Remove Python in the build system for CupidBuild

[frankischilling]

Instead of using Python for the build orchestration develop and implement CupidBuild which will do everything that Python is currently doing for helping build the Cupid Toolchain and the Cupid OS.

[frankischilling]

CupidBuild now exists at source head as a CupidC-buildable hosted command. Commit 157d85d8 gives its first operation guarded CupidASM ET_REL publication on Linux and Windows: frozen seed/source inputs, private execution, structural and strict CupidDis validation, ownership-aware locking, rollback, recovery, and parent-relative replacement. The public suite passes 26 of 27 cases on each host, with the other host-specific case skipped, and the checked object contract is green.

This is the first publication seam, not the Python cutover. The promoted seed still contains five tools, normal recipes still use the Python transaction, and full manifest schema, provenance, target, build-plan, and graph orchestration remain to be transferred. The ticket stays open.

[frankischilling]

Commit 36d062c advances the CupidBuild path without claiming the Python cutover. The source-current publication contract now includes the CupidBuild declarations and Windows startup alongside the PE32 reader, bringing the checked boundary to 75 publication inputs and 55 fixed-point inputs. The Windows source-head fixed point and the complete normal OS build both pass with that closure.

Python still owns process orchestration, filesystem safety, independent policy checks, image packaging coordination, and the boot harness. The Windows fixed-point bridge also still uses Python and the known System32 WSL entry point for checked Linux CupidC. This issue therefore remains open.

[frankischilling]

Pushed a substantial CupidBuild source-head step to bootstrap/cupid-self-hosting in 2493e350 and cf9a29b6.

CupidBuild now parses the frozen manifest as JSON and validates the exact current host contract before running a checked tool. It accepts harmless field reordering and whitespace, while rejecting malformed or trailing JSON, duplicate or unknown fields, missing fields, schema or target drift, provenance drift, bad artifact roles, invalid sizes or hashes, and Linux build-plan drift. The object gate now requires known instructions, local targets, and function anchors at instruction starts.

The hosted i386 runtime gained standard memchr, which closes the source-head CupidBuild link without a host libc substitute. The seven-output self-link passes, and the complete CupidBuild suite passes all 35 tests on native Windows and Linux, with only the expected platform skips.

This issue remains open. Seed-directory peer membership and independent ELF32 or PE32 execution-profile checks still belong to Python. A six-tool seed promotion and normal Make recipe transfer are also still required before CupidBuild owns production coordination.

[frankischilling]

Progress: 06d82590 makes CupidBuild a first-class output of the Linux and native-Windows bootstrap candidates and of the 22-artifact Toolchain publication.

The fixed-point behavior gates now execute CupidBuild's guarded assemble-cupidasm-object path with both final generations, require identical relocatable output, and verify that a missing source preserves both prior outputs. Live publication verification recreates the six-tool candidate before checking its 58-file source closure.

This is a stronger CupidBuild bootstrap boundary, not the end of Python orchestration. Python still coordinates the fixed points, seed trust, independent execution-profile checks, and normal object publication, so this issue remains open.

[frankischilling]

Implemented the first normal CupidBuild ownership transfer in 89d275e0.

• kernel/cpu/isr.o and kernel/core/context_switch.o now invoke the promoted CupidBuild seed directly. CupidBuild freezes the six-tool cohort, runs private CupidASM and CupidDis images, validates the relocatable object, and owns guarded publication. These recipes no longer invoke Python or Hostbuild.
• The active graph remains at 452 transforms: CupidBuild participates in two and Python in 450. CupidASM and CupidDis remain the byte author and inspector for both objects.
• The Linux CupidBuild seed is now stored as executable mode 100755; its bytes and manifest digest are unchanged. Direct execution under WSL returns the expected usage line.
• The complete 163-test transaction and audit suite passed with two expected Windows skips. The changed graph contracts passed again in 63.625 seconds, audit regeneration and comparison passed, and both direct recipes rebuilt with PYTHON=missing-python while preserving their object hashes.
• The normal OS build passed both links, the strict 431-input image scan, and all 16 exact-size checks. A private four-CPU E1000 smoke brought every CPU online and ran /bin/ls.cc through JIT completion without a panic marker.

ADR 0354 and the bootstrap docs, CTXT manuals, wiki, and generated audit now record the boundary. Issue #34 stays open: raw boot and trampoline publication, C and link transactions, generated artifacts, user programs, and fixed-point coordination still need CupidBuild-owned interfaces.

[frankischilling]

Source-head progress landed in 43c747f. CupidBuild now has typed guarded bootloader and SMP-trampoline operations alongside its relocatable-object operation. Both raw paths keep the range map private, enforce the artifact's exact size and layout, run strict CupidDis source-edge checks, recheck the transaction, and publish only the image.

The clean Linux and native Windows fixed points passed together in 3,661.449 seconds. CupidBuild was the only promoted seed image that differed at stage two, and every stage-three/stage-four object and all six final tool images matched. The normal OS build, all 16 exact artifact checks, and a private four-vCPU E1000 boot smoke also passed.

This remains a source-head capability. The promoted seeds predate the two commands, and Python still coordinates the fixed-point builds, so #34 stays open for promotion and the larger coordination transfer.

[frankischilling]

Pushed fb02155. The promoted CupidBuild images now carry the guarded bootloader and SMP-trampoline commands on Linux and Windows, with matching stage-three/stage-four fixed points and promoted-seed self-consumption. This issue stays open because those commands are only seed capabilities at this checkpoint; the normal Make recipes and the remaining Python orchestration still need to move.

[frankischilling]

Commit 0b6d5f4f removes Python and Hostbuild from two more normal production edges: boot/boot.bin and kernel/smp_trampoline.bin. Together with the ISR and context-switch objects, CupidBuild now directly coordinates all four guarded assembly publications through the promoted six-tool seed.

The active audit moves from two CupidBuild and 450 Python participations to four CupidBuild and 448 Python participations. Cross-host tests prove that both raw recipes keep the exact seed closure and ignore poisoned CUPIDASM, CUPIDDIS, and PYTHON overrides. The clean image build, exact artifact verification, seed reproofs, and four-vCPU runtime frontier all passed.

This issue remains open because the normal graph still has 448 Python-coordinated transforms. The next high-leverage boundary is a native checked-tool runner for the CupidObj and CupidLD paths, followed by typed CupidBuild operations for the remaining composite publications.

[frankischilling]

Progress checkpoint: 6eb8772 adds the native checked cupidbuild run --tool cupidobj source capability, its Windows and Linux host boundaries, focused and standard Toolchain contracts, exact audit updates, and full bootstrap documentation.

This issue remains open. The promoted seeds do not contain the command yet, and all 186 direct root CupidObj calls still enter through the Python checked runner. The next coherent step is a paired Linux/Windows seed refresh followed by a separate Make handoff. That refresh is currently blocked because the local WSL service cannot start and returns Wsl/Service/E_UNEXPECTED.

[frankischilling]

The native Windows bootstrap improvement in 93f197c removes the WSL/Linux CupidC bridge from the fixed-point path, but it does not transfer CupidBuild ownership away from Python.

The latest audit still records Python as the owner of 186 direct root CupidObj transactions and 448 transformations across the wider build graph. The Windows and Linux fixed-point proofs, full build, artifact checks, and boot smoke are green, so the bridge removal is a stable step toward that transfer without overstating current ownership.

This issue should remain open until CupidBuild performs those build transactions on the supported path and the replacement is covered by the staged bootstrap checks.

[frankischilling]

Commit 0c6ec10 moves both production kernel links (kernel.elf.pass1 and kernel.elf) from the Python checked-seed launcher to the promoted CupidBuild run --tool cupidld path.

The regenerated active-build audit now attributes 192 transforms to CupidBuild and 260 to host Python. The full image build passed with both linker invocations visibly routed through CupidBuild, all 112 build-audit selectors passed in isolated processes, the 54 artifact-policy tests passed, and a private four-core GUI terminal smoke passed. Python still owns six production composite recipes, so this issue remains open.

[frankischilling]

Checkpoint 471804b1 adds a typed cupidbuild embed-jpeg transaction.

CupidBuild now freezes the JPEG and the complete six-tool seed, runs CupidObj with the original source identity, validates the exact ELF payload and symbols, applies an independent native JPEG parser, and publishes through the existing guarded transaction. The new parser and object contract covers accepted SOF0/SOF1 forms and 21 exact rejection classes. The full 76-test CupidBuild module, fixed-point contracts, active-source audit, OS rebuild, whole-image CupidDis check, and four-vCPU E1000 smoke all pass.

The production JPEG recipe still uses Hostbuild in this checkpoint. The promoted CupidBuild image predates the command, so moving the rule now would break clean builds. I am leaving this issue open for the paired Linux/Windows seed promotion and the subsequent Make handoff.

[frankischilling]

Commit 99f29b2 adds the missing hosted <stddef.h> surface without weakening CupidBuild's size_t API. Strict CupidC now accepts the implementation __builtin_offsetof path, and the frozen Toolchain closure grows to 59 source inputs. The complete frontend group passed 162 tests, the manifest and artifact group passed 119 tests with seven expected skips, the full build-graph module passed all 112 tests, and an uncontended make -j4 all accepted all sixteen exact artifacts after both CupidLD links and whole-image CupidDis validation. Linux and native Windows candidate reconstructions are now running in parallel from this named commit. The issue remains open until that paired proof is promoted and the normal JPEG edge moves to CupidBuild.