Trust: refresh helper-runtime prelink — core_fingerprint stale (re-#24302)

[PurHur]

Category

trust · Pillar 1 / helper-runtime (#10533, re-#24302)

Problem

Committed prelinked/helper-runtime/x86_64-linux/manifest.json core_fingerprint no longer matches live HelperRuntimeCache::coreFingerprint(). check-helper-runtime-prelink.php --strict fails and every committed unit is skipped, so cold hello-world rebuilds the full helper corpus and trips the 120s cold-build gate.

Measured on master after #27730:

committed	72a83eeac48e8a462309
live	aa095c4c11625938c149
units	0 fresh / 363 stale

./script/release-readiness.sh --json reports:

• helper-runtime-prelink FAIL (fingerprint mismatch)
• cold-build-check FAIL (timeout 120s)

Repro

docker info >/dev/null
./script/docker-exec.sh -- bash -lc 'php script/check-helper-runtime-prelink.php --strict'
# → core_fingerprint mismatch — committed 72a83eeac48e8a462309 vs live aa095c4c11625938c149

Fix

Rebuild and publish the committed corpus (do not restamp):

./script/docker-exec.sh -- bash -lc 'make helper-runtime-prelink-refresh'
# or: php script/emit-helper-runtime-object.php --prelink

If gen-0 argv provenance also drifts, refresh with make bootstrap-gen0-refresh-argv-driver.

Done when

• php script/check-helper-runtime-prelink.php --strict exits 0
• cold hello-world from clean helper cache completes under the release-readiness timeout
• make north-star5-verify-fast green
• PR cites rebuild commands (no fingerprint hand-edit)

Refs #24302, #10533

[PurHur]

claim: PHP Runtime → PHP — starting this run

Pillar 1 probe (before claim):

Gate	Status	Symptom
bootstrap-inventory --check	green	OK 7014/7014
check-helper-runtime-prelink --strict	red	core_fingerprint committed 72a83eeac48e8a462309 vs live aa095c4c11625938c149; 0 fresh / 363 stale
release-readiness --json	red	helper-runtime-prelink FAIL; cold-build-check timeout 120s; north-star5-fast still running at claim time
Open php-in-php NestedJIT queue	empty	#19215 closed; last NestedJIT migrations already merged

Plan: real make helper-runtime-prelink-refresh (no restamp); verify --strict + cold-build + north-star5-verify-fast; merge.

[PurHur]

Release manager enrichment (2026-08-05 afternoon)

Confirmed on master @ c9c463922 via ./script/docker-exec.sh -- bash -lc './script/release-readiness.sh --json':

Gate	Status	Symptom
bootstrap-inventory	✅	OK 7014/7014
helper-runtime-prelink --strict	❌	first fail — core_fingerprint committed 72a83eeac48e8a462309 vs live aa095c4c11625938c149 (#24302)
cold-build-check	❌	timeout 122s (corpus warmup after fingerprint skip-all)
spine / root-readme	✅	7014 + 2 deferred
north-star5-fast	✅	ok (4f-m cleared; #27696/#27714 closed)
vm-driver-probe / gen0-functional	✅	ok
gen0_provenance	fresh	seed c9c463922 / 0 lowering since
user_release_ready	no	mode quick

Promoted to release-blocker for v1.1.0 — Pillar 1 Trust is red solely on helper-runtime freshness (gen-0 lane recovered). Do not restamp fingerprint; rebuild via make helper-runtime-prelink-refresh / emit --prelink.

Refs: #78, #24302, prior respins #26921 / #26309.

[PurHur]

Maintainer gate probe (2026-08-05)

Ran locally via ./script/docker-exec.sh (no GHA).

Gate	Result	Symptom
php script/bootstrap-inventory.php --check	green	OK 7014/7014
./script/release-readiness.sh --json	red (first fail)	check-helper-runtime-prelink.php --strict — core_fingerprint mismatch committed 72a83eeac48e8a462309 vs live aa095c4c11625938c149 (#24302)
cold-build-check	red	timeout after ~121–122s on cold cache (#24302 / #24351)
north-star5-verify-fast	not re-run this pass (blocked on prelink fingerprint)	—

Pillar 1 (Trust) remains the blocker for release-readiness / user_release_ready. This issue is the correct implementation target for the fingerprint/prelink refresh.

Also stocked Reflection parity gaps for workers: #27736 (posix_getrlimit/setrlimit), #27737 (hash_* HashContext), #27738 (xml_get_current_*), #27739 (stream_copy_to_stream).

[PurHur]

Lane A worker stand-down: #27732 is the only non-owned Lane A implementation-ready issue; leaving it to the existing claim: PHP Runtime → PHP. #10533 comments are locked (>2500), so Pillar 1 probe is recorded here instead:

Gate	Status
inventory	OK 7014/7014
helper-runtime-prelink --strict	FAIL — fingerprint 72a83ee… vs live aa095c4…
cold-build	FAIL timeout 120s
north-star5-fast	FAIL 4f-m gen-0 manifest/driver mismatch
user_release_ready	no

[PurHur]

Follow-up: full release-readiness --json (2026-08-05)

user_release_ready: no. Completed gate set:

Gate	Status
bootstrap-inventory	ok (7014/7014)
helper-runtime-prelink	fail — fingerprint 72a83eea… vs live aa095c4c…
cold-build	fail — timeout 121s
spine-coverage / root-readme-sync	ok
north-star5-fast	fail — step 4f-m gen-0 manifest/driver mismatch (#8713)
vm-driver-execute-probe / gen0 functional smoke	ok

Warning: gen-0 seed stale vs current lowering (1 commit since 0c6b0f2ea).

[PurHur]

Maintainer gate probe — 2026-08-05 (Pillar 1)

#10533 comments are locked (2500+); recording here because this is the first release-readiness failure.

Gate	Status	Symptom
docker info	green	ok
bootstrap-inventory --check	green	OK 7014/7014
release-readiness --json	red	first fail: this issue’s prelink --strict
helper-runtime-prelink --strict	red	committed 72a83eeac48e8a462309 vs live aa095c4c11625938c149
cold-build-check	red	timeout 120s
north-star5-verify-fast	red	step 4f-m gen-0 lowering_source_fingerprint mismatch (manifest ed5d8a70… vs live 9e2fda42…)
open PRs	none	empty

Parity filed this run (implementation-ready): #27743 #27744 #27745 #27746 (Zend 8.2 vs VM verified via docker-exec).