subagent transcript
session 18e25685 · workflow wf_23df5b1c
delegated task
You are an adversarial verifier for a FreeCAD-wasm code review. A reviewer claims: SEVERITY: high CATEGORY: reproducibility-wrong-scripts-referenced F
▸ Magik
You are an adversarial verifier for a FreeCAD-wasm code review. A reviewer claims:
SEVERITY: high
CATEGORY: reproducibility-wrong-scripts-referenced
FILE: /home/magik6k/lcad-wasm/freecad-port/STATUS.md
SUMMARY: STATUS.md's Reproducibility list points at the stale dep/Qt scripts and omits the actual current-config scripts, which also live OUTSIDE the repo and are not version-controlled with the port.
DETAIL/EVIDENCE: STATUS.md:112-114 lists the reproducibility set as 'rebuild-deps-407.sh, rebuild-qt-asyncify.sh' — the emsdk-4.0.7-era and the older asyncify Qt scripts. The scripts that actually build the CURRENT shipping deps and Qt are rebuild-deps-jseh.sh and rebuild-qt-asyncify-412.sh, and both live in /opt/toolchains/ (outside freecad-port/), so they are not part of the repo/fork that is described as the reproducible artifact. toolchain/ only contains configure-stage1/2.sh, assemble-python-prefix.sh, versions.lock, patches/ — none of the dep- or Qt-build scripts. Additionally /opt/toolchains contains many parallel abandoned lineages (rebuild-deps-407.sh, rebuild-deps-wasmeh.sh, rebuild-qt-jspi.sh, rebuild-qt-jspi-jseh.sh, rebuild-qt-jspi-wasmeh.sh, rebuild-qt-asyncify.sh) with no marker of which is canonical, so a fresh operator cannot tell which pair reproduces the shipped binary.
RECOMMENDATION: Copy the actual current-config scripts (rebuild-deps-jseh.sh, rebuild-qt-asyncify-412.sh) into freecad-port/toolchain/, mark them canonical, delete or clearly quarantine the abandoned JSPI/wasm-EH/407 lineages, and update STATUS.md:112-114 to reference the real files.
Independently verify by reading the actual file(s) and running git/grep as needed (repo at /home/magik6k/lcad-wasm/freecad-port/FreeCAD, toolchain at /opt/toolchains, deploy at /home/magik6k/lcad-wasm/freecad-port/deploy-gui). Default to REFUTED if you cannot confirm the evidence. Adjust severity to what the evidence actually supports.
Fable
thinking
I need to check the specific lines in STATUS.md and examine the toolchain directory to figure out which scripts are the authoritative versions.
Fable
⚙ Bash {"command": "sed -n '100,130p' /home/magik6k/lcad-wasm/freecad-port/STATUS.md", "description": "Read STATUS.md reproducibility section"}
Fable
⚙ Bash {"command": "ls -la /home/magik6k/lcad-wasm/freecad-port/toolchain/ 2>&1; echo \"---OPT---\"; ls -la /opt/toolchains/ 2>&1", "description": "List toolchain dirs"}
Fable
thinking
I've confirmed that STATUS.md lines 112-114 do reference those older script names. Now I need to check whether the current shipping versions have different names, verify they're located outside the repo in /opt/toolchains, and confirm the toolchain directory doesn't contain the dependency or Qt build scripts.
Looking at the actual toolchain directory, it has configure and assembly scripts plus some utility files, but no rebuild-deps or rebuild-qt scripts as expected. To determine which script pair is actually current, I'm checking timestamps and examining what STATUS.md describes as the shipping configuration — the recent modification dates on the deps and the asyncify variant suggest those …
Fable
⚙ Bash {"command": "sed -n '1,60p' /home/magik6k/lcad-wasm/freecad-port/STATUS.md", "description": "Read STATUS.md top"}
Fable
⚙ Bash {"command": "grep -niE 'emsdk|4\\.0\\.(7|12)|asyncify|jspi|jseh|wasm.?eh|js.?exception|exception' /home/magik6k/lcad-wasm/freecad-port/STATUS.md", "description": "Find config keywords in STATUS.md"}
Fable
thinking
Looking at the STATUS.md from the latest session, the winning configuration uses emsdk 4.0.12 with qt-asyncify and JS-EH dependencies, not the 4.0.7 version I might have been considering. The scripts that actually built this winning setup are rebuild-deps-jseh.sh and rebuild-qt-asyncify-412.sh (both from July 4), which are different from the older rebuild-deps-407.sh and rebuild-qt-asyncify.sh listed in the reproducibility section. I need to check these scripts directly to confirm that jseh corresponds to JS-EH and 412 corresponds to emsdk 4.0.12, and verify what EH mode each one uses.
Fable
⚙ Bash {"command": "for f in rebuild-deps-407.sh rebuild-deps-jseh.sh rebuild-qt-asyncify.sh rebuild-qt-asyncify-412.sh; do echo \"===== $f =====\"; grep -niE 'emsdk|4\\.0\\.(7|12)|jspi|asyncify|-fwasm-exceptions|-sSUPPORT_LONGJMP|WASM_EXCEPTIONS|…
Fable
thinking
So the ASYNCIFY + JS-EH + emsdk 4.0.12 configuration is the current winner according to the status file, and there are build scripts like rebuild-deps-jseh.sh that handle compiling the C++ dependencies with JavaScript exceptions for this specific setup.
Looking at what STATUS.md actually lists for reproducibility, it points to older scripts—rebuild-deps-407.sh using the stale 4.0.7 version and rebuild-qt-asyncify.sh without the JS-EH fixes—which don't match the current shipping configuration. The actual working scripts live in /opt/toolchains outside version control, not in the freecad-port repository itself. And there are multiple abandoned rebuild variants scattered around (rebuild-deps-w …
Fable
All factual claims verified. STATUS.md lines 112-114 do list `rebuild-deps-407.sh, rebuild-qt-asyncify.sh`, and these are the stale/superseded scripts.
The current shipping config per STATUS.md's own Session 2 "WINNER" (lines 21-23): "ASYNCIFY + JS-EH + forced JS call-trampoline... Built on emsdk 4.0.12, qt-asyncify, JS-EH deps." The scripts that actually produce this are:
- `rebuild-deps-jseh.sh` — header: "Rebuild all C++ deps with JS exceptions for the JSPI+JS-EH build. emsdk 4.0.12" (matches "JS-EH deps" on 4.0.12)
- `rebuild-qt-asyncify-412.sh` — header: "Rebuild Qt with ASYNCIFY + JS-EH" (matches "qt-asyncify")
The listed scripts are demonstrably wrong: `rebuild-deps-407.sh` = "emsdk 4.0.7", `rebuild-qt-asyncify.sh` (Jul 3 21:52) lacks the JS-EH `-fexceptions`/try_table condition-drop fix present in the -412 variant. Timestamps confirm the -412/-jseh scripts are the ones matching the freshly-built `qt-asyncify`/deps dirs.
Both current scripts live in `/opt/toolchains/` (outside `freecad-port/`); `toolchain/` contains only configure-stage1/2.sh, assemble-python-prefix.sh, versions.lock, patches/ (plus run-freecadcmd.js, t1-smoke.py) — no dep- or Qt-build scripts. The many abandoned lineages (407, wasmeh, jspi, jspi-jseh, jspi-wasmeh, asyncify) are all present with no canonical marker.
The one minor overstatement: the claim says toolchain/ "only contains configure-stage1/2.sh, assemble-python-prefix.sh, versions.lock, patches/" — it also has run-freecadcmd.js and t1-smoke.py, but this doesn't affect the substance (no build scripts there).
Severity: this is a documentation/reproducibility-accuracy defect, not a runtime bug. It genuinely misleads a fresh operator away from reproducing the shipped binary, but it does not affect the running artifact. Medium is the accurate level; high is somewhat inflated for a doc issue.
Fable
⚙ StructuredOutput {"verdict": "CONFIRMED", "reason": "Verified against the files. STATUS.md:112-114 lists `rebuild-deps-407.sh, rebuild-qt-asyncify.sh` as the reproducibility set. STATUS.md's own Session 2 \"WINNER\" (lines 21-23) declares the shipping confi…