Version 3 of the box format: runtime seam, the wire break, and the node and native runtimes

.gitattributes

@@ -5,6 +5,14 @@
 # So: no conversion for anything a scroll can name. The example entry points are the files in this
 # repository that a scroll actually names; keep this list in step with `localFiles` if that changes.
 examples/**/entrypoint.py -text
+examples/**/entrypoint.js -text
+# Reference data a box ships and answers questions about. `codon-demo` pins its SHA-256, so a
+# checkout that rewrote its newlines would fail the build rather than ship different data.
+examples/**/codons.csv -text
+# `dataset-demo` ships a binary HDF5 file and pins its hash; `readings.txt` is the text it was
+# generated from, and a rewritten newline there would silently change what regeneration produces.
+examples/**/readings.h5 -text
+examples/**/readings.txt -text
 
 # Committed locks and licence inventories are compared byte for byte across platforms in CI.
 examples/**/pixi.lock -text

.github/workflows/demo-box.yml

@@ -92,7 +92,6 @@ jobs:
         run: |
           node src/cli.mjs build "$BOX_ID/${{ matrix.target }}" \
             --scrolls-dir examples \
-            --weights embed \
             --private-key "$RUNNER_TEMP/demo-signing-private.pem" \
             --public-key examples/keys/example-signing-public.json
 

.github/workflows/example-build.yml

@@ -102,7 +102,7 @@ jobs:
         run: node src/cli.mjs keygen
 
       - name: Build
-        run: node src/cli.mjs build hello-box/${{ matrix.target }} --scrolls-dir examples --weights embed
+        run: node src/cli.mjs build hello-box/${{ matrix.target }} --scrolls-dir examples
 
       # The check that matters: extract the box and import with the interpreter inside it.
       - name: Verify with self-test
@@ -132,23 +132,68 @@ jobs:
             console.log(`extracted ${mb(payload.installedSizeBytes)}`);
           ' "$release"
 
-      # Determinism is a promise the repository makes that nothing else verifies end to end. The
-      # archive is named by its own SHA-256, so a rebuild that differs lands beside the first rather
-      # than replacing it — the file count is the assertion.
+      # The other two runtimes, on the one target their example scrolls declare. They are the only
+      # thing in CI that builds a box with no interpreter, and a box whose interpreter is not
+      # Python — the paths where a Python assumption would hide, and where the unit suite's fake
+      # toolchain cannot follow. Each is built, verified with its own self-test, and run.
+      - name: Build, verify and run the node and native examples
+        if: matrix.target == 'macos-aarch64-metal'
+        shell: bash
+        run: |
+          set -euo pipefail
+          release_for() {
+            ls .scrollcase/dist/boxes/"$1"/1.0.0/${{ matrix.target }}/*.release.json
+          }
+
+          node src/cli.mjs build hello-box-node/${{ matrix.target }} --scrolls-dir examples
+          node src/cli.mjs verify "$(release_for hello-box-node)" --self-test
+          node src/cli.mjs run "$(release_for hello-box-node)"
+
+          node src/cli.mjs build hello-box-native/${{ matrix.target }} --scrolls-dir examples
+          node src/cli.mjs verify "$(release_for hello-box-native)" --self-test
+          node src/cli.mjs run "$(release_for hello-box-native)" -- --version
+
+          # A node box doing real work rather than proving it starts: reference data pinned by hash,
+          # queried through `node:sqlite`. It is the one example whose payload carries data the box
+          # is expected to answer questions about, so a wrong answer here is a build failure.
+          node src/cli.mjs build codon-demo/${{ matrix.target }} --scrolls-dir examples
+          node src/cli.mjs verify "$(release_for codon-demo)" --self-test
+          node src/cli.mjs run "$(release_for codon-demo)" -- Leucine
+
+          # The native counterpart: a large compiled program with a long tail of codec libraries,
+          # whose self-test runs a real encode rather than a version check. Slower than the rest of
+          # this job put together, and the only thing here that would catch a break in the one case
+          # `native` exists for.
+          node src/cli.mjs build transcode-demo/${{ matrix.target }} --scrolls-dir examples
+          node src/cli.mjs verify "$(release_for transcode-demo)" --self-test
+          node src/cli.mjs run "$(release_for transcode-demo)" -- -version
+
+          # The other native shape: small compiled tools reading a data file the box ships, rather
+          # than one large program driven by flags. Its self-test reads the shipped dataset both
+          # ways — structure and values — so a box whose data or reader stopped agreeing fails here.
+          node src/cli.mjs build dataset-demo/${{ matrix.target }} --scrolls-dir examples
+          node src/cli.mjs verify "$(release_for dataset-demo)" --self-test
+          node src/cli.mjs run "$(release_for dataset-demo)" -- -H readings.h5
+
+      # Determinism is a promise the repository makes that nothing else verifies end to end.
+      #
+      # The assertion is the archive's *name*, not the file count. The archive is named by its own
+      # SHA-256, but a build clears its own object directory before writing into it, so a rebuild
+      # replaces the first archive rather than landing beside it — counting the files afterwards
+      # always yields one and could never fail. Measured: changing the scroll's sourceRevision
+      # produced a completely different archive and left the count at one.
       - name: Rebuild and compare
         shell: bash
         run: |
+          set -euo pipefail
           dist=".scrollcase/dist/boxes/hello-box/1.0.0/${{ matrix.target }}"
-          before=$(ls "$dist"/*.zip | wc -l)
-          if [ "$before" -ne 1 ]; then
-            echo "Expected exactly one archive after the first build, found $before" >&2
-            exit 1
-          fi
-          node src/cli.mjs build hello-box/${{ matrix.target }} --scrolls-dir examples --weights embed
-          after=$(ls "$dist"/*.zip | wc -l)
-          if [ "$after" -ne 1 ]; then
-            echo "Rebuild was not byte-identical: $after distinct archives" >&2
-            ls -l "$dist" >&2
+          before=$(basename "$(ls "$dist"/*.zip)")
+          node src/cli.mjs build hello-box/${{ matrix.target }} --scrolls-dir examples
+          after=$(basename "$(ls "$dist"/*.zip)")
+          if [ "$before" != "$after" ]; then
+            echo "Rebuild was not byte-identical:" >&2
+            echo "  first  $before" >&2
+            echo "  second $after" >&2
             exit 1
           fi
-          echo "Rebuild produced a byte-identical archive."
+          echo "Rebuild produced a byte-identical archive: $after"

.github/workflows/llm-demo-box.yml

@@ -116,7 +116,6 @@ jobs:
           df -h . || true
           node src/cli.mjs build "$BOX_ID/${{ matrix.target }}" \
             --scrolls-dir examples \
-            --weights embed \
             --private-key "$RUNNER_TEMP/demo-signing-private.pem" \
             --public-key examples/keys/example-signing-public.json
 

.github/workflows/sentiment-demo-box.yml

@@ -107,7 +107,6 @@ jobs:
         run: |
           node src/cli.mjs build "$BOX_ID/${{ matrix.target }}" \
             --scrolls-dir examples \
-            --weights embed \
             --private-key "$RUNNER_TEMP/demo-signing-private.pem" \
             --public-key examples/keys/example-signing-public.json
 

.gitignore

@@ -156,6 +156,10 @@ vite.config.ts.timestamp-*
 # scrollcase build state
 .scrollcase/
 
+# `npm run types` stages a copy of src/ here before running tsc over it. One escaped into a commit
+# once, leaving a stale second copy of the contract in the tree.
+.scrollcase-runtime-types-*/
+
 # Python development and packaging state
 __pycache__/
 *.py[cod]