G-138 achieved 2026-07-30: flip + archive record + reference sweep
Acceptance met in full (walk recorded in the detail file's Progress): emission
step landed in BOTH suites and demonstrated end-to-end - exceeding the
demonstrate-90/record-86-follow-through minimum - with byte-identical
re-emission verified, provenance-complete schema-v2 class=library records,
sidecars + per-tier sha1sums in the same step, publication left a deliberate
user step, punkbin layout docs recording the tier (punkbin repo commit
c38686a), and md5c dispositioned (dropped; tcllib's md5 prefers tcllibc,
which bundles the accelerator).
Index entry -> GOALS-archive.md record (file's established arrow-format
convention retained). Reference sweep: G-139 Context/Alternatives/Related
updated with achieved markers + archive path, and G-138's actionable
outcomes pushed to their consumers - G-139 (settled naming, md5c drop,
staging locations of the emitted r1 artifacts), G-123 (schema v2 landed
first for the library class - runtime-side v2 rides the lineage), G-004
(lib tier = the route for library binaries out of the tracked tree),
G-066/G-067 (zip tier recorded as the interim carrier for the .tm long
game). goals_xref report shows no unlinked pairs bridged only by G-138.
ARCHITECTURE.md buildsuites paragraph gains the lib-tier sentence
(architecture_lint clean); src/buildsuites/AGENTS.md child index updated
(also corrects the stale 'G-100 active' to achieved 2026-07-26).
Detail-file move to goals/archive/ follows in the adjacent pure-rename
commit per the Doc Restructures rule.
Assisted-by: harness=claude; primary-model=claude-fable-5; api-location=anthropic.com
@ -94,7 +94,7 @@ Two layers with a deliberate dependency direction (the class never depends on th
- **Boot-precondition gate (G-125).** A bake refuses a kit whose merged `.vfs` supplies no tcl library rather than deploying an artifact that cannot initialise: the kit lands in `FAILED KITS` and nothing is written, so the previously deployed `bin/<kit>` survives. Structural and non-executing (so cross-target kits are covered), reading the merged tree rather than the extraction outcome. The predicate is `punkboot::utils::vfs_boot_library_report`, called through the same guarded require as the provenance check so a stale bootsupport snapshot degrades it to a notice; `make.tcl check` reports ACTIVE/UNAVAILABLE. Sources: `src/AGENTS.md`, `src/modules/punkboot/utils-999999.0a1.0.tm`.
- **Payload/target consistency checks (G-133 + G-134), all advisory.** At the same post-merge seam, a bake classifies each binary library in the merged tree by header (`punkboot::utils::binary_arch_classify` - PE/ELF/Mach-O, honest unknowns) against the kit's target platform; wrong-arch libraries outside platform-discriminated subdirs (canonical `<os>-<cpu>` names, vendor spellings like `win-x64`) earn recapped `BUILD-WARNING`s. After assembly, a kit declaring smoke-require packages (`mapvfs.config` 5th entry element) has each one plain-`package require`d inside the freshly built artifact via its tclsh subcommand - the only check that sees resolution-order defects (wrong-arch version shadowing); cross-target kits skip with a stated reason. The assembled image is also probed for its zip offset convention (G-134, `punkboot::utils::kit_offsetstyle_report` over `punk::zip::archive_info`): a FILE-relative attached payload warns (the pipeline emits archive-relative; the G-128 stamper refuses file-relative by default), no-zip/plain results stay silent. Same guarded-require degradation; `make.tcl check` reports all three. None guarantees statics, pure-tcl packages with binary deps, or version preference beyond the declared smoke set. Sources: `src/AGENTS.md`, `src/runtime/AGENTS.md`, `src/modules/punkboot/utils-999999.0a1.0.tm`.
- **Kit icon step (G-057 + G-128).** Every kit a bake builds gets a `<kitname>.resources.toml` sidecar (deployed beside `bin/<kit>`) recording the build-time icon choice - default `src/runtime/punkshell.ico`, overridable by a root `punkshell.ico` in the kit's own custom `.vfs` folder (pre-merge) - with sha256 identity and provenance lifted from the icon's G-135 assetorigin record. win32-target kits get the icon embedded as PE `RT_ICON`/`RT_GROUP_ICON` behind a single seam (`::punkboot::kit_icon_process`): the vendored punkres portable stamper (`src/tools/punkres`, built to `bin/punkres(.exe)` by the make.tcl tool step) is selected when present and works from any build host; otherwise the twapi arm (tcl-sfe mechanism) serves windows hosts with nothing built. Both arms share one semantic (delete all icon/group entries, write ids 1..N; the group is NAMED from the icon file's uppercased rootname - `PUNKSHELL` - with language adopted from the replaced group) and stamp a per-kit copy of the payload-free raw runtime prefix BEFORE payload attach; punkres can also stamp a FINISHED kit post-hoc, preserving an appended zip payload (archive-relative moved verbatim; file-relative refused by default, shifted with a consent flag). Non-PE targets skip as not applicable; a host where neither mechanism serves skips with a combined notice naming the punkres build remedy; the sidecar is written in every case. Sources: `src/AGENTS.md`, `bin/AGENTS.md`, `src/vfs/AGENTS.md`, `src/tools/AGENTS.md`.
- **Buildsuites and the kit family.**`src/buildsuites/suite_tcl90/` builds Tcl/Tk/tcllib from source with a pinned zig toolchain and produces the runtime kit family (plain / punk / bi) plus artifact metadata (G-096-G-117 era: see archived goals G-096, G-098, G-102, G-103, G-107); artifacts publish to the punkbin repo that `bin/punk-runtime.cmd` fetches from. `src/buildsuites/suite_tcl86/` is the 8.6 sibling (G-099 + G-100, both achieved): a Tcl 8.6 windows runtime (static + dynamic shells, `tcl86t.dll`, on-disk lib tree - no zipfs, so no self-contained kit) with thread 2.8 + tclvfs + Tk 8.6 + tklib + tcllib(+tcllibc critcl accelerators) companions, gated against the 8.6 core/thread/tclvfs testsuites with tcllib/tklib on a record tier and an opt-in `test-tk`; punkshell's own runtests is censused on that runtime at parity with a same-day native-8.6 baseline. Suite child shells scrub `TCL<major>_<minor>_TM_PATH` as well as TCLLIBPATH/TCL_LIBRARY/TK_LIBRARY - without it a census measures the machine's module trees. The 8.6 kit container strategy remains in-flux - see "In-flux areas".
- **Buildsuites and the kit family.**`src/buildsuites/suite_tcl90/` builds Tcl/Tk/tcllib from source with a pinned zig toolchain and produces the runtime kit family (plain / punk / bi) plus artifact metadata (G-096-G-117 era: see archived goals G-096, G-098, G-102, G-103, G-107); artifacts publish to the punkbin repo that `bin/punk-runtime.cmd` fetches from. Both suites also emit the punkbin LIBRARY tier (G-138): verified tcllib/tcllibc installs as generation-tagged immutable zips (`lib/allplatforms` + `lib/<target>`, embedded schema-v2 class=library records, punkzip-deterministic) - the `library-artifacts` step in each recipe; consumption is G-139 territory. `src/buildsuites/suite_tcl86/` is the 8.6 sibling (G-099 + G-100, both achieved): a Tcl 8.6 windows runtime (static + dynamic shells, `tcl86t.dll`, on-disk lib tree - no zipfs, so no self-contained kit) with thread 2.8 + tclvfs + Tk 8.6 + tklib + tcllib(+tcllibc critcl accelerators) companions, gated against the 8.6 core/thread/tclvfs testsuites with tcllib/tklib on a record tier and an opt-in `test-tk`; punkshell's own runtests is censused on that runtime at parity with a same-day native-8.6 baseline. Suite child shells scrub `TCL<major>_<minor>_TM_PATH` as well as TCLLIBPATH/TCL_LIBRARY/TK_LIBRARY - without it a census measures the machine's module trees. The 8.6 kit container strategy remains in-flux - see "In-flux areas".
- **Project generation.**`dev project.new` composes thin layouts from `src/project_layouts/` (overlay chain with `.anti` deletion markers and `name@base` derivation - G-087, achieved) and injects bootsupport modules from the generating shell at generation time.
- **Workflow overview.**`tclsh src/make.tcl workflow` prints the embedded ASCII data-flow overview of the build/release pipeline, with its own update contract in `src/AGENTS.md`. This section deliberately summarises rather than copies it.
Scope: src/make.tcl (post-assembly offset-style probe at the G-133 advisory-check seam, recapped reporting); src/modules/punkboot/utils-999999.0a1.0.tm (probe predicate beside the G-133 scan helpers, guarded require; bootsupport copies via established sync channels); src/tests/modules/punkboot/utils/ + src/tests/shell/testsuites/punkexe/ (characterization); src/AGENTS.md (what the pin does and does not guarantee)
Acceptance: each assembled kit image is probed with punk::zip::archive_info and a recapped BUILD-WARNING naming the kit is emitted when offsetstyle is file (advisory per the G-133 posture - the kit still builds and deploys, unlike the G-125 hard gate); plain and none results (no zip attached - the metakit kit shape G-131 targets) are silence, not warnings: the pin covers zip offset convention, not the presence of a zip; today's bakes produce no warning (G-124's measured baseline: every built kit archive-relative); the probe predicate lives in punkboot::utils beside the G-133 scan helpers, called through the same guarded require so a stale bootsupport snapshot degrades it to a NOTE, and tclsh src/make.tcl check reports its ACTIVE/UNAVAILABLE state; characterization pins the warning on a file-relative kit fixture and silence on the archive-relative kit set; scope is make.tcl's own assembly paths only - punk::zip::mkzip -offsettype file and modpod's equivalent REMAIN available for deliberate manual creation of file-relative artifacts (user decision 2026-07-27: the format works and serves naive zip-tooling/SFX-repair interop, it is simply not what our pipeline emits), and external zip-repair tools' file-relative output remains tolerated on input by the G-124 reader and normalized away by any re-bake.
### G-138 [achieved 2026-07-30] Punkbin library artifact tier: suite-built tcllib/tcllibc published as versioned package zips → detail: goals/archive/G-138-punkbin-library-artifact-tier.md
Scope: src/buildsuites/suite_tcl90/ (library-artifact emission step + tools - beside family_artifacts.tcl, schema emission coordinated with G-123); src/buildsuites/suite_tcl86/ (same emission for the tcl8-generation build); punkbin artifact repo (external, c:/repo/jn/punkbin - new lib/ tier: lib/allplatforms + lib/<target>, layout docs, sha1sums, minisign posture); src/tools/punkzip (as consumed - deterministic zip assembly)
Acceptance: an emission step produces punkbin-layout library artifacts from verified suite builds - suite_tcl90 demonstrated end-to-end (a platform-neutral tcllib zip under lib/allplatforms and a win32-x86_64 tcllibc zip under lib/win32-x86_64), with suite_tcl86's tcl8-generation emission demonstrated or recorded here as an explicit follow-through; zips are assembled with deterministic member ordering (punkzip) so identical input trees reproduce identical zips, and the zig non-bit-reproducibility caveat is recorded with the publish discipline it forces (revisions bump only on deliberate publish, never per rebuild); each zip contains the package folder in installed shape with an embedded punkbin-artifact.toml (class library; provenance covering the source checkout uuids, critcl ref, zig version, optimize mode and driving-shell patchlevel); beside-artifact toml sidecars and sha1sums.txt entries are emitted in the same step; publication to the real punkbin repo remains a deliberate user step and the punkbin layout docs record the lib tier; the md5c package question is dispositioned (published as its own zip or dropped, with the tcllibc-provides-the-md5-accelerator rationale recorded either way).
@ -86,3 +86,4 @@ A standing repo-wide rule in root `AGENTS.md` (User Preferences) already directs
- The scan in step 4 should distinguish "executable binary" from "zip archive" and from "zip archive containing an executable." A naive extension-based check is insufficient; content inspection (file magic, zip listing) is required.
- The AGENTS.md user-preference rule is the transition guard: it stops agents from adding new binaries during the G-005/G-006 development period while the developer's existing vendor/vfs binary commits are known and intentional.
- No persisted prior chat on this topic was found in project sessions; the motivation is the user's stated ultimate aim.
- G-138 (archived 2026-07-30) landed the punkbin lib tier that lets built library binaries leave the tracked tree: suite-built tcllib/tcllibc as immutable generation-tagged zips with embedded provenance records (see goals/archive/G-138-punkbin-library-artifact-tier.md); the vendored src/vendorlib tcllib-tree retirement itself is G-139's sequenced work.
# G-138 Punkbin library artifact tier: suite-built tcllib/tcllibc published as versioned package zips
Status: active
Status: achieved 2026-07-30
Scope: src/buildsuites/suite_tcl90/ (library-artifact emission step + tools - beside family_artifacts.tcl, schema emission coordinated with G-123); src/buildsuites/suite_tcl86/ (same emission for the tcl8-generation build); punkbin artifact repo (external, c:/repo/jn/punkbin - new lib/ tier: lib/allplatforms + lib/<target>, layout docs, sha1sums, minisign posture); src/tools/punkzip (as consumed - deterministic zip assembly)
Goal: the library packages the buildsuites already build and verify - tcllib (pure-Tcl, platform-neutral) and tcllibc (per-platform critcl accelerators built by critcl driving zig cc), both Tcl generations - are published as immutable `<package>-r<N>.zip` artifacts in a distinct library tier of the punkbin artifact repository (platform-neutral packages under lib/allplatforms, per-platform binary packages under lib/<target>), each zip carrying the package folder in installed pkgIndex.tcl shape plus an embedded artifact record (schema class "library", the G-123 schema-v2 lineage) with checkout/toolchain provenance, so library binaries get the same punkbin integrity story as runtimes (immutable -r<N> names, toml sidecars, sha1sums, minisign posture) and the repo can stop carrying hand-dropped built copies (the G-004 direction; consumption is G-139).
Acceptance: an emission step produces punkbin-layout library artifacts from verified suite builds - suite_tcl90 demonstrated end-to-end (a platform-neutral tcllib zip under lib/allplatforms and a win32-x86_64 tcllibc zip under lib/win32-x86_64), with suite_tcl86's tcl8-generation emission demonstrated or recorded here as an explicit follow-through; zips are assembled with deterministic member ordering (punkzip) so identical input trees reproduce identical zips, and the zig non-bit-reproducibility caveat is recorded with the publish discipline it forces (revisions bump only on deliberate publish, never per rebuild); each zip contains the package folder in installed shape with an embedded punkbin-artifact.toml (class library; provenance covering the source checkout uuids, critcl ref, zig version, optimize mode and driving-shell patchlevel); beside-artifact toml sidecars and sha1sums.txt entries are emitted in the same step; publication to the real punkbin repo remains a deliberate user step and the punkbin layout docs record the lib tier; the md5c package question is dispositioned (published as its own zip or dropped, with the tcllibc-provides-the-md5-accelerator rationale recorded either way).
@ -150,5 +150,27 @@ via an untracked bin/packages/<target> tier (G-139).
critcl re-runs (Run cache keys include the inherited PATH, so a different
shell session re-runs critcl; the step succeeds, zig still prints the
command under a 'failed command:' banner when stderr had warnings).
- Remaining for acceptance: punkbin layout docs record the lib tier (punkbin
