v2: a fetch-only registry call (#492), chtypes resolve (#493) and chtypes prune (#494), in all four bindings

[EricAndrechek]

Pre-lock items #492, #493 and #494, in all four bindings, on v2. None of them needs a C-ABI entry or argument: fetch and resolve run entirely in each binding's own OCI layer (the library is first touched at load, which neither reaches), and the in-use signal is a file lock on the cache, not an ABI call. The fingerprint and the header are unchanged (gen.py --check, --major 2 --check).

What it adds

A fetch-only call (#492). The registry's fetch is the library counterpart of chtypes fetch: it resolves, fetches, verifies and installs the build a request names, and opens nothing (no dlopen, no setup, nothing in the memo or libraries()). It honors the registry's fetch options, its errors are the fetch codes, and it returns the fetch layer's Resolved (version, build, digests, library path).

binding	spelling
Go	(*Registry).Fetch(ctx context.Context, request string) (Resolved, error)
Python	Registry.fetch(request: str) -> Resolved
TypeScript	registry.fetch(request: string): Promise<Resolved>
Rust	Registry::fetch(&self, request: &str) -> Result<Resolved>

A concurrent fetch and open of one request share one fetch: the open's fetch now runs through a per-request table of fetches in progress that fetch uses too (#491's single flight, extended).

chtypes resolve <spelling> [--json] [--offline] (#493). What the spelling resolves to on every platform the index offers: the index (through the dev channel's alias first), then each platform manifest by digest and its signed statement, verified exactly as a fetch verifies it. No layer is requested and nothing is written. Output, byte-identical in all four CLIs:

resolved <version> <platform> <build> <manifest>

or, with --json, one line: [{"platform":"linux-amd64","version":"26.8.15.10","build":"20261001.183455","manifest":"sha256:…"},…]. --offline answers from the cache (each platform's resolve_installed); nothing installed is CHTYPES_ARTIFACT_MISSING.

chtypes prune [--line <line>] [--keep <n>] [--dry-run] (#494). Removes each (platform, line)'s installed builds older than its newest n (default 1): the entry and its record, its index.json entries, and its blobs (manifest, config, layer, and its referrers with their layers), never a blob a remaining build names. Cache only, never a system directory; on the dev channel only its own fingerprint's builds, so another SDK's are neither removed nor counted. Output: pruned|would-prune|in-use <version> <platform> <dir> lines, then a summary on stderr.

The in-use signal (new; the cache had none). A registry holds every build it opens or fetches with flock(LOCK_SH) on the entry's verified.json, taken before the library is read and kept until the process exits; prune takes flock(LOCK_EX|LOCK_NB) on the same file and keeps any build it cannot lock, renaming a claimed entry aside before it drops the lock, so a hold taken after finds it gone and the registry looks once more. flock is per open file description, so the same rule holds within one process and across all four bindings; the kernel drops a dead process's locks. TypeScript reaches flock through the generated libc declarations (scripts/abi-v1/emit/ts.py), Rust through the libc crate.

Tests

• Conformance, both corpora (genfixtures, --abi=2): resolve-build-{line,exact,partial-index,untrusted,unpublished,offline,offline-miss,dev-alias} (every online case forbids each layer GET in requests.none_matching) and prune-{keep-newest,keep-two,line,dry-run,in-use,system-dirs-never,foreign-fingerprint-untouched,v1-channel-sees-all}. The schema gains setup.held, request.prune, expect.resolutions and expect.prune.
• Per binding: fetch installs without opening (bytes that are no library: fetch succeeds, nothing loaded, setup not latched), and a fetch and an open of one request make one tag GET and one layer GET (the fixture server's gate and log); the CLI's resolve and prune over the fixtures' basic tree; Go also holds a build from a second process and shows prune keeps it until that process exits.

Gates

Run locally on darwin-arm64, each alone and unpiped, every one exit 0 (measured):

• Go: go test ./...; go test -race on internal/ocifetch and chtypes (also with the ABI v2 stubs built by build-stubs.sh); TestConformanceV1 and TestConformanceProdV2, 325 results over 183 cases each, the 24 new results among them passing.
• Python: uv run pytest -q (487 passed, 244 skipped without stubs; tests/abi2 with the stubs: 285 passed); the conformance suite on both corpora, 325/325 each, 24/24 new; ruff check, ruff format --check.
• genfixtures --check (v1 and --abi=2) and --selftest; server.py --selftest; schema_check.py; staging.py --selftest; parity.py --selftest.
• gen.py --check and --major 2 --check (fingerprint sha256:d60a681e… and header unchanged); gen-constants.py --check; check-no-hand-decls.py --scope all.
• check-cli-parity.sh --selftest (the new planted --keep 0 is caught), and go and python match expected.txt (34 cases); parity-surface.py --selftest, run --only go python (0 findings), --check-issues.
• lint-public, lint-spelling, lint-cited-paths, lint-actions, check-selftests-wired.py, markdownlint, dprint check, rustfmt --edition 2024 --check; policy-merge-check.py --check-ci-names and --check-guide.

TypeScript and Rust were not built or tested locally (CI only, per the lane rules); rust/Cargo.lock gains only libc in the crate's own dependency list (cargo metadata --offline, no build).

Refs #492
Refs #493
Refs #494

🤖 Generated with Claude Code