[Rehearsal/Fork/POSIX] Validate catch-state and spawn fixes before main-first activation

.github/actions/detect-change-scope/ci-scope-paths.sh

@@ -48,7 +48,7 @@ package_publish_flow_changed_files() {
   grep -E \
     -e '^\.github/actions/detect-change-scope/(ci-scope-paths|test-ci-scope-paths)\.sh$' \
     -e '^\.github/workflows/(staging-build|prepare-merge|activate-merge-candidate|recover-rejected-merge-candidate|staging-cleanup|force-rebuild|reusable-package-source-publish)\.yml$' \
-    -e '^\.github/scripts/(activate-merge-candidate|cleanup-merge-candidates|clone-rejected-merge-candidate|compose-staging-release-snapshots|download-verified-release-asset|fetch-canonical-index|github-api-get|init-merge-candidate|latest-merge-gate-status|mark-merge-candidate-ready|reconcile-merge-candidates|recover-canonical-indexes|require-exact-head-approval|select-package-archive-source|state-lock|test-activate-merge-candidate|test-cleanup-merge-candidates|test-clone-rejected-merge-candidate|test-download-verified-release-asset|test-fetch-canonical-index|test-init-merge-candidate|test-latest-merge-gate-status|test-merge-candidate-workflows|test-reconcile-merge-candidates|test-recover-canonical-indexes|test-require-exact-head-approval|test-select-package-archive-source|test-state-lock|test-validate-staging-release|test-verify-merge-candidate|validate-staging-release|verify-merge-candidate)\.sh$' \
+    -e '^\.github/scripts/(activate-merge-candidate|cleanup-merge-candidates|clone-rejected-merge-candidate|compose-staging-release-snapshots|derive-rootfs-staging-scope|download-verified-release-asset|fetch-canonical-index|github-api-get|init-merge-candidate|latest-merge-gate-status|mark-merge-candidate-ready|reconcile-merge-candidates|recover-canonical-indexes|require-exact-head-approval|select-package-archive-source|state-lock|test-activate-merge-candidate|test-cleanup-merge-candidates|test-clone-rejected-merge-candidate|test-derive-rootfs-staging-scope|test-download-verified-release-asset|test-fetch-canonical-index|test-init-merge-candidate|test-latest-merge-gate-status|test-merge-candidate-workflows|test-reconcile-merge-candidates|test-recover-canonical-indexes|test-require-exact-head-approval|test-select-package-archive-source|test-state-lock|test-validate-staging-release|test-verify-merge-candidate|validate-staging-release|verify-merge-candidate)\.sh$' \
     -e '^tools/xtask/src/(build_index|bundle_program|index_candidate|index_toml|index_update|package_archive_name|staging_reuse|update_pkg_manifest)\.rs$' \
     -e '^scripts/(compose-initial-index|index-has-current-entry|index-update|prepare-sdk-package|publish-package-source|release-index-state|sync-package-source)\.sh$' \
     -e '^tests/scripts/(index-update|package-publish-flow|release-index-state)\.sh$' \
@@ -79,7 +79,7 @@ kernel_runtime_changed_files() {
 ci_control_changed_files() {
   grep -E \
     -e '^\.github/workflows/(staging-build|prepare-merge|activate-merge-candidate|recover-rejected-merge-candidate|staging-cleanup|force-rebuild|reusable-package-source-publish)\.yml$' \
-    -e '^\.github/scripts/(activate-merge-candidate|cleanup-merge-candidates|clone-rejected-merge-candidate|compose-staging-release-snapshots|download-verified-release-asset|fetch-canonical-index|github-api-get|init-merge-candidate|latest-merge-gate-status|mark-merge-candidate-ready|reconcile-merge-candidates|recover-canonical-indexes|require-exact-head-approval|select-package-archive-source|state-lock|test-activate-merge-candidate|test-cleanup-merge-candidates|test-clone-rejected-merge-candidate|test-download-verified-release-asset|test-fetch-canonical-index|test-init-merge-candidate|test-latest-merge-gate-status|test-merge-candidate-workflows|test-reconcile-merge-candidates|test-recover-canonical-indexes|test-require-exact-head-approval|test-select-package-archive-source|test-state-lock|test-validate-staging-release|test-verify-merge-candidate|validate-staging-release|verify-merge-candidate)\.sh$' \
+    -e '^\.github/scripts/(activate-merge-candidate|cleanup-merge-candidates|clone-rejected-merge-candidate|compose-staging-release-snapshots|derive-rootfs-staging-scope|download-verified-release-asset|fetch-canonical-index|github-api-get|init-merge-candidate|latest-merge-gate-status|mark-merge-candidate-ready|reconcile-merge-candidates|recover-canonical-indexes|require-exact-head-approval|select-package-archive-source|state-lock|test-activate-merge-candidate|test-cleanup-merge-candidates|test-clone-rejected-merge-candidate|test-derive-rootfs-staging-scope|test-download-verified-release-asset|test-fetch-canonical-index|test-init-merge-candidate|test-latest-merge-gate-status|test-merge-candidate-workflows|test-reconcile-merge-candidates|test-recover-canonical-indexes|test-require-exact-head-approval|test-select-package-archive-source|test-state-lock|test-validate-staging-release|test-verify-merge-candidate|validate-staging-release|verify-merge-candidate)\.sh$' \
     -e '^scripts/(compose-initial-index|index-update|release-index-state)\.sh$' \
     -e '^tests/scripts/(index-update|package-publish-flow|release-index-state)\.sh$' \
     -e '^tests/scripts/ci-run-test-suite-groups\.test\.sh$' \

.github/actions/detect-change-scope/test-ci-scope-paths.sh

@@ -216,6 +216,12 @@ assert_matches package_publish_flow_changed_files \
 assert_matches package_publish_flow_changed_files \
   ".github/scripts/test-validate-staging-release.sh" \
   ".github/scripts/test-validate-staging-release.sh"
+assert_matches package_publish_flow_changed_files \
+  ".github/scripts/derive-rootfs-staging-scope.sh" \
+  ".github/scripts/derive-rootfs-staging-scope.sh"
+assert_matches package_publish_flow_changed_files \
+  ".github/scripts/test-derive-rootfs-staging-scope.sh" \
+  ".github/scripts/test-derive-rootfs-staging-scope.sh"
 assert_matches package_publish_flow_changed_files \
   "tools/xtask/src/staging_reuse.rs" \
   "tools/xtask/src/staging_reuse.rs"
@@ -329,6 +335,12 @@ assert_matches ci_control_changed_files \
 assert_matches ci_control_changed_files \
   ".github/scripts/test-validate-staging-release.sh" \
   ".github/scripts/test-validate-staging-release.sh"
+assert_matches ci_control_changed_files \
+  ".github/scripts/derive-rootfs-staging-scope.sh" \
+  ".github/scripts/derive-rootfs-staging-scope.sh"
+assert_matches ci_control_changed_files \
+  ".github/scripts/test-derive-rootfs-staging-scope.sh" \
+  ".github/scripts/test-derive-rootfs-staging-scope.sh"
 assert_matches ci_control_changed_files \
   ".github/scripts/recover-canonical-indexes.sh" \
   ".github/scripts/recover-canonical-indexes.sh"

.github/scripts/derive-rootfs-staging-scope.sh

@@ -0,0 +1,179 @@
+#!/usr/bin/env bash
+# Derive the exact wasm32 package generation needed to build rootfs.
+set -euo pipefail
+
+REPO_ROOT=""
+XTASK=""
+OUTPUT=""
+
+while [ "$#" -gt 0 ]; do
+  case "$1" in
+    --repo-root) REPO_ROOT="$2"; shift 2 ;;
+    --xtask) XTASK="$2"; shift 2 ;;
+    --output) OUTPUT="$2"; shift 2 ;;
+    *)
+      echo "derive-rootfs-staging-scope: unknown flag $1" >&2
+      exit 2
+      ;;
+  esac
+done
+
+if [ -z "$REPO_ROOT" ] || [ ! -d "$REPO_ROOT" ] || [ -L "$REPO_ROOT" ] ||
+   [ -z "$XTASK" ] || [ ! -f "$XTASK" ] || [ -L "$XTASK" ] || [ ! -x "$XTASK" ] ||
+   [ -z "$OUTPUT" ] || [ "$OUTPUT" = / ]; then
+  echo "derive-rootfs-staging-scope: regular repo root, xtask, and output are required" >&2
+  exit 2
+fi
+
+REPO_ROOT="$(cd "$REPO_ROOT" && pwd -P)"
+REGISTRY="$REPO_ROOT/packages/registry"
+PROGRAM_INDEX="$REGISTRY/program-packages.json"
+OUTPUT_PARENT="$(dirname "$OUTPUT")"
+
+if [ ! -d "$REGISTRY" ] || [ -L "$REGISTRY" ] ||
+   [ ! -f "$PROGRAM_INDEX" ] || [ -L "$PROGRAM_INDEX" ] ||
+   [ ! -d "$OUTPUT_PARENT" ] || [ -L "$OUTPUT_PARENT" ] ||
+   [ -e "$OUTPUT" ] || [ -L "$OUTPUT" ]; then
+  echo "derive-rootfs-staging-scope: registry/index must be regular and output must be new" >&2
+  exit 2
+fi
+
+sha_file() {
+  if command -v sha256sum >/dev/null 2>&1; then
+    sha256sum "$1" | awk '{print $1}'
+  else
+    shasum -a 256 "$1" | awk '{print $1}'
+  fi
+}
+
+index_sha_before="$(sha_file "$PROGRAM_INDEX")"
+
+# WHY: this scope is an acceleration boundary, not an alternate source of
+# package identity. Refuse a stale committed projection before selecting fewer
+# builds, or an omitted generation could be mistaken for a current one.
+WASM_POSIX_DEPS_REGISTRY="$REGISTRY" \
+  "$XTASK" build-deps program-index-context-check \
+    --source-repo-root "$REPO_ROOT"
+
+index_sha_after="$(sha_file "$PROGRAM_INDEX")"
+if [ "$index_sha_before" != "$index_sha_after" ]; then
+  echo "derive-rootfs-staging-scope: program package index changed during validation" >&2
+  exit 1
+fi
+
+TMP_ROOT="$(mktemp -d "$OUTPUT_PARENT/.rootfs-staging-scope.XXXXXX")"
+trap 'rm -rf "$TMP_ROOT"' EXIT
+cp "$PROGRAM_INDEX" "$TMP_ROOT/program-packages.json"
+if [ "$(sha_file "$TMP_ROOT/program-packages.json")" != "$index_sha_before" ]; then
+  echo "derive-rootfs-staging-scope: could not snapshot the validated program package index" >&2
+  exit 1
+fi
+
+jq -e '
+  def hex256:
+    type == "string" and test("^[0-9a-f]{64}$");
+  def package_name:
+    type == "string" and test("^[a-z0-9][a-z0-9._-]*$");
+  . as $index |
+  $index.format == "kandelo-program-packages-v2" and
+  ($index.identities | type == "object") and
+  ($index.packages | type == "object") and
+  ($index.packages.rootfs | type == "object") and
+  ($index.packages.rootfs.arches == ["wasm32"]) and
+  (($index.packages.rootfs.cacheKeys | keys) == ["wasm32"]) and
+  (($index.packages.rootfs.dependencyClosures | keys) == ["wasm32"]) and
+  ($index.packages.rootfs.manifestSha256 | hex256) and
+  ($index.packages.rootfs.cacheKeys.wasm32 | hex256) and
+  ($index.packages.rootfs.dependencyClosures.wasm32 |
+    type == "array" and length > 0) and
+  ($index.identities.rootfs.manifestSha256 ==
+    $index.packages.rootfs.manifestSha256) and
+  ($index.identities.rootfs.cacheKeys.wasm32 ==
+    $index.packages.rootfs.cacheKeys.wasm32) and
+  all($index.packages.rootfs.dependencyClosures.wasm32[];
+    . as $dependency |
+    (($dependency | keys) ==
+      ["cacheKey", "manifestSha256", "packageName"]) and
+    ($dependency.packageName | package_name) and
+    ($dependency.packageName != "rootfs") and
+    ($dependency.manifestSha256 | hex256) and
+    ($dependency.cacheKey | hex256) and
+    ($index.packages[$dependency.packageName] | type == "object") and
+    ($index.packages[$dependency.packageName].arches | index("wasm32") != null) and
+    ($index.packages[$dependency.packageName].manifestSha256 ==
+      $dependency.manifestSha256) and
+    ($index.packages[$dependency.packageName].cacheKeys.wasm32 ==
+      $dependency.cacheKey) and
+    ($index.identities[$dependency.packageName].manifestSha256 ==
+      $dependency.manifestSha256) and
+    ($index.identities[$dependency.packageName].cacheKeys.wasm32 ==
+      $dependency.cacheKey)
+  ) and
+  (
+    [$index.packages.rootfs.dependencyClosures.wasm32[].packageName] |
+    length == (unique | length)
+  )
+' "$TMP_ROOT/program-packages.json" >/dev/null || {
+  echo "derive-rootfs-staging-scope: invalid rootfs wasm32 projection" >&2
+  exit 1
+}
+
+jq -S --arg source_index_sha256 "$index_sha_before" '
+  {
+    format: "kandelo-rootfs-staging-scope-v1",
+    source_index_sha256: $source_index_sha256,
+    root_package: "rootfs",
+    arch: "wasm32",
+    entries: (
+      (
+        .packages.rootfs.dependencyClosures.wasm32 |
+        map({
+          package: .packageName,
+          arch: "wasm32",
+          manifest_sha256: .manifestSha256,
+          cache_key_sha: .cacheKey
+        })
+      ) + [{
+        package: "rootfs",
+        arch: "wasm32",
+        manifest_sha256: .packages.rootfs.manifestSha256,
+        cache_key_sha: .packages.rootfs.cacheKeys.wasm32
+      }] |
+      sort_by(.package, .arch)
+    )
+  }
+' "$TMP_ROOT/program-packages.json" >"$TMP_ROOT/scope.json"
+
+jq -e '
+  (keys == [
+    "arch",
+    "entries",
+    "format",
+    "root_package",
+    "source_index_sha256"
+  ]) and
+  .format == "kandelo-rootfs-staging-scope-v1" and
+  .root_package == "rootfs" and
+  .arch == "wasm32" and
+  (.source_index_sha256 |
+    type == "string" and test("^[0-9a-f]{64}$")) and
+  (.entries | length > 1) and
+  all(.entries[];
+    (.arch == "wasm32") and
+    (.package | type == "string" and
+      test("^[a-z0-9][a-z0-9._-]*$")) and
+    (.manifest_sha256 | type == "string" and
+      test("^[0-9a-f]{64}$")) and
+    (.cache_key_sha | type == "string" and
+      test("^[0-9a-f]{64}$"))
+  ) and
+  ([.entries[] | [.package, .arch]] |
+    length == (unique | length))
+' "$TMP_ROOT/scope.json" >/dev/null || {
+  echo "derive-rootfs-staging-scope: derived an invalid staging scope" >&2
+  exit 1
+}
+
+mv "$TMP_ROOT/scope.json" "$OUTPUT"
+count="$(jq -r '.entries | length' "$OUTPUT")"
+echo "derive-rootfs-staging-scope: selected $count wasm32 package generations" >&2