@@ -1,4 +1,4 @@
-# Reusable: build binaries (standard + UI) on all platforms
+# Reusable: build release binaries on all supported platforms
 name: Build
 
 on:
@@ -12,6 +12,10 @@ on:
         description: 'Generate build provenance attestations for release artifacts'
         type: boolean
         default: false
+      ui_only:
+        description: 'Build only the UI runtime archives'
+        type: boolean
+        default: false
 
 permissions:
   contents: read
@@ -64,6 +68,7 @@ jobs:
           node-version: "22"
 
       - name: Build standard binary
+        if: ${{ !inputs.ui_only }}
         env:
           VERSION: ${{ inputs.version }}
           CC: ${{ matrix.cc }}
@@ -75,17 +80,16 @@ jobs:
             scripts/build.sh "CC=$CC" "CXX=$CXX"
           fi
 
-      - name: Ad-hoc sign macOS binary
-        if: startsWith(matrix.os, 'macos')
+      - name: Ad-hoc sign macOS standard binary
+        if: ${{ !inputs.ui_only && startsWith(matrix.os, 'macos') }}
         run: codesign --sign - --force build/c/codebase-memory-mcp
 
-      # Archive layout/name live in the ONE canonical script the local
-      # artifact-flow smoke lane also runs (venue-parity contract).
       - name: Archive standard binary (canonical package-release.sh)
+        if: ${{ !inputs.ui_only }}
         run: scripts/package-release.sh ${{ matrix.goos }} ${{ matrix.goarch }}
 
       - name: Attest standard binary provenance
-        if: ${{ inputs.attest }}
+        if: ${{ inputs.attest && !inputs.ui_only }}
         uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1
         with:
           subject-path: codebase-memory-mcp-${{ matrix.goos }}-${{ matrix.goarch }}.tar.gz
@@ -110,6 +114,8 @@ jobs:
         if: matrix.goos == 'linux' && matrix.goarch == 'amd64'
         run: scripts/security-ui.sh
 
+      # Archive layout/name live in the ONE canonical script the local
+      # artifact-flow smoke lane also runs (venue-parity contract).
       - name: Archive UI binary (canonical package-release.sh)
         run: scripts/package-release.sh ${{ matrix.goos }} ${{ matrix.goarch }} --variant ui
 
@@ -145,6 +151,7 @@ jobs:
           node-version: "22"
 
       - name: Build standard binary
+        if: ${{ !inputs.ui_only }}
         shell: msys2 {0}
         env:
           VERSION: ${{ inputs.version }}
@@ -155,14 +162,13 @@ jobs:
             scripts/build.sh CC=clang CXX=clang++
           fi
 
-      # Archive layout/name live in the ONE canonical script the local
-      # artifact-flow smoke lane also runs (venue-parity contract).
       - name: Archive standard binary (canonical package-release.sh)
+        if: ${{ !inputs.ui_only }}
         shell: msys2 {0}
         run: scripts/package-release.sh windows amd64 CC=clang CXX=clang++
 
       - name: Attest standard binary provenance
-        if: ${{ inputs.attest }}
+        if: ${{ inputs.attest && !inputs.ui_only }}
         uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1
         with:
           subject-path: codebase-memory-mcp-windows-amd64.zip
@@ -178,6 +184,8 @@ jobs:
             scripts/build.sh --with-ui CC=clang CXX=clang++
           fi
 
+      # Archive layout/name live in the ONE canonical script the local
+      # artifact-flow smoke lane also runs (venue-parity contract).
       - name: Archive UI binary (canonical package-release.sh)
         shell: msys2 {0}
         run: scripts/package-release.sh windows amd64 --variant ui CC=clang CXX=clang++
@@ -218,6 +226,7 @@ jobs:
           node-version: "22"
 
       - name: Build standard binary
+        if: ${{ !inputs.ui_only }}
         shell: msys2 {0}
         env:
           VERSION: ${{ inputs.version }}
@@ -229,11 +238,12 @@ jobs:
           fi
 
       - name: Archive standard binary (canonical package-release.sh)
+        if: ${{ !inputs.ui_only }}
         shell: msys2 {0}
         run: scripts/package-release.sh windows arm64 CC=clang CXX=clang++
 
       - name: Attest standard binary provenance
-        if: ${{ inputs.attest }}
+        if: ${{ inputs.attest && !inputs.ui_only }}
         uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1
         with:
           subject-path: codebase-memory-mcp-windows-arm64.zip
@@ -288,6 +298,7 @@ jobs:
           node-version: "22"
 
       - name: Build standard binary (static)
+        if: ${{ !inputs.ui_only }}
         env:
           VERSION: ${{ inputs.version }}
         run: |
@@ -297,16 +308,18 @@ jobs:
             scripts/build.sh CC=gcc CXX=g++ STATIC=1
           fi
 
-      - name: Verify static linking
+      - name: Verify standard static linking
+        if: ${{ !inputs.ui_only }}
         run: |
           file build/c/codebase-memory-mcp
           ldd build/c/codebase-memory-mcp 2>&1 | grep -q "not a dynamic executable" || ldd build/c/codebase-memory-mcp 2>&1 | grep -q "statically linked"
 
       - name: Archive standard binary (canonical package-release.sh)
+        if: ${{ !inputs.ui_only }}
         run: scripts/package-release.sh linux ${{ matrix.arch }}-portable
 
       - name: Attest standard binary provenance
-        if: ${{ inputs.attest }}
+        if: ${{ inputs.attest && !inputs.ui_only }}
         uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1
         with:
           subject-path: codebase-memory-mcp-linux-${{ matrix.arch }}-portable.tar.gz
@@ -321,6 +334,11 @@ jobs:
             scripts/build.sh --with-ui CC=gcc CXX=g++ STATIC=1
           fi
 
+      - name: Verify UI static linking
+        run: |
+          file build/c/codebase-memory-mcp
+          ldd build/c/codebase-memory-mcp 2>&1 | grep -q "not a dynamic executable" || ldd build/c/codebase-memory-mcp 2>&1 | grep -q "statically linked"
+
       - name: Archive UI binary (canonical package-release.sh)
         run: scripts/package-release.sh linux ${{ matrix.arch }}-portable --variant ui
 
 
@@ -1,4 +1,4 @@
-# Reusable: smoke test every binary (standard + UI, all platforms)
+# Reusable: smoke test shipped release binaries on all platforms
 name: Smoke
 
 on:
@@ -8,6 +8,10 @@ on:
         description: 'Smoke the shipped binaries on the broad platform matrix (extra OS versions) instead of the core set'
         type: boolean
         default: false
+      ui_only:
+        description: 'Smoke only the UI runtime archives'
+        type: boolean
+        default: false
 
 permissions:
   contents: read
@@ -30,6 +34,7 @@ jobs:
         id: set
         env:
           BROAD: ${{ inputs.broad_platforms }}
+          UI_ONLY: ${{ inputs.ui_only }}
         run: |
           CORE_UNIX='[
             {"os":"ubuntu-latest","goos":"linux","goarch":"amd64"},
@@ -72,13 +77,14 @@ jobs:
             WIN=$(jq -cn --argjson a "$CORE_WIN" '$a')
             PORTABLE=$(jq -cn --argjson a "$CORE_PORTABLE" '$a')
           fi
-          # Expand each OS entry over both variants into a FLAT include list so
-          # every {os,variant} runs as its own job. A {variant:[...],include:$LIST}
-          # matrix collapses under GitHub's include-merge (later os entries
-          # overwrite the variant combos last-wins), which silently dropped every
-          # OS except the last — e.g. only windows-11-arm ran, never windows-latest.
-          # Building the cartesian explicitly avoids that.
-          VARIANTS='["standard","ui"]'
+          # Keep the variant dimension explicit because the smoke wrappers use it
+          # to require and validate the UI pack. VT-focused dry runs select only
+          # UI; release compatibility retains both variants until migration.
+          if [ "$UI_ONLY" = "true" ]; then
+            VARIANTS='["ui"]'
+          else
+            VARIANTS='["standard","ui"]'
+          fi
           UNIX_M=$(jq -cn --argjson a "$UNIX" --argjson v "$VARIANTS" '{include:[$a[] as $o | $v[] as $t | ($o + {variant:$t})]}')
           WIN_M=$(jq -cn --argjson a "$WIN" --argjson v "$VARIANTS" '{include:[$a[] as $o | $v[] as $t | ($o + {variant:$t})]}')
           PORTABLE_M=$(jq -cn --argjson a "$PORTABLE" --argjson v "$VARIANTS" '{include:[$a[] as $o | $v[] as $t | ($o + {variant:$t})]}')
@@ -133,8 +139,8 @@ jobs:
           scripts/security-install.sh "$BIN"
           scripts/security-network.sh "$BIN"
 
-      - name: MCP robustness test (linux-amd64 standard only)
-        if: matrix.variant == 'standard' && matrix.goos == 'linux' && matrix.goarch == 'amd64'
+      - name: MCP robustness test (selected linux-amd64 runtime)
+        if: matrix.goos == 'linux' && matrix.goarch == 'amd64' && (inputs.ui_only || matrix.variant == 'standard')
         run: |
           BIN="$RUNNER_TEMP/cbm-artifact/codebase-memory-mcp"
           scripts/security-fuzz.sh "$BIN"
 
@@ -91,6 +91,7 @@ jobs:
     uses: ./.github/workflows/_build.yml
     with:
       attest: false
+      ui_only: true
 
   # ── Smoke test every binary ────────────────────────────────────
   # Run unless builds were skipped or a build leg FAILED. Every build leg
@@ -102,6 +103,7 @@ jobs:
     uses: ./.github/workflows/_smoke.yml
     with:
       broad_platforms: true
+      ui_only: true
 
   # ── Soak tests (optional, parallel with smoke) ────────────────
   soak:
@@ -151,10 +153,11 @@ jobs:
       - name: Extract archive artifacts
         run: |
           scripts/ci/extract-release-archives.sh assets binaries \
-            --expect-archives=16 \
-            --expect-binaries=16 \
+            --archive-scope=ui \
+            --expect-archives=8 \
+            --expect-binaries=8 \
             --expect-packs=8 \
-            --expect-runtime-files=64
+            --expect-runtime-files=32
 
       - name: VirusTotal scan
         uses: crazy-max/ghaction-virustotal@936d8c5c00afe97d3d9a1af26d017cfdf26800a2 # v5.0.0
 
@@ -4,7 +4,7 @@
 #
 # Usage:
 #   extract-release-archives.sh <archive-dir> <output-dir> \
-#     [--expect-archives=N] [--expect-binaries=N] [--expect-packs=N] \
+#     [--archive-scope=all|ui] [--expect-archives=N] [--expect-binaries=N] [--expect-packs=N] \
 #     [--expect-runtime-files=N]
 #
 # The output directory is published as one atomic bundle:
@@ -18,7 +18,7 @@
 set -euo pipefail
 
 if [ "$#" -lt 2 ]; then
-  echo "Usage: $0 <archive-dir> <output-dir> [--expect-archives=N] [--expect-binaries=N] [--expect-packs=N] [--expect-runtime-files=N]" >&2
+  echo "Usage: $0 <archive-dir> <output-dir> [--archive-scope=all|ui] [--expect-archives=N] [--expect-binaries=N] [--expect-packs=N] [--expect-runtime-files=N]" >&2
   exit 2
 fi
 
@@ -70,18 +70,21 @@ UNIX_TARGETS = (
     "linux-arm64-portable",
 )
 WINDOWS_TARGETS = ("windows-amd64", "windows-arm64")
-CANONICAL_ARCHIVES = frozenset(
+UI_ARCHIVES = frozenset(
     [
-        f"codebase-memory-mcp{suffix}-{target}.tar.gz"
-        for suffix in ("", "-ui")
+        f"codebase-memory-mcp-ui-{target}.tar.gz"
         for target in UNIX_TARGETS
     ]
     + [
-        f"codebase-memory-mcp{suffix}-{target}.zip"
-        for suffix in ("", "-ui")
+        f"codebase-memory-mcp-ui-{target}.zip"
         for target in WINDOWS_TARGETS
     ]
 )
+STANDARD_ARCHIVES = frozenset(
+    [f"codebase-memory-mcp-{target}.tar.gz" for target in UNIX_TARGETS]
+    + [f"codebase-memory-mcp-{target}.zip" for target in WINDOWS_TARGETS]
+)
+CANONICAL_ARCHIVES = UI_ARCHIVES | STANDARD_ARCHIVES
 PACK_NAME = re.compile(r"cbm-ui-([0-9a-f]{64})\.pack\Z")
 SAFE_LABEL = re.compile(r"[^A-Za-z0-9._-]+")
 SAFE_ASSET_PATH = re.compile(rb"\A[A-Za-z0-9._/-]+\Z")
@@ -290,13 +293,22 @@ class ObjectStore:
 
 def parse_arguments(
     argv: Sequence[str],
-) -> Tuple[pathlib.Path, pathlib.Path, Dict[str, Optional[int]]]:
+) -> Tuple[pathlib.Path, pathlib.Path, Dict[str, Optional[int]], str]:
     archive_dir = pathlib.Path(argv[1]).absolute()
     output_dir = pathlib.Path(argv[2]).absolute()
     expected: Dict[str, Optional[int]] = {value: None for value in COUNT_OPTIONS.values()}
     seen: set[str] = set()
+    archive_scope = "all"
     for argument in argv[3:]:
         option, separator, raw_value = argument.partition("=")
+        if separator and option == "--archive-scope":
+            if "archive_scope" in seen:
+                raise ContractError(f"duplicate option: {option}")
+            if raw_value not in {"all", "ui"}:
+                raise ContractError("--archive-scope must be all or ui")
+            archive_scope = raw_value
+            seen.add("archive_scope")
+            continue
         if not separator or option not in COUNT_OPTIONS:
             raise ContractError(f"unknown option: {argument}")
         key = COUNT_OPTIONS[option]
@@ -306,7 +318,7 @@ def parse_arguments(
             raise ContractError(f"{option} requires a non-negative integer")
         expected[key] = int(raw_value)
         seen.add(key)
-    return archive_dir, output_dir, expected
+    return archive_dir, output_dir, expected, archive_scope
 
 
 def validate_namespace(archive_name: str, names: Iterable[str]) -> Tuple[str, Dict[str, str]]:
@@ -674,7 +686,7 @@ def write_tsv(
 
 
 def main(argv: Sequence[str]) -> None:
-    archive_dir, output_dir, expected = parse_arguments(argv)
+    archive_dir, output_dir, expected, archive_scope = parse_arguments(argv)
     if not archive_dir.is_dir() or archive_dir.is_symlink():
         raise ContractError(f"archive directory is not a regular directory: {archive_dir}")
     if output_dir.name in ("", ".", ".."):
@@ -687,11 +699,13 @@ def main(argv: Sequence[str]) -> None:
 
     archive_paths = sorted(archive_dir.iterdir(), key=lambda candidate: candidate.name)
     actual_names = {path.name for path in archive_paths}
-    if actual_names != CANONICAL_ARCHIVES or len(archive_paths) != len(CANONICAL_ARCHIVES):
-        missing = sorted(CANONICAL_ARCHIVES - actual_names)
-        unexpected = sorted(actual_names - CANONICAL_ARCHIVES)
+    expected_names = UI_ARCHIVES if archive_scope == "ui" else CANONICAL_ARCHIVES
+    if actual_names != expected_names or len(archive_paths) != len(expected_names):
+        missing = sorted(expected_names - actual_names)
+        unexpected = sorted(actual_names - expected_names)
         raise ContractError(
-            f"archive namespace mismatch: expected exact canonical 16; missing={missing}, unexpected={unexpected}"
+            f"archive namespace mismatch: expected exact canonical {len(expected_names)} "
+            f"({archive_scope}); missing={missing}, unexpected={unexpected}"
         )
     for path in archive_paths:
         mode = path.lstat().st_mode