From 1f8af9980500f725eb80060b021af3710dc22805 Mon Sep 17 00:00:00 2001 From: Julian Noble Date: Wed, 29 Jul 2026 15:09:34 +1000 Subject: [PATCH] G-128: punkbin publication route settled, staged and documented; punkshell 0.30.6 Distribution convention (recorded in src/tools/punkres/PROVENANCE.md): the tool publishes to the punkbin tools tier as win32-x86_64/tools/punkres-x86_64-windows-.exe (arch-os-version beside the zig archives; immutable), integrity via that tier's sha1sums.txt. 0.3.1 STAGED as punkbin commit 1b471fc (sha1 166cd176..., built by the tool step from vendored 0.3.1/f0af880, all other sha1sums SAME) - push is maintainer-gated per punkbin AGENTS.md, and agents never push. Route documented in bin/AGENTS.md; the seam's skip notice names both remedies (build from vendored source, or fetch the prebuilt artifact). Demonstrated in the program-files checkout: artifact placed as bin/punkres.exe reports 0.3.1 and make.tcl tool list reads it CURRENT against the vendored tree. Reproducibility note recorded: zig builds differ across invocations in the PE-header timestamp region - the published sha1 pins THE artifact. Goal Progress: increment 1f; the only remaining acceptance item is the maintainer push making the fetch URL live - achieved flip flagged for confirmation at that point. punkres.test 8/8 re-verified. Assisted-by: harness=claude; primary-model=claude-fable-5; api-location=anthropic.com --- CHANGELOG.md | 11 ++++++++ bin/AGENTS.md | 6 ++++- goals/G-128-portable-pe-resource-stamping.md | 24 +++++++++++++++++ punkproject.toml | 2 +- src/make.tcl | 2 +- src/tools/punkres/PROVENANCE.md | 28 ++++++++++++++++++++ 6 files changed, 70 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index b29d21b7..0f93b6d9 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -5,6 +5,17 @@ The latest `## [X.Y.Z]` header must match the `version` field in `punkproject.to Entries are newest-first; one bullet per notable change. See the root `AGENTS.md` "Project Versioning" section for the bump policy. +## [0.30.6] - 2026-07-29 + +- punkres is publishable as a punkbin artifact (G-128 distribution route): + `win32-x86_64/tools/punkres-x86_64-windows-.exe`, sha1-verified via + the tools tier's `sha1sums.txt`, placed at `bin/punkres.exe` - the + no-toolchain route that does not depend on the committed twapi. 0.3.1 + staged in the punkbin repo (push maintainer-gated); route recorded in + `src/tools/punkres/PROVENANCE.md` and `bin/AGENTS.md`, and the kit-icon + seam's skip notice now names both remedies (build from vendored source, + or fetch the prebuilt artifact). + ## [0.30.5] - 2026-07-29 - `punk-getzig.cmd` fixed for spaced checkout paths and Windows PowerShell 5: diff --git a/bin/AGENTS.md b/bin/AGENTS.md index dc95ec85..caa1c368 100644 --- a/bin/AGENTS.md +++ b/bin/AGENTS.md @@ -168,7 +168,11 @@ never modified). Two mechanisms share one semantic and yield equivalent resource content (G-128 parity evidence): `bin/punkres(.exe)` - the vendored portable stamper, built via `make.tcl tool build punkres`, host-independent - is selected when present; otherwise the twapi arm serves windows hosts with -nothing built. The embedded RT_GROUP_ICON is NAMED from the icon file's +nothing built. A no-toolchain machine can also FETCH the prebuilt tool from +the punkbin artifact repo (`win32-x86_64/tools/punkres-x86_64-windows-.exe`, +sha1-verified against that tier's `sha1sums.txt`, placed at `bin/punkres.exe` - +full route in `src/tools/punkres/PROVENANCE.md`). The embedded RT_GROUP_ICON +is NAMED from the icon file's uppercased rootname (`punkshell.ico` -> `PUNKSHELL`, RC convention; applies to per-kit overrides identically since they are also named `punkshell.ico`), with the resource language adopted from the group being replaced. Stub diff --git a/goals/G-128-portable-pe-resource-stamping.md b/goals/G-128-portable-pe-resource-stamping.md index b00c1534..a3347d6f 100644 --- a/goals/G-128-portable-pe-resource-stamping.md +++ b/goals/G-128-portable-pe-resource-stamping.md @@ -410,3 +410,27 @@ the parked RT_VERSION stamping wants, since the project version is known late. artifact, not nondeterminism. REMAINS for acceptance: only the punkbin publication route (G-123/G-006 channels) for no-toolchain users. +- 2026-07-29 increment 1f (user-directed): PUNKBIN PUBLICATION ROUTE settled, + staged and documented - the acceptance's final clause pending only the + maintainer push. Convention (recorded in + src/tools/punkres/PROVENANCE.md "Distribution"): the tool publishes to the + punkbin tools tier as win32-x86_64/tools/punkres-x86_64-windows-.exe + (arch-os-version naming beside the zig archives; immutable - new versions + add files), integrity via that tier's sha1sums.txt (punkbin's authority for + first-party tools; maintainer-signed .minisig = natural complement, not yet + present). STAGED: punkbin commit 1b471fc adds + punkres-x86_64-windows-0.3.1.exe (sha1 166cd176..., built by the tool step + from vendored 0.3.1/f0af880 with the pinned toolchain), sha1sums row + regenerated all-SAME-plus-one-NEW; push is maintainer-gated per punkbin + AGENTS.md. Route documented in bin/AGENTS.md (kit icon section) and the + seam's skip notice now names BOTH remedies (build from vendored source, or + fetch the punkbin artifact). DEMONSTRATED in the program-files checkout: + the artifact placed as bin/punkres.exe reports 0.3.1, make.tcl tool list + reads it CURRENT against the vendored tree, and the seam selects by + presence. Reproducibility note: zig builds differ across invocations in + the PE-header timestamp region, so the published sha1 pins THE artifact + (the vendored source + pinned toolchain reproduce a functionally + identical tool, not identical bytes). +- REMAINS for acceptance: the maintainer push of punkbin 1b471fc (making the + fetch URL live). On push, every acceptance clause reads satisfied - + flagging the achieved flip for confirmation at that point. diff --git a/punkproject.toml b/punkproject.toml index 7a19a2c2..602217e3 100644 --- a/punkproject.toml +++ b/punkproject.toml @@ -1,4 +1,4 @@ [project] name = "punkshell" -version = "0.30.5" +version = "0.30.6" license = "BSD-2-Clause" diff --git a/src/make.tcl b/src/make.tcl index a7c3c8db..07121b28 100644 --- a/src/make.tcl +++ b/src/make.tcl @@ -6534,7 +6534,7 @@ proc ::punkboot::kiticon::punkres_available {repo_root} { if {[file isfile $exe]} { set punkres_state [list 1 $exe] } else { - set punkres_state [list 0 "portable stamper not present at $exe - 'tclsh src/make.tcl tool build punkres' builds it from vendored source (G-128)"] + set punkres_state [list 0 "portable stamper not present at $exe - 'tclsh src/make.tcl tool build punkres' builds it from vendored source, or fetch the prebuilt punkbin artifact (win32-x86_64/tools/punkres-*; route: src/tools/punkres/PROVENANCE.md) (G-128)"] } return $punkres_state } diff --git a/src/tools/punkres/PROVENANCE.md b/src/tools/punkres/PROVENANCE.md index d7d8c91a..ac99f345 100644 --- a/src/tools/punkres/PROVENANCE.md +++ b/src/tools/punkres/PROVENANCE.md @@ -69,3 +69,31 @@ Origin): is first-party punkshell-project code with no external lineage; recorded by agent at vendoring, 2026-07-29. - No third-party dependencies: `build.zig.zon` declares `.dependencies = .{}`. + +## Distribution (punkbin route) + +Beside building from this vendored source, the tool is published as a punkbin +artifact so a no-toolchain user has a route that does not depend on the +committed twapi (the G-128 acceptance's distribution clause): + +- Artifact: `win32-x86_64/tools/punkres-x86_64-windows-.exe` in the + punkbin artifact repo (arch-os-version naming per that tier's convention, + beside the zig archives; artifacts are immutable - a new version ADDS a new + file). First published: 0.3.1, sha1 + `166cd17628f6f9457f927eb67d34c9f01c5c5646`, built from this vendored state + with the pinned toolchain via `make.tcl tool build punkres` (test gate + 33/33, ReleaseSafe). +- Integrity: the tools tier's `sha1sums.txt` (regenerated by punkbin's + `src/build_sha1sums.tcl`; punkbin's integrity authority for first-party + tools). A maintainer-signed `.minisig` sidecar is the natural complement + per punkbin's metadata notes - maintainer-gated, not yet present. +- The route: download + `/win32-x86_64/tools/punkres-x86_64-windows-.exe` + (canonical base `https://www.gitea1.intx.com.au/jn/punkbin/raw/branch/master`; + mirrors per the `PUNKBIN_URL` conventions in `bin/AGENTS.md`), verify the + sha1 against the tier's `sha1sums.txt`, place at + `/bin/punkres.exe`. The G-057 kit-icon seam selects the tool + by presence; `make.tcl tool list` then reports its installed state against + the vendored version. +- Publication is maintainer-gated: agents stage and commit artifacts in the + punkbin checkout but never push (punkbin `AGENTS.md`).