Harden CI for the harvester binary and add a one-line install script (#2)

- CI now explicitly builds cmd/trainpulse-harvester and cross-compiles the
  whole module for every release target (linux/darwin/windows, amd64/arm64)
  on every PR, so a build-tag mistake like the harvest package's unix/stub
  executor split fails fast instead of only at release time.
- scripts/install.sh downloads the latest (or pinned) release binary for the
  current OS/arch from GitHub Releases, verifies it against SHA256SUMS, and
  installs it — README documents the one-line curl usage.

The existing release workflow (triggered on v* tags) already cross-compiles
both binaries via `make release` and attaches them with checksums; this just
makes sure CI would have caught the harvester binary being unbuildable
before a tag went out, and makes "download and run" the default install
path documented in the README.


Claude-Session: https://claude.ai/code/session_01175LgteX3Pm1Vg7GQNPGrG

Co-authored-by: Claude <noreply@anthropic.com>

Author: Thezone-1

.github/workflows/ci.yml

@@ -25,7 +25,34 @@ jobs:
       - name: go test
         run: go test -race ./...
       - name: go build
-        run: go build ./cmd/trainpulse
+        run: |
+          go build ./cmd/trainpulse
+          go build ./cmd/trainpulse-harvester
+
+  cross-build:
+    name: Cross-compile sanity (${{ matrix.goos }}/${{ matrix.goarch }})
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        include:
+          - goos: linux
+            goarch: amd64
+          - goos: linux
+            goarch: arm64
+          - goos: darwin
+            goarch: arm64
+          - goos: windows
+            goarch: amd64
+    env:
+      GOOS: ${{ matrix.goos }}
+      GOARCH: ${{ matrix.goarch }}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+      - name: go build (all packages)
+        run: go build ./...
 
   python-client:
     name: Python client tests

README.md

@@ -1,5 +1,8 @@
 # TrainPulse
 
+[![CI](https://github.com/Thezone-1/trainpulse/actions/workflows/ci.yml/badge.svg)](https://github.com/Thezone-1/trainpulse/actions/workflows/ci.yml)
+[![Release](https://img.shields.io/github/v/release/Thezone-1/trainpulse)](https://github.com/Thezone-1/trainpulse/releases/latest)
+
 TrainPulse is a lightweight Go daemon for predictive diagnostics of AI and LLM training systems. It collects runtime telemetry, runs low-latency anomaly checks, scores training health, infers likely root causes, and exposes real-time terminal-native stats.
 
 ## First slice
@@ -12,6 +15,29 @@ TrainPulse is a lightweight Go daemon for predictive diagnostics of AI and LLM t
 - Early diagnostic rules for dataloader starvation, GPU underutilization, sync imbalance, memory pressure, thermal instability, and throughput collapse.
 - LLM-native signals for tokens/sec, MFU, sequence padding, tokenizer stalls, all-reduce waits, checkpoint stalls, pipeline bubbles, and per-rank stragglers.
 
+## Install
+
+Prebuilt binaries (linux/amd64, linux/arm64, darwin/arm64, windows/amd64) are
+published on [GitHub Releases](https://github.com/Thezone-1/trainpulse/releases)
+for every tagged version, alongside a `SHA256SUMS` file.
+
+One-line install (downloads the latest release, verifies its checksum, and
+installs to `/usr/local/bin`):
+
+```sh
+curl -fsSL https://raw.githubusercontent.com/Thezone-1/trainpulse/main/scripts/install.sh | sh
+```
+
+```sh
+# the coordinator binary, or a pinned version, or a different install dir:
+curl -fsSL .../install.sh | sh -s -- trainpulse-harvester
+curl -fsSL .../install.sh | VERSION=v0.3.0 sh
+curl -fsSL .../install.sh | INSTALL_DIR="$HOME/.local/bin" sh
+```
+
+Or download the binary for your platform directly and `chmod +x` it — no
+install step, no dependencies.
+
 ## Build
 
 ```sh

scripts/install.sh

@@ -0,0 +1,96 @@
+#!/bin/sh
+# Installs a TrainPulse binary from GitHub Releases.
+#
+# Usage:
+#   curl -fsSL https://raw.githubusercontent.com/Thezone-1/trainpulse/main/scripts/install.sh | sh
+#   curl -fsSL .../install.sh | sh -s -- trainpulse-harvester
+#
+# Env vars:
+#   VERSION       release tag to install, e.g. v0.3.0 (default: latest)
+#   INSTALL_DIR   where to put the binary (default: /usr/local/bin)
+set -eu
+
+REPO="Thezone-1/trainpulse"
+BINARY="${1:-trainpulse}"
+INSTALL_DIR="${INSTALL_DIR:-/usr/local/bin}"
+VERSION="${VERSION:-latest}"
+
+case "$BINARY" in
+  trainpulse | trainpulse-harvester) ;;
+  *)
+    echo "usage: install.sh [trainpulse|trainpulse-harvester]" >&2
+    exit 1
+    ;;
+esac
+
+os=$(uname -s)
+case "$os" in
+  Linux) os=linux ;;
+  Darwin) os=darwin ;;
+  *)
+    echo "error: no prebuilt binary for OS '$os'; download manually from https://github.com/$REPO/releases" >&2
+    exit 1
+    ;;
+esac
+
+arch=$(uname -m)
+case "$arch" in
+  x86_64 | amd64) arch=amd64 ;;
+  arm64 | aarch64) arch=arm64 ;;
+  *)
+    echo "error: no prebuilt binary for architecture '$arch'; download manually from https://github.com/$REPO/releases" >&2
+    exit 1
+    ;;
+esac
+
+if [ "$os" = "darwin" ] && [ "$arch" = "amd64" ]; then
+  echo "error: only darwin/arm64 (Apple Silicon) is published for macOS; build from source for Intel Macs" >&2
+  exit 1
+fi
+
+if [ "$VERSION" = "latest" ]; then
+  VERSION=$(curl -fsSL "https://api.github.com/repos/$REPO/releases/latest" \
+    | grep '"tag_name"' | head -n1 | cut -d '"' -f4)
+  if [ -z "$VERSION" ]; then
+    echo "error: could not resolve the latest release tag" >&2
+    exit 1
+  fi
+fi
+
+asset="${BINARY}-${os}-${arch}"
+base_url="https://github.com/$REPO/releases/download/${VERSION}"
+
+tmp=$(mktemp -d)
+trap 'rm -rf "$tmp"' EXIT
+
+echo "Downloading $asset ($VERSION)..."
+curl -fsSL "$base_url/$asset" -o "$tmp/$asset"
+
+if curl -fsSL "$base_url/SHA256SUMS" -o "$tmp/SHA256SUMS" 2>/dev/null; then
+  expected=$(grep " ${asset}\$" "$tmp/SHA256SUMS" | awk '{print $1}')
+  if [ -n "$expected" ]; then
+    if command -v sha256sum >/dev/null 2>&1; then
+      actual=$(sha256sum "$tmp/$asset" | awk '{print $1}')
+    else
+      actual=$(shasum -a 256 "$tmp/$asset" | awk '{print $1}')
+    fi
+    if [ "$expected" != "$actual" ]; then
+      echo "error: checksum mismatch for $asset (expected $expected, got $actual)" >&2
+      exit 1
+    fi
+    echo "Checksum verified."
+  fi
+fi
+
+chmod +x "$tmp/$asset"
+
+install_path="$INSTALL_DIR/$BINARY"
+if [ -w "$INSTALL_DIR" ]; then
+  mv "$tmp/$asset" "$install_path"
+else
+  echo "Elevated permissions needed to write to $INSTALL_DIR"
+  sudo mv "$tmp/$asset" "$install_path"
+fi
+
+echo "Installed $BINARY $VERSION to $install_path"
+"$install_path" version || true