commit 8501bcd20465d6f883660fe49239006875a7e945
parent 60e168ce0a8f5087930b0ab8e425e3b533f7753e
Author: James Eversole <james@eversole.co>
Date: Fri, 23 Oct 2026 19:23:33 -0500
Preserve historical CLI oracles in compiler retention checks
Current compilers use the v2-only CLI oracle; retained v1 toolchains use their protected frozen source oracle. Record exact oracle identities and reject missing/changed historical inputs and unknown versions. Preserve non-root process authority in matching-proc namespaces. Selection and filesystem safety controls pass; applicable Nix, source freshness, compiler authentication and completed retention checks pass. Final curated tree is byte-identical to archived development checkpoint6d4fa44, whose isolated pre/post retention checks completed for all five selected toolchains and current support reproduction.
Diffstat:
3 files changed, 44 insertions(+), 5 deletions(-)
diff --git a/docs/compiler-rebuilding.md b/docs/compiler-rebuilding.md
@@ -625,7 +625,10 @@ protected directories and the writable checkpoint evidence directory. The sandbo
than inheriting paths hidden by that mount. Each
selected compiler passes independent pair audits, CLI compilation/execution,
diagnostics and integrity controls, correctness smokes, and a fresh scoped
-`native_math` map-builder/adapter job with complete-manifest comparison. Support
+`native_math` map-builder/adapter job with complete-manifest comparison. Current
+IO v2 compilers use the current CLI oracle; retained IO v1 compilers use the
+`test/portable_cli.py` oracle in their protected frozen source. Reports record
+the selected oracle and its hash. Selection precedes execution. Support
reproduction must pass in that isolation too. The same checks run after deletion;
only then can the checkpoint's `plan.json` become `complete: true` and the completion
gate succeed. Verification logs, reports, registry and harness snapshots remain
@@ -643,8 +646,10 @@ rotations at each checkpoint, while sufficient disk space remains.
If an enclosing PID namespace exposes a mismatched procfs, namespace setup can
fail before a validation process starts. Do not count that launch as a check or
weaken isolation. Run the same reviewed apply command inside a matching PID/proc
-namespace, using `unshare --user --map-root-user --mount --pid --fork
---kill-child --mount-proc -- python3 ...`, and recheck completion. Preserve failed
+namespace, using `unshare --user --map-current-user --mount --pid --fork
+--kill-child --mount-proc -- python3 ...`, and recheck completion. Run as a
+non-root user: the CLI oracle checks OS permission denial with that user's
+process authority. Preserve failed
launch evidence; only the completed resumed postchecks satisfy retention.
Safety controls run in the fast Nix check without compiling tricu programs:
diff --git a/test/bootstrap_retention_probe.py b/test/bootstrap_retention_probe.py
@@ -14,6 +14,18 @@ from bootstrap_acceptance import verify
from generation_io import versions
+def portable_probe(source, io_version):
+ """Select the CLI oracle before execution; historical runtimes keep their oracle."""
+ if io_version == 2:
+ return REPO / 'test/portable_cli.py', ['--compiler-io-version', '2']
+ if io_version == 1:
+ oracle = source / 'test/portable_cli.py'
+ if not oracle.is_file():
+ raise ValueError('retained IO v1 source requires its frozen portable CLI oracle')
+ return oracle, [] # Historical harnesses default to IO v1.
+ raise ValueError('unsupported retained compiler IO version')
+
+
def main():
p = argparse.ArgumentParser(description=__doc__)
p.add_argument('--root', type=Path, required=True)
@@ -41,8 +53,9 @@ def main():
fresh = verify(Path(accepted['generations'][0]), generation, Path(runtime), source)
if fresh['artifacts'] != accepted['artifacts']:
raise ValueError('retained acceptance artifacts differ')
- run(role + '-portable', [sys.executable, str(REPO / 'test/portable_cli.py'), runtime,
- '--backend', 'stable', '--indexed', '--compiler-io-version', str(io_version), '--compiler-bundle', str(generation / 'build-stable.arboricx')])
+ oracle, io_flags = portable_probe(source, io_version)
+ run(role + '-portable', [sys.executable, str(oracle), runtime,
+ '--backend', 'stable', '--indexed', *io_flags, '--compiler-bundle', str(generation / 'build-stable.arboricx')])
run(role + '-smoke', [sys.executable, str(REPO / 'test/bootstrap_smoke.py'), runtime,
'--generation', str(generation), '--acceptance', str(acceptance),
'--source-root', str(source), '--directory', str(out / (role + '-smoke'))])
@@ -64,6 +77,7 @@ def main():
report['toolchains'].append(dict(role=role, artifacts=fresh['artifacts'],
acceptance_sha256=sha(acceptance), runtime_sha256=sha(runtime),
fresh_pair_audits=fresh['audits'], portable_cli=True,
+ portable_oracle=str(oracle), portable_oracle_sha256=sha(oracle),
complete_results=len(smoke['cases']), scoped_map_manifest=new))
support = config['support']
runtime = next(t['runtime'] for t in config['toolchains'] if t['role'] == support['toolchain'])
diff --git a/test/bootstrap_retention_test.py b/test/bootstrap_retention_test.py
@@ -12,6 +12,7 @@ import unittest
from unittest.mock import patch
import bootstrap_retention as r
+from bootstrap_retention_probe import portable_probe
from bootstrap_retention_lock import acquire, protect_generations
@@ -32,6 +33,25 @@ class RetentionTests(unittest.TestCase):
r.save(self.out / 'plan.json', plan)
return plan
+ def test_current_cli_oracle_is_v2_only(self):
+ oracle, flags = portable_probe(self.keep, 2)
+ self.assertEqual(oracle, r.REPO / 'test/portable_cli.py')
+ self.assertEqual(flags, ['--compiler-io-version', '2'])
+
+ def test_historical_cli_oracle_requires_frozen_source(self):
+ with self.assertRaisesRegex(ValueError, 'frozen portable CLI oracle'):
+ portable_probe(self.keep, 1)
+ oracle = self.keep / 'test/portable_cli.py'
+ oracle.parent.mkdir(); oracle.write_text('frozen historical oracle')
+ self.assertEqual(portable_probe(self.keep, 1), (oracle, []))
+ plan = self.plan()
+ oracle.write_text('changed historical oracle')
+ with self.assertRaises(ValueError): r.validate_plan(self.root, plan, self.out)
+
+ def test_unknown_cli_version_has_no_oracle_fallback(self):
+ with self.assertRaisesRegex(ValueError, 'unsupported retained'):
+ portable_probe(self.keep, 3)
+
def test_selected_support_source_is_checked_and_fingerprinted(self):
source = self.keep / 'source'; (source/'bootstrap').mkdir(parents=True)
(source/'bootstrap/compiler-source-map.v1').write_text('map')
