big registry and chip package upgrades + build process hardening

Author: mannomannX

cli/toob-cli/cmd/conformance.go

@@ -0,0 +1,61 @@
+package cmd
+
+import (
+	"fmt"
+	"path/filepath"
+
+	"github.com/spf13/cobra"
+	"github.com/toob-boot/toob/internal/conformance"
+	"github.com/toob-boot/toob/internal/ui"
+)
+
+var conformanceCmd = &cobra.Command{
+	Use:   "conformance [path]",
+	Short: "Audit a package for HAL trait conformance and Mock/Real equivalence",
+	Long: `Audits a driver or chip package directory against HAL trait contracts and Mock vs Real implementation parity.
+
+Generates conformance_report.json and conformance_report.md (CRA Annex-I Evidence).`,
+	Args: cobra.MaximumNArgs(1),
+	RunE: func(cmd *cobra.Command, args []string) error {
+		pkgPath := "."
+		if len(args) > 0 {
+			pkgPath = args[0]
+		}
+		absDir, err := filepath.Abs(pkgPath)
+		if err != nil {
+			return fmt.Errorf("invalid path: %w", err)
+		}
+
+		ui.Header(fmt.Sprintf("HAL Conformance Harness: %s", filepath.Base(absDir)))
+
+		report, err := conformance.AuditPackage(absDir)
+		if err != nil {
+			return fmt.Errorf("conformance audit failed: %w", err)
+		}
+
+		jsonPath := filepath.Join(absDir, "conformance_report.json")
+		mdPath := filepath.Join(absDir, "conformance_report.md")
+
+		_ = conformance.ExportReportJSON(report, jsonPath)
+		_ = conformance.ExportReportMarkdown(report, mdPath)
+
+		for _, chk := range report.Checks {
+			if chk.Passed {
+				ui.Success("%s: %s", chk.Name, chk.Details)
+			} else {
+				ui.Error("%s: %s", chk.Name, chk.Details)
+			}
+		}
+
+		if !report.Passed {
+			return fmt.Errorf("FATAL [CONFORMANCE_FAIL]: Package failed HAL conformance audit!")
+		}
+
+		ui.Success("HAL Conformance audit PASSED cleanly. Exported reports to %s and %s", jsonPath, mdPath)
+		return nil
+	},
+}
+
+func init() {
+	rootCmd.AddCommand(conformanceCmd)
+}

cli/toob-cli/cmd/elfaudit.go

@@ -0,0 +1,106 @@
+package cmd
+
+import (
+	"encoding/json"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strconv"
+	"strings"
+
+	"github.com/spf13/cobra"
+	"github.com/toob-boot/toob/internal/elfaudit"
+	"github.com/toob-boot/toob/internal/manifest"
+	"github.com/toob-boot/toob/internal/ui"
+)
+
+var elfauditProfile string
+var elfauditHardware string
+var elfauditBudget uint64
+
+var elfauditCmd = &cobra.Command{
+	Use:   "elfaudit [path/to/target.elf]",
+	Short: "Post-link ELF audit: mock poison-pill, memory overlap, budget check",
+	Long: `Inspects a linked ELF binary for:
+  (a) Mock Poison-Pill  — no *_mock symbols in production profile
+  (b) Memory Overlap    — sections vs. reserved_ram_regions from hardware.json
+  (c) Budget Footprint  — loadable content vs. stage1_size budget`,
+	Args: cobra.ExactArgs(1),
+	RunE: func(cmd *cobra.Command, args []string) error {
+		elfPath, err := filepath.Abs(args[0])
+		if err != nil {
+			return fmt.Errorf("invalid ELF path: %w", err)
+		}
+
+		if _, err := os.Stat(elfPath); os.IsNotExist(err) {
+			return fmt.Errorf("ELF binary not found: %s", elfPath)
+		}
+
+		config := elfaudit.ELFAuditConfig{
+			Profile:        elfauditProfile,
+			Stage1MaxBytes: elfauditBudget,
+		}
+
+		// Load reserved regions from hardware.json if provided
+		if elfauditHardware != "" {
+			absHW, err := filepath.Abs(elfauditHardware)
+			if err != nil {
+				return fmt.Errorf("invalid hardware.json path: %w", err)
+			}
+			data, err := os.ReadFile(absHW)
+			if err != nil {
+				return fmt.Errorf("failed to read hardware.json: %w", err)
+			}
+			var hj manifest.HardwareJson
+			if err := json.Unmarshal(data, &hj); err != nil {
+				return fmt.Errorf("failed to parse hardware.json: %w", err)
+			}
+			for _, r := range hj.ReservedRamRegions {
+				base, err := strconv.ParseUint(strings.TrimPrefix(r.Base, "0x"), 16, 64)
+				if err != nil {
+					return fmt.Errorf("invalid base address '%s' for reserved region '%s': %w", r.Base, r.Name, err)
+				}
+				config.ReservedRegions = append(config.ReservedRegions, elfaudit.MemoryRegion{
+					Name: r.Name,
+					Base: base,
+					Size: uint64(r.Size),
+				})
+			}
+		}
+
+		ui.Header(fmt.Sprintf("ELF Audit: %s [profile=%s]", filepath.Base(elfPath), config.Profile))
+
+		report, err := elfaudit.AuditELF(elfPath, config)
+		if err != nil {
+			return fmt.Errorf("ELF audit failed: %w", err)
+		}
+
+		for _, chk := range report.Checks {
+			if chk.Passed {
+				ui.Success("%s: %s", chk.Name, chk.Details)
+			} else {
+				ui.Error("%s: %s", chk.Name, chk.Details)
+			}
+		}
+
+		// Export JSON report next to the ELF
+		reportPath := elfPath + ".audit.json"
+		reportData, _ := json.MarshalIndent(report, "", "  ")
+		_ = os.WriteFile(reportPath, reportData, 0o644)
+
+		if !report.Passed {
+			return fmt.Errorf("FATAL [ELF_AUDIT_FAIL]: Binary failed post-link audit!")
+		}
+
+		ui.Success("ELF audit PASSED cleanly. Report: %s", reportPath)
+		return nil
+	},
+}
+
+func init() {
+	elfauditCmd.Flags().StringVar(&elfauditProfile, "profile", "production", "Build profile (production|sandbox)")
+	elfauditCmd.Flags().StringVar(&elfauditHardware, "hardware", "", "Path to hardware.json for reserved region checks")
+	elfauditCmd.Flags().Uint64Var(&elfauditBudget, "budget", 0, "Stage1 size budget in bytes (0 = skip budget check)")
+	rootCmd.AddCommand(elfauditCmd)
+}
+

cli/toob-cli/cmd/literallint.go

@@ -0,0 +1,105 @@
+package cmd
+
+import (
+	"encoding/json"
+	"fmt"
+	"os"
+	"path/filepath"
+
+	"github.com/spf13/cobra"
+	"github.com/toob-boot/toob/internal/literallint"
+	"github.com/toob-boot/toob/internal/ui"
+)
+
+var (
+	literallintDeep     bool
+	literallintIncludes []string
+	literallintJSON     string
+)
+
+var literallintCmd = &cobra.Command{
+	Use:   "literallint [paths...]",
+	Short: "Literal-Bann-Lint for chips/ and drivers/ codebases",
+	Long: `Audits C/H source files for unallowed numeric literals (hardcoded addresses, register offsets, magic numbers).
+Every hardware constant must originate from generated_boot_config.h or chip_config.h.
+
+Uses a regex scanner by default, and optional AST inspection via clang-query when --deep is specified.`,
+	RunE: func(cmd *cobra.Command, args []string) error {
+		paths := args
+		if len(paths) == 0 {
+			// Default paths
+			paths = []string{
+				"toob-registry/registry/chips",
+				"toob-registry/registry/drivers",
+			}
+		}
+
+		var absPaths []string
+		for _, p := range paths {
+			abs, err := filepath.Abs(p)
+			if err != nil {
+				return fmt.Errorf("invalid path %s: %w", p, err)
+			}
+			if _, err := os.Stat(abs); err == nil {
+				absPaths = append(absPaths, abs)
+			}
+		}
+
+		if len(absPaths) == 0 {
+			return fmt.Errorf("no valid scanning paths found among: %v", paths)
+		}
+
+		cfg := literallint.LintConfig{
+			Paths:        absPaths,
+			Extensions:   []string{".c", ".h"},
+			IncludePaths: literallintIncludes,
+			DeepMode:     literallintDeep,
+		}
+
+		ui.Header(fmt.Sprintf("Literal-Bann-Lint: Scanning %d path(s)", len(absPaths)))
+
+		report, err := literallint.RunLint(cfg)
+		if err != nil {
+			return fmt.Errorf("literal lint failed: %w", err)
+		}
+
+		ui.Info("Mode: %s", report.Mode)
+		ui.Info("Files scanned: %d, Lines scanned: %d, Suppressed: %d",
+			report.Stats.FilesScanned, report.Stats.LinesScanned, report.Stats.Suppressed)
+
+		if len(report.Violations) > 0 {
+			ui.Error("Found %d numeric literal violation(s):", len(report.Violations))
+			for _, v := range report.Violations {
+				relPath, _ := filepath.Rel(".", v.File)
+				if relPath == "" {
+					relPath = v.File
+				}
+				ui.Error("  %s:%d:%d: literal '%s' [%s]\n    Line: %s",
+					relPath, v.Line, v.Column, v.Literal, v.Source, v.Context)
+			}
+		}
+
+		if literallintJSON != "" {
+			data, _ := json.MarshalIndent(report, "", "  ")
+			if err := os.WriteFile(literallintJSON, data, 0o644); err != nil {
+				ui.Error("Failed to write JSON report to %s: %v", literallintJSON, err)
+			} else {
+				ui.Success("Exported JSON report to %s", literallintJSON)
+			}
+		}
+
+		if !report.Passed {
+			return fmt.Errorf("FATAL [LITERAL_LINT_FAIL]: Found %d banned numeric literal(s)!", len(report.Violations))
+		}
+
+		ui.Success("Literal-Bann-Lint PASSED cleanly. No unauthorized numeric literals found.")
+		return nil
+	},
+}
+
+func init() {
+	literallintCmd.Flags().BoolVar(&literallintDeep, "deep", false, "Enable clang-query AST hybrid scanning")
+	literallintCmd.Flags().StringSliceVar(&literallintIncludes, "include", nil, "Header include paths for clang-query")
+	literallintCmd.Flags().StringVar(&literallintJSON, "json", "", "Export report as JSON to specified file path")
+	rootCmd.AddCommand(literallintCmd)
+}

cli/toob-cli/cmd/publish.go

@@ -15,6 +15,7 @@ import (
 
 	"github.com/spf13/cobra"
 	"github.com/toob-boot/toob/internal/apiclient"
+	"github.com/toob-boot/toob/internal/conformance"
 	"github.com/toob-boot/toob/internal/paths"
 	"github.com/toob-boot/toob/internal/registry"
 	"github.com/toob-boot/toob/internal/ui"
@@ -67,6 +68,18 @@ Examples:
 		if err := checkManifestDependencies(cmd_defaultCtx(), absDir, client); err != nil {
 			return err
 		}
+
+		// Mandatory HAL Conformance Gate (REG-042)
+		ui.Step("Running HAL Conformance Gate...")
+		confReport, confErr := conformance.AuditPackage(absDir)
+		if confErr != nil || confReport == nil || !confReport.Passed {
+			return fmt.Errorf("FATAL [CONFORMANCE_FAIL]: Package failed HAL conformance audit! Run 'toob conformance %s' for details.", absDir)
+		}
+		jsonPath := filepath.Join(absDir, "conformance_report.json")
+		mdPath := filepath.Join(absDir, "conformance_report.md")
+		_ = conformance.ExportReportJSON(confReport, jsonPath)
+		_ = conformance.ExportReportMarkdown(confReport, mdPath)
+		ui.Success("HAL Conformance audit PASSED cleanly. Generated CRA compliance reports.")
 		// Name collision pre-check (Gap 14)
 		manifestName := detectPackageName(absDir)
 		if manifestName != "" {

cli/toob-cli/go.mod

@@ -13,7 +13,7 @@ require (
 
 require (
 	aead.dev/minisign v0.3.0 // indirect
-	golang.org/x/sync v0.22.0 // indirect
+	golang.org/x/sync v0.22.0
 )
 
 require (