aadl_wit_library: add a generate-and-diff drift check (aadl_wit_diff_test) + refresh stale spar checksum registry (0.10.0 → 0.21.0)

[avrabe]

Summary

aadl_wit_library can generate WIT from an AADL model on the fly (great — exactly the front of the pipeline), but there is no first-class way to use it as a drift "result check": generate the WIT and diff it against a committed, reviewable .wit file, failing bazel test on drift. Consumers that commit their generated WIT (so non-bazel toolchains — cargo-component, wit-bindgen — can read it) currently can only guard drift with an out-of-band CI shell step (spar codegen … | diff … || exit 1), which is per-root, CI-only, and easy to forget to wire for a new model.

Two concrete gaps block doing this cleanly in bazel today.

Gap 1 — aadl_wit_library emits a tree artifact, so diff_test can't consume it directly

aadl_wit_library declares its output as a single tree artifact (ctx.actions.declare_directory), containing wit/<process>.wit. @bazel_skylib//rules:diff_test.bzl%diff_test compares single files, so a drift check needs an intermediate genrule to extract wit/<process>.wit out of the directory before diffing — boilerplate every consumer re-derives.

Proposal: a first-class macro, e.g.

aadl_wit_diff_test(
    name = "param_wit_drift_test",
    srcs = glob(["spar/*.aadl"]),
    root = "Falcon_Param::ParamStore.Fmu",
    expected = "wit/param/service.wit",   # the committed, reviewed file
)

that runs spar codegen, picks the single emitted .wit, and diff_tests it against expected. A write_source_files-style updater (bazel run //…:param_wit_drift_test.update) to regenerate the committed file would round it out.

Gap 2 — the spar checksum registry is stale, so the toolchain can't pin the version the consumer actually uses

checksums/tools/spar.json registers only 0.9.3 and 0.10.0, and spar_toolchain defaults to 0.10.0. But spar is shipping fast — v0.18.0…v0.21.0 are released, each with per-platform archives (spar-v0.18.0-aarch64-apple-darwin.tar.gz, etc.). A repo whose committed WIT was generated by spar 0.18.0 (and whose CI drift-gate pins cargo install --tag v0.18.0) cannot point the bazel toolchain at a matching 0.18.0 — so a bazel-generated WIT would be produced by 0.10.0 and mismatch the committed file, making the diff check meaningless or red for the wrong reason.

For a drift "result check" to be sound, the three spar instances must agree: the one that generated the committed WIT, the one the CI gate runs, and the one the bazel toolchain downloads. Today the registry caps the third at 0.10.0.

Proposal: refresh checksums/tools/spar.json to current spar releases (through 0.21.0), or document the supported flow for pinning spar_toolchain to an arbitrary published version + sha.

Why it matters

This is the PulseEngine "model is the source of truth, generated WIT is derived" guarantee. Right now (in relay) it's enforced only by a hand-written per-root CI step (.github/workflows/spar.yml): regenerate + diff -u | exit 1. That works but is CI-only and enumerated per-root — a newly generated WIT is silently ungated until someone remembers to add it. A bazel test-level drift check from rules_wasm_component would make this local, automatic, and uniform.

Context

Hit while adding a spar-generated wit/param/service.wit (Falcon parameter service) in pulseengine/relay. Worked around it for now by wiring the new root into the existing spar.yml regenerate-and-diff CI step; filing this so the durable guard can move into the ruleset where it belongs.

Happy to contribute the aadl_wit_diff_test macro + a registry refresh PR if that's a welcome direction.