ci: pin soul build to vendored release runtime v1.0.0-20260501

Browse Source

The soul build downloaded el-runtime-c 'latest' from Artifact Registry. The
merged ship-soul calls engram_prune_telemetry, which the latest published
runtime no longer defines, so an unpinned build fails to link — the failure
mode that let a broken/handlerless soul reach prod.

Vendor the release runtime v1.0.0-20260501 (el_runtime.c/.h) into the repo and
compile the soul against it. This is the exact runtime the merged soul was
verified against (verify-soul-contract GATE PASS, genesis boot survives, full
safety-contact response), making the build reproducible and independent of a
moving AR 'latest'.

The verify-soul-contract.sh HARD-BLOCK gate already runs before Publish (from
the CI-hardening arc on main), so a destructive or stale soul can never
publish/deploy again.

...

This commit is contained in:

Will Anderson

2026-07-21 15:52:14 -05:00

committed by will.anderson

parent 2c2aaa0653

commit eed6487114

4 changed files with 12330 additions and 34 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download Patch File Download Diff File Expand all files Collapse all files

vendor/el-runtime/v1.0.0-20260501/el_runtime.c

Vendored

+11509

File diff suppressed because it is too large Load Diff