feat(engine)!: retire Python engine and PyPI distribution

.dockerignore

@@ -1,3 +1,3 @@
-# The image installs the built wheel; nothing else belongs in the context.
 *
-!dist/
+!rust/
+!rust/**

.github/workflows/native-publish.yml

@@ -0,0 +1,79 @@
+name: Publish native release
+
+on:
+  release:
+    types: [published]
+
+permissions:
+  contents: write
+
+jobs:
+  binaries:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-latest
+            target: x86_64-unknown-linux-gnu
+            archive: tar.gz
+          - os: macos-14
+            target: aarch64-apple-darwin
+            archive: tar.gz
+          - os: windows-latest
+            target: x86_64-pc-windows-msvc
+            archive: zip
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@v5
+      - name: Install pinned Rust toolchain
+        working-directory: rust
+        run: rustup show
+      - uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: rust
+      - name: Build native binaries
+        shell: bash
+        env:
+          RELEASE_TAG: ${{ github.event.release.tag_name }}
+        run: |
+          VERSION="${RELEASE_TAG#v}"
+          (cd rust && DECIDED_RS_VERSION="$VERSION" cargo build --release --locked -p decided -p decided-mcp)
+      - name: Package Unix binaries
+        if: matrix.archive == 'tar.gz'
+        shell: bash
+        env:
+          TARGET: ${{ matrix.target }}
+        run: |
+          mkdir -p dist
+          tar -C rust/target/release -czf "dist/asdecided-${TARGET}.tar.gz" decided decided-mcp
+      - name: Package Windows binaries
+        if: matrix.archive == 'zip'
+        shell: pwsh
+        run: |
+          New-Item -ItemType Directory -Force dist | Out-Null
+          Compress-Archive -Path rust/target/release/decided.exe,rust/target/release/decided-mcp.exe -DestinationPath dist/asdecided-${{ matrix.target }}.zip
+      - name: Attach binaries to GitHub Release
+        shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: gh release upload "${{ github.event.release.tag_name }}" dist/* --clobber
+
+  image:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    env:
+      IMAGE: ghcr.io/itsthelore/rac
+      TAG: ${{ github.event.release.tag_name }}
+    steps:
+      - uses: actions/checkout@v5
+      - name: Build and smoke-test image
+        run: |
+          docker build --build-arg DECIDED_VERSION="$TAG" -t "$IMAGE:$TAG" -t "$IMAGE:latest" .
+          docker run --rm "$IMAGE:$TAG" --version
+      - name: Publish image
+        run: |
+          echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u "${{ github.actor }}" --password-stdin
+          docker push "$IMAGE:$TAG"
+          docker push "$IMAGE:latest"

.github/workflows/pr-checks.yml

@@ -1,8 +1,6 @@
 name: PR Checks
 
-# Pre-merge distribution checks. Rust behavior and the bounded retirement
-# oracle are owned by rust-spike.yml under ADR-120. This workflow verifies only
-# the maintained Python packaging/SDK bridge and the three shipped Actions.
+# Pre-merge dogfood checks for the three native Actions.
 on:
   pull_request:
 
@@ -14,14 +12,11 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
-  bridge:
-    uses: ./.github/workflows/tests.yml
-
   # Watchkeeper dogfood (v0.12.3): every pull request here gets a product
   # knowledge review from the local action in source mode — which is also
   # the live end-to-end test of action.yml itself.
   watchkeeper:
-    name: watchkeeper (dogfood, source install)
+    name: watchkeeper (dogfood, native)
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v5
@@ -31,15 +26,14 @@ jobs:
       - uses: ./
         with:
           path: decisions
-          install-from: source
 
   # Validate dogfood (v0.17.2): every pull request runs the local validate
   # action in source mode — the live end-to-end test of validate-action/action.yml
   # (install, `decided validate --sarif`, exit-code propagation). SARIF uploads to
   # Code Scanning for same-repo PRs; it is skipped on forks, whose token cannot be
   # granted security-events: write, so the check never fails on a missing scope.
   validate:
-    name: validate (dogfood, source install)
+    name: validate (dogfood, native)
     runs-on: ubuntu-latest
     permissions:
       contents: read
@@ -52,7 +46,6 @@ jobs:
       - uses: ./validate-action
         with:
           path: decisions
-          install-from: source
           upload-sarif: ${{ !github.event.pull_request.head.repo.fork }}
 
   # PR-gate dogfood (v0.21.14): every pull request runs the local PR-gate action
@@ -64,7 +57,7 @@ jobs:
   # never collide). Skipped on forks, whose token cannot be granted
   # security-events: write.
   gate:
-    name: pr-gate (dogfood, source install)
+    name: pr-gate (dogfood, native)
     runs-on: ubuntu-latest
     permissions:
       contents: read
@@ -77,5 +70,4 @@ jobs:
       - uses: ./pr-gate-action
         with:
           path: decisions
-          install-from: source
           upload-sarif: ${{ !github.event.pull_request.head.repo.fork }}