[Sunrisepeak]

openkal 0.17.2 round, part 2 design §5 and §8 (mcpp platforms part 2).

okb v1 (docs/okb.md)

• An okb is a ZIP archive (ZIP64 allowed). Its images are stored, and their bytes begin at multiples of 64 KiB through a local-header field (id 0x6b6f).
• okb.json states the version, name, entry, architectures, and a sha256 for each member. okb.sig is an Ed25519 key and signature over okb.json.
• Resolution order: the architecture's directory, then the archive root, then beside the okb, lib/<arch>/, lib/, and OKRUN_PATH.
• Tools: okld bundle writes an okb, deterministically; okld bundle check checks every member, digest, signature and image.

libokrun

• okrun app.okb runs the okb. It reads the file once and uses each member in place; nothing is extracted or decompressed.
• okrun_run_okb_bytes(bytes, size, entry|NULL, argc, argv, options, why, cap) runs an okb, or any archive of images, from memory and writes nothing to disk. With options.carried, images that are not in the archive are found beside the program.
• okrun_run_images(images, count, entry, …) runs a group of images that resolve one another by name.
• okrun_open_library / okrun_open_library_bytes / okrun_symbol / okrun_close let a program of this system call an image's exports.
• Every image that is loaded, including the ones an image needs, is admitted (requirements, architecture, and the signature requirement).

openkal-bind (docs/bind.md)

A build plugin, mcpp.mcpplibs.openkal_bind. It reads a C header with clang's AST and generates a native binding: each function forwards through a sysv_abi pointer, and on x86-64 Windows callbacks get thunk pools. It also deploys the .okso.

It refuses, naming each declaration:

• long, long double, wchar_t and similar types, also through typedefs and struct fields;
• variadic and unprototyped functions;
• unprototyped callbacks;
• variables;
• functions the image does not export;
• C++ headers.

CI

The images are built once. On Linux x86_64 and aarch64, macOS and Windows, CI runs:

• the okb through okrun, plus its refusals (unsigned, changed, OKRUN_PATH);
• from memory and as a library (examples/host);
• the binding app, including a callback;
• the refusal checks.

Co-authored-by: speak-agent [email protected]