diff --git a/ARCHITECTURE.md b/ARCHITECTURE.md index c178ee7c..6a28cc53 100644 --- a/ARCHITECTURE.md +++ b/ARCHITECTURE.md @@ -94,7 +94,7 @@ Two layers with a deliberate dependency direction (the class never depends on th - **Boot-precondition gate (G-125).** A bake refuses a kit whose merged `.vfs` supplies no tcl library rather than deploying an artifact that cannot initialise: the kit lands in `FAILED KITS` and nothing is written, so the previously deployed `bin/` survives. Structural and non-executing (so cross-target kits are covered), reading the merged tree rather than the extraction outcome. The predicate is `punkboot::utils::vfs_boot_library_report`, called through the same guarded require as the provenance check so a stale bootsupport snapshot degrades it to a notice; `make.tcl check` reports ACTIVE/UNAVAILABLE. Sources: `src/AGENTS.md`, `src/modules/punkboot/utils-999999.0a1.0.tm`. - **Payload/target consistency checks (G-133 + G-134), all advisory.** At the same post-merge seam, a bake classifies each binary library in the merged tree by header (`punkboot::utils::binary_arch_classify` - PE/ELF/Mach-O, honest unknowns) against the kit's target platform; wrong-arch libraries outside platform-discriminated subdirs (canonical `-` names, vendor spellings like `win-x64`) earn recapped `BUILD-WARNING`s. After assembly, a kit declaring smoke-require packages (`mapvfs.config` 5th entry element) has each one plain-`package require`d inside the freshly built artifact via its tclsh subcommand - the only check that sees resolution-order defects (wrong-arch version shadowing); cross-target kits skip with a stated reason. The assembled image is also probed for its zip offset convention (G-134, `punkboot::utils::kit_offsetstyle_report` over `punk::zip::archive_info`): a FILE-relative attached payload warns (the pipeline emits archive-relative; the G-128 stamper refuses file-relative by default), no-zip/plain results stay silent. Same guarded-require degradation; `make.tcl check` reports all three. None guarantees statics, pure-tcl packages with binary deps, or version preference beyond the declared smoke set. Sources: `src/AGENTS.md`, `src/runtime/AGENTS.md`, `src/modules/punkboot/utils-999999.0a1.0.tm`. - **Kit icon step (G-057 + G-128).** Every kit a bake builds gets a `.resources.toml` sidecar (deployed beside `bin/`) recording the build-time icon choice - default `src/runtime/punkshell.ico`, overridable by a root `punkshell.ico` in the kit's own custom `.vfs` folder (pre-merge) - with sha256 identity and provenance lifted from the icon's G-135 assetorigin record. win32-target kits get the icon embedded as PE `RT_ICON`/`RT_GROUP_ICON` behind a single seam (`::punkboot::kit_icon_process`): the vendored punkres portable stamper (`src/tools/punkres`, built to `bin/punkres(.exe)` by the make.tcl tool step) is selected when present and works from any build host; otherwise the twapi arm (tcl-sfe mechanism) serves windows hosts with nothing built. Both arms share one semantic (delete all icon/group entries, write ids 1..N; the group is NAMED from the icon file's uppercased rootname - `PUNKSHELL` - with language adopted from the replaced group) and stamp a per-kit copy of the payload-free raw runtime prefix BEFORE payload attach; punkres can also stamp a FINISHED kit post-hoc, preserving an appended zip payload (archive-relative moved verbatim; file-relative refused by default, shifted with a consent flag). Non-PE targets skip as not applicable; a host where neither mechanism serves skips with a combined notice naming the punkres build remedy; the sidecar is written in every case. Sources: `src/AGENTS.md`, `bin/AGENTS.md`, `src/vfs/AGENTS.md`, `src/tools/AGENTS.md`. -- **Buildsuites and the kit family.** `src/buildsuites/suite_tcl90/` builds Tcl/Tk/tcllib from source with a pinned zig toolchain and produces the runtime kit family (plain / punk / bi) plus artifact metadata (G-096-G-117 era: see archived goals G-096, G-098, G-102, G-103, G-107); artifacts publish to the punkbin repo that `bin/punk-runtime.cmd` fetches from. `src/buildsuites/suite_tcl86/` is the 8.6 sibling (G-099 + G-100, both achieved): a Tcl 8.6 windows runtime (static + dynamic shells, `tcl86t.dll`, on-disk lib tree - no zipfs, so no self-contained kit) with thread 2.8 + tclvfs + Tk 8.6 + tklib + tcllib(+tcllibc critcl accelerators) companions, gated against the 8.6 core/thread/tclvfs testsuites with tcllib/tklib on a record tier and an opt-in `test-tk`; punkshell's own runtests is censused on that runtime at parity with a same-day native-8.6 baseline. Suite child shells scrub `TCL__TM_PATH` as well as TCLLIBPATH/TCL_LIBRARY/TK_LIBRARY - without it a census measures the machine's module trees. The 8.6 kit container strategy remains in-flux - see "In-flux areas". +- **Buildsuites and the kit family.** `src/buildsuites/suite_tcl90/` builds Tcl/Tk/tcllib from source with a pinned zig toolchain and produces the runtime kit family (plain / punk / bi) plus artifact metadata (G-096-G-117 era: see archived goals G-096, G-098, G-102, G-103, G-107); artifacts publish to the punkbin repo that `bin/punk-runtime.cmd` fetches from. Both suites also emit the punkbin LIBRARY tier (G-138): verified tcllib/tcllibc installs as generation-tagged immutable zips (`lib/allplatforms` + `lib/`, embedded schema-v2 class=library records, punkzip-deterministic) - the `library-artifacts` step in each recipe; consumption is G-139 territory. `src/buildsuites/suite_tcl86/` is the 8.6 sibling (G-099 + G-100, both achieved): a Tcl 8.6 windows runtime (static + dynamic shells, `tcl86t.dll`, on-disk lib tree - no zipfs, so no self-contained kit) with thread 2.8 + tclvfs + Tk 8.6 + tklib + tcllib(+tcllibc critcl accelerators) companions, gated against the 8.6 core/thread/tclvfs testsuites with tcllib/tklib on a record tier and an opt-in `test-tk`; punkshell's own runtests is censused on that runtime at parity with a same-day native-8.6 baseline. Suite child shells scrub `TCL__TM_PATH` as well as TCLLIBPATH/TCL_LIBRARY/TK_LIBRARY - without it a census measures the machine's module trees. The 8.6 kit container strategy remains in-flux - see "In-flux areas". - **Project generation.** `dev project.new` composes thin layouts from `src/project_layouts/` (overlay chain with `.anti` deletion markers and `name@base` derivation - G-087, achieved) and injects bootsupport modules from the generating shell at generation time. - **Workflow overview.** `tclsh src/make.tcl workflow` prints the embedded ASCII data-flow overview of the build/release pipeline, with its own update contract in `src/AGENTS.md`. This section deliberately summarises rather than copies it. diff --git a/GOALS-archive.md b/GOALS-archive.md index bf2ba3be..88d5af20 100644 --- a/GOALS-archive.md +++ b/GOALS-archive.md @@ -238,3 +238,7 @@ Acceptance: the vendored tool, built by the same make.tcl tool step G-126 establ ### G-134 [achieved 2026-07-29] Baked kits pinned archive-relative: advisory offset-style probe on assembled kit images → detail: goals/archive/G-134-baked-kits-pinned-archive-relative.md Scope: src/make.tcl (post-assembly offset-style probe at the G-133 advisory-check seam, recapped reporting); src/modules/punkboot/utils-999999.0a1.0.tm (probe predicate beside the G-133 scan helpers, guarded require; bootsupport copies via established sync channels); src/tests/modules/punkboot/utils/ + src/tests/shell/testsuites/punkexe/ (characterization); src/AGENTS.md (what the pin does and does not guarantee) Acceptance: each assembled kit image is probed with punk::zip::archive_info and a recapped BUILD-WARNING naming the kit is emitted when offsetstyle is file (advisory per the G-133 posture - the kit still builds and deploys, unlike the G-125 hard gate); plain and none results (no zip attached - the metakit kit shape G-131 targets) are silence, not warnings: the pin covers zip offset convention, not the presence of a zip; today's bakes produce no warning (G-124's measured baseline: every built kit archive-relative); the probe predicate lives in punkboot::utils beside the G-133 scan helpers, called through the same guarded require so a stale bootsupport snapshot degrades it to a NOTE, and tclsh src/make.tcl check reports its ACTIVE/UNAVAILABLE state; characterization pins the warning on a file-relative kit fixture and silence on the archive-relative kit set; scope is make.tcl's own assembly paths only - punk::zip::mkzip -offsettype file and modpod's equivalent REMAIN available for deliberate manual creation of file-relative artifacts (user decision 2026-07-27: the format works and serves naive zip-tooling/SFX-repair interop, it is simply not what our pipeline emits), and external zip-repair tools' file-relative output remains tolerated on input by the G-124 reader and normalized away by any re-bake. + +### G-138 [achieved 2026-07-30] Punkbin library artifact tier: suite-built tcllib/tcllibc published as versioned package zips → detail: goals/archive/G-138-punkbin-library-artifact-tier.md +Scope: src/buildsuites/suite_tcl90/ (library-artifact emission step + tools - beside family_artifacts.tcl, schema emission coordinated with G-123); src/buildsuites/suite_tcl86/ (same emission for the tcl8-generation build); punkbin artifact repo (external, c:/repo/jn/punkbin - new lib/ tier: lib/allplatforms + lib/, layout docs, sha1sums, minisign posture); src/tools/punkzip (as consumed - deterministic zip assembly) +Acceptance: an emission step produces punkbin-layout library artifacts from verified suite builds - suite_tcl90 demonstrated end-to-end (a platform-neutral tcllib zip under lib/allplatforms and a win32-x86_64 tcllibc zip under lib/win32-x86_64), with suite_tcl86's tcl8-generation emission demonstrated or recorded here as an explicit follow-through; zips are assembled with deterministic member ordering (punkzip) so identical input trees reproduce identical zips, and the zig non-bit-reproducibility caveat is recorded with the publish discipline it forces (revisions bump only on deliberate publish, never per rebuild); each zip contains the package folder in installed shape with an embedded punkbin-artifact.toml (class library; provenance covering the source checkout uuids, critcl ref, zig version, optimize mode and driving-shell patchlevel); beside-artifact toml sidecars and sha1sums.txt entries are emitted in the same step; publication to the real punkbin repo remains a deliberate user step and the punkbin layout docs record the lib tier; the md5c package question is dispositioned (published as its own zip or dropped, with the tcllibc-provides-the-md5-accelerator rationale recorded either way). diff --git a/GOALS.md b/GOALS.md index 02db6dcc..c3707212 100644 --- a/GOALS.md +++ b/GOALS.md @@ -407,10 +407,6 @@ Detail: goals/G-136-generated-project-icon-seeding.md Scope: src/tools/punkres/ (VS_VERSIONINFO construction, set-version + field-level read-back - upstream at c:/repo/jn/zig/punkres); src/make.tcl (version stamping at the G-057/G-128 kit-icon seam, punkres arm); bin/*.resources.toml sidecar format + bin/AGENTS.md (version fields and status vocabulary); punkproject.toml (field source - configurable overrides); src/tests/ (characterization) Detail: goals/G-137-kit-version-resources.md -### G-138 [active] Punkbin library artifact tier: suite-built tcllib/tcllibc published as versioned package zips -Scope: src/buildsuites/suite_tcl90/ (library-artifact emission step + tools - beside family_artifacts.tcl, schema emission coordinated with G-123); src/buildsuites/suite_tcl86/ (same emission for the tcl8-generation build); punkbin artifact repo (external, c:/repo/jn/punkbin - new lib/ tier: lib/allplatforms + lib/, layout docs, sha1sums, minisign posture); src/tools/punkzip (as consumed - deterministic zip assembly) -Detail: goals/G-138-punkbin-library-artifact-tier.md - ### G-139 [active] Consume punkbin library artifacts: fetch/materialize tier replacing vendored tcllib/tcllibc Scope: src/make.tcl (consent-gated library fetch entrypoint; libs step consuming the packages tier; vfslibs as touched); bin/packages// (new untracked materialization tier mirroring bin/runtime//); src/runtime/vendorlib_vfs.toml (tcllib/tcllibc kit-vfs declarations with supersedes removal of the legacy versions); src/vendorlib_tcl8/win32-x86_64/tcllib1.21 + src/vendorlib_tcl9/win32-x86_64/tcllib2.0 (retirement targets); src/vfs/*.vfs lib_tcl trees (kit payload switchover incl. the punk86-family tcllib 2.0 upgrade); lib_tcl8/ + lib_tcl9/ (deployed-tree materialization targets); user-config consent (server-trust pattern shared with G-123/G-006) Detail: goals/G-139-punkbin-library-consumption.md diff --git a/goals/G-004-no-committed-binaries.md b/goals/G-004-no-committed-binaries.md index 7c9f885a..e930eb56 100644 --- a/goals/G-004-no-committed-binaries.md +++ b/goals/G-004-no-committed-binaries.md @@ -86,3 +86,4 @@ A standing repo-wide rule in root `AGENTS.md` (User Preferences) already directs - The scan in step 4 should distinguish "executable binary" from "zip archive" and from "zip archive containing an executable." A naive extension-based check is insufficient; content inspection (file magic, zip listing) is required. - The AGENTS.md user-preference rule is the transition guard: it stops agents from adding new binaries during the G-005/G-006 development period while the developer's existing vendor/vfs binary commits are known and intentional. - No persisted prior chat on this topic was found in project sessions; the motivation is the user's stated ultimate aim. +- G-138 (archived 2026-07-30) landed the punkbin lib tier that lets built library binaries leave the tracked tree: suite-built tcllib/tcllibc as immutable generation-tagged zips with embedded provenance records (see goals/archive/G-138-punkbin-library-artifact-tier.md); the vendored src/vendorlib tcllib-tree retirement itself is G-139's sequenced work. diff --git a/goals/G-066-pkgindex-tm-repackaging.md b/goals/G-066-pkgindex-tm-repackaging.md index 3db3de83..aa0218aa 100644 --- a/goals/G-066-pkgindex-tm-repackaging.md +++ b/goals/G-066-pkgindex-tm-repackaging.md @@ -69,3 +69,8 @@ current goal touches this. (manifest-declared multi-name discovery, with the scan-performance parity target); the extraction-path question spun into G-110 (content-addressed shared-lib cache investigation). +- G-138 (archived 2026-07-30) landed the INTERIM carrier this goal's .tm + direction eventually replaces: per-package installed-shape zips in the + punkbin lib tier (deliberately not superseding the .tm route - both consume + the same suite output, so a pkgIndex-to-.tm conversion here can feed the same + channel later; see goals/archive/G-138-punkbin-library-artifact-tier.md). diff --git a/goals/G-067-module-artifact-channel.md b/goals/G-067-module-artifact-channel.md index 0fbd5d0d..1a1275f8 100644 --- a/goals/G-067-module-artifact-channel.md +++ b/goals/G-067-module-artifact-channel.md @@ -67,3 +67,9 @@ and pull (G-065) instead of re-vendoring by hand. land in working-tree vendor areas - in punkshell itself ignore rules keep them UNCOMMITTED (the committed tree stays binary-free; the promise stays auditable), while derived projects commit them or not per their own binary policy. +- G-138 (archived 2026-07-30) realized an interim zip-based library tier on + punkbin (lib/allplatforms + lib/, schema-v2 class=library embedded + records, generation-tagged immutable names - see + goals/archive/G-138-punkbin-library-artifact-tier.md); this goal's .tm + artifact channel remains the long game and would replace that tier's carrier + format while inheriting its record/provenance pattern. diff --git a/goals/G-123-thirdparty-runtime-tiers.md b/goals/G-123-thirdparty-runtime-tiers.md index a124e239..36a41afa 100644 --- a/goals/G-123-thirdparty-runtime-tiers.md +++ b/goals/G-123-thirdparty-runtime-tiers.md @@ -106,3 +106,11 @@ see goals/archive/G-058-static-runtime-packages.md). kit that passed its declared smoke-requires (plain package require inside the built artifact) plus a clean advisory binary-arch scan - see goals/archive/G-133-bake-payload-consistency-checks.md. +- G-138 (archived 2026-07-30) landed schema v2 FIRST, for the library class: + schema = 2 records with [provenance] class = "suite-built" (the + suite-built|third-party|local field this goal specified), documented in + punkbin AGENTS.md "Library artifacts - lib tier (schema v2)" including the + v2-superset guarantee and the class-line ordering caveat for whole-text + scanners. This goal's runtime-side v2 emission (family_artifacts.tcl) and + the retroactive third-party backfill ride that lineage rather than + introducing it - see goals/archive/G-138-punkbin-library-artifact-tier.md. diff --git a/goals/G-138-punkbin-library-artifact-tier.md b/goals/G-138-punkbin-library-artifact-tier.md index d790582f..81c7003d 100644 --- a/goals/G-138-punkbin-library-artifact-tier.md +++ b/goals/G-138-punkbin-library-artifact-tier.md @@ -1,6 +1,6 @@ # G-138 Punkbin library artifact tier: suite-built tcllib/tcllibc published as versioned package zips -Status: active +Status: achieved 2026-07-30 Scope: src/buildsuites/suite_tcl90/ (library-artifact emission step + tools - beside family_artifacts.tcl, schema emission coordinated with G-123); src/buildsuites/suite_tcl86/ (same emission for the tcl8-generation build); punkbin artifact repo (external, c:/repo/jn/punkbin - new lib/ tier: lib/allplatforms + lib/, layout docs, sha1sums, minisign posture); src/tools/punkzip (as consumed - deterministic zip assembly) Goal: the library packages the buildsuites already build and verify - tcllib (pure-Tcl, platform-neutral) and tcllibc (per-platform critcl accelerators built by critcl driving zig cc), both Tcl generations - are published as immutable `-r.zip` artifacts in a distinct library tier of the punkbin artifact repository (platform-neutral packages under lib/allplatforms, per-platform binary packages under lib/), each zip carrying the package folder in installed pkgIndex.tcl shape plus an embedded artifact record (schema class "library", the G-123 schema-v2 lineage) with checkout/toolchain provenance, so library binaries get the same punkbin integrity story as runtimes (immutable -r names, toml sidecars, sha1sums, minisign posture) and the repo can stop carrying hand-dropped built copies (the G-004 direction; consumption is G-139). Acceptance: an emission step produces punkbin-layout library artifacts from verified suite builds - suite_tcl90 demonstrated end-to-end (a platform-neutral tcllib zip under lib/allplatforms and a win32-x86_64 tcllibc zip under lib/win32-x86_64), with suite_tcl86's tcl8-generation emission demonstrated or recorded here as an explicit follow-through; zips are assembled with deterministic member ordering (punkzip) so identical input trees reproduce identical zips, and the zig non-bit-reproducibility caveat is recorded with the publish discipline it forces (revisions bump only on deliberate publish, never per rebuild); each zip contains the package folder in installed shape with an embedded punkbin-artifact.toml (class library; provenance covering the source checkout uuids, critcl ref, zig version, optimize mode and driving-shell patchlevel); beside-artifact toml sidecars and sha1sums.txt entries are emitted in the same step; publication to the real punkbin repo remains a deliberate user step and the punkbin layout docs record the lib tier; the md5c package question is dispositioned (published as its own zip or dropped, with the tcllibc-provides-the-md5-accelerator rationale recorded either way). @@ -150,5 +150,27 @@ via an untracked bin/packages/ tier (G-139). critcl re-runs (Run cache keys include the inherited PATH, so a different shell session re-runs critcl; the step succeeds, zig still prints the command under a 'failed command:' banner when stderr had warnings). -- Remaining for acceptance: punkbin layout docs record the lib tier (punkbin - repo AGENTS.md/README + build_sha1sums.tcl lib handling). +- 2026-07-30 punkbin layout docs landed (the last acceptance item): punkbin + AGENTS.md gains the lib-tier layout contract line + a "Library artifacts - + lib tier (schema v2)" section (naming, embedded-record shape and the + v2-superset/ordering caveats, determinism + deliberate-publish discipline, + md5c disposition, publication flow); README.md mentions the tier; + build_sha1sums.tcl processes lib/ subfolders (per-target sha1sums, + lib never enters platforms.txt) - verified against the repo (no lib/ yet: + clean no-op; existing artifacts SAME). Committed in the punkbin repo (git + only there - not pushed; pushing is the maintainer's call). +- ACHIEVED FLIP 2026-07-30. Acceptance walk: emission step from verified + builds (dependency chain re-runs the smokes + family check per emission) - + BOTH suites demonstrated, exceeding the demonstrate-90/record-86 minimum; + deterministic punkzip assembly with byte-identical re-emission verified in + both; non-reproducibility caveat + deliberate-publish revision discipline + recorded (recipes, suite READMEs, punkbin AGENTS.md); embedded class=library + records carry source checkout uuids, critcl ref + version, zig version, + optimize mode, driving-shell patchlevel (inspected in the emitted sidecars); + sidecars + per-tier sha1sums emitted in the same step; publication remains a + deliberate user step (nothing was published; artifacts sit under each + suite's out/library/punkbin/lib, revisions unbumped at default 1); punkbin + layout docs record the tier; md5c dispositioned (dropped, rationale above). + Honesty note: sidecar [tests] lines are the suite's recorded G-107 evidence + for the source/toolchain combination (the established runtime-tier + semantic), not per-byte proofs of a given rebuild's dll. diff --git a/goals/G-139-punkbin-library-consumption.md b/goals/G-139-punkbin-library-consumption.md index 4065b499..b179ff7e 100644 --- a/goals/G-139-punkbin-library-consumption.md +++ b/goals/G-139-punkbin-library-consumption.md @@ -7,9 +7,10 @@ Acceptance: a make.tcl entrypoint fetches declared library artifacts from the pu ## Context -The publish half is G-138 (see its Context for the 2026-07-30 provenance -investigation that motivated both). This goal owns the consuming side and the -repo-changing consequences: what src/vendorlib_tcl means afterwards (it +The publish half is G-138 (achieved 2026-07-30 - see +goals/archive/G-138-punkbin-library-artifact-tier.md, including the original +provenance investigation that motivated both). This goal owns the consuming +side and the repo-changing consequences: what src/vendorlib_tcl means afterwards (it shrinks to genuinely hand-managed exceptions), how kit vfs trees stop drifting independently, and how derived projects get the same packages. @@ -68,7 +69,8 @@ State at drafting worth recording: ## Alternatives considered - Keep vendoring (suite output committed into src/vendorlib) - rejected: - G-004 direction; see G-138 Alternatives. + G-004 direction; see the archived G-138 Alternatives + (goals/archive/G-138-punkbin-library-artifact-tier.md). - Fetch directly into lib_tcl with no bin/packages tier - rejected: the input-tier split (immutable verified artifact copy vs punkcheck-installed deployment) is what makes re-bakes, freshness checks and multi-kit @@ -79,7 +81,20 @@ State at drafting worth recording: ## Notes -- Related: G-138 - the publish half; this goal consumes its tier. +- Related: G-138 - the publish half; this goal consumes its tier. ACHIEVED + 2026-07-30 (see goals/archive/G-138-punkbin-library-artifact-tier.md). What + it settled that this goal consumes: artifact naming is + `--r.zip` (generation tag is identity - the + tcl8/tcl9 builds are different bytes under identical folder names); each zip + carries the package folder in installed shape + embedded schema-v2 + class=library record at `/punkbin-artifact.toml`; md5c is DROPPED + (tcllib's md5 prefers tcllibc, which bundles the accelerator) - so the + supersedes removal of tcllib1.21's nested md5c needs no replacement package; + emitted-but-unpublished artifacts stage under each suite's + `out/library/punkbin/lib/` (r1, nothing published yet - publication is the + user step this goal's fetch consumes afterwards); punkbin + build_sha1sums.tcl already handles the lib tier and its AGENTS.md documents + the record schema. - Related: G-123 - shared consent posture and materialization idiom (bin/runtime/ : runtimes :: bin/packages/ : libraries). - Related: G-004 - the vendored-tree retirement is its first major payoff. diff --git a/src/buildsuites/AGENTS.md b/src/buildsuites/AGENTS.md index f8122a93..5e0e1c1d 100644 --- a/src/buildsuites/AGENTS.md +++ b/src/buildsuites/AGENTS.md @@ -38,13 +38,15 @@ this project's `src/` tree. ## Child DOX Index -- `suite_tcl90/` - Tcl 9.0 suite (its README.md carries lineage/detail; no +- `suite_tcl90/` - Tcl 9.0 suite (its README.md carries lineage/detail, + including the G-138 `library-artifacts` punkbin lib-tier emission; no child AGENTS.md yet) - `suite_tcl86/` - Tcl 8.6 suite (G-099 achieved 2026-07-26: tclsh86ts/tclsh86t + tcl86t.dll + lib tree, thread 2.8.13 + tclvfs 1.4.2, core/thread/tclvfs - gates; G-100 active: Tk 8.6.17 + tklib 0.9 + tcllib 2.0/tcllibc, and - punkshell's own runtests censused on this runtime). Its README.md carries the - deliverables, source selections, both makefile.vc DERIVATION records and the - hermetic-environment finding (TCL__TM_PATH must be scrubbed - alongside TCLLIBPATH/TCL_LIBRARY or a census measures the machine); no child - AGENTS.md yet + gates; G-100 achieved 2026-07-26: Tk 8.6.17 + tklib 0.9 + tcllib 2.0/tcllibc, + and punkshell's own runtests censused on this runtime; G-138 + `library-artifacts` emits the tcl8-generation punkbin lib tier). Its README.md + carries the deliverables, source selections, both makefile.vc DERIVATION + records and the hermetic-environment finding (TCL__TM_PATH must + be scrubbed alongside TCLLIBPATH/TCL_LIBRARY or a census measures the + machine); no child AGENTS.md yet