test: avoid credential-shaped registry fixture

.github/workflows/ci.yml

@@ -205,10 +205,56 @@ jobs:
               GITHUB_ACTIONS: ""
            run: bun scripts/ci-dev-affected.ts --task="$AFFECTED_TASK_KEY"
 
+   acp_conformance:
+      if: ${{ always() && !startsWith(github.ref, 'refs/tags/v') && (github.event_name != 'workflow_dispatch' || inputs.rehearsal == 'main-nontag') && needs.main_plan.outputs.has_tasks == 'true' && needs.main_native.result != 'failure' && needs.main_native.result != 'cancelled' }}
+      needs: [main_plan, main_native]
+      runs-on: ubuntu-22.04
+      timeout-minutes: 20
+      steps:
+         - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
+         - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020  # v4
+           with:
+              node-version: "24"
+         - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6  # v2
+           with:
+              bun-version: "1.3.14"
+         - name: Cache bun dependencies
+           uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830  # v4
+           with:
+              path: ~/.bun/install/cache
+              key: bun-1.3.14-${{ runner.os }}-${{ hashFiles('**/bun.lock') }}
+         - run: bun install --frozen-lockfile
+         - name: Download native addon(s)
+           uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093  # v4
+           with:
+              name: main-native-${{ github.run_id }}
+              path: packages/natives/native
+         - name: Run ACP conformance
+           run: |
+              # Real (non-symlinked) seeded scratch workspace, matching the promoted baseline:
+              # the ACP client enforces its session cwd root against the resolved path.
+              scratch="$(mktemp -d "$RUNNER_TEMP/acp-conformance-XXXXXX")"
+              scratch="$(cd "$scratch" && pwd -P)"
+              printf 'acpx conformance workspace\n' > "$scratch/README.md"
+              bun run conformance:run -- \
+                 --agent-command "bun packages/coding-agent/scripts/acp-conformance-agent.ts" \
+                 --format json \
+                 --report "$RUNNER_TEMP/acp-conformance/report.json" \
+                 --cwd "$scratch"
+         - name: Upload ACP conformance report
+           if: ${{ always() }}
+           uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4
+           with:
+              name: acp-conformance-report-${{ github.run_id }}
+              path: ${{ runner.temp }}/acp-conformance/report.json
+              if-no-files-found: warn
+              retention-days: 7
+              overwrite: true
+
    # Branch protection must keep requiring this stable aggregate status.
    test:
       if: ${{ always() && !startsWith(github.ref, 'refs/tags/v') && (github.event_name != 'workflow_dispatch' || inputs.rehearsal == 'main-nontag') }}
-      needs: [main_plan, main_native, main_python_matrix, main_shards]
+      needs: [main_plan, main_native, main_python_matrix, main_shards, acp_conformance]
       runs-on: ubuntu-22.04
       timeout-minutes: 5
       steps:
@@ -218,11 +264,13 @@ jobs:
               native='${{ needs.main_native.result }}'
               shards='${{ needs.main_shards.result }}'
               python='${{ needs.main_python_matrix.result }}'
-              echo "main_plan=$plan main_native=$native main_python_matrix=$python main_shards=$shards"
+              conformance='${{ needs.acp_conformance.result }}'
+              echo "main_plan=$plan main_native=$native main_python_matrix=$python main_shards=$shards acp_conformance=$conformance"
               test "$plan" = success
               case "$native" in success|skipped) ;; *) echo "native gate failed"; exit 1;; esac
               case "$python" in success|skipped) ;; *) echo "Python gate failed"; exit 1;; esac
               test "$shards" = success
+              test "$conformance" = success
 
    # ---------------------------------------------------------------------------
    # Tag (vX.Y.Z) graph: build native addons for every published platform, then
@@ -289,10 +337,31 @@ jobs:
               pattern: pi-natives-${{ matrix.platform }}-${{ matrix.arch }}*
               path: packages/natives/native
               merge-multiple: true
+         - name: Verify memory-guard native loader export
+           run: bun test packages/natives/test/memory-guard-native.test.ts
+
          - name: Build release binary
            env:
               RELEASE_TARGETS: ${{ matrix.target_id }}
            run: bun run ci:release:build-binaries
+         - name: Smoke memory-guard native route (Windows)
+           if: runner.os == 'Windows'
+           shell: pwsh
+           run: |
+              $json = & "${{ matrix.binary_path }}" internal memory-guard-native-smoke --json
+              $data = $json | ConvertFrom-Json
+              if ($data.api -ne "memory_guard_windows_job_probe_v1") {
+                 throw "unexpected api: $($data.api)"
+              }
+              if ($data.source -ne "pi_natives") {
+                 throw "unexpected source: $($data.source)"
+              }
+              if ($data.result.platform -ne "win32") {
+                 throw "unexpected platform: $($data.result.platform)"
+              }
+              if (@("job_snapshot", "not_in_job", "api_error") -notcontains $data.result.kind) {
+                 throw "unexpected result kind: $($data.result.kind)"
+              }
          - name: Smoke release binary
            if: runner.os != 'Windows'
            run: |