cid(review): PASS — root Package.swift CI smoke test verified

Author: CID Agent

.claude/agent-memory/review/MEMORY.md

@@ -80,10 +80,8 @@ Review patterns, quality gate knowledge, and common issues accumulated across CI
     lacks Ruby headers/libclang-dev. Dedicated `ruby` job handles iscc-rb clippy/compile/test
 - .NET bindings fully complete (iteration 9): 32/32 Tier 1 symbols, 91 tests, NuGet publish
     pipeline, version sync, docs. C# issue resolved and deleted from issues.md
-- Swift bindings: XCFramework deliverables complete (iteration 4) — build script, Package.swift,
-    release workflow, version sync (16th target), docs. GITHUB_REF_NAME bug fixed (d29a1b3).
-    Provenance guard added (iteration 5). XCF cache key fixed (iteration 4). Remaining: root
-    Package.swift CI smoke test (normal issue)
+- Swift bindings fully complete: XCFramework, Package.swift, release workflow, version sync, docs,
+    provenance guard (iteration 5), root Package.swift CI smoke test (iteration 6)
 - **JNA Android ARM32 resource path**: JNA canonicalizes ARM32 arch to `arm` (not `armv7`). Correct
     prefix is `android-arm/`, not `android-armv7/`. Verified via bytecode decompilation. Filed as
     spec issue with HUMAN REVIEW REQUESTED
@@ -123,7 +121,8 @@ Review patterns, quality gate knowledge, and common issues accumulated across CI
 - Review shortcut: `cargo build/test/clippy -p iscc-uniffi` + `mise run check` (no `swift test` on
     Linux). Swift tests structurally validated only — execution needs macOS CI
 - **Script-only (shell)**: `bash -n <script>` + `mise run check` + clippy (when no Rust changes)
-- Swift CI job (`swift:`) on `macos-14`: `cargo build -p iscc-uniffi` → `swift build` → `swift test`
+- Swift CI job (`swift:`) on `macos-14`: `dump-package` (root) → `cargo build -p iscc-uniffi` →
+    `swift build` → `swift test`
 - **Docs site URL**: `https://lib.iscc.codes/` NOT `https://iscc-lib.iscc.io/`. Advance agents
     consistently get this wrong — always verify in review
 

.claude/context/handoff.md

@@ -1,29 +1,37 @@
-## 2026-03-22 — Add root Package.swift manifest smoke test to CI
+## 2026-03-22 — Review of: Add root Package.swift manifest smoke test to CI
 
-**Done:** Added a `swift package dump-package` step to the `swift` CI job that validates the
-consumer-facing root `Package.swift` manifest parses correctly. The step runs early (after
-rust-cache, before the expensive UniFFI build) and requires no `working-directory` since it targets
-the repo root.
+**Verdict:** PASS
 
-**Files changed:**
-
-- `.github/workflows/ci.yml`: Added "Validate root Package.swift manifest" step at line 239-240 in
-    the `swift` job, between `Swatinem/rust-cache@v2` and "Build UniFFI native library"
+**Summary:** The advance agent added exactly 2 lines to ci.yml — a `swift package dump-package` step
+in the `swift` job that validates the root `Package.swift` manifest parses correctly. The change is
+minimal, correctly placed (after rust-cache, before the expensive UniFFI build), and all 6
+verification criteria pass. The resolved "CI does not exercise root Package.swift" issue has been
+deleted from issues.md.
 
 **Verification:**
 
-- YAML valid: `yaml.safe_load()` exits 0
-- `grep -c 'dump-package'` returns 1 (step exists exactly once)
-- `grep -B2 'dump-package' | grep -c 'working-directory'` returns 0 (runs at repo root)
-- `grep -B5 'dump-package' | grep 'Validate root'` confirms step name
-- `dump-package` step appears BEFORE "Build UniFFI native library" (visual inspection confirmed)
-- `mise run format` produces no changes
-- `mise run check` — all 15 pre-commit hooks pass
-
-**Next:** The "CI does not exercise root Package.swift" issue in issues.md should be marked resolved
-by the review agent. The only remaining issues are "Add programming language logos to docs site"
-(low priority, CID-skipped) and the benchmarks documentation gap.
-
-**Notes:** No tests to write — this is a CI-only YAML change. The `dump-package` command parses the
-manifest and outputs JSON but does NOT resolve/download binary targets, so the PLACEHOLDER checksum
-on develop is fine. This is exactly the right level of validation for the develop branch.
+- [x] `yaml.safe_load` exits 0 — valid YAML confirmed
+- [x] `grep -c 'dump-package'` returns 1 — step exists exactly once
+- [x] `grep -B2 'dump-package' | grep -c 'working-directory'` returns 0 — runs at repo root
+- [x] `grep -B5 'dump-package' | grep 'Validate root'` — step name confirmed
+- [x] `dump-package` step (line 240) appears BEFORE "Build UniFFI native library" (line 241)
+- [x] `mise run format` — no changes (clean)
+
+**Issues found:**
+
+- (none)
+
+**Codex review:** One P2 finding: `dump-package` doesn't validate the remote XCFramework
+URL/checksum. This is by design — the work package explicitly scoped this as `dump-package` (not
+`swift package resolve`) because the root manifest has a PLACEHOLDER checksum on develop. Binary
+target resolution would fail. The release workflow patches the checksum at publish time. This is the
+correct level of validation for the develop branch. Finding dismissed.
+
+**Next:** Only one low-priority issue remains (docs language logos), which CID skips. The benchmarks
+documentation gap (state.md: "partially met" — speedup factors not published) is the last actionable
+gap for CID. The next step should run the pytest-benchmark comparisons, compute speedup factors, and
+publish them to the docs site.
+
+**Notes:** All 12 bindings complete, all CI green, all issues resolved except the low cosmetic one.
+The project is approaching full completion — only the benchmarks docs gap prevents Documentation and
+Benchmarks from reaching "met" status.

.claude/context/issues.md

@@ -7,14 +7,6 @@ review agent deletes resolved issues after verification (history in git).
 
 <!-- Add issues below this line -->
 
-## CI does not exercise root Package.swift `normal` [human]
-
-CI tests only `packages/swift/Package.swift` (the dev manifest). The root `Package.swift` that real
-SPM consumers resolve — with its binary target and checksum — is never exercised. Binary-target
-regressions (wrong URL pattern, checksum format) can land unnoticed. Low priority because the
-release workflow patches the checksum at publish time, but a manifest-resolution smoke check on
-macOS CI would add defense in depth.
-
 ## Add programming language logos to docs site `low` [human]
 
 README language logos added (iteration 3). Consider adding matching logos to `docs/index.md` and

.claude/context/iterations.jsonl

@@ -1066,3 +1066,8 @@
 {"ts":"2026-03-22T10:51:16.796520+00:00","iteration":5,"role":"update-state","status":"OK","turns":17,"cost_usd":0.521435,"duration_s":141.9}
 {"ts":"2026-03-22T10:55:50.286627+00:00","iteration":5,"role":"define-next","status":"OK","turns":31,"cost_usd":1.045979,"duration_s":273.5}
 {"ts":"2026-03-22T11:00:23.701935+00:00","iteration":5,"role":"advance","status":"OK","turns":28,"cost_usd":0.694194,"duration_s":273.4}
+{"ts":"2026-03-22T11:06:37.976918+00:00","iteration":5,"role":"review","status":"OK","turns":1,"cost_usd":1.10023,"duration_s":374.3}
+{"ts":"2026-03-22T11:19:10.142367+00:00","iteration":6,"role":"update-state","status":"OK","turns":19,"cost_usd":0.577667,"duration_s":148.3}
+{"ts":"2026-03-22T11:22:00.547452+00:00","iteration":6,"role":"define-next","status":"OK","turns":24,"cost_usd":0.777998,"duration_s":170.4}
+{"ts":"2026-03-22T11:26:01.566394+00:00","iteration":6,"role":"advance","status":"OK","turns":26,"cost_usd":0.574974,"duration_s":241.0}
+{"ts":"2026-03-22T11:30:32.179131+00:00","iteration":6,"role":"review","status":"PASS","turns":1,"cost_usd":0.0,"duration_s":0}