ARCADIA-Studio/harness/release-b4-package-preflight-ytr83r-20260911.md

B4 Windows package preflight — 2026-09-11

Codex-ytr83r /root/integration_audit. Static preparation for a distinct B4 prerelease; Codex-9e8r6t retains the named-creation milestone. Read AGENTS.md, issue #1 through comment 204 and Wiki ScenarioLifetimeRendering before this task. Root reports actual push/readback of checkpoint 52f6e17; this report does not alter the earlier publication worker's correctly attributed read-only probe.

No Cargo, metadata, compiler, application, packaging, release or upload was run. No production, packaging script, manifest, global configuration or Git state was changed. Owned outputs are this report and ignored .local/publication-ytr83r/ preflight/candidate files. No current application acceptance is claimed.

Result and concrete missing inputs

1. The installed 20260908 DLL passes the packager's static runtime policy, but the tracked notice manifest has only the previous 20260826 DLL hash. Add the prepared exact new runtime record and its component notice, preserving the old record. Do not replace the DLL with the older version merely to pass.
2. Use the workspace Python explicitly: C:/Users/User/.cache/codex-runtimes/codex-primary-runtime/dependencies/python/python.exe. Its scripts/package-artifacts.py --help startup passed in this review. LLVM's separate bundled Python lacks zlib; the same helper fails at import gzip with ModuleNotFoundError. This is an interpreter-selection requirement, not an unresolved host blocker. Root separately reports all 11 package tests and Docutils generation passed with the workspace Python.
3. Final matching GUI/server executables and their build/acceptance evidence remain pending. Neither executable existed in the ordinary debug/release locations under target/ or target/x86_64-pc-windows-gnullvm/ at inspection. Root must supply its actual build output directory; directory names do not establish build profile or source identity.
4. Full locked dependency/asset notice collection remains unexecuted here. All 41 references in the current supplemental manifest exist and match their declared hashes, but this does not prove coverage of the final target-filtered dependency graph. Preserve the strict offline metadata gate.

Exact runtime and provenance

The publisher's 20260908 release identifies LLVM 23.1.1. Its build script defaults to llvmorg-23.1.1. GitHub's tag lookup resolved that tag to 6dfe1677ab8dffbc6ec13d53a1e0215d75147689; the candidate component notice was downloaded from that exact commit. This records publisher/source provenance, not an independently reproduced toolchain build.

Input	Bytes	SHA-256
Publisher ZIP llvm-mingw-20260908-ucrt-x86_64.zip	190677197	1bcf74d06b724aeecaa6412ca85f5b26fb1da770e7cdcefa9263c9c5c3ad34b6
Installed x86_64-w64-mingw32/bin/libunwind.dll	190464	aa282fa47bb2c4e210cea5e470cdbdca58568f0be0bc73e404d86ab9cd95ef6a
Installed distribution LICENSE.TXT	15141	8d85c1057d742e597985c7d4e6320b015a9139385cff4cbae06ffc0ebe89afee
New commit-specific component notice	See candidate file	b5efebcaca80879234098e52d1725e6d9eb8fb96a19fce625d39184b705f7b6d

ZIP size/hash match the recorded publisher asset response .local/toolchain/llvm-release-asset.json (asset 551256712). Both installed runtime/license files independently match their decompressed ZIP members; .NET and the workspace Python produced the same member hashes. The component notice text happens to match the old notice hash; its newly pinned source provenance and runtime association are still distinct.

Read-only PE parsing confirms machine 0x8664, PE32+ 0x20b, no delay-import directory (RVA 0), and ten ordinary imports: kernel32.dll plus UCRT API-set convert, environment, filesystem, heap, locale, private, runtime, stdio and string DLLs, each api-ms-win-crt-<name>-l1-1-0.dll. Every import matches the existing package policy. Other installed runtimes (libc++.dll, libomp.dll, libwinpthread-1.dll, ASan) are not dependencies of this DLL and are not justified additions to the package. Final executable imports remain unknown.

Candidate files, ready for root review:

• .local/publication-ytr83r/runtime-notice-candidate/manifest.json: exact existing package/asset records and old runtime record, with one new runtime record appended. Every referenced notice is copied beside this alternate manifest to satisfy Under-Root; all candidate notice hashes passed.
• .local/publication-ytr83r/runtime-notice-candidate/llvm-6dfe1677ab8d-libunwind-LICENSE.TXT: exact upstream component notice.
• .local/publication-ytr83r/runtime-notice-candidate/candidate-verification.json: full proposed record, tag resolution, preservation checks and ZIP readback.
• .local/publication-ytr83r/package-preflight.json: static PE, Rust notice, supplemental hash and availability evidence. The candidate verification is the later ZIP-member comparison evidence.

Root can integrate only the new manifest record and new component notice under scripts/windows-notices/, or pass the self-contained alternate manifest with -NoticeManifest. Preserve the old F456 mapping for older artifacts.

Rust, source and build evidence

The installed gnullvm sysroot contains required COPYRIGHT.html and COPYRIGHT-library.html, optional COPYING3 and COPYING.RUNTIME, and 59 entries in its target library directory. Exact copyright hashes are in the static JSON. Installed component records include rustc, rust-std, rust-mingw, Cargo, Clippy and rustfmt. Root identifies this build compiler as Rust 1.98.1; this reviewer did not invoke it. Packaging must use this build's matching Cargo/rustc/sysroot and cache through the process-local toolchain environment.

Supply -BuildEvidence for this release even though the script permits its omission. Required fields are nonempty source_identity, profile, compiler, exact target, and binary_sha256 keyed by arcadia-studio.exe and arcadia-server.exe, with lowercase hashes. Add precise build commands, compiler/linker versions, source input/lock identities and verification record references as useful caller evidence. The script verifies target and binary hashes; it explicitly does not prove the source/profile/compiler statements. Freeze the actual input tree and binaries. Notice hashes of the packaging tree alone cannot establish that those sources produced an existing binary.

The strict notice pipeline hashes registry archives against Cargo.lock, actual local source files, shared workspace/build inputs, fonts and Rust target libraries. It invokes locked offline target-filtered Cargo metadata and rustc queries. Run it only after root releases the active manifest/lock/build boundary. Current Rust/dependency inputs must replace prior-host notice inventories and compiler claims; retain older evidence with its original attribution.

Package scope and remaining acceptance

The current Windows packager intentionally includes GUI plus server only. Its input, build-evidence hash loop, START-HERE and documentation describe that scope; notice roots are restricted to oa-desktop and oa-server. Integrating local oa-cli source without new registry dependencies does not automatically include or verify arcadia.exe. B4 may remain GUI/server with this explicit scope. To include CLI later, deliberately extend binary staging and PE closure, build hash evidence, notice root validation/traversal and workspace source coverage, launch documentation and clean-package CLI acceptance. Update relevant package tests. Never copy a CLI executable into an already hashed ZIP or claim its coverage from the existing two-root inventory.

After binaries exist: inspect their ordinary imports against this exact DLL and system allowlist; retain any unknown-import failure for explicit resolution. Run the unchanged strict packager with a fresh version/output path, reviewed notice inputs and working Python. Read back all ZIP membership/hashes and documentation closure. Packaging integrity still leaves native acceptance pending.

Extract the frozen ZIP into a fresh user-writable directory; use absolute app paths, unrelated working directory and process-only Windows-system PATH. Record binary/runtime/ZIP hashes, OS/graphics information and stdout/stderr/exit state. Verify server readiness, model import/read/update, restart and persistence. Verify real GUI Home/examples/Help, B4 marker selection/Properties at narrow and wide/Fit views, graphical editing and exact full Project/source/file-map Save/Undo/Redo/reopen against the independent lifecycle oracle. Delay/dynamic graphics loads need this runtime gate. A second ordinary machine without development tools remains stronger portability evidence. Parent owns all these gates and the distinct versioned prerelease, release notes and upload/readback.