Linux backend (X11 + Wayland): full non-background parity, builds on ubuntu-latest, awaits on-device verification

.cargo/config.toml

@@ -0,0 +1,7 @@
+# `default-members` in the workspace manifest limits a bare `cargo build` to the
+# crates that build on every OS. These aliases are the explicit "give me
+# everything" verbs for Windows development.
+[alias]
+build-all = "build --workspace"
+check-all = "check --workspace"
+test-all = "test --workspace"

.github/workflows/ci.yml

@@ -39,6 +39,143 @@ jobs:
       - name: Clippy
         run: cargo clippy --workspace -- -D warnings
 
+  # The portable subset only. These jobs must never be given `--workspace`: the
+  # Windows-only crates are *expected* to fail off Windows, and a red X on an
+  # expected failure trains people to ignore CI.
+  # See docs/plans/2026-07-cross-platform-plan.md.
+  check-macos:
+    name: Check (macOS)
+    runs-on: macos-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install Rust stable
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Check portable crates
+        run: cargo check -p ghost-platform -p ghost-ground
+
+      - name: Test platform contract
+        run: cargo test -p ghost-platform
+
+  # The authoritative proof that Ghost's macOS code compiles and links against a
+  # real Apple SDK. Local cross-compilation is a convenience; this job is the gate.
+  # It is deliberately package-scoped, never `--workspace`: ghost-core /
+  # ghost-cache / ghost-intent are Windows-only and expected to fail here.
+  build-macos:
+    name: Build (macOS)
+    runs-on: macos-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install Rust stable
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Cache cargo registry
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            target
+          key: ${{ runner.os }}-cargo-mac-${{ hashFiles('**/Cargo.lock') }}
+          restore-keys: ${{ runner.os }}-cargo-mac-
+
+      - name: Show toolchain and SDK
+        run: |
+          rustc -vV
+          xcrun --sdk macosx --show-sdk-version
+
+      # This job is the authoritative proof that the macOS backend is real: it is the
+      # only place the code is compiled and linked against Apple's SDK. Locally,
+      # `cargo check --target aarch64-apple-darwin` on Linux covers ghost-platform and
+      # stops there, because `ring` (via reqwest -> rustls) has a C build script that
+      # needs a macOS SDK.
+      #
+      # ghost-core, ghost-cache and ghost-intent speak to COM directly and are left
+      # Windows-only rather than ported.
+      - name: Build the macOS-capable crates
+        run: cargo build -p ghost-platform -p ghost-session -p ghost-cli
+
+      - name: Headless unit tests
+        run: cargo test -p ghost-platform -p ghost-session -p ghost-cli --features ghost-cli/mac-headless-tests
+
+      # `--all-targets` so the headless test bodies and the examples are linted too,
+      # not just the libraries.
+      - name: Clippy
+        run: cargo clippy -p ghost-platform -p ghost-session -p ghost-cli --features ghost-cli/mac-headless-tests --all-targets -- -D warnings
+
+  # The authoritative proof that Ghost's Linux code compiles. Same role as
+  # `Build (macOS)`, and package-scoped for the same reason: ghost-core,
+  # ghost-cache and ghost-intent speak to COM and are expected to fail here.
+  #
+  # A runner has no X server, no Wayland compositor and no accessibility bus, so
+  # this job proves compilation and pure-logic tests only. Everything that needs a
+  # live session is `ghost doctor --linux` on real hardware — see
+  # docs/linux-testing.md.
+  build-linux:
+    name: Build (Linux)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install Rust stable
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Cache cargo registry
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            target
+          key: ${{ runner.os }}-cargo-linux-${{ hashFiles('**/Cargo.lock') }}
+          restore-keys: ${{ runner.os }}-cargo-linux-
+
+      # The Linux dependency stack is pure Rust — x11rb speaks the X11 wire
+      # protocol over a socket instead of linking libX11, and the D-Bus/libei/
+      # Wayland crates are Rust implementations rather than `-sys` bindings — so
+      # nothing here needs a system header to *build*. The list is installed
+      # anyway, and kept deliberately, because it is the runtime dependency set a
+      # tester needs, and pinning it in CI means a future dependency swap that
+      # does introduce a C build script fails loudly here instead of on the
+      # tester's machine.
+      - name: Install X11/Wayland/D-Bus development libraries
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends \
+            libx11-dev libxtst-dev libxi-dev libxrandr-dev libxfixes-dev \
+            libdbus-1-dev libwayland-dev libxkbcommon-dev pkg-config
+
+      - name: Show toolchain
+        run: |
+          rustc -vV
+          pkg-config --modversion x11 xtst dbus-1 wayland-client
+
+      - name: Build the Linux backend
+        run: cargo build -p ghost-platform
+
+      - name: Headless unit tests
+        run: cargo test -p ghost-platform --features linux-headless-tests
+
+      - name: Clippy
+        run: cargo clippy -p ghost-platform --features linux-headless-tests --all-targets -- -D warnings
+
+  check-linux:
+    name: Check (Linux)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install Rust stable
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Check portable crates
+        run: cargo check -p ghost-platform -p ghost-ground
+
+      - name: Test platform contract
+        run: cargo test -p ghost-platform
+
   release-build:
     name: Release build
     runs-on: windows-latest
@@ -58,8 +195,10 @@ jobs:
           key: ${{ runner.os }}-cargo-release-${{ hashFiles('**/Cargo.lock') }}
           restore-keys: ${{ runner.os }}-cargo-release-
 
+      # `-p` is required: the workspace sets `default-members` to the portable
+      # crates, so a bare `--bin ghost` would not see ghost-cli's target.
       - name: Release build
-        run: cargo build --release --bin ghost --bin ghost-http --bin ghost-mcp
+        run: cargo build --release -p ghost-cli -p ghost-http -p ghost-mcp --bin ghost --bin ghost-http --bin ghost-mcp
 
       - name: Upload binary artifacts
         uses: actions/upload-artifact@v4