Prebuilt engine binaries: build in CI for Linux/macOS/Windows on merge, fetch from the script, no Soufflé or compiler needed to run #454

Problem

Running the engine requires a Soufflé installation plus a C++ toolchain on the user's machine: run-souffle.sh generates C++ from the rules (souffle -g) and compiles it (c++ -O3 -march=native) on first use, ~70–120 s per language, and fails outright without both. Soufflé itself ships packages only for a handful of Linux distributions; on macOS it is a Homebrew build and on Windows a from-source CMake/vcpkg build. For a consumer that just wants a call graph, that is most of the setup.

None of it is necessary at run time. The compiled engine is a single self-contained executable (measured: ~7.6 MB, linked against nothing but the system C++ runtime) that takes -F <facts> -D <out>, it is already project-independent (relative .input/.output, every knob is a fact). Soufflé is a build-time dependency only, and souffle -g's output is portable C++ that needs just Soufflé's headers and any C++17 compiler.

Proposal

Build the engine binaries in CI on every merge to main and have the script fetch them, so a user needs Node and a shell, no Soufflé, no compiler.

1. A canonical engine id. Today's cache key hashes the generated program text, which embeds absolute include paths, so it differs per checkout. Replace it with a content-only id per language: sha256 of the program with paths relativised to src/, every included .dl in include order, the staging maps, and the pinned Soufflé version (a constant in the repo, since a machine without Soufflé must compute the same id CI did). Path-independent, changes iff the rules change.

2. CI on merge (.github/workflows/engine-binaries.yml):

• generate on Ubuntu: install the pinned Soufflé .deb, compute each language's id, skip languages whose release already exists, run souffle -g → the portable .cpp, plus the header tree.
• build matrix: ubuntu-24.04 (x86_64), ubuntu-24.04-arm (arm64), macos-14 (universal -arch arm64 -arch x86_64), windows-2025 (MSVC, /std:c++17 /O2 /bigobj, the same headers Soufflé's own Windows CI compiles). Portable target flags, not -march=native.
• release: tag engine-<lang>-<id> with assets axiom-engine-<lang>-<os>-<arch>[.exe], sha256sum.txt, and the generated <lang>.cpp (a third path for anyone with only a compiler).

3. The script. run-souffle.sh keeps its compile branch when souffle is on PATH; otherwise it resolves the platform (uname → linux/darwin/windows × x86_64/arm64, Git Bash on Windows), looks in the local cache, downloads the asset for this id (via gh, or curl with a token, the repository is private), verifies the sha256, and runs it. Rules edited locally with no Soufflé installed → an explicit error naming the two ways out, never a silent stale binary.

4. Guard. A preflight asserts the id is the same from two copies of the tree at different paths and differs after a one-character rule change.

Requirements after this: Node ≥ 22.5 (bundle stage) and bash + awk (Git Bash on Windows). Porting the staging driver from bash to TypeScript, one native axiom-graph command everywhere, is the follow-up, not this issue.