tool_install_state judges bin/<tool>.exe current/stale by comparing its
mtime against the newest file anywhere in the tool tree. Two layers kept
that exe mtime frozen at the original link time: a zig cache-hit rebuild
does not rewrite the zig-out artifact, and Tcl's 'file copy -force'
preserves the source mtime (Windows CopyFile semantics). Once any
non-build-input file (e.g. PROVENANCE.md, edited after the G-128/G-135
doc passes) was newer than that link time, the tool was reported 'stale'
permanently - repeated 'make.tcl tool build' runs (field-observed
2026-08-01) reinstalled a timestamp-identical artifact and never cleared
it.
Fix: after the install copy, stamp the installed exe with the install
time ('file mtime $exe [clock seconds]'), making the state measure what
it means - installed since the last change in the tree. Also self-heals
mtime churn from branch switches/fresh clones on the next build.
punkshell 0.39.2 + CHANGELOG entry (patch: build-tooling bug fix).
Thin-layout make.tcl copies resynced via 'make.tcl libs -confirm 0'
(basic, project-0.1, modpod templates copy - byte-identical).
Assisted-by: harness=claude; primary-model=claude-fable-5; api-location=anthropic.com
The G-112 stage-true rename (0.23.0) kept 'project' -> bakehouse and
'vfs' -> bake as transitional aliases until the 8.6 arc completed; that
arc landed with G-099 and the new shape is settled. All alias plumbing
is removed from src/make.tcl: known_commands, the pre-dispatch mapping
switch, the punk::args definitions (SUMMARIES/HELPTEXTS/SUBOPTS/
SUBVALUES/VALUES_SYNOPSES), the "deprecated aliases" help group, the
plain-help block, the workflow-text mention and the degraded-mode
kitname collection. 'vfs' now gets an unknown-subcommand usage error;
'project' prefix-resolves to the read-only 'projectversion' check under
punk::args unambiguous-prefix matching (PUNKBOOT_PLAIN degraded mode
rejects both). Also trimmed a pre-existing trailing space (line 8990)
surfaced by git diff --check via the verbatim layout copies.
Docs: src/README.md, ARCHITECTURE.md, src/AGENTS.md (alias mentions
removed; also corrected the stale layout-sync trigger claim - the
thin-layout sync runs in modules/libs/packages/bakehouse, not
bootsupport), root AGENTS.md sync-step subcommand list ('project' ->
'bakehouse'). Historical records (CHANGELOG 0.23.0 entry, goals
archives, GOALS-archive) deliberately untouched.
punkshell 0.39.1 + CHANGELOG entry (make.tcl interface change - patch
per root AGENTS.md versioning policy).
Build outputs batched per src/AGENTS.md: thin-layout make.tcl copies
resynced via 'make.tcl libs -confirm 0' (basic, project-0.1, modpod
templates copy - all byte-identical to src/make.tcl), plus the lagging
store->modpod catch-up the same run performed (modpod layout copy:
mapvfs.config removed, mapvfs.toml + vfs/README.md added).
Assisted-by: harness=claude; primary-model=claude-fable-5; api-location=anthropic.com
Index + detail-file mirror in step: the src/vfs/*.vfs.toml entry now reads
"the achieved G-115 surface carrying the achieved G-127 platform axis" -
same treatment the clause received when G-115 flipped (852d684a precedent).
Assisted-by: harness=claude; primary-model=claude-fable-5; api-location=anthropic.com
Post-flip goals_xref report: the unlinked G-131/G-137 pair was annotated with
G-024 + G-127 as its only bridges, both now archive-tier - reciprocal Related:
notes record the real kit-wrap-phase adjacency directly.
Assisted-by: harness=claude; primary-model=claude-fable-5; api-location=anthropic.com
- new punkexe/maketclkitlocations.test (PUNK_MAPVFS_CONFIG fixtures, nothing
built): two-target one-vfs distinct locations (flat vs kits/<platform>/),
same-name two-non-native coexistence without runtime-rename, same-target
duplicate keeps <name>_<runtime>; mismatch clause referenced as G-133
regression pin (binaryarch.test + maketclpayloadcheck.test)
- mapvfs_match_outputs: a plain kit name now selects ALL matching records (one
per target) instead of the first hit - pre-G-127 uniqueness assumption removed;
filtered bakelist + selective bake cover every target of a shared name
- full punkexe subtree pass: 15 files, 101 tests, 0 failed (4 constraint skips)
Assisted-by: harness=claude; primary-model=claude-fable-5; api-location=anthropic.com
Scope lines are the index's discovery mechanism (path-grep + goals_xref path
overlap): after the G-024/G-115 migration the old filenames matched nothing on
disk, so agents editing src/runtime/mapvfs.toml or src/vfs/*.vfs.toml would
silently miss these goals. Minimal swaps, index + detail-file mirrors in step:
- G-101/G-131: mapvfs.config -> mapvfs.toml (annotations unchanged)
- G-127: vendorlib_vfs.toml -> src/vfs/*.vfs.toml (the achieved G-115 surface
this goal adds the platform axis to); mapvfs.config -> mapvfs.toml
- G-141: vendorlib_vfs.toml -> src/vfs/*.vfs.toml (the achieved G-115
successor surface; format coordinated with G-127)
Archived G-024/G-115 records deliberately untouched (accurate history).
goals_lint clean; xref path discovery verified resolving to the reworded goals.
Assisted-by: harness=claude; primary-model=claude-fable-5; api-location=anthropic.com
A C:/... path handed unconverted to a POSIX file command under WSL or
msys/git-bash is a relative path: it silently creates a stray cwd tree
whose first component is literally named 'C:' (the NTFS-illegal colon
stored as private-use character U+F03A), invisible to git and fossil
while it contains only empty directories. Remedy: translate at the
boundary (wslpath/cygpath - msys auto-conversion does not cover quoted
command strings or MSYS_NO_PATHCONV/MSYS2_ARG_CONV_EXCL sessions) and
glance at the repo root for stray C* entries after WSL/msys-driven work.
Origin: G-140 WSL smokes leaked an empty temp-dir skeleton into the repo
root, found and removed 2026-07-31.
Assisted-by: harness=claude; primary-model=claude-fable-5; api-location=anthropic.com
Content-identical moves completing the achieved flips (flip edits landed in the
preceding commit per the Doc Restructures move/edit separation).
Assisted-by: harness=claude; primary-model=claude-fable-5; api-location=anthropic.com
G-024 - kit mapping converted to toml (tomlish-parsed), same-day activation->achieved:
- src/runtime/mapvfs.toml: [kit.<name>] / [group.<name>] / [scheme.<name>] tables
(header comment = user-facing spec). All 12 active line-format mappings migrated
(order preserved - identical bakelist rows vs the legacy parse); historical
comments carried over; mapvfs.config deleted here AND in the project-0.1 layout
(converted to mapvfs.toml there).
- make.tcl reader family under the unchanged G-121 model surface: mapvfs_locate
(toml > legacy; PUNK_MAPVFS_CONFIG env override = characterization seam),
mapvfs_parse dispatching on extension, strict mapvfs_parse_toml, deprecated
mapvfs_parse_config fallback (un-migrated generated projects keep baking, with a
NOTE; toml wins when both files exist). Shared toml helpers hoisted to
punkboot::lib (inline toml_untag copies removed).
- Strict entry-named validation: unknown keys/types/schemes, conflicting targets,
duplicate outputs, parse failures fatal (exit 3 pre-build). Full-bake
unresolvables split by nature: missing vfs folder (repo content) fatal per
entry; missing runtime file (environment - part-populated stores are legitimate)
entry-named recapped BUILD-WARNING + skip.
- Groups: @<group> selection in bake/bakelist, group/default/scheme notes columns
+ detail lines, groups listed in errors and argdoc choices. verify-ix86 wraps
the G-129 kits; bake_default=false excludes entries from full bakes.
- G-023 versioned scheme declared live ([scheme.punk8]/[scheme.punk9], group
versioned, bake_default=false pending G-023 activation): parse-time expansion
from punkproject.toml to punk<gen>-<version> / punk<gen>-dev / release-gated
punk<gen>; kit loop creates the plain name when absent and never overwrites it
on a normal bake. punk9-dev baked end-to-end; punk9 gate skip demonstrated.
- Consumer dedupe fix: several entries may share one runtime on one vfs -
kit-output enumeration and the kit-loop runtimes list process each distinct
runtime once (latent multiplication in the legacy format, unreachable there).
G-115 - declarative .vfs composition with drop-in preservation, same-day
activation->achieved:
- Sibling declarations src/vfs/<name>.vfs.toml ([payload.<name>]: source,
source_root src|packages, target, supersedes, replace) materialized by the new
VFSPAYLOAD phase (bakehouse/bake/vfslibs; selective bakes narrow; strict
entry-named errors). Drop-in-wins precedence via punkcheck -overwrite
synced-targets: undeclared or modified-since-install files preserved and
reported (changed-but-preserved NOTE = files_skipped minus sources_unchanged);
supersedes/replace are the explicit exceptions; an undeclared .vfs is untouched.
- vendorlib_vfs.toml relationship settled: folded/superseded - all six install
entries migrated into per-.vfs files for the 13 participating folders (first
materialization run reproduced every payload with zero tracked-content change);
file deleted; a leftover copy warns and is ignored.
- Demonstration kit punkdeclare (group declare-demo, bake_default=false,
smokerequire udp+tcllibc): VCS carries only the boot fauxlink; the whole
lib_tcl9 payload (tcludp vendor tree + tcllibc consent-gated packages tier)
rematerializes from the declaration - clean-tree rebuild smokes pass in-kit,
and drop-in survival was proven live (a foreign pkgIndex.tcl and an undeclared
note both survived; the foreign file genuinely won until removed, caught by the
G-133 smoke probe as designed). Payload ignored in both VCS (.gitignore +
derived ignore-glob; ignore-sync verification clean).
- Docs: src/vfs/README.md (format + precedence spec), src/vfs + src/runtime +
src + bin AGENTS.md, ARCHITECTURE.md (+lint clean), workflow text and
summaries/helptexts/argdoc; layout store seeds the convention (vfs README +
mapvfs.toml; machinery travels via the established make.tcl sync).
Verification: legacy-vs-toml identical kit rows; punkluck86 force-rebuilt under
both formats content-identical (identical 1.73MB runtime+stamp prefix, identical
2993-member payloads; whole-artifact byte identity is not a pipeline property -
consecutive same-config rebuilds differ in zip timestamp metadata, pre-existing);
punkexe suite 98 tests 0 failures incl. 5 new G-024 characterizations
(maketclbakelist.test: @group filter + PUNK_MAPVFS_CONFIG fixture tests) and
updated pins (payloadcheck declared list + punkdeclare; platform detail wording).
Goals: both flipped achieved 2026-07-31 with evidence in the detail files;
GOALS.md entries moved to GOALS-archive.md; live-tier reference sweep applied
(G-004/G-019/G-023/G-025/G-026/G-035/G-065/G-127/G-131/G-137/G-141) including
the G-127 mapvfs-seam retirement note (PUNK_MAPVFS_CONFIG) and a direct
G-137<->G-127 bridge replacing the archived G-024 one. Detail files move to
goals/archive/ in the follow-up pure-rename commit.
Also included as found: the developer's concurrent G-142 goal addition (GOALS.md
entry + goals/G-142-punkbin-listing-manifests.md), committed unmodified for
git/fossil coherence - not agent-authored.
Assisted-by: harness=claude; primary-model=claude-fable-5; api-location=anthropic.com
Per-tier listing manifests with named groups (current/lts/vulnerable/archive) separating the listing surface from the sha1sums integrity ledger; activation assessed as immediately possible (no goal dependencies; G-141 libfetch surface coordination only).
Assisted-by: harness=opencode; primary-model=huggingface/moonshotai/Kimi-K3; api-location=unknown
Both goals flip proposed->active at user direction. Activation-freshness
overlap surveys (goals_xref score) recorded as Related: notes: G-024 gains
G-127/G-131/G-137 pointers, G-115 gains G-127/G-141 pointers (goals drafted
since the 2026-07-24 overlap reviews).
Assisted-by: harness=claude; primary-model=claude-fable-5; api-location=anthropic.com
Records the user-directed findings: tclpackages.toml is an unread
2026-06-23 format outline (checkout-level paper record per G-087's
archived note), the hand-placed tcllib subset exists as vendormodules
.tm pulls (copy-provenance only) plus the mechanism-less pkgIndex-form
bootsupport/lib tree, and the candidate resolution is per-module
declared trims under this goal's manifest with G-066 as the
pkgIndex->tm adoption tool and G-026 as pull enforcement. The sketch's
[libs] binary entries are recorded as a pre-zig-era mis-step (G-004
scope; G-102/G-123/G-139 are the live binary routes); the empty
lib_tcl<N>/<arch> scaffolds are untracked local dirs only.
Assisted-by: harness=claude; primary-model=claude-fable-5; api-location=anthropic.com
src/scriptapps/punk-runtime.ps1 -> src/scriptapps/bin/punk-runtime.ps1
in both the GOALS-archive.md record and the archived detail's Scope
mirror - the sanctioned archive exception (fixing a broken path). The
payload has always lived beside its bash twin in src/scriptapps/bin/.
Assisted-by: harness=claude; primary-model=claude-fable-5; api-location=anthropic.com
make.tcl modules regeneration of punkcheck-managed outputs: the layout
src/make.tcl sync copies (basic, project-0.1, modpod payload) pick up
the G-139-era libfetch/vfslibs help + workflow text, and the modpod
layout payload mirror-prunes the samplesuite1 sketch retired in
fc2376ca and gains the buildsuites README.md.
Assisted-by: harness=opencode; primary-model=huggingface/moonshotai/Kimi-K3; api-location=unknown
G-117/G-123 lineage: project, project_url and packager in emitted
punkbin-artifact.toml records (runtime family + library tier, both
suites) now default from the enclosing project's punkproject.toml
[project] table via a bounded walk-up from the build root
(common.punkprojectField) - a copied suite reads its own project's
manifest. Chains: project: -Dproject > manifest name > "punkshell"
(was hardcoded); project_url: -Dprojecturl > manifest url >
"unrecorded"; packager: -Dpackager > PUNKBIN_PACKAGER > manifest
packager > git identity > fossil user default (new fossil-only
fallback) > "unrecorded". Verified end-to-end: suite_tcl90
kit-family + library emissions and the suite_tcl86 library emission
carry the manifest values, -D overrides win, family_check green.
Root punkproject.toml gains an active url; dev project.new's seeded
manifest now carries commented url/packager placeholders documenting
the consumption site (punk::mix::commandset::project 0.4.1).
Assisted-by: harness=opencode; primary-model=huggingface/moonshotai/Kimi-K3; api-location=unknown
Status active -> achieved 2026-07-31 (acceptance walk in the detail
file); index entry moved to GOALS-archive.md; live-tier sweep: achieved
markers on the G-127/G-130/G-131/G-141 Related lines and the G-006
absorption note (interim trust flags libfetch + punk-runtime named);
actionable-note pushes to G-105 (server surfaces ready for cross-target
artifacts), G-101 (8.6 tier riding the mechanism; tclkit86bi sidecars),
G-067 (provenance/consent patterns to inherit), G-127 (the
no-alternate-mapvfs-seam finding from the e2e demonstration). xref
report: no unlinked pair had G-123 as its only bridge. Detail-file
rename to goals/archive/ follows as its own pure-rename commit.
Assisted-by: harness=claude; primary-model=claude-fable-5; api-location=anthropic.com
fetch now surfaces the artifact's build-origin class in its report
("provenance: class=<c>" after sidecar retrieval, table-aware read,
both payloads, re-wrapped, pinned in runtimecmd_provenance.test) -
the acceptance's consent-surface clause.
END-TO-END DEMONSTRATION (live, fully reverted): fixture punkbin
served via httpfixture with a suffixless testplat-x86_64 runtime; the
committed bin/punk-runtime.cmd fetched fakert-suite-r1 (-platform +
-trust-server; sha1 ok, sidecar + provenance line) and 'use -platform'
materialized the working copy; a temporary mapvfs entry wired it to a
bakelist row: runtime file bin/runtime/testplat-x86_64/fakert-suite
(present), target=testplat-x86_64 - with the .exe-named negative half
(runtime=missing) captured first. Config reverted, tier removed, tree
verified clean. Live canonical evidence also captured: unattended
fetch of tclsh9.0.5-punk-r2.exe from the real origin ran gate-free
(published r2 hash matched).
Full battery: provenance 5/5, freshness + checkfile 12/12,
runtimebash_wsl PASS, dtplite 8/8 (after its separate 0.35.1
pre-existing-fallout fix), roundtrip byte-identical under the punk
baseline runner. Acceptance walk recorded item-by-item in the goal
Progress - every item evidence-satisfied; user-gated follow-throughs
(punkbin push + classification review; index Scope ps1-path
correction) recorded as outside acceptance.
Assisted-by: harness=claude; primary-model=claude-fable-5; api-location=anthropic.com
G-139's vendored-tree removal (70d1838c, 2026-07-30) broke
bin/dtplite.cmd's no-tcllib fallback, which globbed only the retired
src/vendorlib_tcl9/<arch>/tcllib* trees - every execution usecase
failed with "can't find package dtplite" (found by the G-123
acceptance walk's binscripts battery; dtplite.test had not run since
the removal). The fallback now resolves the artifact-fed DEPLOYED tree
lib_tcl9/<target>/tcllib<ver> (both the wrapped-in-bin and unwrapped
script locations), keeping the vendorlib patterns for derived projects
that still vendor. Re-wrapped; dtplite.test 8/8 under the punk
baseline runner.
Assisted-by: harness=claude; primary-model=claude-fable-5; api-location=anthropic.com
Payload fix, both payloads (found designing the coverage): fetch only
retrieved beside-toml sidecars for -r<N> family names, so a fetched
bare-named third-party artifact arrived WITHOUT the retroactive record
its class display depends on. fetch now tries the sidecar for ANY name;
absence stays tolerated (no-basis degradation unchanged).
bin/punk-runtime.cmd re-wrapped.
NEW binscripts suite runtimecmd_provenance.test (5 tests, both payload
routes, httpfixture non-native tier testplat-x86_64: suite-built -r1
family artifact + bare third-party artifact with a retroactive-style
schema-v2 sidecar + a record-less artifact): server-trust gate refusal
from the non-canonical origin (canonical url + -trust-server named, no
artifact lands), -trust-server flag fetch including sidecar retrieval,
PUNKBIN_TRUST_SERVER=1 unattended form, class= tags in list -remote +
plain list (third-party tagged, suite-built quiet, record-less
untagged), and info schema-v2 fields + provenance_class row with the
flat 'class = runtime' ordering-caveat pin and record-row parity
between payloads.
All green: new suite 5/5; pinned checkfile + freshness 12/12; roundtrip
byte-identical under the tclsh9.0.5-punk baseline runner.
Assisted-by: harness=claude; primary-model=claude-fable-5; api-location=anthropic.com
fetch - the executable-retrieving act - now gates at entry when the
origin is non-canonical (PUNKBIN_URL override): the explicit
-trust-server flag or PUNKBIN_TRUST_SERVER=1 env (unattended form) is
the acknowledgement, one vocabulary with make.tcl libfetch's gate
(G-139). The canonical punkbin origin gates nothing (G-058's unattended
tclsfe constraint fetch is unchanged); metadata-only actions
(list -remote, platforms -remote) never gate; never an interactive
prompt. Refusal wording mirrors libfetch's.
ps1: -trust-server is pre-scanned before parameter binding (hyphenated
dynamic-parameter names are fragile under the PS 5.1 binder the windows
wrap routes through). Trap recorded in the goal Progress: a ps1 comment
line must never BEGIN with the word 'requires' - PowerShell parses
'#requires ...' as the #Requires statement and fails the whole file
(found by the powershell.exe 5.1 smoke).
runtimecmd_freshness.test: env seam gains PUNKBIN_TRUST_SERVER=1 + the
matching teardown unset (the fixture is a non-canonical origin, so its
fetch-driving tests need the unattended acknowledgement) - flagged as a
test-contract edit in the goal Progress; every existing assertion
unchanged and passing. Gate refusal characterization lands with the
increment-4 fixture coverage.
Payload growth pushed template label :exit_multishell onto a 512-byte
cmd label-scan boundary - checkfile caught it as designed; fixed via a
+16-byte spacer line (the documented knob). bin/punk-runtime.cmd
re-wrapped. Verification: gate smokes in both payloads (refusal + both
acknowledgement forms; ps1 under powershell.exe 5.1); checkfile 0
ERROR; pinned tests all PASS (checkfile + freshness 12/12, roundtrip
byte-identical under the tclsh9.0.5-punk baseline runner).
Assisted-by: harness=claude; primary-model=claude-fable-5; api-location=anthropic.com
Both payloads gain a TABLE-AWARE [provenance] class reader
(provenance_class() awk helper / Get-PunkRuntimeProvenanceClass) - the
flat first-wins field scans deliberately keep reporting [artifact] class
per the documented schema-v2 ordering caveat. Display: compact
class=third-party|local tag in the plain-list metadata summary and in
list -remote's sparse identity column (suite-built stays quiet; LOCAL
record basis only - a listing does no per-row remote fetches, toml-less
and remote-only rows keep degrading as no-basis rows); info gains the
v2 fields builder/source_url/upstream_ref/retrieved in the flat table
plus a derived provenance_class row, disagreement-checked; help texts
updated to the v1/v2 wording.
bash defect fixed: 'info -platform <p>' was advertised in both help
texts but silently ignored - 'info' was missing from the option-scan
action list (punk-runtime.bash case arm). The per-name report now
honours the tier argument like the ps1 payload (proven by the
tier-named not-found path).
bin/punk-runtime.cmd re-wrapped via the documented multishell
invocation under punk905. Verification: bash -n clean; staged v2
third-party fixture smoke shows parity output in both payloads
('[tcl=9.9.9 class=third-party]' + provenance_class row);
runtimecmd_checkfile PASS (no 512B label crossing after payload
growth); runtimecmd_freshness PASS (13 fixture tests, both routes);
runtimecmd_roundtrip PASS byte-identical under the tclsh9.0.5-punk
baseline runner (plain native tclsh lacks struct::stack for tomlish -
runner-choice trap noted in the goal Progress).
Assisted-by: harness=claude; primary-model=claude-fable-5; api-location=anthropic.com
family_artifacts.tcl and the build905.zig embedded-record literal move
schema 1 -> 2, adding [provenance] class = "suite-built" with the
lib-tier ordering-caveat comment (G-138 lineage - [artifact] class stays
the first 'class =' line; whole-text single-key scanners see that one).
The embedded-vs-sidecar consistency gate expects v2, and
family_check.tcl asserts embed_schema 2 plus the literal
'class = "suite-built"' line (its flat scanner would see [artifact]
class first, per the caveat). Verified: zig ast-check clean, both tools
parse; functional family-build proof is the next step - published v1
records stay valid pre-v2 records, v2 appears from the next family
revision.
Companion punkbin commit 1f10390 (local, unpushed): 12 retroactive
schema-v2 sidecars covering every pre-family runtime artifact across
the five tiers, evidence-based classes (binary markers, punkbin git
history, live kit probes), additive-only (artifact bytes + sha1 rows
unchanged), AGENTS.md runtime-v2 section + README refresh.
Goal Progress records the baseline survey findings (tier argument
already present on fetch/list/use; bash 'info -platform' defect; no
client-side server-trust gate; ps1 Scope path correction pending user
approval).
Assisted-by: harness=claude; primary-model=claude-fable-5; api-location=anthropic.com
proposed -> active in both tiers. Activation-freshness survey re-run
(goals_xref score G-123) per the maintenance rules: strongest pairs
G-127 and interval-drafted G-141; back-pointer Related lines recorded
in the detail file for G-141 (lib-tier selectivity sibling sharing the
server-trust consent surface), G-127 (cross-target kit bakes consume
served tiers), G-130 (32-bit runtimes publish through the per-target
layout) and G-131 (win32-ix86 zipfs specimens are third-party tclkits
the provenance backfill covers).
Assisted-by: harness=claude; primary-model=claude-fable-5; api-location=anthropic.com
Index entry + detail file. 'make.tcl libfetch' (G-139) fetches every
declared libpackages.toml artifact regardless of what the host or bake
consumes - already pinching on WSL (win32-x86_64 zips downloaded for a
linux-only bake; G-140 worked around it via the PUNK_LIBFETCH_CONFIG
test seam) and set to grow as G-004 migrates more vendored trees to
the punkbin lib tier. The goal derives the default fetch set from the
consumption declarations already in the tree (PACKAGES host needs +
the kit set's packages-sourced vfslibs targets) with narrow/widen
overrides, derivation reporting, and a VFSLIBS missing-source hint
naming the fetch the failing bake needs. Overlap survey recorded
(strongest live intersections G-127/G-115; relations
G-006/G-065/G-004/G-123/G-027).
Assisted-by: harness=claude; primary-model=claude-fable-5; api-location=anthropic.com
fetch and list's local-file comparison anchored runtime names at
end-of-line without stripping CR first, so a CRLF-published server
sha1sums.txt aborted fetch with "Unable to locate hash" on strict
grep platforms (GNU and BSD grep; cygwin grep tolerates CRLF, and
the ps1 payload is immune via Get-Content line splitting). Both
lookups now share the tr -d '\r' form list -remote already used.
bin/punk-runtime.cmd regenerated via the scriptwrap machinery; the
re-wrap invocation in src/scriptapps/AGENTS.md is corrected to the
working -force 1 -askme 0 form found during regeneration.
Assisted-by: harness=opencode; primary-model=huggingface/moonshotai/Kimi-K3; api-location=unknown
suite_tcl90: critcl_zig.config gains the linux-x86_64-zig cross target
(zig cc -target x86_64-linux-gnu.2.17 - the dynamic-glibc floor decision,
recorded in the goal file and fed to G-105). build905.zig gains the
tcllibc-linux step (critcl driver on the windows suite shell, stubs
linkage, no linux host; uuid.tcl excluded matching upstream's own
native-linux package shape) gated by the new tools/elf_gate.tcl
(G-133-equivalent ELF64/LSB/ET_DYN/x86_64 structural check - the
load-smoke stand-in for cross lanes). library-artifacts emits
lib/linux-x86_64/tcllibc-tcl9-r<N>.zip in the same run: target =
linux-x86_64, build_host_platform = win32-x86_64, full provenance set,
deliberately no [tests] section. build_id seeds now include the tier
path so same-named artifacts in different target tiers get distinct
identity digests (both suites' tool copies kept byte-identical). Step
lists (build905.zig -Dsteps default, suite.tcl) and README document the
lane and invocation.
Consumption: libpackages.toml declares tcllibc-tcl9-linux (target
linux-x86_64); vendorlib_vfs.toml install.tcllibc_tcl9_linux switches
punk9linux.vfs/lib_tcl9 - replace retires the hand-dropped tcllibc,
supersedes removes the stray tcllibc2.0 - so the last provenance-less
accelerator hand-drops in any kit payload are gone. punkshell902 baked
(G-133 payload arch scan: 6/6 match target linux-x86_64) and
WSL-verified: materialized-tier accel smoke plus baked-kit smokes
(default paths + a pinned variant proving the kit's own lib_tcl9
artifact tree loads with the accelerator engaged). Finding recorded:
the tclkit-902 runtime bundles its own lib/tcllibc2.0 which wins
default precedence - the origin of the retired stray folder name.
Determinism: back-to-back re-emission byte-identical for all three
artifacts; the zig Run session-env cache finding extended (FOSSIL_HOME
and invocation mode churn the key; the linux ELF .so observed
bit-stable across critcl re-runs, unlike the windows PE). Goal flipped
achieved with evidence in the detail file; G-105 notes carry the libc
decision as prior art. Docs: buildsuites AGENTS.md child index,
ARCHITECTURE.md buildsuites paragraph, CHANGELOG + punkproject 0.32.2.
Assisted-by: harness=claude; primary-model=claude-fable-5; api-location=anthropic.com
make.tcl libfetch gains env-only isolation seams - PUNK_LIBFETCH_CONFIG
(alternate declarations file) and PUNK_LIBFETCH_PACKAGES (alternate tier
root), the PUNK_RUNTIME_PLATFORM idiom - so fixture/mirror runs never read
the real declarations or write the real bin/packages tier. Neither seam
bypasses the -trust-server consent gate.
New shell/testsuites/punkexe/maketcllibfetch.test (piped maketcl* harness +
testsupport/httpfixture.tcl + a file:// mirror; the canonical origin is
never contacted) pins the G-139 behaviours that previously had only manual
session evidence: the server-trust gate refusing non-canonical origins with
exit 3 before any network access or tier write, -serverurl-over-PUNKBIN_URL
precedence, consented fetch/verify/materialize (sha1sums + zip + sidecar +
installed-shape tree with embedded record), idempotent re-run vs -force,
declared-revision-change re-materialization keyed to the tree record (with
the sidecar-not-listed note lane), sha1-MISMATCH rejection without residue,
missing-from-server-sha1sums failure, and the no-config no-op. 8/8 pass in
both runner modes (singleproc + -jobs); full punkexe subtree green (93
runnable, 0 failed); the real bin/packages tier verified untouched.
Also refreshes the stale src/runtime/libpackages.toml header (r1 IS
published as of 2026-07-30; the G-139 reference now points at the archive)
and documents the seams there and in the libfetch help text.
Assisted-by: harness=claude; primary-model=claude-fable-5; api-location=anthropic.com
Non-contract addition - the approved Acceptance wording is untouched; the
archived-goal marker lint wants now lives in the Anchors line.
Assisted-by: harness=claude; primary-model=claude-fable-5; api-location=anthropic.com
New proposed goal, flagged at the G-139 achieved flip: punk9linux.vfs's
linux-built tcllibc + stray tcllibc2.0 are the last provenance-less
accelerator hand-drops in any kit payload. G-140 commits a narrow zig
-target lane on the existing windows suite: critcl driving zig cc with an
explicit linux target section (stubs linkage - no cross-built runtime, no
linux build host), emitted as lib/linux-x86_64/tcllibc-tcl9-r<N>.zip through
the established G-138 machinery (record target=linux-x86_64,
build_host_platform=actual host), verified by a host-side ELF check +
byte-identical re-emission + a WSL accel smoke under an existing punkbin
linux Tcl 9 runtime, consumed via the G-139 declaration idiom
(libpackages.toml + vendorlib_vfs.toml supersedes/replace + a punkshell902
cross-target bake with in-kit record + WSL kit smoke). The libc/triple
decision (dynamic glibc floor direction) is recorded as direct input to
G-105's dynamic-libc and mapping items - back-pointer added to G-105 Notes
(non-contract). tcl8 generation dispositioned out of the committed set (no
linux tcl8 kit).
Overlap survey run (goals_xref paths across the scope): G-105 the strongest
live intersection (carried as Related with the lands-first framing);
G-116/G-130/G-060/G-123/G-004/G-065 carried; G-108/G-110/G-131 co-location
only. goals_lint clean.
Assisted-by: harness=claude; primary-model=claude-fable-5; api-location=anthropic.com
Acceptance met in full (walk in the detail file's Progress): libfetch with
sha1 verification + beside-toml metadata + server-trust consent proven LIVE
against the canonical origin post-publication; PACKAGES_tcl<N> libs-step
materialization with punkcheck provenance; vendorlib_vfs.toml declarations
(source_root=packages + replace) with supersedes removing tcllib1.21 incl.
nested tcllibc 0.4 + md5c from the 8.6-family kits; punk86 kit-hosted
runtests vs the same-day baseline IDENTICAL (zero differences to
disposition); vendored trees removed in their own commit after the proven
bake (70d1838c); the post-removal verification bake shipped kits with
verifiable embedded provenance from the tcllib-vendorless checkout;
derived-project decision recorded (fc2376ca).
Index entry -> GOALS-archive.md record. Reference sweep: G-004's
pending-tense retirement line updated to delivered (+ the remaining
vendored trees named as its outstanding scope with the tcllib pattern as
template); actionable pointers pushed to G-006 (libfetch's trust gate = the
interim consent instance to absorb), G-065 (the artifact-fetch pattern to
absorb/reference), G-027 (derived-project library story via the layout
sync), G-123 (materialization twin + the live interim consent flag to
coordinate with). make.tcl workflow text updated to the landed consumption
shape (fetch -> tier -> PACKAGES phase + vfslibs packages lane); vfslibs
summary/help texts cover both source roots. Project 0.32.0 + CHANGELOG
(user-visible kit payload upgrade). goals_lint clean (82 active, 57
archived). Detail-file move to goals/archive/ follows in the adjacent
pure-rename commit.
Assisted-by: harness=claude; primary-model=claude-fable-5; api-location=anthropic.com
src/vendorlib_tcl8/win32-x86_64/tcllib1.21 (2023 hand-drop: tcllib 1.21 +
nested tcllibc 0.4 + md5c, critcl 3.2 era) and
src/vendorlib_tcl9/win32-x86_64/tcllib2.0 (2024 hand-drop: a different
trunk snapshot also labelled 2.0, nested tcllibc + md5c, critcl 3.3.1) are
retired from the tracked tree - the first major G-004 payoff. Their only
machine-readable provenance was critcl's teapot.txt; their replacements are
the published punkbin lib-tier artifacts (r1, suite-built with full
checkout/toolchain provenance) consumed via make.tcl libfetch + the
PACKAGES_tcl<N> phase + the vfslibs packages-root declarations.
Sequencing per the acceptance: removal lands AFTER the artifact-path bake
reproduced working kits (punk86 + punk905 baked, deployed, provenance
verified in-kit) and the punk86 kit-hosted runtests validation came back
identical to the same-day baseline. This commit is removal-only so the
fallback is a revert. Other vendored packages under src/vendorlib_tcl8|9
(Img, itcl, sqlite, tdbc, twapi, tcludp, ...) are unaffected.
Assisted-by: harness=claude; primary-model=claude-fable-5; api-location=anthropic.com
vfslibs processed all declared trees (45 installs): every win32 tcl9 tree's
tcllib2.0 clean-slate replaced by the artifact copy (nested md5c/tcllibc
strays gone), sibling tcllibc-tcl9 installed, stray tcllibc2.0 names
superseded; tcl8 kits upgraded - tcllib1.21 (with nested tcllibc 0.4 + md5c)
superseded out, tcllib2.0-tcl8 + tcllibc-tcl8 in; punk86bawt's bare tcllibc
refreshed; punk9linux keeps its linux-built accelerator siblings (win32
artifacts deliberately not declared there). Every installed tree carries its
embedded punkbin-artifact.toml record into the kit payloads.
Selective bake punk86 + punk905 (punk91/punksys/punk9_beta are live user
shells - trees switched, bakes at next natural rebake): both deployed;
punk905 arch scan OK (tcllibc exempt under its platform subdir); punk86's
only warning is the recorded pre-existing zint i386 defect. Kit provenance
verified both container types: punkzip central-directory read (punk905 zip
kit) and in-vfs record probe (punk86 metakit kit) - records name their
source artifacts + build_ids.
VALIDATION (acceptance): kit-hosted runtests bracket isolating exactly the
kit payload switchover - baseline (pre-switchover punk86) 1125/1099/18/8 in
5 files (exec.test, ns/nslist, ns/nsprimitives, zip/zipaccel,
stdin/runstdin; 1960s); post-switchover IDENTICAL totals, files, and
per-test outcome extraction (1119 lines, empty diff). Differences to
disposition: none - the 8 failures pre-exist on the old payload.
punkcheck-managed vfs tree changes batched per the src/AGENTS.md carve-out.
Assisted-by: harness=claude; primary-model=claude-fable-5; api-location=anthropic.com
The decision (per the acceptance, recorded in the goal detail): derived
projects obtain library binaries via the SAME fetch entrypoint by default -
generated projects receive make.tcl (libfetch + the PACKAGES phase) through
the established layout-sync/G-027 channels and declare their artifacts in
their own src/runtime/libpackages.toml; the copy-and-tweak in-project suite
build per G-104's self-description contract remains the documented
alternative (a tcllib/tcllibc-only suite needs no Tcl source tree - critcl
bundles its headers).
The pre-G-096 samplesuite1 sketch in the project-0.1 layout
(download_and_build.config, mingw64/gcc-era, self-described as SKETCH ONLY)
is removed and replaced by src/buildsuites/README.md in the layout,
documenting both routes for generated projects - the disposition the goal
Approach named. Goal Progress also records the r1 publication (punkbin
ee571ed, pushed) and the live canonical-origin libfetch verification.
Assisted-by: harness=claude; primary-model=claude-fable-5; api-location=anthropic.com
make.tcl libs/packages/bakehouse gain the PACKAGES_tcl<N> phase: materialized
punkbin lib-tier packages under bin/packages/<target>/tcl<N>/ deploy into
lib_tcl<N>/allplatforms + lib_tcl<N>/<this platform> with punkcheck
provenance, mirroring the VENDORLIB_tcl<N> shape (embedded
punkbin-artifact.toml records ride into the deployed trees; absent tier =
silent per-item no-op with a libfetch pointer).
vfslibs declaration schema extended (vendorlib_vfs.toml header documents
both): source_root = "packages" resolves an entry's source against the
bin/packages tier (missing source errors name 'make.tcl libfetch');
replace = true clean-slates a SAME-NAMED existing target folder before
install (supersedes deliberately cannot name the folder being installed -
needed because the pre-G-139 tcl9 hand-drops nested md5c + tcllibc INSIDE
tcllib2.0).
Declarations added for the switchover set (per-kit, never blanket - the
trees that carried hand-drops at 2026-07-30): 8 win32 tcl9 kit vfs trees get
tcllib2.0-tcl9 + tcllibc-tcl9 (supersedes the stray-named tcllibc2.0);
punk9linux (linux target) gets only platform-neutral tcllib2.0 (its
linux-built tcllibc siblings stay - a linux lib-tier emission is future
work); punk86/punk8win/punk8_statictwapi upgrade tcllib1.21 (+nested tcllibc
0.4 + md5c, removed with it via supersedes) to tcllib2.0-tcl8 + tcllibc-tcl8;
punk86bawt refreshes its bare tcllibc only.
Verified: make.tcl libs deployed the tier into lib_tcl8|9 (allplatforms +
win32-x86_64) with embedded records present; vendored mirrors coexist in the
deployed trees until the sequenced retirement. Thin-layout make.tcl sync
copies updated by the run (punkcheck-managed outputs, batched per the
carve-out). Project 0.31.1 + CHANGELOG.
Assisted-by: harness=claude; primary-model=claude-fable-5; api-location=anthropic.com
New 'make.tcl libfetch' subcommand (argdoc'd; workflow text + plain help
updated): fetches the punkbin LIB-TIER artifacts declared in the new
src/runtime/libpackages.toml ([artifact.<name>] name/target; the four G-138
r1 artifacts, both generations) from <origin>/lib/<target>/ into the
untracked bin/packages/<target>/ input tier - zip + .toml sidecar, each
sha1-verified against the server's per-target sha1sums.txt (local tier copy
kept, the punk-runtime store idiom) - then materializes each verified zip
via punk::zip::unzip (crc-verified, mtimes restored, accelerator-eligible)
into bin/packages/<target>/tcl<N>/<pkgfolder>/ (generation subdirs: both
generations install identically-named folders). Idempotent: present
artifacts re-verify and skip; a materialized tree is current while its
embedded record names the declared artifact (the G-138 self-description
payoff); -force overrides.
Consent keyed to server trust (the G-123 posture): the canonical punkbin
origin (punk-runtime raw-base convention) gates nothing; any other origin
(-serverurl or env PUNKBIN_URL) refuses before network access without the
explicit -trust-server flag - never an interactive prompt. file:// origins
served natively (mirrors/fixtures); http(s) transport: Tcl http (+tls) when
loadable, else curl, else PowerShell. The dispatch block sits before the
build-command whitelist gate per the standalone-command pattern and exits
itself.
Emission-side amendment (both suites' library_artifacts.tcl): sidecar tomls
now ride the per-tier staging sha1sums.txt, matching the punkbin repo's
build_sha1sums.tcl coverage so staging-derived mirrors serve verifiable
sidecars.
Verified against a file:// mirror assembled from both suites' staging:
trust-gate refusal, consented fetch of all 4 artifacts (sha1-verified),
materialization of all 4 trees, fully idempotent re-run, and a package-load
proof from the tier (md5 2.0.9 + tcllibc accel=1 under the plain family
kit, ifneeded paths in bin/packages). bin/packages is already ignored in
both VCS via the /bin/* rules. Docs: bin/AGENTS.md tier section,
src/runtime/AGENTS.md libpackages.toml bullet. Project version 0.31.0 +
CHANGELOG (new make.tcl subcommand = product surface). Remaining G-139 work
recorded in the goal's Progress section.
Assisted-by: harness=claude; primary-model=claude-fable-5; api-location=anthropic.com
