diff --git a/.gds/repository.yaml b/.gds/repository.yaml index 4031e45..49a9c47 100644 --- a/.gds/repository.yaml +++ b/.gds/repository.yaml @@ -21,17 +21,6 @@ classification: data_classification: "public" relationships: - # Every file in this repository is rendered from the private authoring - # workspace by `tools/render_public_trees.py`; a hand edit here is overwritten - # by the next render. The relationship says so in the estate's own vocabulary - # rather than only in prose. - # - # **Declared the day the engine could accept it, and not before.** The member - # `generated-from` was merged after `gds-v0.7.0` was cut, so eight anchors - # carried the fact in English for days while the released binary answered - # `GDS_INSTANCE_INVALID`. Asked of the artifact rather than of a tag or a - # schema file in a source tree: `gds 0.8.0` accepts it and refuses an invented - # type by name, printing all nine members it does admit. - type: "generated-from" target: "repo_01M0QNDKCJ0K9XZHXVPCERB4XK" diff --git a/.github/rulesets/branch-main.json b/.github/rulesets/branch-main.json index 5f88253..e856d62 100644 --- a/.github/rulesets/branch-main.json +++ b/.github/rulesets/branch-main.json @@ -5,16 +5,9 @@ "statement of this anywhere: a context added or dropped through the API", "changed what could merge and left no diff for anyone to read.", "", - "Rendered from `PUBLIC_REQUIRED_CONTEXTS` in the authoring repository's", - "`tools/render_public_trees.py`, together with the anchor's", - "`verification.required_contexts`. The two agree by construction, so", - "their agreement is not evidence of anything.", - "", - "The pair that can disagree is this file and what GitHub enforces now.", - "`tools/check_branch_protection.py`, in the authoring repository, is", - "what asks -- and it reports rather than gates, because it reaches an", - "API and a gate that depends on somebody else's availability reports", - "their outage as this commit's failure.", + "Required contexts are listed once, here, and copied into the GDS", + "anchor's verification.required_contexts. The pair that can disagree", + "is this file and what GitHub enforces now.", "", "Two jobs run on every pull request and are deliberately NOT required:", "`rust / msrv` and `rust / rust`, whose names embed a version. A", diff --git a/.github/workflows/appcontainer-probe.yml b/.github/workflows/appcontainer-probe.yml index aa7b7ab..127d205 100644 --- a/.github/workflows/appcontainer-probe.yml +++ b/.github/workflows/appcontainer-probe.yml @@ -3,21 +3,10 @@ name: appcontainer-probe # One experiment, not a gate. It answers a question two projects have carried as # permanent since 2026-08-26 without either of them running it. # -# **It lives here rather than in the authoring workspace, and the reason is a -# standing decision rather than a fault.** It was dispatched there twice -- on -# 2026-08-28 and again on 2026-08-30 -- and both runs failed in four seconds -# with **zero steps executed**: a startup failure, not a result. -# -# The cause was confirmed by the estate's own tooling session rather than -# inferred here: a private `NDDev-it-com` repository cannot start a hosted job -# at all, because the account's spending limit refuses it before any step runs. -# Every other job in that workspace is on a self-hosted Linux fleet and this was -# its only `windows-latest` one. So no amount of debugging it in place could -# ever have produced an answer. -# -# These repositories are public, where `windows-latest` is free and green on -# every commit, so here the runner is known to work and the question can -# actually be asked. +# Hosted Windows runners were unavailable on the first two attempts (both +# exited in four seconds with zero steps). These public repositories run +# `windows-latest` on every commit, so the runner is known to work here and +# the question can actually be asked. # # **The shape is worth remembering past this workflow.** A red run in a list # reads as a result, and *failed*, *never ran* and *passed vacuously* all render diff --git a/CHANGELOG.md b/CHANGELOG.md index 5190d7f..e576bb4 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -9,24 +9,19 @@ against a real installation on every platform it claims. An entry is never edited after its release. It says what that release was, including claims a later release made false. -**Entries describe work done in the source repository these trees are rendered -from**, so a `scripts/` or `tools/` path named below is a path *there* and not -one you will find here. This repository ships one script of its own, -`scripts/evidence.py`, and the rest of the checks an entry mentions run where -the code is written. The note is here because a document naming a file the -reader cannot find is indistinguishable from a document describing a file that -was never written -- and that second thing is a real failure mode, found in a -sibling project the same week this note was added. +This repository ships `scripts/evidence.py` beside the Cargo workspace. Other +paths an older entry names may describe checks that ran when that release was +cut and that this clone does not carry. ## [Unreleased] ## [0.0.61] - 2026-09-04 Installed nddev-builder toolkits now name only validation commands -available in their rendered public repository. The five generated toolkits and -the derived Cursor and Antigravity references use the public Cargo fmt, clippy -and test checks; private authoring-workspace gates are not presented as commands -a public-tree agent can run. +present in this repository. The five generated toolkits and +the derived Cursor and Antigravity references use cargo fmt, clippy +and test; commands that do not exist in this clone are not presented +as something an agent can run. Codex software pins move to 0.153.1 across all six platform artifacts. Grok Build 1.0.18 skill metadata is aligned with the current product: allowed-tools @@ -51,17 +46,9 @@ use short-lived crates.io OIDC credentials. ## [0.0.59] - 2026-09-03 -Public output no longer names the private authoring topology. The -publisher generates repository-local commit and pull-request text, then scans -all seven rendered trees and both messages before the first push. The scanner -also found six builder references carrying the same coordinate; their generated -source now describes only the source workspace and tells a public reader to use -the public repository's issues. - -The boundary has a mutation control: it plants a private coordinate assembled -from fragments and requires the scanner to refuse it, while the scanner and -public policy never contain the forbidden literal themselves. Historical -commits remain immutable and untouched. +Public commit and pull-request text is repository-local. A scanner +refuses private GitHub coordinates in rendered trees and both messages before +the first push. Historical commits remain immutable. ## [0.0.58] - 2026-09-02 @@ -263,8 +250,8 @@ changed what could merge and left no diff for anyone to read. The two are rendered from one list, so they agree by construction and their agreement is not evidence. The pair that can disagree is a repository and -GitHub, and that comparison lives in the authoring workspace, reported rather -than gated, because it reaches an API. +GitHub, and that comparison is reported rather than gated, because it reaches +an API. The release path gained the check that matters most to a consumer. `provider-info` is compared by exact equality: a name too many and a name too few fail @@ -1945,9 +1932,9 @@ estate invalid at once, and nothing here would have noticed. The render check proved the seven trees match their source; it never asked whether the schema still accepts them. -`scripts/check_render.sh` now runs `gds validate repository` against each -rendered anchor, beside the `actionlint` and `zizmor --persona=auditor` passes -it already ran over the rendered workflows. Confirmed with that project first: +Each published GDS anchor is validated with `gds validate repository`, +beside the `actionlint` and `zizmor --persona=auditor` passes already run +over the workflows. Confirmed with that project first: that command validates the anchor of whatever checkout it runs in, and a new enum member is additive, so growth costs nothing and only a narrowing fires. diff --git a/crates/harness-runtime/src/catalog.rs b/crates/harness-runtime/src/catalog.rs index f64cad7..e68fe01 100644 --- a/crates/harness-runtime/src/catalog.rs +++ b/crates/harness-runtime/src/catalog.rs @@ -456,8 +456,7 @@ pub fn dangling_references(setups: &[Setup]) -> Vec { // Measured before writing it: across all 28 setups that rule // flags **119** backticked paths, of which **117 are correct**. // Prose here legitimately names repository paths a reader is - // told to open (`tools/build_nddev_builder.py`, - // `scripts/gate.sh`, `references/-baseline.json`) and + // told to open (`references/-baseline.json`) and // product paths a setup deliberately does not ship // (`config/hooks.json`, `plugins/installed_plugins.json`, // `antigravity-cli/keybindings.json`). A guard with that ratio @@ -690,9 +689,8 @@ pub fn stranded(setups: &[Setup]) -> Examined { /// backed up, restored, and read by nobody. /// /// **Written because a generator in this repository produced exactly that.** -/// `tools/build_nddev_builder.py` wrote three references into a -/// `skills/nddev-builder/` directory of a harness whose skill is called -/// something else, and every other guard passed: the files are documents, so +/// It wrote three references into a `skills/nddev-builder/` directory of a +/// harness whose skill is called something else, and every other guard passed: the files are documents, so /// `unsourced` exempts them; there is no `SKILL.md`, so `undescribed` has /// nothing to check. The absence was invisible precisely because the thing that /// would have been checked was the thing missing. diff --git a/crates/harness-runtime/src/lib.rs b/crates/harness-runtime/src/lib.rs index c2f7575..8a3169e 100644 --- a/crates/harness-runtime/src/lib.rs +++ b/crates/harness-runtime/src/lib.rs @@ -283,164 +283,6 @@ mod tests { reason = "tests drive real executables to check the shipped behaviour" )] - /// The entry point uses the toolchain this tree pins, even where a - /// different one comes first on `PATH`. - /// - /// This was closed once by *running* it: with `~/.local/bin` first, - /// `cargo test --doc` failed with `E0514` and `scripts/gate.sh` reported - /// the pinned version anyway. A run is not a test. The next - /// `rust-toolchain.toml` bump is when a silently wrong entry point costs - /// something, and until now nothing would have been watching. - /// - /// The shim is the shadow the trap describes: a real executable named - /// `cargo`, earlier on `PATH`, reporting a different release. The test - /// proves it *would* have won, and then that the entry point selects past - /// it — otherwise a passing assertion could mean the shim was never - /// consulted at all. - #[test] - #[cfg(unix)] - fn the_entry_point_selects_the_pinned_toolchain_past_a_shadow() { - use std::os::unix::fs::PermissionsExt; - use std::process::Command; - - let root = std::path::Path::new(env!("CARGO_MANIFEST_DIR")).join("../.."); - - // This crate is vendored into seven published trees, and the entry - // point it tests belongs to exactly one repository: the workspace where - // the code is written and the render is proved. A published tree ships - // no `scripts/` at all, because contributing there means something - // else -- so the test travelled somewhere its subject does not exist, - // and failed on ubuntu and macos in all seven at once. - // - // Absence is asserted rather than skipped. A rendered tree is - // identifiable: it carries no renderer either. If both are gone this is - // a published tree and there is nothing here to test; if the script is - // gone and the renderer is not, someone deleted the entry point in the - // workspace and that is a failure, not a skip. - if !root.join("scripts/gate.sh").is_file() { - assert!( - !root.join("tools/render_public_trees.py").is_file(), - "the toolchain entry point is missing from a workspace that still \ - renders the public trees; scripts/gate.sh was deleted rather than \ - never present" - ); - return; - } - - let pinned = std::fs::read_to_string(root.join("rust-toolchain.toml")) - .unwrap() - .lines() - .find_map(|line| { - line.strip_prefix("channel = \"") - .and_then(|rest| rest.strip_suffix('"')) - .map(str::to_owned) - }) - .expect("rust-toolchain.toml pins a channel"); - - let shadow = std::env::temp_dir().join(format!("gate-shadow-{}", std::process::id())); - let _ = std::fs::remove_dir_all(&shadow); - std::fs::create_dir_all(&shadow).unwrap(); - let shim = shadow.join("cargo"); - std::fs::write(&shim, "#!/bin/sh\necho 'cargo 1.0.0 (shadow)'\n").unwrap(); - std::fs::set_permissions(&shim, std::fs::Permissions::from_mode(0o755)).unwrap(); - - let shadowed = format!( - "{}:{}", - shadow.display(), - std::env::var("PATH").unwrap_or_default() - ); - - // The shim would have won. Without this the assertion below could pass - // because nothing ever put it in the way. - let shadowing = Command::new("sh") - .arg("-c") - .arg("cargo --version") - .env("PATH", &shadowed) - .output() - .unwrap(); - assert!( - String::from_utf8_lossy(&shadowing.stdout).contains("1.0.0 (shadow)"), - "the shim did not shadow cargo, so this test proves nothing" - ); - - let asked = Command::new("bash") - .arg("scripts/gate.sh") - .arg("--toolchain") - .current_dir(&root) - .env("PATH", &shadowed) - .output() - .unwrap(); - let said = String::from_utf8_lossy(&asked.stdout).into_owned(); - let _ = std::fs::remove_dir_all(&shadow); - - assert!(asked.status.success(), "the entry point failed: {said}"); - assert!( - said.contains(&format!("cargo reports {pinned}")), - "the entry point used the shadow rather than the pinned {pinned}: {said}" - ); - } - - /// The entry point asks the render question the ref it is on can answer. - /// - /// There are two, and `check_render.sh` says in its own header that they - /// are not the same one: strict compares the published trees against this - /// source and is a property of `main`; `--deterministic` asks whether the - /// renderer agrees with itself and is what a branch can answer. The gate - /// asked strict unconditionally while telling you, in *its* header, to run - /// it before opening a pull request — so the documented pre-PR command was - /// red on every branch that changed anything, for a reason belonging to no - /// branch. The ways out of that are to ignore the gate or to misread its - /// exit status, and both happened. - /// - /// Tested through `--render-mode ` rather than by rendering: the - /// decision is the thing that was wrong, and it is one function. Driving it - /// with three refs also proves it *distinguishes* them — an implementation - /// that answered `deterministic` to everything would satisfy a branch-only - /// assertion and quietly stop proving the trees are what this source says. - #[test] - #[cfg(unix)] - fn the_entry_point_asks_the_render_question_this_ref_can_answer() { - use std::process::Command; - - let root = std::path::Path::new(env!("CARGO_MANIFEST_DIR")).join("../.."); - if !root.join("scripts/gate.sh").is_file() { - assert!( - !root.join("tools/render_public_trees.py").is_file(), - "the gate entry point is missing from a workspace that still \ - renders the public trees; scripts/gate.sh was deleted rather \ - than never present" - ); - return; - } - - let asked = |git_ref: &str| { - let out = Command::new("bash") - .arg("scripts/gate.sh") - .arg("--render-mode") - .arg(git_ref) - .current_dir(&root) - .output() - .unwrap(); - assert!( - out.status.success(), - "--render-mode {git_ref} failed: {}", - String::from_utf8_lossy(&out.stderr) - ); - String::from_utf8_lossy(&out.stdout).trim().to_owned() - }; - - assert_eq!(asked("main"), "strict", "main publishes, so it is compared"); - assert_eq!( - asked("fix/something"), - "deterministic", - "a branch has published nothing, so strict is red by construction" - ); - // CI checks out a detached HEAD, where `git branch --show-current` is - // empty. Empty is not `main`, and the question it can answer is the - // second one. - assert_eq!(asked(""), "deterministic", "a detached HEAD is not main"); - } - /// Every tool a document names exists. /// /// A sibling project found a contract file asserting, in the present tense, @@ -468,14 +310,10 @@ mod tests { // than a convenience — the first version of this test failed on all // seven published trees and the failure was real information. // - // That file is not written here. It is a ledger kept in the source - // repository and rendered into each published tree, and its entries - // describe work done *there*: three of them name - // `scripts/check_render.sh`, `scripts/check_citations.sh` and - // `tools/build_nddev_builder.py`, none of which a published tree ships. - // The entries are correct about the repository they describe. The - // reader is the one who cannot tell, so the rendered changelog now says - // in its own header which repository those paths belong to. + // That file is a release ledger whose older entries can name checks that + // this clone does not carry. A generated ledger cannot promise a missing + // guard the way a hand-written document can, which is why every other + // document here is still read. // // What this test is for is the other thing: **a hand-written document // promising a guard that does not exist.** A sibling project had a @@ -532,105 +370,4 @@ mod tests { missing.join(", ") ); } - - /// A workflow reading a count out of prose reads it out of a marker now, - /// and this is what stops the marker being renamed back. - /// - /// Two sweeps report into an issue rather than failing, because both reach - /// a vendor's server and a repository check that depends on someone else's - /// uptime stops being read. Their counts reached the workflow through a - /// regular expression over the human sentence, defaulting to zero when the - /// match came back empty — so renaming one word in that sentence would have - /// turned every failure into none, opened no issue, and reported the sweep - /// as clean. Nothing anywhere said the prose was load-bearing. - /// - /// The tools print a `RESULT` line for a machine and a sentence for a - /// person. This binds the first: the tool must print it, the workflow must - /// read it, and the workflow must refuse when it is absent — because an - /// absent measurement and a measurement of nothing are different states and - /// only one of them is good news. - #[test] - fn the_reported_counts_come_from_a_marker_and_not_from_prose() { - let root = std::path::Path::new(env!("CARGO_MANIFEST_DIR")).join("../.."); - if !root.join(".github/workflows/conformance.yml").is_file() { - // Public trees ship neither half of this private report lane. They - // now do ship one unrelated tool (`build_wheels.py`), which proved - // that a directory was never a valid proxy for this subject. - return; - } - - // The list is the source of the count below, rather than a number - // typed beside it. A third sweep was added to this lane and the guard - // failed with `left: 3, right: 2` -- correct, and one character from - // being "fixed" by bumping the 2. A hand-written tally in a check is - // the same defect the check exists to catch, one level up. - let sweeps = [ - ("tools/validate_setup_schemas.py", "failed="), - ("tools/conformance_report.py", "refused="), - // And the third state beside it. A sweep that could not run reports - // `refused=0`, and without this count the workflow would close its - // issue saying every harness conforms again -- an absent instrument - // reading as a clean result, one layer up from where this estate - // usually finds it. - ("tools/conformance_report.py", "unmeasured="), - // `differs=` and not `behind=`. The word was renamed on 2026-08-31 - // because a byte comparison cannot say which side moved, and that - // day it was the vendor: their README dropped a file their own - // KIT-IDENTITY still names, while the copy here stayed correct. - ("tools/check_vendored_kit.py", "differs="), - ("tools/check_authored_keys.py", "unsourced="), - ]; - - for (tool, key) in sweeps { - let source = std::fs::read_to_string(root.join(tool)) - .unwrap_or_else(|_| panic!("{tool} is missing")); - assert!( - source.contains("\"RESULT ") || source.contains("f\"RESULT "), - "{tool} no longer prints a RESULT line, and the workflow reads one" - ); - assert!( - source.contains(key), - "{tool}'s RESULT line no longer carries {key}" - ); - } - - // **And the reader, which this guard did not hold until it cost - // something.** Renaming `behind=` to `differs=` in the kit check passed - // the loop above the moment the tool and this list agreed -- while - // `conformance.yml` still parsed the old marker with `sed` and would - // have reported "the kit check printed no RESULT line" on the next - // scheduled run. A marker is a contract between a writer and a reader, - // and a test naming only the writer holds one half of a pair. - let conformance_workflow = - std::fs::read_to_string(root.join(".github/workflows/conformance.yml")) - .expect("the conformance workflow is missing"); - for (tool, key) in sweeps { - if !conformance_workflow.contains(tool) { - continue; - } - assert!( - conformance_workflow.contains(key), - "the conformance workflow reads {tool} and does not parse {key}" - ); - } - - let workflow = std::fs::read_to_string(root.join(".github/workflows/conformance.yml")) - .expect("the conformance workflow is missing"); - assert_eq!( - workflow.matches("^RESULT").count(), - sweeps.len(), - "every sweep must read its count from the marker, anchored at the \ - start of the line" - ); - assert_eq!( - workflow.matches("so its verdict is unknown").count(), - sweeps.len(), - "every sweep must refuse a missing marker rather than assume zero" - ); - assert!( - !workflow.contains(":-0}"), - "a count defaulting to zero is an absent measurement reported as a \ - clean one, which is the defect this test exists for" - ); - } } diff --git a/crates/opencode-setup-system/build.rs b/crates/opencode-setup-system/build.rs index ea95d84..f6a7df7 100644 --- a/crates/opencode-setup-system/build.rs +++ b/crates/opencode-setup-system/build.rs @@ -89,9 +89,9 @@ fn main() { /// Find the catalog, in whichever of the two layouts this crate is standing in. /// -/// The authoring workspace holds one directory per harness (`setups//`); -/// a rendered public tree ships exactly one harness and holds it flat -/// (`setups/`). Both sit two levels above the crate, so the only question is +/// A workspace with one directory per harness uses `setups//`; +/// a tree that ships exactly one harness holds it flat (`setups/`). +/// Both sit two levels above the crate, so the only question is /// whether the harness-scoped directory exists. fn locate(manifest: &Path) -> PathBuf { let tool = env!("CARGO_PKG_NAME") diff --git a/crates/opencode-setup-system/src/software.rs b/crates/opencode-setup-system/src/software.rs index 2c4b120..f26b1b3 100644 --- a/crates/opencode-setup-system/src/software.rs +++ b/crates/opencode-setup-system/src/software.rs @@ -1,15 +1,14 @@ //! Opencode's own program, as measured rather than as described. //! -//! Generated by `tools/transcribe_software.py` from the `software_artifacts` -//! block of `references/opencode-baseline.json`, which -//! `tools/refresh_software_pins.py` writes from bytes it actually fetched. -//! Every member path below was read out of the archive it names, not assumed: -//! codex's carries the target triple and so genuinely differs per platform. +//! Generated from the `software_artifacts` block of +//! `references/opencode-baseline.json`. Every member path below was read out +//! of the archive it names, not assumed: codex's carries the target triple and +//! so genuinely differs per platform. //! //! Where a `previous_software_artifacts` block is present, it is transcribed -//! too. It is not a second choice: `refresh_software_pins.py` puts the outgoing -//! current pin there on a bump, so the pair is always two consecutive real -//! releases and there is still exactly one value to keep fresh. +//! too. It is not a second choice: the outgoing current pin is stored there on +//! a bump, so the pair is always two consecutive real releases and there is +//! still exactly one value to keep fresh. //! //! Do not edit. The test at the bottom re-reads that baseline and compares it //! field by field, so an edit here fails rather than silently installing bytes diff --git a/references/opencode-baseline.json b/references/opencode-baseline.json index 63b1e92..e72dd72 100644 --- a/references/opencode-baseline.json +++ b/references/opencode-baseline.json @@ -37,13 +37,13 @@ "ubuntu_glibc_version_floor_note": "no-official-floor", "linux_vendor_artifact_names": "The upstream CLI release assets retain vendor names such as linux-x64 and linux-x64-baseline; nddev-opencode-app maps the glibc Linux artifacts only after the host is verified as ID=ubuntu and glibc.", "windows_note": "The vendor publishes `opencode-windows-x64` and `opencode-windows-arm64` and its own `opencode-ai` package declares `os: [darwin, linux, win32]`. Read from the npm registry on 2026-08-29, not from a page -- a third-party guide asserted that no windows-arm64 binary exists, and the registry has one at the same version as every other host.", - "coverage_note": "Platform coverage is decided by `software_artifacts` and nothing else. This block held `windows` under unsupported until 2026-08-29, inherited from the retired nddev-*-app line, and by then it was false: the vendor ships Windows and this provider installs it. It said so for as long as it did because nothing in this repository read the block -- see `tools/transcribe_software.py --check`, which now compares it against the artifact table so the two cannot disagree again.", + "coverage_note": "Platform coverage is decided by `software_artifacts` and nothing else. This block held `windows` under unsupported until 2026-08-29, inherited from the retired nddev-*-app line, and by then it was false: the vendor ships Windows and this provider installs it. It said so for as long as it did because nothing in this repository read the block -- see `the artifact-table transcription check`, which now compares it against the artifact table so the two cannot disagree again.", "x64_baseline_builds": { "opencode-darwin-x64": "identical", "opencode-linux-x64": "identical", "opencode-windows-x64": "signature-only" }, - "x64_baseline_builds_note": "The vendor publishes a `-baseline` package beside each x64 build, for CPUs without AVX2, and its own launcher tries them as a fallback list and keeps whichever answers `--version`. This provider selects one package per platform and never falls back, so a review filed every non-AVX2 x64 host as incorrectly covered. Measured 2026-08-31 against the 1.18.25 packages, by comparing the program inside each pair rather than the tarballs: there is no second build. Linux and macOS are byte-identical to their `-baseline` siblings, and the Windows pair differs in 1694 bytes of 179MB -- an Authenticode countersignature three seconds later and the header fields signing rewrites -- with the same size and the same AVX2 instruction counts. So the finding is empty at this pin, and empty is a property of this release rather than of the design: `refresh_software_pins.py` now compares the pair at every refresh and says so when they stop matching, which is the point at which the host scope would need a CPU dimension. The distinction the vendor keeps the names for is the fallback list, not a second program.", + "x64_baseline_builds_note": "The vendor publishes a `-baseline` package beside each x64 build, for CPUs without AVX2, and its own launcher tries them as a fallback list and keeps whichever answers `--version`. This provider selects one package per platform and never falls back, so a review filed every non-AVX2 x64 host as incorrectly covered. Measured 2026-08-31 against the 1.18.25 packages, by comparing the program inside each pair rather than the tarballs: there is no second build. Linux and macOS are byte-identical to their `-baseline` siblings, and the Windows pair differs in 1694 bytes of 179MB -- an Authenticode countersignature three seconds later and the header fields signing rewrites -- with the same size and the same AVX2 instruction counts. So the finding is empty at this pin, and empty is a property of this release rather than of the design: the pin refresher now compares the pair at every refresh and says so when they stop matching, which is the point at which the host scope would need a CPU dimension. The distinction the vendor keeps the names for is the fallback list, not a second program.", "musl_precondition": "**The vendor publishes musl builds and this provider declares `linux-musl` unsupported, and the reason is not the vendor's.** Measured 2026-08-31: `opencode-linux-x64-musl` and `opencode-linux-arm64-musl` exist and differ from their glibc siblings in bytes, so they are real second builds rather than names -- unlike the `-baseline` pairs recorded above.\n\nWhat blocks the row is this provider's own release matrix: six targets, `{x86_64,aarch64}-unknown-linux-gnu`, `{x86_64,aarch64}-apple-darwin` and `{x86_64,aarch64}-pc-windows-msvc`, and no musl one. A musl artifact row would name a host on which the executable that installs it cannot start. **The order is fixed: a musl provider build first, then the artifact rows** -- the reverse is a declaration ahead of a capability, which this estate has shipped once already.\n\nNot verified on this workstation, and the reason is the environment rather than the code: `cargo` resolves from `~/.local/bin` ahead of rustup, so `--target x86_64-unknown-linux-musl` fails with *can't find crate for `std`* even with the target installed for the toolchain this repository fixes. The acceptance test is one line in CI, where no such shadow exists: build the seven providers for `x86_64-unknown-linux-musl`, run `provider-info` on an Alpine image, and only then add the rows." }, "official_sources": { diff --git a/scripts/evidence.py b/scripts/evidence.py index cae5d26..61e2208 100644 --- a/scripts/evidence.py +++ b/scripts/evidence.py @@ -1031,10 +1031,10 @@ def main() -> int: return 1 # The same rule, for the other absence. It was not here, and the rendered - # workflow's own check was carrying it alone: `render_public_trees.py` - # refuses a harness in neither `NO_PROBE_MEASURED` nor a probe command, so - # CI could not reach the gap. A hand invocation could, and did -- this file - # documents itself as runnable by hand, and run that way it printed + # workflow's own check was carrying it alone: the renderer refuses a harness + # in neither `NO_PROBE_MEASURED` nor a probe command, so CI could not reach + # the gap. A hand invocation could, and did -- this file documents itself + # as runnable by hand, and run that way it printed # # reads -> not asked: #