senline-service-dogfood: merge main and reopen dogfood PR

.gitattributes

@@ -6,8 +6,10 @@ sgpm-index.toml text eol=lf
 *.yaml text eol=lf
 *.yml text eol=lf
 *.md text eol=lf
+*.json text eol=lf
+*.raw text eol=lf
+*.ps1 text eol=lf
 
 # Performance evidence: pin byte-identical SHA-256 across hosts
 bench/results/**/*.json -text
 bench/frontend-memory-baseline.json text eol=lf
-

.github/workflows/senline-installed-packages.yml

@@ -0,0 +1,204 @@
+name: senline-installed-packages
+
+on:
+  workflow_dispatch:
+  pull_request:
+    paths:
+      - ".github/workflows/senline-installed-packages.yml"
+      - "scripts/package-toolchain.ps1"
+      - "scripts/package-senline-worker.ps1"
+      - "scripts/package-senline-http.ps1"
+      - "scripts/compare-senline-package-manifests.ps1"
+      - "scripts/install.ps1"
+      - "scripts/install.sh"
+      - "examples/realworld/senline-domain-worker/**"
+      - "examples/realworld/senline-http-dogfood/**"
+
+jobs:
+  installed-worker-http:
+    name: installed worker/HTTP (${{ matrix.os }})
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 120
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-latest
+            target: x86_64-unknown-linux-gnu
+            artifact: linux-x86_64
+          - os: windows-latest
+            target: x86_64-pc-windows-msvc
+            artifact: windows-x86_64
+    env:
+      LLVM_VERSION: "19"
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: dtolnay/rust-toolchain@master
+        with:
+          toolchain: 1.94.0
+
+      - name: Install pinned LLVM toolchain (Ubuntu)
+        if: runner.os == 'Linux'
+        shell: bash
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y clang-${LLVM_VERSION} lld-${LLVM_VERSION}
+          sudo update-alternatives --install /usr/bin/clang clang /usr/bin/clang-${LLVM_VERSION} 100
+
+      - name: Require clang
+        shell: pwsh
+        run: |
+          $clang = Get-Command clang -ErrorAction Stop
+          & $clang.Source --version
+          if ($LASTEXITCODE -ne 0) {
+            throw "clang probe failed with exit code $LASTEXITCODE"
+          }
+
+      - name: Build release tools
+        shell: pwsh
+        run: cargo build -p sgc -p sgpm -p sgfmt -p sglsp --release
+
+      - name: Package installed toolchain
+        shell: pwsh
+        env:
+          SENGOO_DIST_TARGET: ${{ matrix.target }}
+        run: |
+          $version = "0.1.0-ci"
+          $cargoTarget = Join-Path $env:RUNNER_TEMP "sengoo-cargo-package-${{ matrix.artifact }}"
+          Remove-Item -LiteralPath "target/dist" -Recurse -Force -ErrorAction SilentlyContinue
+          Remove-Item -LiteralPath $cargoTarget -Recurse -Force -ErrorAction SilentlyContinue
+          Remove-Item Env:CARGO_ENCODED_RUSTFLAGS -ErrorAction SilentlyContinue
+          Remove-Item Env:RUSTFLAGS -ErrorAction SilentlyContinue
+          ./scripts/package-toolchain.ps1 `
+            -Version $version `
+            -OutputDir "target/dist" `
+            -CargoTargetDir $cargoTarget `
+            -SmokeEvidence "senline-installed-packages ${{ matrix.os }} ${{ github.sha }}"
+
+      - name: Install toolchain outside product workspace
+        shell: pwsh
+        run: |
+          $version = "0.1.0-ci"
+          $archiveDir = "target/dist"
+          $latest = Get-Content (Join-Path $archiveDir "latest-archive.txt") -ErrorAction SilentlyContinue
+          if (-not $latest) {
+            $zip = Get-ChildItem $archiveDir -Filter "*.zip" | Select-Object -First 1
+            if (-not $zip) { throw "missing packaged archive under $archiveDir" }
+            $latest = $zip.FullName
+          } else {
+            if (-not [IO.Path]::IsPathRooted($latest)) {
+              $latest = Join-Path $archiveDir $latest
+            }
+          }
+          $installDir = Join-Path $env:RUNNER_TEMP "sengoo-install-${{ matrix.artifact }}"
+          Remove-Item -LiteralPath $installDir -Recurse -Force -ErrorAction SilentlyContinue
+          if ($IsWindows -or $PSVersionTable.PSEdition -eq "Desktop") {
+            ./scripts/install.ps1 -Archive $latest -InstallDir $installDir
+          } else {
+            sh scripts/install.sh "$latest" "$installDir"
+          }
+          Write-Host "install_dir=$installDir"
+
+      - name: Fake cargo + installed worker/HTTP dual package loop
+        shell: pwsh
+        run: |
+          $ErrorActionPreference = "Stop"
+          $version = "0.1.0-ci"
+          $installDir = Join-Path $env:RUNNER_TEMP "sengoo-install-${{ matrix.artifact }}"
+          $bin = Join-Path $installDir "bin"
+          $suffix = ""
+          if ($IsWindows -or $PSVersionTable.PSEdition -eq "Desktop") {
+            $suffix = ".exe"
+          }
+          $sgc = Join-Path $bin "sgc$suffix"
+          $sgpm = Join-Path $bin "sgpm$suffix"
+          if (-not (Test-Path -LiteralPath $sgc)) { throw "missing installed sgc: $sgc" }
+          if (-not (Test-Path -LiteralPath $sgpm)) { throw "missing installed sgpm: $sgpm" }
+
+          # Fail if any real cargo would be required by the package loop.
+          $fakeCargoDir = Join-Path $env:RUNNER_TEMP "fake-cargo-fail"
+          Remove-Item -LiteralPath $fakeCargoDir -Recurse -Force -ErrorAction SilentlyContinue
+          New-Item -ItemType Directory -Force -Path $fakeCargoDir | Out-Null
+          $fakeCargo = Join-Path $fakeCargoDir "cargo$suffix"
+          if ($suffix -eq ".exe") {
+            @'
+          @echo off
+          echo fake-cargo: cargo must not be invoked by installed senline package loops 1>&2
+          exit /b 97
+          '@ | Set-Content -LiteralPath $fakeCargo -Encoding ASCII
+          } else {
+            @'
+          #!/bin/sh
+          echo "fake-cargo: cargo must not be invoked by installed senline package loops" >&2
+          exit 97
+          '@ | Set-Content -LiteralPath $fakeCargo -Encoding UTF8
+            & chmod +x $fakeCargo
+          }
+          $pathSep = [IO.Path]::PathSeparator
+          $env:PATH = "$fakeCargoDir$pathSep$bin$pathSep" + $env:PATH
+          $env:SGPM_SGC = $sgc
+          $env:SGPM_SGFMT = Join-Path $bin "sgfmt$suffix"
+          Remove-Item Env:SENGOO_ROOT -ErrorAction SilentlyContinue
+          Remove-Item Env:SENGOO_STDLIB -ErrorAction SilentlyContinue
+          Remove-Item Env:SENGOO_RUNTIME -ErrorAction SilentlyContinue
+
+          Write-Host "sgc: $(& $sgc --version) path=$sgc"
+          Write-Host "sgpm: $(& $sgpm --version) path=$sgpm"
+          Write-Host "SGPM_SGC=$env:SGPM_SGC"
+
+          Push-Location examples/realworld/senline-domain-worker
+          try {
+            & $sgpm --runtime-mode installed check --locked
+            if ($LASTEXITCODE -ne 0) { throw "worker sgpm installed check --locked failed" }
+            & $sgpm --runtime-mode installed test --locked
+            if ($LASTEXITCODE -ne 0) { throw "worker sgpm installed test --locked failed" }
+            & $sgpm --runtime-mode installed build --locked --release
+            if ($LASTEXITCODE -ne 0) { throw "worker sgpm installed build --locked --release failed" }
+          } finally {
+            Pop-Location
+          }
+
+          Push-Location examples/realworld/senline-http-dogfood
+          try {
+            & $sgpm --runtime-mode installed check --locked
+            if ($LASTEXITCODE -ne 0) { throw "http sgpm installed check --locked failed" }
+            & $sgpm --runtime-mode installed test --locked
+            if ($LASTEXITCODE -ne 0) { throw "http sgpm installed test --locked failed" }
+            & $sgpm --runtime-mode installed build --locked --release
+            if ($LASTEXITCODE -ne 0) { throw "http sgpm installed build --locked --release failed" }
+          } finally {
+            Pop-Location
+          }
+
+          $pkgRoot = Join-Path $env:RUNNER_TEMP "senline-pkg-${{ matrix.artifact }}"
+          Remove-Item -LiteralPath $pkgRoot -Recurse -Force -ErrorAction SilentlyContinue
+          New-Item -ItemType Directory -Force -Path $pkgRoot | Out-Null
+
+          ./scripts/package-senline-worker.ps1 -SgcPath $sgc -SgpmPath $sgpm -OutputDir (Join-Path $pkgRoot "worker-a")
+          ./scripts/package-senline-worker.ps1 -SgcPath $sgc -SgpmPath $sgpm -OutputDir (Join-Path $pkgRoot "worker-b")
+          ./scripts/compare-senline-package-manifests.ps1 `
+            -LeftManifest (Join-Path $pkgRoot "worker-a/worker-manifest.json") `
+            -RightManifest (Join-Path $pkgRoot "worker-b/worker-manifest.json") `
+            -OutputDir (Join-Path $pkgRoot "worker-compare") `
+            -AllowExecutableHashDrift
+
+          ./scripts/package-senline-http.ps1 -SgcPath $sgc -SgpmPath $sgpm -OutputDir (Join-Path $pkgRoot "http-a")
+          ./scripts/package-senline-http.ps1 -SgcPath $sgc -SgpmPath $sgpm -OutputDir (Join-Path $pkgRoot "http-b")
+          ./scripts/compare-senline-package-manifests.ps1 `
+            -LeftManifest (Join-Path $pkgRoot "http-a/http-manifest.json") `
+            -RightManifest (Join-Path $pkgRoot "http-b/http-manifest.json") `
+            -OutputDir (Join-Path $pkgRoot "http-compare") `
+            -AllowExecutableHashDrift
+
+          Write-Host "senline installed worker/HTTP dual package loop green on ${{ matrix.os }}"
+
+      - name: Upload package compare evidence
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: senline-installed-packages-${{ matrix.artifact }}
+          path: |
+            ${{ runner.temp }}/senline-pkg-${{ matrix.artifact }}/**/comparison.json
+            ${{ runner.temp }}/senline-pkg-${{ matrix.artifact }}/**/*-manifest.json
+          if-no-files-found: warn

.github/workflows/toolchain-distribution.yml

@@ -11,6 +11,8 @@ on:
   pull_request:
     paths:
       - ".github/workflows/toolchain-distribution.yml"
+      - "README-dist.md"
+      - "scripts/compare-distribution-manifests.ps1"
       - "scripts/package-toolchain.ps1"
       - "scripts/install.ps1"
       - "scripts/install.sh"
@@ -35,15 +37,19 @@ jobs:
           - os: ubuntu-latest
             target: x86_64-unknown-linux-gnu
             artifact: linux-x86_64
+            reproducible: true
           - os: windows-latest
             target: x86_64-pc-windows-msvc
             artifact: windows-x86_64
+            reproducible: true
           - os: macos-15
             target: aarch64-apple-darwin
             artifact: macos-arm64
+            reproducible: false
           - os: macos-15-intel
             target: x86_64-apple-darwin
             artifact: macos-x86_64
+            reproducible: false
 
     steps:
       - uses: actions/checkout@v4
@@ -79,7 +85,9 @@ jobs:
           }
           $env:CARGO_BIN_EXE_sgc = Join-Path $releaseBin "sgc$suffix"
           $env:CARGO_BIN_EXE_sgfmt = Join-Path $releaseBin "sgfmt$suffix"
-          & $env:CARGO_BIN_EXE_sgc run examples/01_hello.sg --force-rebuild
+          # Checkout smokes authorize Cargo-built native runtime explicitly.
+          # Installed-mode is proven later against the packaged archive only.
+          & $env:CARGO_BIN_EXE_sgc --runtime-mode source-development run examples/01_hello.sg --force-rebuild
           $helloExit = $LASTEXITCODE
           if ($helloExit -ne 42) {
             throw "sgc hello smoke expected exit 42 on ${{ matrix.os }}, got $helloExit"
@@ -116,20 +124,74 @@ jobs:
       - name: Package toolchain
         shell: pwsh
         env:
-          SENGOO_BUILD_HASH: ${{ github.sha }}
           SENGOO_DIST_TARGET: ${{ matrix.target }}
         run: |
           if ("${{ github.ref_type }}" -eq "tag") {
             $version = "${{ github.ref_name }}".Substring(1)
           } else {
             $version = "0.1.0-ci"
           }
-          ./scripts/package-toolchain.ps1 -Version $version -NoBuild -SmokeEvidence "toolchain-distribution workflow package-smoke ${{ matrix.os }} ${{ github.sha }}"
+
+          $artifact = "${{ matrix.artifact }}"
+          $primaryOutput = "target/dist"
+          $cargoTargetA = Join-Path $env:RUNNER_TEMP "sengoo-cargo-package-a-$artifact"
+          Remove-Item -LiteralPath $primaryOutput -Recurse -Force -ErrorAction SilentlyContinue
+          Remove-Item -LiteralPath $cargoTargetA -Recurse -Force -ErrorAction SilentlyContinue
+          # package-toolchain.ps1 owns deterministic RUSTFLAGS (source+target
+          # remap, Windows /Brepro). Do not set a partial CARGO_ENCODED_RUSTFLAGS
+          # here or it will be overwritten by the packaging script.
+          Remove-Item Env:CARGO_ENCODED_RUSTFLAGS -ErrorAction SilentlyContinue
+          Remove-Item Env:RUSTFLAGS -ErrorAction SilentlyContinue
+          ./scripts/package-toolchain.ps1 `
+            -Version $version `
+            -OutputDir $primaryOutput `
+            -CargoTargetDir $cargoTargetA `
+            -SmokeEvidence "toolchain-distribution workflow build A ${{ matrix.os }} ${{ github.sha }}"
+
+          $manifestA = Join-Path $primaryOutput "sengoo-$version-${{ matrix.target }}/manifest.json"
+          $packageA = Get-Content -LiteralPath $manifestA -Raw | ConvertFrom-Json
+          if (-not $packageA.release_eligible) {
+            throw "package A is not release eligible: $($packageA | ConvertTo-Json -Compress)"
+          }
+
+          if ("${{ matrix.reproducible }}" -eq "true") {
+            $secondaryOutput = "target/dist-repro-b-$artifact"
+            $cargoTargetB = Join-Path $env:RUNNER_TEMP "sengoo-cargo-package-b-$artifact"
+            Remove-Item -LiteralPath $secondaryOutput -Recurse -Force -ErrorAction SilentlyContinue
+            Remove-Item -LiteralPath $cargoTargetB -Recurse -Force -ErrorAction SilentlyContinue
+            Remove-Item Env:CARGO_ENCODED_RUSTFLAGS -ErrorAction SilentlyContinue
+            Remove-Item Env:RUSTFLAGS -ErrorAction SilentlyContinue
+            ./scripts/package-toolchain.ps1 `
+              -Version $version `
+              -OutputDir $secondaryOutput `
+              -CargoTargetDir $cargoTargetB `
+              -SmokeEvidence "toolchain-distribution workflow build B ${{ matrix.os }} ${{ github.sha }}"
+
+            $manifestB = Join-Path $secondaryOutput "sengoo-$version-${{ matrix.target }}/manifest.json"
+            $packageB = Get-Content -LiteralPath $manifestB -Raw | ConvertFrom-Json
+            if (-not $packageB.release_eligible) {
+              throw "package B is not release eligible: $($packageB | ConvertTo-Json -Compress)"
+            }
+
+            $evidenceDir = "target/repro-evidence/$artifact"
+            ./scripts/compare-distribution-manifests.ps1 `
+              -LeftManifest $manifestA `
+              -RightManifest $manifestB `
+              -OutputDir $evidenceDir
+            $comparison = Get-Content -LiteralPath (Join-Path $evidenceDir "comparison.json") -Raw | ConvertFrom-Json
+            if ($comparison.status -ne "reproducible") {
+              throw "independent distribution builds are not reproducible"
+            }
+            foreach ($evidenceFile in @("normalized-a.json", "normalized-b.json", "comparison.json")) {
+              if (-not (Test-Path -LiteralPath (Join-Path $evidenceDir $evidenceFile))) {
+                throw "missing reproducibility evidence: $evidenceFile"
+              }
+            }
+          }
 
       - name: Prepare local release feed
         shell: pwsh
         env:
-          SENGOO_BUILD_HASH: ${{ github.sha }}
           SENGOO_DIST_TARGET: ${{ matrix.target }}
         run: |
           if ("${{ github.ref_type }}" -eq "tag") {
@@ -193,6 +255,20 @@ jobs:
           $archive = Get-Content target/dist/latest-archive.txt
           ./scripts/install.ps1 -Archive $archive -InstallDir target/install-smoke
 
+      - name: Install reproducibility build B (POSIX)
+        if: matrix.reproducible && runner.os != 'Windows'
+        shell: bash
+        run: |
+          archive=$(cat "target/dist-repro-b-${{ matrix.artifact }}/latest-archive.txt")
+          sh scripts/install.sh "$archive" target/install-smoke-repro-b
+
+      - name: Install reproducibility build B (Windows)
+        if: matrix.reproducible && runner.os == 'Windows'
+        shell: pwsh
+        run: |
+          $archive = Get-Content "target/dist-repro-b-${{ matrix.artifact }}/latest-archive.txt"
+          ./scripts/install.ps1 -Archive $archive -InstallDir target/install-smoke-repro-b
+
       - name: Installed stdlib smoke
         shell: pwsh
         run: |
@@ -408,6 +484,20 @@ jobs:
             target/dist/*.sha256
             target/dist/*/manifest.json
 
+      - name: Upload reproducibility evidence
+        if: matrix.reproducible
+        uses: actions/upload-artifact@v4
+        with:
+          name: sengoo-reproducibility-${{ matrix.artifact }}
+          path: |
+            target/dist-repro-b-${{ matrix.artifact }}/*.zip
+            target/dist-repro-b-${{ matrix.artifact }}/*.tar.gz
+            target/dist-repro-b-${{ matrix.artifact }}/*.sha256
+            target/dist-repro-b-${{ matrix.artifact }}/*/manifest.json
+            target/repro-evidence/${{ matrix.artifact }}/normalized-a.json
+            target/repro-evidence/${{ matrix.artifact }}/normalized-b.json
+            target/repro-evidence/${{ matrix.artifact }}/comparison.json
+
   publish-release:
     name: publish complete toolchain release
     if: startsWith(github.ref, 'refs/tags/v')