[SELFHOST-CUTOVER-2] Decide and execute Rust reference compiler retirement after default-mode bake-in

[keaz]

Requirement

Decide whether and when the Rust reference compiler implementation can be deprecated and removed after the controlled self-host default cutover has operated successfully with rollback evidence.

This issue must not start until the default-mode cutover issue is closed with evidence and a bake-in period or equivalent release approval is complete.

Scope

• Define Rust-reference retirement criteria after default self-host operation is proven.
• Identify all Rust source paths that are reference-compiler implementation versus infrastructure still required for packaging, release tooling, tests, bootstrapping, or host integration.
• Define replacement ownership for any remaining Rust-only host tooling before deletion.
• Add a rollback plan that can restore the Rust reference from a tagged release or branch if self-host default regresses.
• Update build, CI, release, docs, and packaging to remove or archive Rust reference code only after all replacement paths exist.
• Preserve license, provenance, historical release, and migration documentation.

Non-goals

• Do not delete Rust source simply because self-host mode is supported.
• Do not remove Rust host infrastructure that is still required by cargo build, packaging, native runtime integration, release tooling, or bootstrapping unless it has a tested replacement.
• Do not remove rollback capability before the default-mode bake-in and release approval are complete.
• Do not introduce placeholder removals, fake passing tests, or dead-code-only cleanups that leave broken documented commands.

Definition of Done

• A retirement decision record exists and is approved.
• Default self-host operation has passed the agreed bake-in criteria.
• All Rust-reference-owned compiler behavior has a self-host replacement with tests.
• All build, CI, release, packaging, docs, and examples work without the removed Rust reference code.
• Rollback or restore instructions are documented and validated.
• cargo build behavior is either intentionally retired/replaced or narrowed to remaining Rust host tooling with updated docs.
• Full CI, release preflight, bootstrap, examples, docs checks, and marker scans pass.
• Evidence is posted before closure with commit hash, removal scope, replacement mapping, tests run, docs updated, rollback validation, and placeholder scan output.

Acceptance Criteria

• The repository no longer contains Rust reference compiler code only after the approved replacement and rollback criteria are satisfied.
• Developers have a documented path to build and release AICore without the Rust reference compiler.
• Any remaining Rust code has a documented non-reference role.
• No existing documented command is broken without an intentional replacement and migration note.

Required Verification

Run at minimum after implementation:

• full default self-host bootstrap/release preflight
• all default-mode build tests
• all fallback/rollback validation that remains applicable
• docs/examples checks
• CI equivalent for the post-retirement build system
• marker scan on touched paths
• repository-wide search confirming removed Rust reference paths are no longer referenced by active docs/scripts/tests

[keaz]

Progress update for #419:

Implemented the Rust-reference retirement audit slice in commit 1d30aa5f6a131651bc54551b772a5e6339b0e58b.

What changed:

• Added decision record: docs/selfhost/rust-reference-retirement.md
• Added checked manifest: docs/selfhost/rust-reference-retirement.v1.json
• Added audit tool: scripts/selfhost/retirement_audit.py
• Added CI wiring: make selfhost-retirement-audit, included in make check / make ci
• Updated self-host docs/runbook with the deferred retirement process and approval gate
• Added self-host tests for both audit consistency and blocked approval mode

Verification run locally:

• python3 scripts/selfhost/retirement_audit.py --check --report target/selfhost-retirement/report.json -> passed
• python3 scripts/selfhost/retirement_audit.py --require-approved --report target/selfhost-retirement/approval-report.json -> failed as intended with explicit blockers
• make selfhost-retirement-audit -> passed
• cargo fmt --all -> passed
• cargo test --locked --test selfhost_parity_tests selfhost_retirement -- --nocapture -> passed
• cargo test --locked --test selfhost_parity_tests selfhost_compiler_support_packages_are_real_sources -- --exact -> passed
• cargo test --locked --test selfhost_parity_tests selfhost_bootstrap_ci_and_release_gates_are_wired -- --exact -> passed
• make docs-check -> passed
• make examples-check -> passed
• make examples-run -> passed
• make ci -> passed
• Marker scan: rg -n "TODO|dummy|stub|unimplemented|panic\(\"todo|FIXME" Makefile docs/selfhost/README.md docs/selfhost/supported-operation-runbook.md docs/selfhost/rust-reference-retirement.md docs/selfhost/rust-reference-retirement.v1.json scripts/selfhost/retirement_audit.py tests/selfhost_parity_tests.rs -> no output

Audit report summary from target/selfhost-retirement/report.json:

• format: aicore-rust-reference-retirement-audit-v1
• status: deferred
• removal_allowed: false
• problems: 0
• blockers: 10
• tracked Rust/Cargo paths classified: 105
• unclassified tracked Rust/Cargo paths: 0

Remaining work before this issue can be closed:

• Approve the retirement decision after default-mode bake-in.
• Add Linux and macOS release preflight bake-in evidence to the manifest.
• For every Rust path class, either provide tested self-host replacement evidence and set removal_allowed=true, or document the retained non-reference Rust role.
• Validate rollback/restore from the recorded last Rust-reference tag or branch.
• Only then remove/archive Rust reference compiler code and update active docs/scripts/tests/workflows accordingly.

Keeping this issue open because the DoD requires approved retirement and actual post-retirement verification; this commit only adds the required audit gate and inventory.

[keaz]

Progress update for #419:

Implemented machine-verifiable bake-in evidence validation in commit 9649758a04bd1434a297e83ef753e1d4b7066d93.

What changed:

• scripts/selfhost/retirement_audit.py now validates passed bake-in entries instead of only counting them.
• Passing bake-in evidence must include:
  • make release-preflight
  • make ci
  • source commit
  • supported bootstrap report plus matching sha256: digest
  • release provenance plus matching sha256: digest
  • controlled default compiler-source build artifact plus matching sha256: digest
• The audit verifies bootstrap report format/status/platform/budget defaults.
• The audit verifies release provenance format/source commit/platform/clean worktree/validation fields/canonical artifact checksum.
• The audit verifies default build artifact checksum.
• Added docs for the bake-in evidence schema in docs/selfhost/rust-reference-retirement.md, docs/selfhost/README.md, and docs/selfhost/supported-operation-runbook.md.
• Added tests for both valid synthetic bake-in evidence and checksum mismatch rejection.

Verification run locally:

• python3 scripts/selfhost/retirement_audit.py --check --report target/selfhost-retirement/report.json -> passed
• cargo fmt --all -> passed
• cargo test --locked --test selfhost_parity_tests selfhost_retirement -- --nocapture -> passed
• cargo test --locked --test selfhost_parity_tests selfhost_compiler_support_packages_are_real_sources -- --exact -> passed
• make selfhost-retirement-audit -> passed
• make docs-check -> passed
• make ci -> passed
• python3 scripts/selfhost/retirement_audit.py --require-approved --report target/selfhost-retirement/approval-report.json -> failed as intended with explicit blockers
• Marker scan: rg -n "TODO|dummy|stub|unimplemented|panic\(\"todo|FIXME" Makefile docs/selfhost/README.md docs/selfhost/supported-operation-runbook.md docs/selfhost/rust-reference-retirement.md docs/selfhost/rust-reference-retirement.v1.json scripts/selfhost/retirement_audit.py tests/selfhost_parity_tests.rs -> no output

Current target/selfhost-retirement/report.json summary:

• format: aicore-rust-reference-retirement-audit-v1
• status: deferred
• removal_allowed: false
• problems: 0
• blockers: 10
• evidence_count: 0
• passed_release_preflight_runs: 0
• tracked Rust/Cargo paths classified: 105
• unclassified tracked Rust/Cargo paths: 0

Remaining blockers before closure:

• Retirement decision is still deferred and approval is not recorded.
• No machine-verified Linux/macOS bake-in entries are recorded yet.
• All Rust path classes remain removal_allowed=false.
• Rollback source and restore validation are not complete.
• Actual Rust reference removal/archive work has not started, which is correct until approval and bake-in are complete.

Keeping #419 open.

[keaz]

Progress update for the rollback-validation slice of #419.

Implemented and pushed commit 9be8534a2b15ba982f875807c91e495223e5af4e (Require rollback evidence for Rust retirement).

What changed:

• Added a machine-checkable rollback section to docs/selfhost/rust-reference-retirement.v1.json with required restore source, restore paths, required restore/build/audit commands, and rollback.validation_evidence.
• Extended scripts/selfhost/retirement_audit.py to validate rollback evidence checksums, checkout command coverage for all restore paths, cargo build log evidence, retirement audit report format/problems, and marker scan evidence.
• The retirement audit now reports rollback state in target/selfhost-retirement/report.json and blocks final retirement until rollback validation exists.
• Updated self-host retirement docs/runbook/README and docs-check coverage.
• Added focused tests for valid rollback evidence and checksum mismatch rejection.

Verification run locally:

• python3 scripts/selfhost/retirement_audit.py --check --report target/selfhost-retirement/report.json -> passed, problems=0, blockers=12.
• cargo test --locked --test selfhost_parity_tests selfhost_retirement_audit -> passed, 6 tests.
• make docs-check -> passed.
• make selfhost-retirement-audit -> passed.
• python3 -m py_compile scripts/selfhost/retirement_audit.py -> passed.
• cargo fmt --all and cargo fmt --all -- --check through make ci -> passed.
• make ci -> passed, including cargo build --locked, targeted/unit/golden/execution/E7/E8/E9/selfhost tests, examples check/run, docs check, integration harness offline, security audit, and reproducibility check.
• Marker scan on touched paths with TODO|dummy|stub|unimplemented|panic\("todo|FIXME -> no matches.
• python3 scripts/selfhost/retirement_audit.py --require-approved --report target/selfhost-retirement/approval-report.json -> intentionally failed with the remaining real blockers.

Current #419 status: keep open. The audit is consistent but retirement is still blocked by approval, Linux/macOS bake-in evidence, validated rollback evidence, and the unresolved Rust path class replacement/retention decisions.

[keaz]

Progress update for the Rust path class decision slice of #419.

Implemented and pushed commit 4c92320771f40b1c5f72423fe74de96f4c23e1c1 (Audit Rust retirement class decisions).

What changed:

• Added a required retirement_decision contract to every rust_path_classes entry in docs/selfhost/rust-reference-retirement.v1.json.
• Split class intent into remove-after-replacement for Rust reference compiler behavior and retain-non-reference for host/tooling/test Rust that may remain only with a named non-reference role.
• Extended scripts/selfhost/retirement_audit.py to validate class decision status, retained Rust roles, command evidence entries, and report checksums.
• Replaced the old generic class blockers with specific blockers:
  • rust-reference-compiler-core replacement/removal decision is pending
  • rust-reference-backend-runtime replacement/removal decision is pending
  • retained Rust role approval blockers for host CLI/release packaging, developer tooling, and tests
• Updated retirement docs/runbook/README and docs-check coverage for class decision evidence.
• Added focused positive/negative tests for class decision evidence checksum validation.

Verification run locally:

• python3 scripts/selfhost/retirement_audit.py --check --report target/selfhost-retirement/report.json -> passed, problems=0, blockers=12.
• python3 -m json.tool docs/selfhost/rust-reference-retirement.v1.json -> passed.
• python3 -m py_compile scripts/selfhost/retirement_audit.py -> passed.
• cargo test --locked --test selfhost_parity_tests selfhost_retirement_audit -> passed, 8 tests.
• make docs-check -> passed.
• make selfhost-retirement-audit -> passed.
• make ci -> passed, including cargo build --locked, all local CI test groups, examples check/run, docs checks, integration harness offline, security audit, and reproducibility check.
• Marker scan on touched paths with TODO|dummy|stub|unimplemented|panic\("todo|FIXME -> no matches.
• python3 scripts/selfhost/retirement_audit.py --require-approved --report target/selfhost-retirement/approval-report.json -> intentionally failed with the remaining real blockers.

Current #419 status: keep open. The issue is not done because the remaining blockers are real: approval is still deferred, Linux/macOS bake-in evidence is not recorded, rollback restore validation is not recorded, and the per-class replacement/retention decisions are not yet approved with evidence.

[keaz]

Progress update for #419, commit 0aa5a1e (Add Rust retirement evidence helper).

Implemented:

• Added scripts/selfhost/retirement_evidence.py to generate checksum-bearing bake-in, rollback, and Rust path class decision evidence entries.
• Added candidate manifest assembly support that only changes approval/class status when explicitly requested, and still relies on retirement_audit.py --require-approved as the final gate.
• Wired the helper into the retirement manifest required active paths and docs checks.
• Updated the Rust retirement docs/runbook/README with evidence helper usage.
• Added self-host parity tests covering successful evidence generation + candidate manifest audit and a negative invalid commit digest path.

Verification run:

• python3 -m py_compile scripts/selfhost/retirement_evidence.py scripts/selfhost/retirement_audit.py
• python3 -m json.tool docs/selfhost/rust-reference-retirement.v1.json
• python3 scripts/selfhost/retirement_audit.py --check --report target/selfhost-retirement/report.json
• cargo fmt --all
• cargo test --locked --test selfhost_parity_tests selfhost_retirement
• make docs-check
• make selfhost-retirement-audit
• make ci
• Expected-failure approval gate: python3 scripts/selfhost/retirement_audit.py --require-approved --report target/selfhost-retirement/approval-report.json returned approval_status=1 with 12 blockers.
• Placeholder marker scan on touched paths found no matches: rg -n "TODO|dummy|stub|unimplemented|panic\(\"todo|FIXME" <touched paths> returned status 1/no output.
• git diff --check

Current status: issue remains open. The implemented helper makes final retirement evidence repeatable and reviewable, but the actual Rust reference retirement is still blocked by the audit until approved decision, two platform bake-in entries, validated rollback restore evidence, and per-class replacement/retention decisions are supplied.

[keaz]

Progress update for #419, commit e8b63ef (Support portable Rust retirement evidence roots).

Implemented:

• Added --evidence-root support to scripts/selfhost/retirement_audit.py so relative bake-in, rollback, and class decision evidence paths can resolve from a separate release evidence bundle instead of requiring generated reports/binaries/logs to live under the repository root.
• Kept repository-owned checks unchanged: active paths, docs, Rust inventory, and rollback restore path existence still resolve against the repo.
• Added evidence_root to the generated audit report for provenance of the audit context.
• Updated retirement docs/runbook/README with the portable evidence bundle flow.
• Added test coverage proving a candidate manifest with relative evidence paths passes when audited with --evidence-root.

Verification run:

• python3 -m py_compile scripts/selfhost/retirement_audit.py scripts/selfhost/retirement_evidence.py
• python3 -m json.tool docs/selfhost/rust-reference-retirement.v1.json
• cargo fmt --all
• cargo test --locked --test selfhost_parity_tests selfhost_retirement
• make docs-check
• make selfhost-retirement-audit
• make ci
• Expected-failure approval gate: python3 scripts/selfhost/retirement_audit.py --require-approved --report target/selfhost-retirement/approval-report.json returned approval_status=1 with the 12 real blockers.
• Placeholder marker scan on touched paths found no matches: rg -n "TODO|dummy|stub|unimplemented|panic\(\"todo|FIXME" <touched paths> returned status 1/no output.
• git diff --check

Current status: #419 remains open. This removes a practical blocker to storing final Linux/macOS bake-in, rollback, and class-decision evidence as release artifacts, but it does not fake approval or generated evidence. Final retirement is still blocked until the manifest has approved decision state, Linux and macOS bake-in entries, validated rollback restore evidence, and approved per-class replacement/retention decisions.

[keaz]

Progress update for #419, commit 5a72083 (Emit bundle-relative Rust retirement evidence).

Implemented:

• Added --path-base to scripts/selfhost/retirement_evidence.py for bake-in-entry, rollback-entry, and class-entry.
• When --path-base <bundle> is supplied, generated evidence entries record paths relative to that bundle while checksums are computed from the actual files.
• The helper rejects evidence files outside --path-base instead of silently recording non-portable paths.
• Updated retirement docs/runbook/README and docs-check coverage for --path-base + --evidence-root workflow.
• Expanded self-host retirement tests to cover bundle-relative evidence entries and the negative outside-path-base failure path.

Verification run:

• python3 -m py_compile scripts/selfhost/retirement_audit.py scripts/selfhost/retirement_evidence.py
• python3 -m json.tool docs/selfhost/rust-reference-retirement.v1.json
• cargo fmt --all
• cargo test --locked --test selfhost_parity_tests selfhost_retirement
• make docs-check
• make selfhost-retirement-audit
• make ci
• Expected-failure approval gate: python3 scripts/selfhost/retirement_audit.py --require-approved --report target/selfhost-retirement/approval-report.json returned approval_status=1 with the 12 real blockers.
• Placeholder marker scan on touched paths found no matches: rg -n "TODO|dummy|stub|unimplemented|panic\(\"todo|FIXME" <touched paths> returned status 1/no output.
• git diff --check

Current status: #419 remains open. The evidence bundle flow is now usable without committing generated binaries/logs/reports into the repository, but final retirement still requires approved decision state, Linux and macOS release-preflight bake-in evidence, validated rollback restore evidence, and approved replacement/retention decisions for every Rust path class.

[keaz]

Progress update for #419, commit 84499d41f6c2129bb8413dbbbc33513e2be25dc1 (Add Rust retirement reference scan evidence).

Implemented:

• Added scripts/selfhost/retirement_reference_scan.py with report format aicore-rust-reference-retirement-reference-scan-v1.
• The scanner targets active .github/workflows, docs, scripts, tests, Makefile, and README.md files, while allowing the retirement decision record/manifest to retain historical migration references.
• Added audit validation for repository-wide reference scan class evidence. The audit now rejects scan evidence unless the report is ok=true, targets at least one approved removal class, includes retired reference tokens, and has no findings or scan problems.
• Updated the retirement audit so a final retired manifest can represent approved removal classes whose historical path patterns are absent, while still failing if those retired files remain active.
• Wired make selfhost-retirement-reference-scan, docs-check coverage, required active path inventory, and self-host docs/runbook guidance.
• Added tests for clean scan, active-reference rejection, valid scan evidence, and failed scan evidence.

Verification run locally:

• python3 -m py_compile scripts/selfhost/retirement_audit.py scripts/selfhost/retirement_evidence.py scripts/selfhost/retirement_reference_scan.py -> passed
• python3 -m json.tool docs/selfhost/rust-reference-retirement.v1.json -> passed
• python3 scripts/selfhost/retirement_reference_scan.py --report target/selfhost-retirement/reference-scan.json -> passed with targeted_classes=0 because the checked-in manifest is still deferred and has no approved removal classes
• python3 scripts/selfhost/retirement_audit.py --check --report target/selfhost-retirement/report.json -> passed with problems=0, blockers=12
• cargo fmt --all -> passed
• cargo test --locked --test selfhost_parity_tests selfhost_retirement -> passed, 16 tests
• make docs-check -> passed
• make selfhost-retirement-audit -> passed
• make selfhost-retirement-reference-scan -> passed in current deferred/no-target mode
• make ci -> passed
• Expected-failure approval gate: python3 scripts/selfhost/retirement_audit.py --require-approved --report target/selfhost-retirement/approval-report.json returned approval_status=1 with the 12 real blockers
• Placeholder marker scan on touched paths with TODO|dummy|stub|unimplemented|panic\(\"todo|FIXME -> no matches
• git diff --check -> passed

Current status: #419 remains open. This commit adds the missing repository-wide reference-scan evidence path and final retired manifest support, but it does not fake approval or removal. Final retirement is still blocked until the decision is approved/retired, Linux and macOS bake-in evidence is recorded, rollback restore validation is recorded, and every Rust path class has approved replacement or retention evidence.

[keaz]

Progress update for #419, commit 981c3dad7e0856da9e00c20b2443c3a0d4bacb92 (Validate Rust retirement class evidence reports).

Implemented:

• Tightened scripts/selfhost/retirement_audit.py so checksum-bearing class evidence is not enough for known report-producing commands.
• make selfhost-parity-candidate class evidence must now be a passing aicore-selfhost-parity-v1 report with results.
• make selfhost-bootstrap class evidence must now be a supported-ready aicore-selfhost-bootstrap-v1 report.
• make selfhost-stage-matrix class evidence must now be a passing aicore-selfhost-stage-matrix-v1 report with no failed cases.
• Left log/note-only commands as checksum-verified evidence because those commands do not currently produce structured reports.
• Updated docs/runbook text so final class approval requirements describe the real report formats.
• Added tests proving valid known reports are accepted and wrong report formats are rejected even when the checksum matches.

Verification run locally:

• python3 -m py_compile scripts/selfhost/retirement_audit.py scripts/selfhost/retirement_evidence.py scripts/selfhost/retirement_reference_scan.py -> passed
• python3 -m json.tool docs/selfhost/rust-reference-retirement.v1.json -> passed
• python3 scripts/selfhost/retirement_audit.py --check --report target/selfhost-retirement/report.json -> passed with problems=0, blockers=12
• python3 scripts/selfhost/retirement_reference_scan.py --report target/selfhost-retirement/reference-scan.json -> passed in current deferred/no-target mode
• cargo fmt --all -> passed
• cargo test --locked --test selfhost_parity_tests selfhost_retirement -> passed, 17 tests
• make docs-check -> passed
• make selfhost-retirement-audit -> passed
• make selfhost-retirement-reference-scan -> passed in current deferred/no-target mode
• make ci -> passed
• Expected-failure approval gate: python3 scripts/selfhost/retirement_audit.py --require-approved --report target/selfhost-retirement/approval-report.json returned approval_status=1 with the same 12 real blockers
• Placeholder marker scan on touched paths with TODO|dummy|stub|unimplemented|panic\(\"todo|FIXME -> no matches
• git diff --check -> passed

Current status: #419 remains open. This closes another evidence-quality gap, but final Rust reference retirement is still blocked by the actual approval/bake-in/rollback/class-decision requirements.

[keaz]

Progress update for #419.

Commit: 94e1ec4 (Validate rollback marker scan evidence)

Implemented:

• Tightened rollback restore evidence validation so marker_scan_report must be checksum-valid, UTF-8 text, and clean/empty.
• Added a regression test proving dirty rollback marker scan evidence blocks retirement approval.
• Updated the Rust reference retirement doc and supported-operation runbook to state the clean marker-scan requirement.

Verification run on the final committed tree:

• cargo fmt --all
• python3 -m py_compile scripts/selfhost/retirement_audit.py scripts/selfhost/retirement_evidence.py scripts/selfhost/retirement_reference_scan.py
• python3 -m json.tool docs/selfhost/rust-reference-retirement.v1.json
• cargo test --locked --test selfhost_parity_tests selfhost_retirement_audit_rejects_dirty_rollback_marker_scan
• make docs-check
• make selfhost-retirement-audit
• python3 scripts/selfhost/retirement_reference_scan.py --report target/selfhost-retirement/reference-scan.json
• make ci
• git diff --check
• touched-path marker scan returned marker_status=1 with no matches.

Approval gate status:

• python3 scripts/selfhost/retirement_audit.py --require-approved --report target/selfhost-retirement/approval-report.json still fails as expected with 12 real blockers.

Current blockers keeping #419 open:

1. retirement decision status is deferred; approved or retired is required for removal
2. approval required before Rust reference removal
3. bake-in requires 2 passing release preflight run(s); recorded 0
4. bake-in requires passing release evidence for linux
5. bake-in requires passing release evidence for macos
6. rollback restore validation is not recorded
7. rollback requires a validated restore evidence entry
8. rust-reference-compiler-core replacement/removal decision is pending
9. rust-reference-backend-runtime replacement/removal decision is pending
10. rust-host-cli-release-packaging retained Rust role is not approved
11. rust-developer-tooling retained Rust role is not approved
12. rust-test-suites retained Rust role is not approved

Per AGENTS.md, this issue remains open and must not be marked Done until those blockers are resolved with real evidence.

[keaz]

Progress update for #419.

Commit: 0c1bb35 (Add Rust retirement bake-in evidence target)

Implemented:

• Added make selfhost-retirement-bake-in-evidence to generate the current-host bake-in entry, assemble a candidate retirement manifest, and audit that candidate against local evidence.
• Hardened scripts/selfhost/retirement_evidence.py bake-in-entry so it rejects stale or non-production evidence before writing a passing bake-in entry. It now validates bootstrap report format/status/platform/default budgets, release provenance format/platform/source commit/clean worktree, and release validation fields.
• Updated self-host retirement docs/runbook with the supported flow after make release-preflight.
• Added regression coverage for the Make wiring and stale-provenance rejection path.

Verification run locally:

• make ci
• cargo fmt --all
• python3 -m py_compile scripts/selfhost/retirement_evidence.py scripts/selfhost/retirement_audit.py scripts/selfhost/retirement_reference_scan.py
• python3 -m json.tool docs/selfhost/rust-reference-retirement.v1.json
• targeted selfhost_parity_tests coverage for the new evidence helper and Make wiring
• make docs-check
• make selfhost-retirement-audit
• git diff --check
• marker scan over touched paths: no matches for TODO|dummy|stub|unimplemented|panic("todo|FIXME

The approval gate was intentionally re-run and still fails with 12 blockers, including deferred retirement approval, missing Linux/macOS bake-in evidence, missing rollback restore validation, and unresolved Rust path class decisions. Keeping #419 open per DoD until those gates have real evidence.

[keaz]

Additional #419 bake-in evidence collected locally on macOS after commit 0c1bb35 was pushed.

Commands run:

• make release-preflight
• make selfhost-retirement-bake-in-evidence

Result:

• macOS make release-preflight passed on source commit 0c1bb3519fc460fe4743509bb66a1e5f96517d08.
• make selfhost-retirement-bake-in-evidence wrote a verified local bake-in entry and candidate manifest:
  • target/selfhost-retirement/bake-in-macos.json
  • target/selfhost-retirement/candidate-manifest-macos.json
  • target/selfhost-retirement/candidate-report-macos.json
• Candidate audit result: status=deferred, problems=0, blockers=11.

Recorded macOS evidence entry:

• platform=macos
• status=passed
• recorded_at=2026-04-20T18:37:24Z
• bootstrap_report_sha256=sha256:a82fc07ed96dd25422680eddb3f9ccb242b3014ac01d5a7352c209141afaa6da
• release_provenance_sha256=sha256:7535db4306e316f52c2d0ba0e08470606a3b91c1e8390e638200c51ea618a0bd
• default_build_sha256=sha256:023a67932c00471a78425c2dc04775ea555940a629e8e283d878d62599ff454e

Remaining blockers are still real and #419 remains open:

• retirement decision/approval is still deferred
• total passing bake-in runs is 1 of required 2
• Linux bake-in evidence is missing
• rollback restore validation is not recorded
• Rust path class decisions are still pending for compiler core, backend/runtime, host CLI/release packaging, developer tooling, and test suites