G-123 activated: third-party runtime tiers (user-directed flip)

proposed -> active in both tiers. Activation-freshness survey re-run
(goals_xref score G-123) per the maintenance rules: strongest pairs
G-127 and interval-drafted G-141; back-pointer Related lines recorded
in the detail file for G-141 (lib-tier selectivity sibling sharing the
server-trust consent surface), G-127 (cross-target kit bakes consume
served tiers), G-130 (32-bit runtimes publish through the per-target
layout) and G-131 (win32-ix86 zipfs specimens are third-party tclkits
the provenance backfill covers).

Assisted-by: harness=claude; primary-model=claude-fable-5; api-location=anthropic.com

GOALS.md

@@ -377,7 +377,7 @@ Detail: goals/G-115-declarative-vfs-composition.md
 Scope: src/buildsuites/suite_tcl90/ (build_tcltls module + crypto-backend build, sources.config + build.zig.zon source records, kit-family bi payload + metadata extension, test_gate record step); src/vfs kit payloads carrying vendored tcltls binaries (current-state reference + recorded disposition only - removal stays G-004-era work); punkbin (as eventual artifact destination via the G-067 library class); consumers punk::imap4 / punk::netbox (package require tls) as verification context
 Detail: goals/G-116-suite-built-tcltls.md
 
-### G-123 [proposed] Third-party runtime tiers via artifact servers: per-target publish, list, fetch, materialize
+### G-123 [active] Third-party runtime tiers via artifact servers: per-target publish, list, fetch, materialize
 Scope: src/scriptapps/punk-runtime.ps1 + src/scriptapps/bin/punk-runtime.bash + punk-runtime_wrap.toml (named-tier operations in both payloads; bin/punk-runtime.cmd via the established re-wrap channel); punkbin artifact repo (external, c:/repo/jn/punkbin - per-tier layout, defaults, sha1sums, schema-v2 provenance sidecars incl. retroactive backfill, layout docs); src/buildsuites/suite_tcl90/ (family_artifacts.tcl schema-v2 emission for suite-built artifacts); alternative-server override + trusted-server set (PUNKBIN_URL pattern; consent surface coordinated with G-006); src/tests/shell/testsuites/binscripts/ (fixture-server characterization); bin/runtime/<tier>/ stores (as materialization targets)
 Detail: goals/G-123-thirdparty-runtime-tiers.md
 

goals/G-123-thirdparty-runtime-tiers.md

@@ -1,6 +1,6 @@
 # G-123 Third-party runtime tiers via artifact servers: per-target publish, list, fetch, materialize
 
-Status: proposed
+Status: active
 Scope: src/scriptapps/punk-runtime.ps1 + src/scriptapps/bin/punk-runtime.bash + punk-runtime_wrap.toml (named-tier operations in both payloads; bin/punk-runtime.cmd via the established re-wrap channel); punkbin artifact repo (external, c:/repo/jn/punkbin - per-tier layout, defaults, sha1sums, schema-v2 provenance sidecars incl. retroactive backfill, layout docs); src/buildsuites/suite_tcl90/ (family_artifacts.tcl schema-v2 emission for suite-built artifacts); alternative-server override + trusted-server set (PUNKBIN_URL pattern; consent surface coordinated with G-006); src/tests/shell/testsuites/binscripts/ (fixture-server characterization); bin/runtime/<tier>/ stores (as materialization targets)
 Goal: runtime artifacts for tiers beyond the host-native platform - third-party-built personalities (e.g an msys2-packaged mingw64-x86_64 tclsh) and cross-personality consumers (a linux tier used from FreeBSD) - are first-class on punkbin or an alternative artifact server: punk-runtime lists/fetches/uses artifacts for an explicitly named target tier from both payloads, materializing sha1-verified -r<N> artifacts + toml metadata into bin/runtime/<tier>/, with build-origin provenance (suite-built vs third-party) labeled on every artifact, consent keyed to server trust rather than artifact origin, and the G-122 chain completed from server artifact to a bakeable mapping entry.
 Acceptance: against a fixture artifact server (httpfixture precedent) carrying a non-native tier, punk-runtime supports an explicit target-tier argument on list/use (and the fetch path) in BOTH payloads - ps1 driven as the committed bin/punk-runtime.cmd under cmd.exe, bash driven under msys bash - with row/verdict parity and the established single-line row vocabulary scoped to the named tier; 'use' materializes the tier's working copy under bin/runtime/<tier>/ with sha1 verification and beside-toml metadata, and freshness verdicts compare against that tier's server default; artifact-toml schema v2 provenance distinguishes suite-built from third-party (class/builder/source_url/upstream_ref/retrieved), with third-party rows carrying a compact origin tag in list -remote's sparse notes column and full fields in the per-name detail view while suite-built rows are unchanged; existing punkbin third-party artifacts (e.g win32-x86_64/tclsfe-x64.exe, tclkit86bi.exe) gain retroactive schema-v2 sidecars additively (artifact bytes, bare pre-family names and sha1sums.txt authority unchanged; toml-less entries continue to degrade as no-basis rows); consent is keyed to SERVER TRUST - fetches from the trusted set (default: the canonical punkbin origin) prompt nothing, leaving existing unattended flows unchanged, while the first fetch from an untrusted/alternative server gates on an explicit acknowledgement (G-006's mechanism when landed, else an interim documented flag) that surfaces the artifact's provenance class; an end-to-end fixture demonstration wires a fetched fixture-tier runtime through a G-122 non-default-target mapping entry to a bakelist row showing the runtime present; the punkbin layout docs record the per-tier + schema-v2 extension and existing native-tier clients are unaffected (existing binscripts tests pass unchanged).
@@ -121,3 +121,22 @@ see goals/archive/G-058-static-runtime-packages.md).
   scanners. This goal's runtime-side v2 emission (family_artifacts.tcl) and
   the retroactive third-party backfill ride that lineage rather than
   introducing it - see goals/archive/G-138-punkbin-library-artifact-tier.md.
+- Activation survey 2026-07-31 (goals_xref score G-123 re-run at the
+  user-directed proposed->active flip): strongest pairs G-127 and G-141
+  (the latter drafted in the interval); G-130/G-131 already point here.
+  Back-pointers recorded below.
+- Related: G-141 - lib-tier fetch selectivity sibling (drafted 2026-07-31):
+  brings this goal's per-artifact selectivity idiom to make.tcl libfetch and
+  coordinates with the same server-trust consent surface; whichever
+  consent/trust surface lands first, the other adopts it rather than
+  introducing another flag.
+- Related: G-127 (back-pointer; its note names this goal) - cross-target kit
+  bakes consume served non-native runtime tiers; its bin/kits/<platform>/
+  output split sits downstream of tiers this goal makes fetchable.
+- Related: G-130 (back-pointer; its Scope names the punkbin per-target
+  layout) - 32-bit windows suite runtimes would publish through the
+  per-target tier surface this goal owns.
+- Related: G-131 (back-pointer) - sibling kit-loop surface: container
+  autodetection widens which served runtimes are kit-wrappable, and its
+  zipfs specimens live in the bin/runtime/win32-ix86 tier of third-party
+  tclkits this goal's provenance backfill covers.