ncurses: enforce the final Wasm artifact contract

[brandonpayton]

Purpose

Make every executable shipped by the ncurses dependency root pass the tap's shared, fail-closed Wasm artifact validation before Homebrew installs it.

The tap contract already requires final linked programs to prove their Kandelo ABI, reject legacy Asyncify, and declare a coherent fork policy. Ncurses installed target programs without running that guard.

Change

• Declare Binaryen and WABT as build dependencies because the shared validator requires both toolsets.
• Validate the seven unique linked programs after the final make and before make install: clear, infocmp, tabs, tic, toe, tput, and tset.
• Require fork: :forbidden for each program.

The installed aliases do not need duplicate validation: captoinfo and infotocap point to tic, while reset points to tset. ncursesw6-config is a /bin/sh script, not Wasm.

This changes one Formula and does not change Kandelo's ABI. There is no Formula revision bump: the new dependencies are build-time inspection tools, and validation runs after the final links without modifying installed bytes.

Fork policy evidence

A prior exact ncurses source build and the fresh ABI 39 build both contain seven distinct Wasm modules. None imports kernel.kernel_fork, and none exports a fork-continuation surface. fork: :forbidden is therefore the explicit package contract rather than an :auto assumption.

All seven installed modules independently passed:

• ABI version exactly 39;
• no kernel.kernel_fork import;
• no fork-instrumentation exports;
• no legacy Asyncify.

Source merge status

The Formula source change can merge independently of bottle publication. It does not depend on tap #106, Automattic/kandelo#874, Automattic/kandelo#936, tap #22, or an already-published libcxx bottle. Those items affect later builds or publication, not whether this fail-closed validation belongs in the Formula.

The single commit was rebased onto exact tap main b39720ab6727a0eb6d2291339b59c82213440bb1. Current head is 7a2cba0e212e847eff9b04a28c5ef92d3ef56dc2; tree is 7b037f37cf0aa571141a827c284e3568b546d66b.

The reviewed Formula/ncurses.rb blob remains exactly 58dc8f9ae0447223e5845b70a0756dff18d52ee0, and the stable patch ID remains 409ba699fbeb8b3352436afc9796f716194f04d9.

Exact-head validation after the rebase:

• Ruby syntax: passed.
• Homebrew style: passed, one file inspected with no offenses.
• Shared Formula support: 48 runs, 380 assertions, no failures.
• #936 Formula source-closure validation: passed; the required direct runtime dependency is libcxx.
• git diff --check origin/main..HEAD: passed.
• Worktree: clean.

The earlier source build and full Formula test remain direct evidence for the unchanged Formula blob: all seven guards ran successfully, the complete ncurses test passed, and bottle creation reached SHA-256 a3f03324ae263e276e80ab7b0080e527a7c52c0deb42130decc4cb7e87337850.

Bottle publication gate

Merging this Formula source does not authorize publishing that local bottle. Final publication remains blocked until:

1. homebrew: publish and verify installable Kandelo bottles kandelo#936 merges and supplies the reviewed publisher implementation.
2. Tap ci: add thin tap workflows for bottle publishing and maintenance #22 merges only after its branch, workflow-permission, and reusable-workflow trust boundaries are enforced.
3. A current authoritative libcxx bottle is published and poured, rather than source-built.
4. sdk: centralize cross-compile function availability kandelo#874 should merge before the final ncurses build so the bottle consumes the authoritative SDK target facts and does not need an avoidable rebuild.
5. Ncurses is rebuilt from merged tap main with the poured libcxx receipt, then passes dependency provenance, handoff validation, public readback, and a final devil's-advocate review.

Tap #106 is not a dependency for the ncurses bottle. It affects Formulae that consume the SDK facts, including later ncurses consumers such as Nano.

The prior local builder correctly stopped after bottle creation because libcxx was source-built. No local bottle has been published, and no browser result is claimed by this source-only PR.

[brandonpayton]

Devil's-advocate review of exact head b852ca4f18ad787e0b98f3e148d605041dd37cd1: ACCEPT the source change; BLOCK merge until the declared external gates are satisfied.

• Scope is one commit and one Formula.
• The seven validated paths are the complete set of unique installed Wasm bytes. captoinfo/infotocap resolve to tic, reset resolves to tset, and the config programs are shell scripts.
• Fresh ABI 39 artifacts prove fork: :forbidden: every program lacks both kernel.kernel_fork and continuation exports; all reject legacy Asyncify.
• Binaryen and WABT are correctly build-scoped because validation runs during install; neither is part of the target runtime closure.
• Validation occurs after the final link and before make install, so there is no unguarded transform afterward.
• No revision bump is correct: the Formula adds inspection only and does not modify installed target bytes.

Fresh source build, all seven guards, the full Formula test, and bottle creation passed. The #936 builder then rejected the source-built libcxx receipt, as intended. This head is not merge-ready until #936 lands, an authoritative libcxx bottle is poured, and the exact build completes provenance/handoff plus final review. No local bottle may be published.

[brandonpayton]

Independent exact-head devil review at 7a2cba0e212e847eff9b04a28c5ef92d3ef56dc2: ACCEPT the source merge; no code findings. The seven guarded paths are the complete set of real target executables; the remaining installed command names are aliases or shell scripts. Validation runs after the final target link and before install, fork: :forbidden matches the proven non-spawning artifacts, WABT/Binaryen own the required inspection tools, and no revision or ABI bump is warranted because validation does not modify installed bytes. The source merge is independent of #874/#936/tap #22/libcxx publication; the PR body now tracks those separately as final bottle-publication gates. Exact-head rebase checks and patch/blob identity are recorded in the updated body.