ci: verify and refresh embedded WASI provenance

.github/workflows/ci.yml

@@ -82,9 +82,30 @@ jobs:
       - name: Build deterministic Rust fixture
         run: cargo build --locked --bin cyberagent-analyzer-fixture
       - name: Build embedded WASI analyzer fixture
+        working-directory: .
+        run: ./scripts/build-embedded-wasi.sh
+      - name: Verify rebuilt WASI matches the embedded product module
+        id: verify-wasi
+        working-directory: .
+        env:
+          REBUILT_WASI_FIXTURE: ${{ github.workspace }}/analyzers/target/wasm32-wasip1/release/cyberagent-analyzer-fixture.wasm
+          EMBEDDED_WASI_FIXTURE: ${{ github.workspace }}/internal/analyzer/embedded/cyberagent-analyzer-fixture.wasm
         run: |
-          rustup target add wasm32-wasip1 --toolchain 1.97.1
-          cargo +1.97.1 build --locked --target wasm32-wasip1 --package cyberagent-analyzer-fixture --release
+          if ! cmp --silent "$REBUILT_WASI_FIXTURE" "$EMBEDDED_WASI_FIXTURE"; then
+            echo "The Rust fixture and the product-embedded WASI module differ."
+            sha256sum "$REBUILT_WASI_FIXTURE" "$EMBEDDED_WASI_FIXTURE"
+            echo "Run ./scripts/build-embedded-wasi.sh and replace internal/analyzer/embedded/cyberagent-analyzer-fixture.wasm."
+            exit 1
+          fi
+          sha256sum "$EMBEDDED_WASI_FIXTURE"
+      - name: Preserve a mismatched rebuilt WASI module
+        if: failure() && steps.verify-wasi.outcome == 'failure'
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: rebuilt-wasi-fixture
+          path: analyzers/target/wasm32-wasip1/release/cyberagent-analyzer-fixture.wasm
+          if-no-files-found: error
+          retention-days: 1
       - name: Verify embedded WASI import and memory boundaries
         working-directory: .
         env:

analyzers/README.md

@@ -51,10 +51,15 @@ Set-Location analyzers
 cargo fmt --all -- --check
 cargo test --locked
 cargo clippy --locked --all-targets -- -D warnings
-rustup target add wasm32-wasip1 --toolchain 1.97.1
-cargo +1.97.1 build --locked --target wasm32-wasip1 --package cyberagent-analyzer-fixture --release
+Set-Location ..
+bash ./scripts/build-embedded-wasi.sh
 ```
 
+构建脚本固定 Linux x86_64 与 Rust 1.97.1，并在编译前把 checkout 与 Cargo registry 路径映射为
+稳定虚拟路径。其他宿主会明确拒绝发布构建；不要用裸 Cargo release 命令替代它，否则 WASI 会
+嵌入宿主路径或宿主相关 crate identity，导致二进制摘要漂移。CI 漂移检查会短期保存 canonical
+重建件，供维护者复核并更新内嵌模块。
+
 ## English
 
 This directory contains deterministic Rust analyzers behind a Go-owned protocol. Rust is
@@ -88,3 +93,10 @@ schema v95 atomically records redacted execution, metadata-summary Artifact,
 and Run events. CLI, control-token HTTP, and Desktop/React expose only the fixed
 digest analyzer under explicit Go confirmation. Rust still owns no Agent,
 authorization, Run lifecycle, credential, or persistence behavior.
+
+Build the product fixture from the repository root on Linux x86_64 with
+`bash ./scripts/build-embedded-wasi.sh`. The script pins Rust 1.97.1 and remaps
+checkout and Cargo registry paths before compiling. Other hosts fail closed: a
+raw Cargo release build can embed host paths or host-specific crate identities
+and produce a different module digest. On drift, CI retains the canonical
+rebuilt module briefly so maintainers can review and update the embedded copy.

internal/analyzer/embedded_wasi_runner_test.go

@@ -42,7 +42,7 @@ func TestEmbeddedWASIExecutesPinnedFixtureAndValidatesResult(t *testing.T) {
 
 func TestEmbeddedWASIModuleDigestIsPinned(t *testing.T) {
 	digest := sha256.Sum256(embeddedAnalyzerFixtureWASM)
-	const expected = "2f74c1eab73b27e905eec63ff91c81b659514bfbc2a87ec4cc1748a89c5a126c"
+	const expected = "0252d60ef07a3f406df1e8f2e1b384e84b899aceca4c62ce1e68537aa19d283f"
 	if actual := hex.EncodeToString(digest[:]); actual != expected {
 		t.Fatalf("embedded analyzer fixture changed without provenance review: %s", actual)
 	}

scripts/build-embedded-wasi.sh

@@ -0,0 +1,28 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+if [[ "$(uname -s)" != "Linux" || "$(uname -m)" != "x86_64" ]]; then
+  echo "embedded WASI release builds require the canonical Linux x86_64 builder" >&2
+  exit 1
+fi
+
+repo_root="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.." && pwd -P)"
+cargo_home="${CARGO_HOME:-${HOME}/.cargo}"
+mkdir -p -- "$cargo_home"
+cargo_home="$(cd -- "$cargo_home" && pwd -P)"
+
+# Rust keeps source paths in panic and diagnostic strings. Map both project and
+# dependency roots to stable virtual paths so the canonical artifact is
+# independent of checkout and Cargo cache locations. The encoded form preserves
+# spaces.
+separator=$'\x1f'
+export CARGO_ENCODED_RUSTFLAGS="--remap-path-prefix=${repo_root}=/workspace${separator}--remap-path-prefix=${cargo_home}=/cargo"
+export CARGO_INCREMENTAL=0
+unset RUSTFLAGS
+
+rustup target add wasm32-wasip1 --toolchain 1.97.1
+(
+  cd -- "$repo_root/analyzers"
+  cargo +1.97.1 build --locked --target wasm32-wasip1 \
+    --package cyberagent-analyzer-fixture --release
+)