lib

commit f4948427d48fe7aa1b7cdc6de58a370870354807
parent b08cd2796cf1dc0e01a83060f0a38209662c1634
Author: triesap <tyson@radroots.org>
Date:   Sun,  6 Sep 2026 23:30:27 +0000

fix: bind Step 298 to its compiler payload

- Declare the Rust compiler exercised by the mutation lanes.
- Avoid duplicating the mandatory Cargo envelope identity.
- Keep Nix identity verification inside the source-bound gate.
- Rebind the gate contract to its final verifier bytes.

Diffstat:
M
contracts/rshr-202-step-298-gates.v1.json
 | 
2
+-
M
tools/xtask/src/rshr_202_step_298_gate.rs
 | 
2
+-

2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/contracts/rshr-202-step-298-gates.v1.json b/contracts/rshr-202-step-298-gates.v1.json
@@ -1 +1 @@
-{"gate_command_contract":[{"argv_template":["cargo","extbuild","run","--","cargo","run","--offline","--locked","-q","-p","xtask","--","rshr-step-298-gate","--step={step}","--check-id={check_id}","--source-revision={source_revision}","--source-tree={source_tree}","--candidate-digest={candidate_digest}","--platform=macos_aarch64","--execution-request-sha256={execution_request_sha256}"],"assertion_id":["step_298_gate_01_14c62391f40dcf5a2e166bac481c9eb8f50052ee65403ddbd63df5cc82ec6843"],"check_id":"gate-01-14c62391f40dcf5a2e166bac481c9eb8f50052ee65403ddbd63df5cc82ec6843","environment_authority":{"cache_policy_id":"rshr-200-step-287-cache-policy.v1","cache_policy_sha256":"3e81d178bce97b6c349dfbb00c68fd6f620ac00b1a1c8d37b12e9998f3c9eaaa","cadence_policy_id":"rshr-200-step-287-cadence-policy.v1","cadence_policy_sha256":"d24903df8659ee3772297c84994911efe7d21cb8b988320ddc6ddce0431892a1","isolation":"extbuild_host_constrained","network":"disabled","network_policy_id":"none","network_policy_sha256":"none","resource_policy_id":"rshr-200-step-287-resource-policy.v1","resource_policy_sha256":"05d3c7a89185d3c55678d97955193fce2ed92b1eee5af99083d77ea64c98d14e"},"environment_names":["EXT_BUILD_CONFIG","EXT_BUILD_MACHINE_CONFIG","EXT_BUILD_ROOT","HOME","PATH","RUSTUP_TOOLCHAIN","TMPDIR"],"gate_definition_sha256":"14c62391f40dcf5a2e166bac481c9eb8f50052ee65403ddbd63df5cc82ec6843","required_platforms":["macos_aarch64"],"required_tools":["cargo"],"result_schema":"radroots.services-hardening.rshr-200-step-check-result.v1","schema":"radroots.services-hardening.rshr-200-step-check-command.v1","step":298,"verifier_path":"tools/xtask/src/rshr_202_step_298_gate.rs","verifier_sha256":"6f02984f08fab23f55399456268486a6173efc61ff72323234ccceb1387a7e97"}],"schema":"radroots.lib.rshr-202-step-298-gates.v1","step":[298]}
+{"gate_command_contract":[{"argv_template":["cargo","extbuild","run","--","cargo","run","--offline","--locked","-q","-p","xtask","--","rshr-step-298-gate","--step={step}","--check-id={check_id}","--source-revision={source_revision}","--source-tree={source_tree}","--candidate-digest={candidate_digest}","--platform=macos_aarch64","--execution-request-sha256={execution_request_sha256}"],"assertion_id":["step_298_gate_01_14c62391f40dcf5a2e166bac481c9eb8f50052ee65403ddbd63df5cc82ec6843"],"check_id":"gate-01-14c62391f40dcf5a2e166bac481c9eb8f50052ee65403ddbd63df5cc82ec6843","environment_authority":{"cache_policy_id":"rshr-200-step-287-cache-policy.v1","cache_policy_sha256":"3e81d178bce97b6c349dfbb00c68fd6f620ac00b1a1c8d37b12e9998f3c9eaaa","cadence_policy_id":"rshr-200-step-287-cadence-policy.v1","cadence_policy_sha256":"d24903df8659ee3772297c84994911efe7d21cb8b988320ddc6ddce0431892a1","isolation":"extbuild_host_constrained","network":"disabled","network_policy_id":"none","network_policy_sha256":"none","resource_policy_id":"rshr-200-step-287-resource-policy.v1","resource_policy_sha256":"05d3c7a89185d3c55678d97955193fce2ed92b1eee5af99083d77ea64c98d14e"},"environment_names":["EXT_BUILD_CONFIG","EXT_BUILD_MACHINE_CONFIG","EXT_BUILD_ROOT","HOME","PATH","RUSTUP_TOOLCHAIN","TMPDIR"],"gate_definition_sha256":"14c62391f40dcf5a2e166bac481c9eb8f50052ee65403ddbd63df5cc82ec6843","required_platforms":["macos_aarch64"],"required_tools":["rustc"],"result_schema":"radroots.services-hardening.rshr-200-step-check-result.v1","schema":"radroots.services-hardening.rshr-200-step-check-command.v1","step":298,"verifier_path":"tools/xtask/src/rshr_202_step_298_gate.rs","verifier_sha256":"d87564ab88378dc59c4405db1fd5f41aa1f67f8c22851612b136067dfc87eac1"}],"schema":"radroots.lib.rshr-202-step-298-gates.v1","step":[298]}
diff --git a/tools/xtask/src/rshr_202_step_298_gate.rs b/tools/xtask/src/rshr_202_step_298_gate.rs
@@ -238,7 +238,7 @@ fn expected_contract(verifier_sha256: &str) -> Value {
         ],
         "gate_definition_sha256": GATE_DIGEST,
         "required_platforms": ["macos_aarch64"],
-        "required_tools": ["cargo"],
+        "required_tools": ["rustc"],
         "result_schema": "radroots.services-hardening.rshr-200-step-check-result.v1",
         "schema": "radroots.services-hardening.rshr-200-step-check-command.v1",
         "step": STEP,