fix: keep Windows release verifier native-ABI-free

[ndizazzo]

Summary

• extract embedded release-footer encoding and verification into a dependency-light mesh-llm-release-footer crate
• make xtask depend directly on that crate instead of mesh-llm-system
• preserve mesh_llm_system::embedded_release_footer as a compatibility re-export
• update publishing, Docker contexts, CI crate lists, and Windows CPU change routing

Why

The fresh v0.75.0-rc1 release run built the immutable Windows host successfully, then failed while building the attestation verifier. xtask depended on mesh-llm-system, which transitively pulled mesh-llm-runtime-install -> skippy-ffi and attempted to build the native llama.cpp ABI in the host-only lane.

The Windows-target xtask dependency graph now contains none of mesh-llm-system, mesh-llm-runtime-install, skippy-ffi, or skippy-runtime.

Validation

• actionlint
• 156 Python CI tests (7 skipped)
• cargo fmt --all --check
• 7/7 mesh-llm-release-footer tests
• 13/13 xtask tests
• cargo check and Clippy with warnings denied for mesh-llm-release-footer, xtask, mesh-llm-system, and mesh-llm
• release-target, CI crate-list, publish-order, and test-all coverage consistency checks
• cargo publish --locked -p mesh-llm-release-footer --dry-run --allow-dirty

This is the focused release unblock extracted from the broader composable CI work in #1113.

Summary by CodeRabbit

• New Features

  • Added a standalone release-footer component for encoding, parsing, and verifying attestation data in release binaries.
  • Integrated release-footer support into system builds and attestation tooling.

• Documentation

  • Added documentation describing the release-footer format and verification responsibilities.

• Build & Infrastructure

  • Updated Rust, Docker, CI, testing, linting, and publishing workflows to include the new component.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 8b1f7e1f-44ae-45d7-bbbb-027b35ae0505

📥 Commits

Reviewing files that changed from the base of the PR and between 44ed9aa and 99c2331.

⛔ Files ignored due to path filters (1)

• Cargo.lock is excluded by !**/*.lock

📒 Files selected for processing (19)

• .github/actions/compute-changes/action.yml
• .github/workflows/ci.yml
• .github/workflows/docker-precheck.yml
• .github/workflows/pr_builds.yml
• Cargo.toml
• ci/linux-test.dockerfile
• crates/mesh-llm-release-footer/Cargo.toml
• crates/mesh-llm-release-footer/README.md
• crates/mesh-llm-release-footer/src/lib.rs
• crates/mesh-llm-system/Cargo.toml
• crates/mesh-llm-system/src/lib.rs
• docker/Dockerfile.client
• fly/Dockerfile
• scripts/affected-crates.sh
• scripts/plan-clippy-batches.sh
• scripts/publish-crates.sh
• tools/xtask/Cargo.toml
• tools/xtask/src/attestation.rs
• tools/xtask/src/tests.rs

---

📝 Walkthrough

Walkthrough

The pull request introduces mesh-llm-release-footer as a workspace crate, updates consumers to use it, adds the crate to container and publishing workflows, and expands CI path detection and validation rules.

Changes

Release Footer Integration

Layer / File(s)	Summary
Footer crate and API migration Cargo.toml, crates/mesh-llm-release-footer/*, crates/mesh-llm-system/*, tools/xtask/*	Adds the workspace crate and dependencies, re-exports it through mesh-llm-system, and updates xtask imports and tests.
Container build inputs docker/*, fly/*, ci/*, .github/workflows/docker-precheck.yml	Copies the crate into Rust build stages and requires explicit workspace copy entries for Docker validation.
Workspace tooling and publishing scripts/affected-crates.sh, scripts/plan-clippy-batches.sh, scripts/publish-crates.sh	Includes the crate in affected-crate fallback handling, clippy batching, dependency ordering, and publication ordering.
CI change detection .github/actions/compute-changes/action.yml, .github/workflows/ci.yml, .github/workflows/pr_builds.yml	Updates Windows CPU, Docker, and Node.js release path filters for the new crate.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

• Mesh-LLM/mesh-llm#912: Changes embedded release-footer parsing that is moved into the new crate by this pull request.

Suggested reviewers: i386, michaelneale

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: decoupling the Windows release verifier from native ABI-heavy runtime dependencies.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/release-verifier-decouple

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[ndizazzo]

Merge validation: the critical Windows CPU lane successfully completed Build backend-neutral Windows release host, proving that the release verifier now builds without the native ABI dependency chain. All substantive PR Quality jobs passed. The only red check is Linux client-auto boot test, which timed out joining the public mesh with MultipathNotNegotiated; the same external-network signature occurred on unrelated run 30477376583, so it is not attributable to this focused dependency extraction. Proceeding without waiting for unrelated backend lanes or the capacity-queued summary aggregator.