chore: compare native Windows ACL prototypes

.github/workflows/windows-acl-prototypes.yaml

@@ -0,0 +1,125 @@
+name: Windows ACL Prototypes
+
+on:
+  pull_request:
+    paths:
+      - "prototypes/windows-acl/**"
+      - ".github/workflows/windows-acl-prototypes.yaml"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: acl-prototypes-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  native:
+    name: Native ACL (${{ matrix.arch }})
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: windows-2025-vs2026
+            arch: x64
+            target: x86_64-pc-windows-msvc
+          - os: windows-11-vs2026-arm
+            arch: arm64
+            target: aarch64-pc-windows-msvc
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 60
+    defaults:
+      run:
+        shell: bash
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: ./.github/actions/setup
+      - name: Check out comparison baseline
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: 22a751efc2fc859641e387921e115d01829db1ac
+          path: .acl-baseline
+          persist-credentials: false
+      - name: Verify native runtime architecture
+        run: node -e 'if (process.arch !== "${{ matrix.arch }}") throw new Error(process.arch); console.log(process.versions)'
+      - name: Install pinned Rust toolchain
+        run: |
+          rustup toolchain install 1.98.1 --profile minimal --component clippy --component rustfmt
+          rustup target add --toolchain 1.98.1 ${{ matrix.target }}
+      - name: Format and lint native code
+        run: |
+          cargo +1.98.1 fmt --all --manifest-path prototypes/windows-acl/Cargo.toml --check
+          cargo +1.98.1 clippy --workspace --all-features --all-targets --target ${{ matrix.target }} --manifest-path prototypes/windows-acl/Cargo.toml --locked -- -D warnings
+      - name: Test native ACL core
+        run: cargo +1.98.1 test -p acl-prototype-core -p acl-prototype-core-windows --target ${{ matrix.target }} --manifest-path prototypes/windows-acl/Cargo.toml --locked
+      - name: Test typed ACL core with static CRT
+        run: cargo +1.98.1 test -p acl-prototype-core-windows --release --target ${{ matrix.target }} --manifest-path prototypes/windows-acl/Cargo.toml --locked
+        env:
+          RUSTFLAGS: "-C target-feature=+crt-static"
+          CARGO_PROFILE_RELEASE_OPT_LEVEL: "s"
+          CARGO_TARGET_DIR: "prototypes/windows-acl/target/static-core-tests"
+      - name: Resolve Electron 37 executable
+        run: pnpm dlx electron@37.10.3 -e 'require("node:fs").appendFileSync(process.env.GITHUB_ENV, "ACL_ELECTRON37_PATH=" + process.execPath + "\n")'
+        env:
+          ELECTRON_RUN_AS_NODE: "1"
+      - name: Compare source, size profiles, and CRT linkage
+        run: node prototypes/windows-acl/experiment.cjs --target ${{ matrix.target }}
+        env:
+          ACL_BASELINE_ROOT: ${{ github.workspace }}/.acl-baseline/prototypes/windows-acl
+      - name: Upload experimental native payloads and reports
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: acl-experiments-${{ matrix.arch }}
+          path: prototypes/windows-acl/artifacts/experiments/
+          if-no-files-found: error
+          retention-days: 7
+
+  universal:
+    name: Universal VSIX comparison
+    needs: native
+    runs-on: ubuntu-24.04
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: ./.github/actions/setup
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: acl-experiments-x64
+          path: prototypes/windows-acl/artifacts/experiments
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: acl-experiments-arm64
+          path: prototypes/windows-acl/artifacts/experiments
+      - name: Package and inspect each universal comparison payload
+        run: node prototypes/windows-acl/experiment-report.cjs
+      - name: Upload experimental universal packages
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: acl-universal-prototypes
+          path: |
+            prototypes/windows-acl/artifacts/experiments/**/*.vsix
+            prototypes/windows-acl/artifacts/experiments/*.json
+          if-no-files-found: error
+          retention-days: 7
+
+  non-windows:
+    name: Native bypass (${{ matrix.os }})
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 20
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-24.04, macos-15]
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: ./.github/actions/setup
+      - name: Test without any native artifacts installed
+        run: pnpm exec vitest run --config prototypes/windows-acl/test/vitest.config.mts

.prettierignore

@@ -10,6 +10,8 @@ flake.lock
 pnpm-debug.log
 pnpm-lock.yaml
 /storybook-static/
+/prototypes/windows-acl/target/
+/prototypes/windows-acl/artifacts/
 
 # Golden snapshots are written verbatim; prettier would drift them out of sync.
 **/__golden__/

.vscodeignore

@@ -4,6 +4,7 @@ coverage/**
 .nyc_output/**
 
 # Development files
+prototypes/**
 src/**
 test/**
 scripts/**

eslint.config.mjs

@@ -22,6 +22,8 @@ export default defineConfig(
 		".vscode-test/**",
 		"test/fixtures/scripts/**",
 		"storybook-static/**",
+		"prototypes/windows-acl/target/**",
+		"prototypes/windows-acl/artifacts/**",
 	]),
 
 	// Base ESLint recommended rules (for JS/TS/TSX files only)

prototypes/windows-acl/.gitignore

@@ -0,0 +1,3 @@
+/target/
+/artifacts/
+/*.vsix