@antprofuse/saddle-skill 0.2.0-rc.19 → 0.2.0

package/SKILL.md

@@ -27,7 +27,11 @@ path、设计目标或相邻版本替代。
 6. 运行 `scripts/validate-contract.sh <application.rs>` 与
    `scripts/validate-generated-project.sh <project-root>`；核对 public API snapshot、
    approved locks、package allowlist、同源 managed-object peak 与 machine
-   fingerprint，再运行正式 Rust package 提供的 Gate，不自行实现替代 Gate。
+   fingerprint，再运行正式 Rust package 提供的 Gate，不自行实现替代 Gate。生成工程
+   验证必须设置 `CARGO_NET_OFFLINE=true`，并通过已批准的 entry-local runner 创建
+   canonical `/tmp` 直属临时根；入口只接受其中独立的 `cargo-home`、`target` 与 `work`，
+   覆盖继承的 `CARGO_HOME`，在成功、STOP 和其他失败退出后删除整个临时根，并输出由
+   toolchain、target、features、lock、source 与 build contract 共同派生的 cache key。
 
 ## 生成约束
 

package/assets/registry-consumer/Cargo.lock

@@ -921,9 +921,9 @@ dependencies = [
 
 [[package]]
 name = "saddle-admission"
-version = "0.2.0-rc.19"
+version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "87ac93a6e5e95fc64934c20d7b7b534b852df9972c0e2534a705100eb6166dcb"
+checksum = "86c6a3787d1612faa49558f5a104ba78415ff604344112c150b6b69446937065"
 dependencies = [
  "saddle-core",
  "serde",
@@ -932,9 +932,9 @@ dependencies = [
 
 [[package]]
 name = "saddle-core"
-version = "0.2.0-rc.19"
+version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c8da2ce735cc6d32474506748c1641115ba171901d75a23e17f8a6fe541e9f57"
+checksum = "bf4e1cd2343cc239a0bb8288fe0947e73775d9cb3438b85ee1c15026a6369aa0"
 dependencies = [
  "ring",
  "rustix",
@@ -945,9 +945,9 @@ dependencies = [
 
 [[package]]
 name = "saddle-db"
-version = "0.2.0-rc.19"
+version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "73b59ad40f9f9376198397009f06c1d982d7886b9b1af06a14e309e75874d8f8"
+checksum = "e3cac62b288d0e7cf775138793e2d8afb8923b4bbb4d72afb2deb8c18d9b7030"
 dependencies = [
  "futures-util",
  "saddle-admission",
@@ -963,9 +963,9 @@ dependencies = [
 
 [[package]]
 name = "saddle-framework"
-version = "0.2.0-rc.19"
+version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "65b7879addd6739efe0281df357877633c04d9a2073bc3993885bb8eab11afff"
+checksum = "6f819954a32f042aa43a55c1fddb8e1a8c6de389f5f3b6cd006bba532a1aca0b"
 dependencies = [
  "ring",
  "saddle-admission",
@@ -981,9 +981,9 @@ dependencies = [
 
 [[package]]
 name = "saddle-observability"
-version = "0.2.0-rc.19"
+version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b64016c93ad54a07c90a6896eb946d7c4d1c96f6bdb2db3ba5687ef99024ae48"
+checksum = "5e6f5d2228e8a02dd6bf65cbbd2e982129696976a104c4caf773c12016e1ecd3"
 dependencies = [
  "getrandom 0.3.4",
  "rustix",
@@ -996,9 +996,9 @@ dependencies = [
 
 [[package]]
 name = "saddle-runtime"
-version = "0.2.0-rc.19"
+version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "addf7ef4a9ffe064d168f63ab4aae2702198faeac21512738a526a95af88e36c"
+checksum = "0c8925b3871f95f58cde8cf7de6938116d4fbb35000ea31699c7603d658deee2"
 dependencies = [
  "saddle-admission",
  "saddle-core",
@@ -1011,9 +1011,9 @@ dependencies = [
 
 [[package]]
 name = "saddle-service"
-version = "0.2.0-rc.19"
+version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e1292672f35cb3d0e29d759a27f134657e0d249bee9e8cb932b1676fd4a7c1bb"
+checksum = "6d148466da57be9be7b2e4df9dcd68f0a253a418db247438ad0be1e886c8ff1b"
 dependencies = [
  "pin-project-lite",
  "saddle-admission",

package/assets/registry-consumer/Cargo.toml

@@ -6,13 +6,13 @@ rust-version = "1.85"
 publish = false
 
 [dependencies]
-saddle = { package = "saddle-framework", version = "=0.2.0-rc.19" }
-saddle-admission = "=0.2.0-rc.19"
-saddle-core = "=0.2.0-rc.19"
-saddle-db = "=0.2.0-rc.19"
-saddle-observability = "=0.2.0-rc.19"
-saddle-runtime = "=0.2.0-rc.19"
-saddle-service = "=0.2.0-rc.19"
+saddle = { package = "saddle-framework", version = "=0.2.0" }
+saddle-admission = "=0.2.0"
+saddle-core = "=0.2.0"
+saddle-db = "=0.2.0"
+saddle-observability = "=0.2.0"
+saddle-runtime = "=0.2.0"
+saddle-service = "=0.2.0"
 
 [lints.rust]
 unsafe_code = "forbid"

package/package-files.txt

@@ -21,4 +21,5 @@ scripts/validate-generated-preflight.sh
 scripts/validate-identity-closure.py
 scripts/validate-managed-objects-peak.py
 scripts/validate-machine-input.sh
+scripts/validation-cache-key.py
 scripts/sync-identity-closure.py

package/package-manifest.json

@@ -5,18 +5,18 @@
   "publish": false,
   "npm": {
     "name": "@antprofuse/saddle-skill",
-    "version": "0.2.0-rc.19"
+    "version": "0.2.0"
   },
   "rust": {
     "facade": "saddle-framework",
-    "requirement": "=0.2.0-rc.19",
-    "source_commit": "669162c8730e33eaf8ffc246936c3eaa216d530c",
+    "requirement": "=0.2.0",
+    "source_commit": "96cd4ec8da55b0770c5d3e8275c74e65241a4759",
     "msrv": "1.85.0",
     "abi_frozen": false,
     "compatibility": "source-and-public-api",
     "skill_mapping": "exact-manifest-identity-not-version-number-equality",
     "public_api_snapshot": "references/public-api.snapshot",
-    "public_api_snapshot_sha256": "35409438325aa899b8f25dd1e93b5476c5709053be5dc97e194165c27ecaa531"
+    "public_api_snapshot_sha256": "da87e0b63c3fdf511daac30581cbf415f49541df2034d1e7bc713a9833179a51"
   },
   "skill": {
     "name": "saddle-service-0-2",
@@ -44,16 +44,17 @@
     "unified_application_sha256": "a85bf6a5665f3516fafddbe2b3c9460dadb7e341ce0336a79c4ecca4a4fd55d9",
     "unified_owner_sha256": "af15a8dab10c1ac35d1c7bcbf2174d80c056e8200bd8b7f6fe2ceb60c1f9e0ea",
     "approved_locks": {
-      "registry_consumer": "206c563849c0e538c4a343722d74f89d5e0dec0a8701e7ba8dfb64e61f8a8b4f"
+      "registry_consumer": "8896ba07b7a868b6914fa4cf5e85358e0c201bd717083c1822d0456d547a87ed"
     },
     "registry_consumer_template": {
-      "cargo_lock": "206c563849c0e538c4a343722d74f89d5e0dec0a8701e7ba8dfb64e61f8a8b4f",
-      "cargo_manifest": "730aed27a57fe76abbb340b2c7228866ca3692232046e3cc8f4ca82f2c8cf802",
+      "cargo_lock": "8896ba07b7a868b6914fa4cf5e85358e0c201bd717083c1822d0456d547a87ed",
+      "cargo_manifest": "561cef428037910a846ff06936b1c71a7d41d386fd8341abb0e5e979a2ea83d1",
       "library": "a85bf6a5665f3516fafddbe2b3c9460dadb7e341ce0336a79c4ecca4a4fd55d9",
       "generated_owner": "af15a8dab10c1ac35d1c7bcbf2174d80c056e8200bd8b7f6fe2ceb60c1f9e0ea",
       "external_consumer_test": "18cb018e87a251255457861058537fc1b07b0226c002d170de4e2c5512f2ae45",
-      "output_validator": "72047a79a2e135c19460a674f0ddd7facefea284e55bcb435b911f9ecf121f2c",
-      "preflight_validator": "925c0205387dd458cd60e029179f978aa72dcc1eb3bcde6b32ad4756363b81e4"
+      "output_validator": "d20d3ecf89e81c0797340bd6779e8e58265e4cfe4c38b7519e78a9064a817415",
+      "preflight_validator": "925c0205387dd458cd60e029179f978aa72dcc1eb3bcde6b32ad4756363b81e4",
+      "cache_key_builder": "7b464d2bfd6444f03c9ebc6bc58c49e03904223dc1a55bee8bfba8dabf56e90b"
     }
   },
   "generated_static_facts": {
@@ -62,7 +63,7 @@
     "c1_routes": 3,
     "fingerprint_toolchain": "rustc-1.85.0",
     "application_machine_fingerprint": "NOT_GENERATED_SK_02",
-    "template_identity_sha256": "acff3e0217a14fd3e9b3f0b7a52da9561fa09caa6f29a56ae98a2cf503ce1942",
+    "template_identity_sha256": "04f64225450bd190706464f806d8ce6604a70774b112311908ece3f448eeb261",
     "service_capacity": "whole-bundle-facade-owned",
     "termination": "component-opaque",
     "continuation": "component-opaque",
@@ -91,21 +92,21 @@
   ],
   "identity_closure": {
     "path": "references/identity-closure.json",
-    "sha256": "405935bb9f0ed2f6e268cedb8254d8540e597b0c3e65b67e7512aef61d515277",
-    "registry_artifact_source_commit": "669162c8730e33eaf8ffc246936c3eaa216d530c",
-    "rust_candidate_manifest_sha256": "ae2477f5c192b421922029fe78a1e32e4e2ba990385fe97dbaab419f8f7e3c6c",
+    "sha256": "620df144ab00eee84a5826bf4f53ae2f1f04b564c97f499ec9dd9a0e78b0aaea",
+    "registry_artifact_source_commit": "96cd4ec8da55b0770c5d3e8275c74e65241a4759",
+    "rust_candidate_manifest_sha256": "2b0af0e6dd396b32fcbefb4236565136319c0d33c69effc1852913acb5290b17",
     "registry_packages_sha256": {
-      "saddle-admission": "87ac93a6e5e95fc64934c20d7b7b534b852df9972c0e2534a705100eb6166dcb",
-      "saddle-core": "c8da2ce735cc6d32474506748c1641115ba171901d75a23e17f8a6fe541e9f57",
-      "saddle-db": "73b59ad40f9f9376198397009f06c1d982d7886b9b1af06a14e309e75874d8f8",
-      "saddle-framework": "65b7879addd6739efe0281df357877633c04d9a2073bc3993885bb8eab11afff",
-      "saddle-macros": "1c109b6e5addb35fae28ded64b08e64f68da8d14f961480b2d08dafc18867e64",
-      "saddle-observability": "b64016c93ad54a07c90a6896eb946d7c4d1c96f6bdb2db3ba5687ef99024ae48",
-      "saddle-runtime": "addf7ef4a9ffe064d168f63ab4aae2702198faeac21512738a526a95af88e36c",
-      "saddle-service": "e1292672f35cb3d0e29d759a27f134657e0d249bee9e8cb932b1676fd4a7c1bb"
+      "saddle-admission": "86c6a3787d1612faa49558f5a104ba78415ff604344112c150b6b69446937065",
+      "saddle-core": "bf4e1cd2343cc239a0bb8288fe0947e73775d9cb3438b85ee1c15026a6369aa0",
+      "saddle-db": "e3cac62b288d0e7cf775138793e2d8afb8923b4bbb4d72afb2deb8c18d9b7030",
+      "saddle-framework": "6f819954a32f042aa43a55c1fddb8e1a8c6de389f5f3b6cd006bba532a1aca0b",
+      "saddle-macros": "e46b63cda97e643f41a86ac817306081b88c1af186c635e9451946b51c59dbeb",
+      "saddle-observability": "5e6f5d2228e8a02dd6bf65cbbd2e982129696976a104c4caf773c12016e1ecd3",
+      "saddle-runtime": "0c8925b3871f95f58cde8cf7de6938116d4fbb35000ea31699c7603d658deee2",
+      "saddle-service": "6d148466da57be9be7b2e4df9dcd68f0a253a418db247438ad0be1e886c8ff1b"
     },
-    "framework_crate_sha256": "65b7879addd6739efe0281df357877633c04d9a2073bc3993885bb8eab11afff",
-    "fresh_registry_cargo_lock_sha256": "ac65de56aa57a0d2bb07b86ed420f9039e2b535fb6508f896ab6646bdb7cd3af",
-    "registry_consumer_cargo_lock_sha256": "206c563849c0e538c4a343722d74f89d5e0dec0a8701e7ba8dfb64e61f8a8b4f"
+    "framework_crate_sha256": "6f819954a32f042aa43a55c1fddb8e1a8c6de389f5f3b6cd006bba532a1aca0b",
+    "fresh_registry_cargo_lock_sha256": "542bb990a3e176f3cc987b34df23061c6fdaac321d3433aaa08cf5f47151631a",
+    "registry_consumer_cargo_lock_sha256": "8896ba07b7a868b6914fa4cf5e85358e0c201bd717083c1822d0456d547a87ed"
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@antprofuse/saddle-skill",
-  "version": "0.2.0-rc.19",
+  "version": "0.2.0",
   "description": "Unpublished immutable Saddle 0.2 Skill candidate.",
   "license": "MIT OR Apache-2.0",
   "files": [

package/references/api-boundary.md

@@ -51,9 +51,9 @@ where
 为 private、non-Clone 且仅移动一次。bundle 与 config 由 Test/部署控制面提供；Skill 不生成
 provider、credential、calibration 或 raw owner constructor。
 
-Facade source `669162c8730e33eaf8ffc246936c3eaa216d530c` 已真实导出本候选宏和
+Facade source `96cd4ec8da55b0770c5d3e8275c74e65241a4759` 已真实导出本候选宏和
 managed API，并物理收口 V1 路径。该 source checkpoint 仍不等于已发布的
-`saddle-framework 0.2.0-rc.19`；正式使用必须按 package manifest 精确匹配该候选制品。
+`saddle-framework 0.2.0`；正式使用必须按 package manifest 精确匹配该候选制品。
 旧 rc.3/rc.4 与外部 proof associated types 不兼容，禁止回退或混用。
 
 ## 稳定诊断 code 候选

package/references/identity-closure.json

@@ -1,23 +1,23 @@
 {
   "schema": "saddle-skill-identity-closure/2",
-  "skill_release": "0.2.0-rc.19",
-  "rust_release": "0.2.0-rc.19",
-  "artifact_source_commit": "669162c8730e33eaf8ffc246936c3eaa216d530c",
-  "registry_artifact_source_commit": "669162c8730e33eaf8ffc246936c3eaa216d530c",
-  "rust_candidate_manifest_sha256": "ae2477f5c192b421922029fe78a1e32e4e2ba990385fe97dbaab419f8f7e3c6c",
+  "skill_release": "0.2.0",
+  "rust_release": "0.2.0",
+  "artifact_source_commit": "96cd4ec8da55b0770c5d3e8275c74e65241a4759",
+  "registry_artifact_source_commit": "96cd4ec8da55b0770c5d3e8275c74e65241a4759",
+  "rust_candidate_manifest_sha256": "2b0af0e6dd396b32fcbefb4236565136319c0d33c69effc1852913acb5290b17",
   "registry_packages_sha256": {
-    "saddle-admission": "87ac93a6e5e95fc64934c20d7b7b534b852df9972c0e2534a705100eb6166dcb",
-    "saddle-core": "c8da2ce735cc6d32474506748c1641115ba171901d75a23e17f8a6fe541e9f57",
-    "saddle-db": "73b59ad40f9f9376198397009f06c1d982d7886b9b1af06a14e309e75874d8f8",
-    "saddle-framework": "65b7879addd6739efe0281df357877633c04d9a2073bc3993885bb8eab11afff",
-    "saddle-macros": "1c109b6e5addb35fae28ded64b08e64f68da8d14f961480b2d08dafc18867e64",
-    "saddle-observability": "b64016c93ad54a07c90a6896eb946d7c4d1c96f6bdb2db3ba5687ef99024ae48",
-    "saddle-runtime": "addf7ef4a9ffe064d168f63ab4aae2702198faeac21512738a526a95af88e36c",
-    "saddle-service": "e1292672f35cb3d0e29d759a27f134657e0d249bee9e8cb932b1676fd4a7c1bb"
+    "saddle-admission": "86c6a3787d1612faa49558f5a104ba78415ff604344112c150b6b69446937065",
+    "saddle-core": "bf4e1cd2343cc239a0bb8288fe0947e73775d9cb3438b85ee1c15026a6369aa0",
+    "saddle-db": "e3cac62b288d0e7cf775138793e2d8afb8923b4bbb4d72afb2deb8c18d9b7030",
+    "saddle-framework": "6f819954a32f042aa43a55c1fddb8e1a8c6de389f5f3b6cd006bba532a1aca0b",
+    "saddle-macros": "e46b63cda97e643f41a86ac817306081b88c1af186c635e9451946b51c59dbeb",
+    "saddle-observability": "5e6f5d2228e8a02dd6bf65cbbd2e982129696976a104c4caf773c12016e1ecd3",
+    "saddle-runtime": "0c8925b3871f95f58cde8cf7de6938116d4fbb35000ea31699c7603d658deee2",
+    "saddle-service": "6d148466da57be9be7b2e4df9dcd68f0a253a418db247438ad0be1e886c8ff1b"
   },
-  "framework_crate_sha256": "65b7879addd6739efe0281df357877633c04d9a2073bc3993885bb8eab11afff",
-  "fresh_registry_cargo_lock_sha256": "ac65de56aa57a0d2bb07b86ed420f9039e2b535fb6508f896ab6646bdb7cd3af",
-  "registry_consumer_cargo_lock_sha256": "206c563849c0e538c4a343722d74f89d5e0dec0a8701e7ba8dfb64e61f8a8b4f",
+  "framework_crate_sha256": "6f819954a32f042aa43a55c1fddb8e1a8c6de389f5f3b6cd006bba532a1aca0b",
+  "fresh_registry_cargo_lock_sha256": "542bb990a3e176f3cc987b34df23061c6fdaac321d3433aaa08cf5f47151631a",
+  "registry_consumer_cargo_lock_sha256": "8896ba07b7a868b6914fa4cf5e85358e0c201bd717083c1822d0456d547a87ed",
   "declaration_schema": "saddle-application/1",
   "machine_schema": "saddle-approved-build/2",
   "generated_static_schema": "saddle-generated-static-facts/2",
@@ -28,21 +28,22 @@
     "canonical_machine_input_sha256": "f7e73baa824f607a83a275e20681da46e4eab6f250fba8129bf959a1b7f263e6",
     "semantic_fact_whole_sha256": "a3ccc16cd94daec6c3bd4b93d7f8095b4eef68d3e9dbb686c8942c341acda5b2"
   },
-  "public_api_snapshot_sha256": "35409438325aa899b8f25dd1e93b5476c5709053be5dc97e194165c27ecaa531",
+  "public_api_snapshot_sha256": "da87e0b63c3fdf511daac30581cbf415f49541df2034d1e7bc713a9833179a51",
   "machine_schema_document_sha256": "353ee7fbf4dc8219595c44a1871f699952d0f2b116ed5ec615242c3f5521285d",
   "approved_locks": {
-    "registry_consumer": "206c563849c0e538c4a343722d74f89d5e0dec0a8701e7ba8dfb64e61f8a8b4f"
+    "registry_consumer": "8896ba07b7a868b6914fa4cf5e85358e0c201bd717083c1822d0456d547a87ed"
   },
   "unified_application_sha256": "a85bf6a5665f3516fafddbe2b3c9460dadb7e341ce0336a79c4ecca4a4fd55d9",
   "unified_owner_sha256": "af15a8dab10c1ac35d1c7bcbf2174d80c056e8200bd8b7f6fe2ceb60c1f9e0ea",
-  "template_identity_sha256": "acff3e0217a14fd3e9b3f0b7a52da9561fa09caa6f29a56ae98a2cf503ce1942",
+  "template_identity_sha256": "04f64225450bd190706464f806d8ce6604a70774b112311908ece3f448eeb261",
   "registry_consumer_template": {
-    "cargo_lock": "206c563849c0e538c4a343722d74f89d5e0dec0a8701e7ba8dfb64e61f8a8b4f",
-    "cargo_manifest": "730aed27a57fe76abbb340b2c7228866ca3692232046e3cc8f4ca82f2c8cf802",
+    "cargo_lock": "8896ba07b7a868b6914fa4cf5e85358e0c201bd717083c1822d0456d547a87ed",
+    "cargo_manifest": "561cef428037910a846ff06936b1c71a7d41d386fd8341abb0e5e979a2ea83d1",
     "library": "a85bf6a5665f3516fafddbe2b3c9460dadb7e341ce0336a79c4ecca4a4fd55d9",
     "generated_owner": "af15a8dab10c1ac35d1c7bcbf2174d80c056e8200bd8b7f6fe2ceb60c1f9e0ea",
     "external_consumer_test": "18cb018e87a251255457861058537fc1b07b0226c002d170de4e2c5512f2ae45",
-    "output_validator": "72047a79a2e135c19460a674f0ddd7facefea284e55bcb435b911f9ecf121f2c",
-    "preflight_validator": "925c0205387dd458cd60e029179f978aa72dcc1eb3bcde6b32ad4756363b81e4"
+    "output_validator": "d20d3ecf89e81c0797340bd6779e8e58265e4cfe4c38b7519e78a9064a817415",
+    "preflight_validator": "925c0205387dd458cd60e029179f978aa72dcc1eb3bcde6b32ad4756363b81e4",
+    "cache_key_builder": "7b464d2bfd6444f03c9ebc6bc58c49e03904223dc1a55bee8bfba8dabf56e90b"
   }
 }

package/references/public-api.snapshot

@@ -1,6 +1,6 @@
 format=saddle-public-api-snapshot/1
 facade=saddle-framework
-source_commit=669162c8730e33eaf8ffc246936c3eaa216d530c
+source_commit=96cd4ec8da55b0770c5d3e8275c74e65241a4759
 declaration_schema=saddle-application/1
 macro=saddle::application!
 managed_type=saddle::managed::U64

package/scripts/sync-identity-closure.py

@@ -18,7 +18,7 @@ def main() -> None:
     parser = argparse.ArgumentParser()
     parser.add_argument("--root", type=Path, required=True)
     parser.add_argument("--rust-candidate-manifest", type=Path, required=True)
-    parser.add_argument("--skill-release", default="0.2.0-rc.19")
+    parser.add_argument("--skill-release", default="0.2.0")
     args = parser.parse_args()
 
     root = args.root.resolve()
@@ -26,7 +26,7 @@ def main() -> None:
     candidate = json.loads(candidate_path.read_text(encoding="utf-8"))
     if candidate.get("schema") != "saddle-rs-01-r12-rust-recovery-candidate/1":
         raise SystemExit("unsupported Rust candidate manifest")
-    if candidate.get("release") != "0.2.0-rc.19" or candidate.get("status") != "candidate-ready-for-transport-review":
+    if candidate.get("release") != "0.2.0" or candidate.get("status") != "candidate-ready-for-transport-review":
         raise SystemExit("unexpected or incomplete Rust candidate")
     if candidate.get("publish_performed") is not False or candidate.get("tag_performed") is not False:
         raise SystemExit("Rust candidate crossed the release boundary")
@@ -57,6 +57,7 @@ def main() -> None:
         "external_consumer_test": template_root / "tests/provider_consumer.rs",
         "output_validator": skill / "scripts/validate-generated-project.sh",
         "preflight_validator": skill / "scripts/validate-generated-preflight.sh",
+        "cache_key_builder": skill / "scripts/validation-cache-key.py",
     }
     observed_template = {name: digest(path) for name, path in template_inputs.items()}
     template_identity = hashlib.sha256(

package/scripts/validate-generated-project.sh

@@ -9,7 +9,35 @@ fi
 project=$(cd "$1" && pwd)
 test -f "$project/Cargo.toml"
 test -f "$project/Cargo.lock"
-"$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/validate-generated-preflight.sh" "$project"
+script_dir=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd -P)
+cache_key_builder="$script_dir/validation-cache-key.py"
+test -x "$cache_key_builder"
+
+if [[ ${CARGO_NET_OFFLINE:-} != true ]]; then
+  echo "Skill validation requires CARGO_NET_OFFLINE=true" >&2
+  exit 1
+fi
+if [[ ${SADDLE_SKILL_FEATURE_SET:-default} != default ]]; then
+  echo "Skill validation supports only the declared default feature set" >&2
+  exit 1
+fi
+if [[ -z ${SADDLE_ENTRY_LOCAL_ROOT:-} || -z ${CARGO_HOME:-} || -z ${CARGO_TARGET_DIR:-} ]]; then
+  echo "Skill validation requires the approved entry-local cache runner" >&2
+  exit 1
+fi
+entry_root=$(cd "$SADDLE_ENTRY_LOCAL_ROOT" && pwd -P)
+trusted_tmp=$(cd /tmp && pwd -P)
+if [[ $(dirname "$entry_root") != "$trusted_tmp" || -L $SADDLE_ENTRY_LOCAL_ROOT ]]; then
+  echo "Skill validation entry root must be a canonical direct child of /tmp" >&2
+  exit 1
+fi
+if [[ $(cd "$CARGO_HOME" && pwd -P) != "$entry_root/cargo-home" || \
+      $(cd "$CARGO_TARGET_DIR" && pwd -P) != "$entry_root/target" || \
+      $(pwd -P) != "$entry_root/work" ]]; then
+  echo "Skill validation requires entry-local cargo-home, target, and workdir" >&2
+  exit 1
+fi
+"$script_dir/validate-generated-preflight.sh" "$project"
 if find "$project" -type d -name target -print -quit | grep -q .; then
   echo "tracked or unignored build target is forbidden" >&2
   exit 1
@@ -30,13 +58,13 @@ if re.search(r"(?:path|git|workspace)\s*=|\[patch", cargo_text):
 
 deps = cargo.get("dependencies", {})
 framework = deps.get("saddle")
-if not isinstance(framework, dict) or framework.get("package") != "saddle-framework" or framework.get("version") != "=0.2.0-rc.19":
-    raise SystemExit("exact registry saddle-framework =0.2.0-rc.19 is required")
+if not isinstance(framework, dict) or framework.get("package") != "saddle-framework" or framework.get("version") != "=0.2.0":
+    raise SystemExit("exact registry saddle-framework =0.2.0 is required")
 for name, value in deps.items():
     if name.startswith("saddle-"):
         version = value if isinstance(value, str) else value.get("version")
-        if version != "=0.2.0-rc.19":
-            raise SystemExit(f"{name} must use exact registry 0.2.0-rc.19")
+        if version != "=0.2.0":
+            raise SystemExit(f"{name} must use exact registry 0.2.0")
 
 sources = sorted((root / "src").glob("**/*.rs"))
 tests = sorted((root / "tests").glob("**/*.rs"))
@@ -63,24 +91,33 @@ if "#[test]" not in test_text:
     raise SystemExit("zero executable tests are forbidden")
 PY
 
-owned_target=
-if [[ -z ${CARGO_TARGET_DIR:-} ]]; then
-  owned_target=$(mktemp -d)
-  export CARGO_TARGET_DIR=$owned_target
-  trap 'rm -rf -- "$owned_target"' EXIT
-else
-  mkdir -p "$CARGO_TARGET_DIR"
-fi
-case "$(cd "$CARGO_TARGET_DIR" && pwd)" in
+case "$(cd "$CARGO_TARGET_DIR" && pwd -P)" in
   "$project"|"$project"/*)
     echo "Cargo target must be outside the generated project" >&2
     exit 1
     ;;
 esac
-export CARGO_NET_OFFLINE=${CARGO_NET_OFFLINE:-false}
-cargo +1.85.0 test --manifest-path "$project/Cargo.toml" --locked
+cargo +1.85.0 test --manifest-path "$project/Cargo.toml" --locked --offline
 if find "$project" -type d -name target -print -quit | grep -q .; then
   echo "validation left a build target in the generated project" >&2
   exit 1
 fi
+rustc_verbose=$(rustc +1.85.0 -vV)
+rustc_version=$(sed -n '1s/^rustc //p' <<<"$rustc_verbose")
+toolchain_identity=$(sed -n 's/^commit-hash: //p' <<<"$rustc_verbose")
+target_triple=$(sed -n 's/^host: //p' <<<"$rustc_verbose")
+if [[ -z $rustc_version || -z $toolchain_identity || -z $target_triple ]]; then
+  echo "Rust toolchain identity is incomplete" >&2
+  exit 1
+fi
+cache_identity=$(python3 "$cache_key_builder" cache-key \
+  --project "$project" \
+  --rustc-version "$rustc_version" \
+  --toolchain-identity "$toolchain_identity" \
+  --target-triple "$target_triple" \
+  --feature-set default \
+  --build-contract "validate-generated-project=$script_dir/validate-generated-project.sh" \
+  --build-contract "validate-generated-preflight=$script_dir/validate-generated-preflight.sh" \
+  --build-contract "validation-cache-key=$cache_key_builder")
+printf 'saddle-skill-validation-cache=%s\n' "$cache_identity"
 echo "generated provider-generic consumer: PASS"

package/scripts/validate-identity-closure.py

@@ -74,6 +74,7 @@ def main() -> None:
         "external_consumer_test": template_root / "tests/provider_consumer.rs",
         "output_validator": skill / "scripts/validate-generated-project.sh",
         "preflight_validator": skill / "scripts/validate-generated-preflight.sh",
+        "cache_key_builder": skill / "scripts/validation-cache-key.py",
     }
     observed_template = {name: digest(path) for name, path in template_inputs.items()}
     template_identity = hashlib.sha256(
@@ -117,9 +118,9 @@ def main() -> None:
         raise SystemExit("identity closure invalid: registry package set")
     if any(not re.fullmatch(r"[0-9a-f]{64}", value) for value in closure["registry_packages_sha256"].values()):
         raise SystemExit("identity closure invalid: registry package digest")
-    if manifest["npm"]["version"] != "0.2.0-rc.19" or closure.get("skill_release") != "0.2.0-rc.19":
+    if manifest["npm"]["version"] != "0.2.0" or closure.get("skill_release") != "0.2.0":
         raise SystemExit("identity closure invalid: Skill candidate version")
-    if manifest["rust"]["requirement"] != "=0.2.0-rc.19" or closure.get("rust_release") != "0.2.0-rc.19":
+    if manifest["rust"]["requirement"] != "=0.2.0" or closure.get("rust_release") != "0.2.0":
         raise SystemExit("identity closure invalid: Rust RC version")
     installation = manifest.get("installation", {})
     if installation != {

package/scripts/validate-machine-input.sh

@@ -36,7 +36,7 @@ fi
 grep -Fxq 'schema=saddle-approved-build/2' "$input"
 grep -Fxq 'status=rc-blackbox-candidate-unpublished' "$input"
 grep -Fxq 'release_approval=false' "$input"
-grep -Fxq 'rust_facade_source=669162c8730e33eaf8ffc246936c3eaa216d530c' "$input"
+grep -Fxq 'rust_facade_source=96cd4ec8da55b0770c5d3e8275c74e65241a4759' "$input"
 grep -Fxq 'generated_static_schema=saddle-generated-static-facts/2' "$input"
 grep -Fxq 'runtime_profile=opaque-verified-startup-plan-layout' "$input"
 grep -Fxq 'signed_production_bundle=deployment-required' "$input"

package/scripts/validation-cache-key.py

@@ -0,0 +1,88 @@
+#!/usr/bin/env python3
+"""Build the deterministic P2 validation identity for an entry-local run."""
+
+from __future__ import annotations
+
+import argparse
+import hashlib
+import json
+from pathlib import Path
+
+
+def hash_parts(parts: list[tuple[str, bytes]]) -> str:
+    digest = hashlib.sha256()
+    for name, payload in parts:
+        encoded = name.encode("utf-8")
+        digest.update(len(encoded).to_bytes(8, "big"))
+        digest.update(encoded)
+        digest.update(len(payload).to_bytes(8, "big"))
+        digest.update(payload)
+    return digest.hexdigest()
+
+
+def source_digest(project: Path) -> str:
+    paths = [project / "Cargo.toml"]
+    for directory in (project / "src", project / "tests"):
+        if directory.is_dir():
+            paths.extend(path for path in directory.rglob("*.rs") if path.is_file())
+    unique = sorted(set(paths), key=lambda item: item.relative_to(project).as_posix())
+    return hash_parts(
+        [(path.relative_to(project).as_posix(), path.read_bytes()) for path in unique]
+    )
+
+
+def parse_contract(value: str) -> tuple[str, Path]:
+    if "=" not in value:
+        raise argparse.ArgumentTypeError("build contract must be label=path")
+    label, raw_path = value.split("=", 1)
+    if not label or not raw_path:
+        raise argparse.ArgumentTypeError("build contract must be label=path")
+    path = Path(raw_path).resolve()
+    if not path.is_file():
+        raise argparse.ArgumentTypeError(f"build contract is not a file: {path}")
+    return label, path
+
+
+def main() -> None:
+    parser = argparse.ArgumentParser()
+    subparsers = parser.add_subparsers(dest="command", required=True)
+    key_parser = subparsers.add_parser("cache-key")
+    key_parser.add_argument("--project", type=Path, required=True)
+    key_parser.add_argument("--rustc-version", required=True)
+    key_parser.add_argument("--toolchain-identity", required=True)
+    key_parser.add_argument("--target-triple", required=True)
+    key_parser.add_argument("--feature-set", required=True)
+    key_parser.add_argument("--build-contract", action="append", type=parse_contract, required=True)
+    args = parser.parse_args()
+
+    project = args.project.resolve()
+    lock = project / "Cargo.lock"
+    if not lock.is_file():
+        raise SystemExit(f"Cargo.lock is missing: {lock}")
+    contracts = sorted(args.build_contract, key=lambda item: item[0])
+    build_contract_digest = hash_parts([(label, path.read_bytes()) for label, path in contracts])
+    inputs = {
+        "RUSTC_VERSION": args.rustc_version,
+        "TOOLCHAIN_IDENTITY": args.toolchain_identity,
+        "TARGET_TRIPLE": args.target_triple,
+        "FEATURE_SET": args.feature_set,
+        "LOCK_DIGEST": hashlib.sha256(lock.read_bytes()).hexdigest(),
+        "SOURCE_DIGEST": source_digest(project),
+        "BUILD_CONTRACT_DIGEST": build_contract_digest,
+    }
+    canonical = [inputs[name] for name in (
+        "RUSTC_VERSION", "TOOLCHAIN_IDENTITY", "TARGET_TRIPLE", "FEATURE_SET",
+        "LOCK_DIGEST", "SOURCE_DIGEST", "BUILD_CONTRACT_DIGEST",
+    )]
+    output = {
+        "schema": "saddle-skill-validation-cache-key/1",
+        "inputs": inputs,
+        "cache_key": hashlib.sha256(
+            json.dumps(canonical, separators=(",", ":")).encode("utf-8")
+        ).hexdigest(),
+    }
+    print(json.dumps(output, separators=(",", ":"), sort_keys=True))
+
+
+if __name__ == "__main__":
+    main()