@antprofuse/saddle-skill 0.2.0 → 0.3.0-alpha.2

package/scripts/parameterized-capacity-facts.py

@@ -1,254 +0,0 @@
-#!/usr/bin/env python3
-"""Generate or validate Saddle's final parameterized generated-capacity facts."""
-
-from __future__ import annotations
-
-import hashlib
-import json
-import re
-import sys
-from pathlib import Path
-
-U64_MAX = (1 << 64) - 1
-APPROVED_PROFILE_COUNT = 6_505_728
-APPROVED_DOMAIN_FINGERPRINT = (
-    "b83afcae5ee83ae410b207fe93b4609bf1c12549e2eb52a139cb5728c2f121f9"
-)
-DOMAIN = {
-    "worker_threads_min": 1,
-    "worker_threads_max": 8,
-    "active_requests_min": 1,
-    "active_requests_max": 128,
-    "wait_slots_min": 0,
-    "wait_slots_max": 128,
-    "db_max": 64,
-}
-COST = {
-    "route_count": 6,
-    "managed_commitment_per_active": 232,
-    "managed_objects_per_active": 2,
-    "task_storage_per_active": 2072,
-    "framework_per_active": 7200,
-    "response_carrier_per_active": 64,
-    "entry_reserve_per_active": 64,
-}
-IDENTITY_KEYS = (
-    "source_commit",
-    "contract_sha256",
-    "calibration_sha256",
-    "physical_measurement_sha256",
-    "physical_binary_sha256",
-    "physical_cargo_lock_sha256",
-    "query_artifact_sha256",
-    "c1_artifact_sha256",
-    "managed_objects_peak_fingerprint",
-)
-BASE_KEYS = {
-    "schema",
-    "source_commit",
-    "contract_sha256",
-    "calibration_sha256",
-    "physical_measurement_sha256",
-    "physical_binary_sha256",
-    "physical_cargo_lock_sha256",
-    "query_artifact_sha256",
-    "c1_artifact_sha256",
-    "managed_objects_peak_fingerprint",
-    "source_build_identity",
-    "worker_threads_domain",
-    "active_requests_domain",
-    "wait_slots_domain",
-    "db_domain",
-    "transport_registration_relation",
-    "io_events_relation",
-    "task_slot_capacity_relation",
-    "route_count",
-    "managed_commitment_per_active",
-    "managed_objects_per_active",
-    "task_storage_per_active",
-    "framework_per_active",
-    "response_carrier_per_active",
-    "entry_reserve_per_active",
-    "profile_count",
-    "domain_fingerprint",
-    "arithmetic",
-}
-
-
-def fail(message: str) -> None:
-    raise ValueError(message)
-
-
-def checked(value: int, label: str) -> int:
-    if value < 0 or value > U64_MAX:
-        fail(f"{label} exceeds approved 64-bit usize")
-    return value
-
-
-def sha256_text(text: str) -> str:
-    return hashlib.sha256(text.encode("utf-8")).hexdigest()
-
-
-def validate_sha(value: object, key: str) -> str:
-    length = 40 if key == "source_commit" else 64
-    label = "full Git commit" if key == "source_commit" else "SHA-256"
-    if not isinstance(value, str) or not re.fullmatch(rf"[0-9a-f]{{{length}}}", value):
-        fail(f"{key} is not {label}")
-    return value
-
-
-def canonical_identity(identity: dict[str, object]) -> tuple[dict[str, str], str]:
-    if set(identity) != set(IDENTITY_KEYS):
-        fail("source/build identity has unknown, duplicate, or missing fields")
-    values = {key: validate_sha(identity[key], key) for key in IDENTITY_KEYS}
-    text = "".join(f"{key}={values[key]}\n" for key in IDENTITY_KEYS)
-    return values, sha256_text(text)
-
-
-def profile_record(
-    workers: int,
-    active: int,
-    waiters: int,
-    db: int,
-    *,
-    task_storage_per_active: int = COST["task_storage_per_active"],
-) -> str:
-    if not 1 <= workers <= 8:
-        fail("T is outside 1..8")
-    if not 1 <= active <= 128:
-        fail("N is outside 1..128")
-    if not 0 <= waiters <= 128:
-        fail("W is outside 0..128")
-    if not 0 <= db <= min(active, 64):
-        fail("DB is outside 0..min(N,64)")
-    registration = checked(active + waiters, "R=N+W")
-    events = checked(registration + 3, "E=R+3")
-    task_slots = active
-    managed = checked(active * COST["managed_commitment_per_active"], "managed")
-    objects = checked(active * COST["managed_objects_per_active"], "objects")
-    task = checked(active * task_storage_per_active, "task")
-    framework = checked(active * COST["framework_per_active"], "framework")
-    response = checked(active * COST["response_carrier_per_active"], "response")
-    entry = checked(active * COST["entry_reserve_per_active"], "entry")
-    return (
-        f"T={workers};N={active};W={waiters};DB={db};"
-        f"R={registration};E={events};task_slots={task_slots};"
-        f"managed={managed};objects={objects};task={task};"
-        f"framework={framework};response={response};entry={entry}\n"
-    )
-
-
-def enumerate_domain() -> tuple[int, str]:
-    digest = hashlib.sha256()
-    count = 0
-    for workers in range(1, 9):
-        for active in range(1, 129):
-            for waiters in range(0, 129):
-                for db in range(0, min(active, 64) + 1):
-                    record = profile_record(workers, active, waiters, db)
-                    digest.update(record.encode("ascii"))
-                    count += 1
-    return count, digest.hexdigest()
-
-
-def expected(identity: dict[str, object], *, derive_domain: bool) -> dict[str, str]:
-    identity_values, source_build_identity = canonical_identity(identity)
-    if derive_domain:
-        count, domain_fingerprint = enumerate_domain()
-        if (
-            count != APPROVED_PROFILE_COUNT
-            or domain_fingerprint != APPROVED_DOMAIN_FINGERPRINT
-        ):
-            fail("enumerated support domain drifted from schema 1")
-    else:
-        count = APPROVED_PROFILE_COUNT
-        domain_fingerprint = APPROVED_DOMAIN_FINGERPRINT
-    return {
-        "schema": "saddle-generated-parameterized-capacity/1",
-        **identity_values,
-        "source_build_identity": source_build_identity,
-        "worker_threads_domain": "1..8",
-        "active_requests_domain": "1..128",
-        "wait_slots_domain": "0..128",
-        "db_domain": "0..min(N,64)",
-        "transport_registration_relation": "R=N+W",
-        "io_events_relation": "E=R+3",
-        "task_slot_capacity_relation": "task_slot_capacity=N",
-        **{key: str(value) for key, value in COST.items()},
-        "profile_count": str(count),
-        "domain_fingerprint": domain_fingerprint,
-        "arithmetic": "checked-u64",
-    }
-
-
-def read_facts(path: Path) -> dict[str, str]:
-    values: dict[str, str] = {}
-    for line_number, line in enumerate(path.read_text(encoding="utf-8").splitlines(), 1):
-        if not line or "=" not in line:
-            fail(f"line {line_number} is not canonical key=value")
-        key, value = line.split("=", 1)
-        if key in values:
-            fail(f"duplicate field: {key}")
-        if key not in BASE_KEYS:
-            fail(f"unknown field: {key}")
-        values[key] = value
-    if set(values) != BASE_KEYS:
-        fail("machine facts have missing fields")
-    return values
-
-
-def generate(identity_path: Path, output_path: Path) -> None:
-    identity = json.loads(identity_path.read_text(encoding="utf-8"))
-    values = expected(identity, derive_domain=True)
-    output_path.parent.mkdir(parents=True, exist_ok=True)
-    output_path.write_text(
-        "".join(f"{key}={values[key]}\n" for key in values),
-        encoding="utf-8",
-    )
-
-
-def validate(facts_path: Path) -> None:
-    values = read_facts(facts_path)
-    identity = {key: values[key] for key in IDENTITY_KEYS}
-    wanted = expected(identity, derive_domain=False)
-    if values != wanted:
-        drift = sorted(key for key in BASE_KEYS if values.get(key) != wanted.get(key))
-        fail(f"generated capacity facts drifted: {','.join(drift)}")
-
-
-def main() -> int:
-    try:
-        if len(sys.argv) == 4 and sys.argv[1] == "generate":
-            generate(Path(sys.argv[2]), Path(sys.argv[3]))
-            return 0
-        if len(sys.argv) == 3 and sys.argv[1] == "validate":
-            validate(Path(sys.argv[2]))
-            print("saddle-generated-parameterized-capacity/1: valid")
-            return 0
-        if len(sys.argv) == 7 and sys.argv[1] == "probe":
-            workers, active, waiters, db, task_cost = map(int, sys.argv[2:])
-            print(
-                profile_record(
-                    workers,
-                    active,
-                    waiters,
-                    db,
-                    task_storage_per_active=task_cost,
-                ),
-                end="",
-            )
-            return 0
-        print(
-            "usage: parameterized-capacity-facts.py "
-            "generate <identity.json> <facts> | validate <facts> | "
-            "probe <T> <N> <W> <DB> <task-cost>",
-            file=sys.stderr,
-        )
-        return 64
-    except (OSError, ValueError, json.JSONDecodeError) as error:
-        print(f"parameterized capacity facts invalid: {error}", file=sys.stderr)
-        return 1
-
-
-if __name__ == "__main__":
-    raise SystemExit(main())

package/scripts/sync-identity-closure.py

@@ -1,124 +0,0 @@
-#!/usr/bin/env python3
-"""Synchronize the packaged Skill closure from one approved Rust candidate."""
-
-from __future__ import annotations
-
-import argparse
-import hashlib
-import json
-import re
-from pathlib import Path
-
-
-def digest(path: Path) -> str:
-    return hashlib.sha256(path.read_bytes()).hexdigest()
-
-
-def main() -> None:
-    parser = argparse.ArgumentParser()
-    parser.add_argument("--root", type=Path, required=True)
-    parser.add_argument("--rust-candidate-manifest", type=Path, required=True)
-    parser.add_argument("--skill-release", default="0.2.0")
-    args = parser.parse_args()
-
-    root = args.root.resolve()
-    candidate_path = args.rust_candidate_manifest.resolve()
-    candidate = json.loads(candidate_path.read_text(encoding="utf-8"))
-    if candidate.get("schema") != "saddle-rs-01-r12-rust-recovery-candidate/1":
-        raise SystemExit("unsupported Rust candidate manifest")
-    if candidate.get("release") != "0.2.0" or candidate.get("status") != "candidate-ready-for-transport-review":
-        raise SystemExit("unexpected or incomplete Rust candidate")
-    if candidate.get("publish_performed") is not False or candidate.get("tag_performed") is not False:
-        raise SystemExit("Rust candidate crossed the release boundary")
-    source = candidate.get("artifact_source_commit", "")
-    if not re.fullmatch(r"[0-9a-f]{40}", source):
-        raise SystemExit("Rust artifact source is not a full commit")
-    expected_packages = {
-        "saddle-core", "saddle-macros", "saddle-admission", "saddle-observability",
-        "saddle-runtime", "saddle-db", "saddle-service", "saddle-framework",
-    }
-    packages = {item["name"]: item for item in candidate.get("crates", [])}
-    if set(packages) != expected_packages:
-        raise SystemExit("Rust candidate does not contain exactly eight Saddle crates")
-    if any(not re.fullmatch(r"[0-9a-f]{64}", item.get("sha256", "")) for item in packages.values()):
-        raise SystemExit("Rust candidate crate digest is invalid")
-
-    skill = root / "skills/saddle-service-0-2"
-    manifest_path = skill / "package-manifest.json"
-    manifest = json.loads(manifest_path.read_text(encoding="utf-8"))
-    snapshot = skill / "references/public-api.snapshot"
-    machine_doc = skill / "references/machine-schema.md"
-    template_root = skill / "assets/registry-consumer"
-    template_inputs = {
-        "cargo_lock": template_root / "Cargo.lock",
-        "cargo_manifest": template_root / "Cargo.toml",
-        "library": template_root / "src/lib.rs",
-        "generated_owner": template_root / "src/generated_artifact.rs",
-        "external_consumer_test": template_root / "tests/provider_consumer.rs",
-        "output_validator": skill / "scripts/validate-generated-project.sh",
-        "preflight_validator": skill / "scripts/validate-generated-preflight.sh",
-        "cache_key_builder": skill / "scripts/validation-cache-key.py",
-    }
-    observed_template = {name: digest(path) for name, path in template_inputs.items()}
-    template_identity = hashlib.sha256(
-        json.dumps(observed_template, separators=(",", ":")).encode()
-    ).hexdigest()
-    gate_identity = manifest.get("gate_identity", {})
-    if not re.fullmatch(r"[0-9a-f]{40}", gate_identity.get("d1_source_candidate", "")):
-        raise SystemExit("approved Gate identity is missing")
-
-    closure = {
-        "schema": "saddle-skill-identity-closure/2",
-        "skill_release": args.skill_release,
-        "rust_release": candidate["release"],
-        "artifact_source_commit": source,
-        "registry_artifact_source_commit": source,
-        "rust_candidate_manifest_sha256": digest(candidate_path),
-        "registry_packages_sha256": {name: packages[name]["sha256"] for name in sorted(packages)},
-        "framework_crate_sha256": packages["saddle-framework"]["sha256"],
-        "fresh_registry_cargo_lock_sha256": candidate["consumer_lock_sha256"],
-        "registry_consumer_cargo_lock_sha256": observed_template["cargo_lock"],
-        "declaration_schema": "saddle-application/1",
-        "machine_schema": "saddle-approved-build/2",
-        "generated_static_schema": "saddle-generated-static-facts/2",
-        "gate_identity": gate_identity,
-        "public_api_snapshot_sha256": digest(snapshot),
-        "machine_schema_document_sha256": digest(machine_doc),
-        "approved_locks": {"registry_consumer": observed_template["cargo_lock"]},
-        "unified_application_sha256": observed_template["library"],
-        "unified_owner_sha256": observed_template["generated_owner"],
-        "template_identity_sha256": template_identity,
-        "registry_consumer_template": observed_template,
-    }
-    closure_path = skill / "references/identity-closure.json"
-    closure_path.write_text(json.dumps(closure, indent=2) + "\n", encoding="utf-8")
-
-    manifest["npm"]["version"] = args.skill_release
-    manifest["rust"]["requirement"] = f'={candidate["release"]}'
-    manifest["rust"]["source_commit"] = source
-    manifest["rust"]["public_api_snapshot_sha256"] = closure["public_api_snapshot_sha256"]
-    manifest["consumer_evidence"]["approved_locks"] = closure["approved_locks"]
-    manifest["consumer_evidence"]["unified_application_sha256"] = closure["unified_application_sha256"]
-    manifest["consumer_evidence"]["unified_owner_sha256"] = closure["unified_owner_sha256"]
-    manifest["consumer_evidence"]["registry_consumer_template"] = observed_template
-    manifest["generated_static_facts"]["application_machine_fingerprint"] = "NOT_GENERATED_SK_02"
-    manifest["generated_static_facts"]["template_identity_sha256"] = template_identity
-    manifest["identity_closure"] = {
-        "path": "references/identity-closure.json",
-        "sha256": digest(closure_path),
-        "registry_artifact_source_commit": source,
-        "rust_candidate_manifest_sha256": closure["rust_candidate_manifest_sha256"],
-        "registry_packages_sha256": closure["registry_packages_sha256"],
-        "framework_crate_sha256": closure["framework_crate_sha256"],
-        "fresh_registry_cargo_lock_sha256": closure["fresh_registry_cargo_lock_sha256"],
-        "registry_consumer_cargo_lock_sha256": closure["registry_consumer_cargo_lock_sha256"],
-    }
-    manifest_path.write_text(json.dumps(manifest, indent=2) + "\n", encoding="utf-8")
-    package_path = skill / "package.json"
-    package = json.loads(package_path.read_text(encoding="utf-8"))
-    package["version"] = args.skill_release
-    package_path.write_text(json.dumps(package, indent=2) + "\n", encoding="utf-8")
-
-
-if __name__ == "__main__":
-    main()

package/scripts/validate-contract.sh

@@ -1,62 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-if [[ $# -ne 1 ]]; then
-  echo "usage: validate-contract.sh <application.rs>" >&2
-  exit 64
-fi
-
-source_file=$1
-if [[ ! -f "$source_file" ]]; then
-  echo "contract source not found: $source_file" >&2
-  exit 66
-fi
-
-source_text="$(<"$source_file")"
-
-required=(
-  'saddle::application!'
-  'schema "saddle-application/1";'
-  'application '
-  'service '
-)
-for token in "${required[@]}"; do
-  if ! grep -Fq "$token" <<<"$source_text"; then
-    echo "missing required declaration token: $token" >&2
-    exit 1
-  fi
-done
-
-if [[ "$(grep -Fc 'saddle::application!' <<<"$source_text")" -ne 1 ]]; then
-  echo "exactly one saddle::application! declaration is required" >&2
-  exit 1
-fi
-
-if grep -Eq \
-  'ServiceHandler|ServiceFuture|ServiceRegistry|Statement|DbValue|TransactionFuture|serde|sqlx|String|Vec<|Box<|dyn Future|tokio::|std::thread|spawn\(|channel\(|capacity[[:space:]]|deadline[[:space:]]|timeout[[:space:]]' \
-  <<<"$source_text"
-then
-  echo "declaration contains a V1, unmanaged, execution, or numeric-profile bypass" >&2
-  exit 1
-fi
-
-if grep -Eq 'transaction[[:space:]].*\{([^}]|$)*steps[[:space:]]+([02-9]|[1-9][0-9]+);' \
-  <<<"$(tr '\n' ' ' <"$source_file")"
-then
-  echo "schema 1 transaction must contain exactly one step" >&2
-  exit 1
-fi
-
-if grep -Eq 'decision[[:space:]]+([^;]+);' <<<"$source_text"; then
-  while IFS= read -r decision; do
-    case "$decision" in
-      "decision commit;"|"decision business_rollback;") ;;
-      *)
-        echo "unsupported transaction decision: $decision" >&2
-        exit 1
-        ;;
-    esac
-  done < <(grep -Eo 'decision[[:space:]]+[^;]+;' <<<"$source_text")
-fi
-
-echo "saddle-application/1 declaration: candidate-valid"

package/scripts/validate-generated-preflight.sh

@@ -1,120 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-if [[ $# -ne 1 ]]; then
-  echo "usage: validate-generated-preflight.sh <project-root>" >&2
-  exit 64
-fi
-
-project=$(cd "$1" && pwd)
-python3 - "$project" <<'PY'
-from pathlib import Path
-import re, sys
-
-root = Path(sys.argv[1])
-sources = sorted((root / "src").glob("**/*.rs"))
-if not sources:
-    raise SystemExit("generated source is missing")
-source = "\n".join(path.read_text() for path in sources)
-without_blocks = re.sub(r"/\*.*?\*/", "", source, flags=re.S)
-active = "\n".join(line.split("//", 1)[0] for line in without_blocks.splitlines())
-required = [
-    r"let\s+bundle\s*=\s*builder\s*\.\s*freeze_with_capacity_leaf\s*\(",
-    r"generated_bootstrap\s*\(\s*seal\.preflight_token\(\)\s*,\s*bundle\s*,",
-    r"seal\s*\.\s*bind\s*\(\s*bootstrap\s*\)",
-]
-for pattern in required:
-    if not re.search(pattern, active, flags=re.S):
-        raise SystemExit(f"missing active generated runtime preflight shape: {pattern}")
-
-marker = re.search(r"seal\s*\.\s*bind\s*\(", active)
-if marker is None:
-    raise SystemExit("missing active Facade opaque bind call")
-start = marker.end()
-round_depth, curly_depth, square_depth = 1, 0, 0
-commas = []
-end = None
-for index in range(start, len(active)):
-    char = active[index]
-    if char == "(":
-        round_depth += 1
-    elif char == ")":
-        round_depth -= 1
-        if round_depth == 0:
-            end = index
-            break
-    elif char == "{":
-        curly_depth += 1
-    elif char == "}":
-        curly_depth -= 1
-    elif char == "[":
-        square_depth += 1
-    elif char == "]":
-        square_depth -= 1
-    elif char == "," and round_depth == 1 and curly_depth == 0 and square_depth == 0:
-        commas.append(index)
-if end is None:
-    raise SystemExit("unterminated Facade opaque bind call")
-arguments = active[start:end]
-parts = []
-previous = 0
-for comma in commas:
-    parts.append(arguments[previous:comma - start].strip())
-    previous = comma - start + 1
-parts.append(arguments[previous:].strip())
-parts = [part for part in parts if part]
-if parts != ["bootstrap"]:
-    raise SystemExit("Facade bind must receive only the Service whole-bundle bootstrap")
-for forbidden in [
-    r"type\s+ServiceCapacity\s*=", r"type\s+Termination\s*=", r"type\s+Continuation\s*=",
-    r"\.into_parts\s*\(\s*\)", r"GeneratedBootstrapBinder", r"GeneratedTerminationTopologyWorkOwner",
-    r"PreflightGeneratedStaticContinuationOwner", r"runtime_layout_preflight\s*\(",
-    r"impl\s+(?:GeneratedBootstrapBinder|PreflightGeneratedStaticContinuationOwner|GeneratedTerminationTopologyWorkOwner)\s+for\s+",
-]:
-    if re.search(forbidden, active):
-        raise SystemExit(f"generated production proof injection remains: {forbidden}")
-
-def function_body(name: str) -> str:
-    marker = re.search(rf"fn\s+{name}\s*\([^)]*\)\s*->\s*ExecutionError\s*\{{", active)
-    if marker is None:
-        raise SystemExit(f"missing generated error mapper: {name}")
-    start = marker.end() - 1
-    depth = 0
-    for index in range(start, len(active)):
-        if active[index] == "{":
-            depth += 1
-        elif active[index] == "}":
-            depth -= 1
-            if depth == 0:
-                return active[start + 1:index]
-    raise SystemExit(f"unterminated generated error mapper: {name}")
-
-expected = {
-    "map_query_error": {
-        "ConnectionUnavailable", "QueryFailed", "InvalidRow", "FinalizerFailed",
-        "Cancelled", "Shutdown", "DependencyExecutionFailed", "DependencyUnavailable",
-    },
-    "map_write_error": {
-        "ConnectionUnavailable", "WriteFailed", "FinalizerFailed", "Cancelled", "Shutdown",
-        "DependencyExecutionFailed", "DependencyUnavailable",
-    },
-    "map_transaction_error": {
-        "BusinessRollback", "ConnectionUnavailable", "BeginFailed", "WriteFailed",
-        "CommitFailed", "RollbackFailed", "FinalizerFailed", "Cancelled", "Shutdown",
-        "Business", "DependencyExecutionFailed", "DependencyUnavailable",
-    },
-}
-for name, tokens in expected.items():
-    body = function_body(name)
-    if re.search(r"(?:^|[,{|])\s*_\s*=>", body):
-        raise SystemExit(f"generated error mapper contains a catch-all: {name}")
-    for token in tokens:
-        if len(re.findall(rf"\b{re.escape(token)}\b", body)) != 1:
-            raise SystemExit(f"generated error mapper token drift: {name}/{token}")
-    if name != "map_transaction_error" and re.search(r"\bExecutionError::Business\b", body):
-        raise SystemExit(f"dependency failure was downgraded to Business: {name}")
-if len(re.findall(r"\bExecutionError::Business\b", function_body("map_transaction_error"))) != 1:
-    raise SystemExit("only BusinessRollback may map to ExecutionError::Business")
-PY
-
-echo 'generated whole-bundle opaque proof authority: PASS'

package/scripts/validate-generated-project.sh

@@ -1,123 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-if [[ $# -ne 1 ]]; then
-  echo "usage: validate-generated-project.sh <project-root>" >&2
-  exit 64
-fi
-
-project=$(cd "$1" && pwd)
-test -f "$project/Cargo.toml"
-test -f "$project/Cargo.lock"
-script_dir=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd -P)
-cache_key_builder="$script_dir/validation-cache-key.py"
-test -x "$cache_key_builder"
-
-if [[ ${CARGO_NET_OFFLINE:-} != true ]]; then
-  echo "Skill validation requires CARGO_NET_OFFLINE=true" >&2
-  exit 1
-fi
-if [[ ${SADDLE_SKILL_FEATURE_SET:-default} != default ]]; then
-  echo "Skill validation supports only the declared default feature set" >&2
-  exit 1
-fi
-if [[ -z ${SADDLE_ENTRY_LOCAL_ROOT:-} || -z ${CARGO_HOME:-} || -z ${CARGO_TARGET_DIR:-} ]]; then
-  echo "Skill validation requires the approved entry-local cache runner" >&2
-  exit 1
-fi
-entry_root=$(cd "$SADDLE_ENTRY_LOCAL_ROOT" && pwd -P)
-trusted_tmp=$(cd /tmp && pwd -P)
-if [[ $(dirname "$entry_root") != "$trusted_tmp" || -L $SADDLE_ENTRY_LOCAL_ROOT ]]; then
-  echo "Skill validation entry root must be a canonical direct child of /tmp" >&2
-  exit 1
-fi
-if [[ $(cd "$CARGO_HOME" && pwd -P) != "$entry_root/cargo-home" || \
-      $(cd "$CARGO_TARGET_DIR" && pwd -P) != "$entry_root/target" || \
-      $(pwd -P) != "$entry_root/work" ]]; then
-  echo "Skill validation requires entry-local cargo-home, target, and workdir" >&2
-  exit 1
-fi
-"$script_dir/validate-generated-preflight.sh" "$project"
-if find "$project" -type d -name target -print -quit | grep -q .; then
-  echo "tracked or unignored build target is forbidden" >&2
-  exit 1
-fi
-
-python3 - "$project" <<'PY'
-from pathlib import Path
-import re, sys, tomllib
-
-root = Path(sys.argv[1])
-cargo_text = (root / "Cargo.toml").read_text()
-cargo = tomllib.loads(cargo_text)
-package = cargo.get("package", {})
-if package.get("rust-version") != "1.85":
-    raise SystemExit("generated project must declare rust-version 1.85")
-if re.search(r"(?:path|git|workspace)\s*=|\[patch", cargo_text):
-    raise SystemExit("path/git/workspace/patch dependency is forbidden")
-
-deps = cargo.get("dependencies", {})
-framework = deps.get("saddle")
-if not isinstance(framework, dict) or framework.get("package") != "saddle-framework" or framework.get("version") != "=0.2.0":
-    raise SystemExit("exact registry saddle-framework =0.2.0 is required")
-for name, value in deps.items():
-    if name.startswith("saddle-"):
-        version = value if isinstance(value, str) else value.get("version")
-        if version != "=0.2.0":
-            raise SystemExit(f"{name} must use exact registry 0.2.0")
-
-sources = sorted((root / "src").glob("**/*.rs"))
-tests = sorted((root / "tests").glob("**/*.rs"))
-if not sources or not tests:
-    raise SystemExit("generated source and at least one executable integration test are required")
-source = "\n".join(p.read_text() for p in sources)
-without_blocks = re.sub(r"/\*.*?\*/", "", source, flags=re.S)
-active = "\n".join(line.split("//", 1)[0] for line in without_blocks.splitlines())
-required = [
-    r"pub\s+fn\s+run\s*<\s*B\s*>",
-    r"B\s*:\s*ApprovedExternalBundle",
-    r"ProductionLauncher::verify\s*\(\s*bundle\s*\)\?\s*\.run\s*\(\s*config\s*,\s*GeneratedOwner\s*\)",
-    r"mod\s+__saddle_generated\s*;",
-]
-for pattern in required:
-    if not re.search(pattern, active, re.S):
-        raise SystemExit(f"missing active generated consumer shape: {pattern}")
-if re.search(r"pub\s+struct\s+GeneratedOwner", active):
-    raise SystemExit("GeneratedOwner must remain private")
-if "TODO" in source or re.search(r"fn\s+main[^{}]*\{\s*(?:return\s+)?Ok\s*\(\s*\(\s*\)\s*\)\s*;?\s*\}", active, re.S):
-    raise SystemExit("placeholder or no-op main is forbidden")
-test_text = "\n".join(p.read_text() for p in tests)
-if "#[test]" not in test_text:
-    raise SystemExit("zero executable tests are forbidden")
-PY
-
-case "$(cd "$CARGO_TARGET_DIR" && pwd -P)" in
-  "$project"|"$project"/*)
-    echo "Cargo target must be outside the generated project" >&2
-    exit 1
-    ;;
-esac
-cargo +1.85.0 test --manifest-path "$project/Cargo.toml" --locked --offline
-if find "$project" -type d -name target -print -quit | grep -q .; then
-  echo "validation left a build target in the generated project" >&2
-  exit 1
-fi
-rustc_verbose=$(rustc +1.85.0 -vV)
-rustc_version=$(sed -n '1s/^rustc //p' <<<"$rustc_verbose")
-toolchain_identity=$(sed -n 's/^commit-hash: //p' <<<"$rustc_verbose")
-target_triple=$(sed -n 's/^host: //p' <<<"$rustc_verbose")
-if [[ -z $rustc_version || -z $toolchain_identity || -z $target_triple ]]; then
-  echo "Rust toolchain identity is incomplete" >&2
-  exit 1
-fi
-cache_identity=$(python3 "$cache_key_builder" cache-key \
-  --project "$project" \
-  --rustc-version "$rustc_version" \
-  --toolchain-identity "$toolchain_identity" \
-  --target-triple "$target_triple" \
-  --feature-set default \
-  --build-contract "validate-generated-project=$script_dir/validate-generated-project.sh" \
-  --build-contract "validate-generated-preflight=$script_dir/validate-generated-preflight.sh" \
-  --build-contract "validation-cache-key=$cache_key_builder")
-printf 'saddle-skill-validation-cache=%s\n' "$cache_identity"
-echo "generated provider-generic consumer: PASS"