bzip2, xz: enforce the final Wasm artifact contract

[brandonpayton]

Purpose

Make the Bzip2 and XZ pilot Formulae fail before installation if their final linked executables are not valid Kandelo Wasm artifacts.

These are peer compression pilots receiving the same artifact policy, so the changes are intentionally one commit and one PR.

Change

• declare native Binaryen and WABT inspection tools for both Formulae;
• validate Bzip2's final bzip2 executable after linking and before installation;
• validate XZ's two distinct executables, xz and xzdec, after linking and before installation; and
• require the truthful fork: :forbidden contract for all three executables.

XZ's other command names remain symlinks whose target is exactly xz, so they do not represent additional executable identities.

No Formula revision is bumped. The validators and native build dependencies do not change installed target bytes. This PR contains no bottle block, archive, sidecar, receipt, provenance record, generated Wasm, or Kandelo ABI change.

Source merge readiness

This source-only PR is ready to merge now.

The Formulae call the existing tap-owned kandelo_validate_wasm_artifact helper and existing Kandelo artifact guards. Declaring WABT and Binaryen ensures the validator uses structural Wasm inspection. The source change does not depend on Automattic/kandelo#936, #913, #874, #883, #938, tap #22, or published bottles.

Tap PR #106 touches a separate XZ hunk and composes cleanly with this change. Either source PR may land first; the later one must be restacked and revalidated on current tap main.

Exact source

• Tap base: deb07626ce0078d578dd890712756373a4a4d5ce
• Exact head: 3bd7156d775dd1347f114cf5db2f854678dfbcdb
• Exact tree: c2115f7e355c61b98724043903433aa328fc491c
• Stable patch ID: 350e04a2e9a0684804c96feb60ddd1b49f867dfd
• Bzip2 Formula blob: 1aa6995595d24f4dd698a4195f4932970f03ec16
• XZ Formula blob: 0210cd45a64d098164b6fa18aa9e62c15e7caa3b
• Formula-support tree: e9f4d1372824afa8e4ade31df0073e8d8c317e6a

The stable patch ID and both Formula blobs are identical to the prior reviewed head.

Validation

Exact final head

Run through Kandelo's declared dev shell where applicable:

• Ruby syntax for both Formulae;
• brew style: 2 files, no offenses;
• Formula-support suite: 48 tests / 380 assertions;
• TypeScript support suite: 15 tests;
• exact source-closure validation for both Formulae;
• declared direct and wasm32 target runtime closures: empty for both Formulae;
• git diff --check; and
• a clean current-main merge tree.

Independent devil's-advocate review accepted the exact head, tree, and patch ID above with no findings.

Fresh source and Formula tests

Fresh supported source builds and full Formula tests ran on source-test head 04775b99f2ce01234617fc7f85e5956a9ef3394e. Its Bzip2 blob, XZ blob, and complete Formula-support tree are byte-identical to the exact final head above; the later base commits changed only peer Formulae.

Build context:

• Kandelo builder/validator head: homebrew: publish and verify installable Kandelo bottles kandelo#936 exact 256cb8844a26468fbde2dd77d6f93f0828a35fc4;
• Homebrew implementation: exact 34c40c18ffa2029b611b61c73273e32c003d0842;
• tap source: clean detached /private/tmp/kandelo-pr126-build-tap at 04775b99f2ce01234617fc7f85e5956a9ef3394e; and
• Kandelo builds/tests invoked through scripts/dev-shell.sh.

Both Formulae source-built successfully, all three in-Formula artifact guards passed, and both full Formula tests passed. Independent bottle inspection reported ABI 39, wasm32, fork-not-required, and an empty runtime dependency closure for each Formula.

Local validation archives:

• Bzip2 SHA-256: a639866932c2e462e9ca6f55f92b45dbb2852ce97323db4a309aca7918cad39d
• XZ SHA-256: 42dd8fd64ba7a6bf389e6425cec486dc20f5901b3f63425f4556458293af0aff

These archives are local evidence only. They were not published and must not be reused as authoritative bottles. The conflicted shared checkout under /opt/homebrew/Library/Taps was not used or modified by this validation.

Authoritative bottle publication

Publication remains a separate post-merge operation. It waits for:

1. homebrew: publish and verify installable Kandelo bottles kandelo#936 to land the secure reusable publisher;
2. tap ci: add thin tap workflows for bottle publishing and maintenance #22 and the required repository-protection boundary;
3. the final SDK/Autoconf stack in sdk: preserve static linker argument order kandelo#913, #874, #883, and #938;
4. tap formulae: use SDK-owned cross-compilation settings #106 after #874, because it changes the final XZ Formula source used for publication;
5. the canonical ABI 39 package index refresh after Kandelo main settles; and
6. fresh exact-merged-head build, inspection, and Node/Chromium pour evidence.

No canonical bottle bytes or metadata are changed by this PR.

[brandonpayton]

Independent devil's-advocate review: ACCEPT

No findings on the exact source reviewed:

• base: 731ce63ec3248cdd063cd25e79ca6298eba1a687
• head: e09da2c93659dc0226352c714544055a2315e4a1
• tree: e7e5d802925701b334bf80ecad77154305d2c66c

Scope and installed-artifact completeness

The diff is exactly seven additions across Formula/bzip2.rb and Formula/xz.rb: native WABT/Binaryen build dependencies and final linked-artifact validation.

• Bzip2 has one distinct installed Wasm executable, bzip2. It is validated immediately after the final make and before it is copied into the prefix.
• XZ has two distinct installed Wasm executables, xz and xzdec. Both are validated after the final make and before make install.
• XZ's other installed command names, lzcat, lzma, unlzma, unxz, and xzcat, are symlinks whose target is exactly xz; they are not additional executable identities requiring duplicate validation.
• Neither Formula transforms the executable bytes after validation.

All three distinct binaries use the truthful fork: :forbidden policy. Independent inspection of the retained exact-head bottles confirmed that each is wasm32, exports ABI 39, has no kernel.kernel_fork import, has no wpk_fork_* continuation exports, has no legacy Asyncify marker, and embeds no rejected host workspace path.

Revision and dependency review

No Formula revision bump is needed. The new dependencies are native inspection tools, and the validator is read-only; this change does not alter or replace installed target bytes. Target runtime dependency closure is empty for both Formulae.

The retained evidence is bound to exact tap head e09da2c93659dc0226352c714544055a2315e4a1 and exact Kandelo #936 head 256cb8844a26468fbde2dd77d6f93f0828a35fc4:

• Bzip2 bottle: 76bb55dfeb3755f3c5952b4ae677a33944604bbf91d2528e105c2524127f675c
• XZ bottle: 393587a852a38021185a0b66c3eb10f08d85b720929be7e884134267da8d7832
• Future-stack XZ bottle: 6050eddcc2220099574adbfad65298751f7fa1751405147e02e87b0ad42c8304

I also compared the six synthetic future-stack commits with the current #913/#874/#883/#938 heads by stable patch ID; every pair is identical, so that proof remains current despite the cherry-picked commit IDs.

Validation reproduced

Run through Kandelo's scripts/dev-shell.sh where applicable:

• git diff --check
• Ruby syntax for both Formulae
• brew style for both Formulae: 2 files, no offenses
• Formula-support suite: 45 runs / 340 assertions
• exact Formula source-closure validation for Bzip2 and XZ
• declared target runtime-closure validation for Bzip2 and XZ: empty
• independent extraction and fail-closed inspection of all three distinct Wasm binaries and all five XZ aliases

Gates retained

This accepts the source change; it does not waive the PR's declared merge/publication gates. #936, #913, #874, #883, and #938 must land, and the canonical ABI 39 package index must be refreshed after main settles. If tap PR #106 lands first, this PR should be restacked and the exact source evidence rerun before merge.

[brandonpayton]

Independent devil's-advocate review: ACCEPT

No findings on the exact source reviewed:

• base: deb07626ce0078d578dd890712756373a4a4d5ce
• head: 3bd7156d775dd1347f114cf5db2f854678dfbcdb
• tree: c2115f7e355c61b98724043903433aa328fc491c
• stable patch ID: 350e04a2e9a0684804c96feb60ddd1b49f867dfd

The seven-line diff is complete and correctly placed:

• Bzip2's only distinct installed executable, bzip2, is validated after its final link and before installation.
• XZ's two distinct installed executables, xz and xzdec, are validated after the final build and before installation.
• XZ's five remaining command names are symlinks whose target is exactly xz.
• All three executables truthfully require fork: :forbidden.
• WABT and Binaryen are build-only inspection dependencies.
• No installed target bytes change, so no Formula revision or bottle metadata change is warranted.

The source-build evidence remains exact after the final peer-Formula restack: Bzip2 blob 1aa6995595d24f4dd698a4195f4932970f03ec16, XZ blob 0210cd45a64d098164b6fa18aa9e62c15e7caa3b, and Formula-support tree e9f4d1372824afa8e4ade31df0073e8d8c317e6a are identical between build head 04775b99f2ce01234617fc7f85e5956a9ef3394e and the exact final head.

Fresh source builds, all in-Formula guards, full Formula tests, independent archive inspection, source closures, syntax/style, 48/380 Ruby support assertions, and 15/15 TypeScript support tests passed as recorded in the PR body. The source tap was the clean detached /private/tmp/kandelo-pr126-build-tap; the conflicted shared /opt/homebrew/Library/Taps checkout was not used or modified.

This accepts source merge now. Automattic/kandelo#936, #913, #874, #883, #938, tap #22, tap #106, the final ABI 39 index refresh, and fresh exact-merged-head pour evidence remain authoritative bottle-publication gates only. The local validation archives are not publication artifacts.