[Homebrew/ABI] Prepare one verified ABI 42 package generation

.github/workflows/browser-demos-ci.yml

@@ -61,7 +61,7 @@ jobs:
         run: |
           npx playwright test \
             test/coi.spec.ts \
-            test/browser-kernel-lazy-registration.spec.ts \
+            test/package-deferred-tree-browser.spec.ts \
             test/wasm-trap-signal.spec.ts \
             --project=chromium \
             --project=firefox \

.github/workflows/homebrew-main-shell-ci.yml

@@ -217,12 +217,91 @@ jobs:
             npx playwright install chromium --with-deps
           )
 
-      - name: Resolve current direct browser bundling inputs and build the exact candidate kernel
+      - name: Select one verified package generation
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           set -euo pipefail
           abi=$(sed -nE 's/^pub const ABI_VERSION: u32 = ([0-9]+);$/\1/p' \
             crates/shared/src/lib.rs)
-          export WASM_POSIX_BINARY_INDEX_URL="https://github.com/Automattic/kandelo/releases/download/binaries-abi-v${abi}/index.toml"
+          [[ "$abi" =~ ^[0-9]+$ ]]
+          canonical_url="https://github.com/${GITHUB_REPOSITORY}/releases/download/binaries-abi-v${abi}/index.toml"
+          selected_url="$canonical_url"
+
+          if [ "$GITHUB_EVENT_NAME" = pull_request ]; then
+            pr_number=$(jq -er '.pull_request.number' "$GITHUB_EVENT_PATH")
+            [[ "$pr_number" =~ ^[1-9][0-9]*$ ]]
+            target_tag="pr-${pr_number}-staging"
+            expected="$RUNNER_TEMP/homebrew-main-shell-staging-expected.json"
+            snapshot="$RUNNER_TEMP/homebrew-main-shell-staging-snapshot"
+
+            # WHY: an ABI bump has no canonical package release yet. Reuse the
+            # parallel staging build only after proving it is a complete,
+            # exact-current generation; accepting a partial mutable index would
+            # mix packages from different builds or silently source-build gaps.
+            if bash scripts/dev-shell.sh env \
+                EXPECTED="$expected" \
+                SNAPSHOT="$snapshot" \
+                TARGET_TAG="$target_tag" \
+                ABI="$abi" \
+                bash -c '
+                  set -euo pipefail
+                  host_target=$(rustc -vV | awk "/^host/ {print \$2}")
+                  cargo build --release -p xtask --target "$host_target"
+                  xtask="target/$host_target/release/xtask"
+                  "$xtask" staging-reuse expected \
+                    --registry packages/registry \
+                    --expected-abi "$ABI" \
+                    --exclude erlang-vfs,perl,perl-vfs,python-vfs,redis,texlive \
+                    --output "$EXPECTED"
+                  bash .github/scripts/validate-staging-release.sh \
+                    --tag "$TARGET_TAG" \
+                    --expected-ledger "$EXPECTED" \
+                    --mode current \
+                    --output-dir "$SNAPSHOT" \
+                    --xtask "$xtask"
+                '; then
+              frozen_index="$snapshot/frozen-index.toml"
+              target_index_url="https://github.com/${GITHUB_REPOSITORY}/releases/download/${target_tag}/index.toml"
+              # WHY: index freezing consumes only the bytes already validated
+              # above. Remove network credentials so this pure transformation
+              # cannot accidentally grow an authenticated code path.
+              env -u GH_TOKEN -u GITHUB_TOKEN \
+                -u HOMEBREW_GITHUB_API_TOKEN \
+                -u HOMEBREW_GITHUB_PACKAGES_TOKEN \
+                bash scripts/dev-shell.sh env \
+                SOURCE_INDEX="$snapshot/source-index.toml" \
+                FROZEN_INDEX="$frozen_index" \
+                TARGET_INDEX_URL="$target_index_url" \
+                ABI="$abi" \
+                bash -c '
+                  set -euo pipefail
+                  host_target=$(rustc -vV | awk "/^host/ {print \$2}")
+                  xtask="target/$host_target/release/xtask"
+                  # WHY: the PR release tag remains mutable. Keep the validated
+                  # index bytes local while rewriting relative archive names to
+                  # their exact release URLs; archive hashes still fail closed.
+                  "$xtask" index-candidate seed \
+                    --canonical-index "$SOURCE_INDEX" \
+                    --candidate-index "$FROZEN_INDEX" \
+                    --canonical-index-url "$TARGET_INDEX_URL" \
+                    --expected-abi "$ABI" \
+                    --generated-at "1970-01-01T00:00:00Z" \
+                    --generator "Homebrew main-shell frozen staging generation"
+                '
+              selected_url="file://${frozen_index}"
+              echo "Using complete verified package generation from $target_tag"
+            else
+              echo "Complete current $target_tag generation is unavailable; using canonical/source fallback"
+            fi
+          fi
+
+          echo "WASM_POSIX_BINARY_INDEX_URL=$selected_url" >> "$GITHUB_ENV"
+
+      - name: Resolve current direct browser bundling inputs and build the exact candidate kernel
+        run: |
+          set -euo pipefail
+          test -n "${WASM_POSIX_BINARY_INDEX_URL:-}"
           # Vite resolves static @binaries imports across the wider demo app.
           # Derive those registry roots from the imports and package manifests
           # so adding an import cannot silently leave this browser proof stale.

.github/workflows/reusable-homebrew-bottle-publish.yml

@@ -96,6 +96,27 @@ jobs:
             return 2
           }
 
+          normalize_write_kandelo_ref() {
+            local ref="$1"
+
+            if [ "$ref" = "main" ]; then
+              printf 'refs/heads/main\n'
+              return 0
+            fi
+            if [[ "$ref" =~ ^[0-9a-f]{40}$ ]]; then
+              # WHY: a new ABI needs bottles before its bottle-backed shell can
+              # validate and merge. The protected tap caller must hardcode this
+              # reviewed SHA, and the Kandelo merge must preserve it as an
+              # ancestor of main; accepting a branch would make executable
+              # publication input mutable between review and checkout.
+              printf '%s\n' "$ref"
+              return 0
+            fi
+
+            echo "::error::write publication requires Kandelo main or an exact reviewed lowercase 40-character commit SHA" >&2
+            return 2
+          }
+
           normalized_caller_repository="$(printf '%s' "$CALLER_REPOSITORY" | tr '[:upper:]' '[:lower:]')"
           normalized_tap_repository="$(printf '%s' "$TAP_REPOSITORY" | tr '[:upper:]' '[:lower:]')"
           normalized_tap_name="$(printf '%s' "$TAP_NAME" | tr '[:upper:]' '[:lower:]')"
@@ -134,13 +155,10 @@ jobs:
               "$CALLER_REPOSITORY/.github/workflows/maintain-bottles.yml@refs/heads/main") ;;
               *) echo "::error::publication requires a reviewed tap write workflow"; exit 2 ;;
             esac
-            [ "$KANDELO_REF" = "main" ] || {
-              echo "::error::write publication requires Kandelo main"; exit 2;
-            }
             [ "$TAP_REF" = "main" ] || {
               echo "::error::write publication requires tap main"; exit 2;
             }
-            validated_kandelo_ref="refs/heads/main"
+            validated_kandelo_ref="$(normalize_write_kandelo_ref "$KANDELO_REF")"
             validated_tap_ref="refs/heads/main"
           fi
           {