[Homebrew/Provenance] Keep the corrected Bash source in main history - #1095
Closed
brandonpayton wants to merge 42 commits into
Closed
[Homebrew/Provenance] Keep the corrected Bash source in main history#1095brandonpayton wants to merge 42 commits into
brandonpayton wants to merge 42 commits into
Conversation
Embed Bash and its always-needed runtime closure, but leave Homebrew and the selected Formula trees as verified lazy sources. Derive eager and lazy variants from the same package identities so product policy does not create a second recipe. Record the exact migration locks, Node and Chromium runtime probes, browser download accounting, and the current rollout plan. Ruby-backed brew commands remain intentionally blocked on the ABI 42 dynamic fork-continuation transition and final tap repin before this candidate can ship.
The cutover intentionally turns homebrew-bootstrap into a two-output package and makes it the shell package’s sole registry dependency. Update the combined packaging-contract tests to assert that complete atomic generation and the current shell revision, while continuing to reject every retired registry bundle.
Exercise /usr/bin/brew itself rather than only the canonical target. The test proves symlink resolution finds the registered package tree, fetches the complete verified archive once, materializes every member atomically, and does not refetch on later use.
Regenerate the canonical program package index after the frozen lazy-shell stack changed the closure keys used by lamp, nginx-php-vfs, and WordPress. This restores the package projection freshness contract used before browser assets may resolve.
Add one durable root-image export contract to the Node and browser kernel hosts. The owning worker closes a snapshot gate, drains earlier mutations, rejects concurrent rootfs changes and live processes, and transfers only the root image so lazy descriptors survive a reboot without capturing boot-scoped mounts. Cover pre-init and non-VFS failures, exact-byte transfer, lazy-state restore, live/tearing-down process exclusion, mutation ordering, and real Chromium/Firefox/WebKit reboot behavior. Keep Vite module-worker reloads on a normal 200 response because WebKit rejects conditional worker revalidation under COEP even when the original response has matching CORP headers.
Exercise the browser worker through its public API so rootfs snapshots are proven to reject live and tearing-down processes, wait for an active lazy-file materialization, and exclude overlapping exports and writes. Reboot the exported bytes and verify the completed mutation is durable while the rejected write is absent.
…romium Move the generated guest scripts, export/reboot orchestration, and exact VFS input checks into browser-safe shared contracts so both hosts prove the same lifecycle instead of maintaining parallel semantics. Add an explicitly gated Chromium fixture with immutable URL, byte-length, SHA-256, tap-revision, embedded-plan, and closed-payload bindings. Wire offline admission coverage into CI and document that live execution still requires one coherent published ABI-42 fixture. Validated with the 38-test focused contract suite, host declaration typecheck, targeted TypeScript checks, Node and browser bundles, the selected production Vite build, and a real Chromium offline admission run.
Regenerate the authoritative package projection after the bridge changes the shell-owned deferred package tree. This keeps the bridge head independently buildable before the browser ownership follow-up adds its separate shell input change.
Replace the obsolete total invocation count with named structural checks for offline lifecycle rejection, shell acceptance, and MODESET. The WHY comment records that process isolation belongs to each heavyweight proof rather than to an incidental command count.
The shell imports the split deferred-tree contract through package-deferred-tree.ts, so that contract file contributes to reproducible shell output and must be an explicit build input. Regenerate the authoritative projection in the same commit so this bridge head remains internally exact.
…ication Transfer the exported lifecycle filesystem directly into its worker-owned phase-two runtime, enforce one bounded deadline across fixture and script work, and prove the exact ownership path in Node and Chromium. The bridge owns its deferred-tree package inputs and browser-process contract; this commit carries the lifecycle ownership changes and their closed-lazy-assets identity delta.
A package archive can be present but unusable, including when a same-run staging overlay has a stale cache identity. In that case the resolver must be able to run the shell recipe from any direct or transitive caller without caller-specific npm setup. Create a resolver-owned Git source snapshot, install both locked JavaScript dependency trees there with a scrubbed public-registry npm environment, and run the composer only from that private snapshot. Isolate every snapshot Git command from ambient attributes, replacement refs, selectors, and external diff configuration. Remove predictive setup from CI and run.sh, bind the preparer into the package cache identity, and cover stale-overlay fallback, concurrent builds, path substitution, Git/npm configuration, and credential isolation. Regenerate the authoritative program-package projection so shell and every composite package that depends on it carry the new manifest and cache identities.
…ages Preserve the exact publisher-integrity and browser lifecycle histories in one downstream integration point after the immutable ABI 42 source. Regenerate the authoritative package projection from the combined package manifests so the shared generated file represents both lineages.
…cle batch Preserve the exact source-fallback fix and current-main ancestry in the post-publication product integration point. Combine both shell-closure test contracts and regenerate the package projection from the resulting manifests.
… snapshot The combined lazy-shell and self-contained source-fallback contracts add one Git-owned package-tree input. Read it from the resolver-owned source snapshot, not the shared checkout, and make the concurrency test prove that isolation.
Record the narrow critical-path acceptance for an eager-Bash, lazy-brew shell with real first-party and independent-tap installs on Node.js and Chromium. Keep Erlang, Dinit, failed noncritical formulae, catalog parity, manuals, activation groups, and the wider migration as visible follow-up work without allowing ABI-41 fallback.
The fork instrumenter is a declared input to program builds. Regenerate the program package index so every cache key names the corrected activation-local catch implementation instead of silently reusing artifacts built by the previous instrumenter. Package manifests and ABI remain unchanged.
Add a maintainer-controlled staging scope that validates the current program projection, force-selects every rootfs wasm32 dependency generation into the PR release, and visibly defers unrelated program generations. Keep the limited run from authorizing prepare-merge and cover malformed, stale, missing, duplicate, identity-mismatched, and non-wasm32 projections.
Exercise the fail-closed path explicitly when the validated program index has no rootfs package projection.
Fail the limited prepublication gate if its target release changes after preflight instead of hiding the race with a canonical-release supplement.
SYS_SPAWN used the channel-sized scratch address for every blob while checking only the remaining WebAssembly memory. Environments above one channel therefore overwrote adjacent Rust heap state and could make a completed child disappear from waitpid. Validate the complete transport, preserve the 4 MiB ARG_MAX contract, and lazily allocate one bounded kernel-owned buffer for large blobs. Reuse is safe because copy and kernel parsing are synchronous on the kernel worker event loop. Add boundary-focused host coverage, a two-spawn executable regression, and architecture documentation.
LAMP, nginx+PHP, and WordPress image builds boot NodeKernelHost for opcache prewarming or database installation. Their declared host/src input intentionally makes kernel-worker behavior part of the generated image identity. Regenerate only those three projected cache identities after the large SYS_SPAWN transport correction. The existing import-closure contract verifies that kernel-worker changes affect exactly these image packages.
Join the exact reviewed fork-correct package producer to current main without activating its not-yet-accepted ABI 42 product tree. The join tree remains identical to main; the follow-up documentation commit records the bounded operation and current execution gates.
brandonpayton
added
the
preserve-head-commit
brandonpayton
force-pushed
the
homebrew/preserve-bash-rebuild5-source-qk044
branch
2 times, most recently
from
July 25, 2026 05:56
adcf69b to
84d30ef
Compare
brandonpayton
force-pushed
the
homebrew/preserve-bash-rebuild5-source-qk044
branch
from
July 25, 2026 06:05
84d30ef to
f0318b0
Compare
Member
Author
|
Superseded by the main-first provenance plan. Git reachability is not equivalent to building final bottles from the exact tree merged into |
Member
Author
|
Closed because Git reachability is not package provenance. Making the #1094 source commit an ancestor of |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Bash rebuild 5 must record the exact reviewed Kandelo source commit
6d923c6454dd7174082f25c3d3991d03f86f5ddb. PR #1094 intentionally targetsthe post-frozen product-integration branch, so merging that PR alone would
leave the public bottle's source dependent on an unprotected side branch.
The source must remain reachable from
mainbefore publication, but thenot-yet-accepted product tree must not be activated merely to preserve its
history.
What this PR does
maincommit to exact source6d923c…with anancestry-only merge.
mainparent.history onto
main, preserving its complete earlier scope.the one-shot Bash rebuild, the separate reference/scratch safety workstreams,
the exact public Node.js/Chromium lifecycle gate, and the core tap's missing
default-branch protection as an explicit governance follow-up.
6d923c…inmain, let theBash publisher consume its sealed 15-entry snapshot, build the 75 affected
package generations, durably promote the exact source-derived browser-input
closure (62 identities, 61 archives), and only then close [Rehearsal/Fork/POSIX] Validate catch-state and spawn fixes before main-first activation #1094 so PR cleanup
cannot delete an input that has not yet been consumed.
6d923c…distinct from GitHub's tested PR merge0968e0b…. The plan requires durable promotion to verify their exactparent/tree relationship and record both identities instead of manually
rewriting the temporary tag.
This changes durable history and documentation. It does not activate the
ABI-42 kernel, shell, guest Homebrew lifecycle, or any other product file.
The product cutover remains owned by #1087 after its exact public evidence.
Validation
a351fc9b18da032c09160c95f1da672374ade700and6d923c6454dd7174082f25c3d3991d03f86f5ddb.a351fc9b18da032c09160c95f1da672374ade700's tree.6d923c6454dd7174082f25c3d3991d03f86f5ddbis an ancestor of the PR head.mainplan: no end-state goal, phase, inventory role, disposition, or completion
criterion was removed.
git diff --checkpasses.This is a documentation-and-history change. It does not claim fresh runtime,
browser, package-build, POSIX, or performance evidence.
Merge requirement
Keep the
preserve-head-commitlabel and merge this PR with a merge commit.If
mainadvances, rebuild the ancestry-only join and repeat the ordered-parent,tree-equality, exact-ancestry, and docs-only-diff checks before merging.
This bounded history operation requires Brandon's explicit approval.