diff --git a/.github/workflows/intel-x64-verify.yml b/.github/workflows/intel-x64-verify.yml
new file mode 100644
index 00000000..a9f7b089
--- /dev/null
+++ b/.github/workflows/intel-x64-verify.yml
@@ -0,0 +1,155 @@
+name: intel-x64-verify
+
+# One-off, manually dispatched: prove the published x64 DMG on REAL Intel mac
+# hardware (the arm64 build host can't; Rosetta lacks AVX so the bundled Bun
+# claude CLI is untestable there). Downloads the live release asset, checks
+# every binary's arch, runs the bundled python + CLI, then boots the whole app
+# and polls backend health.
+on:
+  push:
+    branches: [eric/intel-x64-fix]
+    paths: ['.github/workflows/intel-x64-verify.yml']
+  workflow_dispatch:
+    inputs:
+      runner:
+        description: 'runner label (must be an Intel x64 mac)'
+        default: 'macos-15-large'
+        required: true
+
+jobs:
+  verify:
+    runs-on: ${{ inputs.runner || 'macos-15-intel' }}
+    timeout-minutes: 25
+    steps:
+      - name: prove this runner is real Intel silicon
+        run: |
+          set -x
+          uname -m
+          sysctl -n machdep.cpu.brand_string
+          sysctl hw.optional.avx1_0 hw.optional.avx2_0
+          test "$(uname -m)" = "x86_64"
+          test "$(sysctl -n hw.optional.avx1_0)" = "1"
+
+      - name: download published x64 DMG
+        run: |
+          curl -sSL -o /tmp/x64.dmg "https://github.com/${{ github.repository }}/releases/latest/download/OpenSwarm-x64.dmg"
+          ls -la /tmp/x64.dmg
+          hdiutil attach -nobrowse -readonly -mountpoint /tmp/oswmnt /tmp/x64.dmg
+          mkdir -p /tmp/oswapp
+          ditto /tmp/oswmnt/OpenSwarm.app /tmp/oswapp/OpenSwarm.app
+          hdiutil detach /tmp/oswmnt
+
+      - name: gatekeeper + signature
+        run: |
+          codesign --verify --deep --strict /tmp/oswapp/OpenSwarm.app
+          spctl -a -t exec -vv /tmp/oswapp/OpenSwarm.app
+          xcrun stapler validate /tmp/oswapp/OpenSwarm.app
+
+      - name: binary arch census
+        run: |
+          R=/tmp/oswapp/OpenSwarm.app/Contents/Resources
+          for b in \
+            /tmp/oswapp/OpenSwarm.app/Contents/MacOS/OpenSwarm \
+            "$R/python-env/bin/python3.13" \
+            "$R/python-env/lib/python3.13/site-packages/claude_agent_sdk/_bundled/claude" \
+            "$R/node/x64/bin/node" \
+            "$R/backend/uv-bin/uv"; do
+            A=$(lipo -archs "$b")
+            echo "$A  $b"
+            case "$A" in *x86_64*) ;; *) echo "WRONG ARCH"; exit 1;; esac
+          done
+
+      - name: bundled python runs natively + backend deps import
+        run: |
+          R=/tmp/oswapp/OpenSwarm.app/Contents/Resources
+          "$R/python-env/bin/python3" --version
+          "$R/python-env/bin/python3" -c "import fastapi, anthropic, pydantic, httpx, jsonschema, claude_agent_sdk; print('deps ok')"
+
+      - name: bundled claude CLI runs natively (the AVX gate Rosetta could not test)
+        run: |
+          CLI=/tmp/oswapp/OpenSwarm.app/Contents/Resources/python-env/lib/python3.13/site-packages/claude_agent_sdk/_bundled/claude
+          OUT=$("$CLI" --version 2>&1); echo "$OUT"
+          echo "$OUT" | grep -q "Claude Code"
+          if echo "$OUT" | grep -qi "lacks AVX"; then echo "AVX warning on real Intel = fail"; exit 1; fi
+          "$CLI" --help > /dev/null
+          # a real invocation exercises the JIT/network paths; a clean auth
+          # error (not a SIGILL/crash) is the pass condition
+          set +e
+          # macOS has no `timeout`; perl alarm is the portable equivalent
+          ANTHROPIC_API_KEY=sk-ant-invalid perl -e 'alarm 90; exec @ARGV' -- "$CLI" -p "hi" --model claude-haiku-4-5-20251001 > /tmp/cli-run.out 2>&1
+          CODE=$?
+          set -e
+          cat /tmp/cli-run.out
+          echo "exit=$CODE"
+          # 132=SIGILL 139=SIGSEGV 134=SIGABRT: any of those = AVX/crash class
+          if [ $CODE -eq 132 ] || [ $CODE -eq 139 ] || [ $CODE -eq 134 ]; then exit 1; fi
+
+      - name: boot the full app, poll backend health
+        run: |
+          cd /tmp/oswapp
+          OPENSWARM_E2E=1 ./OpenSwarm.app/Contents/MacOS/OpenSwarm > /tmp/boot.log 2>&1 &
+          APP_PID=$!
+          for i in $(seq 1 60); do
+            CODE=$(curl -s -o /dev/null -w '%{http_code}' --max-time 2 http://127.0.0.1:8324/api/health/check || true)
+            [ "$CODE" = "200" ] && break
+            sleep 2
+          done
+          echo "health=$CODE after ~$((i*2))s"
+          kill $APP_PID 2>/dev/null || true
+          tail -30 /tmp/boot.log || true
+          test "$CODE" = "200"
+
+  verify-windows:
+    runs-on: windows-latest
+    timeout-minutes: 30
+    steps:
+      - name: download published Setup.exe
+        shell: pwsh
+        run: |
+          curl.exe -sSL -o $env:TEMP\OpenSwarm-Setup-x64.exe "https://github.com/${{ github.repository }}/releases/latest/download/OpenSwarm-Setup-x64.exe"
+          Get-Item $env:TEMP\OpenSwarm-Setup-x64.exe | Select-Object Name,Length
+
+      - name: silent install (Squirrel)
+        shell: pwsh
+        run: |
+          Start-Process -FilePath "$env:TEMP\OpenSwarm-Setup-x64.exe" -ArgumentList "--silent"
+          # the root OpenSwarm.exe is Squirrel's stub; the real app + resources
+          # live in app-<version>\. python.exe appearing = install truly done.
+          $deadline = (Get-Date).AddMinutes(10)
+          do {
+            Start-Sleep -Seconds 5
+            $py = Get-ChildItem "$env:LOCALAPPDATA\openswarm\app-*\resources\python-env\python.exe" -ErrorAction SilentlyContinue | Select-Object -First 1
+          } until ($py -or (Get-Date) -gt $deadline)
+          if (-not $py) { Get-ChildItem "$env:LOCALAPPDATA\openswarm" -Recurse -Depth 2 -ErrorAction SilentlyContinue | Select-Object FullName -First 40; throw "installed python-env not found" }
+          $appDir = $py.FullName -replace '\\resources\\python-env\\python\.exe$', ''
+          echo "APP_EXE=$appDir\OpenSwarm.exe" >> $env:GITHUB_ENV
+          echo "APP_DIR=$appDir" >> $env:GITHUB_ENV
+          echo "installed at $appDir"
+
+      - name: bundled python + claude CLI run on real Windows x64
+        shell: pwsh
+        run: |
+          $py = Join-Path $env:APP_DIR "resources\python-env\python.exe"
+          & $py --version
+          if ($LASTEXITCODE -ne 0) { throw "python --version failed" }
+          & $py -c "import fastapi, anthropic, pydantic, httpx, jsonschema, claude_agent_sdk; print('deps ok')"
+          if ($LASTEXITCODE -ne 0) { throw "import smoke failed" }
+          $cli = Get-ChildItem (Join-Path $env:APP_DIR "resources\python-env") -Recurse -Filter "claude*" -ErrorAction SilentlyContinue | Where-Object { $_.Directory.Name -eq "_bundled" } | Select-Object -First 1
+          if (-not $cli) { throw "bundled claude CLI not found" }
+          & $cli.FullName --version
+          if ($LASTEXITCODE -ne 0) { throw "claude --version failed" }
+
+      - name: boot the installed app, poll backend health
+        shell: pwsh
+        run: |
+          $env:OPENSWARM_E2E = "1"
+          Start-Process -FilePath $env:APP_EXE
+          $code = 0
+          foreach ($i in 1..60) {
+            Start-Sleep -Seconds 3
+            try { $code = (Invoke-WebRequest -Uri "http://127.0.0.1:8324/api/health/check" -UseBasicParsing -TimeoutSec 2).StatusCode } catch { $code = 0 }
+            if ($code -eq 200) { break }
+          }
+          echo "health=$code"
+          Stop-Process -Name "OpenSwarm" -Force -ErrorAction SilentlyContinue
+          if ($code -ne 200) { throw "backend never became healthy" }