Self-hosted fixed-point verification
How Prismio compares compiler generations, seed output, deterministic IR, and packaged toolchains to protect bootstrap trust.
Last verified
A self-hosted compiler can reproduce the same bug across generations. Fixed-point agreement is a determinism and bootstrap check, not a proof of semantic correctness.
The target-neutral committed seed builds an initial native compiler. That generation compiles the current source into the next, which compiles it again. Relevant emitted compiler IR is compared between successive generations.
python3 tools/bootstrap.py --seed --out build/gen0
python3 tools/bootstrap.py --compiler build/gen0 --out build/gen1
python3 tools/bootstrap.py --compiler build/gen1 --out build/gen2Generate compiler IR with both later generations and compare the normalized artifacts. A mismatch can come from nondeterministic iteration, unstable symbol identity, uninitialized state, target metadata, or a genuine compiler semantic difference.
Seed agreement asks a separate question: can the pinned bootstrap seed still reach the current source and expected generation? Refreshing the seed requires a trusted deterministic compiler and should never be used to hide unexplained divergence.
Packaging verification then ensures the result works without repository-relative sources or libraries. All three layers are required for a credible release.
Generation gate
tools/release_gate.py is the release-level implementation. bootstrap(compiler, out) invokes
the repository bootstrap path with an explicit host. check_generations builds generation one
and generation two into a private work directory. The two binaries are both executable tests; the
corresponding emitted IR carries the stronger reproducibility signal.
check_fixpoint compares normalized generation outputs. A byte-identical fixed point means the
compiler built by generation one emits the same compiler representation as the compiler built by
generation two. check_rc_reproduces additionally asks the release candidate to reproduce the
generation-one IR, preventing a separately built candidate from escaping the cycle.
check_seed bootstraps from bootstrap/seed.ll the way a new machine does and verifies it remains capable of
producing the candidate. Cutting a new seed is an explicit operation through prismio seed (tools/refresh_seed.py); it must follow reviewed source/runtime changes and a successful fixed point, and the
result is committed only when the maintainer says so.
Other release-gate functions
| Function | Gate |
|---|---|
check_source_lists | Embedded/build source inventories match the repository |
check_suite | Complete positive, negative, and specialized compiler suite |
check_differential | Native AIF agrees with the independent model |
check_corpus | Representative programs compile and run |
check_verify_sweep | Runtime ledger reports no supported lifecycle violations |
check_jit | ORC execution matches native expectations |
check_cross_target | Target triple/layout and cross artifacts behave as recorded |
check_packaging | Installed layout works without checkout-relative resources |
mnemonic_diff | Reports function-level code-shape drift for review |
Differences can come from nondeterministic declaration order, temporary paths, timestamps, uninitialized data, target defaults, hash iteration, or a real semantic change. Normalize only fields proven irrelevant to executable meaning. Never copy generation-two output over generation one to “fix” a mismatch; identify the producer of the differing bytes.