Context
PR #176 currently writes and validates the Symbian toolchain receipt in three parallel implementations: the container setup script, the container doctor script, and the host-side TypeScript validator. The same area also repeats SHA-256 helpers and shell guard blocks. A future field or validation change can silently invalidate caches or make the host and image disagree.
The network-disabled linux/amd64 container intentionally has no Bun, so the solution must preserve the documented shell exception rather than assuming one runtime everywhere.
Acceptance criteria
- Define one versioned receipt field contract and validation semantics.
- Make the setup writer, container doctor, and host TypeScript validator consume generated data or fixtures from that contract.
- Add parity fixtures covering valid receipts, missing or changed fields, digest mismatch, and schema-version invalidation.
- Consolidate repeated Bun SHA-256 helpers and container shell guard fragments where the execution boundary permits.
- Preserve
--network=none, implementation-digest handshakes, cache invalidation, and secret redaction.
Context
PR #176 currently writes and validates the Symbian toolchain receipt in three parallel implementations: the container setup script, the container doctor script, and the host-side TypeScript validator. The same area also repeats SHA-256 helpers and shell guard blocks. A future field or validation change can silently invalidate caches or make the host and image disagree.
The network-disabled linux/amd64 container intentionally has no Bun, so the solution must preserve the documented shell exception rather than assuming one runtime everywhere.
Acceptance criteria
--network=none, implementation-digest handshakes, cache invalidation, and secret redaction.