Integrate and qualify the pending rendering, text and platform work

.github/workflows/build.yml

@@ -86,7 +86,7 @@ jobs:
           if (Test-Path -LiteralPath $evidence) { throw 'Evidence directory already exists.' }
           New-Item -ItemType Directory -Path $evidence | Out-Null
           $dll = Join-Path $env:GITHUB_WORKSPACE 'tests/ProGPU.PathRasterization.Conformance/bin/Release/net10.0/${{ matrix.rid }}/ProGPU.PathRasterization.Conformance.dll'
-          $cases = @('coverage', 'simple-first', 'boolean-first', 'linear-coverage', 'linear-first', 'curve-first')
+          $cases = @('coverage', 'simple-first', 'boolean-first', 'linear-coverage', 'linear-first', 'curve-first', 'linear-winding')
           $completed = @()
           foreach ($case in $cases) {
             $stdout = Join-Path $evidence "$case-stdout.log"
@@ -106,7 +106,7 @@ jobs:
               Get-Content -LiteralPath $stderr
             }
           }
-          if ($completed.Count -ne 6) { throw 'All six regression bodies, including the three original cases, must execute and pass.' }
+          if ($completed.Count -ne 7) { throw 'All seven regression bodies, including the six original cases, must execute and pass.' }
           @{ executed = $completed; skipped = 0; processDeadlineSeconds = 120 } | ConvertTo-Json | Set-Content -LiteralPath (Join-Path $evidence 'summary.json')
       - name: Retain source GPU coverage and pipeline acquisition evidence
         if: always()
@@ -521,6 +521,14 @@ jobs:
           path: artifacts/progpu-native/diagnostics/managed-picture
           if-no-files-found: warn
 
+      - name: Retain original Direct2D RGB glyph parameter receipts
+        if: always() && runner.os == 'Windows'
+        uses: actions/upload-artifact@v7
+        with:
+          name: progpu-direct2d-rgb-reference-${{ matrix.rid }}
+          path: '**/direct2d-rgb-reference-*/'
+          if-no-files-found: ${{ job.status == 'success' && 'error' || 'warn' }}
+
       - name: Upload native MIL ImageBrush frames
         if: matrix.rid == 'linux-x64' || matrix.rid == 'osx-arm64' || matrix.rid == 'win-x64'
         uses: actions/upload-artifact@v7
@@ -1564,6 +1572,7 @@ jobs:
         timeout-minutes: 10
         run: |
           ./eng/progpu-install-linux-packages.sh \
+            libc++1 \
             libvulkan1 \
             mesa-vulkan-drivers \
             libx11-xcb1 \
@@ -1612,6 +1621,20 @@ jobs:
           dotnet build src/ProGPU.Tests/ProGPU.Tests.csproj --configuration Release --runtime ${{ matrix.rid }} --no-restore -p:ContinuousIntegrationBuild=true
           dotnet build src/ProGPU.Tests.Headless/ProGPU.Tests.Headless.csproj --configuration Release --runtime ${{ matrix.rid }} --no-restore -p:ContinuousIntegrationBuild=true
 
+      # The package-consumer preflight above builds Backend.Native but not Text.
+      # Reuse the actual library outputs from Build tests, without rebuilding
+      # their graph or executing the probe against an unqualified native runtime.
+      - name: Compile source Display comparison probe
+        if: runner.os == 'Linux'
+        shell: bash
+        run: |
+          set -euo pipefail
+          test -s src/ProGPU.Backend.Native/bin/Release/net10.0/ProGPU.Backend.Native.dll
+          test -s src/ProGPU.Text/bin/Release/net10.0/ProGPU.Text.dll
+          dotnet build eng/SourceDisplayPolicyProbe/SourceDisplayPolicyProbe.csproj \
+            --configuration Release --runtime '${{ matrix.rid }}' \
+            -p:BuildProjectReferences=false -p:ContinuousIntegrationBuild=true
+
       - name: Run owned Cocoa popup lifecycle contracts
         run: >-
           dotnet test src/ProGPU.Tests/ProGPU.Tests.csproj

.github/workflows/native-contract-generation.yml

@@ -32,6 +32,7 @@ jobs:
           ./eng/progpu-generate-native-contract.sh
           git rev-parse HEAD > src/ProGPU.Backend.Native/Generated/generator-head.txt
           sha256sum src/ProGPU.Native/include/progpu_native_text_hinting.h > src/ProGPU.Backend.Native/Generated/hinting-header.sha256
+          sha256sum src/ProGPU.Native/include/progpu_native_text_source.h src/ProGPU.Native/include/progpu_native_text_source_resource.h > src/ProGPU.Backend.Native/Generated/source-headers.sha256
       - name: Verify bounded inline-array generation and atomic rejection
         shell: bash
         run: python3 eng/tests/test_native_contract_inline_arrays.py

.github/workflows/release.yml

@@ -6,7 +6,7 @@ on:
       version:
         description: NuGet package version to build.
         required: true
-        default: 0.1.0-preview.63
+        default: 0.1.0-preview.66
       publish:
         description: Push packages to NuGet.org after validation.
         required: true
@@ -89,6 +89,8 @@ jobs:
             clang-tools \
             cmake \
             ninja-build \
+            gnupg \
+            fonts-dejavu-core \
             libvulkan1 \
             mesa-vulkan-drivers \
             libx11-xcb1 \
@@ -103,22 +105,87 @@ jobs:
 
       - name: Install macOS native build tools
         if: runner.os == 'macOS'
-        run: brew install ninja
+        run: brew install ninja gnupg
 
       - name: Verify generated C# native contract
         if: matrix.rid == 'linux-x64'
         shell: bash
         run: ./eng/progpu-verify-native-contract.sh
 
+      - name: Build signed isolated font dependency
+        if: runner.os != 'Windows'
+        shell: bash
+        run: |
+          font_workspace="$(mktemp -d "${RUNNER_TEMP}/progpu-freetype.XXXXXXXX")"
+          font_workspace="$(cd "$font_workspace" && pwd -P)"
+          echo "PROGPU_FREETYPE_WORKSPACE=$font_workspace" >> "$GITHUB_ENV"
+          if [[ '${{ runner.os }}' == 'macOS' ]]; then
+            test_font='/System/Library/Fonts/Supplemental/Arial.ttf'
+          else
+            test_font='/usr/share/fonts/truetype/dejavu/DejaVuSans.ttf'
+          fi
+          python3 ./eng/progpu-prepare-freetype.py \
+            --workspace "$font_workspace" --rid '${{ matrix.rid }}' --cc clang --cxx clang++ \
+            --test-font "$test_font"
+
+      - name: Build signed isolated font dependency on Windows
+        if: runner.os == 'Windows'
+        shell: pwsh
+        run: |
+          $fontWorkspace = Join-Path $env:RUNNER_TEMP ('progpu-freetype.' + [Guid]::NewGuid().ToString('N'))
+          "PROGPU_FREETYPE_WORKSPACE=$fontWorkspace" | Out-File -FilePath $env:GITHUB_ENV -Append -Encoding utf8
+          ./eng/progpu-prepare-freetype-windows.ps1 -Rid '${{ matrix.rid }}' -Workspace $fontWorkspace
+
+      - name: Upload verified font dependency and original notices
+        uses: actions/upload-artifact@v7
+        with:
+          name: progpu-freetype-${{ matrix.rid }}
+          path: ${{ env.PROGPU_FREETYPE_WORKSPACE }}/install
+          if-no-files-found: error
+
+      - name: Fetch exact owned EDIT dictionary source
+        if: runner.os != 'Windows'
+        shell: bash
+        run: |
+          python3 - <<'PY'
+          import hashlib, json, os, pathlib, tempfile, urllib.request
+          pin = json.loads(pathlib.Path('eng/native-edit-word-icu.json').read_text())
+          workspace = pathlib.Path(tempfile.mkdtemp(prefix='progpu-edit-icu.', dir=os.environ['RUNNER_TEMP'])).resolve()
+          archive = workspace / 'icu-sources.tgz'
+          with urllib.request.urlopen(pin['sourceUrl']) as source, archive.open('xb') as output:
+              while chunk := source.read(1024 * 1024):
+                  output.write(chunk)
+          with archive.open('rb') as source:
+              actual = hashlib.file_digest(source, 'sha256').hexdigest()
+          if actual != pin['sourceSha256']:
+              raise SystemExit('Owned EDIT dictionary source differs from the reviewed pin')
+          with open(os.environ['GITHUB_ENV'], 'a') as output:
+              output.write(f'PROGPU_EDIT_WORD_ICU_ARCHIVE={archive}\n')
+          PY
+
+      - name: Fetch exact owned EDIT dictionary source on Windows
+        if: runner.os == 'Windows'
+        shell: pwsh
+        run: |
+          $pin = Get-Content -Raw eng/native-edit-word-icu.json | ConvertFrom-Json
+          $workspace = Join-Path $env:RUNNER_TEMP ('progpu-edit-icu.' + [Guid]::NewGuid().ToString('N'))
+          New-Item -ItemType Directory -Path $workspace | Out-Null
+          $archive = Join-Path $workspace 'icu-sources.tgz'
+          Invoke-WebRequest -Uri $pin.sourceUrl -OutFile $archive
+          if ((Get-FileHash -LiteralPath $archive -Algorithm SHA256).Hash.ToLowerInvariant() -cne $pin.sourceSha256) {
+            throw 'Owned EDIT dictionary source differs from the reviewed pin.'
+          }
+          "PROGPU_EDIT_WORD_ICU_ARCHIVE=$archive" | Out-File -FilePath $env:GITHUB_ENV -Append -Encoding utf8
+
       - name: Build and integration-test native renderer
         if: runner.os != 'Windows'
         shell: bash
         env:
           PROGPU_NATIVE_RUN_DAWN_HEADER_CONTRACT: 1
           PROGPU_NATIVE_ENABLE_CPP_MODULES: ${{ matrix.rid == 'linux-x64' && 'ON' || '' }}
         run: |
-          ./eng/build-progpu-native.sh
-          ./eng/progpu-stage-native-runtime.sh
+          ./eng/build-progpu-native.sh --font-manifest "$PROGPU_FREETYPE_WORKSPACE/install/progpu-freetype.json" --edit-word-icu-archive "$PROGPU_EDIT_WORD_ICU_ARCHIVE"
+          ./eng/progpu-stage-native-runtime.sh --font-manifest "$PROGPU_FREETYPE_WORKSPACE/install/progpu-freetype.json" --edit-word-icu-archive "$PROGPU_EDIT_WORD_ICU_ARCHIVE"
 
       - name: Build and integration-test native renderer on Windows
         if: runner.os == 'Windows'
@@ -127,6 +194,8 @@ jobs:
           ./eng/build-progpu-native-windows.ps1
           -Rid "${{ matrix.rid }}"
           -BenchmarkProfile Smoke
+          -FontManifest "${{ env.PROGPU_FREETYPE_WORKSPACE }}/install/progpu-freetype.json"
+          -EditWordIcuArchive "${{ env.PROGPU_EDIT_WORD_ICU_ARCHIVE }}"
 
       - name: Verify exact WebScene provider on Metal
         if: matrix.rid == 'osx-arm64'

.github/workflows/wpf-display-text-reference.yml

@@ -91,6 +91,41 @@ jobs:
               Get-Content -LiteralPath $stderr
             }
           }
+      - name: Capture independent original source request metrics
+        shell: pwsh
+        run: |
+          $evidence = Join-Path $env:GITHUB_WORKSPACE 'artifacts/wpf-display-reference'
+          $dll = Join-Path $env:GITHUB_WORKSPACE 'eng/WpfDisplayTextReference/bin/Release/net10.0-windows/WpfDisplayTextReference.dll'
+          $font = Join-Path $env:GITHUB_WORKSPACE 'src/ProGPU.Fonts.Inter/Fonts/Inter-Regular.ttf'
+          foreach ($family in @('original', 'midpoint-rtl-positioned-v3')) {
+            $name = if ($family -eq 'original') { 'source-inputs' } else { 'source-midpoint-inputs' }
+            $receipt = Join-Path $evidence "$name.json"
+            $stdout = Join-Path $evidence "$name-stdout.log"
+            $stderr = Join-Path $evidence "$name-stderr.log"
+            $values = @($dll, '--source-inputs', $font, $receipt, '${{ matrix.arch }}', $env:REFERENCE_COMMIT)
+            if ($family -ne 'original') { $values += @($family, (Join-Path $evidence 'rtl-font')) }
+            $arguments = $values | ForEach-Object { '"' + $_ + '"' }
+            $child = Start-Process (Get-Command dotnet).Source -ArgumentList $arguments -PassThru -NoNewWindow -RedirectStandardOutput $stdout -RedirectStandardError $stderr
+            try {
+              if (!$child.WaitForExit(90000)) { throw 'Original source-input reference process exceeded 90 seconds.' }
+              if ($child.ExitCode -ne 0) { throw "Original source-input reference exited $($child.ExitCode)." }
+              $value = Get-Content -LiteralPath $receipt -Raw | ConvertFrom-Json
+              $count = if ($family -eq 'original') { 192 } else { 288 }
+              $schema = if ($family -eq 'original') { 2 } else { 4 }
+              if ($value.Schema -ne $schema -or $value.SourceCommit -ne $env:REFERENCE_COMMIT -or $value.CaseCount -ne $count -or $value.Cases.Count -ne $count -or $value.Architecture -ne '${{ matrix.arch }}') { throw 'Incomplete independent source-input receipt.' }
+              foreach ($case in $value.Cases) {
+                $original = if ($family -eq 'original') { $case } else { $case.Original }
+                $metrics = $original.IndependentSourceMetrics
+                if ($metrics.Version -ne 1 -or $metrics.Mode -cne $original.Mode -or $metrics.Em -ne $original.Em -or $metrics.Dpi -ne $original.Dpi -or $metrics.ToReal -ne 1 -or $metrics.TypefaceIdentity -cne $value.PresentationIdentity -or $metrics.TypefaceAssembly.Sha256 -cne $value.PresentationCore.Sha256) { throw 'Independent source metric identity mismatch.' }
+              }
+              Get-FileHash -Algorithm SHA256 -LiteralPath $receipt | Format-List
+            } finally {
+              if (!$child.HasExited) { $child.Kill($true); $child.WaitForExit(5000) | Out-Null }
+              $child.Dispose()
+              Get-Content -LiteralPath $stdout
+              Get-Content -LiteralPath $stderr
+            }
+          }
       - uses: actions/upload-artifact@v7
         if: always()
         with: