@@ -1,6 +1,7 @@
 name: Native platform builds
 
 on:
+  workflow_call:
   workflow_dispatch:
   pull_request:
     paths:
 
@@ -1,8 +1,8 @@
 name: Release
 
-# Builds, signs, notarizes and verifies the macOS artifacts for a pushed version tag and attaches
-# them to that tag's GitHub release (created as a draft if it does not exist). Fails closed: no
-# secret, no artifact. Nothing unsigned is ever uploaded. See docs/release-signing.md.
+# Signs and verifies macOS updates, builds unsigned Windows/Linux installers on native hosts,
+# then attaches exact accepted candidates to a draft release. Publication is separate.
+# macOS signing fails closed. See docs/release-signing.md.
 on:
   push:
     tags: ["v*"]
@@ -53,12 +53,16 @@ jobs:
           git fetch --force origin "refs/tags/${GITHUB_REF_NAME}:refs/tags/${GITHUB_REF_NAME}"
           [ "$(git cat-file -t "${GITHUB_REF_NAME}")" = tag ] || { echo "::error::${GITHUB_REF_NAME} is not an annotated, signed tag"; exit 1; }
           git tag -v "${GITHUB_REF_NAME}"
+          [ "$(git rev-parse "${GITHUB_REF_NAME}^{commit}")" = "$GITHUB_SHA" ] || { echo "::error::signed tag does not match workflow source"; exit 1; }
 
       - uses: actions/setup-node@v5
         with:
           node-version: 24
           cache: npm
 
+      - name: Verify tag, package version and checkout identity
+        run: node scripts/verify-release-candidate.mjs identity
+
       - name: Install
         run: npm ci
 
@@ -197,28 +201,67 @@ jobs:
           path: ${{ runner.temp }}/modex-update-acceptance-evidence/
           if-no-files-found: ignore
 
+  native-platforms:
+    name: native Windows and Linux candidates
+    uses: ./.github/workflows/platform-cli.yml
+    permissions:
+      contents: read
+
   attach-release:
     name: attach verified release artifacts
-    needs: [macos, native-update]
+    needs: [macos, native-update, native-platforms]
     runs-on: ubuntu-latest
     permissions:
       contents: write
     steps:
+      - uses: actions/checkout@v5
+      - uses: actions/setup-node@v5
+        with:
+          node-version: 24
       - uses: actions/download-artifact@v4
         with:
           name: macos-release-candidate
-          path: release
-      - name: Verify candidate bytes and attach to the release (draft if new)
+          path: release-candidates/macos
+      - uses: actions/download-artifact@v4
+        with:
+          name: native-installers-win32
+          path: release-candidates/win32
+      - uses: actions/download-artifact@v4
+        with:
+          name: native-installers-linux
+          path: release-candidates/linux
+      - uses: actions/download-artifact@v4
+        with:
+          name: native-installed-win32
+          path: release-candidates/installed-win32
+      - uses: actions/download-artifact@v4
+        with:
+          name: native-installed-linux
+          path: release-candidates/installed-linux
+      - uses: actions/download-artifact@v4
+        with:
+          name: macos-native-update-upgrade
+          path: release-candidates/macos-upgrade
+      - uses: actions/download-artifact@v4
+        with:
+          name: macos-native-update-native-failure
+          path: release-candidates/macos-native-failure
+      - uses: actions/download-artifact@v4
+        with:
+          name: macos-native-update-interrupted
+          path: release-candidates/macos-interrupted
+      - name: Bind installer bytes and native receipts to this release
+        run: node scripts/verify-release-candidate.mjs collect release-candidates release-candidates/verified
+      - name: Attach verified files to a draft release
         env:
           GH_TOKEN: ${{ github.token }}
           GH_REPO: ${{ github.repository }}
-        working-directory: release
+        working-directory: release-candidates/verified
         run: |
-          sha256sum --check SHA256SUMS.txt
-          # Existing public releases and existing asset names are immutable here.
+          # Existing public releases and assets are immutable here. No --clobber.
           if gh api "repos/$GH_REPO/releases/tags/$GITHUB_REF_NAME" > "$RUNNER_TEMP/release.json"; then
-            jq -e '.draft == true' "$RUNNER_TEMP/release.json"
+            jq -e '.draft == true and (.assets | length == 0)' "$RUNNER_TEMP/release.json"
           else
-            gh api --method POST "repos/$GH_REPO/releases" -f tag_name="$GITHUB_REF_NAME" -f name="Modex $GITHUB_REF_NAME" -f body="Draft: notes pending." -F draft=true > "$RUNNER_TEMP/release.json"
+            gh api --method POST "repos/$GH_REPO/releases" -f tag_name="$GITHUB_REF_NAME" -f name="Modex $GITHUB_REF_NAME" -f body="Draft: notes pending. Windows installers are unsigned. See RELEASE-MANIFEST.json for native acceptance limits." -F draft=true > "$RUNNER_TEMP/release.json"
           fi
-          gh release upload "$GITHUB_REF_NAME" Modex-*-arm64.dmg Modex-*-arm64.zip SHA256SUMS.txt
+          gh release upload "$GITHUB_REF_NAME" ./*
@@ -58,7 +58,7 @@ fs.writeFileSync(path.join(home, "app", "state.json"), JSON.stringify({ version:
 const sentinel = path.join(root, "unrelated-data");
 const marker = randomUUID();
 fs.writeFileSync(sentinel, marker);
-const result = { schema: 1, sourceSha: manifest.sourceSha, runId: manifest.runId,
+const result = { schema: 1, candidate: manifest, sourceSha: manifest.sourceSha, runId: manifest.runId,
   platform: process.platform, arch: process.arch, launches: [], uninstall: "pending",
   installerAcceptance: "pending", credentials: "pending", remaining: ["KWallet credential persistence", "complete CLI/account acceptance"] };
 let installAttempted = false;
@@ -307,6 +307,7 @@ finally {
   } catch (error) { failure = failure ? new AggregateError([failure, error], "Acceptance and cleanup failed") : error; }
   try { await stopKeyring(); }
   catch (error) { failure = failure ? new AggregateError([failure, error], "Acceptance and keyring cleanup failed") : error; }
+  result.nativeChecksPassed = !failure;
   result.error = failure ? String(failure) : undefined;
   fs.writeFileSync(path.join(evidence, "result.json"), JSON.stringify(result, null, 2) + "\n");
 }
 
@@ -85,7 +85,7 @@ const dataMarkers = defaultData.map(directory => {
   fs.writeFileSync(file, marker);
   return file;
 });
-const result = { schema: 1, sourceSha: manifest.sourceSha, runId: manifest.runId,
+const result = { schema: 1, candidate: manifest, sourceSha: manifest.sourceSha, runId: manifest.runId,
   platform: process.platform, arch: process.arch, terminalShell: commandShell, terminalEnvironmentKey: "ComSpec", launches: [], uninstall: "pending",
   installerAcceptance: "pending", credentials: "pending", remaining: ["complete CLI/account acceptance"] };
 let installAttempted = false;
@@ -247,6 +247,7 @@ finally {
       result.uninstall = "NSIS removed application and registration; recorded threads, probe ciphertext and unrelated data retained";
     }
   } catch (error) { failure = failure ? new AggregateError([failure, error], "Acceptance and cleanup failed") : error; }
+  result.nativeChecksPassed = !failure;
   result.error = failure ? String(failure) : undefined;
   fs.writeFileSync(path.join(evidence, "result.json"), JSON.stringify(result, null, 2) + "\n");
 }
 
@@ -185,6 +185,28 @@ Fresh required macOS checks and native Windows/Linux jobs verify each submitted
 [PR #173](https://github.com/TypeSafeAI/modex/pull/173) records the exact hosted receipts.
 
 Installer candidate implementation and native test artifacts are distinct from release
-publication. The protected release workflow still uploads only macOS assets; acceptance
-and publication of the exact tagged Windows/Linux installers remain pending, along with
+publication. The combined release workflow below is prepared, but acceptance and
+publication of the exact tagged Windows/Linux installers remain pending, along with
 the account/session and historical-migration limits recorded above.
+
+## Tagged release candidates
+
+The protected Release workflow calls the native platform workflow for the same tagged
+source. Each installed-app report includes its byte-verified candidate manifest and sets
+`nativeChecksPassed` only after acceptance and cleanup succeed. The attachment job requires
+matching source, run, version, architecture, file sizes and hashes, plus the signed macOS
+scenario receipts. It copies only the five verified installers and publishes their hashes
+and remaining acceptance limits into a draft release; private upgrade baselines are excluded.
+
+This workflow change has not yet run on an approved signed tag. It does not change the native
+evidence or outstanding gates above. Windows installers remain unsigned, updates remain
+manual, and `installerAcceptance` stays `pending` until the remaining account/session checks
+have evidence. See [release signing](release-signing.md#candidate-attachment-checks).
+
+The [release-patch native run](https://github.com/TypeSafeAI/modex/actions/runs/38230412498)
+passed at `5189b57`. Both reports contain the verified candidate manifest and
+`nativeChecksPassed: true`. The downloaded installer archives match GitHub's sizes and
+digests; their manifests exactly match the installed-app receipts, and all three installer
+byte sizes and SHA-256 values match. The tested merge tree equals that source head.
+This proves the new report fields on that revision; it does not complete the pending
+account/session checks or the first combined signed-tag execution.
@@ -1,6 +1,6 @@
 # Signing and notarizing the macOS build
 
-From v0.0.5 every release artifact is signed with a Developer ID Application certificate,
+From v0.0.5 every macOS release artifact is signed with a Developer ID Application certificate,
 hardened-runtime enabled, notarized by Apple and stapled, so Gatekeeper opens it without a
 warning on a fresh Mac. v0.0.1–v0.0.4 were ad-hoc signed and needed a right-click → Open.
 
@@ -85,7 +85,7 @@ Rules that keep this safe:
 4. **The private key stays in the keychain.** Export a `.p12` only to populate CI, with a
    strong password, and delete the export afterwards. The workflow imports it into a
    temporary keychain on the runner and deletes that keychain at the end of the job.
-5. **CI refuses unsigned output.** The workflow checks every secret is present, verifies the
+5. **macOS CI refuses unsigned output.** The workflow checks every secret is present, verifies the
    tag's SSH signature against `TAG_ALLOWED_SIGNERS` before building, and uploads only after
    the same verification the local script runs. The `release-signing` environment should
    require a reviewer, so a tag push alone cannot mint artifacts.
@@ -168,9 +168,13 @@ rehearsal that gates the merge.
    the full e2e suite against the packaged app. It also signs a private updater-enabled
    `0.0.0` source fixture. Three fresh GitHub-hosted macOS runners use those exact source
    and candidate ZIPs for native upgrade, native download failure, and interrupted-download
-   acceptance. Only after all jobs pass does it attach the DMG, ZIP, and `SHA256SUMS.txt`
-   to a draft release. Existing public releases and asset names cannot be overwritten.
-   The private source fixture is never a public release asset.
+   acceptance. The same workflow also runs native Windows and Linux installer checks.
+   After all jobs pass, it verifies the five candidate installers against their hashes,
+   exact tag/package/source/run identity, and native receipts. It attaches the macOS
+   DMG/ZIP, unsigned Windows NSIS installer, Linux AppImage/Debian packages,
+   `SHA256SUMS.txt`, and `RELEASE-MANIFEST.json` to a draft release. Existing public
+   releases and drafts containing assets are refused. The private source fixtures are
+   never public release assets.
 4. Download the draft's assets and check them on a Mac as in
    [Verifying a download](#verifying-a-download): `shasum -c`, Gatekeeper, stapler and the
    signing certificate. Attach the verification log, write the notes, then publish the draft.
@@ -202,3 +206,26 @@ Keep the `macos-native-update-*` artifacts with the release review. Local harnes
 simulated controller tests pass, but the three hosted native scenarios have not run. Signed
 tag approval, the `release-signing` reviewer, and draft-asset verification remain required
 before publication. See [update recovery](update-recovery.md) for current local behavior.
+
+## Candidate attachment checks
+
+`node scripts/verify-release-candidate.mjs identity` requires a stable, nonzero desktop
+version matching the tag and a checkout matching the workflow commit. The signing job
+also verifies that the signed tag points to that commit. Version `0.0.0` is reserved for
+private upgrade fixtures; an existing published tag must not be reused.
+
+The attachment job downloads candidates and acceptance reports from the same workflow run
+into separate directories. The verifier checks all five installer files, both native
+platform manifests, and all three signed macOS scenario receipts before copying an explicit
+allowlist into a fresh output directory. It checks the copied hashes again, then writes
+the combined checksum list and release manifest. Missing, extra, tampered, symlinked, stale,
+or failed inputs stop attachment. Windows and Linux checks use the reusable native workflow
+with read-only repository access and receive no Apple signing secrets.
+
+`nativeChecksPassed: true` records that the installed-app harness and its cleanup passed.
+It does not complete `installerAcceptance`, which remains `pending` with the account/session
+limits in each report and the release manifest. Windows signing is deferred, Windows/Linux
+updates remain manual, and same-source `0.0.0` fixtures do not prove historical migration.
+The combined release workflow still needs its first approved tagged execution; helper tests
+verify the attachment checks, not installed-app behavior. Review the remaining gates in
+[native-platforms.md](native-platforms.md) before publication.
@@ -4,7 +4,7 @@ The living map of what has shipped, what is on `main` but unreleased, what is in
 what is next. Update it in the same PR that changes any of those; a reader should be able to
 plan the next session from this page alone. Release evidence lives in [`reviews/`](reviews/).
 
-_Last updated 2026-10-11._
+_Last updated 2026-10-12._
 
 ## Shipped
 
@@ -480,6 +480,16 @@ seven site tests, with real OpenKnowledge enabled and no skips.
 
 ## In flight
 
+- **Verified multiplatform release candidates.** The release workflow now joins native
+  Windows/Linux checks with signed macOS acceptance, binds installer bytes and receipts
+  to the exact tag/source/run, and prepares a draft with five installers, checksums and
+  an acceptance manifest. The combined recovery source passed local build/typechecks and
+  1,405 unit tests (15 skipped). Native reports and all three installer hashes were verified
+  on [the release-patch run](https://github.com/TypeSafeAI/modex/actions/runs/38230412498).
+  The combined release workflow has not yet run on an approved signed tag.
+  Windows signing stays deferred; account/session and historical migration gaps remain.
+  [Attachment checks](release-signing.md#candidate-attachment-checks).
+
 - **Automatic updates and durable drafts.** The unreleased desktop code connects verified download,
   cancellation, restart preparation, and recovery for packaged Macs. Schema-2 draft storage
   preserves independent text and files, pending originals, and owner-removal recovery.
@@ -709,9 +719,8 @@ Roughly in the order they earn their place; none is scheduled.
 
 1. **Ship automatic installation of updates.** Finish the in-flight acceptance and signed
    release gates above. Published builds still require manual installation.
-2. **Publish Windows and Linux installers.** Extend the protected release pipeline, which
-   currently uploads macOS artifacts, to verify and publish the exact tagged native
-   installers. Candidate Actions artifacts are not releases. Provider-account acceptance,
+2. **Publish Windows and Linux installers.** Run the prepared protected release pipeline
+   on an approved new signed tag, verify its draft assets, and complete release review. Candidate Actions artifacts are not releases. Provider-account acceptance,
    KWallet6/full graphical sessions, and historical schema migration remain unproven;
    see [native-platforms.md](native-platforms.md) for candidate evidence and its limits.
 3. **Routines.** Read-only routines come next: Chat or Plan turns on a timer, with the