build(codex-cli): reproducible clone-and-build pipeline for the wasi fork

[NathanFlurry]

make -C toolchain codex now clones rivet-dev/codex at the pinned SHA
(toolchain/codex-ref), injects the committed wasi patch set (stubs +
std-patches/crates: path-dedot, path-absolutize, rustls-native-certs, tokio
net-stubs), vendors + build-std, and installs to software/codex/wasm. Removes
dependence on machine-specific [patch.crates-io] paths. Verified: the hard
crates compile for wasm32-wasip1; full artifact has one remaining rmcp-oauth
Send blocker (documented).

[NathanFlurry]

Stack for rivet-dev/agentos

• fix(git): resolve index-pack memory access out of bounds when cloning pushed packs #1716 xszzlvlw · 2026-07-09 13:02:17
• fix(execution): honor SOCK_NONBLOCK on host-net sockets so git push >16KiB completes #1715 urmlkuuz · 2026-07-09 11:27:59
• fix(git): WASI-safe sideband demux (no fork in fetch-pack) for HTTPS transport #1714 yxttuznk · 2026-07-09 09:33:32
• feat(wget): real HTTPS via in-guest mbedTLS backend + gzip #1713 xqrmppuq · 2026-07-09 06:32:52
• feat(git): HTTPS smart-HTTP (clone/fetch/push) via mbedTLS libcurl + real git-remote-http #1712 swtzymkt · 2026-07-09 06:32:50
• feat(curl): real in-guest TLS (mbedTLS) + gzip/brotli/zstd + CA bundle #1711 qotxnxxx · 2026-07-09 06:32:49
• feat(toolchain): build mbedTLS for wasm32-wasip1 + ship CA bundle (TLS foundation) #1710 olswtlmy · 2026-07-09 06:32:48
• docs(networking): spec for full curl/wget/git TLS + networking parity #1709 lmspssks · 2026-07-09 04:13:34
• build(codex-cli): reproducible clone-and-build pipeline for the wasi fork #1708 lruywzvy · 2026-07-09 04:13:33 👈
• docs(registry): mark codex coverage proven #1707 kyswsrtv · 2026-07-09 03:04:31
• test(opencode): add real ACP session coverage #1706 xtnuomsw · 2026-07-09 03:04:29
• test(claude): include real ACP session coverage #1705 rxmoulty · 2026-07-09 03:04:28
• test(pi-cli): enable real ACP bash coverage #1704 xqtkmsyn · 2026-07-09 03:04:27
• test(pi): enable real ACP bash coverage #1703 mzuuypsm · 2026-07-09 03:04:25
• test(core): include registry parity suites by default #1702 solxpnqv · 2026-07-09 03:04:24
• fix(everything): add valid package manifest #1701 kzzsrlkn · 2026-07-09 03:04:23
• fix(vim): move terminal shims into sysroot #1700 lnmnkups · 2026-07-09 03:04:22
• fix(file): classify scripts before magic detection #1699 zkwprmqp · 2026-07-09 03:04:21
• fix(diffutils): add recursive header and e2e #1698 kusqlnlq · 2026-07-09 03:04:20
• fix(yq): support file operands and add e2e #1697 znlmtymu · 2026-07-09 03:04:18
• test(gzip): add package e2e coverage #1696 tlstlwvy · 2026-07-09 03:04:17
• fix(tar): tighten listing parity and add e2e #1695 rszmulmk · 2026-07-09 03:04:16
• test(sed): add package e2e coverage #1694 wvpklkqv · 2026-07-09 03:04:15
• test(gawk): add package e2e coverage #1693 pzxkurol · 2026-07-09 03:04:13
• fix(jq): support file operands and add e2e #1692 slnmvuqz · 2026-07-09 03:04:12
• test(codex): unskip full-turn coverage #1691 ryqtvoqv · 2026-07-09 03:04:11
• test(duckdb): prove analytical csv e2e #1690 qrwnvouk · 2026-07-09 03:04:10
• test(git): prove quickstart log and diff e2e #1689 svltqsmx · 2026-07-09 03:04:08
• fix(findutils): build upstream uutils findutils #1688 msknmmps · 2026-07-09 03:04:07
• fix(git): build upstream git #1687 tmvlxlvk · 2026-07-09 03:04:06
• fix(infozip): build upstream zip and unzip #1686 nppnuxpr · 2026-07-09 03:04:05
• fix(ripgrep): build upstream ripgrep #1685 msypkqmo · 2026-07-09 03:04:03
• fix(grep): build upstream GNU grep #1684 uyukolvr · 2026-07-09 03:04:02
• fix(fd): build upstream fd-find #1683 mrskpomv · 2026-07-09 03:04:01
• fix(registry): drop http-get package #1682 ypuuvrmq · 2026-07-09 03:04:00
• fix(tree): build upstream tree #1681 kpmrwxln · 2026-07-09 03:03:59
• fix(sqlite3): build official SQLite shell #1680 typytnkk · 2026-07-09 03:03:57
• fix(wget): build real GNU Wget for WASI #1679 zuosnzmq · 2026-07-09 03:03:56
• build(codex-cli): make the codex-rs fork build reproducible #1678 svksnzon · 2026-07-09 03:03:55
• docs: clarify custom-sysroot build philosophy; retry wget #1677 npzzwyqr · 2026-07-09 03:03:54
• fix(wget): drop unsupported wget package #1676 mxkxpnpn · 2026-07-09 03:03:53
• fix(unzip): harden fallback archive parsing #1675 krxkqtnx · 2026-07-09 03:03:52
• fix(curl): build the real curl CLI for WASI #1674 oxoqrwvk · 2026-07-09 03:03:50
• fix(runtime): repair Wasm socket and signal integration #1673 zvyxkkyv · 2026-07-09 03:03:49
• fix(vfs): expose positioned writes in test kernel #1667 klrzzkro · 2026-07-08 07:11:50
• fix(runtime): unblock WasmVM signal waits and dispose #1666 zkywnwup · 2026-07-08 07:11:48
• test(registry): mark stdin redirection parity proven #1665 lonnzuqw · 2026-07-08 07:11:47
• fix(runtime): honor >> append mode in guest shell VFS redirection #1664 ouxrzutq · 2026-07-08 07:11:46
• chore(registry): remove vix package; document real-tool (no-reimplementation) principle #1663 wuzulpzz · 2026-07-08 07:11:44
• refactor(software): flatten registry/ into top-level software/ and toolchain/ #1662 wktwwvso · 2026-07-08 07:11:42
• refactor(tests): relocate runtime integration tests into packages/runtime-core; add test-standardization spec #1661 rwowokzx · 2026-07-08 07:11:41
• main

Get stack: forklift get 1708
Push local edits: forklift submit
Merge when ready: forklift merge 1708