feat(release): rc tagger gates on fleet cells before tagging + #4314 salvage (Refs #4327)

contracts/apr-version-traceability-v1.yaml

@@ -1,11 +1,12 @@
 metadata:
-  version: 1.1.0
+  version: 1.2.0
   created: '2026-04-05'
   author: PAIML Engineering
   description: "apr --version traceability contract — the version output must always contain an informative build identifier; never the bare '(unknown)' sentinel when a CARGO_PKG_VERSION or any alternative identifier is available; AND the embedded git SHA must match the actual HEAD of the source tree at build time (including in git worktrees)"
   references:
     - "paiml/aprender#597 (Version string shows (unknown) instead of git hash)"
     - "paiml/aprender#1862 (build.rs misses HEAD changes in worktrees because ../../.git is a file pointer, not a directory)"
+    - "paiml/aprender#4110 (crates.io installs print +no-git although the tarball's .cargo_vcs_info.json carries the commit)"
   registry: true
   tags:
     - cli
@@ -36,11 +37,13 @@ equations:
       - "Common sentinel forms are forbidden: (unknown), 0000000, <empty>, null"
 
   fallback_hierarchy:
-    formula: "APR_GIT_SHA = override ∨ git_hash ∨ committed_sha ∨ 'v{version}+no-git'"
+    formula: "APR_GIT_SHA = override ∨ vcs_info_sha ∨ git_hash ∨ committed_sha ∨ 'v{version}+no-git'"
     domain: "build-time environment"
     codomain: "APR_GIT_SHA environment variable"
     invariants:
       - "Env var APR_GIT_SHA_OVERRIDE, if set, wins (for CI/release)"
+      - "Otherwise: read git.sha1 from the package's .cargo_vcs_info.json (written by cargo package into every published crate), short 9-hex form, -dirty suffix when cargo recorded a dirty tree; a value that is not 40 hex is ignored (#4110)"
+      - "The vcs rung precedes git rev-parse: an unpacked crate may sit inside an UNRELATED repository whose HEAD is not the crate's commit"
       - "Otherwise: try git rev-parse --short HEAD"
       - "Otherwise: try reading crates/apr-cli/.git-sha committed file"
       - "Otherwise: emit 'v{CARGO_PKG_VERSION}+no-git' as informative fallback"
@@ -89,6 +92,11 @@ falsification_tests:
     prediction: "When built without git context, apr --version output contains the package version string"
     test: "apr --version 2>&1 | grep -qE '0\\.[1-9][0-9]*\\.[0-9]+'"
     if_fails: "Version string missing entirely"
+  - id: FALSIFY-VERSION-005
+    rule: "a packaged apr-cli (no .git of its own) names the commit in its .cargo_vcs_info.json, even inside a foreign repository"
+    prediction: "The shipped build.rs, compiled and run as cargo runs it on a package dir holding the byte-exact apr-cli-0.69.1 vcs file, emits APR_GIT_SHA=d8a6df53a; inside an unrelated repo it still does; with the vcs rung removed or placed behind git rev-parse the table goes RED"
+    test: "cargo test -p apr-cli --lib build_rs_vcs_sha"
+    if_fails: "crates.io installs regress to '+no-git' (0.68.1/0.69.1 shape), or report an enclosing repository's HEAD"
   - id: FALSIFY-VERSION-004
     rule: "build.rs registers worktree-aware rerun-if-changed triggers"
     prediction: "build.rs invokes `git rev-parse --git-dir` and `--git-common-dir` (not a hardcoded `../../.git/HEAD` path)"

crates/apr-cli/build.rs

@@ -1,9 +1,14 @@
 // Contract: apr-version-traceability-v1 F-VERSION-001..004 (paiml/aprender#597, #1862).
 // Resolve APR_GIT_SHA with a multi-source fallback hierarchy:
 //   1. APR_GIT_SHA_OVERRIDE env var (CI/release hook)
-//   2. git rev-parse --short HEAD (dev builds from worktree or primary checkout)
-//   3. committed .git-sha file (crates.io installs)
-//   4. "v{CARGO_PKG_VERSION}+no-git" (informative fallback — never bare "unknown")
+//   2. .cargo_vcs_info.json `git.sha1` — written by `cargo package` into every published
+//      tarball, so a crates.io install knows its commit (#4110). Ahead of `git rev-parse`
+//      because an unpacked crate may sit inside SOME OTHER repository whose HEAD is not ours
+//   3. git rev-parse --short HEAD (dev builds from worktree or primary checkout; retried with
+//      the enclosing checkout marked safe.directory when git refuses a checkout owned by another
+//      user — binary-release.yml builds as root in a container over the runner's checkout)
+//   4. committed .git-sha file
+//   5. "v{CARGO_PKG_VERSION}+no-git" (informative fallback — never bare "unknown")
 fn main() {
     let sha = resolve_git_sha();
     println!("cargo:rustc-env=APR_GIT_SHA={sha}");
@@ -16,6 +21,7 @@ fn main() {
 
     println!("cargo:rerun-if-env-changed=APR_GIT_SHA_OVERRIDE");
     println!("cargo:rerun-if-changed=.git-sha");
+    println!("cargo:rerun-if-changed=.cargo_vcs_info.json");
 }
 
 fn register_git_rerun_triggers() {
@@ -58,20 +64,78 @@ fn resolve_git_sha() -> String {
         }
     }
 
-    // 2. Live git hash from worktree (works for both primary checkouts and worktrees)
-    if let Some(sha) = run_git(&["rev-parse", "--short", "HEAD"]) {
+    // 2. The commit `cargo package` recorded (crates.io / packaged builds, no .git)
+    if let Some(sha) = vcs_info_sha() {
         return sha;
     }
 
-    // 3. Committed .git-sha fallback (updated by release script at publish time)
+    // 3. Live git hash from worktree (works for both primary checkouts and worktrees).
+    //    `trusted_git_retry`: the release binaries are built as root in a container over the
+    //    runner-owned checkout, where git refuses the repo as "dubious ownership" (#4110)
+    let head = ["rev-parse", "--short", "HEAD"];
+    if let Some(sha) = run_git(&head).or_else(|| trusted_git_retry(&head)) {
+        return sha;
+    }
+
+    // 4. Committed .git-sha fallback (updated by release script at publish time)
     if let Ok(contents) = std::fs::read_to_string(".git-sha") {
         let s = contents.trim().to_string();
         if !s.is_empty() {
             return s;
         }
     }
 
-    // 4. Informative fallback — never bare "unknown"
+    // 5. Informative fallback — never bare "unknown"
     let version = std::env::var("CARGO_PKG_VERSION").unwrap_or_else(|_| "0.0.0".to_string());
     format!("v{version}+no-git")
 }
+
+/// `git.sha1` from `.cargo_vcs_info.json`, shortened to 9 hex digits (what `git rev-parse
+/// --short` prints in this repository), with `-dirty` when cargo packaged a dirty tree.
+/// Parsed by hand: a build script has no serde, and the file is cargo's own fixed shape.
+fn vcs_info_sha() -> Option<String> {
+    let dir = std::env::var("CARGO_MANIFEST_DIR").unwrap_or_else(|_| ".".to_string());
+    let text = std::fs::read_to_string(format!("{dir}/.cargo_vcs_info.json")).ok()?;
+    let after = &text[text.find("\"sha1\"")? + "\"sha1\"".len()..];
+    let open = after.find('"')?;
+    let value = &after[open + 1..];
+    let sha = &value[..value.find('"')?];
+    if sha.len() != 40 || !sha.bytes().all(|b| b.is_ascii_hexdigit()) {
+        return None;
+    }
+    let dirty = text.contains("\"dirty\": true") || text.contains("\"dirty\":true");
+    Some(format!(
+        "{}{}",
+        &sha[..9],
+        if dirty { "-dirty" } else { "" }
+    ))
+}
+
+/// `git <args>` again, with the checkout that encloses this package marked `safe.directory`.
+///
+/// git refuses a repository owned by another user ("detected dubious ownership"), and the release
+/// lane builds as root in a container over the runner-owned checkout, so every published binary
+/// printed `+no-git` (#4110). The exception goes in a private GLOBAL config under OUT_DIR:
+/// git ignores `safe.directory` given by `-c` or GIT_CONFIG_* before 2.39 (measured, 2.34.1).
+/// Only the checkout found by walking up from CARGO_MANIFEST_DIR is trusted, never `*`, and
+/// `rev-parse` runs no hooks. This build is already compiling that checkout's code.
+fn trusted_git_retry(args: &[&str]) -> Option<String> {
+    let manifest = std::env::var("CARGO_MANIFEST_DIR").ok()?;
+    let top = std::path::Path::new(&manifest)
+        .ancestors()
+        .find(|d| d.join(".git").exists())?;
+    let config =
+        std::path::Path::new(&std::env::var("OUT_DIR").ok()?).join("apr-safe-directory.gitconfig");
+    std::fs::write(
+        &config,
+        format!("[safe]\n\tdirectory = {}\n", top.display()),
+    )
+    .ok()?;
+    let out = std::process::Command::new("git")
+        .args(args)
+        .env("GIT_CONFIG_GLOBAL", &config)
+        .output()
+        .ok()?;
+    let s = String::from_utf8_lossy(&out.stdout).trim().to_string();
+    (out.status.success() && !s.is_empty()).then_some(s)
+}

crates/apr-cli/src/build_rs_vcs_sha_tests.rs

@@ -0,0 +1,221 @@
+//! #4110 — a crates.io install of apr names its commit, never `+no-git`.
+//!
+//! The 0.69.1 post-publish install printed `apr 0.69.1 (v0.69.1+no-git)` (0.68.1 did too) although
+//! the published tarball carried the commit: `cargo package` writes `.cargo_vcs_info.json` into
+//! every crate. These tests compile the SHIPPED `build.rs` with rustc and run it the way cargo runs a
+//! build script (CARGO_MANIFEST_DIR, CARGO_PKG_VERSION, cwd = the package dir) in a temp package
+//! dir with no `.git` of ours above it. The vcs file is byte-exact from the real apr-cli-0.69.1 crate.
+//! The release binaries printed `+no-git` too: binary-release.yml builds as root in a container over
+//! the runner-owned checkout, and git refuses it ("dubious ownership"); row `foreign-owner`.
+//! `planted_regressions_turn_red` re-runs the table on three planted copies of `build.rs` — the vcs
+//! rung removed (the pre-#4110 script), the vcs rung behind `git rev-parse`, and the safe.directory
+//! retry removed — and requires each to fail, so the table cannot pass vacuously.
+
+use std::path::{Path, PathBuf};
+use std::process::Command;
+
+const BUILD_RS: &str = include_str!("../build.rs");
+const VCS_CALL: &str = "    if let Some(sha) = vcs_info_sha() {";
+
+/// Byte-exact `.cargo_vcs_info.json` of apr-cli-0.69.1 as downloaded from crates.io.
+const VCS_REAL: &str = "{\n  \"git\": {\n    \"sha1\": \"d8a6df53a6c7104ef4eabfd2284908f93f1d6a3f\"\n  },\n  \"path_in_vcs\": \"crates/apr-cli\"\n}";
+const VCS_DIRTY: &str = "{\n  \"git\": {\n    \"sha1\": \"d8a6df53a6c7104ef4eabfd2284908f93f1d6a3f\",\n    \"dirty\": true\n  },\n  \"path_in_vcs\": \"crates/apr-cli\"\n}";
+const VCS_BAD: &str =
+    "{\n  \"git\": {\n    \"sha1\": \"not-a-sha\"\n  },\n  \"path_in_vcs\": \"crates/apr-cli\"\n}";
+
+fn compile(source: &str, dir: &Path, name: &str) -> PathBuf {
+    let src = dir.join(format!("{name}.rs"));
+    let bin = dir.join(name);
+    std::fs::write(&src, source).expect("write build.rs copy");
+    let rustc = std::env::var("RUSTC").unwrap_or_else(|_| "rustc".to_string());
+    let out = Command::new(rustc)
+        .args([
+            "--edition",
+            "2021",
+            "--crate-name",
+            "build_script_build",
+            "-o",
+        ])
+        .arg(&bin)
+        .arg(&src)
+        .output()
+        .expect("rustc must be runnable: this test compiles the shipped build.rs");
+    assert!(
+        out.status.success(),
+        "rustc rejected {name}: {}",
+        String::from_utf8_lossy(&out.stderr)
+    );
+    bin
+}
+
+fn git(dir: &Path, args: &[&str]) -> String {
+    let out = Command::new("git")
+        .args([
+            "-c",
+            "core.hooksPath=/dev/null",
+            "-c",
+            "user.email=f@x",
+            "-c",
+            "user.name=f",
+        ])
+        .args(args)
+        .current_dir(dir)
+        .output()
+        .expect("git must be runnable");
+    assert!(
+        out.status.success(),
+        "git {args:?}: {}",
+        String::from_utf8_lossy(&out.stderr)
+    );
+    String::from_utf8_lossy(&out.stdout).trim().to_string()
+}
+
+/// A fresh package dir under `root`; the vcs file written when given; optionally its own repo.
+fn package(root: &Path, name: &str, vcs: Option<&str>) -> PathBuf {
+    let dir = root.join(name);
+    std::fs::create_dir_all(&dir).expect("mkdir package");
+    if let Some(v) = vcs {
+        std::fs::write(dir.join(".cargo_vcs_info.json"), v).expect("write vcs file");
+    }
+    dir
+}
+
+/// Runs the compiled build script like cargo does; returns the APR_GIT_SHA it emits.
+/// `ceiling` stops git's upward search there (None: search freely, as a real install would).
+fn run(bin: &Path, pkg: &Path, ceiling: Option<&Path>, env: &[(&str, &str)]) -> String {
+    let out_dir = pkg.join("target-out");
+    std::fs::create_dir_all(&out_dir).expect("mkdir OUT_DIR");
+    let mut cmd = Command::new(bin);
+    cmd.current_dir(pkg)
+        .env("CARGO_MANIFEST_DIR", pkg)
+        .env("OUT_DIR", &out_dir)
+        .env("CARGO_PKG_VERSION", "9.9.9")
+        .env_remove("APR_GIT_SHA_OVERRIDE")
+        .env_remove("GIT_DIR")
+        .env_remove("GIT_WORK_TREE")
+        .env(
+            "GIT_CEILING_DIRECTORIES",
+            ceiling.unwrap_or_else(|| Path::new("/nonexistent")),
+        )
+        .envs(env.iter().copied());
+    let out = cmd.output().expect("run build script");
+    String::from_utf8_lossy(&out.stdout)
+        .lines()
+        .find_map(|l| l.strip_prefix("cargo:rustc-env=APR_GIT_SHA="))
+        .unwrap_or("<none>")
+        .to_string()
+}
+
+/// The case table. Returns the names of the rows that landed wrong (empty = all as expected).
+fn table(build_rs: &str, label: &str) -> Vec<String> {
+    let tmp = tempfile::tempdir().expect("tempdir");
+    let root = tmp.path();
+    let bin = compile(build_rs, root, label);
+    let mut wrong = Vec::new();
+    let mut expect = |row: &str, got: String, want: &str| {
+        if got != want {
+            wrong.push(format!("{row}: got {got:?}, want {want:?}"));
+        }
+    };
+    let pkgs = root.join("pkgs");
+    let p = package(&pkgs, "packaged", Some(VCS_REAL));
+    expect("packaged", run(&bin, &p, Some(&pkgs), &[]), "d8a6df53a");
+    // an unrelated repository ABOVE the unpacked crate, with a commit, and no ceiling between them
+    let foreign = package(&pkgs, "foreign", None);
+    git(&foreign, &["init", "-q"]);
+    git(
+        &foreign,
+        &["commit", "-q", "--allow-empty", "-m", "foreign"],
+    );
+    let p = package(&foreign, "crate", Some(VCS_REAL));
+    expect("foreign-repo", run(&bin, &p, None, &[]), "d8a6df53a");
+    let p = package(&pkgs, "dirty", Some(VCS_DIRTY));
+    expect("dirty", run(&bin, &p, Some(&pkgs), &[]), "d8a6df53a-dirty");
+    let p = package(&pkgs, "malformed", Some(VCS_BAD));
+    expect(
+        "malformed",
+        run(&bin, &p, Some(&pkgs), &[]),
+        "v9.9.9+no-git",
+    );
+    let p = package(&pkgs, "no-vcs", None);
+    expect("no-vcs", run(&bin, &p, Some(&pkgs), &[]), "v9.9.9+no-git");
+    let p = package(&pkgs, "override", Some(VCS_REAL));
+    expect(
+        "override",
+        run(
+            &bin,
+            &p,
+            Some(&pkgs),
+            &[("APR_GIT_SHA_OVERRIDE", "release123")],
+        ),
+        "release123",
+    );
+    // a dev checkout: no vcs file, its own repo -> `git rev-parse --short HEAD` (worktree freshness)
+    let dev = package(&pkgs, "dev", None);
+    git(&dev, &["init", "-q"]);
+    git(&dev, &["commit", "-q", "--allow-empty", "-m", "dev"]);
+    let head = git(&dev, &["rev-parse", "--short", "HEAD"]);
+    expect("dev-checkout", run(&bin, &dev, None, &[]), &head);
+    // the release lane: root in a container over the runner-owned checkout. git's own test knob
+    // makes it see another owner; the precondition proves plain git really refuses the repo here
+    let other_owner = [("GIT_TEST_ASSUME_DIFFERENT_OWNER", "1")];
+    let refused = Command::new("git")
+        .args(["rev-parse", "HEAD"])
+        .current_dir(&dev)
+        .envs(other_owner)
+        .output();
+    assert!(
+        !refused.expect("git").status.success(),
+        "cannot simulate a checkout owned by another user: this git ignores GIT_TEST_ASSUME_DIFFERENT_OWNER"
+    );
+    expect("foreign-owner", run(&bin, &dev, None, &other_owner), &head);
+    wrong
+}
+
+#[test]
+fn packaged_build_rs_names_its_commit() {
+    let wrong = table(BUILD_RS, "shipped");
+    assert!(
+        wrong.is_empty(),
+        "shipped build.rs rows landed wrong: {wrong:#?}"
+    );
+}
+
+#[test]
+fn planted_regressions_turn_red() {
+    assert_eq!(
+        BUILD_RS.matches(VCS_CALL).count(),
+        1,
+        "the vcs rung call site moved; re-anchor the plants"
+    );
+    let no_rung = BUILD_RS.replace(VCS_CALL, "    if let Some(sha) = None::<String> {");
+    let git_first = BUILD_RS.replace(
+        VCS_CALL,
+        "    if let Some(sha) = run_git(&[\"rev-parse\", \"--short\", \"HEAD\"]).or_else(vcs_info_sha) {",
+    );
+    let w1 = table(&no_rung, "plant_no_rung");
+    assert!(
+        w1.iter().any(|r| r.starts_with("packaged:")),
+        "no-vcs-rung plant survived: {w1:#?}"
+    );
+    let retry = "run_git(&head).or_else(|| trusted_git_retry(&head))";
+    assert_eq!(
+        BUILD_RS.matches(retry).count(),
+        1,
+        "the git retry call site moved; re-anchor the plant"
+    );
+    let w3 = table(&BUILD_RS.replace(retry, "run_git(&head)"), "plant_no_retry");
+    assert!(
+        w3.iter().any(|r| r.starts_with("foreign-owner:")),
+        "no-retry plant survived: {w3:#?}"
+    );
+    let w2 = table(&git_first, "plant_git_first");
+    assert!(
+        w2.iter().any(|r| r.starts_with("foreign-repo:")),
+        "git-first plant survived: {w2:#?}"
+    );
+    assert!(
+        !w2.iter().any(|r| r.starts_with("packaged:")),
+        "git-first plant should still pass packaged: {w2:#?}"
+    );
+}