feat: acquire Git credentials on demand using a detached broker

.github/workflows/ci.yml

@@ -16,7 +16,24 @@ jobs:
         run: swift --version
 
       - name: Run tests
-        run: swift run adevcontainerTests
+        # Prepare generated, ignored Swift payloads before any Swift target builds.
+        # Build the CLI explicitly for isolated internal-entry subprocess tests.
+        run: |
+          sh scripts/build-guest-credential-relay.sh
+          sh scripts/test-guest-credential-relay.sh
+          swift build --product adevcontainer
+          ADEVCONTAINER_CREDENTIAL_TESTS_ONLY=1 swift run adevcontainerTests
+          swift run adevcontainerTests
 
       - name: Release build
         run: swift build -c release --product adevcontainer
+
+  native-linux-amd64:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Build and exercise shipped static amd64 relay
+        run: |
+          sh scripts/build-guest-credential-relay.sh --raw-only
+          sh scripts/test-guest-credential-relay.sh
+          sh Tests/GuestGitCredentialRelay/build_artifacts_tests.sh

.github/workflows/release.yml

@@ -39,7 +39,12 @@ jobs:
         run: bash scripts/inject-version.sh "${{ steps.version.outputs.version }}"
 
       - name: Run tests
-        run: swift run adevcontainerTests
+        run: |
+          sh scripts/build-guest-credential-relay.sh
+          sh scripts/test-guest-credential-relay.sh
+          swift build --product adevcontainer
+          ADEVCONTAINER_CREDENTIAL_TESTS_ONLY=1 swift run adevcontainerTests
+          swift run adevcontainerTests
 
       - name: Release build
         run: swift build -c release --product adevcontainer
@@ -59,11 +64,7 @@ jobs:
             exit 1
           fi
           echo "Using binary: ${BIN}"
-          mkdir -p dist
-          cp "${BIN}" dist/adevcontainer
-          export COPYFILE_DISABLE=1
-          tar -C dist -czf adevcontainer-macos-arm64.tar.gz adevcontainer
-          shasum -a 256 adevcontainer-macos-arm64.tar.gz > adevcontainer-macos-arm64.tar.gz.sha256
+          sh scripts/package-release.sh "${BIN}" .
           SHA256="$(awk '{print $1}' adevcontainer-macos-arm64.tar.gz.sha256)"
           if [[ ! "$SHA256" =~ ^[0-9a-f]{64}$ ]]; then
             echo "error: failed to parse sha256 from checksum file: ${SHA256}" >&2

.gitignore

@@ -1,5 +1,6 @@
 # SwiftPM
 .build/
+Sources/ADevContainerLib/Git/Generated/GuestGitCredentialEmbeddedAssets.swift
 .swiftpm/xcode/xcuserdata/
 .swiftpm/configuration/
 *.xcodeproj

CONTRIBUTING.md

@@ -10,19 +10,53 @@ Contributing with AI agents? Use [agents-workspace](https://github.com/wcgomes/a
 
 ## Build
 ```bash
+sh scripts/build-guest-credential-relay.sh # authenticated toolchain + both embedded guest targets
 swift build            # binary: .build/debug/adevcontainer
 swift build -c release # binary: .build/release/adevcontainer
 ```
 
 To install from source onto PATH and link the Apple CLI plugin:
 
 ```bash
+sh scripts/build-guest-credential-relay.sh
 swift build -c release
 cp .build/release/adevcontainer /usr/local/bin/   # or another directory on PATH
 adevcontainer plugin --install                    # use sudo when the plugin destination requires elevation
 ```
 
 ## Tests
+Safe, synthetic credential checks (no user broker/provider/container):
+
+```sh
+sh scripts/test-guest-credential-relay.sh
+sh Tests/GuestGitCredentialRelay/build_artifacts_tests.sh
+swift build --product adevcontainer # internal-entry subprocess tests use this binary
+ADEVCONTAINER_CREDENTIAL_TESTS_ONLY=1 swift run adevcontainerTests
+ADEVCONTAINER_DETACHED_BROKER_TEST=1 ADEVCONTAINER_CREDENTIAL_TESTS_ONLY=1 swift run adevcontainerTests
+```
+
+The last command adds the isolated detached-broker probe: private context,
+test-owned executable copies, synthetic provider, CLI-exit survival, single-owner
+concurrency, idle exit, crash containment, and upgrade replacement. It never runs
+`launchctl`, creates a plist, or touches production state.
+
+Native tests have recorded behavioral red/green for absent transport, stdout
+backpressure and tampered extracted toolchains. Artifact tests compare independent
+output/cache rebuilds, ELF architecture/bounds/no-loader/no-dynamic metadata,
+manifest/payload hashes and protocol identity. Generated Swift payloads under
+`Sources/ADevContainerLib/Git/Generated/` must not be edited or committed. Details:
+[`Tests/GuestGitCredentialRelay/README.md`](Tests/GuestGitCredentialRelay/README.md).
+Linux CI uses the pinned compiler/raw-only mode and actually executes the shipped
+amd64 ELF; macOS-native parser tests do not prove Linux target execution. The
+isolated detached-broker probe runs from test-owned executable copies under the
+temporary root and requires no authorization; arm64 guest smoke requires separately
+authorized exclusively-created resources.
+
+Do not run the full suite against an installed/running runtime without explicit
+authorization for its integration side effects. Never stop an existing runtime
+or user container merely to force integration skips. No real authentication or
+host credential erase/reject is part of the synthetic checks.
+
 Plain `swift test` may report “no tests found” on Command Line Tools hosts, which lack `XCTest.framework`; the suite of record is `swift run adevcontainerTests`. On a TTY, clone tests can prompt for git identity; `swift run adevcontainerTests < /dev/null` runs the suite without prompts.
 
 - Integration skips cleanly if Apple `container` is unavailable