feat: include Linux ARM64 in native Codex runner targets

Ship a source-bound ARM64 daemon alongside Linux x64 and both Mac targets.
Use native hosted builds and the existing clean npm/native startup verifier.
Read target requirements from the immutable source to preserve historical
three-target promotions. Keep Codex payloads as official npm dependencies.

Resolve ARM64 creation and login through the shared platform contract. Share
the existing legacy CLI permission calculation with import previews without
changing execution behavior. Record targeted checks and live Mac evidence.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

scripts/__tests__/grok-public-install-sandbox.test.mjs

@@ -169,7 +169,8 @@ test('the bundled-dependency installs run together while the other packages are
   const checks = position("for (const tarball of tarballs) assertNoBundledCodexPayloads(run('tar', ['-tzf', tarball])");
   const copied = position('for (const tarball of tarballs) {');
   assert.ok(bundledSources < start && start < registered && registered < otherSources && otherSources < join && join < packs && packs < reordered && reordered < checks && checks < copied);
-  assert.equal(source.match(/run\('npm', \['pack'/g).length, 1, 'only the lifecycle sentinel is packed in-process');
+  const packagingLane = source.slice(position("} else {\nassert.equal(process.platform, 'linux'"));
+  assert.equal(packagingLane.match(/run\('npm', \['pack'/g).length, 1, 'only the lifecycle sentinel is packed in-process in the packaging lane');
   assert.ok(source.includes("destination: join(root, `pack-${index}`)"), 'each pack writes into its own directory');
   // The timing line reports the split staging phase, each install, and the
   // pack step with what the packs would have cost one after another.
@@ -352,6 +353,7 @@ test('actual tar member checks allow Codex JavaScript but reject nested platform
   assert.doesNotThrow(() => assertNoBundledCodexPayloads(javascript));
   for (const payload of [
     'package/node_modules/@openai/codex-linux-x64/package.json',
+    'package/node_modules/@openai/codex-linux-arm64/package.json',
     'package/node_modules/bridge/node_modules/@openai/codex-darwin-arm64/package.json',
     'package/node_modules/@openai/codex-win32-x64/package.json',
     'package/node_modules/@openai/codex/vendor/x86_64-unknown-linux-musl/codex/codex',
@@ -364,26 +366,28 @@ test('actual tar member checks allow Codex JavaScript but reject nested platform
 });
 
 test('consumer provenance rejects bundled, foreign, inconsistent and non-official Codex payloads', () => {
-  const path = 'node_modules/@openai/codex-linux-x64';
-  const manifest = { name: '@openai/codex', version: '0.160.0-linux-x64', os: ['linux'], cpu: ['x64'] };
+  for (const target of ['linux-x64', 'linux-arm64']) {
+  const path = `node_modules/@openai/codex-${target}`;
+  const manifest = { name: '@openai/codex', version: `0.160.0-${target}`, os: ['linux'], cpu: [target.slice('linux-'.length)] };
   const entry = { version: manifest.version, resolved: `https://registry.npmjs.org/@openai/codex/-/codex-${manifest.version}.tgz`,
     integrity: `sha512-${Buffer.alloc(64, 1).toString('base64')}` };
-  const check = (value = entry, installed = [{ path, manifest }]) => assertInstalledCodexPlatformProvenance({ packages: { [path]: value } }, installed, 'linux-x64');
+  const check = (value = entry, installed = [{ path, manifest }]) => assertInstalledCodexPlatformProvenance({ packages: { [path]: value } }, installed, target);
   assert.equal(check().codexConsumerHostOnly, true);
-  const legacyManifest = { ...manifest, version: '0.156.1-linux-x64' };
+  const legacyManifest = { ...manifest, version: `0.156.1-${target}` };
   assert.equal(check({ ...entry, version: legacyManifest.version,
-    resolved: 'https://registry.npmjs.org/@openai/codex/-/codex-0.156.1-linux-x64.tgz' }, [{ path, manifest: legacyManifest }]).codexConsumerHostOnly, true);
-  assert.throws(() => check(entry, [{ path, manifest: { ...manifest, version: '^0.160.0-linux-x64' } }]), /exact host version/);
+    resolved: `https://registry.npmjs.org/@openai/codex/-/codex-0.156.1-${target}.tgz` }, [{ path, manifest: legacyManifest }]).codexConsumerHostOnly, true);
+  assert.throws(() => check(entry, [{ path, manifest: { ...manifest, version: `^0.160.0-${target}` } }]), /exact host version/);
   for (const change of [
-    { inBundle: true }, { link: true }, { version: '0.156.1-linux-x64' },
-    { resolved: 'https://example.com/@openai/codex/-/codex-0.160.0-linux-x64.tgz' },
-    { resolved: 'https://registry.npmjs.org/@openai/codex/-/codex-0.156.1-linux-x64.tgz' },
-    { resolved: 'https://user@registry.npmjs.org/@openai/codex/-/codex-0.160.0-linux-x64.tgz' },
+    { inBundle: true }, { link: true }, { version: `0.156.1-${target}` },
+    { resolved: `https://example.com/@openai/codex/-/codex-0.160.0-${target}.tgz` },
+    { resolved: `https://registry.npmjs.org/@openai/codex/-/codex-0.156.1-${target}.tgz` },
+    { resolved: `https://user@registry.npmjs.org/@openai/codex/-/codex-0.160.0-${target}.tgz` },
     { integrity: undefined }, { integrity: 'sha512-AA==' },
   ]) assert.throws(() => check({ ...entry, ...change }));
   assert.throws(() => check(entry, []), /must install its host/);
   assert.throws(() => check(entry, [{ path: 'node_modules/@openai/codex-darwin-arm64', manifest }]), /only the host/);
   assert.throws(() => check(entry, [{ path, manifest: { ...manifest, name: 'untrusted' } }]), /identity/);
+  }
 });
 
 
@@ -413,9 +417,31 @@ test('installed daemon proof uses the production host resolver and complete sour
   assert.match(source, /runnerBinaryTarget\(bytes\), target/);
   assert.match(source, /createHash\('sha256'\)/);
   assert.match(source, /metadata.binaryContractVersion, expected.contracts.runnerdArtifact/);
+  assert.match(source, /'linux-arm64'/);
   assert.doesNotMatch(source, /PAPERCLIP_RUNNERD_BINARY|runner\/target\/debug|execFileSync\('paperclip-runnerd'/);
 });
 
+test('native ARM clean consumers keep the existing container and installed-runtime boundaries', () => {
+  const args = grokConsumerDockerArgs({ ...paths, platform: 'linux/arm64', command: GROK_PUBLIC_INSTALL_LIFECYCLE });
+  assert.deepEqual(values(args, '--platform'), ['linux/arm64']);
+  assert.deepEqual(values(args, '--network'), ['none']);
+  assert.deepEqual(values(args, '--user'), ['1001:1001']);
+  assert.ok(args.includes('--read-only'));
+  assert.deepEqual(values(args, '--cap-drop'), ['ALL']);
+  assert.deepEqual(values(args, '--security-opt'), ['no-new-privileges']);
+  assert.ok(values(args, '--mount').some(value => value.endsWith('dst=/packages,readonly')));
+  assert.throws(() => grokConsumerDockerArgs({ ...paths, platform: 'linux/arm/v7', command: [] }), /supported native Linux platform/);
+  const source = readFileSync(new URL('../verify-grok-npm-install.mjs', import.meta.url), 'utf8');
+  const arm = source.split('async function verifyLinuxArmConsumer(')[1].split("if (process.argv[2] === '--linux-arm64-consumer')")[0];
+  assert.match(arm, /process.platform \+ '-' \+ process.arch, 'linux-arm64'/);
+  assert.match(arm, /const platform = 'linux\/arm64'/);
+  assert.match(arm, /isolated\(GROK_PUBLIC_INSTALL_LIFECYCLE\)/);
+  assert.match(arm, /installedCodexProbeSource\(installed \+ '\/index.js', '\/consumer', undefined, \{ nativeCodex: true \}\)/);
+  assert.match(arm, /tests\/runner-e2e\/installed-cli.ts/);
+  assert.match(arm, /temporarySizeMiB: 2048, temporaryExecutable: true/);
+  assert.doesNotMatch(arm, /stage-runner|runner\/target|PAPERCLIP_RUNNER_BINARY|prerequisite:/);
+});
+
 
 test('Mac startup wiring normalizes only validated manifest digests and uses server-scoped tooling', () => {
   const source = macInstalledStartupProbeSource('/owned/consumer', '/owned/consumer/server', 'sha256:' + 'a'.repeat(64), '/source/tests/runner-e2e/installed-cli.ts');

scripts/__tests__/release-verify-workflow.test.mjs

@@ -746,9 +746,14 @@ test("direct protocol concurrency override only lowers the configured ceiling",
 test("release daemon production uses exact-source native hosts and no publisher or provider permissions", () => {
   const workflow = readWorkflow("release-verify.yml");
   const producer = workflow.split("  runner_binaries:\n")[1];
-  for (const [target, host] of [["linux-x64", "ubuntu-latest"], ["darwin-arm64", "macos-15"], ["darwin-x64", "macos-15-intel"]]) {
-    assert.ok(producer.includes(`- target: ${target}\n            host: ${host}`));
+  const targets = workflow.split("  runner_binary_targets:\n")[1].split("  runner_binaries:\n")[0];
+  for (const [target, host] of [["linux-x64", "ubuntu-latest"], ["linux-arm64", "ubuntu-24.04-arm"], ["darwin-arm64", "macos-15"], ["darwin-x64", "macos-15-intel"]]) {
+    assert.ok(targets.includes(`'${target}': '${host}'`));
   }
+  assert.match(producer, /matrix: \$\{\{ fromJSON\(needs.runner_binary_targets.outputs.matrix\) \}\}/);
+  assert.match(targets, /Unknown exact-source daemon platform contract/);
+  assert.match(targets, /RELEASE_RUNNER_TARGETS/);
+  assert.doesNotMatch(targets, /secrets\.|id-token: write|contents: write|npm publish|environment:/);
   assert.match(producer, /persist-credentials: false/);
   assert.match(producer, /contents: read/);
   assert.doesNotMatch(producer, /secrets\.|id-token: write|contents: write|npm publish|environment:/);
@@ -773,7 +778,7 @@ test("release daemon production uses exact-source native hosts and no publisher
   assert.match(script, /elif \[ "\$dry_run" = false \]; then[\s\S]*?release_fail "Public releases require/);
 });
 
-test("premerge Mac qualification consumes the same Linux-packed npm bytes without publishing", () => {
+test("premerge native qualification consumes the same Linux-packed npm bytes without publishing", () => {
   const smoke = readWorkflow("release-smoke.yml");
   assert.match(smoke, /smoke_service:\n\s+if: inputs.qualification_source_sha == ''/);
   assert.match(smoke, /smoke:\n\s+if: inputs.qualification_source_sha == ''/);
@@ -784,11 +789,46 @@ test("premerge Mac qualification consumes the same Linux-packed npm bytes withou
   assert.match(qualification, /if: \$\{\{ !cancelled\(\) && steps.pack_identity.outputs.available == 'true' \}\}/);
   assert.match(qualification, /name: \$\{\{ inputs.artifact_name \}\}-public-packages/);
   assert.match(qualification, /--mac-consumer/);
-  assert.match(qualification, /host: macos-15\n/);
-  assert.match(qualification, /host: macos-15-intel\n/);
+  assert.match(qualification, /--linux-arm64-consumer/);
+  assert.match(qualification, /fromJSON\(needs.qualification_daemons.outputs.native_consumer_matrix\)/);
   assert.match(qualification, /pnpm install --ignore-scripts --no-frozen-lockfile/);
 });
 
+test("exact-source daemon matrices preserve historical three-target sources and add native ARM only for new sources", () => {
+  const workflow = readWorkflow("release-verify.yml");
+  const step = workflow.split('      - name: Preserve the immutable source\'s platform contract')[1].split('\n  runner_binaries:')[0];
+  const script = step.split('        run: |\n')[1].split('\n').map(line => line.startsWith('          ') ? line.slice(10) : line).join('\n');
+  const root = mkdtempSync(path.join(tmpdir(), 'release-target-contract-'));
+  try {
+    const tools = path.join(root, 'tools'); mkdirSync(tools);
+    writeFileSync(path.join(tools, 'git'), '#!/bin/sh\nprintf "%s\\n" "$FIXTURE_HEAD"\n', { mode: 0o755 });
+    const source = path.join(root, 'packages/paperclip-runner/scripts/stage-release-runner-binaries.mjs');
+    mkdirSync(path.dirname(source), { recursive: true });
+    const output = path.join(root, 'outputs');
+    const historical = ['darwin-arm64', 'darwin-x64', 'linux-x64'];
+    for (const targets of [historical, [...historical, 'linux-arm64']]) {
+      writeFileSync(source, `export const RELEASE_RUNNER_TARGETS = ${JSON.stringify(targets)};`);
+      writeFileSync(output, '');
+      const result = spawnSync('bash', ['-euo', 'pipefail', '-c', script], { cwd: root, encoding: 'utf8', env: {
+        PATH: `${tools}:${path.dirname(process.execPath)}:/usr/bin:/bin`, SOURCE_SHA: 'a'.repeat(40), FIXTURE_HEAD: 'a'.repeat(40), GITHUB_OUTPUT: output,
+      } });
+      assert.equal(result.status, 0, result.stderr);
+      const data = Object.fromEntries(readFileSync(output, 'utf8').trim().split('\n').map(line => {
+        const index = line.indexOf('='); return [line.slice(0, index), JSON.parse(line.slice(index + 1))];
+      }));
+      assert.deepEqual(data.matrix.include.map(row => row.target), targets);
+      assert.deepEqual(data.native_consumers.include.map(row => row.target), targets.filter(target => target !== 'linux-x64'));
+      assert.ok(data.matrix.include.every(row => row.target !== 'linux-arm64' || row.host === 'ubuntu-24.04-arm'));
+    }
+    writeFileSync(source, 'export const RELEASE_RUNNER_TARGETS = ["linux-arm64"];'); writeFileSync(output, '');
+    const result = spawnSync('bash', ['-euo', 'pipefail', '-c', script], { cwd: root, encoding: 'utf8', env: {
+      PATH: `${tools}:${path.dirname(process.execPath)}:/usr/bin:/bin`, SOURCE_SHA: 'a'.repeat(40), FIXTURE_HEAD: 'a'.repeat(40), GITHUB_OUTPUT: output,
+    } });
+    assert.equal(result.status, 1); assert.match(result.stderr, /Unknown exact-source daemon platform contract/);
+    assert.equal(readFileSync(output, 'utf8'), '');
+  } finally { rmSync(root, { recursive: true, force: true }); }
+});
+
 
 test("historical promotion sources keep their packaging path while new sources require daemon assembly", () => {
   const workflow = readWorkflow("release.yml");

scripts/grok-public-install-sandbox.mjs

@@ -198,7 +198,7 @@ export function installedDaemonProbeSource(outputRoot, consumerRoot, sourceRevis
     const { parsePaperclipRunnerdBuildMetadata } = await import(pathToFileURL(join(output, 'evals/runnerd-artifact.js')).href);
     const { PAPERCLIP_RUNNER_BUILD_METADATA: expected } = await import(pathToFileURL(join(output, 'evals/build-metadata.js')).href);
     const manifest = JSON.parse(readFileSync(join(output, 'bin/release-manifest.json'), 'utf8'));
-    const targets = ['darwin-arm64', 'darwin-x64', 'linux-x64'];
+    const targets = ['darwin-arm64', 'darwin-x64', 'linux-x64', 'linux-arm64'];
     assert.equal(manifest.schema, 'paperclip.runner.release-binaries.v1');
     assert.equal(manifest.sourceRevision, ${JSON.stringify(sourceRevision)});
     assert.deepEqual(Object.keys(manifest.platforms).sort(), targets.sort());
@@ -240,7 +240,8 @@ export function macInstalledStartupProbeSource(consumerRoot, serverRoot, runnerD
       serverRoot:${JSON.stringify(serverRoot)},expectedRunnerSha256:${JSON.stringify(runnerDigest.slice(7))}})));`;
 }
 
-export function grokConsumerDockerArgs({ assets, consumer, cache, command, uid, gid, download = false, prerequisite, temporarySizeMiB = 256, temporaryExecutable = false }) {
+export function grokConsumerDockerArgs({ assets, consumer, cache, command, uid, gid, download = false, prerequisite, temporarySizeMiB = 256, temporaryExecutable = false, platform = 'linux/amd64' }) {
+  if (!['linux/amd64', 'linux/arm64'].includes(platform)) throw new Error('Public-install verification requires a supported native Linux platform');
   if (!Number.isSafeInteger(uid) || uid <= 0 || !Number.isSafeInteger(gid) || gid <= 0) {
     throw new Error('Public-install verification requires an unprivileged host user');
   }
@@ -251,7 +252,7 @@ export function grokConsumerDockerArgs({ assets, consumer, cache, command, uid,
     throw new Error('Executable runtime snapshots require an offline verification sandbox');
   }
   return [
-    'run', '--rm', '--platform', 'linux/amd64',
+    'run', '--rm', '--platform', platform,
     '--user', `${uid}:${gid}`, '--read-only',
     '--cap-drop', 'ALL', '--security-opt', 'no-new-privileges',
     '--pids-limit', '256', '--memory', '3g',

scripts/release.sh

@@ -292,7 +292,7 @@ if [ -n "${PAPERCLIP_RELEASE_RUNNER_ARTIFACTS_DIR:-}" ]; then
     assemble-daemons "$PAPERCLIP_RELEASE_RUNNER_ARTIFACTS_DIR" "$(git rev-parse HEAD)"
   cp -R "$REPO_ROOT/packages/paperclip-runner/dist/bin/." "$REPO_ROOT/server/dist/vendor/paperclip-runner/bin/"
 elif [ "$dry_run" = false ]; then
-  release_fail "Public releases require the three hosted runner daemon artifacts; use the supported Release workflow."
+  release_fail "Public releases require the four hosted runner daemon artifacts; use the supported Release workflow."
 fi
 node "$REPO_ROOT/scripts/build-standalone-public-packages.mjs"
 bash "$REPO_ROOT/scripts/prepare-server-ui-dist.sh"

scripts/verify-grok-npm-install.mjs

@@ -8,6 +8,7 @@ import { chmodSync, cpSync, existsSync, mkdirSync, mkdtempSync, readFileSync, re
 import { createHash } from 'node:crypto';
 import { createServer } from 'node:net';
 import { tmpdir } from 'node:os';
+import { stripTypeScriptTypes } from 'node:module';
 import { basename, dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { packConcurrency, packStagedPackages, packTimings } from './pack-staged-packages.mjs';
@@ -95,7 +96,75 @@ async function verifyMacConsumer(packageDirectory, sourceRevision, receiptPath)
     console.log(JSON.stringify(receipt));
   } finally { rmSync(root, { recursive: true, force: true }); }
 }
-if (process.argv[2] === '--mac-consumer') {
+async function verifyLinuxArmConsumer(packageDirectory, sourceRevision, receiptPath) {
+  assert.equal(process.env.GITHUB_ACTIONS, 'true', 'Native clean consumers run only on disposable hosted CI');
+  assert.equal(process.platform + '-' + process.arch, 'linux-arm64', 'ARM qualification requires a native ARM host');
+  assert.match(sourceRevision, /^[a-f0-9]{40}$/);
+  const packages = realpathSync(packageDirectory);
+  const manifest = JSON.parse(readFileSync(join(packages, 'manifest.json'), 'utf8'));
+  assert.equal(manifest.schema, 'paperclip.runner.public-packages/v1');
+  assert.equal(manifest.sourceRevision, sourceRevision);
+  assert.ok(manifest.archives.some(entry => entry.name === '@paperclipai/server'));
+  assert.ok(manifest.archives.some(entry => entry.name === 'paperclipai'));
+  assert.equal(new Set(manifest.archives.map(entry => entry.name)).size, manifest.archives.length);
+  const root = realpathSync(mkdtempSync(join(tmpdir(), 'paperclip-arm-public-install-')));
+  try {
+    const assets = join(root, 'assets'), consumer = join(root, 'consumer'), cache = join(root, 'cache');
+    for (const directory of [assets, consumer, cache]) mkdirSync(directory);
+    const run = (command, args, cwd = root) => execFileSync(command, args, { cwd,
+      env: { PATH: process.env.PATH, HOME: root, TMPDIR: root }, timeout: 10 * 60_000,
+      maxBuffer: 32 * 1024 * 1024, encoding: 'utf8' });
+    const platform = 'linux/arm64';
+    run('docker', ['pull', '--platform', platform, GROK_PUBLIC_INSTALL_IMAGE]);
+    const isolated = (command, options = {}) => run('docker', grokConsumerDockerArgs({ assets, consumer, cache,
+      uid: process.getuid(), gid: process.getgid(), platform, command, ...options }));
+    for (const entry of manifest.archives) {
+      assert.match(entry.file, /^[A-Za-z0-9._-]+\.tgz$/); assert.match(entry.sha256, /^[a-f0-9]{64}$/);
+      const tarball = join(packages, entry.file);
+      assert.equal(realpathSync(tarball), tarball);
+      assert.equal(createHash('sha256').update(readFileSync(tarball)).digest('hex'), entry.sha256);
+      assertNoBundledCodexPayloads(run('tar', ['-tzf', tarball]).trim().split('\n'));
+      cpSync(tarball, join(assets, entry.file)); chmodSync(join(assets, entry.file), 0o644);
+    }
+    writeFileSync(join(consumer, 'package.json'), JSON.stringify({ private: true, type: 'module' }));
+    const sentinelSource = join(root, 'lifecycle-sentinel'); mkdirSync(sentinelSource);
+    writeFileSync(join(sentinelSource, 'package.json'), JSON.stringify({ name: 'paperclip-verification-lifecycle-sentinel', version: '1.0.0',
+      scripts: { postinstall: 'node -e "require(\'node:fs\').writeFileSync(\'lifecycle-ran\', \'ok\')"' } }));
+    run('npm', ['pack', '--ignore-scripts', '--pack-destination', assets], sentinelSource);
+    isolated(['npm', 'install', '--ignore-scripts', '--omit=dev', ...readdirSync(assets).filter(file => file.endsWith('.tgz')).map(file => `/packages/${file}`)], { download: true });
+    const sentinel = join(consumer, 'node_modules/paperclip-verification-lifecycle-sentinel/lifecycle-ran');
+    assert.equal(existsSync(sentinel), false);
+    const lock = readFileSync(join(consumer, 'package-lock.json'), 'utf8');
+    isolated(GROK_PUBLIC_INSTALL_LIFECYCLE);
+    assert.equal(readFileSync(sentinel, 'utf8'), 'ok');
+    assert.equal(readFileSync(join(consumer, 'package-lock.json'), 'utf8'), lock);
+    for (const entry of manifest.archives) {
+      assert.equal(JSON.parse(readFileSync(join(consumer, 'node_modules', entry.name, 'package.json'))).version, manifest.releaseVersion);
+    }
+    const server = '/consumer/node_modules/@paperclipai/server', installed = server + '/dist/vendor/paperclip-runner';
+    const probe = (name, source, options = {}) => { writeFileSync(join(assets, name), source); return JSON.parse(isolated(['node', '/packages/' + name], options).trim()); };
+    const daemon = probe('daemon-probe.mjs', installedDaemonProbeSource(installed, '/consumer', sourceRevision));
+    assert.equal(daemon.target, 'linux-arm64');
+    const codex = probe('codex-probe.mjs', installedCodexProbeSource(installed + '/index.js', '/consumer', undefined, { nativeCodex: true }));
+    // Reuse the existing zero-turn hook as read-only verifier source. All
+    // production imports still resolve from the installed consumer graph.
+    cpSync(join(repo, 'tests/runner-e2e/installed-cli.ts'), join(assets, 'installed-cli.ts'));
+    writeFileSync(join(assets, 'types.js'), stripTypeScriptTypes(readFileSync(join(repo, 'tests/runner-e2e/types.ts'), 'utf8')));
+    const startup = probe('startup-probe.mjs', macInstalledStartupProbeSource('/consumer', server, daemon.sha256, '/packages/installed-cli.ts'),
+      { temporarySizeMiB: 2048, temporaryExecutable: true });
+    const receipt = { schema: 'paperclip.runner.linux-arm64-public-install.v1', sourceRevision, platform: process.platform, architecture: process.arch,
+      cleanNpmInstall: true, packageCount: manifest.archives.length, codexPackedPayloadsOmitted: true,
+      consumerImage: GROK_PUBLIC_INSTALL_IMAGE, consumerImagePlatform: platform,
+      consumerLockPreserved: true, lifecycleSentinelVerified: true, lifecycleNetwork: 'none',
+      ...daemon, ...codex, startup, providerCalls: 0 };
+    writeFileSync(receiptPath, JSON.stringify(receipt, null, 2) + '\n');
+    console.log(JSON.stringify(receipt));
+  } finally { rmSync(root, { recursive: true, force: true }); }
+}
+if (process.argv[2] === '--linux-arm64-consumer') {
+  assert.equal(process.argv.length, 6, 'Usage: --linux-arm64-consumer PACKAGE_DIRECTORY SOURCE_SHA RECEIPT_PATH');
+  await verifyLinuxArmConsumer(process.argv[3], process.argv[4], process.argv[5]);
+} else if (process.argv[2] === '--mac-consumer') {
   assert.equal(process.argv.length, 6, 'Usage: --mac-consumer PACKAGE_DIRECTORY SOURCE_SHA RECEIPT_PATH');
   await verifyMacConsumer(process.argv[3], process.argv[4], process.argv[5]);
 } else {