From 670ab78dd820e53f29e668de54a6862e6d03ab11 Mon Sep 17 00:00:00 2001 From: Julian Noble Date: Fri, 31 Jul 2026 14:20:55 +1000 Subject: [PATCH] G-123 increment 5: consent surface + e2e demonstration + acceptance walk (punkshell 0.36.0) fetch now surfaces the artifact's build-origin class in its report ("provenance: class=" after sidecar retrieval, table-aware read, both payloads, re-wrapped, pinned in runtimecmd_provenance.test) - the acceptance's consent-surface clause. END-TO-END DEMONSTRATION (live, fully reverted): fixture punkbin served via httpfixture with a suffixless testplat-x86_64 runtime; the committed bin/punk-runtime.cmd fetched fakert-suite-r1 (-platform + -trust-server; sha1 ok, sidecar + provenance line) and 'use -platform' materialized the working copy; a temporary mapvfs entry wired it to a bakelist row: runtime file bin/runtime/testplat-x86_64/fakert-suite (present), target=testplat-x86_64 - with the .exe-named negative half (runtime=missing) captured first. Config reverted, tier removed, tree verified clean. Live canonical evidence also captured: unattended fetch of tclsh9.0.5-punk-r2.exe from the real origin ran gate-free (published r2 hash matched). Full battery: provenance 5/5, freshness + checkfile 12/12, runtimebash_wsl PASS, dtplite 8/8 (after its separate 0.35.1 pre-existing-fallout fix), roundtrip byte-identical under the punk baseline runner. Acceptance walk recorded item-by-item in the goal Progress - every item evidence-satisfied; user-gated follow-throughs (punkbin push + classification review; index Scope ps1-path correction) recorded as outside acceptance. Assisted-by: harness=claude; primary-model=claude-fable-5; api-location=anthropic.com --- CHANGELOG.md | 9 ++ bin/punk-runtime.cmd | 8 ++ goals/G-123-thirdparty-runtime-tiers.md | 94 +++++++++++++++++-- punkproject.toml | 2 +- src/scriptapps/bin/punk-runtime.bash | 4 + src/scriptapps/bin/punk-runtime.ps1 | 4 + .../binscripts/runtimecmd_provenance.test | 5 +- 7 files changed, 113 insertions(+), 13 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index af6b0d0d..b9bd4acb 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -5,6 +5,15 @@ The latest `## [X.Y.Z]` header must match the `version` field in `punkproject.to Entries are newest-first; one bullet per notable change. See the root `AGENTS.md` "Project Versioning" section for the bump policy. +## [0.36.0] - 2026-07-31 + +- `punk-runtime` fetch reports the artifact's build-origin class after + retrieving its metadata sidecar (`provenance: class=` - table-aware + schema-v2 read), completing the G-123 consent surface: a trusted fetch from + any origin now makes the artifact's provenance class visible in the fetch + report. Both payloads; `bin/punk-runtime.cmd` re-wrapped; pinned in the + provenance characterization suite. + ## [0.35.1] - 2026-07-31 - `bin/dtplite.cmd` repaired (G-139 fallout, present since the vendored-tree diff --git a/bin/punk-runtime.cmd b/bin/punk-runtime.cmd index 46659534..3761066f 100755 --- a/bin/punk-runtime.cmd +++ b/bin/punk-runtime.cmd @@ -1907,6 +1907,10 @@ case "$action" in tomlname="$(rootname_of "$runtime").toml" if curl -fsSL --output "${archdir}/${tomlname}" "${url_kitbase}/${archtail}/${tomlname}"; then echo "artifact metadata saved at ${archdir}/${tomlname}" + #G-123 consent surface: the fetch report names the artifact's + #build-origin class (table-aware read - schema v2) + fclass=$(provenance_class < "${archdir}/${tomlname}") + [[ -n "$fclass" ]] && echo "provenance: class=$fclass" else rm -f "${archdir}/${tomlname}" echo "no artifact metadata toml on server for $runtime (ok for pre-family runtimes)" @@ -3606,6 +3610,10 @@ function psmain { try { Invoke-WebRequest -Uri $tomlurl -OutFile $tomllocal -ErrorAction Stop Write-Host "artifact metadata saved at $tomllocal" + #G-123 consent surface: the fetch report names the artifact's + #build-origin class (table-aware read - schema v2) + $fclass = Get-PunkRuntimeProvenanceClass ([string[]](Get-Content -Path $tomllocal)) + if ($fclass -ne "") { Write-Host "provenance: class=$fclass" } } catch { Write-Host "no artifact metadata toml on server for $runtime (ok for pre-family runtimes)" } diff --git a/goals/G-123-thirdparty-runtime-tiers.md b/goals/G-123-thirdparty-runtime-tiers.md index 8356ecc5..f03b1711 100644 --- a/goals/G-123-thirdparty-runtime-tiers.md +++ b/goals/G-123-thirdparty-runtime-tiers.md @@ -277,13 +277,87 @@ see goals/archive/G-058-static-runtime-packages.md). pin and record-row parity between payloads. - All GREEN: new suite 5/5; pinned checkfile + freshness 12/12; roundtrip byte-identical under the punk baseline runner. - - Acceptance items now covered by executed evidence: explicit - target-tier on list/use/fetch (pre-existing + info fix), tier-scoped - materialization + freshness (existing suite), v2 provenance - distinguishing suite-built/third-party with compact tag + detail - view, retroactive additive sidecars, consent keyed to server trust - with unattended flows unchanged, native-tier clients unaffected. - REMAINING for acceptance: the end-to-end fixture-tier -> G-122 - non-default-target mapvfs entry -> bakelist-row demonstration, and - the final acceptance walk. USER-GATED items outstanding: punkbin - push + classification review; Scope ps1-path correction approval. +- 2026-07-31 increment 5 (punkshell 0.36.0): consent surface + the + end-to-end demonstration + full-battery acceptance walk. + - fetch now surfaces the artifact's build-origin class in its report + ("provenance: class=" printed after sidecar retrieval, both + payloads, table-aware read; pinned in runtimecmd_provenance.test) - + the acceptance's "acknowledgement that surfaces the artifact's + provenance class" consent clause. + - E2E DEMONSTRATION (live, fully reverted afterwards): httpfixture + served a fixture punkbin whose testplat-x86_64 tier used SUFFIXLESS + runtime naming (the non-windows suffix convention - the first + .exe-named attempt produced the NEGATIVE half: bakelist row + 'runtime=missing', detail '(MISSING)', proving the presence + indicator discriminates). The committed bin/punk-runtime.cmd fetched + fakert-suite-r1 with -platform testplat-x86_64 -trust-server (sha1 + ok, sidecar retrieved, provenance line shown) and 'use -platform' + materialized working fakert-suite + beside-toml + active.toml under + bin/runtime/testplat-x86_64/. A TEMPORARY mapvfs.config entry + 'fakert-suite {punk9win_for_tkruntime.vfs punkfixture zip + testplat-x86_64}' then yielded the bakelist row 'punkfixture zip + fakert-suite punk9win_for_tkruntime.vfs absent + target=testplat-x86_64' with detail 'runtime file: + bin/runtime/testplat-x86_64/fakert-suite (present)' - a fetched + fixture-tier runtime wired through a G-122 non-default-target + mapping entry to a bakelist row showing the runtime present. Config + reverted, tier removed, tree verified clean. Candidate follow-on + recorded: a PERMANENT seam-based characterization would need an + alternate-mapvfs-config seam in make.tcl (none exists today, which + is why the demonstration was live-reversible rather than a test). + - LIVE CANONICAL evidence: an unattended 'fetch tclsh9.0.5-punk-r2.exe' + against the real canonical origin ran gate-free end-to-end (server + sha1sums fetched; published r2 hash 5337179b... matched). + - Full battery: provenance 5/5 (incl. the consent-surface pin), + freshness + checkfile 12/12, runtimebash_wsl PASS, dtplite 8/8 + after its separate fix, roundtrip byte-identical under the punk + baseline runner. The dtplite discovery: its 5 execution-usecase + failures were PRE-EXISTING G-139 fallout (the no-tcllib fallback + still globbed the retired src/vendorlib_tcl9 trees) - fixed as its + own change-set (punkshell 0.35.1, git e26489fd) resolving the + deployed lib_tcl9 tree; unrelated to this goal's changes. +- ACCEPTANCE WALK 2026-07-31 - every item evidence-satisfied: + (1) fixture artifact server carrying a non-native tier + explicit + target-tier argument on list/use and the fetch path in BOTH payloads, + ps1 as the committed bin/punk-runtime.cmd under cmd.exe and bash under + msys bash, with row/verdict parity and tier-scoped row vocabulary - + runtimecmd_freshness + runtimecmd_provenance suites (and the bash + 'info -platform' defect fixed in increment 2). + (2) 'use' materializes the tier's working copy under bin/runtime// + with sha1-verified fetch input and beside-toml metadata; freshness + verdicts compare against that tier's server default - suites + the + live e2e 'use -platform' materialization. + (3) schema-v2 provenance distinguishes suite-built from third-party + (class/builder/source_url/upstream_ref/retrieved); third-party rows + carry the compact origin tag in list -remote's sparse notes column and + full fields in the per-name detail view; suite-built rows unchanged - + increment-1 live family build (family_check schema-2 + class pin x3 + variants) + the provenance suite's tag/info/ordering-caveat pins. + (4) existing punkbin third-party artifacts gained retroactive schema-v2 + sidecars ADDITIVELY (12 artifacts, all five tiers; artifact bytes, + bare names and sha1sums authority unchanged; toml-less entries degrade + as no-basis rows - pinned) - punkbin git 1f10390 (local; push is the + maintainer's publication act). + (5) consent keyed to SERVER TRUST: the canonical origin (trusted + default) prompts nothing - live canonical fetch evidence + the G-058 + unattended flow unchanged; the first fetch from an untrusted server + gates on the explicit interim documented flag (-trust-server / + PUNKBIN_TRUST_SERVER=1 - G-006's mechanism absorbs it when landed) + which surfaces the artifact's provenance class via the fetch report; + never an interactive prompt - gate smokes both payloads + suite pins. + (6) end-to-end fixture demonstration: fetched fixture-tier runtime -> + G-122 non-default-target mapping entry -> bakelist row showing the + runtime present - the live demonstration above (positive + negative). + (7) punkbin layout docs record the per-tier + schema-v2 extension - + punkbin AGENTS.md "Runtime artifacts - schema v2 + retroactive + sidecars" (+ lib-tier v1-section emission note updated). + (8) existing native-tier clients unaffected; existing binscripts tests + pass - freshness suite green with ONE additive env-acknowledgement + line in its fixture harness (test-contract edit, flagged for + maintainer review; no assertion changed), runtimebash_wsl and dtplite + green (dtplite via the separate pre-existing-fallout fix). + USER-GATED FOLLOW-THROUGHS (deliberately outside acceptance): punkbin + push + provenance-class classification review (publication + discipline); the index Scope ps1-path correction (contract edit + awaiting approval: the payload lives at + src/scriptapps/bin/punk-runtime.ps1, not src/scriptapps/punk-runtime.ps1). diff --git a/punkproject.toml b/punkproject.toml index c307e004..bc313a20 100644 --- a/punkproject.toml +++ b/punkproject.toml @@ -1,4 +1,4 @@ [project] name = "punkshell" -version = "0.35.1" +version = "0.36.0" license = "BSD-2-Clause" diff --git a/src/scriptapps/bin/punk-runtime.bash b/src/scriptapps/bin/punk-runtime.bash index 2aa53ed1..5fba9883 100644 --- a/src/scriptapps/bin/punk-runtime.bash +++ b/src/scriptapps/bin/punk-runtime.bash @@ -627,6 +627,10 @@ case "$action" in tomlname="$(rootname_of "$runtime").toml" if curl -fsSL --output "${archdir}/${tomlname}" "${url_kitbase}/${archtail}/${tomlname}"; then echo "artifact metadata saved at ${archdir}/${tomlname}" + #G-123 consent surface: the fetch report names the artifact's + #build-origin class (table-aware read - schema v2) + fclass=$(provenance_class < "${archdir}/${tomlname}") + [[ -n "$fclass" ]] && echo "provenance: class=$fclass" else rm -f "${archdir}/${tomlname}" echo "no artifact metadata toml on server for $runtime (ok for pre-family runtimes)" diff --git a/src/scriptapps/bin/punk-runtime.ps1 b/src/scriptapps/bin/punk-runtime.ps1 index f650d26c..f6d92881 100644 --- a/src/scriptapps/bin/punk-runtime.ps1 +++ b/src/scriptapps/bin/punk-runtime.ps1 @@ -895,6 +895,10 @@ function psmain { try { Invoke-WebRequest -Uri $tomlurl -OutFile $tomllocal -ErrorAction Stop Write-Host "artifact metadata saved at $tomllocal" + #G-123 consent surface: the fetch report names the artifact's + #build-origin class (table-aware read - schema v2) + $fclass = Get-PunkRuntimeProvenanceClass ([string[]](Get-Content -Path $tomllocal)) + if ($fclass -ne "") { Write-Host "provenance: class=$fclass" } } catch { Write-Host "no artifact metadata toml on server for $runtime (ok for pre-family runtimes)" } diff --git a/src/tests/shell/testsuites/binscripts/runtimecmd_provenance.test b/src/tests/shell/testsuites/binscripts/runtimecmd_provenance.test index e690d42f..cf10f046 100644 --- a/src/tests/shell/testsuites/binscripts/runtimecmd_provenance.test +++ b/src/tests/shell/testsuites/binscripts/runtimecmd_provenance.test @@ -318,7 +318,7 @@ namespace eval ::testspace { }\ -result [list 1 1 1 1 1 1 0] - test runtimecmd_prov_fetch_trustflag_bare_sidecar {fetch of a BARE third-party name with -trust-server: both payloads pass the gate, verify sha1, and also retrieve the retroactive sidecar toml}\ + test runtimecmd_prov_fetch_trustflag_bare_sidecar {fetch of a BARE third-party name with -trust-server: both payloads pass the gate, verify sha1, retrieve the retroactive sidecar toml, and the fetch report surfaces the build-origin class (consent surface)}\ -constraints $C\ -body { set result {} @@ -328,10 +328,11 @@ namespace eval ::testspace { lappend result [dict get $r exit] lappend result [file exists [staged_path thirdkit.exe]] lappend result [file exists [staged_path thirdkit.toml]] + lappend result [count_matches [dict get $r output] "provenance: class=third-party"] } set result }\ - -result [list 0 1 1 0 1 1] + -result [list 0 1 1 1 0 1 1 1] test runtimecmd_prov_fetch_trustenv {PUNKBIN_TRUST_SERVER=1 is the unattended acknowledgement: fetch with no flag succeeds from both payloads}\ -constraints $C\