Fused gale-nano as a self-contained wasm component (exports gust:os, residual = gust:hal) for cosign-signed OCI delivery

[avrabe]

Tracks the build target behind DD-OS-DELIVERY-001 (gale#223): gale's consumable cut for the per-core fusion contract (jess#167 / jess DD-026) is a cosign-signed OCI wasm component, and the real work is producing the component itself — not the OCI push (that's a bounded release.yml add on top of the already cosign-signed .wasm/SLSA output).

Problem (grounded on v0.5.0 assets)

Neither released msgq shape is meld fuse-able standalone:

• gale-wasm-msgq-v0.5.0-cortex-m4f.o — dissolved decision core (gale_k_msgq_put_decide), nm -u = 0 undefined, but only the decision fragment.
• gale-wasm-msgq-v0.5.0.wasm — core module importing a 9-symbol env scheduler seam (k_spin_lock/unlock, z_ready_thread, z_reschedule, z_unpend_first_thread, gale_w_msgq_pend/thread_swap_data/memcpy, arch_thread_return_value_set), confirmed via wasm-tools print.

Target

A self-contained wasm component — the fused gale-nano runtime subset (Verus-proven executor + the gust:os capability providers + msgq/mutex/sem) — that:

• exports gust:os (the capability world flight components import: log/channel/io/spawn/taskdisp/time/timer);
• resolves the scheduler seam internally — z_ready_thread/z_reschedule/gale_w_msgq_pend/… satisfied by the composed executor, never exposed;
• leaves exactly gust:hal (mmio) as the only residual import after the app↔providers composition dissolves.

Acceptance (the delivery invariant, DD-OS-DELIVERY-001)

• wasm-tools confirms the artifact is a component (not a core module) that exports gust:os.
• After wac plug (a flight app importing gust:os) + meld fuse --memory shared + loom + synth, the dissolved object's only undefined symbols are the gust:hal mmio seam — no scheduler/heap symbols leak.
• release.yml publishes it cosign-signed to OCI (ghcr) alongside the existing signed assets.
• rivet: DD-OS-DELIVERY-001 gets a verifies link once the component + its gate exist.

Scope / timing

Bound to the v0.6 delivery cut; both sides float-gated (no urgency). The F100-failsafe half of DD-026 is already the gale-verified VER-OS-HM-001 FSM (v0.5.0) — this is purely the all-cores substrate delivery shape. Refs: gale#223, DD-OS-DELIVERY-001, jess#167, jess DD-026, gale#65.

[avrabe]

Two refinements folded into DD-OS-DELIVERY-001 (#225):

1. Generic, multi-consumer — not jess-specific. This is the natural externalisation of gust's OS-as-wasm-component-model: the OS is already a typed capability world (gust:os) that apps import and providers export, so publishing gale's providers as a signed component just makes that distributable. Any downstream that imports gust:os pulls the same signed component and fuses it for its target. jess#167/DD-026 is the first reference consumer, not the only one — more follow.

2. Publish to BOTH channels the sibling flight component uses (relay's falcon-flight is now live on both): a cosign-signed OCI registry (ghcr) AND wasm.directory. Updated acceptance:

   • release.yml publishes the fused component cosign-signed to ghcr OCI (ghcr.io/pulseengine/gale-nano-*).
   • …and to wasm.directory (the component index), same signed artifact.

Everything else stands: the component exports gust:os, resolves the scheduler seam internally, residual after fusion = exactly gust:hal. v0.6 cut, float-gated.