build(#1643): ship the .NET native model host for win-x64, win-arm64, linux-x64 in the NuGet package (Decision 111, slice 2)

[enricopiovesan]

Summary

Slice 2 of #1602 (Decision 111). The TraverseEmbedder NuGet package now ships the traverse_dotnet_host model engine for win-x64, win-arm64 and linux-x64 under runtimes/<rid>/native/, so .NET loads the right one automatically. The shipped Windows binary is built and tested before release.

• New windows-native job (windows-latest, pwsh):

  • builds traverse-dotnet-host for x86_64-pc-windows-msvc and aarch64-pc-windows-msvc with native MSVC;
  • runs the full .NET test suite against the win-x64 DLL (the signed vectors, the rights suite, CancellationToken interruption, fail-closed loading);
  • uploads both DLLs.

  It skips the test project's bash-based native build, because bash can resolve to WSL on Windows, and places the shipped DLL in the test output directly. win-arm64 is built but not run, since there's no arm64 runner.

• publish job:

  • tests on linux-x64;
  • downloads the Windows DLLs and builds the linux-x64 .so into TraverseEmbedder/runtimes/, then packs;
  • verifies the .nupkg (scripts/ci/dotnet_nupkg_native_check.sh): all three libraries present and non-empty, no unexpected native assets, and the linux-x64 library exporting exactly traverse_dotnet_host_model_call and traverse_dotnet_host_free;
  • loads the engine from the installed package in a throwaway console app (scripts/ci/dotnet_nupkg_consumer_smoke.sh).

  Only then does it log in to NuGet (OIDC) and push.

• Dry run on pull requests: the workflow now also runs on PRs that touch packages/dotnet/**, crates/traverse-dotnet-host/**, crates/traverse-model-host-frame/**, the native build script, or the workflow. The NuGet login and push steps are skipped for pull_request, and the version comes from the Cargo workspace. Every other PR still runs only the linux-x64 dotnet-model-host job (Decision 111). This narrow trigger, rather than a Windows job on every PR, means the Windows path is proven before a release depends on it.

• TraverseEmbedder.csproj packs runtimes/**/native/* when the staged folder exists. A build without it still works, and model calls then fail closed with engine_unavailable. runtimes/ is gitignored, so nothing binary is committed.

• README and CHANGELOG are updated.

Governing Spec

• 138-governed-exact-model-execution
• 068-public-platform-embedder-packages
• 031-supply-chain-hardening
• 060-wasm-resource-limits

Project Item

• Closes .NET model host publish: Windows build + test and NuGet runtimes/ packaging (Decision 111, slice 2) #1643 (Project 1). Umbrella .NET exact-ref model execution umbrella: native Rust via P/Invoke (Decision 111) #1602.

Validation

• Locally (macOS), the packing mechanism was checked by staging this host's library as runtimes/osx-arm64/native/:
  • dotnet pack lays it out as runtimes/osx-arm64/native/libtraverse_dotnet_host.dylib;
  • dotnet_nupkg_consumer_smoke.sh installs the package from a local feed and prints native-model-host-ok;
  • packed without native assets, the same smoke test fails with the fail-closed ExactModelException ("could not be loaded").
• The Windows build and the full dry run are verified by this PR's CI (the windows-native and publish jobs of Publish .NET embedder). The workflow YAML parses.
• spec_alignment_check.sh and pr_body_check.sh pass.

🤖 Generated with Claude Code