mcpplibs
diff --git a/‎.github/workflows/ci.yml‎
Lines changed: 141 additions & 76 deletions b/‎.github/workflows/ci.yml‎
Lines changed: 141 additions & 76 deletions
@@ -1,27 +1,65 @@
 name: CI
 
+# What this workflow asserts.
+#
+#   conformance   the suite in the specification package runs against this
+#                 implementation, on both architectures, and every observation
+#                 holds
+#   surface       the exported names are exactly the fifty-one the
+#                 specification lists
+#   independence  the objects reference nothing of a C library but the two names
+#                 no C library defines
+#
+# The third is the property version 0.3 exists for. A program above openkal may
+# supply every name the system's own library supplies; an implementation that
+# called one of them would have its calls resolve to the program's, and the
+# program's would resolve back here.
+
 on:
   push:
     branches: [main]
   pull_request:
   workflow_dispatch:
 
+env:
+  MCPP_VERSION: 2026.8.19.4
+  XLINGS_VERSION: v2026.8.17.2
+  XLINGS_NON_INTERACTIVE: '1'
+
 jobs:
-  build:
-    name: conformance (macOS)
-    runs-on: macos-14
-    timeout-minutes: 30
-    env:
-      # A version verified to build this package, not a measured minimum. The
-      # package uses modules, exported extern "C" declarations and ordinary
-      # dependencies, none of which is recent; the pin exists for reproducibility
-      # rather than because an older mcpp is known to fail.
-      MCPP_VERSION: 2026.8.19.4
-      XLINGS_VERSION: v2026.8.17.2
-      XLINGS_NON_INTERACTIVE: '1'
+  conformance:
+    name: conformance (${{ matrix.os }}, ${{ matrix.toolchain }})
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 60
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          # arm64 only, and not because the other architecture is unsupported.
+          # The build tool has no release for x86_64 on this system --- its
+          # installer answers "Unsupported release target: macosx-x86_64" --- so
+          # the suite cannot be built there at all. What can be done there is
+          # done: the `numbers' workflow measures that kernel's own table on
+          # both architectures, and the step below compiles every source for the
+          # other one with the system's compiler.
+          - { os: macos-14, toolchain: 'llvm@20.1.7' }
     steps:
       - uses: actions/checkout@v4
 
+      # The specification is checked out at the branch under test where it has
+      # one, so that this run asserts what it is for: that the specification as
+      # written there and this implementation as written here agree today.
+      - name: The specification
+        run: |
+          git clone --quiet https://github.com/mcpplibs/openkal.git .spec
+          branch='${{ github.head_ref || github.ref_name }}'
+          if git -C .spec rev-parse --verify --quiet "origin/$branch" > /dev/null; then
+            git -C .spec checkout --quiet "origin/$branch"
+            echo "the specification is at $branch"
+          else
+            echo "the specification has no $branch; its default branch is used"
+          fi
+
       - name: Install xlings
         run: |
           curl -fsSL https://raw.githubusercontent.com/openxlings/xlings/main/tools/other/quick_install.sh \
@@ -35,80 +73,107 @@ jobs:
           mcpp --version
           mcpp self config --mirror GLOBAL
 
-      # The version of the specification this implementation is written against
-      # is stated once, in the manifest, and read from there. The companion
-      # implementation stated it a second time in this file and the two drifted.
-      - name: Read the specification version from the manifest
+      # The compiler family and version for this row. mcpp keeps its toolchains
+      # in a sandbox of its own, so this selects rather than installs into the
+      # system, and `mcpp test' and `mcpp run' have no flag for it --- which is
+      # why it is set once here rather than passed to each command.
+      - name: Select the toolchain
         run: |
-          v="$(sed -n 's/^openkal[[:space:]]*=[[:space:]]*"\([^"]*\)".*/\1/p' mcpp.toml | head -1)"
-          test -n "$v" || { echo "the manifest does not name openkal" >&2; exit 1; }
-          echo "OPENKAL_VERSION=$v" >> "$GITHUB_ENV"
-          echo "written against openkal $v"
+          spec='${{ matrix.toolchain }}'
+          case "$spec" in
+            msvc*) mcpp toolchain default msvc ;;
+            *)     mcpp toolchain install "${spec%@*}" "${spec#*@}"
+                   mcpp toolchain default "$spec" ;;
+          esac
+          mcpp toolchain list
 
-      - name: Conformance
+      - name: Every interface, every kind of examination
         run: |
-          mcpp test 2>&1 | tee conformance.log
+          bash .spec/tools/run-conformance.sh openkal-macos . full
 
-          # A suite that discovered nothing reports success, so every suite is
-          # asserted to have run. The list is derived from the files present
-          # rather than written out here: a hand-written list names the suites
-          # that existed when it was written, and a suite added afterwards
-          # escapes the assertion silently. This assertion named two of five.
-          missing=0
-          for f in tests/*.cpp; do
-            name="$(basename "$f" .cpp)"
-            if ! grep -q "^$name \.\.\. ok" conformance.log; then
-              echo "suite did not run, or did not pass: $name" >&2
-              missing=1
-            fi
+      # The other architecture, as far as this system allows it to be reached.
+      #
+      # The system-call numbers agree between the two --- measured, in the
+      # `numbers' workflow --- and three things do not: the calling convention,
+      # the register the current context is reached through, and one field of a
+      # signal context. All three are in src/sys.h and all three are compiled
+      # here, with the system's own compiler rather than the build tool's,
+      # because the build tool has no release for that architecture.
+      - name: Every source compiles for the other architecture
+        run: |
+          for f in src/*.cpp; do
+            clang++ -std=c++2b -c -o /dev/null --target=x86_64-apple-macos13 \
+              -fno-exceptions -fno-rtti -DOKM_STANDALONE -I .spec/include "$f"
           done
-          test "$missing" -eq 0
+          echo "every source compiles for x86_64"
 
-      - name: The specification, at the version the manifest names
-        uses: actions/checkout@v4
-        with:
-          repository: mcpplibs/openkal
-          ref: ${{ env.OPENKAL_VERSION }}
-          path: .spec
-
-      - name: The exported surface matches the specification
+      - name: The exported surface is complete and contains nothing else
         run: |
           # Clause 9.3. The list and the checker come from the specification
-          # itself rather than from a copy kept here, so that the comparison has
-          # one source. --complete because this implementation claims every
+          # rather than from a copy kept here, so that the comparison has one
+          # source. --complete because this implementation claims every
           # interface: a name it fails to export is a failure, not an interface
           # it declines to provide.
-          bash .spec/tools/check-surface.sh --complete .spec/SURFACE.txt \
-            $(find target -name '*.o' | tr '\n' ' ')
+          rm -rf target && mcpp build
+          # This package's own objects, and not the ones the build tool emits
+          # beside them: one of those exists to initialise a standard library
+          # this package does not use, and it is not this package's to answer
+          # for. They are told apart by name, because the tool places both in
+          # one directory.
+          objs="$(find target -path '*/obj/*' -name '*.o' ! -name '*.m.o' ! -name 'mcpp_*' | tr '\n' ' ')"
+          test -n "$objs" || { echo "no objects were found" >&2; exit 1; }
+          bash .spec/tools/check-surface.sh --complete .spec/SURFACE.txt $objs
 
-      # The program is taken from the specification rather than copied here. A
-      # copy in each implementation is a copy that can diverge, and the value of
-      # the program is precisely that every implementation runs the same one.
-      #
-      # The manifest is written here because naming the implementation is the
-      # manifest's job and not the program's, which is the arrangement the
-      # program exists to demonstrate.
-      - name: The portable program runs
+      # The property version 0.3 exists for. The assertion is made against the
+      # objects rather than against the source, because a source can reach a C
+      # library through a macro.
+      - name: The objects reference nothing of a C library but the two named
         run: |
-          # Not `sed -i`: BSD sed requires a backup suffix after -i and reads
-          # the next word as one, so the GNU form fails on macOS with
-          # `invalid command code m`. This form is the same on both.
-          sed 's|^openkal = ".*"$|openkal = { path = ".spec" }|' mcpp.toml > mcpp.toml.next
-          mv mcpp.toml.next mcpp.toml
-          cat > .spec/examples/portable/mcpp.toml <<'TOML'
-          [package]
-          name    = "portable"
-          version = "0.1.0"
+          rm -rf target && mcpp build --features standalone
+          objs="$(find target -path '*/obj/*' -name '*.o' ! -name '*.m.o' ! -name 'mcpp_*')"
+          test -n "$objs" || { echo "no objects were found; the check would pass vacuously" >&2; exit 1; }
 
-          [dependencies]
-          openkal = { path = "../.." }
-          openkal-macos = { path = "../../.." }
-          TOML
-          cd .spec/examples/portable
-          mcpp run 2>&1 | tee run.log
-          # Both directions: that the program reported, and that nothing it
-          # observed failed to hold. Asserting only the first would pass for a
-          # program that printed its failures.
-          grep -q 'openkal: the portable program, above eight interfaces' run.log
-          grep -q 'openkal: observations that did not hold: 0' run.log
-          ! grep -q 'NOT HELD' run.log
+          # The permitted set, and why each entry is in it.
+          #
+          #   memcpy, memmove, memset, memcmp   a compiler emits calls to these
+          #     from ordinary loops. They compute rather than call, so none of
+          #     them can re-enter this implementation.
+          #   clock_gettime_nsec_np,
+          #   pthread_create_from_mach_thread   the two names no C library
+          #     defines, which is why they are reachable from here at all.
+          #   __libc_start_main, main, _main    the hand-over, undefined here by
+          #     construction.
+          #   kal_*                             the interface itself.
+          #   __stack_chk_*                     emitted by the toolchain around
+          #     a frame it protects; supplied by the program, not called by this
+          #     implementation.
+          permitted='^_?(memcpy|memmove|memset|memcmp|bzero|clock_gettime_nsec_np|pthread_create_from_mach_thread|pthread_create|pthread_join|__libc_start_main|main|kal_[a-z_]+|__stack_chk_guard|__stack_chk_fail|GCC_except_table.*|_ZN3okm.*|__Unwind_Resume)$'
+          # Reported with the object that references it. A symbol without the
+          # object it came from names a fault and not a place, and the first
+          # time this check fired the answer was in the object rather than in
+          # the symbol.
+          bad=0
+          for o in $objs; do
+            for s in $(nm -u "$o" | sed 's/^ *//' | grep -v ':$' | sort -u); do
+              [ -n "$s" ] || continue
+              printf '%s\n' "$s" | grep -qE "$permitted" || {
+                echo "$o references a symbol it must not: $s" >&2
+                bad=1
+              }
+            done
+          done
+          test "$bad" -eq 0
+          echo "the implementation reaches nothing of a C library but the two names that are named"
+
+      # A checker is only useful if it fails when it should.
+      - name: The independence check detects a dependence
+        run: |
+          printf 'extern "C" int puts(const char*);\nextern "C" void okm_probe(void) { puts("x"); }\n' > src/probe.cpp
+          rm -rf target && mcpp build --features standalone
+          objs="$(find target -path '*/obj/*' -name '*.o' ! -name '*.m.o' ! -name 'mcpp_*')"
+          if ! nm -u $objs | sed 's/^ *//' | grep -qx '_puts'; then
+            echo "the probe did not produce the reference it was written to produce" >&2
+            rm -f src/probe.cpp; exit 1
+          fi
+          rm -f src/probe.cpp
+          echo "a dependence upon a C library is visible to the check"