New 'make.tcl libfetch' subcommand (argdoc'd; workflow text + plain help
updated): fetches the punkbin LIB-TIER artifacts declared in the new
src/runtime/libpackages.toml ([artifact.<name>] name/target; the four G-138
r1 artifacts, both generations) from <origin>/lib/<target>/ into the
untracked bin/packages/<target>/ input tier - zip + .toml sidecar, each
sha1-verified against the server's per-target sha1sums.txt (local tier copy
kept, the punk-runtime store idiom) - then materializes each verified zip
via punk::zip::unzip (crc-verified, mtimes restored, accelerator-eligible)
into bin/packages/<target>/tcl<N>/<pkgfolder>/ (generation subdirs: both
generations install identically-named folders). Idempotent: present
artifacts re-verify and skip; a materialized tree is current while its
embedded record names the declared artifact (the G-138 self-description
payoff); -force overrides.
Consent keyed to server trust (the G-123 posture): the canonical punkbin
origin (punk-runtime raw-base convention) gates nothing; any other origin
(-serverurl or env PUNKBIN_URL) refuses before network access without the
explicit -trust-server flag - never an interactive prompt. file:// origins
served natively (mirrors/fixtures); http(s) transport: Tcl http (+tls) when
loadable, else curl, else PowerShell. The dispatch block sits before the
build-command whitelist gate per the standalone-command pattern and exits
itself.
Emission-side amendment (both suites' library_artifacts.tcl): sidecar tomls
now ride the per-tier staging sha1sums.txt, matching the punkbin repo's
build_sha1sums.tcl coverage so staging-derived mirrors serve verifiable
sidecars.
Verified against a file:// mirror assembled from both suites' staging:
trust-gate refusal, consented fetch of all 4 artifacts (sha1-verified),
materialization of all 4 trees, fully idempotent re-run, and a package-load
proof from the tier (md5 2.0.9 + tcllibc accel=1 under the plain family
kit, ifneeded paths in bin/packages). bin/packages is already ignored in
both VCS via the /bin/* rules. Docs: bin/AGENTS.md tier section,
src/runtime/AGENTS.md libpackages.toml bullet. Project version 0.31.0 +
CHANGELOG (new make.tcl subcommand = product surface). Remaining G-139 work
recorded in the goal's Progress section.
Assisted-by: harness=claude; primary-model=claude-fable-5; api-location=anthropic.com
`bin/packages/<target>/` is the untracked input tier for punkbin LIB-TIER library
artifacts (tcllib/tcllibc as immutable generation-tagged zips - shellspy G-138),
mirroring the `bin/runtime/<platform>/` store idiom: per-target folders holding
the sha1-verified `-r<N>` zips, their `.toml` sidecars and a local copy of the
server's `sha1sums.txt`, plus the materialized installed-shape package trees
under `bin/packages/<target>/tcl<N>/<pkgfolder>/` (generation subfolders because
both Tcl generations install identically-named folders). Materialized trees are
self-describing via their embedded `punkbin-artifact.toml` records (the G-138
schema) - `make.tcl libfetch` uses that record to skip re-materializing a
current tree. Populated by `tclsh src/make.tcl libfetch` from the declarations
in `src/runtime/libpackages.toml` (consent keyed to server trust: the canonical
punkbin origin needs no flag, any other origin - `-serverurl` or env
`PUNKBIN_URL` - requires the explicit `-trust-server` flag; `file://` origins
serve local mirrors/fixtures). Everything under `bin/packages/` is
fetch-regenerable and ignored by both VCS (`/bin/*` rules) - never commit from
it; downstream consumption into `lib_tcl<N>/` and kit vfs trees is the
remainder of G-139.
### Interactive verification shells
- Interactive console/repl verification should cover both Tcl generations - behaviour can differ materially (e.g. the Tcl 8.6 windows console channel driver vs the Tcl 9 rewrite). Use a Tcl 8.6-based punk shell (`punksys.exe`) and a current Tcl 9-based punk shell (named for the Tcl release it embeds, e.g. `punk902z.exe` at the time of writing - ask the user which is current rather than assuming). `info patchlevel` in-session confirms the runtime.
@ -17,6 +17,7 @@ Houses the `mapvfs.config` that maps VFS payloads to platform runtimes, plus the
- **Target platform (4th element, G-122).** A kit config entry may name the canonical punkshell platform its runtime is for (`help platforms` lists the names). It decides which `bin/runtime/<platform>/` tier the runtime is read from (macosx-* collapsing to the universal `macosx` folder), whether the runtime file and the built kit carry `.exe`, and whether the pre-deploy process sweep applies. It is a property of the RUNTIME: entries on one runtime line may repeat it but must not disagree (a conflict, or a name that is not an `<os>-<cpu>` platform-dir name, is a fatal config error). Omitted means the build host's default target - which for an msys2/cygwin-runtime tclsh is `win32-x86_64`, not that host's own canon. The live example is the `tclkit-902-Linux64-intel-dyn` entry (target `linux-x86_64`, suffixless `punkshell902` artifact). The schema's eventual home is the G-024 toml conversion; consumers read the parsed model (`::punkboot::lib::mapvfs_*`), never the file format.
- Runtime executables are placed in `bin/runtime/<platform>/` by the `bin/punk-runtime.cmd` helper, manually, or (G-103 family runtimes) copied from the suite_tcl90 `kit-family` build products under `src/buildsuites/_build/suite_tcl90/out/family/`.
- `punkshell.ico` here is the project-DEFAULT kit icon: the bake icon step (G-057) records it in every kit's `<kitname>.resources.toml` sidecar and embeds it into win32-target kits (per-kit override + format + skip semantics: bin/AGENTS.md). It is a derived copy of `src/assets/logo/punk-mark.ico` - its `.assetorigin.toml` sidecar records the derivation; regenerate via the logo pipeline, never edit the `.ico` here.
- `libpackages.toml` (G-139) declares the punkbin LIB-TIER library artifacts this checkout consumes: `[artifact.<name>]` entries with `name` (immutable `<pkgfolder>-<tcl8|tcl9>-r<N>.zip` artifact filename) and `target` (`allplatforms` or a platform-dir name). Processed by `tclsh src/make.tcl libfetch` into the untracked `bin/packages/<target>/` input tier (sha1-verified against the server's per-target sha1sums.txt; trees materialized under `bin/packages/<target>/tcl<N>/`). Consuming a new revision = editing the declared name here (deliberate, reviewable - mirroring the emission side's deliberate-publish discipline). The file's own header comment is the user-facing spec; keep the two in step.
- The `_build/` subdirectory holds build intermediates; it can be safely deleted.
