IC Tooling

This workspace owns Host primitives (ic-host-*), build orchestration (ic-build) and test support (ic-testkit, ic-testkit-native). Build and Testkit use Host through explicit crate dependencies. Private test drivers and the Wasm probe remain unpublished.

Foundation's five primitive/inspection packages, Build, Text, Host Tools and the Testkit family have independent release versions in this workspace. See release ownership and the Foundation, Build, Text, Host Tools and Testkit ledgers.

See the consolidation inventory, Build documentation and Testkit documentation.

Host libraries

Host-side Rust libraries for artifact inspection, local filesystem safety, admitted process execution and IC-specific format handling.

The FS package's explicit cli feature supplies native ic-host-file commands for bounded hashes and private create/replace operations, with caller-selected batch limits and explicit executable preparation.

These run locally outside canisters. The ic-host prefix identifies their ecosystem; the generic crates have no IC runtime dependency. Gzip and Wasm support are optional features of ic-host-artifacts. Filesystem/process consumers select the small default artifact dependency.

See the Host API reference for operation contracts, resource bounds, failure evidence and caller responsibilities.

Development

The published libraries support Linux x86-64 and macOS 15 on Intel and Apple Silicon, with the consumer minimum declared in Cargo.toml. The development compiler is pinned separately in rust-toolchain.toml. See host qualification for validation commands and native evidence requirements.

For development, prepare the toolchain selected in rust-toolchain.toml and the bootstrap prerequisites and shell PATH, then run:

make install-tools
make tools-check
make install-hooks
make test PACKAGE=ic-host-artifacts

Setup is explicit; tools-check verifies prepared tools offline. Hook installation separately activates the repository-local formatter. Shared Tooling owns these common commands and executable installation; this workspace owns the Host, Build and Testkit libraries, package checks and publication policy.

Use make check, make clippy, make docs-check, make test with PACKAGE=<crate> for focused work. Follow the shared validation policy for when to select those checks or full make ci validation. The host guide describes feature-specific and hook checks; make help lists the available commands.

Git release and crates.io publication are separate operations; a tag does not establish registry availability. Read the release and publication guide for prerequisites, explicit command effects and retained-evidence recovery. Consumers adopt and qualify registry selections independently.

Read the extraction contract, the handoff and agent rules. Human and agent contributions follow the PR contribution rules.

Bounded Wasm inspection CLI

cargo run -p ic-host-wasm-inspect --locked -- input.wasm 1048576 1000 1000 1000

The standalone application composes artifact/filesystem owners, retaining the five library boundaries without depending on Host Tools or the Candid parser. It prints exact SHA-256 and raw/structural facts after complete admission; budgets and interpretation stay caller-owned. It executes no Wasm and estimates no cycles or instructions. Select the published package, version and binary through the standard Shared Tooling Cargo installer; no extra feature selection is required. Append --expect-sha256 SHA256 for digest verification before reporting, or --details for export/custom-section records after the TSV summary. These options replace the retired ic-host-fs inspect_artifact example; default CLI output is unchanged. See the inspector guide.