pre-commit‎
Lines changed: 29 additions & 0 deletions b/‎.githooks/pre-commit‎
Lines changed: 29 additions & 0 deletions
diff --git a/‎.github/workflows/nodejs.yml‎
Lines changed: 11 additions & 0 deletions b/‎.github/workflows/nodejs.yml‎
Lines changed: 11 additions & 0 deletions
diff --git a/‎.github/workflows/python.yml‎
Lines changed: 2 additions & 2 deletions b/‎.github/workflows/python.yml‎
Lines changed: 2 additions & 2 deletions
diff --git a/‎.github/workflows/release-cli.yml‎
Lines changed: 158 additions & 0 deletions b/‎.github/workflows/release-cli.yml‎
Lines changed: 158 additions & 0 deletions
diff --git a/‎.gitignore‎
Lines changed: 9 additions & 0 deletions b/‎.gitignore‎
Lines changed: 9 additions & 0 deletions
diff --git a/‎Makefile‎
Lines changed: 17 additions & 0 deletions b/‎Makefile‎
Lines changed: 17 additions & 0 deletions
@@ -0,0 +1,29 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Block accidental mutation of canonical cross-language fixtures.
+# To intentionally update these files, run:
+#   UPDATE_CROSS_LANG_FIXTURES=1 make regen-cross-lang-fixtures
+# and commit with UPDATE_CROSS_LANG_FIXTURES=1 in the environment.
+
+changed="$(git diff --cached --name-only --diff-filter=ACMRD)"
+
+if [ -z "${changed}" ]; then
+  exit 0
+fi
+
+if echo "${changed}" | rg -q '^jacs/tests/fixtures/cross-language/'; then
+  case "${UPDATE_CROSS_LANG_FIXTURES:-}" in
+    1|true|TRUE|yes|YES)
+      ;;
+    *)
+      echo "ERROR: staged cross-language fixture changes detected." >&2
+      echo "Set UPDATE_CROSS_LANG_FIXTURES=1 when intentionally regenerating fixtures." >&2
+      echo "Recommended flow:" >&2
+      echo "  UPDATE_CROSS_LANG_FIXTURES=1 make regen-cross-lang-fixtures" >&2
+      exit 1
+      ;;
+  esac
+fi
+
+exit 0
@@ -6,12 +6,14 @@ on:
     paths:
       - 'jacsnpm/**'
       - 'jacs/**'  # jacsnpm depends on jacs
+      - 'binding-core/**'  # jacsnpm verifyStandalone depends on binding-core
       - '.github/workflows/nodejs.yml'
   pull_request:
     branches: [ "main" ]
     paths:
       - 'jacsnpm/**'
       - 'jacs/**'  # jacsnpm depends on jacs
+      - 'binding-core/**'  # jacsnpm verifyStandalone depends on binding-core
       - '.github/workflows/nodejs.yml'
   workflow_dispatch: # Allows manual triggering
 
@@ -52,6 +54,15 @@ jobs:
         working-directory: jacsnpm
         run: npm run build
 
+      - name: Run cross-language tests (hermetic env)
+        working-directory: jacsnpm
+        env:
+          JACS_DATA_DIRECTORY: /tmp/does-not-exist
+          JACS_KEY_DIRECTORY: /tmp/does-not-exist
+          JACS_DEFAULT_STORAGE: memory
+          JACS_KEY_RESOLUTION: hai
+        run: npm run test:cross-language
+
       - name: Run tests
         working-directory: jacsnpm
         run: npm test
 
@@ -39,7 +39,7 @@ jobs:
               cd /workspace/jacspy && \
               /opt/python/cp311-cp311/bin/python3.11 -m venv .venv && \
               source .venv/bin/activate && \
-              pip install maturin pytest && \
+              pip install maturin pytest pytest-asyncio && \
               pip install fastmcp mcp starlette && \
               make test-python"
 
@@ -88,7 +88,7 @@ jobs:
           set -euo pipefail
           uv venv /tmp/jacs-wheel-smoke
           uv pip install --python /tmp/jacs-wheel-smoke/bin/python dist/jacs-*.whl
-          uv run --python /tmp/jacs-wheel-smoke/bin/python python - <<'PY'
+          /tmp/jacs-wheel-smoke/bin/python - <<'PY'
           import jacs
           import jacs.simple
           import jacs.hai
 
@@ -0,0 +1,158 @@
+name: Release CLI Binaries
+
+on:
+  push:
+    tags:
+      - 'cli/v*'
+
+permissions:
+  contents: write
+
+jobs:
+  verify-version:
+    runs-on: ubuntu-latest
+    outputs:
+      version: ${{ steps.extract.outputs.version }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Extract version from tag
+        id: extract
+        run: |
+          TAG="${GITHUB_REF#refs/tags/cli/v}"
+          echo "version=$TAG" >> $GITHUB_OUTPUT
+
+      - name: Check Cargo.toml version matches tag
+        run: |
+          TAG_VERSION="${{ steps.extract.outputs.version }}"
+          CARGO_VERSION=$(grep '^version = ' jacs/Cargo.toml | head -1 | sed 's/version = "\(.*\)"/\1/')
+          echo "Cargo version: $CARGO_VERSION, tag: $TAG_VERSION"
+          if [ "$CARGO_VERSION" != "$TAG_VERSION" ]; then
+            echo "::error::Version mismatch! jacs/Cargo.toml has $CARGO_VERSION but tag is $TAG_VERSION"
+            exit 1
+          fi
+
+  build:
+    needs: verify-version
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: macos-latest
+            target: aarch64-apple-darwin
+            artifact_name: jacs-cli
+            asset_name: jacs-cli-${{ needs.verify-version.outputs.version }}-darwin-arm64
+            archive: tar.gz
+          - os: macos-14
+            target: x86_64-apple-darwin
+            artifact_name: jacs-cli
+            asset_name: jacs-cli-${{ needs.verify-version.outputs.version }}-darwin-x64
+            archive: tar.gz
+          - os: ubuntu-latest
+            target: x86_64-unknown-linux-gnu
+            artifact_name: jacs-cli
+            asset_name: jacs-cli-${{ needs.verify-version.outputs.version }}-linux-x64
+            archive: tar.gz
+          - os: ubuntu-24.04-arm
+            target: aarch64-unknown-linux-gnu
+            artifact_name: jacs-cli
+            asset_name: jacs-cli-${{ needs.verify-version.outputs.version }}-linux-arm64
+            archive: tar.gz
+          - os: windows-latest
+            target: x86_64-pc-windows-msvc
+            artifact_name: jacs-cli.exe
+            asset_name: jacs-cli-${{ needs.verify-version.outputs.version }}-windows-x64
+            archive: zip
+
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          toolchain: '1.93'
+          targets: ${{ matrix.target }}
+
+      - name: Build CLI binary
+        run: cargo build --release -p jacs --features cli --target ${{ matrix.target }}
+
+      - name: Smoke test (Unix)
+        if: runner.os != 'Windows'
+        run: ./target/${{ matrix.target }}/release/jacs --version
+
+      - name: Smoke test (Windows)
+        if: runner.os == 'Windows'
+        run: .\target\${{ matrix.target }}\release\jacs.exe --version
+
+      - name: Package (Unix)
+        if: runner.os != 'Windows'
+        run: |
+          cp target/${{ matrix.target }}/release/jacs jacs-cli
+          tar czf ${{ matrix.asset_name }}.tar.gz jacs-cli
+          shasum -a 256 ${{ matrix.asset_name }}.tar.gz > ${{ matrix.asset_name }}.tar.gz.sha256
+
+      - name: Package (Windows)
+        if: runner.os == 'Windows'
+        shell: pwsh
+        run: |
+          Copy-Item "target/${{ matrix.target }}/release/jacs.exe" "jacs-cli.exe"
+          Compress-Archive -Path "jacs-cli.exe" -DestinationPath "${{ matrix.asset_name }}.zip"
+          Get-FileHash "${{ matrix.asset_name }}.zip" -Algorithm SHA256 | ForEach-Object { "$($_.Hash.ToLower())  ${{ matrix.asset_name }}.zip" } | Out-File "${{ matrix.asset_name }}.zip.sha256" -Encoding ascii
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: ${{ matrix.asset_name }}
+          path: |
+            ${{ matrix.asset_name }}.*
+
+  release:
+    needs: [verify-version, build]
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          path: artifacts
+
+      - name: Collect checksums
+        run: |
+          cd artifacts
+          find . -name "*.sha256" -exec cat {} \; > ../sha256sums.txt
+          cd ..
+          cat sha256sums.txt
+
+      - name: Create GitHub Release
+        uses: softprops/action-gh-release@v2
+        with:
+          tag_name: cli/v${{ needs.verify-version.outputs.version }}
+          name: JACS CLI v${{ needs.verify-version.outputs.version }}
+          body: |
+            ## JACS CLI v${{ needs.verify-version.outputs.version }}
+
+            Prebuilt CLI binaries for verifying and signing JACS documents.
+
+            ### Install
+
+            Download the binary for your platform, extract, and add to your PATH:
+
+            ```bash
+            # macOS (Apple Silicon)
+            curl -LO https://github.com/HumanAssisted/JACS/releases/download/cli/v${{ needs.verify-version.outputs.version }}/jacs-cli-${{ needs.verify-version.outputs.version }}-darwin-arm64.tar.gz
+            tar xzf jacs-cli-*.tar.gz
+            sudo mv jacs-cli /usr/local/bin/
+
+            # Linux (x86_64)
+            curl -LO https://github.com/HumanAssisted/JACS/releases/download/cli/v${{ needs.verify-version.outputs.version }}/jacs-cli-${{ needs.verify-version.outputs.version }}-linux-x64.tar.gz
+            tar xzf jacs-cli-*.tar.gz
+            sudo mv jacs-cli /usr/local/bin/
+            ```
+
+            Or install via npm/pip (ships with `@hai.ai/jacs` and `jacs`).
+
+            ### Verify checksums
+            ```bash
+            shasum -a 256 -c sha256sums.txt
+            ```
+          files: |
+            artifacts/**/*.tar.gz
+            artifacts/**/*.zip
+            sha256sums.txt
@@ -20,3 +20,12 @@ scratch.md
 jacs.config.json
 !jacs/jacs.config.json
 .DS_Store
+
+# Runtime artifacts from tests
+var/
+documents/
+jacsnpm/var/
+
+# Generated by quickstart/persistent agent tests
+**/jacs_data/
+**/jacs_keys/
@@ -3,6 +3,7 @@
         release-jacs release-jacspy release-jacsnpm release-all \
         retry-jacspy retry-jacsnpm \
         version versions check-versions check-version-jacs check-version-jacspy check-version-jacsnpm \
+        install-githooks regen-cross-lang-fixtures \
         help
 
 # ============================================================================
@@ -58,6 +59,18 @@ test-jacsnpm:
 
 test: test-jacs
 
+# Regenerate all canonical cross-language fixtures in sequence.
+# This intentionally mutates tracked fixture files.
+regen-cross-lang-fixtures:
+	UPDATE_CROSS_LANG_FIXTURES=1 cargo test -p jacs --test cross_language_tests -- --nocapture
+	cd jacspy && UPDATE_CROSS_LANG_FIXTURES=1 pytest tests/test_cross_language.py -q
+	cd jacsnpm && UPDATE_CROSS_LANG_FIXTURES=1 npm run test:cross-language --silent
+
+# Install repo-local git hooks (pre-commit guard for fixture changes).
+install-githooks:
+	git config core.hooksPath .githooks
+	@echo "Configured git hooks path to .githooks"
+
 # ============================================================================
 # VERSION INFO
 # ============================================================================
@@ -226,6 +239,10 @@ help:
 	@echo "  make test-jacs-cli   Run CLI integration tests"
 	@echo "  make test-jacspy     Run Python binding tests"
 	@echo "  make test-jacsnpm    Run Node.js binding tests"
+	@echo "  make regen-cross-lang-fixtures  Regenerate Rust->Python->Node fixtures"
+	@echo ""
+	@echo "GIT HOOKS:"
+	@echo "  make install-githooks  Configure core.hooksPath=.githooks"
 	@echo ""
 	@echo "DIRECT PUBLISH (local credentials required):"
 	@echo "  make publish-jacs        Publish to crates.io"