task: unify release hosts, native runtimes, and product bundles

.agents/skills/benchmark-tune/SKILL.md

@@ -26,12 +26,13 @@ For performance work, use a release build on the target host:
 just release-build
 ```
 
-On NVIDIA remote hosts, verify that the release binary is actually using CUDA
-before recording performance results. For Jetson/Orin-style aarch64 CUDA hosts,
-prefer the repo's CUDA backend build path for the host, for example
-`scripts/build-linux.sh --backend cuda --cuda-arch 87`, with the host CUDA
-toolkit paths exported as needed. A generic release build that reports CPU
-devices is not valid performance evidence for GPU tune work.
+On NVIDIA remote hosts, verify that the selected CUDA native runtime is actually
+in use before recording performance results. For Jetson/Orin-style aarch64 CUDA
+hosts, build the normal backend-neutral product with a CUDA runtime, for example
+`just build backend=cuda cuda_arch=87`, with the CUDA toolkit paths exported as
+needed. The host itself must remain backend-neutral; a generic CPU runtime is
+not valid performance evidence for GPU tune work. Confirm `mesh-llm runtime
+list` selects the intended CUDA runtime before benchmarking.
 
 If the run is on a remote node over SSH and will take time, use the
 `remote-observable-process` skill. Prefer a TTY/login shell and `tee` logs over

.agents/skills/manage-ci/SKILL.md

@@ -220,6 +220,32 @@ update the skill resources in the same change.
 
 ## Caches, artifacts, and smoke tests
 
+- Treat release production as a three-layer graph: one backend-neutral host per
+  OS/architecture, one native-runtime artifact per
+  OS/architecture/backend/backend-version, and product composition from those
+  two immutable inputs. A backend alias may select a runtime but must never
+  compile a distinct host.
+- Host artifacts must include and pass the dynamic-import policy report.
+  Runtime artifacts must include their manifest, file checksums, runtime ABI,
+  MeshLLM version, platform, and backend compatibility. Product artifacts must
+  record the exact host and runtime digests and preserve the
+  `mesh-bundle/native-runtimes/<runtime-id>` layout.
+- Keep host, runtime, and product matrices separate in release workflows.
+  Product jobs download producer artifacts and verify compatibility and digest
+  metadata before composition. Never satisfy a missing producer by rebuilding
+  either layer in a consumer job.
+- Host producers attest and import-check the host before upload. Consumers
+  verify that producer checksum and attestation, then copy the exact host bytes;
+  they must not re-stamp, relink, or otherwise mutate a host per backend alias.
+- Main CI executable lanes follow the same product contract: CPU artifact
+  producers upload a backend-neutral host together with its adjacent packaged
+  runtime, and every backend lane builds the host separately from its runtime.
+  Do not upload or consume a raw host binary, rebuild a host after restoring a
+  runtime cache, or use a driver stub to make an executable test pass.
+- No-driver smoke is mandatory for every product alias, native package, and OCI
+  image. CUDA/ROCm/Vulkan device absence is not a skip condition for
+  `--version`, runtime discovery/listing, or client startup. Hardware-qualified
+  serving tests are additional coverage.
 - Namespace cache keys and include every compatibility boundary that can make
   reuse unsafe: OS, architecture, backend/toolchain, relevant lockfiles,
   `.github/cache-version.txt`, and build inputs. Do not broaden restore keys

.agents/skills/manage-ci/references/current-inventory.md

@@ -13,7 +13,7 @@ the commands at the end before operational changes.
 | `pr_website.yml` | PR, dispatch | Public website build canary and summary |
 | `pr_cleanup.yml` | PR close via `pull_request_target`, dispatch | Positively matched PR cache/artifact cleanup only; never executes PR code |
 | `pr_auto_assign.yml` | PR lifecycle via `pull_request_target` | PR metadata assignment only; never executes PR code |
-| `ci.yml` | Main push, dispatch | Trusted main CI equivalent of build/test/smoke lanes |
+| `ci.yml` | Main push, dispatch | Trusted main build/test/smoke lanes; composed host/runtime products and no-driver client readiness |
 | `docker.yml` | Dispatch | Manual client Dockerfile validation; does not publish |
 | `docker-precheck.yml` | Reusable call | Shared Docker validation precheck |
 | `smoke.yml` | Reusable call | Artifact-based inference/OpenAI/split smoke |
@@ -31,6 +31,33 @@ the commands at the end before operational changes.
 | `reset-caches.yml` | Confirmed dispatch | Destructive repository cache reset |
 | `stale-prs.yml` | Schedule, dispatch | PR warning/closure maintenance |
 
+`release.yml` uses the contract-v2 three-layer artifact graph:
+
+- host matrix: one dynamic, backend-neutral executable and import report per
+  supported OS/architecture;
+- native-runtime matrix: one manifested/checksummed runtime per supported
+  OS/architecture/backend/backend-version;
+- product matrix: digest-verified composition of a host plus one runtime while
+  retaining existing backend-flavored public archive names as aliases.
+
+The host producer attests the binary, writes `host-imports.json`, and publishes
+its checksum. Product consumers verify that immutable input before composition;
+they must not re-stamp or otherwise mutate the host per backend alias. Release
+CPU and backend product consumers also perform a noninteractive JSON client
+readiness smoke from the verified host/runtime inputs before publication; CI
+and packaging consumers must not rebuild either input. Portable bundles
+place runtimes at `mesh-bundle/native-runtimes/<runtime-id>`; Debian/Arch
+packages use `/usr/local/lib/mesh-llm/<version>/native-runtimes`; Homebrew uses
+formula-owned `libexec/native-runtimes`.
+
+`ci.yml` applies the same executable-product rule to trusted main validation:
+Linux and macOS debug artifact producers upload both the backend-neutral host
+and its adjacent runtime; their consumer reruns JSON client readiness from those
+exact bytes. Linux and Windows backend rows build a release host separately,
+package exactly one selected runtime, and require `runtime list` plus no-driver
+client readiness. They never invoke a backend-linked host, inject a CUDA driver
+stub, or skip client startup merely because a hosted runner has no GPU.
+
 Local actions:
 
 - `.github/actions/compute-changes` owns path, crate, backend, SDK, UI, website,

.github/actions/restore-smoke-inputs/action.yml

@@ -54,6 +54,23 @@ runs:
         chmod +x "${{ inputs.staged_binary_path }}"
         test -x "${{ inputs.staged_binary_path }}"
 
+    - name: Stage packaged native runtime
+      shell: bash
+      run: |
+        set -euo pipefail
+        source_runtime_root="${{ inputs.artifact_path }}/native-runtimes"
+        staged_runtime_root="$(dirname "${{ inputs.staged_binary_path }}")/native-runtimes"
+        [[ -d "$source_runtime_root" ]] || {
+          echo "artifact does not contain native-runtimes: $source_runtime_root" >&2
+          exit 1
+        }
+        rm -rf "$staged_runtime_root"
+        cp -a "$source_runtime_root" "$staged_runtime_root"
+        find "$staged_runtime_root" -type f -name manifest.json -print -quit | grep -q . || {
+          echo "staged native runtime has no manifest.json: $staged_runtime_root" >&2
+          exit 1
+        }
+
     - name: Restore integration model cache
       id: cache-model
       uses: actions/cache/restore@v5