FEATURE-ci-native-link-map: Select Darwin linker map syntax

Author: etr

scripts/lib/package_integration.py

@@ -3,6 +3,7 @@
 import json
 import os
 from pathlib import Path
+import platform
 import shlex
 import time
 from package_commands import dependencies
@@ -19,7 +20,8 @@ def compile_probe(compiler, sources, flags, libraries, executable, command, env,
         included.update(dependencies(depfile))
         objects.append(str(obj))
     matrix.check_dependencies(included, prefix, source, build, private)
-    command(shlex.split(compiler) + objects + libraries + ['-Wl,-Map,' + str(executable) + '.map', '-o', str(executable)],
+    map_option = '-Wl,-map,' if platform.system() == 'Darwin' else '-Wl,-Map,'
+    command(shlex.split(compiler) + objects + libraries + [map_option + str(executable) + '.map', '-o', str(executable)],
             executable.parent, env)
     return {'compile_options': ['-O0', '-g'] if compile_options is None else list(compile_options), 'dependencies': sorted(included), 'sources': {str(path): hashlib.sha256(path.read_bytes()).hexdigest() for path in sources},
             'artifact_sha256': hashlib.sha256(executable.read_bytes()).hexdigest(), 'private_test_headers': private,

scripts/test-v3-installed-package.py

@@ -1,22 +1,84 @@
 #!/usr/bin/env python3
 """Adversarial policy fixtures; these are not installed-package proof."""
+import hashlib
 import importlib.util
 import json
 import os
 import shlex
 from pathlib import Path
 import subprocess
+import sys
 import tempfile
 import unittest
 from unittest.mock import patch
 
+sys.path.insert(0, str(Path(__file__).parent / 'lib'))
+import package_integration as integration
+
 CXX = os.environ.get('CXX', 'c++')
 
 spec = importlib.util.spec_from_file_location('audit', Path(__file__).with_name('audit-v3-installed-package.py'))
 audit = importlib.util.module_from_spec(spec)
 spec.loader.exec_module(audit)
 
 
+class CompileProbeTest(unittest.TestCase):
+    def setUp(self):
+        self.tmp = tempfile.TemporaryDirectory()
+        self.addCleanup(self.tmp.cleanup)
+        self.root = Path(self.tmp.name).resolve()
+        self.source, self.build, self.prefix = (self.root / name for name in ('source', 'build', 'prefix'))
+        self.unit = self.root / 'consumer.cpp'
+        self.unit.write_text('int main() { return 0; }\n')
+        self.header = self.prefix / 'include/httpserver.hpp'
+        self.header.parent.mkdir(parents=True)
+        self.header.write_text('struct installed_server {};\n')
+        self.executable = self.root / 'consumer'
+        self.calls = []
+
+    def command(self, argv, cwd, env):
+        self.calls.append((argv, cwd, env))
+        if '-MF' in argv:
+            Path(argv[argv.index('-MF') + 1]).write_text(
+                'consumer.o: ' + shlex.join([str(self.unit), str(self.header)]) + '\n')
+        Path(argv[argv.index('-o') + 1]).write_text('compiled artifact')
+
+    def test_compile_probe_uses_host_link_map_syntax_preserving_arguments_and_receipt(self):
+        compiler = 'cache-wrapper "compiler path/c++" --driver-mode=g++'
+        flags = ['-I' + str(self.prefix / 'include'), '-DFIXTURE=1']
+        libraries = ['-L' + str(self.prefix / 'lib'), '-lhttpserver', '-pthread', '-lssl', '-lcrypto']
+        env = {'PATH': 'selected-toolchain'}
+        map_path = str(self.executable) + '.map'
+        for host, option in (('Darwin', '-Wl,-map,'), ('Linux', '-Wl,-Map,'),
+                             ('FreeBSD', '-Wl,-Map,'), ('Windows', '-Wl,-Map,')):
+            for options in (None, ['-O2', '-DNDEBUG']):
+                with self.subTest(host=host, compile_options=options), patch('platform.system', return_value=host):
+                    self.calls.clear()
+                    receipt = integration.compile_probe(compiler, [self.unit], flags, libraries,
+                        self.executable, self.command, env, self.source, self.build, self.prefix, False,
+                        compile_options=options)
+                    obj = str(self.root / 'consumer-0.o')
+                    expected_options = ['-O0', '-g'] if options is None else options
+                    self.assertEqual(self.calls, [
+                        (shlex.split(compiler) + ['-std=c++20'] + expected_options + flags +
+                         ['-MMD', '-MF', str(self.root / 'consumer-0.d'), '-c', str(self.unit), '-o', obj], self.root, env),
+                        (shlex.split(compiler) + [obj] + libraries + [option + map_path, '-o', str(self.executable)], self.root, env)])
+                    self.assertEqual(receipt['link_map'], map_path)
+                    self.assertEqual(receipt['compile_options'], expected_options)
+                    self.assertEqual(receipt['sources'], {str(self.unit): hashlib.sha256(self.unit.read_bytes()).hexdigest()})
+                    self.assertEqual(receipt['dependency_sha256'], {
+                        str(path): hashlib.sha256(path.read_bytes()).hexdigest() for path in (self.unit, self.header)})
+                    self.assertEqual(receipt['dependencies'], sorted([str(self.unit), str(self.header)]))
+                    self.assertEqual(receipt['artifact_sha256'], hashlib.sha256(self.executable.read_bytes()).hexdigest())
+                    self.assertFalse(receipt['private_test_headers'])
+
+    def test_compile_probe_rejects_source_header_before_linking(self):
+        with patch('platform.system', return_value='Darwin'), self.assertRaisesRegex(ValueError, 'source public header contamination'):
+            integration.compile_probe('c++', [self.unit], [], [], self.executable, self.command,
+                {}, self.root, self.build, self.prefix, False)
+        self.assertEqual(len(self.calls), 1)
+
+
 class AuditTest(unittest.TestCase):
     def setUp(self):
         environment = patch.dict(os.environ)

specs/tasks/FEATURE-ci-native-link-map.md

@@ -0,0 +1,65 @@
+# FEATURE-ci-native-link-map
+
+Status: Implemented; local affected checks pass. Groundwork validation and
+finalization remain caller-owned. Native platform results remain CI / v3 PR owned.
+
+Scope: repair the installed-consumer link-map option rejected by Darwin ld.
+Base: v3 at `808f7fa20b0bc2f3c3049140b86189e704c5378e`.
+
+- [x] Create an isolated task worktree using the Groundwork identity helper.
+- [x] Reproduce the command defect with a failing compile-probe regression.
+- [x] Select Darwin `-Wl,-map,` while retaining GNU `-Wl,-Map,` elsewhere.
+- [x] Verify the unchanged map receipt path, ordered library arguments, quoted
+      compiler wrapper/options, compile-option defaults/overrides, source and
+      dependency hashes, artifact hash, and dependency contamination rejection.
+- [x] Run affected Python module tests and a real local GNU compile/link/run.
+- [x] Check the diff and Python syntax; record unavailable native evidence.
+- [ ] Caller: complete Groundwork validation and finalization.
+- [ ] CI / v3 PR: obtain fresh native Darwin installed-consumer and selected
+      archive results after merge; retain other platform results honestly.
+
+## Failure evidence and causal assessment
+
+The original native macOS failure is retained at
+`/tmp/v3-ci-job-120361073477-direct.log`, lines 299–318. Darwin ld rejects the
+unconditionally emitted GNU `-Map` option in `compile_probe`. The earlier TCP443
+permission probe is followed by the existing privileged setup; it is not the
+terminal failure. The caller also retained the same failure from selected-archive
+job 120362794854 at `/tmp/v3-ci-job-120362794854-direct.log`.
+
+The focused regression ran against the original implementation first:
+`python3 scripts/test-v3-installed-package.py CompileProbeTest -v` failed only
+the two Darwin option variants, showing `-Map` instead of `-map`. Linux,
+FreeBSD and Windows command variants retained their expected GNU syntax.
+
+## Local verification
+
+- The focused command regression passed after the minimal platform selection.
+- `python3 scripts/test-v3-installed-package.py -v`: 37 tests passed.
+- `python3 scripts/test-v3-native-benchmark.py`: 18 tests passed, including the
+  existing compile-probe default/override contract.
+- A bounded real `compile_probe` invocation compiled and linked a C++ consumer
+  against a temporary installed-header fixture with GNU c++, ran the resulting
+  executable, and verified the receipt's map file existed (20,637 bytes).
+  The temporary directory contained spaces; dependency parsing also passed.
+  This is a linker smoke check, not installed-library acceptance evidence.
+- `python3 -m py_compile scripts/lib/package_integration.py
+  scripts/test-v3-installed-package.py` and `git diff --check` passed.
+- CLAUDE.md prescribes cpplint for C++; no C++ files changed and no Python
+  linter is configured. No local Python linter was available.
+
+Darwin ld / ld64.lld was unavailable locally. Native Darwin linking and the
+fresh full package matrices remain incomplete until CI executes them. No broad
+native/build baseline was rerun, and no previous failed receipt was promoted to
+a pass. Prior validation closures remain unchanged. No product sources, audit
+policy, dependency/provider/client pins, tags or releases changed.
+
+## Implementation notes
+
+These Python script tests use standard-library unittest and need no dependency
+installation. Existing modules load `scripts/lib` through `sys.path`; use
+`platform.system()` for native host selection. The repository's general C++
+setup remains `./bootstrap`, an out-of-tree configure/build and `make check`.
+The isolated task branch was created from v3 using the helper-returned identity;
+Git metadata writes required sandbox escalation. The unrelated bauth worktree
+was preserved.