moonbit-community · ZSeanYves · Aug 13, 2026 · Aug 13, 2026
@@ -24,7 +24,7 @@ jobs:
           fetch-depth: 0
 
       - name: Install MoonBit
-        uses: hustcer/setup-moonbit@9199da0ab63ea0c0bab1dc15f03d76e17ed4f75f # v1.22
+        uses: hustcer/setup-moonbit@1522f9aef02a8ca0187dfc00a41f5dd6b16750f7 # v1.23
         with:
           version: 0.10.6+62c2592d1
 
@@ -141,7 +141,7 @@ jobs:
         uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
 
       - name: Install MoonBit
-        uses: hustcer/setup-moonbit@9199da0ab63ea0c0bab1dc15f03d76e17ed4f75f # v1.22
+        uses: hustcer/setup-moonbit@1522f9aef02a8ca0187dfc00a41f5dd6b16750f7 # v1.23
         with:
           version: 0.10.6+62c2592d1
 

@@ -18,7 +18,7 @@ jobs:
         with:
           fetch-depth: 0
           persist-credentials: false
-      - uses: hustcer/setup-moonbit@9199da0ab63ea0c0bab1dc15f03d76e17ed4f75f # v1.22
+      - uses: hustcer/setup-moonbit@1522f9aef02a8ca0187dfc00a41f5dd6b16750f7 # v1.23
         with:
           version: 0.10.6+62c2592d1
       - name: Ensure MoonX entry point
@@ -35,8 +35,6 @@ jobs:
         include:
           - os: ubuntu-latest
             platform: linux-x86_64
-          - os: macos-15-intel
-            platform: macos-x86_64
           - os: macos-latest
             platform: macos-aarch64
           - os: windows-latest
@@ -50,13 +48,15 @@ jobs:
       - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
         with:
           persist-credentials: false
-      - uses: hustcer/setup-moonbit@9199da0ab63ea0c0bab1dc15f03d76e17ed4f75f # v1.22
+      - uses: hustcer/setup-moonbit@1522f9aef02a8ca0187dfc00a41f5dd6b16750f7 # v1.23
         with:
           version: 0.10.6+62c2592d1
       - name: Ensure MoonX entry point
         shell: bash
         run: ./tools/release/ensure_moonx.sh
       - run: moon update
+      - name: Install exact dependencies
+        run: moon check --target all --warn-list +73
       - name: Build and verify
         shell: bash
         run: |
@@ -93,12 +93,14 @@ jobs:
       - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
         with:
           persist-credentials: false
-      - uses: hustcer/setup-moonbit@9199da0ab63ea0c0bab1dc15f03d76e17ed4f75f # v1.22
+      - uses: hustcer/setup-moonbit@1522f9aef02a8ca0187dfc00a41f5dd6b16750f7 # v1.23
         with:
           version: 0.10.6+62c2592d1
       - name: Ensure MoonX entry point
         run: ./tools/release/ensure_moonx.sh
       - run: moon update
+      - name: Install exact dependencies
+        run: moon check --target all --warn-list +73
       - name: Build wasm1 staging asset
         run: MOONJUST_REQUIRE_CLEAN=1 MOONJUST_RELEASE_PLATFORM=linux-x86_64 ./tools/release/build_artifacts.sh
       - name: Verify staging MoonX protocol

@@ -10,6 +10,7 @@ audit = "docs/PHASE_0_11_AUDIT.md"
 mooncakes = "complete module metadata, source package validation, documented public facade and exact moonx executable coordinate"
 policy = "deny, inspect, CI and execute policies with real capability-denial and allow-path smoke tests"
 artifacts = "release-mode Linux, macOS and Windows Native executables plus linear-memory wasm1, SHA-256 checksums and clean extraction smoke tests"
+native_matrix = "linux-x86_64, macos-aarch64 and windows-x86_64; macos-x86_64 is excluded because the official MoonBit installer removed Intel macOS toolchain distribution"
 supply_chain = "CycloneDX SBOM, SLSA-compatible provenance predicate, checksums and GitHub OIDC artifact attestations bound to commit and toolchain"
 upgrade = "cold source-package install, previous-release replacement, corpus execution and byte-preserving rollback without shared project build cache"
 publication = "repository automation prepares and attests candidates only; formal Mooncakes publication, tags and GitHub Releases are maintainer-only"

@@ -83,5 +83,5 @@ permission. Formal publication remains exclusively a maintainer action.
 
 No second-review finding remains open. Phase 11 becomes complete only after
 the reviewed PR merges through required checks, the manual release-candidate
-workflow proves all four Native candidates plus the wasm1 asset and OIDC
+workflow proves all supported Native candidates plus the wasm1 asset and OIDC
 attestations without publishing, and the resulting protected-main CI passes.
@@ -19,7 +19,7 @@
 | --- | --- | --- |
 | PR-110 | Complete Mooncakes metadata, safe source archive, executable public API guide and exact MoonX coordinate | `moon package`, source verifier, 3 API documentation tests and local MoonX staging |
 | PR-111 | Explicit deny, inspect, CI and execute policies with security documentation | explicit deny, omitted-section default deny, read-only query and controlled/full execution smoke tests |
-| PR-112 | Linux, macOS, Windows and wasm1 candidate artifacts with deterministic archives and checksums | platform matrix workflow, extraction verifier, exact version execution and external/embedded checksum validation |
+| PR-112 | Linux x86_64, macOS arm64, Windows x86_64 and wasm1 candidate artifacts with deterministic archives and checksums | supported-platform matrix workflow, extraction verifier, exact version execution and external/embedded checksum validation |
 | PR-113 | Dependency/license audit, CycloneDX SBOM, SLSA-compatible provenance and OIDC candidate attestation | exact three-dependency audit, commit/toolchain/target binding and twelve-class tamper rejection |
 | PR-114 | Cache-independent source rebuild plus previous-candidate upgrade and rollback | fresh source tree, caches disabled, Phase 10 query/execution parity and exact-byte rollback |
 
@@ -67,6 +67,11 @@ Native toolchain embeds target-path information, so the project does not claim
 path-independent Native bytes. Instead, independent source-package rebuilds
 must pass exact version, query and execution corpora.
 
+The official MoonBit installer removed Intel macOS toolchain distribution, so
+the reviewed candidate matrix explicitly excludes macOS x86_64 rather than
+substituting an emulated result. The supported Native candidates are Linux
+x86_64, macOS arm64 and Windows x86_64; wasm1 remains independently packaged.
+
 ## Supply chain and upgrade
 
 Every Native candidate and the wasm1 MoonX asset carry a CycloneDX 1.5 SBOM

@@ -701,14 +701,17 @@ Markdown 上游 oracle 证据见
 | PR-114 | upgrade rehearsal | 从干净环境和上一 RC 升级/回滚 | 无本机缓存依赖；回滚文档可执行 |
 
 执行状态：Phase 11 已于 2026-08-13 完成本地实现和第一轮严格验收。
-PR-110 至 PR-114 的 Mooncakes/MoonX staging、四类 wasm policy、四平台
+PR-110 至 PR-114 的 Mooncakes/MoonX staging、四类 wasm policy、三平台
 Native 与 wasm1 候选制品、checksum/SBOM/provenance/OIDC attestation 流程、
 十二类篡改拒绝和 Phase 10 到 Phase 11 升级/精确回滚证据见
 [`PHASE_11_REPORT.md`](PHASE_11_REPORT.md)。仓库自动化只准备并验证候选物，
 不执行正式发布、创建 tag 或 GitHub Release；这些操作仅由维护者本人完成。
 两轮远端 PR CI 与强制二次复核已经通过，审计见
 [`PHASE_0_11_AUDIT.md`](PHASE_0_11_AUDIT.md)。candidate workflow、合并与
 protected-main CI 完成前，阶段出口保持 pending。
+当前官方 MoonBit 安装链已移除 macOS x86_64 工具链分发，因此候选矩阵按
+第 3.3 节规则在 RC 前明确收缩为 Linux x86_64、macOS arm64 和 Windows
+x86_64；不得以模拟结果替代，待官方恢复支持并通过真实 runner 后再扩展。
 
 ### Phase 12：Beta、RC 和 GA
 

@@ -5,6 +5,12 @@ MoonJust prepares two related release candidates from the same reviewed commit:
 - the `moonbit-community/MoonJust` source module for Mooncakes;
 - prebuilt `cmd/just` executables for Linux, macOS, Windows and wasm1.
 
+The reviewed Native candidate matrix is Linux x86_64, macOS arm64 and Windows
+x86_64. macOS x86_64 is not claimed: the official MoonBit installer removed
+Intel macOS toolchain distribution before this candidate was prepared. It must
+not be restored to the matrix until an official supported toolchain is
+available and the real-runner gate passes.
+
 The source module version in `moon.mod`, the application version reported by
 `just --version`, and every artifact provenance statement are reviewed
 together. The candidate workflow refuses a dirty tree, an unclassified