Release contract: archives, image, SIF, entrypoint, release checks (A7)

[jcschaff]

This PR implements VCell's solver release contract (docs/plan-solver-repos.md §1, row A7) for VCellChombo2D_x64 and VCellChombo3D_x64. The details are in the new SOLVER-RELEASE.md.

What it adds

• .github/workflows/release.yml. It runs on PRs and manual runs, which build and check everything and publish nothing, and on v* tags, which also publish.
  • Release assets: linux64.tgz (x86_64), linux64arm.tgz (aarch64), mac64.tgz (universal arm64+x86_64, ad-hoc signed) and SHA256SUMS.
  • Archive layout: flat. It holds the two executables under VCell's names, the bundled GCC runtime, LICENSE, THIRD-PARTY-LICENSES/ (Chombo, the submodules and every Conan package) and VERSION. There are no test binaries and no static libraries.
  • Linux: built on manylinux_2_28 with gcc-toolset-13. The whole Conan tree is compiled from source, because Conan Center's binaries need a newer glibc (their m4 doesn't even run there). packaging/bundle-linux.sh bundles libgfortran, libquadmath and libz with RUNPATH=$ORIGIN, and fails the build on any GLIBC_ symbol version newer than 2.28.
  • macOS: built with Homebrew GCC 13 on arm64 and x86_64. packaging/bundle_macos.py bundles the GCC runtime dylibs with @rpath install names and @loader_path as the only rpath, so nothing refers to /opt/homebrew. packaging/make-universal.sh then lipos the two builds together.
  • Windows: no win64.zip. Chombo's build needs GNU make, perl and a Unix shell, and the MinGW port on windows-ci doesn't build yet. This is documented.
• Image ghcr.io/virtualcell/vcell-chombo:<X.Y.Z> and :latest, for amd64 and arm64. It is the release archive on debian:bookworm-slim, with no build stage, behind the standard /usr/local/bin/vcell-solver-entrypoint (ENTRYPOINT, CMD ["--help"]):
  • no arguments or --help prints the version and executables and exits 0;
  • a known executable name is execed with the arguments unchanged;
  • anything else prints usage and exits 2.
• SIF ghcr.io/virtualcell/vcell-chombo_singularity:<X.Y.Z> and :latest (amd64, about 42 MB), pushed with ORAS.
• Messaging is ON everywhere, so -tid works. libcurl is built without TLS, because vcell-messaging only speaks http:// to the broker's REST bridge. That also drops OpenSSL from the mac build.

Solver fixes found along the way

1. Path buffers. BASE_FILE_NAME-derived paths went into 128-byte stack buffers, which overflowed on long absolute paths (see VCell's docs/chombo-solver-notes.md, defect 1). The buffers are now 4096 bytes. Two error paths that threw a pointer to a dead stack buffer now throw a std::string.
2. Scratch file location. The scratch .sim.hdf5 for each timepoint was written into the current directory, so any run from a directory the user can't write failed with "cannot write zip archive". That covers a read-only container and an unprivileged user in a root-owned checkout, which is how the release check caught it. The file is now written next to the results, and it keeps its bare name in the .log and the zip, so what VCell reads is unchanged.

Checks: tests/release/check_release.py

The script runs the shipped artifact, with nothing from the build tree and only numpy and h5py on the host. Every run uses -tid 0 against a fake broker REST bridge, and must report starting, progress and completed (the last event) with no failure. It is run against:

• each Linux archive, as an unprivileged user from a non-writable cwd;
• the universal mac archive, on both an arm64 and an x86_64 runner;
• both images, as the caller's uid;
• the SIF, under apptainer run --containall --bind <work>:/simdata with a bare executable name, /simdata paths and -tid 0, exactly as SlurmProxy runs it.

The cases, each in 2D and in 3D, are usage, smoke (under a path of 287 characters or more), the regression baseline (rtol 1e-9), the analytic eigenmode, and new reference models.

The reference models reference{2,3}d.fvinput are the first inputs in this repo that move mass across the embedded boundary: U in a disc or sphere, V outside it, and a membrane flux k(U−V) between them. Results, identical on every target:

model	Σ total t=0 → 0.2	max drift	mass crossed (equilibrium share)
2D 32²	136.5660017 → 136.5660017	7.5e-10	64.2% (80.4%)
3D 16³	41.50830499 → 41.50830495	1.5e-9	83.5% (93.5%)

The regression cases match the Linux/GCC 13 baselines on x86_64, aarch64 and macOS arm64, with a worst relative difference of 1.7e-15. The analytic ratio is 1.000.

Decisions

• The Linux archives bundle libgfortran, libquadmath and libz. They treat glibc, libstdc++ and libgcc_s as system libraries: gcc-toolset needs only the GCC 8 ABI (GLIBCXX_3.4.22 max).
• The effective minimum macOS is 15, because Homebrew's gcc@13 bottles on the macOS-15 runners carry minos 15.0.
• Serial only. MPI Chombo (VCellChombo<N>D_x64parallel) is a follow-up.
• The image and SIF are published on v* tags only (:<X.Y.Z> and :latest). Pushes to main publish nothing.
• ci.yml is unchanged and stays the everyday build+ctest workflow.
• vcell-messaging here is the 2.0 MessageEventManager rewrite. Its stopRequested flag is initialized, so the uninitialized-bStopRequested bug found in the older VCellMessaging copies does not apply. The check asserts that JOB_COMPLETED is the last event anyway.

For VCell

• B2 (pom). Take linux64.tgz, mac64.tgz and SHA256SUMS and unpack them flat into localsolvers/{linux64,mac64}. There is no win64 asset. For notarization, the Mach-O files are the two executables plus libgfortran.5.dylib, libquadmath.0.dylib, libstdc++.6.dylib and libgcc_s.1.1.dylib.
• C2 (submit.env). Set VCELL_HTC_VCELLCHOMBO_APPTAINER_IMAGE=oras://ghcr.io/virtualcell/vcell-chombo_singularity:<X.Y.Z> and VCELL_HTC_VCELLCHOMBO_SOLVER_LIST=Chombo.

🤖 Generated with Claude Code