From 88fb9a7e25e8913a9db0fc5244452b3fdd7bf26f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jose=20Villase=C3=B1or=20Montfort?=
 <195970+montfort@users.noreply.github.com>
Date: Sun, 19 Jul 2026 03:03:12 -0600
Subject: [PATCH] fix(release): SC-009 gate uses dumpbin on Windows (strings
 was blind)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The release dry-run failed only on native (win-x64): the SC-009 gate
("test hooks NOT exported") lists symbols with `strings` for .dll files,
but `strings` cannot reliably read a PE export table — it missed even the
`abi_version` positive control, so the gate correctly refused a verdict
("blind, not clean") and failed. The other three RIDs (nm) pass; the code
and the binaries are fine — only the Windows inspection method was wrong.

Switch the .dll path to `dumpbin -exports` (the canonical tool for a PE
export table), made available via ilammy/msvc-dev-cmd on the Windows runner.
The positive-control + both-hooks logic is unchanged.

Latent gate (not introduced recently); surfaced by the pre-publish dry-run.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .github/workflows/release.yml | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 24823a6..606e94f 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -88,6 +88,11 @@ jobs:
           # Quedarnos solo con el cdylib (descartar .d/.rlib/.pdb/.lib/.exp).
           find out -type f ! -name '*.so' ! -name '*.dll' ! -name '*.dylib' -delete
           ls -la out
+      # On Windows, `strings` cannot reliably read a PE export table (it missed even the positive
+      # control), so the SC-009 gate uses `dumpbin -exports`; this puts it on PATH for the bash step.
+      - name: Setup MSVC tools (dumpbin) for SC-009
+        if: runner.os == 'Windows'
+        uses: ilammy/msvc-dev-cmd@v1
       # SC-009: los test-hooks NUNCA viajan en release. Dos correcciones de CHARTER-12:
       #  (a) el patrón era `weft_test_panic`, que NO casa con `weft_loro_test_panic` (no es
       #      substring) → el shim de Loro quedaba fuera del gate. Ahora se buscan ambos.
@@ -102,15 +107,15 @@ jobs:
         run: |
           set -euo pipefail
 
-          symbols() {   # $1 = archivo → lista de símbolos, o falla si no hay herramienta
+          symbols() {   # $1 = archivo → lista de símbolos exportados, o falla si no hay herramienta
             case "$1" in
               *.so|*.dylib) nm -D "$1" 2>/dev/null || nm "$1" ;;
-              *.dll)        strings "$1" ;;
+              *.dll)        dumpbin -exports "$1" ;;   # reads the PE export table (strings is unreliable)
             esac
           }
 
           case "$RUNNER_OS" in
-            Windows) command -v strings >/dev/null || { echo "::error::falta 'strings': el gate SC-009 no puede verificar nada"; exit 1; } ;;
+            Windows) command -v dumpbin >/dev/null || { echo "::error::falta 'dumpbin': el gate SC-009 no puede verificar nada"; exit 1; } ;;
             *)       command -v nm      >/dev/null || { echo "::error::falta 'nm': el gate SC-009 no puede verificar nada"; exit 1; } ;;
           esac