ci(vold): trace pinned dependencies and probe a minimal original-vold source checkout

.github/workflows/ci.yml

@@ -102,6 +102,29 @@ jobs:
       - name: Test unmodified original vold CI-only baseline
         run: python3 tests/vold_baseline_ci_test.py
 
+      - name: Test actual Repo manifest selection and bounded build inputs
+        run: python3 tests/vold_original_build_test.py
+
+      - name: Test bounded original Vold source dependency resolver
+        run: python3 tests/vold_source_closure_test.py
+
+      - name: Test Sony vendor makefile-only regeneration guard
+        run: python3 tests/vold_vendor_makefiles_test.py
+
+      - name: Test original vold probe ordering and bounded expansion
+        run: python3 tests/vold_probe_orchestration_test.py
+
+      - name: Generate the provisional original vold source plan
+        run: python3 src/ci/vold_source_closure.py plan --output "${RUNNER_TEMP}/vold-source-plan.json"
+
+      - name: Retain the provisional original vold source plan
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: vold-source-provisional-plan
+          path: ${{ runner.temp }}/vold-source-plan.json
+          if-no-files-found: error
+          retention-days: 14
+
       - name: Test pdx235 Custota metadata preparation
         run: bash tests/pdx235_custota_metadata_test.sh
 

.github/workflows/vold-baseline.yml

@@ -4,6 +4,16 @@ name: Qualify original LineageOS pdx235 vold (no patch)
 # once this *baseline-only* workflow is merged to the default branch.
 on:
   workflow_dispatch:
+    inputs:
+      mode:
+        description: Static plan, source-only compile probe (not proof), or authenticated byte comparison
+        type: choice
+        required: true
+        default: plan
+        options:
+          - plan
+          - probe
+          - compare
 
 permissions:
   contents: read
@@ -13,7 +23,42 @@ concurrency:
   cancel-in-progress: false
 
 jobs:
+  dependency_plan:
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout immutable manifest and source probe
+        uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - name: Trace the initial pinned source selection
+        shell: bash
+        run: |
+          set -euo pipefail
+          python3 src/ci/vold_source_closure.py plan --output "${RUNNER_TEMP}/vold-source-plan.json"
+          python3 - <<'PY'
+          import json
+          import os
+          from pathlib import Path
+          info = json.loads((Path(os.environ["RUNNER_TEMP"]) / "vold-source-plan.json").read_text())
+          assert info["schema_version"] == 1
+          count = len(info["selected_projects"])
+          with Path(os.environ["GITHUB_STEP_SUMMARY"]).open("a") as summary:
+              summary.write(f"### Provisional vold source graph: {count}/1243 manifest projects\n")
+              summary.write("This is a source probe, **not** a complete Soong closure or a reproduced binary.\n")
+              summary.write("Sony vendor declarations cannot be regenerated from the public lists alone: the pinned generator reads proprietary ELF inputs.\n")
+          PY
+      - name: Upload static source dependency selection
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: vold-source-provisional-plan
+          path: ${{ runner.temp }}/vold-source-plan.json
+          retention-days: 14
+
   prerequisites:
+    needs: dependency_plan
+    if: inputs.mode != 'plan'
     runs-on: ubuntu-24.04
     permissions:
       contents: read
@@ -37,6 +82,7 @@ jobs:
           }
 
   unmodified_vold:
+    name: ${{ inputs.mode == 'probe' && 'Source compile probe — NOT QUALIFIED' || 'Authentic byte-for-byte original vold check' }}
     needs: prerequisites
     runs-on: [self-hosted, linux, x64, modos-lineage-large]
     timeout-minutes: 360
@@ -53,9 +99,15 @@ jobs:
 
       - name: Validate isolated host and reserve scratch workspace
         shell: bash
+        env:
+          BASELINE_MODE: ${{ inputs.mode }}
         run: |
           set -euo pipefail
-          for binary in repo avbroot curl unzip openssl sha256sum debugfs git python3 realpath; do
+          binaries=(repo git python3 realpath)
+          if [[ "$BASELINE_MODE" == compare ]]; then
+            binaries+=(avbroot curl unzip openssl sha256sum debugfs)
+          fi
+          for binary in "${binaries[@]}"; do
             command -v "$binary" >/dev/null || {
               echo "::error::Missing required executable: $binary"
               exit 1
@@ -68,15 +120,16 @@ jobs:
           }
           path="$(realpath -e -- "$path")"
           free="$(df -PB1 "$path" | awk 'END {print $4}')"
-          (( free >= 250000000000 )) || {
-            echo '::error::At least 250 GB free space is required before syncing the complete 1,243-project tree'
+          (( free >= 100000000000 )) || {
+            echo '::error::The subset probe requires at least 100 GB as a conservative starting allowance (not a proven maximum)'
             exit 1
           }
           workspace="$(mktemp -d "$path/modos-original-vold.XXXXXXXX")"
           echo "VOLD_SCRATCH=$path" >> "$GITHUB_ENV"
           echo "VOLD_WORK=$workspace" >> "$GITHUB_ENV"
 
       - name: Fetch only the immutable official October 16 source OTA
+        if: inputs.mode == 'compare'
         shell: bash
         run: |
           set -euo pipefail
@@ -96,45 +149,35 @@ jobs:
             --output "$VOLD_WORK/source.zip" "$url"
 
       - name: Authenticate official publisher and extract original vold
+        if: inputs.mode == 'compare'
         shell: bash
         run: |
           set -euo pipefail
           bash src/ci/extract_original_vold.sh "$VOLD_WORK/source.zip" "$VOLD_WORK/reference"
 
-      - name: Synchronize the exact 1,243-project original manifest
-        shell: bash
-        run: |
-          set -euo pipefail
-          python3 src/ci/build_original_vold.py sync \
-            --source-root "$VOLD_WORK/source" --jobs 4
 
-      - name: Build unmodified vold and require byte-exact equality
+      - name: Probe missing project dependencies and compare original when selected
         shell: bash
+        env:
+          VOLD_PROBE_STAGE: ${{ inputs.mode }}
+          VOLD_PROBE_JOBS: '4'
         run: |
           set -euo pipefail
-          python3 src/ci/build_original_vold.py compare \
-            --source-root "$VOLD_WORK/source" \
-            --reference-vold "$VOLD_WORK/reference/original-vold" \
-            --output-dir "$VOLD_WORK/baseline" --jobs 4
-          python3 - <<'PY'
-          import json
-          import os
-          from pathlib import Path
-          p = Path(os.environ['VOLD_WORK']) / 'baseline' / 'baseline-report.json'
-          data = json.loads(p.read_text())
-          assert data['byte_identical'] is True
-          with Path(os.environ['GITHUB_STEP_SUMMARY']).open('a') as report:
-              report.write('## Unmodified vold reproduced byte-for-byte\n')
-              report.write(f"Source OTA SHA-256: `{data['official_ota_sha256']}`\n\n")
-              report.write(f"Original vold SHA-256: `{data['reference_sha256']}`\n")
-          PY
+          export VOLD_SOURCE_REF="${VOLD_WORK}/reference/original-vold"
+          bash src/ci/probe_original_vold.sh
 
-      - name: Retain small comparison receipt only
+      - name: Upload only small dependency diagnostics or comparison receipt
         if: always() && env.VOLD_WORK != ''
         uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
-          name: original-pdx235-vold-reproducibility-report
-          path: ${{ env.VOLD_WORK }}/baseline/baseline-report.json
+          name: vold-probe-${{ inputs.mode }}-diagnostics
+          path: |
+            ${{ env.VOLD_WORK }}/baseline-*/baseline-report.json
+            ${{ env.VOLD_WORK }}/source-selection.json
+            ${{ env.VOLD_WORK }}/sony-vendor-input-report.json
+            ${{ env.VOLD_WORK }}/source-index-*.json
+            ${{ env.VOLD_WORK }}/dependency-diagnosis-*.json
+            ${{ env.VOLD_WORK }}/probe-only.txt
           if-no-files-found: warn
           retention-days: 14
 

docs/evidence/vold-build-setup-review-20261022.json

@@ -0,0 +1,36 @@
+{
+  "schema_version": 1,
+  "kind": "pinned-lineage-build-setup-source-review",
+  "date_utc": "2026-10-22",
+  "source_evidence": [
+    "https://github.com/LineageOS/android_build/blob/73e37454cdac3892c961e554524ccc52b1bfcf00/envsetup.sh",
+    "https://github.com/LineageOS/android_vendor_lineage/blob/87daf527b0288b60c9cc07c05a5f5aad1660c234/build/envsetup.sh",
+    "https://github.com/LineageOS/android_vendor_lineage/blob/87daf527b0288b60c9cc07c05a5f5aad1660c234/build/tools/roomservice.py",
+    "https://github.com/LineageOS/android_vendor_lineage/blob/87daf527b0288b60c9cc07c05a5f5aad1660c234/vars/aosp_target_release"
+  ],
+  "findings": [
+    "The pinned lunch function requires product, release and variant; its legacy syntax rejects lineage_pdx235-userdebug because the release component is absent",
+    "The pinned LineageOS breakfast helper reads vars/aosp_target_release; that exact file selects cp2a",
+    "The pinned lunch function invokes roomservice for dependency discovery; roomservice can synchronize projects not selected by the bounded probe",
+    "The unchanged _lunch_meat function performs product/release/variant configuration without roomservice",
+    "The pinned envsetup reads optional unset variables, so bash nounset is incompatible with sourcing it unchanged"
+  ],
+  "reviewed_configuration": {
+    "product": "lineage_pdx235",
+    "release": "cp2a",
+    "variant": "userdebug",
+    "precheck": "check_product lineage_pdx235 cp2a",
+    "setup": "_lunch_meat lineage_pdx235 cp2a userdebug",
+    "build_target": "m vold",
+    "release_file_sha256": "258eaaeb1fc743ee5fd3a0ade38905be3bbfe3d2624d7fd477dd966a68d67eb6",
+    "automatic_kernel_builds": "fail before kernel synchronization or compilation",
+    "source_files_modified": false
+  },
+  "validation": {
+    "tests": "tests/vold_original_build_test.py",
+    "actual_bash_failure_guards_tested": ["upstream setup failure", "automatic kernel-build request"],
+    "source_workspace_checked_after_successful_build": true,
+    "android_compilation_attempted": false,
+    "byte_identity_established": false
+  }
+}

docs/evidence/vold-repo-integration-20261022.json

@@ -0,0 +1,37 @@
+{
+  "schema_version": 1,
+  "kind": "local-repo-manifest-and-subset-sync-integration",
+  "date_utc": "2026-10-22",
+  "repo_tool": {
+    "source": "https://github.com/GerritCodeReview/git-repo",
+    "revision": "d744eb15f38b9351463900babffd732994e3a046",
+    "manifest_selection_source": "https://github.com/GerritCodeReview/git-repo/blob/d744eb15f38b9351463900babffd732994e3a046/manifest_xml.py"
+  },
+  "fixture": {
+    "project_source": "Two tiny local Git repositories and a local manifest repository, all created for this integration check",
+    "project_paths": ["system/vold", "system/update_engine"],
+    "manifest_revisions": "Immutable commit SHAs generated by the local fixture",
+    "repo_launcher": "Official main.py executed against the fixture .repo directory; .repo/repo links to the recorded tool checkout",
+    "android_sources_downloaded": false,
+    "android_compilation_attempted": false
+  },
+  "verified_steps": [
+    "First actual repo init selects the fixture default.xml at the fixture manifest commit",
+    "The builder installs the flattened manifest into .repo/manifests/modos-vold-original-20261016.xml",
+    "Second actual repo init -m modos-vold-original-20261016.xml succeeds and writes the modern include wrapper",
+    "verify_active_manifest accepts the actual wrapper and byte-identical included manifest",
+    "repo sync --no-clone-bundle -j1 system/vold succeeds and system/update_engine remains absent",
+    "Resuming with both selected paths issues only repo sync --no-clone-bundle -j1 system/update_engine",
+    "Resuming the unchanged two-project selection issues no repo sync",
+    "Real Git HEAD and clean-worktree verification pass for each checked-out fixture project"
+  ],
+  "observed_sync_commands": [
+    ["sync", "--no-clone-bundle", "-j1", "system/vold"],
+    ["sync", "--no-clone-bundle", "-j1", "system/update_engine"]
+  ],
+  "limitations": [
+    "The first sync attempt was blocked before project checkout by the execution sandbox's local multiprocessing-socket restriction; the same fixture was resumed outside that sandbox restriction",
+    "The local tool wrapper emitted a repo-tool refresh warning; both recorded project sync commands completed with exit status zero",
+    "This verifies Repo selection and incremental synchronization behavior only. It is not Android source-closure, vendor-provenance, binary-equality, or device-qualification evidence"
+  ]
+}

docs/evidence/vold-vendor-preflight-20261022.json

@@ -0,0 +1,43 @@
+{
+  "byte_identical_vold_qualified": false,
+  "command": [
+    "python3",
+    "-B",
+    "device/sony/pdx235/extract-files.py",
+    "--regenerate_makefiles"
+  ],
+  "date": "2026-10-22",
+  "environment": {
+    "PYTHONDONTWRITEBYTECODE": "1",
+    "PYTHONPATH": "tools/extract-utils"
+  },
+  "exit_status": 1,
+  "input_sha256": {
+    "device/sony/pdx235/extract-files.py": "440af4750e0496627003295606935d3a534f2e758ab42adacd3d5da6e255f0e0",
+    "device/sony/pdx235/proprietary-files.txt": "93da9a7ac7957afde23ac9c59425947a29b410d01fd5b1fcde2efb5ec155855f",
+    "device/sony/sm6375-common/extract-files.py": "266ac34e070a5755d513979ad74196b4341c363915b0cfaa24e51d4bf49d6ec8",
+    "device/sony/sm6375-common/proprietary-files.txt": "8056cdd324881ba179fbac2553e77ddc0d1456ade7ef1e37f9630bb5f6c39a29",
+    "tools/extract-utils/extract_utils/elf.py": "58d3a6db079185d94e2d283211f73fa71f32bb882618ac47b0feb6d2f5e01d31",
+    "tools/extract-utils/extract_utils/main.py": "3470e7a43a9788f2699c13d627750b7f5fdc448bf364a48a3a7c86f2b931562d",
+    "tools/extract-utils/extract_utils/makefiles.py": "2a550851c75a2a32d4d294338df3e73f7d95b4418721653224565d27ba6fa111",
+    "tools/extract-utils/extract_utils/module.py": "1d1f77c66e05a3f3fea1e710caca7842c38c11b76c1a7bb486724826e72f73ef"
+  },
+  "kind": "sony-vendor-regeneration-public-source-replay",
+  "original_scripts_modified": false,
+  "partial_outputs": [
+    "vendor/sony/pdx235/Android.bp",
+    "vendor/sony/pdx235/Android.mk",
+    "vendor/sony/pdx235/BoardConfigVendor.mk",
+    "vendor/sony/pdx235/pdx235-vendor.mk"
+  ],
+  "proprietary_binaries_present": false,
+  "public_source_revisions": {
+    "LineageOS/android_device_sony_pdx235": "0559de69466e1e9af69b121985f592c4f4609283",
+    "LineageOS/android_device_sony_sm6375-common": "d1d80af1ad9032cb092ff6d85db437709cc54e28",
+    "LineageOS/android_tools_extract-utils": "ff6589c6b0a4a00c592e98940e9e6b6a50c76569"
+  },
+  "python_version": "Python 3.12.14",
+  "schema_version": 1,
+  "stderr": "Traceback (most recent call last):\n  File \"device/sony/pdx235/extract-files.py\", line 63, in <module>\n    utils.run()\n  File \"tools/extract-utils/extract_utils/main.py\", line 219, in run\n    self.write_makefiles()\n  File \"tools/extract-utils/extract_utils/main.py\", line 160, in write_makefiles\n    module.write_makefiles(\n  File \"tools/extract-utils/extract_utils/module.py\", line 738, in write_makefiles\n    proprietary_file.write_makefiles(self, ctx)\n  File \"tools/extract-utils/extract_utils/module.py\", line 215, in write_makefiles\n    write_product_packages(\n  File \"tools/extract-utils/extract_utils/makefiles.py\", line 683, in write_product_packages\n    w(write_lib_package, lib64_tree, packages_ctx)\n  File \"tools/extract-utils/extract_utils/makefiles.py\", line 626, in w\n    return write_packages_group(\n           ^^^^^^^^^^^^^^^^^^^^^\n  File \"tools/extract-utils/extract_utils/makefiles.py\", line 565, in write_packages_group\n    package_name = fn(file, builder, *args, **kwargs)\n                   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\n  File \"tools/extract-utils/extract_utils/makefiles.py\", line 382, in write_lib_package\n    return write_elfs_package(\n           ^^^^^^^^^^^^^^^^^^^\n  File \"tools/extract-utils/extract_utils/makefiles.py\", line 266, in write_elfs_package\n    machine, bits, libs = get_file_machine_bits_libs(f_path, gen_deps)\n                          ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\n  File \"tools/extract-utils/extract_utils/elf.py\", line 43, in get_file_machine_bits_libs\n    with open(file_path, 'rb') as f:\n         ^^^^^^^^^^^^^^^^^^^^^\nFileNotFoundError: [Errno 2] No such file or directory: 'vendor/sony/pdx235/proprietary/vendor/lib64/camera/com.qti.eeprom.hi846_back_eeprom.so'\n",
+  "stdout": "Parsing device/sony/pdx235/proprietary-files.txt\nParsing device/sony/sm6375-common/proprietary-files.txt\n"
+}