@@ -93,6 +93,7 @@ bash "${release_clone}/examples/espressif/build_idf_component.sh" --version-suff
     --out "${build_dir}/release_component" 2>&1 | tee "${build_dir}/generate-release.log"
 compote manifest lint "${build_dir}/release_component"
 python - "${build_dir}/release_component" "${release_version}" "$(git rev-parse HEAD)" <<'PY'
+import re
 import sys
 from pathlib import Path
 
@@ -103,6 +104,13 @@ for line in (f"component_version: {version}", f"executorch_commit: {commit}"):
         sys.exit(f"FAIL: the release component's VERSION has no '{line}'")
 if not any(l.startswith("generator: ") and l.endswith(" --version-suffix ''") for l in lines):
     sys.exit("FAIL: the release component's VERSION does not record --version-suffix ''")
+sys.path.insert(0, ".")
+from install_requirements import TORCH_URL_BASE
+
+if not any(re.fullmatch(r"torch_requirement: torch==\d+\.\d+\.\d+\S*", l) for l in lines):
+    sys.exit("FAIL: the release component's VERSION has no torch_requirement: torch==X.Y.Z")
+if f"torch_index: {TORCH_URL_BASE}/cpu" not in lines:
+    sys.exit(f"FAIL: the release component's VERSION has no torch_index: {TORCH_URL_BASE}/cpu")
 if f'version: "{version}"' not in (component / "idf_component.yml").read_text().splitlines():
     sys.exit(f"FAIL: the release component's idf_component.yml is not version {version}")
 print(f"OK: a clean checkout tagged v{version} generates release {version}")
 
@@ -33,17 +33,35 @@
 #     pytorch/executorch, builds the smoke consumer for ESP32-S3 with it, fails
 #     if the registry serves files other than <dir>'s archive, and runs the
 #     build on the emulator.
+#   test_espressif_idf_nightly.sh wheel <dir> <dev version> <commit>
+#     Checks that the ExecuTorch nightly wheels of the version's date exist for
+#     every platform and Python and were built from <commit>, so a project can
+#     install the executorch its kernel bundles need. Refuses today's nightly,
+#     which a later one could replace. Logs go under <dir>.
+#   test_espressif_idf_nightly.sh rehearse <dir>
+#     Checks that wheel refuses a version that is not a dev version and today's
+#     nightly, then runs it on the latest finished nightly of origin/nightly's
+#     last 60 days, the nightly index's window, that has every wheel. Nightly
+#     wheels can fail to build for days, so finding none only warns.
+#   test_espressif_idf_nightly.sh torch <dir>
+#     Needs only <dir> from prepare: checks that the torch the component's
+#     VERSION names resolves from its index for every platform and Python.
 
 set -euo pipefail
 
 et_root=$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)
-usage="usage: $0 prepare <dir> [stamp options] | build <dir> <shard> <shards> | fetch <dir> <URL> <sha256> | registry <dir> <URL>"
+usage="usage: $0 prepare <dir> [stamp options] | build <dir> <shard> <shards> | fetch <dir> <URL> <sha256> | registry <dir> <URL> | wheel <dir> <dev version> <commit> | rehearse <dir> | torch <dir>"
 mode=${1:?${usage}}
 dir=${2:?${usage}}
 mkdir -p "${dir}"
 dir=$(cd "${dir}" && pwd)
 cd "${et_root}"
 targets=(esp32 esp32s3 esp32c3 esp32c5 esp32c6 esp32p4)
+# The platforms and CPython versions ExecuTorch's wheels are built for, as
+# .github/workflows/build-wheels-{linux,aarch64-linux,macos,windows}.yml set them.
+wheel_platforms=(manylinux_2_28_x86_64 manylinux_2_28_aarch64 macosx_14_0_arm64 win_amd64)
+wheel_pythons=(311 312 313 314 315)
+nightly_index=https://download.pytorch.org/whl/nightly/cpu
 
 # Runs a command with its output in a log, and shows the log's tail if it fails.
 logged() {
@@ -395,6 +413,116 @@ settings_applied() {
     [[ "${applied}" == true ]]
 }
 
+# Prints each wheel a dev version lacks: version, the nightly index's listing.
+missing_wheels() {
+    local listed platform python
+    listed=$(grep -F "executorch-${1/-dev./.dev}" <<< "$2" || true)
+    for platform in "${wheel_platforms[@]}"; do
+        for python in "${wheel_pythons[@]}"; do
+            grep -qF -- "-cp${python}-cp${python}-${platform}.whl" <<< "${listed}" \
+                || echo "cp${python}-${platform}"
+        done
+    done
+}
+
+# Checks a dev version's nightly wheels: version, commit.
+check_wheels() {
+    local version=$1 commit=$2 listing missing wheels platform python
+    if [[ "${version}" != *-dev.* ]]; then
+        echo "FAIL: ${version} is not a dev version" >&2
+        exit 1
+    fi
+    # A second nightly the same day would replace the wheels of this one.
+    if [[ "${version##*-dev.}" == "$(date -u +%Y%m%d)" ]]; then
+        echo "FAIL: ${version} is today's nightly, which a later nightly today could replace;" \
+            "publish it after 00:00 UTC, before the next nightly." >&2
+        exit 1
+    fi
+    # The version's date is its nightly commit's UTC date, and the wheels' is
+    # the day they were built; when the two differ, no wheels are found.
+    listing=$(curl -sSf --retry 3 "${nightly_index}/executorch/")
+    missing=$(missing_wheels "${version}" "${listing}")
+    if [[ -n "${missing}" ]]; then
+        echo "FAIL: the nightly index has no ${version} wheel for ${missing//$'\n'/ }" >&2
+        exit 1
+    fi
+    wheels=$(mktemp -d)
+    # shellcheck disable=SC2064 # wheels is local, so expand it now.
+    trap "rm -rf '${wheels}'" EXIT
+    mkdir -p "${dir}/logs"
+    for platform in "${wheel_platforms[@]}"; do
+        for python in "${wheel_pythons[@]}"; do
+            logged "${dir}/logs/nightly-wheel-cp${python}-${platform}.log" python -m pip download \
+                --no-deps --only-binary=:all: --platform "${platform}" \
+                --python-version "3.${python#3}" --implementation cp --index-url "${nightly_index}" \
+                --dest "${wheels}" "executorch==${version/-dev./.dev}"
+        done
+    done
+    python - "${commit}" "${wheels}"/executorch-*.whl <<'PY'
+import re
+import sys
+import zipfile
+
+commit, wheels = sys.argv[1], sys.argv[2:]
+wrong = []
+for wheel in wheels:
+    version_py = zipfile.ZipFile(wheel).read("executorch/version.py").decode()
+    built = re.search(r"^git_version: .* = '(\w+)'", version_py, re.MULTILINE)
+    if not built or built.group(1) != commit:
+        wrong.append(f"{wheel} ({built.group(1) if built else 'no commit'})")
+if wrong:
+    sys.exit(f"FAIL: not built from the component's {commit}: {', '.join(wrong)}")
+print(f"OK: all {len(wheels)} wheels were built from {commit}")
+PY
+}
+
+wheel() {
+    check_wheels "${3:?${usage}}" "${4:?${usage}}"
+}
+
+rehearse() {
+    local today output listing commit day version
+    today=$(date -u +%Y%m%d)
+    output=$( (check_wheels 1.6.0 0) 2>&1 || true)
+    if [[ "${output}" != *"is not a dev version"* ]]; then
+        echo "FAIL: the wheel check did not refuse 1.6.0: ${output}" >&2
+        exit 1
+    fi
+    output=$( (check_wheels "1.6.0-dev.${today}" 0) 2>&1 || true)
+    if [[ "${output}" != *"is today's nightly"* ]]; then
+        echo "FAIL: the wheel check did not refuse today's nightly: ${output}" >&2
+        exit 1
+    fi
+    echo "OK: the wheel check refuses a version that is not a dev version and today's nightly"
+    listing=$(curl -sSf --retry 3 "${nightly_index}/executorch/")
+    for commit in $(git rev-list --first-parent --since=60.days origin/nightly); do
+        day=$(TZ=UTC git log -1 --format=%cd --date=format-local:%Y%m%d "${commit}")
+        version="$(git show "${commit}:version.txt")-dev.${day}"
+        if [[ "${day}" != "${today}" && -z "$(missing_wheels "${version}" "${listing}")" ]]; then
+            check_wheels "${version}" "${commit}"
+            return
+        fi
+    done
+    echo "::warning::no nightly of the last 60 days has every wheel; the dev wheel check went unrehearsed."
+}
+
+torch() {
+    local version_file="${dir}/component/executorch/VERSION" requirement index target platform python
+    requirement=$(sed -n 's/^torch_requirement: *//p' "${version_file}")
+    index=$(sed -n 's/^torch_index: *//p' "${version_file}")
+    target=$(mktemp -d)
+    mkdir -p "${dir}/logs"
+    for platform in "${wheel_platforms[@]}"; do
+        for python in "${wheel_pythons[@]}"; do
+            logged "${dir}/logs/torch-cp${python}-${platform}.log" python -m pip install --dry-run \
+                --no-deps --only-binary=:all: --platform "${platform}" \
+                --python-version "3.${python#3}" --implementation cp --target "${target}" \
+                --index-url "${index}" "${requirement}"
+        done
+    done
+    echo "OK: ${requirement} resolves from ${index} for CPython ${wheel_pythons[*]} on ${wheel_platforms[*]}"
+}
+
 # Runs a build on its emulator: build dir, target, log, then idf.py arguments.
 run_firmware() {
     local build=$1 target=$2 log=$3
@@ -429,5 +557,8 @@ case "${mode}" in
     build) build "$@" ;;
     fetch) fetch "$@" ;;
     registry) registry "$@" ;;
+    wheel) wheel "$@" ;;
+    rehearse) rehearse ;;
+    torch) torch ;;
     *) echo "unknown mode ${mode}; ${usage}" >&2; exit 1 ;;
 esac
@@ -50,11 +50,31 @@ jobs:
         source .ci/scripts/utils.sh
         install_executorch --use-pt-pinned-commit --minimal
         bash .ci/scripts/test_espressif_idf_nightly.sh prepare "${RUNNER_ARTIFACT_DIR}"
+        bash .ci/scripts/test_espressif_idf_nightly.sh torch "${RUNNER_ARTIFACT_DIR}"
         # Runs the release stamp's checks, which publishing otherwise first runs
         # at a real tag, at a throwaway local one.
         git tag -f "v$(cat version.txt)"
         bash examples/espressif/build_idf_component.sh --version --version-suffix ""
 
+  # The dev versions' wheel check, which publishing otherwise first runs on a
+  # dispatch from the nightly branch.
+  dev-wheel-check:
+    name: Rehearse the dev version's wheel check
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
+          persist-credentials: false
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: '3.11'
+      - run: |
+          set -euo pipefail
+          git fetch -q --shallow-since='60 days ago' origin \
+            +refs/heads/nightly:refs/remotes/origin/nightly
+          bash .ci/scripts/test_espressif_idf_nightly.sh rehearse "${RUNNER_TEMP}/wheel"
+
   registry-dry-run:
     name: Registry validation (upload --dry-run)
     needs: [docker-image, prepare]
 
@@ -1,11 +1,12 @@
 name: Publish ESP-IDF component
 
 # Publishes pytorch/executorch to the ESP Component Registry: RC tags to the
-# staging registry, and release and respin tags to staging and then
-# production; manual runs validate without uploading unless told otherwise.
-# The archive is built and tested on the ESP-IDF releases the component
-# supports before any upload, and each upload is followed by a consumer build
-# that resolves the version from that registry. See the release runbook in
+# staging registry, release and respin tags to staging and then production,
+# and on demand a dev version of a nightly branch commit for early adopters;
+# other manual runs validate without uploading unless told otherwise. The
+# archive is built and tested on the ESP-IDF releases the component supports
+# before any upload, and each upload is followed by a consumer build that
+# resolves the version from that registry. See the release runbook in
 # examples/espressif/README.md.
 
 on:
@@ -15,7 +16,7 @@ on:
   workflow_dispatch:
     inputs:
       version_suffix:
-        description: 'Version suffix: empty at a release tag, -rc.N at an RC tag, ~N at a respin tag vX.Y.Z-esp-idf.N'
+        description: 'Version suffix: empty at a release tag, -rc.N at an RC tag, ~N at a respin tag vX.Y.Z-esp-idf.N, -dev for the dev version of the nightly branch'
         type: string
         default: ''
       registry:
@@ -62,6 +63,7 @@ jobs:
         shell: bash
         env:
           EVENT: ${{ github.event_name }}
+          REF: ${{ github.ref }}
           REF_NAME: ${{ github.ref_name }}
           VERSION_SUFFIX: ${{ inputs.version_suffix }}
           REGISTRY: ${{ inputs.registry }}
@@ -87,8 +89,20 @@ jobs:
               fi
               ;;
             workflow_dispatch)
-              if [[ ! "${VERSION_SUFFIX}" =~ ^(-rc\.[1-9][0-9]*|~[1-9][0-9]*)?$ ]]; then
-                echo "::error::version_suffix must be empty, -rc.N or ~N, not '${VERSION_SUFFIX}'."
+              if [[ ! "${VERSION_SUFFIX}" =~ ^(-rc\.[1-9][0-9]*|~[1-9][0-9]*|-dev)?$ ]]; then
+                echo "::error::version_suffix must be empty, -rc.N, ~N or -dev, not '${VERSION_SUFFIX}'."
+                exit 1
+              fi
+              # A dev version's users install the nightly wheel of its commit.
+              if [[ "${VERSION_SUFFIX}" == -dev && "${REF}" != refs/heads/nightly ]]; then
+                echo "::error::a dev version is published from the nightly branch, not ${REF}."
+                exit 1
+              fi
+              # Keeps the nightly branch to dev versions. This runs from the
+              # dispatched ref's copy of the workflow, so the environment's
+              # reviewers check what that copy does.
+              if [[ "${REF}" == refs/heads/nightly && "${VERSION_SUFFIX}" != -dev ]]; then
+                echo "::error::the nightly branch publishes dev versions only, with version_suffix -dev."
                 exit 1
               fi
               if [[ "${VERSION_SUFFIX}" == -rc.* && "${REGISTRY}" == production ]]; then
@@ -145,22 +159,32 @@ jobs:
         unset SCCACHE_BUCKET SCCACHE_S3_KEY_PREFIX
         CONDA_ENV=$(conda env list --json | jq -r '.envs | .[-1]')
         conda activate "${CONDA_ENV}"
+        suffix="${{ needs.plan.outputs.suffix }}"
+        # A tag names its version, and a dispatch appends its suffix to
+        # version.txt, except that -dev also takes the commit's date.
+        expected="${{ needs.plan.outputs.version }}"
+        expected="${expected:-$(cat version.txt)${suffix}}"
+        # Before the build: a dev version's users install the nightly wheels of
+        # its commit.
+        if [[ "${suffix}" == -dev ]]; then
+          expected=$(bash examples/espressif/build_idf_component.sh --version --version-suffix -dev)
+          bash .ci/scripts/test_espressif_idf_nightly.sh wheel "${RUNNER_ARTIFACT_DIR}" \
+            "${expected}" "$(git rev-parse HEAD)"
+        fi
         source .ci/scripts/utils.sh
         install_executorch --use-pt-pinned-commit --minimal
         if [[ "${{ needs.plan.outputs.rehearsal }}" == true ]]; then
           # A pull request rehearses the release stamp at a throwaway local tag.
           git tag -f "v$(cat version.txt)"
         fi
-        # A tag names its version; a dispatch appends its suffix to version.txt.
-        expected="${{ needs.plan.outputs.version }}"
-        expected="${expected:-$(cat version.txt)${{ needs.plan.outputs.suffix }}}"
         bash .ci/scripts/test_espressif_idf_nightly.sh prepare "${RUNNER_ARTIFACT_DIR}" \
-          --version-suffix "${{ needs.plan.outputs.suffix }}"
+          --version-suffix "${suffix}"
         version=$(cat "${RUNNER_ARTIFACT_DIR}/version")
         if [[ "${version}" != "${expected}" ]]; then
           echo "FAIL: generated version ${version}, expected ${expected}" >&2
           exit 1
         fi
+        bash .ci/scripts/test_espressif_idf_nightly.sh torch "${RUNNER_ARTIFACT_DIR}"
         echo "Packed pytorch/executorch ${version}"
         # Nothing downstream reads the unpacked component.
         rm -r "${RUNNER_ARTIFACT_DIR}/component"
 
@@ -43,8 +43,9 @@ both with `executorch_add_model` and `executorch_add_kernels` (see the
 component's `README.md`). Application pipelines built on the runtime
 (for example wake word front ends and detectors) stay with the
 application.
-Consumers need ESP-IDF, plus the `executorch` Python package of the
-same release to make kernel bundles — no host CMake build, no flatc.
+Consumers need ESP-IDF, plus the `executorch` Python package the
+component was built from to make kernel bundles (see the component's
+`README.md`) — no host CMake build, no flatc.
 `idf_component_smoke/` is a minimal consumer that CI generates, builds
 and runs on the emulator (`.ci/scripts/test_espressif_idf_component.sh`).
 `idf_component_consumer/` builds the same app from the packed component
@@ -87,6 +88,16 @@ serves the tested files, and runs it on the emulator.
   cannot hold `~`); the tag publishes it to staging, then production. A
   release whose publishing failed in CI is published as a respin once the
   CI is fixed.
+- A dev version, `X.Y.Z-dev.YYYYMMDD`, lets projects use the component
+  before a release. Run the workflow on the `nightly` branch with
+  `version_suffix` `-dev`, `registry` `production` and `dry_run` cleared,
+  between 00:00 UTC and the next nightly (around 11:30 UTC), so that it
+  publishes the last nightly of a finished day. Projects resolve from
+  production, where a version range picks up a pre-release only if it opts
+  in. The run publishes only if that day's ExecuTorch nightly wheels, for
+  every platform and Python, were built from the same commit, because
+  projects install them to make their kernel bundles. Before the first dev
+  upload, run it once with `dry_run` left set, so its packing has run.
 - A manual run only validates unless `dry_run` is cleared. With `registry`
   `production`, it uploads to staging first. A run that uploads nothing
   rehearses the staging upload with `--dry-run`.
@@ -106,23 +117,31 @@ names this repository, this workflow and that environment, so no other job
 can upload with the repository's GitHub identity. Before approving an upload,
 check that the run's ref and commit are the release's announced tag and
 commit, or for a respin, that its tag's commit is on `release/X.Y` and
-its changes since `vX.Y.Z` were reviewed. Before approving the staging upload,
-dispatch the nightly matrix (`nightly-espressif-idf.yml`) on the tag and
-wait for its macOS and Windows configure jobs to pass; a failure on
-ESP-IDF master, which breaks on its own schedule, is advisory. Approve the
-production upload once `executorch` X.Y.Z is on PyPI, since a project
-needs it to make kernel bundles, and the release owner has built a
-project against the version on staging.
+its changes since `vX.Y.Z` were reviewed. A dev version's run comes from
+the `nightly` branch, whose copy of this workflow is main's and enforces
+its own limits, so before approving one, also review what changed in
+`publish-espressif-idf.yml` and `.ci/scripts/upload_espressif_idf_component.sh`
+since the last approved dev run. Before approving the staging upload of a
+release or RC, dispatch the nightly matrix (`nightly-espressif-idf.yml`) on
+the tag and wait for its macOS and Windows configure jobs to pass; a
+failure on ESP-IDF master, which breaks on its own schedule, is advisory.
+A dev version has only its own run's checks. Approve the production upload
+of a release once `executorch` X.Y.Z is on PyPI, since a project needs it
+to make kernel bundles, and the release owner has built a project against
+the version on staging; a dev version's run has already checked its
+nightly wheels.
 
 The one-time setup goes in this order, because GitHub creates a missing
 environment, unprotected, as soon as a workflow names it:
 
 1. Add rulesets that let only release managers create, update or delete
    `v*` tags, since the environment trusts them, and `release/*` branches,
-   which respin tags must be on.
+   which respin tags must be on, and only the account that pushes the
+   nightly branch update or delete `nightly`, which the environment trusts
+   for dev versions.
 2. Create the `esp-component-registry` environment with required
    reviewers, self-review prevented, no admin bypass, and deployments
-   limited to `v*` tags.
+   limited to `v*` tags, plus `nightly` before the first dev version.
 3. Create the `pytorch` namespace on the staging registry, which takes
    namespace requests of its own, apart from the production registry's.
 4. On each registry, add a trusted uploader to `pytorch/executorch` (in