Release Assurance

Read the release record, not a spreadsheet. Each target row names its proof host and its executables' hashes, and the record lists the third-party components inside each target. The Windows executables link OpenSSL 3.5.9 statically; the Linux executables load the operating system's own libssl.so.3.

{
  "schema": "mertek.tri.private-release",
  "version": "1.4.0",
  "sourceCommit": "9b2e4c71a0d58f36e1c7b90a4d2f8e63c5a1b7d0",
  "targets": [
    {
      "identity": "windows-x86_64-pe",
      "proofHost": "release-win-02",
      "tri": { "objectDigest": "4f9a07c2e81b3d65a0c4e7f19b2d83c6a5e0f71d4b9c2a8e3f6d0b1c7a5e9d24" },
      "components": [
        { "name": "OpenSSL", "version": "3.5.9", "linkage": "static", "license": "Apache-2.0" },
        { "name": "Unicode Character Database", "version": "17.0.0", "linkage": "compiled-in", "license": "Unicode-3.0" }
      ]
    },
    {
      "identity": "linux-x86_64-elf",
      "proofHost": "release-linux-01",
      "components": [
        { "name": "OpenSSL", "version": "3", "linkage": "system libssl.so.3", "license": "Apache-2.0" }
      ]
    }
  ]
}

Change the pin in one place. Compiler flags, per-node optimization levels and provider package roots are named lines in the checked-in build graph. The fix changes the provider pin where it is declared, and no workstation setting or environment variable can supply a second answer. A new pin is accepted only when two producing hosts rebuild the archives byte for byte.

cflags = -std=c11 -fno-fast-math -fexcess-precision=standard -ffp-contract=off -fstack-protector-strong -fPIC -ftls-model=initial-exec -fdata-sections -Wall -Wextra -Wpedantic -Wvla -Walloca -Werror -I.
mertektypes_optimization = -O3
mercrypto_optimization = -O2
merprim_optimization = -O3
draft_optimization = -O2
thalassa_optimization = -O3
# The complete Windows TLS build provisions this exact static OpenSSL.
openssl3510 = build/providers/openssl-3.5.10-static

Rebuild through the one launcher. Every compile edge runs the same launcher. It keys each object by its inputs and returns a stored object when nothing it reads has changed. Only the TLS adapter objects compile again, and every Windows executable relinks because each Windows link takes the TLS archives.

test_class_cc = build
rule cc
  command = $python tools/compile_runner.py --compile $out --depfile $out.d --identity c24e8aacd89902a6 -- $cc $cflags $providercflags -fstack-usage -MD -MF $out.d -c $in -o $out
  description = cc $in
  depfile = $out.d
  deps = gcc
  restat = 1

Rebuild what is derived, after the last rebase. Inventories such as the cross-node dependency graph and the type reference come from the final source state, never from a hand merge. Their generation lanes rederive each one and refuse a stale checked-in copy.

git fetch origin
git rebase origin/main
# Regenerate each derived inventory with its own writer on this exact
# tree, and land it with the change. Never hand-merge one.
ninja -k 0 design-graph-test mertektypes-reference-test
# Each generation lane rederives its inventory from the final source
# and fails on a stale checked-in copy.

Gate, bless, and publish the manifest last. Each proof host runs the full plan at the release commit, and the bless records an executable's SHA-256 only after that run exits 0. Objects publish first and the manifest last, so a half-published release never has a name.

# The private release manifest, written after every object reads back.
text schema = "mertek.tri.private-release"
u16 schemaVersion = 2
text releaseKind = "release"
text version = "1.4.1"
text sourceCommit = "5f0c2a91d4e7b3c8a6f1e0d9c2b4a7e3f8d1c6b9"
text[] requiredTargets = ["windows-x86_64-pe", "linux-x86_64-elf", "macos-arm64-macho"]
chest[] targets = [
    {
        text identity = "windows-x86_64-pe"
        text operatingSystem = "windows"
        text architecture = "x86_64"
        text objectFormat = "pe"
        text proofHost = "release-win-02"
        chest tri = {
            text kind = "tri"
            u64 size = 23511054
            sha256 objectDigest = "8a41c0f3d2b97e65a1c4f08d3e2b7a96c5d10e4f2a8b3c7d6e9f01a2b3c4d5e6"
        }
    }
]