contract.yml

# Copyright (c) 2026 [Ribose Inc](https://www.ribose.com).
# All rights reserved.
# This file is a part of tamatebako
#
# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that the following conditions
# are met:
# 1. Redistributions of source code must retain the above copyright
#    notice, this list of conditions and the following disclaimer.
# 2. Redistributions in binary form must reproduce the above copyright
#    notice, this list of conditions and the following disclaimer in the
#    documentation and/or other materials provided with the distribution.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
# ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
# TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDERS OR CONTRIBUTORS
# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
# POSSIBILITY OF SUCH DAMAGE.

# Bootstrap <-> runtime contract version: the versioned protocol between
# the tebako bootstrap (released from tamatebako/tebako) and the runtime
# images published from this repo — the env vars passed down, the argv
# layout, and the filesystem-image handoff. Modeled on
# tebako-runtime-ruby's contract.yml; the version -> semantics changelog
# table is spec 06's, the contract-2 grammar is spec 17's.
#
# This factory has NO contract-1 era: python runtimes exist only in the
# image era, so contract_version is 2 from the first publish (the schema
# floors it at 2 — contract 1 was the retired v1 C++ tebako-main.cpp
# grammar this factory never ships). Bump rules mirror the ruby
# factory's: any change to env/argv/handoff semantics bumps the integer
# by exactly +1, here and in the compiled-in TEBAKO_CONTRACT_VERSION, in
# the same commit — scripts/check_contract.rb locks the two (the
# driver-source parity arm lands with the first real build; today the
# check validates this file against the schema).
#
# Schema: schema/contract.schema.yml (validated by the same check).
---
contract_version: 2

# The toolchain CONTAINER line the POSIX legs run inside:
# ghcr.io/tamatebako/tpkg-builder-<triplet>:<container_version>, baked by
# tebako-ci-containers. This factory never references the archived v1
# tebako-<platform> images. "v1" is the moving family tag; the first real
# build PR pins per-leg digests (the builder publish workflow prints
# them — consumers pin by digest, tebako-ci-containers README). Windows
# and macOS legs are runner-native — no tpkg-builder images exist for
# them (the documented exception, not a gap).
container_version: "v1"

# The published link-unit pin: the tamatebako/tebako release whose
# prebuilt link unit (the spec-17 driver + scoped tfs + the native
# closure, per triplet) the legs CONSUME as a download instead of
# building from source. The closure depends on the triplet and the
# product release only — never on the python version. An empty pin, a
# missing asset, or a checksum MISMATCH are all hard named errors —
# never a silent fallback (this factory has no source-build path for
# the driver stack; a supply-chain event is reported, not worked
# around).
#
# v2.3.2 is the current product line: the v2.3 arc (spec-30 spawn
# dispatch, shim routing + version management, the spec-29 wrapper-exe
# driver, the libtfs-preload dup-class interpose with the aarch64
# dup2 repair — tebako#534/#545) on top of v2.1.10's three boot fixes
# (tebako#524/#527/#529; contract unchanged at 2). Verified
# 2026-09-06 (the fully published release): v2.3.2 ships a unit for
# all seven legs — linux-gnu-{x86_64,arm64},
# linux-musl-{x86_64,arm64}, macos-{x86_64,arm64} and
# x86_64-windows-gnu. NEVER pin v2.3.1: it published partial (no
# linux-arm64 units) after the aarch64 SYS_dup2 compile break.
link_unit_release: "v2.3.2"

# The tamatebako/python SOURCE release this factory consumes
# (tfs-python-<version>-src[-<scenario>].tar.gz + SHA256SUMS,
# sha256-verified). v0.3.0 adds the platform-scenario axis: 3.14.7 ships
# tfs-python-3.14.7-src-windows-msys.tar.gz (the msys2/ucrt64 patch
# series) alongside the unsuffixed linux-gnu
# back-compat asset every version carries. v0.3.1 carries the
# MSYS2-MINGW-packages 0007 port (tamatebako/python#16): the checked-in
# PC/errmap.h needs -I$(srcdir)/PC on the msys build path, which
# upstream's Makefile grants MSVC only. v0.3.2 carries the MSYS2 sweep
# for the static ucrt64 shape (tamatebako/python#17): 18 more patches
# ported (0001 nt-threads, 0005 mingw configure defaults, 0008/0016/
# 0017/0036/0037/0041/0045/0054/0056/0059/0060/0063/0075/0078/0097/0100)
# plus the syslibs deviation — the round-2/3 compile+link walls
# (VPATH, thread_pthread, alarm//dev/ptmx probes, winconsoleio,
# version/pathcch libs). v0.3.3 carries the mingw shared-build
# machinery (tamatebako/python#18): 0009/0010 (declspec exports + the
# enable_shared mingw arms — LDLIBRARY=libpython3.14.dll.a /
# DLLLIBRARY=libpython3.14.dll), the dynload_win cluster (0011-0015 —
# the .cp314-mingw_x86_64_ucrt_gnu.pyd rename), the two interpreter
# boot walls the PR's own smoke leg forced (0018: winreg/msvcrt/
# _winapi bootstrap-static; 0034: sys.winver/dllhandle under
# defined(MS_WINDOWS) && defined(Py_ENABLE_SHARED)), 0066
# (_Py_CheckPython3), and 0039 (-municode + win resources +
# pythonw.exe). v0.3.4 carries the sysconfig posix-mode pair
# (tamatebako/python#19): 0003 (the sys._is_mingw flags) + 0020 (mingw
# builds take the posix sysconfig path) — the pybuilddir.txt wall the
# first --enable-shared leg hit (trp run 34748169561: KeyError 'LIBPL'
# — upstream's nt path never merges the Makefile-parsed
# build_time_vars); 0034's hunk 3 returns to MSYS2-verbatim context.
# v0.3.5 carries the module-libs cluster (tamatebako/python#20): 0061 +
# 0073 (_multiprocessing: the win32 enable condition, then -lws2_32),
# 0074 (select: _MSC_VER → MS_WIN32 guards + -lws2_32), and 0076
# (_ctypes: -lole32 -loleaut32 -luuid) — the shared-extension link
# wall the v0.3.4 leg hit (trp run 34750005177: __WSAFDIsSet/
# __imp_select/__imp_WSAGetLastError; PE resolves every symbol at link
# time and upstream's PY_STDLIB_MOD stanzas carry no per-module libs).
# v0.3.6 carries the mmap + legacy-DLL-loading trio
# (tamatebako/python#21): 0062 (mmap builds on win32 — its absence
# killed ensurepip in `make install`, trp run 34753278108: pip's
# vendored cachecontrol imports mmap), 0067
# (PYTHONLEGACYWINDOWSDLLLOADING — the bpo-36085 DEFAULT_DIRS search
# never consults PATH, so the build-tree check removed
# _decimal/_zstd/_testinternalcapi whose dep DLLs live in
# <ucrt64>/bin), and 0064 (have_dynamic_loading for the dlopen-gated
# test modules); 0076 returns to MSYS2-verbatim context.
# v0.2.0 (2026-09-05) added
# 3.11.16; the v0.1.0 set (3.12.14, 3.13.15, 3.14.7) carried forward
# sha256-verified. A build leg fails closed while this is empty.
source_release: "v0.3.6"

# The python version catalog this factory builds and publishes. Mirrors
# tamatebako/python's versions.yml at source release v0.3.6 (3.11.16,
# 3.12.14, 3.13.15, 3.14.7). The source factory owns the
# version PINS (url/sha256/line); this catalog selects which published
# versions the matrix grammar expands over — the same split as
# tamatebako/ruby's versions.yml vs tebako-runtime-ruby's
# .github/matrix.json; the catalog itself lives here next to the pins.
#
# Flavor lines (the x.y.z-jit suffix — grammar owned by
# PythonVersion::LINE_PATTERN): a build ability rides the RELEASE LINE,
# never a selector axis (spec 28 §8's truffleruby native/jvm precedent).
# A jit line builds the SAME pristine source with
# --enable-experimental-jit (PEP 744, 3.13+) and publishes as a sibling
# line: tebako-runtime-<tebako>-3.13.15-jit-<triplet>. The LLVM toolchain
# is a BUILD-TIME-only dependency (the JIT stencils are compiled into the
# exe; the shipped runtime gains no runtime system dependency —
# CPython's Tools/jit/README.md). tidy deliberately carries no jit line:
# the dogfood driver stays the plain 3.13.15. jit legs exist for
# linux-gnu + macos ONLY: CPython's JIT target whitelist
# (Tools/jit/_targets.py) rejects *-linux-musl upstream — the matrix
# engine skips the combination with a loud note (a musl enablement patch
# would belong to tamatebako/python, not this factory).
#
# Set grammar (tebako-runtime-ruby's semantics):
#   catalog — every version this factory publishes
#   full    — the tip of every supported line (jit lines included)
#   tidy    — the primary dogfood set (the xml2rfc driving line)
python:
  catalog: ["3.11.16", "3.12.14", "3.13.15", "3.14.7", "3.13.15-jit", "3.14.7-jit"]
  full: ["3.11.16", "3.12.14", "3.13.15", "3.14.7", "3.13.15-jit", "3.14.7-jit"]
  tidy: ["3.13.15"]