open-standards/wai/changes/2026-11-09-release-c-swift-kotlin-images.md

The release carries libwai for C, the Swift and Android packages, and the relay's and room service's images

• C (quickstart/build-libwai.sh): each Linux job of the release attaches libwai-<version>-<triple>.tar.gz, for x86_64- and aarch64-unknown-linux-gnu. It holds lib/libwai.a, built from wai-rs with the feature native_sink (the envelope and the native sink, the C interface the Swift and Android packages carry; no codec library), for the glibc target and without crt-static; the committed include/wai.h; and lib/pkgconfig/wai.pc, whose prefix is its own directory and whose Libs name the system libraries the static library needs. The library is static so that a program carries it: nothing of libwai is looked for when the program runs, and its C runtime is the one it is linked against. Before it is attached, the header the build regenerated must be the committed one, the library must define exactly the envelope's and the native sink's functions (quickstart/libwai_interface.py), and quickstart/test/c-library.sh compiles quickstart/test/c/hello.c against the archive with the flags pkg-config --cflags --libs wai gives, links it and runs it.
• Swift (wai-sink-swift): Package.swift names the binary target WaiFFI by URL and checksum where a release has written them, and build/WaiFFI.xcframework while it is built there. The release's swift job builds every slice and attaches WaiFFI-<version>.xcframework.zip and wai-sink-swift-<version>.zip, the package whose Package.swift names the zip by its download URL and SwiftPM checksum (scripts/package-release.sh). scripts/check-release-package.sh resolves, builds and runs an application that depends on the package, before the attach with the framework served through a mirror of the URL and after from the URL itself, and requires the package with a wrong checksum to be refused; wai-sink-swift.yml runs the first on every change.
• Kotlin (wai-sink-android): the library is published with maven-publish as science.transaction.wai:wai-sink:<version>, the version of wai-rs, and its manifest is of the package science.transaction.wai.sink (it was wai.sink; the Kotlin classes keep the package wai.sink, which the JNI layer's symbols name). The release's android job holds the publication to scripts/check-publication.sh (its coordinates, its manifest's package, both libraries of each ABI, its classes), attaches wai-sink-<version>.aar, and publishes it to the forge's Maven registry; wai-sink-android.yml writes and checks the publication on every change.
• Images (joule-code: joule-moq-relay/deploy/, joule-moq-room/deploy/): Containerfiles for the relay and the room service, each with a check-image.sh that runs the image with a read-only root and no capabilities and requires its user, its --version and its service: the relay's WebSocket opening answered with its first capsule, and the room service's /health with its clock's session to the relay's image up. The release's images job builds both, checks them and pushes them to the forge's container registry (quickstart/release-images.sh, quickstart/oci-push.py); an image that fails its check is not pushed.
• The forge's job token reads the organisation's packages and cannot write them, so the Maven publication and the images run only once the owner's setup exists: the repository secret WAI_PACKAGES_TOKEN, a forge token with the scope write:package, and for the images a runner labelled oci and the repository variable WAI_OCI_RUNNER set to true. Until then the release says which is missing in a notice and succeeds: the AAR is attached unpublished, and the images job is skipped, not queued. Everything uploads to the forge over the private network.