Build: enforce owned local dependencies and offline builds

[chrisbbreuer]

Parent: #459

Goal

Enforce a zero-unowned-production-dependency policy: zig-js may depend only on Zig's standard library/toolchain and owner-maintained sibling repositories resolved locally under ~/Code/**.

The engine dependencies already use local ../zig-regex and ../zig-gc. Documentation deliberately uses the owner-maintained BunPress ecosystem from ../../Tools/bunpress; defects and missing capabilities belong in those source repositories rather than in replacement code inside zig-js.

Required policy

• Classify every external edge as exactly one of: Zig/compiler toolchain; standard platform SDK/runtime interface; owner-maintained local build/runtime dependency; explicit checksum-pinned test/conformance/benchmark oracle; generated-data acquisition input; or prohibited/unclassified. The classification states whether it can affect shipped semantics.
• Production Zig package dependencies are an explicit allowlist of owner-maintained local paths; initially ../zig-regex and ../zig-gc.
• Owner-maintained tools and libraries under ~/Code/Tools and ~/Code/Libraries remain dependencies and are improved at their source. Do not replace them merely to reduce dependency count.
• No unowned network dependency resolution, vendored third-party runtime/library, C/C++ engine, opaque binary, or system JavaScript engine may enter the library or its normal build.
• Platform SDK/runtime APIs required to expose a platform feature (for example Foundation/Objective-C on macOS) are declared separately from portable engine dependencies and must not provide JavaScript semantics.
• System JavaScriptCore and external standards corpora remain differential/conformance/benchmark oracles only, behind explicitly named non-library targets.
• Generators must consume checked-in, checksum-pinned inputs or explicit one-shot acquisition commands; ordinary builds and tests do not fetch the network.
• CI sibling checkouts use exact owner-maintained revisions and the same local-path graph as development.
• Repository Python and semantic shell implementation tools migrate under Tooling: consolidate durable repository tools in TypeScript on Home #497. JavaScript/TypeScript tools that are part of an owner-maintained package remain in that package and are improved there; unowned registry/runtime/bootstrap edges still require an explicit pin and classification.
• WABT, wasm-tools, upstream engines, and standards corpora may remain explicit pinned test/benchmark oracles, but never enter the normal package graph, shipped library, ordinary offline build, or source of runtime semantics.

Audit

• Scan build.zig.zon, Zig imports, link directives, C/Objective-C includes, package manifests, scripts, subprocesses, dynamic loading, and generated-file provenance.
• Fail on an unclassified dependency edge or network access from a normal build/test/docs command.
• Produce a machine-readable inventory with owner, purpose, scope, local path, pin, license, and whether it can affect runtime semantics.

Acceptance

• A CI gate rejects any unapproved dependency/link/fetch edge.
• The normal library build succeeds with network disabled and only owner-maintained sibling checkouts present.
• libffi removal is completed in ObjC: replace libffi with an owned native ABI dispatcher #463.
• BunPress is consumed and improved as an exact owner-maintained local dependency in Docs: consume and improve owned BunPress tooling locally #464.
• Repository Python/semantic-shell gates, generators, audits, and publication tools migrate under Tooling: consolidate durable repository tools in TypeScript on Home #497 without deleting owner-maintained packages.
• README, build.zig.zon, and developer docs state the exact policy without claiming that test-only standards inputs are production dependencies.
• No compatibility shim or fallback weakens a feature merely to avoid implementing its owned replacement.
• Toolchain, owner-maintained dependency, platform SDK, test oracle, acquisition input, and shipped dependency boundaries are machine-readable and fail on ambiguity.

Foundation

The local-path dependency graph is established in build.zig.zon; the engine/JSC separation is documented in README and enforced by the separate comparison executables.

[chrisbbreuer]

Landed the independently actionable #462 foundation in 6adf47fe.

Implemented:

• versioned machine-readable classification for production, platform, oracle, acquisition, tooling, manifest, and CI edges, including runtime-semantics rulings;
• a Zig-native fail-closed audit covering local package paths, module imports, framework/system links, build subprocesses, tracked manifests and lock evidence, script/runtime counts, network-capable scripts, submodule gitlinks, CI actions, exact corpus revisions, download checksums, and dynamic/network production-source edges;
• a required CI leg and exact CI revisions for zig-regex and zig-gc at the same local sibling paths used by developers;
• the documented ownership and change policy.

Verification: live audit passes; a deliberate unclassified link is rejected; normal zig build passes under a macOS deny-network sandbox; docs links and the 49-page site build pass.

Keeping #462 open: libffi removal (#463), docs-chain replacement (#464), and Python/JS/shell plus legacy acquisition/CI-bootstrap migration (#497) remain explicit migration_required violations. They are gated and visible, not exemptions or workarounds.

[chrisbbreuer]

Child #463 implementation is now on main in 63ccdb26: the libffi edge and all include/link/call references are gone, replaced by the owned Zig plus Darwin AArch64/x86-64 dispatcher. The #462 inventory now has 14 active/classified edges and 6 migration_required groups; libffi is no longer one of them.

#463 remains open only for its quiet AC-powered performance gate. #462 still remains open for #464 and #497.

[chrisbbreuer]

Dependency migration update: #464 is complete in 418b51ef. The BunPress/npm docs chain and Bun CI bootstrap are gone. Docs now build and preview offline through the in-tree Zig tool, with 49 pages / 128 assets / 183 deterministic outputs covered by a checked tree hash. The dependency audit now reports 13 classified edges and 4 migration targets (down from 6). #462 remains open for the remaining owned-dependency migrations, including #497.

[chrisbbreuer]

Policy correction and owned-docs progress landed in cc4ba5ff. BunPress is owner-maintained and is now classified as an allowed exact local dependency, not a prohibited third-party chain. Its source improvements are linked from #464.

The audit now uses the general owner_maintained_local class, ties the local package resolution to the exact stacksjs/bunpress CI checkout revision, and reports 14 classified edges / 5 remaining migration targets. #462 remains open for the remaining bootstrap, transitive-resolution, and #497 work.

[chrisbbreuer]

The owned docs boundary advanced in zig-js 56ba547 and BunPress dd82b741f1f1a789c2f0d51635574adb354888b8. The BunPress runtime dependency declarations and lock are now complete, renderer failures fail closed, deterministic output is checked, and zig-js records the exact upstream revision in the machine-readable inventory. #464 remains open until owned companion-library source resolution is local/pinned end to end; #497 still owns the repository implementation-tool migrations.