homebrew: make bootstrap images reproducible and provenance-bound

[brandonpayton]

Purpose

Provide one reviewable, ABI39-based Homebrew bootstrap tooling batch. It builds an unmodified upstream Homebrew checkout into a Kandelo VFS image through the normal package resolver, binds every manifest entry to the selected artifact tree, preserves trusted ZIP filesystem semantics without importing unsafe permissions, and makes the resulting image byte-reproducible.

The branch is a linear nine-commit stack intended for rebase merge so each independently reviewed fix remains bisectable.

Preserved commits

• homebrew: make guest bootstrap images reproducible and ABI-checked #902: committed ABI-checked Homebrew bootstrap builder and Wasm artifact validator.
• mkrootfs: preserve ZIP symlinks without path escape #917: canonical ZIP paths, exact UTF-8 names, and real ZIP symlink ingestion.
• packages: bind rootfs manifests to one artifact tree #919: exclusive --binaries-dir rootfs manifest provenance.
• Bootstrap caller binding to the selected binaries/ tree.
• Exact ABI39 lazy inode identity assertion.
• Detached-snapshot timestamp normalization using SOURCE_DATE_EPOCH.
• mkrootfs: emit complete inspect output #920: complete mkrootfs inspect output with correct EPIPE handling.
• Explicit trusted-archive policy that imports only Unix execute bits for regular files.
• Canonical mkrootfs type-check coverage for the shared-memory APIs it imports from the host.

An independent exact audit verified that every source/candidate pair has the same stable patch ID, message, and author, and that no overlapping hunk was dropped or duplicated. A separate devil's-advocate review accepted the trusted archive permission boundary with no findings.

Integrated evidence

All validation ran through scripts/dev-shell.sh on ABI39.

Claim	Evidence
Combined mkrootfs behavior	178/178 tests passed
VFS, ZIP, manifest provenance, artifact validation	108/108 focused tests passed
Shared host compatibility	Node ESM/CJS, browser bundles, and declarations built
Tool typing	canonical mkrootfs TypeScript check passed with ES2024 shared-memory declarations and ES2022 output target
ABI discipline	ABI snapshot/version check passed unchanged at 39
Normal versus skip-resolve image	both 805,316,862 bytes, SHA-256 a151cb827da26b1412fe9a8c37ae7c9ee57097e092ccf0f3920a1b4901f78b6c, byte-identical
Artifact closure	1 kernel plus 72 program artifacts validated at ABI39
Full image inspection	4,925 entries; all 64 pinned Homebrew executables are 0755; all 2,900 non-executables are 0644
Archive metadata	all 167 symlinks retain exact targets; all 380 directories are 0755; every archive member is uid/gid 1000; zero mismatches

The permission policy remains fixed by default. preserve-executable is an explicit opt-in for a trusted ZIP and imports only 0111 from Unix central-directory entries. Read/write, set-ID, sticky, type, ownership, directory, symlink, and non-Unix compatibility metadata remain controlled by the manifest.

Shell syntax, Node syntax, diff checks, deterministic timestamp adversarial probes, and the complete-output/early-pipe probes also passed.

Truthful runtime boundary

The image runs real upstream Homebrew, not a registry wrapper. brew --version and brew config --no-install-from-api both reach Ruby and then exit 139 because each fork continuation needs 20,012 bytes while ABI39 reserves 16,384. The host reports that exact platform limit instead of corrupting memory. This batch intentionally does not claim that Homebrew installation is functional; continuation sizing belongs in the next ABI/rebuild batch.

Contract scope

This PR does not change ABI_VERSION, the ABI snapshot, or the VFS on-disk layout. Timestamp normalization is opt-in on a detached snapshot; ordinary Node and browser runtime snapshots preserve live POSIX times. Full browser runtime and broad conformance suites were not run locally and remain required CI evidence.

Supersession

This batch is intended to supersede #902, #917, #919, and #920 after the combined CI run is green and maintainer review is complete. Keep those PRs open until then.

[github-actions]

Phase B-1 matrix build status — pr-921-staging

ABI v39. 6 built, 0 failed, 6 total.

Package	Arch	Status	Sha
kandelo-sdk	wasm32	built	18405ee6
rootfs	wasm32	built	0a05033f
shell	wasm32	built	d96885ae
lamp	wasm32	built	801a444d
node-vfs	wasm32	built	8207665f
wordpress	wasm32	built	203f33a8

_{Auto-generated; replaced on each push. Raw data in the publish-status workflow artifact.}

[brandonpayton]

Updated the batch after devil's-advocate review found that the pinned Homebrew ZIP had 64 executable regular files while the bootstrap manifest normalized every archive file to 0644.

The new opt-in fmode_policy=preserve-executable imports only Unix 0111 bits from this pinned trusted archive. Default archive behavior remains fixed-mode. Independent review accepted the boundary, and exhaustive image comparison found 64/64 executable files at 0755, 2,900/2,900 non-executables at 0644, 167 exact symlinks, 380 directories at 0755, and no mode/owner/target mismatches.

Fresh normal and --skip-package-resolve ABI39 images are byte-identical at 805,316,862 bytes (a151cb827da26b1412fe9a8c37ae7c9ee57097e092ccf0f3920a1b4901f78b6c). The real guest probe now passes the permission boundary and reproduces only the known 20,012-byte continuation versus 16,384-byte ABI39 reserve. Full evidence is in the updated PR body.

[github-actions]

prepare-merge: test-gate passed against the synthetic PR merge and binaries-abi-v39. Missing entries were built or promoted from PR staging only when their merged-tree cache key matched; merge-gate=success posted on PR HEAD and squash auto-merge enabled.