[LunaStev]

Summary

Vex projects gain reproducible multi-package workflows, safe manifest editing, explicit tests and verified build reuse. Repository automation moves from x.py to Meson while Cargo remains responsible for Rust dependencies, compilation and incremental build decisions.

Changes

• Share verified immutable Git objects through per-user/VEX_CACHE_HOME storage, repository OS locks, corruption quarantine and independent project checkouts. Support offline restoration, explicit cache pruning and repository subpackages with traversal/symlink escape checks.
• Add format 4 package SemVer/version_req, separate import aliases from concrete identities, and lock v4. Preserve legacy manifest meaning and valid locked files without implicit conversion. Lock union activation graphs and build selected target contexts with additive features.
• Coordinate explicit workspace members/exclude/default_members, package/workspace selection, root-owned locking/output and per-member execution directories. Preflight selected packages before compilation and release project leases before program spawn.
• Add explicit-name new with opt-in Git initialization, token-range add/remove preserving comments/formatting, journaled manifest/lock recovery, and help/completions/manpage generation from one command specification.
• Run declared main-based test executables with test-only dependencies, name filters, human results and JSONL test_result records. Execute all selected tests deterministically, preserve the first program failure code and never cache execution results.
• Reuse builds only when content fingerprints cover source and dependency inputs, compiler/runtime closure, features, target/profile and declared native inputs. Validate cached contents, copy independent run generations and miss safely for unverified inputs.
• Enforce own-source MPL/SPDX headers, line-ending rules and author-matching DCO trailers in the read-only Quality job. Check contribution history without bot exemptions; retain the narrow verified GitHub merge exception.
• Cross-build RISC-V/LoongArch tests, release binaries and compiler fixtures on amd64 with a digest-pinned GNU SDK. Execute complete target process trees in pinned QEMU userspaces, retaining debug assertions/overflow checks, fixture hashes, ELF checks and separate build/runtime evidence. Keep checkout/API credentials out of containers.
• Remove the x.py entry point. Meson owns build/test/quality/release sequencing, explicit release target selection and fail-fast dependencies. Dedicated Python helpers retain deterministic archive creation, exact binary version/help validation, atomic publication, checksums and release-source validation. Every build request reaches Cargo; Meson stamps cannot conceal source changes or a later failed build.
• Migrate CI and release workflows for all nine platforms to Meson without changing required job names or acceptance scope. Keep guest packaging independent of a target Rust compiler, reject development verifier overrides for official local releases and reset development options in acceptance configurations.

Validation

• CI run 40628920253 passed all ten checks for head 4ac6f1630323e6a8e30549f982b11453f047c47c: Quality and all nine platform acceptance jobs (Linux amd64/arm64/riscv64/loongarch64, macOS amd64/arm64, Windows amd64/arm64 and FreeBSD amd64).
• All nine downloaded acceptance reports validate against the tested PR merge source 4190c48b963d80dfda3215ff1b94f1d765da0139, containing this head and the current base. Compiler archive digests, target identities, cross SDK/runtime evidence and fixture source hashes match the declared inputs.
• Local Meson check passed: Python tooling tests (60), workspace Rust tests (332), formatting, Clippy with warnings denied and workspace build. A legacy package identity beginning with 00 remains byte-identical across the SHA-2 upgrade.
• Local Meson Quality passed: 104 locked packages audited, no findings and no exceptions, plus source/workflow policy, Markdown links, a 2,000-case parser mutation corpus, formatting and Clippy. DCO verified across all contribution commits.
• Complete local Linux amd64 acceptance passed with verified public Wave 0.2.1-pre-beta, package/re-export/alias/feature/workspace/test smoke, packaged binary version/help and C/C++/Rust inputs plus Wave object/shared consumers. The CI jobs retain that full scope on all native/VM/QEMU platforms and exercise target doctest/debug/overflow probes on both cross-built lanes.

The audit blocker GHSA-qwgh-2vcv-g2f7 is resolved by upgrading sha2 to 0.11.1 and its transitive block-buffer to 0.12.1, with Cargo.lock and complete dependency notices regenerated. Existing lowercase, zero-padded SHA-256 identities/checksums are preserved.

FreeBSD now bootstraps pip from Python 3.11's bundled ensurepip in its isolated venv instead of requesting the unavailable py311-pip package. Its complete CI acceptance passes. The supported Rust toolchain remains 1.96.0.

Compatibility boundaries

Wave still exposes a global dependency map. Distinct aliases and separate workspace compiler invocations work; conflicting transitive uses of one import name for different package sources are rejected. Compiler-scoped coexistence acceptance remains under #58.

Tests initially use normal executables with main; Wave-native unit-test syntax/harness remains pending under #60. Freshness establishes dynamic compiler/runtime closure on Linux ELF hosts. Unknown SDK/custom-linker/native inputs, implicit hosted system links and hosts with unverified runtime closure compile normally without reuse.

Closes #29
Closes #57
Closes #132
Closes #51
Closes #55
Closes #56
Closes #30
Closes #28
Closes #50
Closes #63
Closes #59
Closes #77
Closes #82
Closes #84
Refs #58, #60