R2-1/R2-2: t27c silicon writes the receipt artifact (device record, IDCODE, verdict word, seal hash, seeds, toolchain) #7041

Epic #6655, Round-2 requirements R2-1 and R2-2 (recorded in the epic body by the owner's decision of 2026-10-06).

What

t27c silicon proves a spec on the die and prints a transcript, but writes no artifact: the durable record of a verified run is a comment pasted by hand. R2-1 fixes that. The contract already landed as specs/verified/receipt.t27 (#6943): six fields, fixed order, first_missing fails closed, verdict words pinned to verdict.t27 (PASS=0, FAIL=1).

The tool half:

1. R2-1 — receipt file. Every hardware t27c silicon run (not --skip-hardware) writes .trinity/receipts/<spec-stem>.json into the repo tree with exactly the six contract fields:
   • device_record (busdev + full IDCODE, read live from --detect the way t27c boards reads it -- the IDCODE in a document is not evidence, 2026-08-14)
   • full_idcode (the whole idcode 0x03636093 line from the loader/detect log, not a re-typed constant)
   • verdict_word (the word the B2 stage selected by design id, as a number; a run with no verdict word writes no receipt)
   • seal_hash (t27c seal --verify output for the spec, or null + receipt_first_missing never lies)
   • seeds (pnr_seed when given, else [])
   • toolchain (R2-2)
2. R2-2 — toolchain identity. The receipt names the binary that made it: the t27c git commit from git rev-parse --short HEAD at build time (via env!), so a receipt answers "which compiler made this claim". Producer identity is verbatim, never normalized (producer_matches).
3. The receipt is append-only history per run: one file per run record (R2-4 consumes these), file name <stem>-<UTC-timestamp>-<pid>.json.

Why foreign code

The silicon command is Rust (bootstrap/src/service.rs). Standing owner rule 2026-10-06: label it yourself, do the foreign part. PR carries owner-approved-foreign; exceptions entry cites this issue.

Tests

Unit tests over the pure writers: receipt JSON has the six fields in contract order; a dry-run (--skip-hardware) writes nothing; a FAIL verdict word still writes a receipt (the receipt records, it does not judge); parsing of the loader log's IDCODE line.

Closes nothing else. Refs #6655.

🤖 Generated with Claude Code