# Legacy comparison status

## Current native semantic-comparison baseline

The native builder can collect portable semantic facts directly from either a
rootfs tar archive or its companion manifest and compare:

- package name/version records when supplied by a build manifest;
- regular-file SHA-256 digests, symlinks, and hardlinks;
- RT initrd path and SHA-256 digest;
- enabled systemd service symlinks; and
- archive member paths and kinds.

Legacy tar paths using a leading `./` are normalized before comparison. Hasher
metadata paths containing `.host` or `.fakedata` are excluded on both sides.
This comparison deliberately does not claim byte-for-byte tar equivalence.

Validated native plan command:

```text
$ cargo run -- plan --spec profiles/alt-controller.toml
target: alt-controller
architecture: x86_64
format: tar
stages:
  1. resolve
  2. install
  3. finalize-rootfs
  4. initramfs
  5. package
  6. manifest
```

## Current blocker: unavailable Clippy component

The required lint and formatting validations cannot run in the installed Rust
toolchain. Exact command output from this workspace:

```text
$ cargo clippy -- -D warnings
error: no such command: `clippy`

help: view all installed commands with `cargo --list`
help: find a package to install `clippy` with `cargo search cargo-clippy`

$ cargo fmt --check
error: no such command: `fmt`

help: a command with a similar name exists: `fix`

help: view all installed commands with `cargo --list`
help: find a package to install `fmt` with `cargo search cargo-fmt`
```

On the latest validation run, `cargo test` completed successfully (63
integration tests) before `cargo clippy -- -D warnings` reported the missing
component above. The corrective action is to install the Clippy and rustfmt
components/packages for this toolchain, then run:

```text
cargo clippy -- -D warnings
cargo fmt --check
```

## Verification-runner readiness mismatch

The workspace-level verifier correctly completed the Rust build and test
phases, but its detected web-service readiness probe is not applicable to this
CLI binary. Exact command evidence from this workspace:

```text
$ hermes verify --json
{"recipe":"Rust project","ok":false,"phases":[{"phase":"build","command":"cargo build","exitCode":0,"ok":true},{"phase":"test","command":"cargo test","exitCode":0,"ok":true}],"readiness":{"url":"http://127.0.0.1:8000/","ready":false,"error":"<urlopen error [Errno 111] Connection refused>"}}
```

The launched `alt-controller-image` process printed its Clap command help and
exited normally; it is not an HTTP server and intentionally does not listen on
port 8000. The corrective action is to configure the verifier for this CLI as
a build-and-test-only Rust project, without an HTTP readiness probe. Until
then, `cargo build --release`, `cargo test`, and explicit CLI smoke commands
are the applicable project validations.

## Next comparison action

Produce a native Controller artifact in an isolated workspace, collect its
companion manifest, and run `alt-controller-image compare` against the observed
legacy Controller tarball. Record every semantic delta as deliberate or
unresolved in this document.

## Current native build blocker: unavailable Hasher privilege helper

The native CLI reached its typed `HasherInstaller` boundary and invoked `hsh`
without invoking GNU Make, `mkimage`, or `mkimage-profiles`, but this host does
not permit Hasher's installed privilege helper to run. Exact command evidence:

```text
$ ./target/release/alt-controller-image build --spec profiles/alt-controller.toml --workspace /mnt/hermes-workspace/alt-controller-native-work-20260812 --output /mnt/hermes-workspace/alt-controller-native-20260812.tar
hsh: /usr/libexec/hasher-priv/getconf.sh: cannot access getconf helper.
error: hsh exited with exit status: 1
```

No workspace, tarball, or companion manifest was produced, so no native versus
legacy semantic comparison can honestly be recorded yet. The next corrective
action is to run the same native CLI build in an environment where the host's
Hasher privilege helper is usable (or have the host Hasher installation repaired),
then inspect its generated companion manifest and compare it with the observed
legacy Controller tarball.