Fase 0+1: build sandbox real (bwrap + zig cc) e hidratación por hardlinks

- hammer-core: Recipe::from_toml/load_from_path reales; Phases override;
  hashing por *contenido* de patches; Store::seal con rename atómico + chmod
  r/o recursivo; Store::find_by_hash por prefix.
- hammer-build: fetch (git mirror + archive al commit fijado), Sandbox::run
  sobre bwrap con rootfs Alpine como tmp-overlay y zig cc inyectado,
  orquestador build con caché por hash, hydrate con hardlinks atómicos
  (link tmp + rename) que pisa el FHS sin tocar inodes del store.
- BuildConfig leído de HAMMER_{ROOTFS,ZIG,WORK} o defaults relativos al store.
- CLI: hammer build / hammer hydrate funcionales; logs a stderr para que
  stdout sea pipeable (el hash y nada más).
- 20 unit + 1 integration test end-to-end (hello.c estático compilado bajo
  bwrap, sellado, hidratado, ejecutado en sandbox limpio).

Cierra el primer entregable del roadmap salvo "X = grep" (falta heurística
autotools/cmake en resolve_phases).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

This commit is contained in:

Sergio

2026-06-07 19:27:26 +00:00

co-authored by

Claude Opus 4.7

parent 8bf1623044

commit 7b362e9d6a

16 changed files with 1549 additions and 81 deletions

									
										Cargo.toml
									
		+2
		
												View File
												
				@@ -24,7 +24,9 @@ thiserror = "2"

				serde = { version = "1", features = ["derive"] }

				serde_json = "1"

				serde_yaml = "0.9"

				toml = "0.8"

				blake3 = "1"

				tempfile = "3"

				clap = { version = "4", features = ["derive"] }

				tracing = "0.1"

				tracing-subscriber = { version = "0.3", features = ["env-filter"] }