nicosuave · Nov 5, 2026 · Nov 5, 2026 · Nov 5, 2026 · Nov 5, 2026
diff --git a/.github/workflows/community.yml b/.github/workflows/community.yml
@@ -0,0 +1,42 @@
+name: Community extension
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: community-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  distribution:
+    name: DuckDB 2.0
+    uses: duckdb/extension-ci-tools/.github/workflows/_extension_distribution.yml@8f59772b4ef9a13837b3e353db032b3aca300d04
+    with:
+      extension_name: sqlnb
+      duckdb_version: v2.0.0
+      duckdb_commit: d54cbbe3df17e8e5ce68312f483b4155836112aa
+      ci_tools_version: 8f59772b4ef9a13837b3e353db032b3aca300d04
+      extra_toolchains: rust
+      # The server requires native sockets/filesystems. MinGW is not supported
+      # by the Windows filesystem implementation; MSVC is tested instead.
+      exclude_archs: wasm_mvp;wasm_eh;wasm_threads;windows_amd64_mingw;windows_amd64_rtools
+      opt_in_archs: osx_amd64
+      reduced_ci_mode: disabled
+      save_cache: false
+
+  rust:
+    name: Rust contracts
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@1.99.0
+      - name: Install build cache
+        run: bash scripts/configure-ci.sh
+      - name: Test HTTP, MCP, history, and filesystem contracts
+        run: .ci/tools/bin/mbx test --manifest-path http/Cargo.toml --locked -- --test-threads=1
diff --git a/.gitignore b/.gitignore
@@ -1,6 +1,17 @@
 .artifacts/
 .deps/
 .agents/
+.ci/
+.cache/
+configure/
+vcpkg/
+local_vcpkg_installation/
+duckdb_downloads/
+duckdb_extensions/
+duckdb_binaries/
+testext/
+duckdb_test_dir/
+duckdb_unittest_tempdir/
 build/
 node_modules/
 test-results/

diff --git a/.gitmodules b/.gitmodules
@@ -0,0 +1,6 @@
+[submodule "extension-ci-tools"]
+	path = extension-ci-tools
+	url = https://github.com/duckdb/extension-ci-tools.git
+[submodule "duckdb"]
+	path = duckdb
+	url = https://github.com/duckdb/duckdb.git
diff --git a/CMakeLists.txt b/CMakeLists.txt
@@ -21,19 +21,26 @@ set(SIDEQUERY_HTTP_LOCK ${CMAKE_CURRENT_SOURCE_DIR}/http/Cargo.lock)
 file(GLOB_RECURSE SIDEQUERY_HTTP_SOURCES CONFIGURE_DEPENDS
      ${CMAKE_CURRENT_SOURCE_DIR}/http/src/*.rs)
 set(SIDEQUERY_HTTP_TARGET_DIR ${CMAKE_CURRENT_BINARY_DIR}/http-cargo)
+set(SIDEQUERY_HTTP_PROFILE_DIR ${SIDEQUERY_HTTP_TARGET_DIR}/release)
+set(SIDEQUERY_CARGO_TARGET_ARGS)
+if(Rust_CARGO_TARGET)
+  # Community CI cross-compiles Intel macOS on Apple Silicon runners.
+  list(APPEND SIDEQUERY_CARGO_TARGET_ARGS --target ${Rust_CARGO_TARGET})
+  set(SIDEQUERY_HTTP_PROFILE_DIR ${SIDEQUERY_HTTP_TARGET_DIR}/${Rust_CARGO_TARGET}/release)
+endif()
 if(MSVC)
-  set(SIDEQUERY_HTTP_LIBRARY ${SIDEQUERY_HTTP_TARGET_DIR}/release/sidequery_http.lib)
+  set(SIDEQUERY_HTTP_LIBRARY ${SIDEQUERY_HTTP_PROFILE_DIR}/sidequery_http.lib)
   # DuckDB uses the static MSVC runtime; Rust and its C dependencies must agree.
   set(SIDEQUERY_RUST_ENV "RUSTFLAGS=$ENV{RUSTFLAGS} -C target-feature=+crt-static")
 else()
-  set(SIDEQUERY_HTTP_LIBRARY ${SIDEQUERY_HTTP_TARGET_DIR}/release/libsidequery_http.a)
+  set(SIDEQUERY_HTTP_LIBRARY ${SIDEQUERY_HTTP_PROFILE_DIR}/libsidequery_http.a)
 endif()
 
 set(SIDEQUERY_REPO_MBX ${CMAKE_CURRENT_SOURCE_DIR}/scripts/mbx)
 if(EXISTS ${SIDEQUERY_REPO_MBX})
   set(SIDEQUERY_CARGO_BUILD ${SIDEQUERY_REPO_MBX} build)
 else()
-  find_program(SIDEQUERY_MBX_EXECUTABLE mbx)
+  find_program(SIDEQUERY_MBX_EXECUTABLE mbx HINTS ${CMAKE_CURRENT_SOURCE_DIR}/.ci/tools/bin)
   if(SIDEQUERY_MBX_EXECUTABLE AND "$ENV{RUSTC_WRAPPER}" STREQUAL ""
      AND "$ENV{RUSTC_WORKSPACE_WRAPPER}" STREQUAL "")
     set(SIDEQUERY_CARGO_BUILD ${SIDEQUERY_MBX_EXECUTABLE} build)
@@ -50,7 +57,7 @@ endif()
 add_custom_command(
   OUTPUT ${SIDEQUERY_HTTP_LIBRARY}
   COMMAND ${CMAKE_COMMAND} -E env CARGO_TARGET_DIR=${SIDEQUERY_HTTP_TARGET_DIR} ${SIDEQUERY_RUST_ENV}
-          ${SIDEQUERY_CARGO_BUILD} --manifest-path ${SIDEQUERY_HTTP_MANIFEST} --locked --release
+          ${SIDEQUERY_CARGO_BUILD} --manifest-path ${SIDEQUERY_HTTP_MANIFEST} --locked --release ${SIDEQUERY_CARGO_TARGET_ARGS}
   DEPENDS ${SIDEQUERY_HTTP_MANIFEST} ${SIDEQUERY_HTTP_LOCK} ${SIDEQUERY_HTTP_SOURCES}
   WORKING_DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR}/http
   COMMENT "Building Sidequery's in-process Axum HTTP server"

diff --git a/LICENSE b/LICENSE
@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 SQLNB contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
diff --git a/Makefile b/Makefile
@@ -0,0 +1,12 @@
+PROJ_DIR := $(dir $(abspath $(lastword $(MAKEFILE_LIST))))
+
+EXT_NAME := sqlnb
+EXT_CONFIG := $(PROJ_DIR)extension_config.cmake
+
+include extension-ci-tools/makefiles/duckdb_extension.Makefile
+include extension-ci-tools/makefiles/vcpkg.Makefile
+
+.PHONY: sqlnb_ci_setup
+configure_ci: sqlnb_ci_setup
+sqlnb_ci_setup:
+	bash scripts/configure-ci.sh
diff --git a/README.md b/README.md
@@ -27,9 +27,10 @@ load sqlnb from sidequery;
 select sqlnb_start();
 ```
 
-Keep DuckDB running while you use the browser. SQLNB loads its Quack, `httpfs`,
-and `icu` dependencies automatically. The first launch needs an internet
-connection to download the UI; subsequent launches can use a verified cached copy.
+Keep DuckDB running while you use the browser. SQLNB loads the official Quack,
+`httpfs`, and `icu` dependencies from DuckDB core automatically. The first launch
+needs an internet connection to download the UI; subsequent launches can use a
+verified cached copy.
 
 Use `select sqlnb_status();` to see the local URL and `select sqlnb_stop();` to
 stop the server. Restart the server to pick up UI updates.
@@ -56,3 +57,8 @@ To connect an MCP client, start with `mcp := true` and follow the
 - [MCP reference](docs/mcp.md) — authentication, tools, and execution behavior.
 - [UI assets](docs/ui-assets.md) — custom frontends, updates, and the deployment contract.
 - [Release procedures](docs/releases.md) — maintainer builds, signing, and publication.
+
+## License
+
+The native extension is [MIT licensed](LICENSE). The separately hosted Sidequery
+UI is not included in this repository or covered by its license.
diff --git a/docs/development.md b/docs/development.md
@@ -8,6 +8,29 @@ checkout or frontend build is required.
 
 Run the commands below from the repository root.
 
+## Community build
+
+The DuckDB and extension-ci-tools submodules pin DuckDB 2.0.0 and its community
+build tooling. Initialize them before using the standard extension targets:
+
+```sh
+git submodule update --init --recursive
+make setup-vcpkg
+VCPKG_TOOLCHAIN_PATH="$PWD/vcpkg/scripts/buildsystems/vcpkg.cmake" GEN=ninja make release
+make test
+```
+
+The SQL tests start the server with a small local UI fixture, exercise MCP owner
+isolation and shutdown, and verify invalid startup options and disabled external
+access. They install runtime dependencies from DuckDB's core repository; they
+do not need a Sidequery repository registration or the hosted UI.
+
+The [community workflow](../.github/workflows/community.yml) uses DuckDB's reusable
+distribution workflow for Linux x86-64/ARM64, macOS Intel/Apple Silicon, and Windows
+MSVC. Wasm cannot provide the native server's sockets and filesystem; Windows
+MinGW is not supported. The CI setup hook installs Boxington into the disposable
+workspace when another compiler wrapper is not already configured.
+
 ## Rust tests
 
 ```sh

diff --git a/docs/releases.md b/docs/releases.md
@@ -8,6 +8,29 @@ Building this repository does not require that access.
 
 Run the commands below from the repository root.
 
+## Community repository
+
+The community build uses the standard `Makefile`, `extension_config.cmake`,
+and `test/sql` suite. Its CI pins DuckDB 2.0.0 and the matching community tooling;
+it builds and tests artifacts without publishing them.
+
+Submit `extensions/sqlnb/description.yml` to
+[duckdb/community-extensions](https://github.com/duckdb/community-extensions),
+pinning `repo.ref` to a validated commit of this repository. The community
+repository builds, signs, and distributes accepted submissions. A passing build
+here does not mean the extension has been accepted or published there.
+
+After acceptance and publication, users can install with:
+
+```sql
+install sqlnb from community;
+load sqlnb;
+select sqlnb_start();
+```
+
+Quack, `httpfs`, and `icu` load from DuckDB core, including when SQLNB itself was
+installed from the Sidequery repository.
+
 ## DuckDB 2.0
 
 For official DuckDB `v2.0.0` (source `d54cbbe3df`), use the matching official CLI:
@@ -27,10 +50,10 @@ distributable standard library so Homebrew's host deployment target cannot leak
 into the extension.
 The OpenSSL build also requires Curl, Perl, and Make.
 
-Sign both artifacts using the monorepo's `tools/extension-repository` operator
+Sign the SQLNB artifact using the monorepo's `tools/extension-repository` operator
 tool. Run its signed native smoke and browser qualification before publishing
-`quack`, then `sqlnb`, to `https://extensions.sidequery.dev`. Core `httpfs` and
-`icu` remain official DuckDB dependencies and are not republished by Sidequery.
+`sqlnb` to `https://extensions.sidequery.dev`. Quack is built for local qualification;
+installed SQLNB uses the official core Quack, `httpfs`, and `icu` dependencies.
 After publication, verify a fresh signed installation:
 
 ```sh
@@ -79,5 +102,5 @@ bun scripts/runtime-smoke.mjs --duckdb /absolute/path/to/alpha41489/duckdb \
 
 A local repository directory is also accepted. Each client uses fresh extension
 and trust directories, allows only signed extensions, and proves that starting
-`sqlnb` bootstraps Quack from Sidequery. The suite checks queries, notebook files, caller
+`sqlnb` bootstraps Quack from core. The suite checks queries, notebook files, caller
 isolation, authentication, server cleanup, and remote UI generation updates.
diff --git a/duckdb b/duckdb
diff --git a/extension-ci-tools b/extension-ci-tools
diff --git a/extension_config.cmake b/extension_config.cmake
@@ -1,15 +1,5 @@
-duckdb_extension_load(json)
-duckdb_extension_load(autocomplete)
-duckdb_extension_load(icu)
-
-duckdb_extension_load(httpfs
-  GIT_URL https://github.com/duckdb/duckdb-httpfs
-  GIT_TAG 13e18b3c9f3810334f5972b76a3acc247b28e537
+# Community builds use DuckDB's core repository for runtime dependencies.
+duckdb_extension_load(sqlnb
+  SOURCE_DIR ${CMAKE_CURRENT_LIST_DIR}
+  LOAD_TESTS
 )
-
-duckdb_extension_load(quack
-  GIT_URL https://github.com/duckdb/duckdb-quack
-  GIT_TAG 40de7badae4193c29d9c0834473fb76acc6c51e6
-)
-
-duckdb_extension_load(sqlnb SOURCE_DIR ${CMAKE_CURRENT_LIST_DIR})
diff --git a/extension_config_legacy.cmake b/extension_config_legacy.cmake
@@ -0,0 +1,15 @@
+duckdb_extension_load(json)
+duckdb_extension_load(autocomplete)
+duckdb_extension_load(icu)
+
+duckdb_extension_load(httpfs
+  GIT_URL https://github.com/duckdb/duckdb-httpfs
+  GIT_TAG 13e18b3c9f3810334f5972b76a3acc247b28e537
+)
+
+duckdb_extension_load(quack
+  GIT_URL https://github.com/duckdb/duckdb-quack
+  GIT_TAG 40de7badae4193c29d9c0834473fb76acc6c51e6
+)
+
+duckdb_extension_load(sqlnb SOURCE_DIR ${CMAKE_CURRENT_LIST_DIR})
diff --git a/http/Cargo.toml b/http/Cargo.toml
@@ -2,6 +2,7 @@
 name = "sidequery-ui-http"
 version = "0.1.0"
 edition = "2021"
+license = "MIT"
 publish = false
 
 [lib]

diff --git a/http/src/history.rs b/http/src/history.rs
@@ -521,6 +521,11 @@ impl Transaction<'_> {
             sync_history_path(&entry.map_err(err)?.path()).map_err(err)?;
         }
         sync_history_path(&packs).map_err(err)?;
+        let pack_name = builder.name().map(|s| format!("pack-{s}"));
+        drop(builder);
+        // libgit2 retains pack handles without delete sharing on Windows. Reopen
+        // its lazy object database before removing old packs; keep our lock held.
+        self.repo = Repository::open_bare(self.repo.path()).map_err(err)?;
         // All live objects are durably packed. Remove loose objects and superseded packs only.
         for entry in fs::read_dir(&objects).map_err(err)? {
             let entry = entry.map_err(err)?;
@@ -530,7 +535,6 @@ impl Transaction<'_> {
                 fs::remove_dir_all(entry.path()).map_err(err)?;
             }
         }
-        let pack_name = builder.name().map(|s| format!("pack-{s}"));
         for path in previous {
             if pack_name
                 .as_ref()