Tighten cached guardrail signatures

check-linuxcnc-inputs-cached.sh

@@ -103,6 +103,8 @@ write_complete_mode_signature() {
 }
 
 if ! {
+    printf 'CACHED_SCRIPT='
+    sha256sum check-linuxcnc-inputs-cached.sh
     printf 'CHECK_SCRIPT='
     sha256sum check-linuxcnc-inputs.sh
     printf 'LINUXCNC_ROOT=%s\n' "$linuxcnc_root"

check-linuxcnc-switchkins-remap-table-cached.sh

@@ -73,15 +73,20 @@ write_manifest_source_stats() {
 write_project_output_hashes() {
     local project_output
     for project_output in \
+        core/src/cnc_sim_api.cpp \
         core/src/linuxcnc_switchkins_remap_table.inc \
         core/tests/linuxcnc_switchkins_remap_config_cases.inc \
-        web/public/linuxcnc_switchkins_remap_config_cases.json; do
+        web/public/linuxcnc_switchkins_remap_config_cases.json \
+        web/src/index.ts \
+        web/src/wasm-core.js; do
         [[ -f "$project_output" ]] || return 1
         sha256sum "$project_output"
     done
 }
 
 if ! {
+    printf 'CACHED_SCRIPT='
+    sha256sum check-linuxcnc-switchkins-remap-table-cached.sh
     printf 'CHECK_SCRIPT='
     sha256sum check-linuxcnc-switchkins-remap-table.sh
     printf 'GENERATOR_SCRIPT='

docs/linuxcnc-source-policy.md

@@ -86,9 +86,9 @@ Efficiency rules:
 - Reuse source preflight results in persistent build directories through
   `check-linuxcnc-inputs-cached.sh`; its signature must include the LinuxCNC
   root, manifest content, source file size and nanosecond mtime stats, the check
-  mode, and the checker script hash. Cache updates must be serialized with a
+  mode, the cached wrapper script hash, and the checker script hash. Cache
-  lock inside the cache directory and must write next signatures through unique
+  updates must be serialized with a lock inside the cache directory and must
-  temporary files.
+  write next signatures through unique temporary files.
   Root-only source, flag, and link helper scripts must also use this cached
   preflight, defaulting to `build/linuxcnc-helper-preflight-cache` when a caller
   has not supplied `CNC_SIM_PREFLIGHT_CACHE_DIR`.
@@ -97,15 +97,16 @@ Efficiency rules:
   `test-linuxcnc-wasm-cmake-safe-probe.sh` instead of forcing a second cache
   walk in the same pass.
 - Cache wasm blocker analyzer output in `test-linuxcnc-wasm-blockers.sh`. Its
-  signature must include the analyzer script, manifest content, LinuxCNC source
+  signature must include the blocker wrapper script, analyzer script, manifest
-  size and nanosecond mtime stats, shim lister script, and shim source hashes.
+  content, LinuxCNC source size and nanosecond mtime stats, shim lister script,
-  The cache must be locked and may be overridden with
+  and shim source hashes. The cache must be locked and may be overridden with
   `CNC_SIM_WASM_BLOCKERS_CACHE_DIR`.
 - Reuse switchkins/remap table check results in the same persistent cache with
   `check-linuxcnc-switchkins-remap-table-cached.sh`; its signature must include
-  the checker and generator scripts, the kinematics manifest, referenced
+  the cached wrapper script, checker script, generator script, the kinematics
-  LinuxCNC source size and nanosecond mtime stats, and tracked generated
+  manifest, referenced LinuxCNC source size and nanosecond mtime stats, tracked
-  table/case outputs.
+  generated table/case outputs, and the thin API/web bridge files that pass
+  switchkins config aliases.
 - Reuse wasm probe objects across the wasm source object probe,
   `rs274ngc_pre` blocker/link probes, and the runtime link probe through
   `build-linuxcnc-wasm-probe-objects.sh`. Its mode-specific object caches must

test-all-native.sh

@@ -72,6 +72,7 @@ grep -F 'CNC_SIM_ALL_NATIVE_GUARDRAILS_ONLY must be 0 or 1: $guardrails_only' te
 grep -F 'all native guardrail checks passed' test-all-native.sh >/dev/null
 test -x check-linuxcnc-inputs-cached.sh
 grep -F 'CNC_SIM_PREFLIGHT_CACHE_DIR' check-linuxcnc-inputs-cached.sh >/dev/null
+grep -F 'sha256sum check-linuxcnc-inputs-cached.sh' check-linuxcnc-inputs-cached.sh >/dev/null
 grep -F 'sha256sum check-linuxcnc-inputs.sh' check-linuxcnc-inputs-cached.sh >/dev/null
 grep -F 'exec 8>"$cache_dir/check-linuxcnc-inputs.lock"' check-linuxcnc-inputs-cached.sh >/dev/null
 grep -F 'flock 8' check-linuxcnc-inputs-cached.sh >/dev/null
@@ -79,12 +80,19 @@ grep -F 'stat -c '\''SOURCE=%n:%s:%y'\''' check-linuxcnc-inputs-cached.sh >/dev/
 grep -F 'next_signature=$(mktemp "$cache_file.next.XXXXXX")' check-linuxcnc-inputs-cached.sh >/dev/null
 test -x check-linuxcnc-switchkins-remap-table-cached.sh
 grep -F 'check-linuxcnc-switchkins-remap-table.lock' check-linuxcnc-switchkins-remap-table-cached.sh >/dev/null
+grep -F 'sha256sum check-linuxcnc-switchkins-remap-table-cached.sh' check-linuxcnc-switchkins-remap-table-cached.sh >/dev/null
 grep -F 'sha256sum check-linuxcnc-switchkins-remap-table.sh' check-linuxcnc-switchkins-remap-table-cached.sh >/dev/null
 grep -F 'sha256sum generate-linuxcnc-switchkins-remap-table.sh' check-linuxcnc-switchkins-remap-table-cached.sh >/dev/null
 grep -F 'stat -c '\''SOURCE=%n:%s:%y'\''' check-linuxcnc-switchkins-remap-table-cached.sh >/dev/null
+grep -F 'core/src/cnc_sim_api.cpp' check-linuxcnc-switchkins-remap-table-cached.sh >/dev/null
 grep -F 'core/src/linuxcnc_switchkins_remap_table.inc' check-linuxcnc-switchkins-remap-table-cached.sh >/dev/null
 grep -F 'core/tests/linuxcnc_switchkins_remap_config_cases.inc' check-linuxcnc-switchkins-remap-table-cached.sh >/dev/null
 grep -F 'web/public/linuxcnc_switchkins_remap_config_cases.json' check-linuxcnc-switchkins-remap-table-cached.sh >/dev/null
+grep -F 'web/src/index.ts' check-linuxcnc-switchkins-remap-table-cached.sh >/dev/null
+grep -F 'web/src/wasm-core.js' check-linuxcnc-switchkins-remap-table-cached.sh >/dev/null
+grep -F 'the cached wrapper script, checker script, generator script' docs/linuxcnc-source-policy.md >/dev/null
+grep -F 'generated table/case outputs, and the thin API/web bridge files that pass' docs/linuxcnc-source-policy.md >/dev/null
+grep -F 'switchkins config aliases.' docs/linuxcnc-source-policy.md >/dev/null
 grep -F 'check-linuxcnc-switchkins-remap-table-cached.sh --cache-dir "$preflight_cache_dir" linuxcnc-kinematics-source-files.txt' test-native.sh >/dev/null
 grep -F 'check-linuxcnc-switchkins-remap-table-cached.sh --cache-dir "$preflight_cache_dir" linuxcnc-kinematics-source-files.txt' test-linuxcnc-source-link.sh >/dev/null
 grep -F 'CNC_SIM_PREFLIGHT_CACHE_DIR="$preflight_cache_dir"' build-wasm.sh >/dev/null
@@ -318,6 +326,9 @@ grep -F 'rs274_native_makefile="$build_dir/rs274-native.mk"' test-linuxcnc-rs274
 grep -F 'printf '\''\n-include $(DEP_FILES)\n'\''' test-linuxcnc-rs274-native.sh >/dev/null
 grep -F 'make --output-sync=target -j"$build_jobs" -f "$rs274_native_makefile"' test-linuxcnc-rs274-native.sh >/dev/null
 for hot_signature_script in \
+    build-linuxcnc-wasm-link-probe.sh \
+    build-linuxcnc-wasm-probe-objects.sh \
+    build-linuxcnc-wasm-standalone-probe.sh \
     build-linuxcnc-native-bridge-objects.sh \
     test-linuxcnc-api-native.sh \
     test-linuxcnc-bridge-native.sh \
@@ -491,6 +502,8 @@ grep -F 'Reuse standalone wasm probe objects and binaries for the tooldata link,
 grep -F 'Reuse wasm final link probes for `rs274ngc_pre` and runtime link checks' docs/linuxcnc-source-policy.md >/dev/null
 grep -F 'cached `nm --defined-only` symbol export signatures' docs/linuxcnc-source-policy.md >/dev/null
 grep -F 'Cache wasm blocker analyzer output' docs/linuxcnc-source-policy.md >/dev/null
+grep -F 'signature must include the blocker wrapper script, analyzer script' docs/linuxcnc-source-policy.md >/dev/null
+grep -F 'sha256sum test-linuxcnc-wasm-blockers.sh' test-linuxcnc-wasm-blockers.sh >/dev/null
 grep -F 'Persistent native, source-link, source-syntax, and wasm-safe CMake probe' docs/linuxcnc-source-policy.md >/dev/null
 grep -F 'copies and byte-compares `cnc_sim.js` and `cnc_sim.wasm` under' docs/linuxcnc-source-policy.md >/dev/null
 grep -F '`CNC_SIM_BUILD_JOBS` must be a positive integer and defaults to `8`.' docs/linuxcnc-source-policy.md >/dev/null

test-linuxcnc-wasm-blockers.sh

@@ -146,6 +146,8 @@ write_shim_source_hashes() {
     done < <(./list-linuxcnc-wasm-safe-shims.sh)
 }
 {
+    printf 'BLOCKER_SCRIPT='
+    sha256sum test-linuxcnc-wasm-blockers.sh
     printf 'ANALYZER='
     sha256sum analyze-linuxcnc-wasm-blockers.sh
     printf 'SHIM_LISTER='

test-linuxcnc-wasm-cmake-safe-probe.sh

@@ -217,6 +217,7 @@ grep -F 'CNC_SIM_WASM_BLOCKERS_CACHE_DIR must not contain whitespace: $cache_dir
 grep -F 'CNC_SIM_WASM_BLOCKERS_CACHE_DIR must not be the filesystem root' test-linuxcnc-wasm-blockers.sh >/dev/null
 grep -F 'exec 8>"$cache_dir/wasm-blockers.lock"' test-linuxcnc-wasm-blockers.sh >/dev/null
 grep -F 'stat -c '\''SOURCE=%n:%s:%y'\''' test-linuxcnc-wasm-blockers.sh >/dev/null
+grep -F 'sha256sum test-linuxcnc-wasm-blockers.sh' test-linuxcnc-wasm-blockers.sh >/dev/null
 grep -F 'sha256sum analyze-linuxcnc-wasm-blockers.sh' test-linuxcnc-wasm-blockers.sh >/dev/null
 if CNC_SIM_WASM_BLOCKERS_CACHE_DIR= ./test-linuxcnc-wasm-blockers.sh "$manifest" >"$wasm_blockers_cache_log" 2>&1; then
     echo "wasm blocker cache accepted an empty cache directory" >&2
@@ -258,6 +259,7 @@ grep -F 'CNC_SIM_WASM_PROBE_OBJECT_CACHE_DIR must not contain whitespace: $cache
 grep -F 'CNC_SIM_WASM_PROBE_OBJECT_CACHE_DIR must not be the filesystem root' build-linuxcnc-wasm-probe-objects.sh >/dev/null
 grep -F 'source-objects|rs274ngc-pre|runtime' build-linuxcnc-wasm-probe-objects.sh >/dev/null
 grep -F 'wasm probe object source list contains an empty path' build-linuxcnc-wasm-probe-objects.sh >/dev/null
+grep -F "printf 'BUILD_RULE_VERSION=1\n'" build-linuxcnc-wasm-probe-objects.sh >/dev/null
 grep -F 'list-cmake-set-sources.sh cnc_sim_core_sources core/' list-linuxcnc-wasm-safe-project-sources.sh >/dev/null
 grep -F 'list-cmake-set-sources.sh cnc_sim_linuxcnc_rs274_backend_sources core/' list-linuxcnc-wasm-safe-project-sources.sh >/dev/null
 grep -F 'build-linuxcnc-wasm-probe-objects.sh --mode source-objects "$manifest"' test-linuxcnc-wasm-source-objects.sh >/dev/null
@@ -294,6 +296,7 @@ grep -F 'CNC_SIM_BUILD_JOBS must be a positive integer: $build_jobs' build-linux
 grep -F 'tooldata-link|tooldata-common-link|interp-base-link|python-plugin-link|rs274ngc-pre-object' build-linuxcnc-wasm-standalone-probe.sh >/dev/null
 grep -F 'check-linuxcnc-inputs-cached.sh --cache-dir "$preflight_cache_dir" --root-only' build-linuxcnc-wasm-standalone-probe.sh >/dev/null
 grep -F 'exec 8>"$mode_dir/probe.lock"' build-linuxcnc-wasm-standalone-probe.sh >/dev/null
+grep -F "printf 'BUILD_RULE_VERSION=1\n'" build-linuxcnc-wasm-standalone-probe.sh >/dev/null
 grep -F 'DEP_FILES += %s.d' build-linuxcnc-wasm-standalone-probe.sh >/dev/null
 grep -F 'make --output-sync=target -j"$build_jobs" -f "$makefile" >/dev/null' build-linuxcnc-wasm-standalone-probe.sh >/dev/null
 grep -F 'build-linuxcnc-wasm-standalone-probe.sh --mode tooldata-link' test-linuxcnc-wasm-tooldata-link.sh >/dev/null
@@ -330,6 +333,7 @@ grep -F 'CNC_SIM_WASM_LINK_PROBE_CACHE_DIR must not be the filesystem root' buil
 grep -F 'rs274ngc-pre|runtime' build-linuxcnc-wasm-link-probe.sh >/dev/null
 grep -F 'build-linuxcnc-wasm-probe-objects.sh --mode "$object_mode" "$manifest"' build-linuxcnc-wasm-link-probe.sh >/dev/null
 grep -F 'exec 8>"$mode_dir/link.lock"' build-linuxcnc-wasm-link-probe.sh >/dev/null
+grep -F "printf 'BUILD_RULE_VERSION=1\n'" build-linuxcnc-wasm-link-probe.sh >/dev/null
 grep -F 'make --output-sync=target -j"$build_jobs" -f "$makefile" >/dev/null' build-linuxcnc-wasm-link-probe.sh >/dev/null
 grep -F 'build-linuxcnc-wasm-link-probe.sh --mode rs274ngc-pre "$manifest"' test-linuxcnc-wasm-rs274ngc-pre-link.sh >/dev/null
 grep -F 'build-linuxcnc-wasm-link-probe.sh --mode runtime "$manifest"' test-linuxcnc-wasm-runtime-link.sh >/dev/null