feat: Linux/cloud platform stack (TLS, registry, static/cross, selfhost PM)

Ship the QUALITY_PLAN platform focus: thin/minimal runtime, --static/--target,
Nexus HTTPS/mTLS with graceful stop, lock checksums + install --locked,
selfhost registry (search/add/HTTP), containers, and CI smokes for cloud path.

tools/smoke_registry.sh

@@ -1,6 +1,5 @@
 #!/usr/bin/env bash
-# Smoke: registry search + add + install + build with greet package (E.1)
-# Also verifies HTTP-fetchable registry index (E.1b).
+# Smoke: registry search + add + install + lock reproducibility + HTTPS (E.1 / session 79)
 set -euo pipefail
 ROOT="$(cd "$(dirname "$0")/.." && pwd)"
 BUXC="$ROOT/buxc"
@@ -12,11 +11,16 @@ fi
 
 TMP=$(mktemp -d)
 HTTP_PID=""
+HTTPS_PID=""
 cleanup() {
   if [[ -n "$HTTP_PID" ]]; then
     kill "$HTTP_PID" 2>/dev/null || true
     wait "$HTTP_PID" 2>/dev/null || true
   fi
+  if [[ -n "$HTTPS_PID" ]]; then
+    kill "$HTTPS_PID" 2>/dev/null || true
+    wait "$HTTPS_PID" 2>/dev/null || true
+  fi
   rm -rf "$TMP"
 }
 trap cleanup EXIT
@@ -60,20 +64,67 @@ echo "=== bux add greet ==="
 grep -q greet bux.toml
 cat bux.toml
 
-echo "=== bux install ==="
+echo "=== bux install (with checksum) ==="
 "$BUXC" install
 test -f bux.lock
 grep -q greet bux.lock
+grep -q Checksum bux.lock
 cat bux.lock
+cp bux.lock "$TMP/lock1"
+
+echo "=== lock reproducibility (second install) ==="
+"$BUXC" install
+# Source path + version + checksum must match
+diff -u "$TMP/lock1" bux.lock
+
+echo "=== bux install --locked ==="
+"$BUXC" install --locked
+
+echo "=== install --locked fails without lock ==="
+rm -f bux.lock
+if "$BUXC" install --locked 2>"$TMP/locked_err"; then
+  echo "error: expected --locked to fail without lock" >&2
+  exit 1
+fi
+grep -qi 'missing\|locked' "$TMP/locked_err"
+"$BUXC" install
+test -f bux.lock
+
+echo "=== checksum mismatch detected ==="
+# Corrupt checksum
+python3 - <<'PY'
+from pathlib import Path
+p = Path("bux.lock")
+t = p.read_text()
+# flip last hex nibble of Checksum line if present
+lines = []
+for line in t.splitlines():
+    if line.startswith("Checksum"):
+        # Checksum = "abcdef..."
+        import re
+        m = re.search(r'"([0-9a-fA-F]+)"', line)
+        if m:
+            h = m.group(1)
+            h2 = h[:-1] + ("0" if h[-1] != "0" else "1")
+            line = f'Checksum = "{h2}"'
+    lines.append(line)
+p.write_text("\n".join(lines) + "\n")
+PY
+if "$BUXC" install --locked 2>"$TMP/csum_err"; then
+  echo "error: expected checksum mismatch failure" >&2
+  exit 1
+fi
+grep -qi 'checksum' "$TMP/csum_err"
+# restore good lock
+"$BUXC" install >/dev/null
 
 echo "=== bux run ==="
 "$BUXC" run . | tee "$TMP/run.out"
 grep -q "Hello, Bux!" "$TMP/run.out"
 
 # --- HTTP registry index ---
-echo "=== HTTP registry index (E.1b) ==="
+echo "=== HTTP registry index ==="
 mkdir -p "$TMP/http"
-# Absolute file: path so resolution works after download to ~/.bux/cache
 cat > "$TMP/http/registry.toml" <<EOF
 [[package]]
 name = "greet"
@@ -82,14 +133,12 @@ source = "file:$ROOT/registry/packages/greet"
 description = "HTTP-served greet package"
 EOF
 
-# Free port via python
 PORT=$(python3 -c 'import socket; s=socket.socket(); s.bind(("127.0.0.1",0)); print(s.getsockname()[1]); s.close()')
 (
   cd "$TMP/http"
   python3 -m http.server "$PORT" --bind 127.0.0.1 >/dev/null 2>&1
 ) &
 HTTP_PID=$!
-# Wait until server responds
 for _ in 1 2 3 4 5 6 7 8 9 10; do
   if curl -fsS "http://127.0.0.1:${PORT}/registry.toml" >/dev/null 2>&1; then
     break
@@ -101,9 +150,43 @@ export BUX_REGISTRY="http://127.0.0.1:${PORT}/registry.toml"
 export BUX_REGISTRY_REFRESH=1
 "$BUXC" search greet | tee "$TMP/http_search.out"
 grep -q greet "$TMP/http_search.out"
-grep -q "http://127.0.0.1" "$TMP/http_search.out" || grep -q "cached" "$TMP/http_search.out"
 unset BUX_REGISTRY_REFRESH
-# Second search should hit cache without refresh
 "$BUXC" search greet | grep -q greet
 
-echo "PASS: registry smoke (local + HTTP search + add + install + build)"
+# --- HTTPS registry (self-signed) ---
+echo "=== HTTPS registry index (self-signed + BUX_REGISTRY_INSECURE) ==="
+mkdir -p "$TMP/https"
+cp "$TMP/http/registry.toml" "$TMP/https/registry.toml"
+openssl req -x509 -newkey rsa:2048 -nodes \
+  -keyout "$TMP/https/key.pem" -out "$TMP/https/cert.pem" \
+  -days 1 -subj "/CN=localhost" 2>/dev/null
+
+SPORT=$(python3 -c 'import socket; s=socket.socket(); s.bind(("127.0.0.1",0)); print(s.getsockname()[1]); s.close()')
+python3 - <<PY &
+import http.server, ssl, os
+os.chdir("$TMP/https")
+httpd = http.server.HTTPServer(("127.0.0.1", $SPORT), http.server.SimpleHTTPRequestHandler)
+ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
+ctx.load_cert_chain("$TMP/https/cert.pem", "$TMP/https/key.pem")
+httpd.socket = ctx.wrap_socket(httpd.socket, server_side=True)
+httpd.serve_forever()
+PY
+HTTPS_PID=$!
+for _ in 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15; do
+  if curl -kfsS "https://127.0.0.1:${SPORT}/registry.toml" >/dev/null 2>&1; then
+    break
+  fi
+  sleep 0.15
+done
+
+export BUX_REGISTRY="https://127.0.0.1:${SPORT}/registry.toml"
+export BUX_REGISTRY_REFRESH=1
+export BUX_REGISTRY_INSECURE=1
+"$BUXC" search greet | tee "$TMP/https_search.out"
+grep -q greet "$TMP/https_search.out"
+grep -q "https://" "$TMP/https_search.out" || grep -q "cached" "$TMP/https_search.out"
+unset BUX_REGISTRY_INSECURE
+unset BUX_REGISTRY_REFRESH
+unset BUX_REGISTRY
+
+echo "PASS: registry smoke (local + lock/checksum + locked + HTTP + HTTPS)"