Implement researched Guix package outcome for #311: [Guix packaging] CoreRL #668

New issue

Closed

opened 2026-09-02 09:13:14 +00:00 by htayj · 2 comments

htayj commented

2026-09-02 09:13:14 +00:00

(Migrated from github.com)

Context

This delivery ticket was created from research issue #311 ([Guix packaging] CoreRL).

The host-validated research finding follows:

Canonical upstream is the Studio Tectorum/Roguelike Education static article https://www.roguelikeeducation.org/2.html (published 2013-10-24; page SHA-256 4550fbe5ff17a58b2c4ec80d74587a4c043dbf24440881556aaddcbc7852e3c6) and its complete direct source https://www.roguelikeeducation.org/vault/core/1kcore.c. No maintained VCS repository, tags, submodules, or newer CoreRL release was found; treat the dated 1 KiB article/source as fixed revision 1kib-20131024 and pin the direct source with SHA-256 05d55844b30fbfae72bd87ab9e26539cfb8232e540bc0d0ce50b04d6d1369e24 (Guix base32 axkvqrftb67244v5q6vz4jsttt5yemxfic6a2dhfbmcnnujwtysa). The page says the 1023-byte C source is released into the public domain, and the package need ship only that source-derived executable plus a generated notice recording the upstream URL and grant; the linked screenshot, Haiku/OS X binaries, and DCPU-16 port are not package inputs, so there are no bundled fonts, tiles, sounds, maps, documentation assets, or fetched submodules requiring separate grants. The source uses only curses and libc, has no updater, telemetry, runtime download, file-state, or network behavior, and gives the authoritative build command gcc -o corerl 1kcore.c -lncurses. Use a gnu-build-system package module (tay packages corerl), delete configure, disable nonexistent upstream tests, and compile directly with gcc-toolchain as a native input and ncurses as an input; use -std=gnu89 for the intentionally pre-C99 source (implicit main/time declarations), with bash-minimal, coreutils-minimal, and util-linux additionally declared for the launcher-owned smoke path. GNU Guix package search returned no corerl result, and the local channel has no corerl/CoreRL definition or prior issue/runtime proof. CoreRL is the 1 KiB revision of the earlier 4 KiB Core at https://www.roguelikeeducation.org/1.html; Measter/NanoRL is a distinct Rust/Arduino port (master tip cadf54cbec0c36afa50a3b72b1d8f9b585337826, with Arduino-derived LGPL-2.1 files) and must not be substituted. Install /bin/corerl as a wrapper around a private compiled real binary: normal invocations exec the real game, while --smoke sets C locale and package-owned TERM/TERMINFO_DIRS, starts the real game through util-linux script in a PTY, feeds deterministic Up/Down/q input, captures the transcript outside the store, asserts the generated map contains @, e, and < plus the normal Quit on level 1. result, then prints the single-line marker CORERL_RUNTIME_OK. The wrapper must create no persistent state and perform no network access. Later delivery acceptance is guix lint -L . corerl with no package-specific findings; networkless guix build -L . --no-grafts corerl; upstream tests are unavailable; guix build -L . --no-grafts --check corerl; and a fresh HOME/XDG smoke run of corerl --smoke with the planned screenshot proving the real local game starts, processes gameplay input, emits the marker, and writes neither the store nor persistent HOME/XDG state. The research environment had no Guix daemon, so no build or package proof was claimed.

Acceptance criteria

Implement the viable package change identified in the host-validated research finding.
Preserve Guix source provenance, licensing, and deterministic build requirements recorded in the finding.
Add and pass a package-specific safe smoke proof using isolated HOME/XDG state before closure.

Runtime evidence contract

Implementation workflow: guix-package-quality-gates
Reviewed contract file: .goocastle/runtime-evidence-contracts.json
Required proof phase: safe-package-proof; screenshot phase: runtime-screenshot
Evidence adapter: github-issue-comment
Copy this reviewed contract into the named file before running the package proof workflow.

{
  "version": 1,
  "contracts": [
    {
      "issueNumber": 668,
      "packageName": "corerl",
      "artifactPath": ".goocastle/evidence/issue-668.png",
      "runtime": {
        "executable": "corerl",
        "invocation": {
          "file": "corerl",
          "args": [
            "--smoke"
          ]
        },
        "successMarker": "CORERL_RUNTIME_OK"
      }
    }
  ]
}

Imported from GitHub issue/PR. Originally posted by htayj on 2026-09-02T09:13:14Z.

## Context This delivery ticket was created from research issue #311 ([Guix packaging] CoreRL). The host-validated research finding follows: Canonical upstream is the Studio Tectorum/Roguelike Education static article https://www.roguelikeeducation.org/2.html (published 2013-10-24; page SHA-256 4550fbe5ff17a58b2c4ec80d74587a4c043dbf24440881556aaddcbc7852e3c6) and its complete direct source https://www.roguelikeeducation.org/vault/core/1kcore.c. No maintained VCS repository, tags, submodules, or newer CoreRL release was found; treat the dated 1 KiB article/source as fixed revision 1kib-20131024 and pin the direct source with SHA-256 05d55844b30fbfae72bd87ab9e26539cfb8232e540bc0d0ce50b04d6d1369e24 (Guix base32 axkvqrftb67244v5q6vz4jsttt5yemxfic6a2dhfbmcnnujwtysa). The page says the 1023-byte C source is released into the public domain, and the package need ship only that source-derived executable plus a generated notice recording the upstream URL and grant; the linked screenshot, Haiku/OS X binaries, and DCPU-16 port are not package inputs, so there are no bundled fonts, tiles, sounds, maps, documentation assets, or fetched submodules requiring separate grants. The source uses only curses and libc, has no updater, telemetry, runtime download, file-state, or network behavior, and gives the authoritative build command gcc -o corerl 1kcore.c -lncurses. Use a gnu-build-system package module (tay packages corerl), delete configure, disable nonexistent upstream tests, and compile directly with gcc-toolchain as a native input and ncurses as an input; use -std=gnu89 for the intentionally pre-C99 source (implicit main/time declarations), with bash-minimal, coreutils-minimal, and util-linux additionally declared for the launcher-owned smoke path. GNU Guix package search returned no corerl result, and the local channel has no corerl/CoreRL definition or prior issue/runtime proof. CoreRL is the 1 KiB revision of the earlier 4 KiB Core at https://www.roguelikeeducation.org/1.html; Measter/NanoRL is a distinct Rust/Arduino port (master tip cadf54cbec0c36afa50a3b72b1d8f9b585337826, with Arduino-derived LGPL-2.1 files) and must not be substituted. Install /bin/corerl as a wrapper around a private compiled real binary: normal invocations exec the real game, while --smoke sets C locale and package-owned TERM/TERMINFO_DIRS, starts the real game through util-linux script in a PTY, feeds deterministic Up/Down/q input, captures the transcript outside the store, asserts the generated map contains @, e, and < plus the normal Quit on level 1. result, then prints the single-line marker CORERL_RUNTIME_OK. The wrapper must create no persistent state and perform no network access. Later delivery acceptance is guix lint -L . corerl with no package-specific findings; networkless guix build -L . --no-grafts corerl; upstream tests are unavailable; guix build -L . --no-grafts --check corerl; and a fresh HOME/XDG smoke run of corerl --smoke with the planned screenshot proving the real local game starts, processes gameplay input, emits the marker, and writes neither the store nor persistent HOME/XDG state. The research environment had no Guix daemon, so no build or package proof was claimed. ## Acceptance criteria - Implement the viable package change identified in the host-validated research finding. - Preserve Guix source provenance, licensing, and deterministic build requirements recorded in the finding. - Add and pass a package-specific safe smoke proof using isolated HOME/XDG state before closure.  ## Runtime evidence contract Implementation workflow: `guix-package-quality-gates` Reviewed contract file: `.goocastle/runtime-evidence-contracts.json` Required proof phase: `safe-package-proof`; screenshot phase: `runtime-screenshot` Evidence adapter: `github-issue-comment` Copy this reviewed contract into the named file before running the package proof workflow. ```json { "version": 1, "contracts": [ { "issueNumber": 668, "packageName": "corerl", "artifactPath": ".goocastle/evidence/issue-668.png", "runtime": { "executable": "corerl", "invocation": { "file": "corerl", "args": [ "--smoke" ] }, "successMarker": "CORERL_RUNTIME_OK" } } ] } ```  --- Imported from [GitHub issue/PR](https://github.com/htayj/guix-channel/issues/668). Originally posted by [htayj](https://github.com/htayj) on 2026-09-02T09:13:14Z.

tay referenced this issue

2026-09-02 09:13:28 +00:00

[Guix packaging] CoreRL #311

htayj commented

2026-09-02 09:59:54 +00:00

(Migrated from github.com)

Goocastle verified runtime evidence.

Runtime receipt

Package: corerl
Safe package proof phase: safe-package-proof
Safe package proof argv: ["sh",".goocastle/prove-guix-package.sh"]
Screenshot phase: runtime-screenshot
Screenshot argv: ["sh",".goocastle/capture-guix-package-screenshot.sh"]
Runtime executable (Guix store/profile): /gnu/store/86aia78x37ymlkxhzvwmhxy83la959dz-corerl-1kib-20131024/bin/corerl
Runtime invocation: ["/gnu/store/86aia78x37ymlkxhzvwmhxy83la959dz-corerl-1kib-20131024/bin/corerl","--smoke"]
Expected runtime invocation: ["corerl","--smoke"]
Expected runtime marker: CORERL_RUNTIME_OK
Per-issue runtime contract: .goocastle/runtime-evidence-contracts.json (issue #668, SHA-256 444e999f6960c60eee0a139cab3489f252f31b8b5f99b52205f40f716d74709a)
Artifact path: .goocastle/evidence/issue-668.png
Artifact SHA-256: b66ba8a9279a24371724b54fdbf506270331e5727cfe2af584ca91bc383b433b
Artifact commit: 2ff7456159d682dad9a366eb307f339da1dd1182
Artifact size/format: 6475 bytes / png

Imported from GitHub comment. Originally posted by htayj on 2026-09-02T09:59:54Z.

Goocastle verified runtime evidence. ![Runtime screenshot](https://github.com/htayj/guix-channel/blob/833b40ac337e47994b6706944c7a9cae5398558d/.goocastle/evidence/issue-668.png?raw=1) <details><summary>Runtime receipt</summary> - Package: <code>corerl</code> - Safe package proof phase: <code>safe-package-proof</code> - Safe package proof argv: <code>["sh",".goocastle/prove-guix-package.sh"]</code> - Screenshot phase: <code>runtime-screenshot</code> - Screenshot argv: <code>["sh",".goocastle/capture-guix-package-screenshot.sh"]</code> - Runtime executable (Guix store/profile): <code>/gnu/store/86aia78x37ymlkxhzvwmhxy83la959dz-corerl-1kib-20131024/bin/corerl</code> - Runtime invocation: <code>["/gnu/store/86aia78x37ymlkxhzvwmhxy83la959dz-corerl-1kib-20131024/bin/corerl","--smoke"]</code> - Expected runtime invocation: <code>["corerl","--smoke"]</code> - Expected runtime marker: <code>CORERL_RUNTIME_OK</code> - Per-issue runtime contract: <code>.goocastle/runtime-evidence-contracts.json (issue #668, SHA-256 444e999f6960c60eee0a139cab3489f252f31b8b5f99b52205f40f716d74709a)</code> - Artifact path: <code>.goocastle/evidence/issue-668.png</code> - Artifact SHA-256: <code>b66ba8a9279a24371724b54fdbf506270331e5727cfe2af584ca91bc383b433b</code> - Artifact commit: <code>2ff7456159d682dad9a366eb307f339da1dd1182</code> - Artifact size/format: <code>6475 bytes / png</code> </details> --- Imported from [GitHub comment](https://github.com/htayj/guix-channel/issues/668#issuecomment-5507807025). Originally posted by [htayj](https://github.com/htayj) on 2026-09-02T09:59:54Z.

htayj commented

2026-09-02 09:59:58 +00:00

(Migrated from github.com)

Completed by Goocastle

Imported from GitHub comment. Originally posted by htayj on 2026-09-02T09:59:58Z.

Completed by Goocastle --- Imported from [GitHub comment](https://github.com/htayj/guix-channel/issues/668#issuecomment-5507807763). Originally posted by [htayj](https://github.com/htayj) on 2026-09-02T09:59:58Z.

tay referenced this issue

2026-09-02 10:15:52 +00:00

Reverify final CoreRL runtime evidence after #668 audit repair #669