test(binding): validate native addon coverage on Linux (spike)

.changepacks/changepack_log_native_binding.json

@@ -0,0 +1,7 @@
+{
+  "changes": {
+    "bindings/devup-ui-wasm/package.json": "Patch"
+  },
+  "note": "Add a genuine native-addon coverage feasibility checkpoint for the forthcoming optional compiler binding. No compiler behavior or new build errors.",
+  "date": "2026-10-20T00:00:00.000Z"
+}

.github/workflows/W74a-binding-coverage-spike.yml

@@ -0,0 +1,90 @@
+name: W74a native coverage SPIKE
+
+# Replace/remove this SPIKE workflow before the binding PR leaves Draft.
+on:
+  push:
+    branches: [feat/napi-binding]
+    paths:
+      - 'e2e/binding/coverage-spike/**'
+      - '.github/workflows/W74a-binding-coverage-spike.yml'
+  pull_request:
+    branches: [fix/portable-binding-state]
+    paths:
+      - 'e2e/binding/coverage-spike/**'
+      - '.github/workflows/W74a-binding-coverage-spike.yml'
+
+permissions:
+  contents: read
+
+jobs:
+  scratch-controls:
+    runs-on: ubuntu-latest
+    timeout-minutes: 25
+    env:
+      CARGO_BUILD_JOBS: '2'
+      CARGO_TERM_COLOR: never
+    defaults:
+      run:
+        shell: bash
+        working-directory: e2e/binding/coverage-spike
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - name: Prepare private evidence directory
+        run: |
+          echo "W74A_EVIDENCE=$RUNNER_TEMP/W74a-evidence" >> "$GITHUB_ENV"
+          mkdir -p "$RUNNER_TEMP/W74a-evidence"
+      - uses: actions/setup-node@v7
+        with:
+          node-version: latest
+      - uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: latest
+      - uses: actions-rust-lang/setup-rust-toolchain@v2
+        with:
+          toolchain: stable
+          components: rustfmt, clippy
+          cache: false
+          rustflags: ''
+      - name: Resolve latest official GNU x64 tarpaulin release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          mkdir -p "$W74A_EVIDENCE" "$RUNNER_TEMP/W74a-tools"
+          gh api repos/xd009642/tarpaulin/releases/latest > "$W74A_EVIDENCE/tarpaulin-release.json"
+          tag=$(node -p "JSON.parse(require('node:fs').readFileSync(process.env.W74A_EVIDENCE + '/tarpaulin-release.json')).tag_name")
+          asset=cargo-tarpaulin-x86_64-unknown-linux-gnu.tar.gz
+          gh release download "$tag" --repo xd009642/tarpaulin --pattern "$asset" --dir "$W74A_EVIDENCE"
+          node --input-type=module <<'NODE'
+          import assert from 'node:assert/strict'
+          import { createHash } from 'node:crypto'
+          import { readFileSync, writeFileSync } from 'node:fs'
+          const root = process.env.W74A_EVIDENCE
+          const release = JSON.parse(readFileSync(`${root}/tarpaulin-release.json`))
+          const asset = release.assets.find(({ name }) => name === 'cargo-tarpaulin-x86_64-unknown-linux-gnu.tar.gz')
+          assert.ok(asset)
+          const digest = 'sha256:' + createHash('sha256').update(readFileSync(`${root}/${asset.name}`)).digest('hex')
+          assert.equal(digest, asset.digest, 'Official asset digest mismatch')
+          writeFileSync(`${root}/tarpaulin-asset.json`, JSON.stringify({ tag: release.tag_name, name: asset.name, digest }, null, 2))
+          NODE
+          tar -xzf "$W74A_EVIDENCE/$asset" -C "$RUNNER_TEMP/W74a-tools"
+          echo "$RUNNER_TEMP/W74a-tools" >> "$GITHUB_PATH"
+      - name: Record resolved tools and runner
+        run: |
+          printf '%s\n' "$GITHUB_SHA" "$GITHUB_REF" "$GITHUB_RUN_ID" "$GITHUB_RUN_ATTEMPT" > "$W74A_EVIDENCE/source-run.txt"
+          { uname -a; printf '%s\n' "$ImageOS" "$ImageVersion"; rustc +stable -Vv; cargo +stable -V; cargo +stable tarpaulin --version; node --version; bun --version; } 2>&1 | tee "$W74A_EVIDENCE/versions.log"
+      - name: Scratch source formatting and strict clippy
+        run: |
+          cargo +stable fmt --all -- --check 2>&1 | tee "$W74A_EVIDENCE/fmt.log"
+          cargo +stable clippy --locked --workspace --all-targets --all-features --target-dir "$RUNNER_TEMP/W74a-clippy-target" --jobs 2 -- -D warnings 2>&1 | tee "$W74A_EVIDENCE/clippy.log"
+      - name: Serial Node coverage controls and direct Bun addon execution
+        run: node run.mjs "$W74A_EVIDENCE" 2>&1 | tee "$W74A_EVIDENCE/runner.log"
+      - name: Preserve raw SPIKE evidence even on failure
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: W74a-native-coverage-SPIKE-${{ github.run_id }}-${{ github.run_attempt }}
+          path: ${{ runner.temp }}/W74a-evidence
+          retention-days: 30
+          if-no-files-found: warn

Cargo.toml

@@ -1,6 +1,6 @@
 [workspace]
 resolver = "2"
-members = ["libs/extractor", "bindings/devup-ui-wasm", "libs/sheet", "libs/css"]
+members = ["libs/extractor", "bindings/devup-ui-wasm", "libs/sheet", "libs/css", "libs/binding", "bindings/devup-ui-binding"]
 
 [workspace.lints.rust]
 unexpected_cfgs = { level = "warn", check-cfg = ['cfg(tarpaulin_include)'] }
@@ -59,3 +59,7 @@ codegen-units = 1
 strip = true
 # Abort on panic: smaller binary, no unwinding overhead
 panic = "abort"
+
+[profile.native]
+inherits = "release"
+opt-level = 3

bindings/devup-ui-binding/Cargo.toml

@@ -0,0 +1,30 @@
+[package]
+name = "devup-ui-binding"
+version = "0.1.0"
+edition = "2024"
+rust-version = "1.88"
+description = "Synchronous native build-host adapter for Devup UI"
+license = "Apache-2.0"
+repository = "https://github.com/dev-five-git/devup-ui"
+keywords = ["css", "react", "devup-ui", "napi"]
+categories = ["development-tools", "web-programming"]
+
+[lib]
+crate-type = ["cdylib"]
+test = false
+doctest = false
+
+[lints]
+workspace = true
+
+[dependencies]
+devup-ui-binding-core = { path = "../../libs/binding" }
+extractor = { path = "../../libs/extractor" }
+sheet = { path = "../../libs/sheet" }
+napi = { version = "3.14.2", features = ["napi6"] }
+napi-derive = "3.6.12"
+serde = { version = "1.0.229", features = ["derive"] }
+bimap = { version = "0.6.3", features = ["serde"] }
+
+[build-dependencies]
+napi-build = "2.6.0"

bindings/devup-ui-binding/README.md

@@ -0,0 +1,9 @@
+# Native build-host adapter (WIP)
+
+`adapter.cjs` privately exports `createBinding(raw)`; its returned object explicitly exposes the existing 29 WASM names. Raw addon helpers, positional requests and `interop.cjs` are not package ABI. No public loader or npm manifest is provided yet.
+
+The synchronous Unknown-backed decoder calls the existing engine Serde implementations, without JSON preconversion. JSON.stringify is used only after invalid-type selection for the generated-WASM debug diagnostic. Resolver handles are per environment; replacement, both resets and teardown release them. Native state still does not support concurrent independent builds.
+
+The decoder is private and target-bounded: unused Serde hints use trait forwarding, not an additional public compatibility API. New engine Deserialize shapes require fresh boundary and real-host coverage evidence.
+
+Malformed prefix policy `msg_f4283cd7dea1` is unresolved. Valid strings/nullish values are implemented; nonstrings currently encounter native argument rejection, not emulated WASM traps. This is not all-input parity or acceptance. No builds/tests/coverage have run for this implementation; main must perform same-revision Node/Bun differentials and real Node standard-tarpaulin attribution, including private error paths and finalization.