Make Whitaker installation binary-only and immutable #499

Problem

The Rust baseline train for leynos/cuprum cannot bind its Whitaker gate to an immutable, binary-only toolchain through the current install-whitaker action.

Cuprum pins leynos/shared-actions@c5a54701c8603a0fa756a6b34c49bc2af75a6c11 and installer version 0.2.7. The action downloads and checksum-verifies the tagged installer archive and has no action-level source fallback. The installed Whitaker, however, can fall back to local compilation when a prebuilt suite or dependency binary is absent or rejected:

• Whitaker v0.2.7 resolves to 2bc0c3fafb86914f14bd73461a511588841f0a34.
• installer/src/prebuilt.rs maps prebuilt-suite failures to Fallback.
• installer/src/deps/install.rs falls back from release assets to cargo binstall, then cargo install --locked.
• The CLI offers --build-only, but no binary-only or fail-on-fallback mode.

Suite provenance is also mutable. Version 0.2.7 downloads the suite from the GitHub rolling release. At inspection time that release resolved to 1aa59f0e02c69f04407d389c673e15a0e7d9d09b, nightly 2026-05-28, with Linux x86_64 archive SHA-256 f0ef6da458c493a8dee0d1d7118b529374260730aeeca25062780cd67c3335c7. The shared-action cache key contains the installer version and dylint.toml hash, but no suite revision or manifest/archive digest.

A successful consumer job can therefore build from source or reuse a cached suite from a different rolling revision. That violates the estate's binary-only CI policy and prevents a repository from recording one reproducible Whitaker rule-suite revision.

Acceptance criteria

• Provide a fail-closed binary-only installation mode covering the Whitaker suite and every dependency binary; no cargo install, cargo binstall source fallback, or local suite compilation may run in this mode.
• Pin the suite to an immutable revision or content-addressed manifest and verify every downloaded archive before extraction.
• Include the immutable suite identity and relevant archive/manifest digest in the shared-action cache key and version marker.
• Emit the installer version, suite revision, toolchain, cargo-dylint version, dylint-link version, and verified archive digests in CI evidence.
• Fail clearly on unsupported platforms or missing trusted binaries rather than silently compiling from source.
• Add cold-cache, warm-cache, missing-asset, bad-digest, and attempted-fallback contract tests.
• Preserve the existing action-level checksum verification for the installer archive.

Issue #420 concerns detection and source fallback while obtaining the installer itself. This issue covers the stricter consumer mode after that installer runs, plus immutable suite provenance and cache identity.

Impact

This blocks the final binding Whitaker layer in leynos/cuprum. Existing source-fix and formatting layers can proceed, but the train cannot claim a reproducible, binary-only Whitaker gate until this contract is available.

References

• Fix cargo-binstall presence probe in install-whitaker #420
• https://lody.ai/leynos/sessions/934d2efe-ceff-4a48-876a-6c022311b70d