Build-provenance documentation for Codex 0.154.0 and its ARM64-musl V8 artifact

What is the type of issue?

Documentation is missing.

What is the issue?

We are documenting the native build provenance of the official Codex 0.154.0 ARM64-musl artifacts embedded in an Android launcher. This is a request for retained build evidence or a pinned reproduction recipe, not a security-vulnerability report or an allegation that the release is incorrect.

We have verified the release payloads and original signatures, recovered the matching GNU-debuglink symbol files and Cargo timing artifacts, and traced the separately produced V8 archive and exact ICU data. The remaining gap is the final contributing native objects/sections, rather than another conservative dependency or license list.

Could you share any retained evidence for these exact outputs, or point us to an existing public location?

1. Codex final links: linker maps or equivalent post-LTO/garbage-collection/ICF contribution reports; final link commands/response files and toolchain versions; or a linker reproducer containing the matching inputs. For generated/static native objects not already covered by pinned Cargo inputs, a source-to-object manifest with source revisions, patches and compile commands would help.
2. The reused V8 archive: a retained Bazel action/compilation graph or equivalent mapping its objects to source revisions, compile flags, toolchain and generated inputs, plus the archive assembly command. Please distinguish repeated member names by ordinal or hash. This producer-side mapping is separate from what the later Codex link retained.

If original records have expired, identifying which are unavailable and providing a pinned build recipe/toolchain definition would still be useful. We would label a separate source replay as a new build, not as the original producer's link map. No credentials, signing material or private runner data are requested; paths can be normalized while preserving source/input identities.

Where did you find it?

Codex: release rust-v0.154.0, source commit 6b9826e3aa83b1a5947db50f4332cb9c65f1b340.
Both specific producing jobs below succeeded; the overall workflow run contains other failed work and is not being described as wholly successful.

V8: producer commit 12b3e88028b983051913fb6bb95d7a11218bdceb, ARM64-musl sandbox job 90418416602, original artifact ID 8705113138 (rusty-v8-150.4.0-ptrcomp-sandbox-aarch64-unknown-linux-musl). Its original job artifact matches the published archive/bindings/checksum files, and the consumer checksum pin agrees.

• librusty_v8_ptrcomp_sandbox_release_aarch64-unknown-linux-musl.a.gz SHA-256: d258efd9c17b67077013f110302ff148fd11428cc4804fcb5c9ad05e3e634cb4.
• Decompressed archive SHA-256: ee804b4b7f326ecdf4bcc5c93c94b84374d7e435759af934df372b9e5640ff26.

We inventoried all 2,100 archive objects and found positive complete, non-relocated instruction matches from 501 objects in the actual host. We are not treating the remaining objects as absent or this witness set as an exhaustive link map.

Thank you; even a pointer to the appropriate existing provenance artifacts would help.

Start by reviewing the linked Codex producing jobs 102657284351 and 102657284476, then the V8 sandbox job 90418416602 and its cited artifacts. Done means locating retained link or compilation provenance for the specified outputs, or documenting which records are unavailable and providing a pinned reproduction recipe without presenting a new build as the original.