Browse Source

Refresh stale punkbin commit-hash pins in archived goals (punkbin shellspy->punkshell sweep)

The punkbin artifact repo carried the wrong project token ("shellspy" - the
experimental subcommand, not the project name per root AGENTS.md) in 10 commit
messages (subjects AND bodies) back to the repo's earliest scaffolding. A
message-only `git filter-branch --msg-filter 'sed s/shellspy/punkshell/g'` over
the whole shellspy-bearing history rewrote all 10 (20 commits replayed, trees
byte-identical - --msg-filter cannot alter content), force-pushed to
origin/master (now 63f5e558). punkbin is git-only (no fossil).

The rewrite changed every commit hash in the swept range, so punkbin commit-hash
pins in archived goal detail files went stale. Refreshed all of them to the new
hashes so the records stay honest pointers rather than dangling references:
- G-172 (3 pins): ab5611d -> a73d862e; 59e7475 -> 63f5e558 (this goal's two
  in-situ republish commits - my session's defect; the earlier 2-commit amend
  had already left these pins stale and this refresh clears them).
- G-128 (3 pins): 1b471fc -> 2d2bf48 (punkres stamper publication).
- G-139 (1 pin): ee571ed -> e5c86eb (lib tier r1 publication).
- G-123 (2 pins): 1f10390 -> 0d49aa7 (retroactive schema-v2 sidecars).
- G-165 (1 pin): a22e16b -> a8303c4 (punkzip root-strip/exclude build options).

Per goals/AGENTS.md archived files are frozen except Follow-on dispositions;
this refresh is a sanctioned exception under explicit user permission to make
archived goals honest regarding hashes. Pure hash-token substitutions - no
prose, Scope, Goal or Acceptance text changed. The dated achievement-time
qualifiers around the pins (e.g "LOCAL ONLY - not pushed", "STAGED", "REMAINS
for acceptance") are point-in-time history and stay untouched. goals_lint clean.

Assisted-by: harness=pi; primary-model=huggingface/zai-org/GLM-5.2; api-location=huggingface.co
master
Julian Noble 4 days ago
parent
commit
3450a9d3cb
  1. 4
      goals/archive/G-123-thirdparty-runtime-tiers.md
  2. 6
      goals/archive/G-128-portable-pe-resource-stamping.md
  3. 2
      goals/archive/G-139-punkbin-library-consumption.md
  4. 2
      goals/archive/G-165-driver-invariant-kit-assembly.md
  5. 6
      goals/archive/G-172-distributed-binary-cpu-floor.md

4
goals/archive/G-123-thirdparty-runtime-tiers.md

@ -176,7 +176,7 @@ see goals/archive/G-058-static-runtime-packages.md).
differ from the PUBLISHED r2 bytes (v2 record + non-reproducible
dlls) - publishing v2 runtime records is a deliberate user step that
bumps to -r3; never overwrite the published r2.
- punkbin side (git 1f10390, LOCAL ONLY - not pushed; publication stays
- punkbin side (git 0d49aa7, LOCAL ONLY - not pushed; publication stays
the maintainer's call): 12 retroactive schema-v2 sidecars across all
five runtime tiers - every pre-family artifact now carries
machine-readable build origin ([provenance] class third-party|local
@ -336,7 +336,7 @@ see goals/archive/G-058-static-runtime-packages.md).
(4) existing punkbin third-party artifacts gained retroactive schema-v2
sidecars ADDITIVELY (12 artifacts, all five tiers; artifact bytes,
bare names and sha1sums authority unchanged; toml-less entries degrade
as no-basis rows - pinned) - punkbin git 1f10390 (local; push is the
as no-basis rows - pinned) - punkbin git 0d49aa7 (local; push is the
maintainer's publication act).
(5) consent keyed to SERVER TRUST: the canonical origin (trusted
default) prompts nothing - live canonical fetch evidence + the G-058

6
goals/archive/G-128-portable-pe-resource-stamping.md

@ -418,7 +418,7 @@ the parked RT_VERSION stamping wants, since the project version is known late.
(arch-os-version naming beside the zig archives; immutable - new versions
add files), integrity via that tier's sha1sums.txt (punkbin's authority for
first-party tools; maintainer-signed .minisig = natural complement, not yet
present). STAGED: punkbin commit 1b471fc adds
present). STAGED: punkbin commit 2d2bf48 adds
punkres-x86_64-windows-0.3.1.exe (sha1 166cd176..., built by the tool step
from vendored 0.3.1/f0af880 with the pinned toolchain), sha1sums row
regenerated all-SAME-plus-one-NEW; push is maintainer-gated per punkbin
@ -431,11 +431,11 @@ the parked RT_VERSION stamping wants, since the project version is known late.
the PE-header timestamp region, so the published sha1 pins THE artifact
(the vendored source + pinned toolchain reproduce a functionally
identical tool, not identical bytes).
- REMAINS for acceptance: the maintainer push of punkbin 1b471fc (making the
- REMAINS for acceptance: the maintainer push of punkbin 2d2bf48 (making the
fetch URL live). On push, every acceptance clause reads satisfied -
flagging the achieved flip for confirmation at that point.
- 2026-07-29 PUBLICATION LIVE - acceptance FULLY MET (flip evidence): after
the maintainer push of punkbin 1b471fc, the route was verified against the
the maintainer push of punkbin 2d2bf48, the route was verified against the
live server: punkres-x86_64-windows-0.3.1.exe fetched from
https://www.gitea1.intx.com.au/jn/punkbin/raw/branch/master/win32-x86_64/tools/,
sha1 matches the server's sha1sums.txt row and the staged value

2
goals/archive/G-139-punkbin-library-consumption.md

@ -167,7 +167,7 @@ State at drafting worth recording:
- 2026-07-30 r1 PUBLISHED (user-directed): all four artifacts + sidecars
copied into the punkbin repo's lib tier, build_sha1sums.tcl generated the
per-tier sha1sums (every hash byte-identical to the staging emission;
platforms.txt untouched), committed (punkbin ee571ed) and PUSHED to the
platforms.txt untouched), committed (punkbin e5c86eb) and PUSHED to the
gitea origin together with the earlier lib-tier docs commit. The canonical
fetch path verified LIVE immediately after: 'make.tcl libfetch -force'
with no server flags fetched, sha1-verified and materialized all four

2
goals/archive/G-165-driver-invariant-kit-assembly.md

@ -181,7 +181,7 @@ enabling step):
win32-x86_64/tools/punkzip-x86_64-windows-2.4.0.exe (sha1
2008b51ffa26e31faa0e76ea1e229ee1cec16395, recorded in the tier's
sha1sums.txt via src/build_sha1sums.tcl - NEW, no CHANGED), punkbin git
a22e16b, pushed to the canonical origin. Non-windows cross-builds remain
a8303c4, pushed to the canonical origin. Non-windows cross-builds remain
a follow-on (see Follow-ons). This satisfies the acceptance's final item
(publication recorded - not deferred).

6
goals/archive/G-172-distributed-binary-cpu-floor.md

@ -209,7 +209,7 @@ project's first contact with a new user fails with no message at all.
race - passed on both reruns; one intermediate run hung 4h inside
httpProxy.test "ThreadLevel 1", the socket-flake class - killed and rerun).
lib tier audited clean (tcllibc.dll zmm=0; the critcl -target pin already
protected it). Published in-situ: punkbin ab5611d (3 exes + 3 schema-2
protected it). Published in-situ: punkbin a73d862e (3 exes + 3 schema-2
tomls + 2 versioned tool exes + both sha1sums.txt), pushed to
origin/master. Record-honesty residual: the published tomls' [tests] lines
carry the emission-time (July) summaries; the fresh shipped-codegen gate
@ -294,7 +294,7 @@ project's first contact with a new user fails with no message at all.
re-ran). family_check passed for all three members (the new
embed_cpu_floor/embed_cpu_model assertions are green). Audit of the rebuilt r2
exes: all three PASS at the baseline floor with zmm=0 ymm=0 out-of-floor=0.
Published in-situ to punkbin (git 59e7475, pushed to origin/master): the three
Published in-situ to punkbin (git 63f5e558, pushed to origin/master): the three
r2 exes + three r2 tomls replaced under their existing names/revisions; each
toml [provenance] now carries cpu_floor="baseline" + cpu_model="x86_64"; the
[tests] tclcore line refreshed to the shipped-codegen gate evidence
@ -317,7 +317,7 @@ project's first contact with a new user fails with no message at all.
clean; suite_tcl86's lib tier (tcllibc.dll) was audited clean then too.)
- each published artifact's metadata record states the floor: the republished
tomls carry cpu_floor/cpu_model in [provenance] (verified by diff vs the prior
ab5611d tomls and by punk-runtime info).
a73d862e tomls and by punk-runtime info).
- punk-runtime surfaces it: `info` shows the cpu_floor/cpu_model rows
(embedded = sidecar, sha1 matches); `list` shows floor=baseline in the
metadata summary; `use` selects cleanly on the meets verdict (this v4 host

Loading…
Cancel
Save