@@ -30,17 +30,29 @@
 #     pytorch/executorch, builds the smoke consumer for ESP32-S3 with it, fails
 #     if the registry serves files other than <dir>'s archive, and runs the
 #     build on the emulator.
+#   test_espressif_idf_nightly.sh wheel <dir> <dev version> <commit>
+#     Checks that the ExecuTorch nightly wheels of the version's date exist for
+#     every platform and Python, and that each platform's Python 3.11 wheel was
+#     built from <commit>, so a project can install the executorch its kernel
+#     bundles need. Refuses today's nightly, which a later one could replace.
+#     Logs go under <dir>.
+#   test_espressif_idf_nightly.sh torch <dir>
+#     Needs only <dir> from prepare: checks that the torch the component's
+#     VERSION names resolves from its index on every platform.
 
 set -euo pipefail
 
 et_root=$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)
-usage="usage: $0 prepare <dir> [stamp options] | build <dir> <shard> <shards> | registry <dir> <URL>"
+usage="usage: $0 prepare <dir> [stamp options] | build <dir> <shard> <shards> | registry <dir> <URL> | wheel <dir> <version> <commit> | torch <dir>"
 mode=${1:?${usage}}
 dir=${2:?${usage}}
 mkdir -p "${dir}"
 dir=$(cd "${dir}" && pwd)
 cd "${et_root}"
 targets=(esp32 esp32s3 esp32c3 esp32c5 esp32c6 esp32p4)
+# The platforms and Pythons ExecuTorch's wheels are built for.
+wheel_platforms=(manylinux_2_28_x86_64 manylinux_2_28_aarch64 macosx_14_0_arm64 win_amd64)
+wheel_pythons=(311 312 313 314 315)
 
 # Runs a command with its output in a log, and shows the log's tail if it fails.
 logged() {
@@ -357,6 +369,70 @@ settings_applied() {
     [[ "${applied}" == true ]]
 }
 
+wheel() {
+    local version=${3:?${usage}} commit=${4:?${usage}} wheels platform python listing
+    local missing=()
+    if [[ "${version}" != *-dev.* ]]; then
+        echo "FAIL: ${version} is not a dev version" >&2
+        exit 1
+    fi
+    # A second nightly the same day would replace the wheels of this one.
+    if [[ "${version##*-dev.}" == "$(date -u +%Y%m%d)" ]]; then
+        echo "FAIL: ${version} is today's nightly, which a later nightly today could replace;" \
+            "publish it after 00:00 UTC, before the next nightly." >&2
+        exit 1
+    fi
+    listing=$(curl -sSf https://download.pytorch.org/whl/nightly/cpu/executorch/)
+    listing=$(grep -F "executorch-${version/-dev./.dev}" <<< "${listing}" || true)
+    for platform in "${wheel_platforms[@]}"; do
+        for python in "${wheel_pythons[@]}"; do
+            if ! grep -qF -- "-cp${python}-cp${python}-${platform}.whl" <<< "${listing}"; then
+                missing+=("cp${python}-${platform}")
+            fi
+        done
+    done
+    if (( ${#missing[@]} > 0 )); then
+        echo "FAIL: the nightly index has no ${version} wheel for ${missing[*]}" >&2
+        exit 1
+    fi
+    wheels=$(mktemp -d)
+    # shellcheck disable=SC2064 # wheels is local, so expand it now.
+    trap "rm -rf '${wheels}'" EXIT
+    mkdir -p "${dir}/logs"
+    for platform in "${wheel_platforms[@]}"; do
+        logged "${dir}/logs/nightly-wheel-${platform}.log" python -m pip download --no-deps \
+            --only-binary=:all: --platform "${platform}" --python-version 3.11 \
+            --implementation cp --index-url https://download.pytorch.org/whl/nightly/cpu \
+            --dest "${wheels}/${platform}" "executorch==${version/-dev./.dev}"
+        python - "${wheels}/${platform}"/executorch-*.whl "${commit}" <<'PY'
+import re
+import sys
+import zipfile
+
+wheel, commit = sys.argv[1:]
+version_py = zipfile.ZipFile(wheel).read("executorch/version.py").decode()
+built = re.search(r"^git_version: .* = '(\w+)'", version_py, re.MULTILINE)
+built = built.group(1) if built else None
+if built != commit:
+    sys.exit(f"FAIL: {wheel} was built from {built}, not the component's {commit}")
+print(f"OK: {wheel} was built from {commit}")
+PY
+    done
+}
+
+torch() {
+    local version_file="${dir}/component/executorch/VERSION" requirement index platform
+    requirement=$(sed -n 's/^torch_requirement: *//p' "${version_file}")
+    index=$(sed -n 's/^torch_index: *//p' "${version_file}")
+    mkdir -p "${dir}/logs"
+    for platform in "${wheel_platforms[@]}"; do
+        logged "${dir}/logs/torch-${platform}.log" python -m pip install --dry-run --no-deps \
+            --only-binary=:all: --platform "${platform}" --python-version 3.11 \
+            --implementation cp --target "$(mktemp -d)" --index-url "${index}" "${requirement}"
+    done
+    echo "OK: ${requirement} resolves from ${index} on ${wheel_platforms[*]}"
+}
+
 # Runs a build on its emulator: build dir, target, log, then idf.py arguments.
 run_firmware() {
     local build=$1 target=$2 log=$3
@@ -390,5 +466,7 @@ case "${mode}" in
     prepare) prepare "$@" ;;
     build) build "$@" ;;
     registry) registry "$@" ;;
+    wheel) wheel "$@" ;;
+    torch) torch ;;
     *) echo "unknown mode ${mode}; ${usage}" >&2; exit 1 ;;
 esac
@@ -1,7 +1,8 @@
 name: Publish ESP-IDF component
 
 # Publishes pytorch/executorch to the ESP Component Registry: RC tags to the
-# staging registry, release tags to staging and then production. The archive
+# staging registry, release tags to staging and then production, and on demand
+# a dev version of a nightly branch commit for early adopters. The archive
 # is built and tested on the ESP-IDF releases the component supports before
 # any upload, and each upload is followed by a consumer build that resolves
 # the version from that registry. See the release runbook in
@@ -14,7 +15,7 @@ on:
   workflow_dispatch:
     inputs:
       version_suffix:
-        description: 'Version suffix: empty at a release tag, -rc.N at an RC tag, ~N for a packaging respin on release/X.Y'
+        description: 'Version suffix: empty at a release tag, -rc.N at an RC tag, ~N for a packaging respin on release/X.Y, -dev for the dev version of the nightly branch'
         type: string
         default: ''
       registry:
@@ -33,6 +34,7 @@ on:
       - .github/workflows/publish-esp-idf.yml
       - .ci/scripts/upload_espressif_idf_component.sh
       - .ci/scripts/espressif_idf_upload_requirements.txt
+      - .ci/scripts/test_espressif_idf_nightly.sh
 
 # Runs for one tag or branch go one at a time; runs for different ones, such as
 # an RC awaiting approval and its release, do not hold each other up.
@@ -59,6 +61,7 @@ jobs:
         shell: bash
         env:
           EVENT: ${{ github.event_name }}
+          REF: ${{ github.ref }}
           REF_NAME: ${{ github.ref_name }}
           VERSION_SUFFIX: ${{ inputs.version_suffix }}
           REGISTRY: ${{ inputs.registry }}
@@ -79,8 +82,18 @@ jobs:
               fi
               ;;
             workflow_dispatch)
-              if [[ ! "${VERSION_SUFFIX}" =~ ^(-rc\.[1-9][0-9]*|~[1-9][0-9]*)?$ ]]; then
-                echo "::error::version_suffix must be empty, -rc.N or ~N, not '${VERSION_SUFFIX}'."
+              if [[ ! "${VERSION_SUFFIX}" =~ ^(-rc\.[1-9][0-9]*|~[1-9][0-9]*|-dev)?$ ]]; then
+                echo "::error::version_suffix must be empty, -rc.N, ~N or -dev, not '${VERSION_SUFFIX}'."
+                exit 1
+              fi
+              # A dev version's users install the nightly wheel of its commit.
+              if [[ "${VERSION_SUFFIX}" == -dev && "${REF}" != refs/heads/nightly ]]; then
+                echo "::error::a dev version is published from the nightly branch, not ${REF}."
+                exit 1
+              fi
+              # The environment trusts the nightly branch for dev versions only.
+              if [[ "${REF}" == refs/heads/nightly && "${VERSION_SUFFIX}" != -dev ]]; then
+                echo "::error::the nightly branch publishes dev versions only, with version_suffix -dev."
                 exit 1
               fi
               if [[ "${VERSION_SUFFIX}" == -rc.* && "${REGISTRY}" == production ]]; then
@@ -136,26 +149,68 @@ jobs:
         unset SCCACHE_BUCKET SCCACHE_S3_KEY_PREFIX
         CONDA_ENV=$(conda env list --json | jq -r '.envs | .[-1]')
         conda activate "${CONDA_ENV}"
+        nightly=.ci/scripts/test_espressif_idf_nightly.sh
+        suffix="${{ needs.plan.outputs.suffix }}"
+        # A tag names its version; a dispatch appends its suffix to version.txt.
+        expected="${{ needs.plan.outputs.version }}"
+        expected="${expected:-$(cat version.txt)${suffix}}"
+        # Before the build: a dev version's users install the nightly wheels of
+        # its commit.
+        if [[ "${suffix}" == -dev ]]; then
+          expected=$(bash examples/espressif/build_idf_component.sh --version --version-suffix -dev)
+          bash "${nightly}" wheel "${RUNNER_ARTIFACT_DIR}" "${expected}" "$(git rev-parse HEAD)"
+        fi
         source .ci/scripts/utils.sh
         install_executorch --use-pt-pinned-commit --minimal
         if [[ "${{ needs.plan.outputs.rehearsal }}" == true ]]; then
           # A pull request rehearses the release stamp at a throwaway local tag.
           git tag -f "v$(cat version.txt)"
         fi
-        # A tag names its version; a dispatch appends its suffix to version.txt.
-        expected="${{ needs.plan.outputs.version }}"
-        expected="${expected:-$(cat version.txt)${{ needs.plan.outputs.suffix }}}"
-        bash .ci/scripts/test_espressif_idf_nightly.sh prepare "${RUNNER_ARTIFACT_DIR}" \
-          --version-suffix "${{ needs.plan.outputs.suffix }}"
+        bash "${nightly}" prepare "${RUNNER_ARTIFACT_DIR}" --version-suffix "${suffix}"
         version=$(cat "${RUNNER_ARTIFACT_DIR}/version")
         if [[ "${version}" != "${expected}" ]]; then
           echo "FAIL: generated version ${version}, expected ${expected}" >&2
           exit 1
         fi
+        bash "${nightly}" torch "${RUNNER_ARTIFACT_DIR}"
         echo "Packed pytorch/executorch ${version}"
         # Nothing downstream reads the unpacked component.
         rm -r "${RUNNER_ARTIFACT_DIR}/component"
 
+  # A pull request rehearses the dev version's wheel check on the latest
+  # finished nightly that has wheels. Nightly wheels fail to build for days at a
+  # time, so finding none only warns, and nothing waits on this job.
+  dev-wheel-rehearsal:
+    name: Rehearse the dev version's wheel check
+    needs: plan
+    if: needs.plan.outputs.rehearsal == 'true'
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: '3.11'
+      - run: |
+          set -euo pipefail
+          # The nightly index keeps about two months of wheels.
+          git fetch -q --shallow-since='61 days ago' origin \
+            +refs/heads/nightly:refs/remotes/origin/nightly
+          listing=$(curl -sSf https://download.pytorch.org/whl/nightly/cpu/executorch/)
+          today=$(date -u +%Y%m%d)
+          for commit in $(git rev-list --first-parent origin/nightly); do
+            day=$(TZ=UTC git log -1 --format=%cd --date=format-local:%Y%m%d "${commit}")
+            version="$(git show "${commit}:version.txt")-dev.${day}"
+            if [[ "${day}" != "${today}" ]] \
+                && grep -qF "executorch-${version/-dev./.dev}" <<< "${listing}"; then
+              bash .ci/scripts/test_espressif_idf_nightly.sh wheel "${RUNNER_TEMP}/wheel" \
+                "${version}" "${commit}"
+              exit 0
+            fi
+          done
+          echo "::warning::no nightly of the last 60 days has wheels; the dev wheel check went unrehearsed."
+
   dry-run:
     name: Registry validation on ${{ matrix.registry }} (upload --dry-run)
     needs: [docker-image, package]
 
@@ -42,8 +42,9 @@ both with `executorch_add_model` and `executorch_add_kernels` (see the
 component's `README.md`). Application pipelines built on the runtime
 (for example wake word front ends and detectors) stay with the
 application.
-Consumers need ESP-IDF, plus the `executorch` Python package of the
-same release to make kernel bundles — no host CMake build, no flatc.
+Consumers need ESP-IDF, plus the `executorch` Python package the
+component was built from to make kernel bundles (see the component's
+`README.md`) — no host CMake build, no flatc.
 `idf_component_smoke/` is a minimal consumer that CI generates, builds
 and runs on the emulator (`.ci/scripts/test_espressif_idf_component.sh`).
 `idf_component_consumer/` builds the same app from the packed component
@@ -78,6 +79,15 @@ serves the tested files, and runs it on the emulator.
   `examples/espressif/`, `.ci/`, `.github/` and `docs/`, and run the
   workflow on `release/X.Y` with `version_suffix` `~N`. A release whose
   publishing failed in CI is published as a respin once the CI is fixed.
+- A dev version, `X.Y.Z-dev.YYYYMMDD`, lets projects use the component
+  before a release. Run the workflow on the `nightly` branch with
+  `version_suffix` `-dev`, `registry` `production` and `dry_run` cleared,
+  between 00:00 UTC and the next nightly (around 11:30 UTC), so that it
+  publishes the last nightly of a finished day. Projects resolve from
+  production, where a version range picks up a pre-release only if it opts
+  in. The run publishes only if that day's ExecuTorch nightly wheels, on
+  every platform, were built from the same commit, because projects install
+  them to make their kernel bundles.
 - A manual run only validates unless `dry_run` is cleared. With `registry`
   `production`, it uploads to staging first. Uploads skip versions the
   registry already has, so **Re-run failed jobs** retries with the same
@@ -88,13 +98,15 @@ Each upload waits for a reviewer of the `esp-component-registry`
 environment, the only place the registries accept uploads from: on each
 registry, `pytorch/executorch`'s trusted uploader names this repository and
 that environment. Before approving an upload, check that the run's ref and
-commit are the release's announced tag and commit. Before approving the
-staging upload, dispatch the nightly matrix (`nightly-espressif-idf.yml`)
-on the tag and wait for it to pass; it also covers ESP-IDF master, the
-all-ops build and the macOS and Windows configure jobs. Approve the
-production upload once `executorch` X.Y.Z is on PyPI, since a project
-needs it to make kernel bundles, and the release owner has built a
-project against the version on staging.
+commit are the release's announced tag and commit, or for a dev version,
+the `nightly` branch. Before approving the staging upload of a release or
+RC, dispatch the nightly matrix (`nightly-espressif-idf.yml`) on the tag
+and wait for it to pass; it also covers ESP-IDF master, the all-ops build
+and the macOS and Windows configure jobs. A dev version has only its own
+run's builds. Approve the production upload once, for a release,
+`executorch` X.Y.Z is on PyPI, since a project needs it to make kernel
+bundles, and the release owner has built a project against the version on
+staging.
 
 The one-time setup goes in this order, because GitHub creates a missing
 environment, unprotected, as soon as a workflow names it:
@@ -103,7 +115,8 @@ environment, unprotected, as soon as a workflow names it:
    delete `v*` tags, since the environment trusts those tags.
 2. Create the `esp-component-registry` environment with required
    reviewers, self-review prevented, no admin bypass, and deployments
-   limited to `v*` tags and `release/*` branches.
+   limited to `v*` tags and `release/*` branches, plus `nightly` before the
+   first dev version.
 3. Create the `pytorch` namespace on the staging registry.
 4. On each registry, make this repository and that environment
    `pytorch/executorch`'s trusted uploader.
 
@@ -22,10 +22,13 @@
 #                                  release/X.Y, after vX.Y.Z, and differ from
 #                                  it only under examples/espressif/, .ci/,
 #                                  .github/ and docs/.
+#   --version-suffix -dev          X.Y.Z-dev.<HEAD's commit date in UTC>,
+#                                  published from the nightly branch.
 #   --allow-dev-stamp              X.Y.Z-dev.<HEAD's commit date in UTC>, for
 #                                  builds from any commit; never published.
-# The first three also refuse uncommitted changes to what the generator
-# reads, and every stamp needs ExecuTorch at the top of its own git checkout.
+# All but --allow-dev-stamp also refuse uncommitted changes to what the
+# generator reads, and every stamp needs ExecuTorch at the top of its own git
+# checkout.
 #
 # Derived from examples/arduino/build_arduino_library.sh with an ESP-IDF
 # output layout and the shared ESP-IDF PAL. The component vendors every
@@ -143,12 +146,14 @@ ET_VERSION=$(cat "$ET_ROOT/version.txt")
 if [[ ! "$ET_VERSION" =~ ^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$ ]]; then
   stamp_error "version.txt must contain an ExecuTorch version in X.Y.Z form."
 fi
+DEV_SUFFIX="-dev.$(TZ=UTC git -C "$ET_ROOT" log -1 --format=%cd --date=format-local:%Y%m%d)"
 if [ "$ALLOW_DEV_STAMP" = true ]; then
   if [ "$VERSION_SUFFIX_GIVEN" = true ]; then
     stamp_error "--allow-dev-stamp picks the suffix; drop --version-suffix."
   fi
-  VERSION_SUFFIX="-dev.$(TZ=UTC git -C "$ET_ROOT" log -1 --format=%cd --date=format-local:%Y%m%d)"
+  VERSION_SUFFIX="$DEV_SUFFIX"
 fi
+STAMP_SUFFIX="$VERSION_SUFFIX"
 # A release commit can carry its last RC's tag too.
 HEAD_TAGS=$(git -C "$ET_ROOT" tag --points-at HEAD 2>/dev/null || true)
 head_has_tag() {
@@ -199,25 +204,28 @@ case "$VERSION_SUFFIX" in
 $CHANGED"
     fi
     ;;
+  -dev)
+    VERSION_SUFFIX="$DEV_SUFFIX"
+    ;;
   *)
     # The only other suffix is the one --allow-dev-stamp picks.
     if [ "$ALLOW_DEV_STAMP" = false ]; then
-      stamp_error "--version-suffix must be empty, -rc.N or ~N, not $VERSION_SUFFIX; --allow-dev-stamp makes a development stamp."
+      stamp_error "--version-suffix must be empty, -rc.N, ~N or -dev, not $VERSION_SUFFIX; --allow-dev-stamp makes an unpublished development stamp."
     fi
     ;;
 esac
 if [ "$ALLOW_DEV_STAMP" = false ]; then
   CHANGES=$(uncommitted_changes)
   if [ -n "$CHANGES" ]; then
-    stamp_error "a release, RC or respin stamp needs a checkout without uncommitted changes to what the generator reads, but found:
+    stamp_error "a published stamp needs a checkout without uncommitted changes to what the generator reads, but found:
 $CHANGES"
   fi
 fi
 ET_COMPONENT_VERSION="$ET_VERSION$VERSION_SUFFIX"
 if [ "$ALLOW_DEV_STAMP" = true ]; then
   STAMP_OPTION=" --allow-dev-stamp"
 elif [ "$VERSION_SUFFIX_GIVEN" = true ]; then
-  STAMP_OPTION=" --version-suffix '$VERSION_SUFFIX'"
+  STAMP_OPTION=" --version-suffix '$STAMP_SUFFIX'"
 else
   STAMP_OPTION=""
 fi
@@ -682,11 +690,25 @@ sed -e "s/@ET_COMPONENT_VERSION@/$ET_COMPONENT_VERSION/" -e "s/@ET_COMMIT@/$ET_S
   "$TEMPLATE_DIR/idf_component.yml.in" > "$OUT_DIR/idf_component.yml"
 
 ET_DIRTY=$(uncommitted_changes)
+# The torch that install_requirements.py installs to build ExecuTorch's wheels,
+# which declare none, and the index that keeps it.
+TORCH_REQUIREMENT=$(sed -n 's/.*"\(torch==[^"]*\)" if use_pytorch_nightly.*/\1/p' \
+  "$ET_ROOT/install_requirements.py")
+if [ -z "$TORCH_REQUIREMENT" ]; then
+  echo "ERROR: install_requirements.py names no torch==X for the wheel builds." >&2; exit 1
+fi
+if [[ "$TORCH_REQUIREMENT" == *.dev* ]]; then
+  TORCH_INDEX=https://download.pytorch.org/whl/nightly/cpu
+else
+  TORCH_INDEX=https://download.pytorch.org/whl/cpu
+fi
 {
   echo "# GENERATED by examples/espressif/build_idf_component.sh -- do not edit."
   echo "executorch_version: $ET_VERSION"
   echo "component_version: $ET_COMPONENT_VERSION"
   echo "executorch_commit: $ET_SHA${ET_DIRTY:+ (tree had uncommitted changes)}"
+  echo "torch_requirement: $TORCH_REQUIREMENT"
+  echo "torch_index: $TORCH_INDEX"
   echo "generator: examples/espressif/build_idf_component.sh --out $OUT_DIR_AS_GIVEN$STAMP_OPTION"
   echo "kernel_libraries:"
   for entry in "${LIBRARIES[@]}"; do