ABI: Batch ABI 43 platform work and shared-memory vfork

.github/actions/detect-change-scope/ci-scope-paths.sh

@@ -94,6 +94,7 @@ binary_materialization_changed_files() {
   grep -E \
     -e '^packages/registry/program-packages\.json$' \
     -e '^tools/xtask/src/(index_candidate|index_toml|package_archive_name|remote_fetch|util)\.rs$' \
+    -e '^scripts/browser-memory64-example-fixtures\.(sh|txt)$' \
     -e '^scripts/(activate-local-shell-build-override|ci-homebrew-browser-mirror-state|fetch-binaries|install-local-binary|install-local-shell-artifact|materialize-ci-canonical-package-index|materialize-ci-publication-blockers|materialize-pr-overlays|materialize-resolver-binaries|pack-ci-test-workspace|resolve-binary|stage-portable-resolver-binaries|test-wasm-artifact-guards|validate-publication-blocker-report|wasm-artifact-guards)\.sh$' \
     -e '^scripts/(build-resolve-binary-bundle|test-resolve-binary-bundle)\.sh$' \
     -e '^scripts/resolve-binary\.(ts|bundle\.mjs|bundle\.LICENSES\.txt)$' \
@@ -112,7 +113,9 @@ kernel_runtime_changed_files() {
     -e '^tests/vfs-products\.(toml|generated\.json)$' \
     -e '^tools/xtask/src/abi_staging/' \
     -e '^(Cargo\.(lock|toml)|flake\.(nix|lock)|rust-toolchain\.toml|\.gitmodules)$' \
-    -e '^scripts/(build-musl|build-libcxx|build-programs|check-abi-version|check-libcxx-toolchain-version|ci-run-test-suite|dev-shell|run-libc-tests|run-posix-tests|run-sortix-tests)\.sh$' \
+    -e '^scripts/browser-memory64-example-fixtures\.(sh|txt)$' \
+    -e '^scripts/check-browser-memory64-example-fixtures\.ts$' \
+    -e '^scripts/(build-musl|build-libcxx|build-programs|check-abi-version|check-libcxx-toolchain-version|ci-check-browser-assets|ci-run-test-suite|dev-shell|run-libc-tests|run-posix-tests|run-sortix-tests)\.sh$' \
     -e '^scripts/(abi-staging-pages-(producer(-fixture)?|readiness)(\.test)?\.ts|abi-staging-product-(browser|node)-evidence(\.test)?\.ts|abi-staging-product-input-sources\.ts|check-pages-vfs-product-registry(\.test)?\.mjs|run-vfs-product-builder(\.test)?\.ts|test-abi-staging-(mini-lifecycle|pages-atomic|product-authority)\.sh|vfs-product-catalog(\.test)?\.mjs)$' \
     -e '^examples/run-example\.ts$' \
     || true

.github/actions/detect-change-scope/test-ci-scope-paths.sh

@@ -233,6 +233,13 @@ for blocker_materialization_script in \
     "$blocker_materialization_script" \
     "$blocker_materialization_script"
 done
+for browser_memory64_fixture_input in \
+  scripts/browser-memory64-example-fixtures.sh \
+  scripts/browser-memory64-example-fixtures.txt; do
+  assert_matches binary_materialization_changed_files \
+    "$browser_memory64_fixture_input" \
+    "$browser_memory64_fixture_input"
+done
 assert_matches binary_materialization_changed_files \
   "scripts/stage-portable-resolver-binaries.sh" \
   "scripts/stage-portable-resolver-binaries.sh"
@@ -538,6 +545,15 @@ assert_matches kernel_runtime_changed_files \
 assert_matches kernel_runtime_changed_files \
   "scripts/ci-run-test-suite.sh" \
   "scripts/ci-run-test-suite.sh"
+for browser_memory64_fixture_input in \
+  scripts/browser-memory64-example-fixtures.sh \
+  scripts/browser-memory64-example-fixtures.txt \
+  scripts/check-browser-memory64-example-fixtures.ts \
+  scripts/ci-check-browser-assets.sh; do
+  assert_matches kernel_runtime_changed_files \
+    "$browser_memory64_fixture_input" \
+    "$browser_memory64_fixture_input"
+done
 assert_not_matches kernel_runtime_changed_files \
   "tools/xtask/src/remote_fetch.rs" \
   "tools/xtask/src/remote_fetch.rs"

.github/actions/package-toolchain/action.yml

@@ -27,7 +27,7 @@ runs:
       run: |
         set -euo pipefail
         musl_gitlink="$(git rev-parse HEAD:libc/musl)"
-        KEY="musl-sysroot-v5-${{ runner.os }}-$musl_gitlink-${{ hashFiles('flake.nix', 'flake.lock', 'rust-toolchain.toml', 'scripts/dev-shell.sh', 'scripts/build-musl.sh', 'scripts/install-overlay-headers.sh', 'packages/registry/libcxx/**', 'libc/musl-overlay/**', 'libc/glue/**', 'sdk/activate.sh', 'sdk/bin/**', 'sdk/config.site', 'sdk/package.json', 'sdk/package-lock.json', 'sdk/src/**') }}"
+        KEY="musl-sysroot-v6-${{ runner.os }}-$musl_gitlink-${{ hashFiles('.github/actions/package-toolchain/**', 'flake.nix', 'flake.lock', 'rust-toolchain.toml', 'scripts/dev-shell.sh', 'scripts/build-musl.sh', 'scripts/install-overlay-headers.sh', 'packages/registry/libcxx/**', 'libc/musl-overlay/**', 'libc/glue/**', 'sdk/activate.sh', 'sdk/bin/**', 'sdk/config.site', 'sdk/package.json', 'sdk/package-lock.json', 'sdk/src/**') }}"
         echo "value=$KEY" >> "$GITHUB_OUTPUT"
         echo "toolchain-cache key: $KEY"
 
@@ -56,17 +56,56 @@ runs:
               build-deps path libcxx --arch "$arch")"
             if [ "$arch" = "wasm64" ]; then sysroot="sysroot64"; else sysroot="sysroot"; fi
             mkdir -p "$sysroot/lib" "$sysroot/include/c++"
-            ln -sf "$prefix/lib/libc++.a"    "$sysroot/lib/libc++.a"
-            ln -sf "$prefix/lib/libc++abi.a" "$sysroot/lib/libc++abi.a"
+            # WHY: the resolver prefix is runner-local and is neither cached nor
+            # packed below. Copy these inputs so downstream test shards receive
+            # a self-contained sysroot instead of dangling absolute symlinks.
+            rm -f "$sysroot/lib/libc++.a" "$sysroot/lib/libc++abi.a"
+            install -m 0644 "$prefix/lib/libc++.a" "$sysroot/lib/libc++.a"
+            install -m 0644 "$prefix/lib/libc++abi.a" "$sysroot/lib/libc++abi.a"
             rm -rf "$sysroot/include/c++/v1"
-            ln -sfn "$prefix/include/c++/v1" "$sysroot/include/c++/v1"
+            cp -a "$prefix/include/c++/v1" "$sysroot/include/c++/v1"
           done
         '
 
     - name: Build fork-instrument host tool
       shell: bash
       run: bash scripts/dev-shell.sh bash scripts/build-fork-instrument-tool.sh
 
+    - name: Validate portable toolchain sysroots
+      shell: bash
+      run: |
+        set -euo pipefail
+        for sysroot in sysroot sysroot64; do
+          for archive in libc++.a libc++abi.a; do
+            path="$sysroot/lib/$archive"
+            if [ ! -f "$path" ] || [ -L "$path" ]; then
+              echo "package-toolchain: non-portable libc++ archive: $path" >&2
+              exit 1
+            fi
+          done
+          headers="$sysroot/include/c++/v1"
+          if [ ! -d "$headers" ] || [ -L "$headers" ]; then
+            echo "package-toolchain: non-portable libc++ headers: $headers" >&2
+            exit 1
+          fi
+
+          # WHY: tar preserves symlinks, but it does not carry targets outside
+          # the archived sysroot. Reject any escaping or dangling link before
+          # publication so consumers cannot receive a locally valid artifact
+          # that becomes incomplete after extraction.
+          sysroot_root="$(realpath "$sysroot")"
+          while IFS= read -r -d '' link; do
+            target="$(realpath "$link" 2>/dev/null || true)"
+            case "$target" in
+              "$sysroot_root"/*) ;;
+              *)
+                echo "package-toolchain: sysroot link escapes archive: $link" >&2
+                exit 1
+                ;;
+            esac
+          done < <(find "$sysroot" -type l -print0)
+        done
+
     - name: Pack toolchain sysroots + host tools
       shell: bash
       run: |

.github/scripts/test-merge-candidate-workflows.sh

@@ -1300,6 +1300,10 @@ for workflow in "$STAGING_WORKFLOW" "$PREPARE"; do
   grep -Fq 'run: bash scripts/dev-shell.sh npm ci --no-audit --no-fund' \
     <<<"$root_install_step" ||
     fail "$(basename "$workflow") materialization validation must install the root esbuild dependency"
+  materialization_step="$(step_block "$workflow" "Test binary materialization flow")"
+  grep -Fq 'bash scripts/dev-shell.sh bash scripts/build-fork-instrument-tool.sh' \
+    <<<"$materialization_step" ||
+    fail "$(basename "$workflow") materialization validation must build the fork contract inventory tool"
 done
 
 grep -Fq 'cleanup-merge-candidates.sh' "$CLEANUP_WORKFLOW" || \

.github/workflows/force-rebuild.yml

@@ -818,14 +818,16 @@ jobs:
       # remove serial work while `test-gate` still aggregates every cell.
       matrix:
         include:
-          - suite: cargo-kernel
-            label: cargo-kernel
+          - suite: cargo-workspace
+            label: cargo-workspace
             group: all
+            # Cover every workspace crate except independently gated xtask.
+            # New crates are included without another matrix allow-list edit.
             needs_submodules: false
             needs_toolchain: false
             needs_workspace: false
-          - suite: fork-instrument
-            label: fork-instrument
+          - suite: cargo-xtask
+            label: cargo-xtask
             group: all
             needs_submodules: false
             needs_toolchain: false

.github/workflows/prepare-merge.yml

@@ -1687,6 +1687,10 @@ jobs:
       - name: Test binary materialization flow
         if: env.BINARY_MATERIALIZATION_CHANGED == 'true' && env.EXACT_ABI_STAGING_APPLICABLE != 'true'
         run: |
+          # WHY: artifact-guard integration tests query the ABI 43 binary
+          # contract inventory. This source-only job does not download the
+          # package-toolchain artifact, so prepare its host tool explicitly.
+          bash scripts/dev-shell.sh bash scripts/build-fork-instrument-tool.sh
           bash scripts/dev-shell.sh npx --prefix host vitest run --root . tests/package-system
 
   test-suite-early:
@@ -1712,11 +1716,18 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - suite: cargo-kernel
-            label: cargo-kernel
-          - suite: fork-instrument
-            label: fork-instrument
+          - suite: cargo-workspace
+            label: cargo-workspace
+            # Closed-by-default coverage for every workspace crate except
+            # independently gated xtask, including integration-test crates.
+            kernel_only: true
+          - suite: cargo-xtask
+            label: cargo-xtask
+            # Package-system automation is independent of kernel changes and
+            # needs neither the toolchain nor the prepared test workspace.
+            kernel_only: false
     env:
+      KERNEL_ONLY: ${{ matrix.kernel_only }}
       KERNEL_CHANGED: ${{ needs.change-scope.outputs.kernel }}
       EXACT_ABI_STAGING_APPLICABLE: ${{ needs.change-scope.outputs.exact_abi_staging_applicable }}
       SUITE: ${{ matrix.suite }}
@@ -1725,7 +1736,8 @@ jobs:
         id: suite
         run: |
           set -euo pipefail
-          if [ "$KERNEL_CHANGED" != "true" ] && \
+          if [ "$KERNEL_ONLY" = "true" ] && \
+             [ "$KERNEL_CHANGED" != "true" ] && \
              [ "$EXACT_ABI_STAGING_APPLICABLE" != "true" ]; then
             echo "skip=true" >> "$GITHUB_OUTPUT"
             echo "$SUITE is kernel-only and this diff does not require kernel suites."

.github/workflows/staging-build.yml

@@ -899,6 +899,10 @@ jobs:
       - name: Test binary materialization flow
         if: env.BINARY_MATERIALIZATION_CHANGED == 'true' && env.EXACT_ABI_STAGING_APPLICABLE != 'true'
         run: |
+          # WHY: artifact-guard integration tests query the ABI 43 binary
+          # contract inventory. This source-only job does not download the
+          # package-toolchain artifact, so prepare its host tool explicitly.
+          bash scripts/dev-shell.sh bash scripts/build-fork-instrument-tool.sh
           bash scripts/dev-shell.sh npx --prefix host vitest run --root . tests/package-system
 
   test-suite-early:
@@ -920,11 +924,18 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - suite: cargo-kernel
-            label: cargo-kernel
-          - suite: fork-instrument
-            label: fork-instrument
+          - suite: cargo-workspace
+            label: cargo-workspace
+            # Closed-by-default coverage for every workspace crate except
+            # independently gated xtask, including integration-test crates.
+            kernel_only: true
+          - suite: cargo-xtask
+            label: cargo-xtask
+            # Package-system automation is independent of kernel changes and
+            # needs neither the toolchain nor the prepared test workspace.
+            kernel_only: false
     env:
+      KERNEL_ONLY: ${{ matrix.kernel_only }}
       KERNEL_CHANGED: ${{ needs.change-scope.outputs.kernel }}
       EXACT_ABI_STAGING_APPLICABLE: ${{ needs.change-scope.outputs.exact_abi_staging_applicable }}
       SKIP_STAGING_TESTS: ${{ needs.change-scope.outputs.skip_staging_tests }}
@@ -940,7 +951,8 @@ jobs:
             echo "skip-staging-tests label is present; $SUITE is deferred to prepare-merge."
             exit 0
           fi
-          if [ "$KERNEL_CHANGED" != "true" ] && \
+          if [ "$KERNEL_ONLY" = "true" ] && \
+             [ "$KERNEL_CHANGED" != "true" ] && \
              [ "$EXACT_ABI_STAGING_APPLICABLE" != "true" ]; then
             echo "skip=true" >> "$GITHUB_OUTPUT"
             echo "$SUITE is kernel-only and this diff does not require kernel suites."

.gitmodules

@@ -3,7 +3,7 @@
 	url = https://github.com/ifduyue/musl.git
 [submodule "libc-test"]
 	path = tests/libc/libc-test
-	url = git@github.com:PocketCluster/libc-test.git
+	url = https://github.com/PocketCluster/libc-test.git
 [submodule "os-test"]
 	path = tests/sortix/os-test
 	url = https://gitlab.com/sortix/os-test.git

CLAUDE.md

@@ -285,9 +285,13 @@ pins current.
 `libc/glue/channel_syscall.c`, run `scripts/build-musl.sh` before relying on
 `build.sh`, Vitest, or conformance tests.
 
-PR titles, PR descriptions, and commit messages should lead with the purpose of
-the work: the platform contract, user-visible behavior, system invariant, or
-project capability being changed or protected. Every PR description must put a
+PR titles and commit subjects must begin with a concise purpose prefix in the
+form `Area: Purpose`, such as `Homebrew:`, `Kernel:`, `POSIX:`, `CI:`,
+`Browser:`, or `Docs:`. Choose the area that best identifies the contract or
+capability a reader should notice; the prefix is a routing hint, not a substitute
+for a purpose-led title. PR descriptions and commit messages should then lead
+with the platform contract, user-visible behavior, system invariant, or project
+capability being changed or protected. Every PR description must put a
 plain-language `## Why` section before `## What changed`, implementation
 details, or validation. Explain the current problem, who or what it affects,
 and why fixing it matters before describing the mechanics.

MANIFEST

@@ -36,7 +36,7 @@
 /etc/ssl/certs   d  0755  0  0
 
 # ── User home ──────────────────────────────────────────────────────
-/home/user       d  0755  1000  1000
+/home/maker      d  0755  1000  1000
 
 # ── /etc content (source: images/rootfs/etc/*) ────────────────────────────
 # passwd/group/hosts live in rootfs.vfs, which is the source of truth
@@ -53,6 +53,8 @@
 /etc/os-release    f  0644  0  0
 /etc/profile       f  0644  0  0
 /etc/motd          f  0644  0  0
+/etc/motd.autologin f 0644  0  0
+/etc/sudoers       f  0440  0  0
 # The rootfs file is the authoritative services database. Rootfs-derived
 # images inherit it rather than rebuilding or synthesizing a second table.
 /etc/services      f  0644  0  0