bedrock roots tranche 2: zero foreign replace_on_cycle slots on both arches

[bryan-minimal]

Summary

Repoints the last 17 foreign prebuilt slots (replace_on_cycle) at artifacts built by the hex0-rooted bootstrap ladder. After this merges, no prebuilt on either arch comes from anywhere but our own ladder.

	packages
amd64 (12)	bash-bootstrap, bison, coreutils, diffutils, file, findutils, gawk-bootstrap, grep, m4, make, sed, tar
arm64 (5)	bison, diffutils, file, findutils, m4

Same mechanism as #631: every hunk is a url + sha256 swap plus a 4-line provenance comment, generated by update-bedrock-roots.py from the manifest in gominimal/minimermetic#98. No hand edits. 12 files, +102 / −34.

What to look at

1. Each hunk is the same shape. packages/bison/build.ncl shows both arches; the other 11 are one or two copies of it.
2. coreutils and sed are amd64 build-time executors. After this merges, every amd64 build.sh runs on ladder-built coreutils 9.11 and sed 4.10 instead of the foreign 9.9 / 4.9. Expect a cold round and byte-identity drift downstream, same as the bedrock roots: repoint the 42-row manifest slots at hex0-rooted artifacts #631 executor flip on arm64.
3. Versions only go up. 8 slot/arch pairs upgrade, 7 unchanged, 0 downgrades:
   • amd64: coreutils 9.9→9.11, sed 4.9→4.10, m4 1.4.20→1.4.21, file 5.46→5.48, findutils 4.10.0→4.11.0, gawk 5.3.2→5.4.1
   • arm64: file 5.46→5.48, findutils 4.10.0→4.11.0
4. Files lost vs the foreign tarballs. Compared member by member. Only gawk-bootstrap (amd64) drops anything: usr/bin/gawk-5.3.2, usr/bin/gawkbug, usr/etc/profile.d/gawk.{sh,csh}. Nothing in the tree consumes them (gawk's own recipe already deletes gawkbug). The arm64 five lose nothing.

Verify a slot yourself (no credentials, ~10 seconds)

URL=<url from the diff>; SHA=<sha256 from the diff>
curl -s "https://storage.googleapis.com/${URL#gs://}" | shasum -a 256   # must print $SHA

How the artifacts were sealed

Each was built twice from cold on separate VMs from pkgs bryan/tranche2-bedrock-variants @ 1562eab6, and the pairs compared byte for byte:

arch	verdict	date	log
amd64	T2S_ALL_SEALED n=12	2026-09-12	gs://minimalmertic-debug-output/rung-pair/t2-seal-20260912T065623Z-amd/
arm64	T2S_ALL_SEALED n=5	2026-09-12	gs://minimalmertic-debug-output/rung-pair/t2-seal-20260912T044404Z-arm/

Publish to staging: 2026-09-25, 17/17 preflight and 17/17 sha readback. Copies of the seal verdicts, compare logs and publish log are in minimermetic#98 under docs/tranche2/seal-evidence/.

As with #631, tarballs only. No .intoto envelopes: there is no aarch64 Confidential Space, and this set is sealed by byte identity rather than attested.

The 17 artifacts (sha256, bytes)

Path: gs://minimal-staging-archives/prebuilts/bedrock/sha256/<sha>/stage0-<pkg>-{amd-x86_64,arm-aarch64}.tar.zst

pkg	arch	sha256	bytes
bash-bootstrap	amd64	91773ea69595d55da81bea80031ab0c550475292cbb47fc929a515cb4e0cb1ce	1829719
bison	amd64	e131fa2e001d518be7afea3b3d4690a52a63a34a7b1264d2dd27b1b9a90ceb96	754730
bison	arm64	fb6b49db2a329390fd56890248164670f300f0ae8c231d260fbc40268fc40bf3	743104
coreutils	amd64	210ec67122a89479fc67dbc6dc744287a0f42cfdee6b888f39a7f2a72e701de5	3107260
diffutils	amd64	4df877219bf42d64cde70b561a846560486e8c90545155831001a7e8569b0ce2	355285
diffutils	arm64	1c96a9ca39c49425c9db568fce3eb703805341d884fdc02b8b8f2015f981fe9d	354382
file	amd64	6a038986ad61344d8ab343d878509b689f5c3234eabb2cfa72652a379c07a48c	458952
file	arm64	a6f92ee3fd7091ed03c8525eaa3bcbada3d4f3d83853ee436e4e10f1d229d012	458826
findutils	amd64	f6f35466213d8c0432614a46b4c2827e1ddf531ea316ded0b44ec8f2a14ab6ce	537471
findutils	arm64	0e5ca2adcedc9c949859438103cae0635ab7714363626fd6e4e06b58a59bc0d8	535448
gawk-bootstrap	amd64	f5789cd747e9cf71a44be65f1bc45649b7349553fbd6233e56f8403996453e85	1388762
grep	amd64	a74a9e2fd59c2ea1fe5754ebebdd55bbd65dcbd4a2427a6878f9e2ac71174629	232678
m4	amd64	fcd2408d7c45d11f0ab9b9c63261814e2882f9ba9cafc0ebcc8006810575cf4d	286660
m4	arm64	7281618383241388a86632d589d1a72acc54a78c2751d618e9eeb3be2af62e72	283564
make	amd64	5d003ab688603c1e30e14dc29b6dc2ae0f6e9732a5525e2ccd0ea246b5dc25b5	496072
sed	amd64	c49d44a30c484e907686faf38ac7a08abfc3cc3c91fd1ef5e961032b092910bb	253566
tar	amd64	6aabccf01c40348e91319cf05867e4657829a0a4dd6e1e04e83572b3afc40a93	789427

The ladder behind every artifact

hex0 → kaem → mes/mescc → tcc → musl → binutils-2.30 → gcc-4.7.x → gcc-10.4.0
  → gcc-15.2.0 → binutils-2.41 + glibc-2.42 → gcc-15.2.0-glibc → each package above

Seed: 229 bytes on amd64, 526 bytes on aarch64. Full provenance and evidence: gominimal/minimermetic#16.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Build Updates
  • Updated prebuilt sources for several core command-line tools to use Bedrock bootstrap artifacts, with matching checksums.
  • Both Amd64 and Arm64 sources were updated where available; unchanged architecture sources remain as before.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: gominimal/pkgs/.coderabbit.yaml

Review profile: CHILL

Plan: Essentials

Run ID: de494a34-6115-4f63-ba86-937f832afb67

📥 Commits

Reviewing files that changed from the base of the PR and between 4228eb9 and 42c1486.

📒 Files selected for processing (12)

• packages/bash-bootstrap/build.ncl
• packages/bison/build.ncl
• packages/coreutils/build.ncl
• packages/diffutils/build.ncl
• packages/file/build.ncl
• packages/findutils/build.ncl
• packages/gawk-bootstrap/build.ncl
• packages/grep/build.ncl
• packages/m4/build.ncl
• packages/make/build.ncl
• packages/sed/build.ncl
• packages/tar/build.ncl

Included review availability: This review used your included allowance. 0 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

---

📝 Walkthrough

Walkthrough

Twelve package manifests now use Bedrock stage0 archives and matching SHA-256 values for selected prebuilt sources. The updates cover Amd64 and, for some packages, Arm64 artifacts. Existing architecture selection and extraction settings remain unchanged where described.

Changes

Bedrock stage0 artifact updates

Layer / File(s)	Summary
Update prebuilt sources packages/{bash-bootstrap,bison,coreutils,diffutils,file,findutils,gawk-bootstrap,grep,m4,make,sed,tar}/build.ncl	The manifests use Bedrock stage0 archive URLs and matching SHA-256 values for selected architecture-specific prebuilts. Comments identify artifact provenance and update sources. Architecture selection and extraction settings remain unchanged where described.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Other

Possibly related PRs

• gominimal/pkgs#631: Replaces other cycle-replacement prebuilts with artifacts from the Bedrock bootstrap ladder, continuing the same manifest migration.

Suggested reviewers: twitchyliquid64

Merge Risk: ⚪ Minimal · up to 41780

No actionable issue is established in the manifest updates. Mergeability remains subject to normal artifact validation.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: tranche 2 replaces foreign cycle-replacement slots with Bedrock-rooted artifacts on both architectures.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

_{Comment @coderabbitai help to get the list of available commands.}

[bryan-minimal]

Companion (manifest rows + flip tool + seal/publish evidence): gominimal/minimermetic#98