Build: enforce owned local dependencies and offline builds

Parent: #459

Goal

Enforce a zero-unowned-production-dependency policy: zig-js may depend only on Zig's standard library/toolchain and owner-maintained sibling repositories resolved locally under ~/Code/**.

The engine dependencies already use local ../zig-regex and ../zig-gc. Documentation deliberately uses the owner-maintained BunPress ecosystem from ../../Tools/bunpress; defects and missing capabilities belong in those source repositories rather than in replacement code inside zig-js.

Required policy

• Classify every external edge as exactly one of: Zig/compiler toolchain; standard platform SDK/runtime interface; owner-maintained local build/runtime dependency; explicit checksum-pinned test/conformance/benchmark oracle; generated-data acquisition input; or prohibited/unclassified. The classification states whether it can affect shipped semantics.
• Production Zig package dependencies are an explicit allowlist of owner-maintained local paths; initially ../zig-regex and ../zig-gc.
• Owner-maintained tools and libraries under ~/Code/Tools and ~/Code/Libraries remain dependencies and are improved at their source. Do not replace them merely to reduce dependency count.
• No unowned network dependency resolution, vendored third-party runtime/library, C/C++ engine, opaque binary, or system JavaScript engine may enter the library or its normal build.
• Platform SDK/runtime APIs required to expose a platform feature (for example Foundation/Objective-C on macOS) are declared separately from portable engine dependencies and must not provide JavaScript semantics.
• System JavaScriptCore and external standards corpora remain differential/conformance/benchmark oracles only, behind explicitly named non-library targets.
• Generators must consume checked-in, checksum-pinned inputs or explicit one-shot acquisition commands; ordinary builds and tests do not fetch the network.
• CI sibling checkouts use exact owner-maintained revisions and the same local-path graph as development.
• Repository Python and semantic shell implementation tools migrate under #497. JavaScript/TypeScript tools that are part of an owner-maintained package remain in that package and are improved there; unowned registry/runtime/bootstrap edges still require an explicit pin and classification.
• WABT, wasm-tools, upstream engines, and standards corpora may remain explicit pinned test/benchmark oracles, but never enter the normal package graph, shipped library, ordinary offline build, or source of runtime semantics.

Audit

• Scan build.zig.zon, Zig imports, link directives, C/Objective-C includes, package manifests, scripts, subprocesses, dynamic loading, and generated-file provenance.
• Fail on an unclassified dependency edge or network access from a normal build/test/docs command.
• Produce a machine-readable inventory with owner, purpose, scope, local path, pin, license, and whether it can affect runtime semantics.

Acceptance

• A CI gate rejects any unapproved dependency/link/fetch edge.
• The normal library build succeeds with network disabled and only owner-maintained sibling checkouts present.
• libffi removal is completed in #463.
• BunPress is consumed and improved as an exact owner-maintained local dependency in #464.
• Repository Python/semantic-shell gates, generators, audits, and publication tools migrate under #497 without deleting owner-maintained packages.
• README, build.zig.zon, and developer docs state the exact policy without claiming that test-only standards inputs are production dependencies.
• No compatibility shim or fallback weakens a feature merely to avoid implementing its owned replacement.
• Toolchain, owner-maintained dependency, platform SDK, test oracle, acquisition input, and shipped dependency boundaries are machine-readable and fail on ambiguity.

Foundation

The local-path dependency graph is established in build.zig.zon; the engine/JSC separation is documented in README and enforced by the separate comparison executables.

Landed the independently actionable #462 foundation in 6adf47fe.

Implemented:

• versioned machine-readable classification for production, platform, oracle, acquisition, tooling, manifest, and CI edges, including runtime-semantics rulings;
• a Zig-native fail-closed audit covering local package paths, module imports, framework/system links, build subprocesses, tracked manifests and lock evidence, script/runtime counts, network-capable scripts, submodule gitlinks, CI actions, exact corpus revisions, download checksums, and dynamic/network production-source edges;
• a required CI leg and exact CI revisions for zig-regex and zig-gc at the same local sibling paths used by developers;
• the documented ownership and change policy.

Verification: live audit passes; a deliberate unclassified link is rejected; normal zig build passes under a macOS deny-network sandbox; docs links and the 49-page site build pass.

Keeping #462 open: libffi removal (#463), docs-chain replacement (#464), and Python/JS/shell plus legacy acquisition/CI-bootstrap migration (#497) remain explicit migration_required violations. They are gated and visible, not exemptions or workarounds.

Child #463 implementation is now on main in 63ccdb26: the libffi edge and all include/link/call references are gone, replaced by the owned Zig plus Darwin AArch64/x86-64 dispatcher. The #462 inventory now has 14 active/classified edges and 6 migration_required groups; libffi is no longer one of them.

#463 remains open only for its quiet AC-powered performance gate. #462 still remains open for #464 and #497.

Dependency migration update: #464 is complete in 418b51ef. The BunPress/npm docs chain and Bun CI bootstrap are gone. Docs now build and preview offline through the in-tree Zig tool, with 49 pages / 128 assets / 183 deterministic outputs covered by a checked tree hash. The dependency audit now reports 13 classified edges and 4 migration targets (down from 6). #462 remains open for the remaining owned-dependency migrations, including #497.

Policy correction and owned-docs progress landed in cc4ba5ff. BunPress is owner-maintained and is now classified as an allowed exact local dependency, not a prohibited third-party chain. Its source improvements are linked from #464.

The audit now uses the general owner_maintained_local class, ties the local package resolution to the exact stacksjs/bunpress CI checkout revision, and reports 14 classified edges / 5 remaining migration targets. #462 remains open for the remaining bootstrap, transitive-resolution, and #497 work.

The owned docs boundary advanced in zig-js 56ba547 and BunPress dd82b74. The BunPress runtime dependency declarations and lock are now complete, renderer failures fail closed, deterministic output is checked, and zig-js records the exact upstream revision in the machine-readable inventory. #464 remains open until owned companion-library source resolution is local/pinned end to end; #497 still owns the repository implementation-tool migrations.

Owned documentation dependency work is complete in dd0c423b, and #464 is closed.

The dependency audit now pins and classifies the complete BunPress/STX/ts-syntax-highlighter sibling graph; exact Linux CI and network-denied local builds are green. The audit remains at 14 classified edges and 4 migration targets. The remaining repository-tool/runtime migrations stay tracked by #497; flips 0 test262 cases.

b6745030 fixes the docs Required Check without weakening the owned dependency boundary.

docs-link-check configures the repository Zig graph, so the docs job now checks out the pinned owned zig-regex and zig-gc siblings at the exact local paths declared by build.zig.zon, alongside the existing owned BunPress/STX/ts-syntax-highlighter graph. Local validation: 89 documentation files, all links resolve. Test262 flips: 0.

Follow-up CI evidence for b6745030: the actual docs Required Check completed successfully with the owned sibling graph present.

#462 acceptance is now complete. The final inventory reconciliation landed in https://github.com/zig-utils/zig-js/commit/5be57aa8cd074b342a443c510d8653bf45e7ed54 and the fail-closed audit reports 14 classified edges, 59 classified repository tools, and 0 migration targets.\n\nCurrent proof against the checklist:\n- dependency-audit is a Required Check and rejects unclassified package, link, subprocess, script-runtime, fetch, submodule, action, and dynamic-loading edges;\n- the network-denied normal build with only the pinned owned sibling graph was recorded earlier in this issue and the current inventory preserves that graph;\n- libffi and its include/link/call edges were removed by #463 implementation; #463 remains open only for its independent quiet-host performance evidence;\n- the owned BunPress/STX/ts-syntax-highlighter local graph is complete and #464 is closed;\n- durable repository tooling migrated to TypeScript on Home and #497 is closed;\n- README/build.zig.zon/developer documentation and both machine-readable inventories state the production, platform, owned-tooling, oracle, acquisition, and shipped-semantics boundaries;\n- there are no compatibility shims, fallback engines, or unresolved migration exemptions.\n\nThe latest audit, benchmark validation graph, 93-file docs link check, and reproducible 49-page docs build all pass. Test262 flips: 0.