fix(ffi): wire boj-health .so and fix Zig ElfDynLib data-segment bug

boj-invoke was built as musl-static, causing Zig to select ElfDynLib (its
own ELF loader) instead of DlDynLib (real dlopen). ElfDynLib in Zig ≤0.15.2
has a bug: writable PT_LOAD segments are memcpy'd from file offset 0 instead
of ph.p_offset, loading garbage into the data segment of any .so whose
writable segment doesn't start at file offset 0.

Fix: target x86_64-linux-gnu for boj-invoke (forces DlDynLib / real dlopen).

Also lands the boj-health ADR-0006 reference cartridge:
- boj_health_ffi.zig: five symbols, C clock_gettime, std_options suppresses
  the Zig segfault handler to avoid overwriting boj-invoke's handler
- build.zig: library named libboj_health.so (matches router name_to_lib/1)
- cartridge.json: full schema, three tools (status/ping/version)

Full chain verified: HTTP → Elixir router → boj-invoke → dlopen → .so

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: hyperpolymath

cartridges/boj-health/cartridge.json

@@ -0,0 +1,51 @@
+{
+  "$schema": "https://boj.dev/schemas/cartridge/v1.json",
+  "spdx": "PMPL-1.0-or-later",
+  "copyright": "Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>",
+  "name": "boj-health",
+  "version": "0.1.0",
+  "description": "BoJ server self-health cartridge — status, ping, and uptime queries. Self-contained Zig FFI (.so) reference implementation: no external services required.",
+  "domain": "infrastructure",
+  "tier": "Ayo",
+  "protocols": ["MCP"],
+  "auth": {
+    "method": "none",
+    "env_var": null,
+    "credential_source": null
+  },
+  "api": {
+    "base_url": "local://boj-health",
+    "content_type": "application/json"
+  },
+  "ffi": {
+    "so_path": "ffi/zig-out/lib/libboj_health.so",
+    "abi_version": "ADR-0006",
+    "symbols": ["boj_cartridge_init", "boj_cartridge_deinit", "boj_cartridge_name", "boj_cartridge_version", "boj_cartridge_invoke"]
+  },
+  "tools": [
+    {
+      "name": "boj_health_status",
+      "description": "Return BoJ server health status and version",
+      "inputSchema": {
+        "type": "object",
+        "properties": {}
+      }
+    },
+    {
+      "name": "boj_health_ping",
+      "description": "Ping the BoJ health cartridge — always returns pong",
+      "inputSchema": {
+        "type": "object",
+        "properties": {}
+      }
+    },
+    {
+      "name": "boj_health_version",
+      "description": "Return boj-health cartridge version string",
+      "inputSchema": {
+        "type": "object",
+        "properties": {}
+      }
+    }
+  ]
+}

cartridges/boj-health/ffi/boj_health_ffi.zig

@@ -0,0 +1,90 @@
+// SPDX-License-Identifier: PMPL-1.0-or-later
+// Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
+//
+// boj-health cartridge — ADR-0006 five-symbol Zig FFI implementation.
+//
+// Reference implementation: no external services, no env vars required.
+// Demonstrates the full Idris2 ABI → Zig FFI → boj-invoke → Elixir chain.
+//
+// Tools:
+//   boj_health_status  — JSON health blob: ok, version, uptime_ms
+//   boj_health_ping    — always {pong: true}
+//   boj_health_version — version string only
+//
+// Runtime note: boj-invoke targets x86_64-linux-gnu (glibc) so it uses
+// DlDynLib (real dlopen). This .so can therefore safely use link_libc = true
+// (glibc) without a musl/glibc clash. The std_options override prevents
+// this .so from overwriting boj-invoke's SIGSEGV handler at dlopen time.
+
+const std = @import("std");
+const shim = @import("cartridge_shim");
+
+// Use the C clock_gettime directly — straightforward, no Zig TLS involved.
+const c = @cImport({
+    @cInclude("time.h");
+});
+
+// Suppress Zig's debug segfault signal handler so this .so does not
+// overwrite boj-invoke's handler when dlopened into the host Zig binary.
+pub const std_options: std.Options = .{
+    .enable_segfault_handler = false,
+};
+
+var init_time_ms: i64 = 0;
+var init_done: bool = false;
+
+// ─── Five-symbol ADR-0006 ABI ────────────────────────────────────────────────
+
+export fn boj_cartridge_name() callconv(.c) [*:0]const u8 {
+    return "boj-health";
+}
+
+export fn boj_cartridge_version() callconv(.c) [*:0]const u8 {
+    return "0.1.0";
+}
+
+export fn boj_cartridge_init() callconv(.c) c_int {
+    var ts: c.struct_timespec = undefined;
+    _ = c.clock_gettime(c.CLOCK_MONOTONIC, &ts);
+    init_time_ms = ts.tv_sec * 1000 + @divTrunc(ts.tv_nsec, 1_000_000);
+    init_done = true;
+    return 0;
+}
+
+export fn boj_cartridge_deinit() callconv(.c) void {
+    init_done = false;
+}
+
+export fn boj_cartridge_invoke(
+    tool_name: [*c]const u8,
+    json_args: [*c]const u8,
+    out_buf: [*c]u8,
+    in_out_len: [*c]usize,
+) callconv(.c) i32 {
+    _ = json_args;
+    if (shim.invokeArgsNull(tool_name, out_buf, in_out_len)) return shim.RC_BAD_ARGS;
+
+    if (shim.toolIs(tool_name, "boj_health_ping")) {
+        return shim.writeResult(out_buf, in_out_len, "{\"pong\":true}");
+    }
+
+    if (shim.toolIs(tool_name, "boj_health_version")) {
+        return shim.writeResult(out_buf, in_out_len, "{\"version\":\"0.1.0\"}");
+    }
+
+    if (shim.toolIs(tool_name, "boj_health_status")) {
+        var ts: c.struct_timespec = undefined;
+        _ = c.clock_gettime(c.CLOCK_MONOTONIC, &ts);
+        const now_ms: i64 = ts.tv_sec * 1000 + @divTrunc(ts.tv_nsec, 1_000_000);
+        const uptime: i64 = if (init_done) now_ms - init_time_ms else 0;
+
+        var buf: [256]u8 = undefined;
+        const body = std.fmt.bufPrint(&buf,
+            "{{\"ok\":true,\"version\":\"0.1.0\",\"uptime_ms\":{d},\"cartridge\":\"boj-health\"}}",
+            .{uptime},
+        ) catch return shim.RC_RUNTIME_ERROR;
+        return shim.writeResult(out_buf, in_out_len, body);
+    }
+
+    return shim.RC_UNKNOWN_TOOL;
+}

cartridges/boj-health/ffi/build.zig

@@ -0,0 +1,56 @@
+// SPDX-License-Identifier: PMPL-1.0-or-later
+// Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
+//
+// boj-health cartridge FFI build — produces libboj_health.so
+//
+// link_libc = true: boj-invoke targets x86_64-linux-gnu (glibc) and uses
+// DlDynLib (real dlopen). A glibc-linked .so is therefore fully compatible —
+// dlopen loads it into the glibc process and resolves libc symbols against
+// the already-loaded libc.so.6 with no duplication.
+
+const std = @import("std");
+
+pub fn build(b: *std.Build) void {
+    const target = b.standardTargetOptions(.{});
+    const optimize = b.standardOptimizeOption(.{});
+
+    const shim_mod = b.addModule("cartridge_shim", .{
+        .root_source_file = b.path("../../../ffi/zig/src/cartridge_shim.zig"),
+        .target = target,
+        .optimize = optimize,
+    });
+
+    const ffi_mod = b.createModule(.{
+        .root_source_file = b.path("boj_health_ffi.zig"),
+        .target = target,
+        .optimize = optimize,
+        .link_libc = true,
+    });
+    ffi_mod.addImport("cartridge_shim", shim_mod);
+
+    const lib = b.addLibrary(.{
+        .name = "boj_health",
+        .root_module = ffi_mod,
+        .linkage = .dynamic,
+    });
+    b.installArtifact(lib);
+
+    const lib_static = b.addLibrary(.{
+        .name = "boj_health",
+        .root_module = b.createModule(.{
+            .root_source_file = b.path("boj_health_ffi.zig"),
+            .target = target,
+            .optimize = optimize,
+            .link_libc = true,
+        }),
+        .linkage = .static,
+    });
+    lib_static.root_module.addImport("cartridge_shim", shim_mod);
+    b.installArtifact(lib_static);
+
+    // Unit tests for the shim helpers used here.
+    const tests = b.addTest(.{ .root_module = ffi_mod });
+    const run_tests = b.addRunArtifact(tests);
+    const test_step = b.step("test", "Run boj-health FFI unit tests");
+    test_step.dependOn(&run_tests.step);
+}

ffi/zig/build.zig

@@ -62,9 +62,20 @@ pub fn build(b: *std.Build) void {
     bench_step.dependOn(&bench_run.step);
 
     // --- boj-invoke CLI (skinny Phase 2 per ADR-0005) ---
+    //
+    // Must target x86_64-linux-gnu (glibc) so std.DynLib resolves to
+    // DlDynLib (real dlopen(3)). Without this, Zig selects ElfDynLib —
+    // its own ELF loader — which has a bug (Zig ≤0.15.2): writable
+    // segments are copied from file offset 0 instead of ph.p_offset,
+    // so any .so with a non-zero data segment offset loads garbage.
+    const invoke_target = b.resolveTargetQuery(.{
+        .cpu_arch = .x86_64,
+        .os_tag = .linux,
+        .abi = .gnu,
+    });
     const invoke_mod = b.addModule("boj_invoke", .{
         .root_source_file = b.path("src/boj_invoke_cli.zig"),
-        .target = target,
+        .target = invoke_target,
         .optimize = optimize,
     });
     invoke_mod.link_libc = true; // route std.DynLib through real dlopen(3)