[PHPCraftdream]

Summary

• Check Cargo/npm dependency licenses and isolated Python build/dev/test graphs across Python 3.9, 3.11 and 3.13 on Linux, macOS and Windows. Reject unrecognized metadata and verify reviewed legacy exceptions by exact version and license-file SHA-256.
• Package both project licenses in pure wheels and verify exact bytes, uniqueness and metadata, including negative tests.
• Share locked native notice preparation: source-backed Cargo license texts, additional notices, actual Rust compiler/std report and lock hash. Refuse evidence inside Cargo sources, nonempty staging directories and bundle overwrites. Verify exact bundle bytes and RECORD in actual wheels.
• Build static PIC LLVM libunwind from source commit 87f0227cb60147a26a1eeb4fb06e3b505e9c7261. Include the complete original LICENSE and source-level notices/hashes for all 31 C/C++/ASM runtime files, including DWARF attribution; reject unreviewed source license headers.
• Remove GCC unwinder/archive and startup objects from musllinux builds using a small project-owned ELF DSO handle/finalization hook following the Itanium ABI. Verify actual link inputs rather than linker-script wildcard selectors.
• Verify both architectures' ELF/native payloads, compiler/lock consistency, notices, link maps, Rust TLS destruction, panic conversion and native suites. Test glibc dlclose and musl process-exit finalization separately; musl deliberately does not unload DSOs at dlclose.
• Reuse the verified musllinux build/runtime workflow in production release configuration. The PR caller passes the pinned 0.8.1 source commit; production passes its own github.sha. Gate publication on that workflow, separate distribution wheel artifacts from audit evidence and download only wheels-* for publication. CI checks the caller/source/publish wiring.

Verified results

All 38 checks passed at 11c07f2c2fd116dd62f6765fbb0f4a53a8b30661, including source-level attribution, no-GCC link inputs, TLS/panic/DSO lifecycle and 3,503 development native tests per musllinux architecture.

All 38 checks passed at b910e6c0098c6d795ccc5bbefbe71fd1f935ba8f after the common preparation helper was introduced. The native evidence job passed 13 CLI tests and verified notices in a real wheel.

All 42 checks passed at 40f9ff9467723457e4893c6c8ba49ddcbb05439f. The isolated release-source pipeline checked out exact Python v0.8.1 commit 566bbfce6c6b48387d7a0a089939a26744013dea, preserved its manifest/binding sources and passed 2,732 release-tag tests per architecture plus lifecycle/ABI/notice gates.

Both actual release-source wheel artifacts were independently inspected: registry core 0.8.1 checksum 7140dfe2fa6c320e74768cd6a637828c2d26f81746254f4fcd805f3993bd3fd5, lock hash and bundled notice bytes matched. Each contained 37 package records and all 31 LLVM source notices. These are newly resolved builds of release source, not reproductions of historical wheels.

All 42 checks passed at 6668fb31bff28f05740d10cee7195cbabf793c4d after connecting the reusable musllinux path to production configuration and separating publishable artifacts.

Current head a9e992f672e1d47bd99e2b483bac2d3f81849597 passed all 48 checks. A second reusable workflow covers the six GNU/Linux, macOS and Windows targets. It verifies the exact notice bundle/RECORD, native format/architecture and actual compiler identity, and retains native headers/imports for the separate runtime audit. Installed-wheel smoke tests run only when the target matches the runner architecture; cross-target execution is not claimed. Production calls the same native workflow, with its own source commit, and publication requires its success. All eight native release targets now have notice packaging and artifact verification.

The six non-musl artifact reports were also independently inspected: each used source 566bbfce6c6b48387d7a0a089939a26744013dea, registry core 0.8.1 with the expected checksum, a matching lock hash, 37 package records and the correct native architecture. No local tests or builds were run.

Boundaries and remaining work

The release configuration changes are in this draft PR only: no merge, release, tag change, PyPI upload or IDE-store publication was performed. The packaging implementation is complete, but the wider non-Cargo CRT/SDK and historical-artifact audit remains separate. GNU wheels still reference external system libgcc_s; macOS references system libSystem/libiconv; Windows references CPython and the system CRT. These are not extra bundled native payload files, and their presence is not a blanket licensing approval for all compiler/SDK components.

The development manifest uses Git core 0.9.0, while the release provenance guard requires registry core 0.8.1. Their evidence is kept separate. No version, framework or core source was changed to bypass the guard.

Cargo graph coverage is conservative, not an exact linked-code inventory. Native runtime evidence is recorded separately. Packaging notices alone does not establish every distribution obligation or resolve the wider historical native-artifact audit.

The pinned upstream libunwind LICENSE references a CREDITS.TXT file absent from its source tree; this is recorded honestly. The complete original LICENSE and actual source-header notices are retained. Ktav's own license has not been changed or presented as replacing third-party conditions.

Historical 0.8.1 musllinux wheels remain unchanged and contain a separate GCC 12.4 libgcc_s without a separate GCC license/source-offer file. Their exact GCC source provenance and applicable obligations remain under review; the new LLVM path does not repair those artifacts.

🤖 Generated with Claude Code