fix: release artifacts and verify them more

.github/workflows/ci_kotlin.yml

@@ -41,8 +41,61 @@ jobs:
           distribution: "temurin"
           java-version: "21"
       - uses: gradle/actions/setup-gradle@v4
-      - name: cargo make test-kotlin
-        run: cargo make test-kotlin
+      - uses: android-actions/setup-android@v3
+        if: matrix.name != 'linux-aarch64'
+      - run: cargo make test-kotlin
+
+  kotlin-jvm-consumer-smoke:
+    name: Kotlin - JVM consumer smoke (${{ matrix.name }})
+    timeout-minutes: 30
+    runs-on: ${{ matrix.runner }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - name: linux-x86_64
+            runner: [self-hosted, linux, X64]
+            cargo_target: x86_64-unknown-linux-gnu
+          - name: linux-aarch64
+            runner: [self-hosted, linux, ARM64]
+            cargo_target: aarch64-unknown-linux-gnu
+          - name: macOS-aarch64
+            # xcode16 → native-arm runner pool; the unlabeled macOS/ARM64 pool
+            # is Rosetta'd and uname misreports x86_64.
+            runner: [self-hosted, macOS, ARM64, xcode16]
+            cargo_target: aarch64-apple-darwin
+          - name: windows-x86_64
+            runner: [windows-latest]
+            cargo_target: x86_64-pc-windows-msvc
+    defaults:
+      run:
+        shell: bash
+    steps:
+      - uses: actions/checkout@master
+        with:
+          submodules: recursive
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: ${{ matrix.cargo_target }}
+      - uses: Swatinem/rust-cache@v2
+        with:
+          key: kotlin-consumer-${{ matrix.name }}
+      # taiki-e/install-action has no aarch64-linux cargo-make and davidB
+      # ships x86_64-only; cargo install works on every host.
+      - name: Install cargo-make
+        shell: bash
+        run: |
+          if ! command -v cargo-make >/dev/null 2>&1; then
+            cargo install --locked cargo-make
+          fi
+      - uses: actions/setup-java@v4
+        with:
+          distribution: "temurin"
+          java-version: "21"
+      - uses: gradle/actions/setup-gradle@v4
+      - uses: android-actions/setup-android@v3
+        if: matrix.name != 'linux-aarch64'
+      - run: cargo make verify-kotlin-consumer
 
   kotlin-android:
     name: Kotlin - Android cross-build
@@ -62,13 +115,60 @@ jobs:
           distribution: "temurin"
           java-version: "21"
       - uses: android-actions/setup-android@v3
-      - name: Setup Android NDK
-        uses: arqu/setup-ndk@main
+      - uses: arqu/setup-ndk@main
         id: setup-ndk
         with:
           ndk-version: r23
           add-to-path: true
-      - name: cargo make kotlin-android
-        env:
+      - env:
           ANDROID_NDK_HOME: ${{ steps.setup-ndk.outputs.ndk-path }}
         run: cargo make kotlin-android
+
+  kotlin-android-consumer-smoke:
+    name: Kotlin - Android consumer smoke (emulator)
+    timeout-minutes: 45
+    # ubuntu-latest has /dev/kvm via nested-virt; kotlin-android's
+    # self-hosted runner doesn't.
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@master
+        with:
+          submodules: recursive
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: aarch64-linux-android,armv7-linux-androideabi,i686-linux-android,x86_64-linux-android
+      - uses: Swatinem/rust-cache@v2
+      - uses: davidB/rust-cargo-make@v1
+      - uses: actions/setup-java@v4
+        with:
+          distribution: "temurin"
+          java-version: "17"
+      - uses: android-actions/setup-android@v3
+      - uses: arqu/setup-ndk@main
+        id: setup-ndk
+        with:
+          ndk-version: r23
+          add-to-path: true
+      - run: cargo install --version 3.5.4 cargo-ndk --locked
+      - name: Cross-build Android natives
+        env:
+          ANDROID_NDK_HOME: ${{ steps.setup-ndk.outputs.ndk-path }}
+        run: |
+          cargo ndk -o ./android-jniLibs \
+            -t armeabi-v7a -t arm64-v8a -t x86 -t x86_64 \
+            build --release --lib -p iroh-ffi
+      - run: bash scripts/stage_android_natives.sh
+      - name: Enable KVM
+        run: |
+          echo 'KERNEL=="kvm", GROUP="kvm", MODE="0666", OPTIONS+="static_node=kvm"' | sudo tee /etc/udev/rules.d/99-kvm4all.rules
+          sudo udevadm control --reload-rules
+          sudo udevadm trigger --name-match=kvm
+      - uses: reactivecircus/android-emulator-runner@v2
+        with:
+          api-level: 35
+          arch: x86_64
+          target: google_apis
+          force-avd-creation: false
+          emulator-options: -no-window -no-audio -no-boot-anim -gpu swiftshader_indirect -no-metrics
+          disable-animations: true
+          script: bash scripts/run_android_smoke.sh

.github/workflows/ci_swift.yml

@@ -28,4 +28,15 @@ jobs:
       - uses: Swatinem/rust-cache@v2
       - uses: davidB/rust-cargo-make@v1
       - name: cargo make test-swift
+        # Builds the full Apple xcframework + runs the IrohLib test suite for
+        # macOS via xcodebuild test.
         run: cargo make test-swift
+      - name: cargo make verify-swift-xcframework
+        # Asserts per-slice bundle layout (shallow iOS, deep macOS — Xcode 27+
+        # rejects shallow Info.plist on macOS, iroh-ffi#247).
+        run: cargo make verify-swift-xcframework
+      - name: cargo make verify-swift-consumer
+        # iOS device build + iOS Simulator full test run (boots a sim, runs
+        # IrohLibTests on iOS runtime). Catches link errors + iOS-side runtime
+        # regressions that macOS-only test-swift can't see.
+        run: cargo make verify-swift-consumer