Record verified Component runtime snapshot and artifact checks

scripts/check-bootstrap.py

@@ -10,7 +10,7 @@ import sys
 ROOT = Path(__file__).resolve().parent.parent
 wrapper = ROOT / ("mvnw.cmd" if os.name == "nt" else "mvnw")
 subprocess.run([str(wrapper), "--batch-mode", "--no-transfer-progress", "clean", "verify"], cwd=ROOT, check=True)
-for document in [ROOT / "README.md", ROOT / "AGENTS.md", ROOT / "THIRD-PARTY-NOTICES.md", *sorted((ROOT / "docs").glob("*.md"))]:
+for document in [ROOT / "README.md", ROOT / "AGENTS.md", ROOT / "THIRD-PARTY-NOTICES.md", *sorted((ROOT / "docs").rglob("*.md"))]:
     content = document.read_text(encoding="utf-8")
     for example in re.findall(r"```json\n(.*?)\n```", content, re.S):
         json.loads(example)

scripts/check-neitzellib-artifact.py

@@ -0,0 +1,24 @@
+#!/usr/bin/env python3
+"""Verify that the locally installed development runtime matches the tested artifact."""
+import argparse
+import hashlib
+import json
+from pathlib import Path
+import sys
+
+ROOT = Path(__file__).resolve().parent.parent
+parser = argparse.ArgumentParser(description=__doc__)
+parser.add_argument("--repository", type=Path, default=Path.home() / ".m2/repository")
+args = parser.parse_args()
+manifest = json.loads((ROOT / "docs/runtime/neitzellib-baseline.json").read_text())
+errors = []
+for artifact in manifest["artifacts"]:
+    path = args.repository / artifact["repositoryPath"]
+    if not path.is_file():
+        errors.append(f"Missing: {path}")
+    elif hashlib.sha256(path.read_bytes()).hexdigest() != artifact["sha256"]:
+        errors.append(f"Different build: {path}")
+if errors:
+    print("\n".join(errors), file=sys.stderr)
+    sys.exit("Runtime identity mismatch. See docs/runtime/neitzellib-baseline.md; do not bypass this check merely because the version is 1.0-SNAPSHOT.")
+print(f"PASS {len(manifest['artifacts'])} runtime artifacts match tested source {manifest['sourceRevision']}; no corrected release version is claimed")