[JarryShaw]

Please follow the guide below

• You will be asked some questions, please read them carefully and answer honestly

• Put an x into all the boxes [ ] relevant to your pull request (like that [x])

• Use Preview tab to see how your pull request will actually look like

• Searched for similar pull requests

• Followed the coding style (make pylint, make mypy, make isort)

• make test passes, and a test case covers the change. Narrow runs only, listed below.

• Added a changelog entry under docs/source/changelog/ and regenerated CHANGELOG.md, if the change is user-visible: N/A — centralised in docs(changelog): shared 1.5.0 changelog — long-lived, merges last (#610, #616, #617, #618, #620) #657

What is the purpose of your pull request?

Tick the commit type your subject line carries.

• fix — corrects a defect
• feat — adds a feature
• perf — changes performance, not behaviour
• refactor — changes neither behaviour nor performance
• test — tests only
• docs — documentation only
• ci — workflows or build tooling
• release — bumps the version or rolls up a distribution
• chore — anything else

---

Description

Closes #1822. The osx-64 conda package used to be built on arm64 macos-latest and relabelled with conda convert, so it shipped arm64 binaries (lxml, and since #1821 also cffi and cryptography).

• Native legs, in both conda workflows:
  • macos-26-intel builds osx-64. Per GitHub's runner docs, macos-15-intel and macos-26-intel are the only Intel images, and macos-13 is gone.
  • macos-latest publishes osx-arm64. Anaconda already carries it for recent betas, because the old upload pushed the unconverted package too.
  • ubuntu-latest stays linux-64.
  • No conda convert remains. A leg whose build produced another platform fails before upload.
• Release completeness: the check still counts {'linux-64', 'osx-64'}, as before.
• Smoke check: --smoke now checks info/index.json against the runner, and checks every ELF/Mach-O binary's architecture. Universal binaries pass if they carry the right slice. Run against real wheels, the arm64 wheels relabelled osx-64 fail on every binary, and correctly labelled sets pass.
• Tests: tests/project/test_conda_native_platforms_1822.py pins the mapping in both workflows, runs the build step with a fake conda, and tests the header reader. It fails on main. The full tests/project run gives 973 passed, 1 skipped.

Decision needed (#1822): cryptography has shipped no Intel macOS wheel since 49.0.0 (verified: 48.0.1 is universal2; 49.0.0 and 50.0.2 have none). The osx-64 leg would therefore build it from source, probably linking the runner's Homebrew OpenSSL.

Not verified: no Actions run was possible here, so the Intel leg, the source build and an actual Intel Mac import are all untested.

[JarryShaw]

Verdict: NEEDS CHANGES at 12dcebf08. A Sonnet cross-review (author: Opus) checked:

• the runner labels, against GitHub's runner docs and the runner-images README;
• the mapping and the mismatch guard in both workflows;
• the architecture check, run on real wheels: arm64, x86_64, universal2 and manylinux;
• that the new tests fail on main and catch six mutations.

Two statements in docs/source/contributing/releasing.rst are now false and need fixing:

• :426: the release diagram says 2 OS, but the conda matrix now has a third leg. It is also a count in prose.
• :339-340: Anaconda's count is described as one file per OS and Python version, but osx-arm64 is deliberately not counted.

Fix round under way. The cryptography choice on #1822 is still open.

[JarryShaw]

Verdict: GOOD TO GO at 7b5299e83. A Sonnet re-check (author: Opus) confirmed that both releasing.rst statements now match create-release.yml's completeness check and contain no counts. The util/conda_vendor.py mypy error is gone, back to main's baseline. Nothing else in releasing.rst or workflows.rst is now false, and tests/project gives 973 passed, 1 skipped.

This verdict covers the PR as it stands, which takes option A from #1822: cryptography is built from source on the Intel leg. If you pick B or C there, I'll follow up with a revision.

[github-actions]

Coverage: 90.05% (unit tier, Python 3.15, 7b5299e83, Unit Tests run success)

Package	Statements	Missed	Branches	Partial	Cover
pcapkit (top level)	104	2	20	2	96.77%
pcapkit/const	19593	881	2616	867	92.11%
pcapkit/corekit	2462	69	780	35	96.55%
pcapkit/dumpkit	276	3	100	3	98.40%
pcapkit/foundation	2915	164	1016	34	93.59%
pcapkit/interface	138	7	52	5	93.68%
pcapkit/protocols	17408	224	4580	189	98.10%
pcapkit/toolkit	872	177	298	8	77.18%
pcapkit/utilities	512	2	158	4	99.10%
pcapkit/vendor	4407	2342	1010	157	43.27%

Per-file detail: the coverage-html artifact of this run.

[JarryShaw]

Please hold this one: your ruling on #1822 (option B, a platform pin for cryptography on Intel macOS) needs a revision first. The revision is under way.

[JarryShaw]

This merged before the option-B revision landed. That work continues in #1827, as a follow-up on top of main.