Furth FortuneM9 reference

Assurance fabric / System overview

Release Assurance

A repeatable path from source to release

Release assurance resolves dependencies, builds artifacts, records their contents, and refreshes derived inventories from the approved source tree.

Inside the system

Architecture plates

Each plate preserves the internal layout, paths, boundaries, and highlighted decisions. Use the short label first, then follow the lines through the system.

Plate 01

One table of flags, and four ways to leave it

build-profile.manifest · three readers · the gate compiler line

ONE TABLE build-profile.manifest the ONE opt/debug/sanitize table profile release -O2 profile developer -O0 -g0 profile sanitize -O1 -g -fsanitize=address,undefined -fno-omit-frame-pointer NOT THE PROFILE'S TO OWN -std · -D... · -Werror -ffp-contract · -static · -pthread each caller keeps its own context READERS OVER ONE TABLE build-profile.sh bash · mtk_profile_optflags build-profile.ps1 Get-MtkProfileOptflags .bat / cmd recipes capture the print with for /f 74 tracked .ps1 and .bat recipes are censused on the same rule native/gates/fragment-prelude.sh every gates.d leaf sources it gcc -O2 -std=c11 -D_DEFAULT_SOURCE -D_FILE_OFFSET_BITS=64 -Werror=implicit-function-declaration unknown profile is REFUSED return 2, nothing on stdout, and no silent fall back to release THE GATE test-iteration-p0.build-profile CENSUSES FOUR WAYS TO LEAVE THE AUTHORITY BYPASS · a raw -O2 a live compile line that never consults the profile. 24 paths are declared pinned with a reason; a stale record fails. REACH · no source mtk_profile_optflags is a shell function, so it does not cross a bash child. An unsourced call expands to the empty string. SURFACE · dangling a function the authority declares that nothing calls. It bypasses nothing and it censuses nowhere, so it rots. SPLICE · word count --flag $(mtk_profile_optflags) works under release, one word, and refuses the whole argv under developer and sanitize.
Plate 02

One compiler launcher on PATH, one authority per run

the seam · four selection cases · the declared successor

THE SEAM · ONE AUTHORITY PER RUN scripts/use-build-cache.sh sourced, never executed 1 · strip every managed launcher directory from PATH 2 · prepend exactly one 3 · publish BUILDCACHE_ACTIVE_ENGINE WHY ONE, NOT TWO LAYERS Both launchers install a gcc at this same PATH seam, and both decide how a combined compile plus link is decomposed. NO THIRD ENGINE A new build cache REPLACES the successor. Two arms is the most this one-authority invariant can carry and still be provable. SELECTION · FOUR CASES BUILDCACHE_OFF=1 no routing; the engine stays unset unset · the default ccache, auto-provisioned once BUILDCACHE_ENGINE=ccache declared; refuses when unavailable BUILDCACHE_ENGINE=gate-action the successor, behind its opt-in THE ONE DEGRADE PATH Only the UNSET default may end with no cache. It warns loudly and builds cold. A DECLARED authority that cannot be honoured refuses instead. AUTHORITY TODAY, AND THE FLIP ccache · current authority memoises compiler invocations its link line is a passthrough gate-action · the successor compile actions, link actions, byte-replayed diagnostics, and typed action records THREE CONDITIONS, ALL REQUIRED 1 · the overlapping bespoke caches become product-bound 2 · one green coordinated full profile under gate-action 3 · one green cache audit on current main Until all three hold, ccache keeps the seat.
Plate 03

A cache needs a decomposition, and the win is on the repeat run

the argv taxonomy · the refusal · the never-break guarantee · the economics

ONE COMBINED RECIPE gcc -O2 a.c b.c -o bin -lm one compile-plus-link invocation ccache cannot cache this shape buildcache/decompose.sh the ONE argv taxonomy, shared by both managed launchers FOUR CLASSES, NO DEFAULT BUCKET compile-only · link-only BOTH · REFUSED SPLITTABLE · PER-SOURCE COMPILE PLUS ONE LINK modelled argv · no -c · at least one source · an explicit -o · no -x language state across sources ccache gcc <compile> -c src -o obj then one cheap link FAITHFUL LINK ORDER The link recipe carries a __BC_SOURCE_n__ placeholder in each source's own slot, so an archive the caller wrote first is still scanned first. REFUSED · 11 typed reasons response-file · sysroot · save- temps · non-object-mode · an unmodelled flag or positional REFUSE MEANS DO NOT SPLIT. THE GUARANTEE · A CACHE RETURNS THE ANSWER FASTER, IT NEVER CHANGES IT a split compile fails, or the split link fails, then redo the caller's combined build verbatim and let it report ONE EXCEPTION cannot find -l: the library is absent, so a full uncached rebuild cannot conjure it DIAGNOSTICS ARE BUFFERED A failed split attempt stays silent, so a failing build is reported once and not twice. WHAT THE CACHE ACTUALLY BUYS trident_rt.c · 50,539 lines the largest TU in the tree, built inside about 593 gates' own TU. A worktree-path miss costs about 114 s, every time. PATH-INDEPENDENT IDENTITY CCACHE_BASEDIR makes co-located worktrees share one entry. cache-identity.sh does the same for content-addressed artifacts. the embed archive · 53 TUs build-runtime-object.sh builds it once, so $TRIDENT_EMBED_TUS expands to one .a. The 53 loose sources cost 235 s cold a gate.
Plate 04

The host substrate closure: resolved, never spelled

host-substrate.manifest · the readers · what a recipe asks for · the refusal

ONE MACHINE-READABLE CLOSURE gates/host-substrate.manifest schema 1 · four record types base · 60 non-GPU members embed · 53, a strict subset supervisor · the one member an include-style driver omits backend · 9 profiles, each base plus its own GPU adapter EVERY TOOLCHAIN RESOLVES IT host-substrate-manifest.sh bash · hostsub_tus host-substrate.ps1 Get-HostSubstrateTus .bat and MSVC recipes call the PowerShell reader WHAT A RECIPE ASKS FOR th_host_tus the full software-backend host th_host_tus_aux the same, minus the supervisor th_host_tus_backend swap ONLY the GPU adapter trident_embed_tus the embedder subset, as one .a THE GATE gates.host-substrate-link REFUSES A COPIED LIST hardcoded A recipe that invokes a compiler AND spells a marker TU as a real build token, without resolving the manifest. Three markers key the scan: thalassa_engine_supervisor, keel_graph_containers, and keel_ai_crowd_batch. ok A recipe that names a reader, a resolver, or a resolved variable on a REAL code line. A comment-only mention does not count, because comments are stripped first. That gap once let hardcoded bench recipes pass.
Plate 05

Derived artifacts: any landing stales them

whole-tree derivation · three modes · the derived generator population

DERIVED FROM THE WHOLE TRACKED TREE git ls-files the tracked index, never a walk a copied file is not an input package_inventory.py classifies every scope source into six committed artifacts source-inventory.tsv · loader- inventory.tsv · runtime-library- manifest.tsv · and three more THREE MODES, AND THEY ARE NOT INTERCHANGEABLE --write refreshes every artifact. Run it LAST, after the final rebase, before the push. --verify structural invariants only. Immune to churn, so it is the right pre-push check. --check compares the snapshot bytes. The only mode that sees a new, renamed or reclassified file. gates.generator-drift-sweep · THE POPULATION IS DERIVED, NEVER LISTED CANDIDATE · 14 a tracked .py or .sh that DECLARES --write as its own option, or a tracked .tri whose write and check entries pair. Trident pairs today · 3 SWEPT · 9 --check too, or the check entry EXEMPT · 5 one typed reason, closed set of 2 NEITHER, OR BOTH, IS A FAIL A generator nothing checks is the defect. An exemption that outlives its cause is refused as stale, never carried on. A .tri names the driver to write. TWO COLLAPSE FLOORS, AND A NEGATIVE CONTROL ON EVERY RUN The corpus enumerates 11,967 tracked scripts. A result below the floor of 400 refuses, and a candidate count below 14 refuses, because an unusable enumeration reads exactly like a clean tree. A PATH-shimmed git that dies proves that refusal every run. The known-red ledger is EMPTY, so every red fails. A row expires by becoming false, never on a clock. A Trident port HOLDS the candidate floor: the .tri pair rejoins the population the ported .py leaves.
Plate 06

Product, package, and library: a resolved closure, not a file order

two products · three module axes · the resolver and what it refuses

WHAT THIS REPOSITORY DEPLOYS MerTekStak.com administration and control plane owner mertekstak · repo-product MerTek.io identity, Application authoring owner mertek-io · repo-product runtime-authored Applications BitsOfUs, IntoTheStrand and ReefStudio are config plus .tri in the live store, not source. DECLARED SUBSTRATE SETS platform.fathom.server.substrate platform.fathom.client · .shared platform.thalassa.client · .shared THREE INDEPENDENT MODULE AXES locality · 3 values server · client · both where the bytes may execute visibility · 5 values public-sdk · platform-internal product-private · shared-contract · test-only audience · the package field which people use the package It is not module visibility. both IS A DECLARATION A shared module says so. It is never a fallback for a module that nobody classified. BUILD AND DEPLOY RESOLVE A CLOSURE t.package.resolver resolveArtifacts(jobs, package Catalog, sourceCatalog) the only resolver entry t.package.provision projectArtifacts · validate Envelope · encodeAdmission the provisioning composites NOT A DEPENDENCY SOURCE a source grep · the shell concatenation order · a global load of every library A module a build script concatenates but the manifest does not declare is ABSENT.

Key parts

What the system does

These are the main boundaries, inputs, outputs, and failure rules. The examples show a specific use of each part.

One source of release policy

Approved settings and dependencies are resolved from declared records. Teams do not rely on private workstation choices.

Specific example

A lab and an integration environment can produce software under the same reviewed release policy.

Known software contents

Products are tied to a resolved set of packages and libraries. The release can show what it contains.

Specific example

A vulnerability review can identify which fielded applications include an affected component.

Fresh derived evidence

Generated catalogs and inventories are refreshed against the complete approved source before release.

Specific example

A delivery package can include an inventory that matches the exact software sent for acceptance.

Uses

Example uses

Pilot questions

What the team must decide

Which release facts must be retained

What dependency evidence the program requires

How the delivered artifact is tied to an accepted source state

Request a technical briefing

Connected references

Assurance fabric Evidence and Verification Open reference Assurance fabric Controlled Deployment Open reference Assurance fabric System Boundaries Open reference
Return to the M9 reference library