refactor(tools): move mise bootstrap logic to Go #813

Problem

The bootstrap entry point must work before mise or a Go toolchain is installed, but its installation logic remains shell. It selects a cached version and installation path, resolves platform/archive/checksum inputs, installs mise and invokes it (tools/mise-bootstrap:4, tools/mise-bootstrap:56, tools/mise-bootstrap:142, tools/mise-bootstrap:254, tools/mise-bootstrap:294, tools/mise-bootstrap:402), on origin/main at a0347a715fab580ece45edfcb3d13509620459a8.

This split chooses Go migration with a temporary frozen compatibility path, rather than a permanent bootstrap exception to the shell rule. It must preserve the first-run path when the replacement binary is not yet available.

This is the bootstrap split of #332. Part of #588.

Acceptance criteria

1. AC1: Version and installation-path selection equal the frozen command's under the existing defaults and environment overrides.
2. AC2: An existing file at the selected installation path takes the same cache-hit path as today, without downloading or silently enforcing a different version policy.
3. AC3: Platform and archive selection preserve the frozen command's supported OS/architecture/libc outcomes and unsupported-platform refusals.
4. AC4: Download-source and checksum selection honor the same configuration precedence and requested version as the frozen command.
5. AC5: Failed download, checksum retrieval or checksum validation never results in a newly installed executable or successful bootstrap result.
6. AC6: A successful installation produces the same executable bytes, mode decisions, diagnostics and temporary-artifact cleanup as the frozen command for equivalent inputs.
7. AC7: Failed platform, installed-version, archive-capability, checksum-tool, cache-path or user-ID probes remain failures even after printing plausible output.
8. AC8: Invoking the installed mise preserves the caller's invocation name, arguments, input/output streams, working directory and terminal exit status.
9. AC9: Non-functional: when the released replacement command is already available, bootstrap works without a Go toolchain or an existing mise installation.
10. AC10: The existing entry point ends as a thin shell wrapper that probes the Go subcommand without side effects and falls back to the frozen shell only when that capability is absent, including first run without any replacement binary.
11. AC11: A supported Go failure never triggers shell fallback, repeated installation or a repeated installed-command invocation.
12. AC12: Non-functional: release N-2 bootstrap invocations and environment settings remain supported without a raised binary floor, new required configuration or loss of an existing platform's fallback path.

Scope and non-goals

Preserve cache/version/path precedence and leading-version normalization (tools/mise-bootstrap:5); Linux/Darwin, existing architecture and musl selection (tools/mise-bootstrap:56, tools/mise-bootstrap:67); explicit archive format and older-version format behavior (tools/mise-bootstrap:99); archive capability decisions (tools/mise-bootstrap:112); checksum-tool selection and pinned/dynamic checksums (tools/mise-bootstrap:132, tools/mise-bootstrap:142); download alternatives and error reporting (tools/mise-bootstrap:254); installed-version parsing and opt-in matching-version skip behavior within installation (tools/mise-bootstrap:285, tools/mise-bootstrap:309); requested-source precedence (tools/mise-bootstrap:319); extraction, directory-path refusal, root-specific mode/ownership behavior, final move and success cleanup (tools/mise-bootstrap:327); debug/quiet diagnostics (tools/mise-bootstrap:14); and returning to the invoking directory before forwarding (tools/mise-bootstrap:396).

The public entry point currently skips installation whenever the selected path is already a file (tools/mise-bootstrap:399). Do not confuse that contract with the installation helper's narrower optional version check. Keep the helper's failed-version-probe behavior covered without changing the public cache policy.

The entry point suppresses shell-activation help (tools/mise-bootstrap:398). Migrating the unused activation-help variants at tools/mise-bootstrap:365 is a non-goal: this entry point exposes none of them. Preserve the suppression rather than adding activation instructions or editing shell startup files.

Non-goals: a permanent shell exemption, new supported platforms, expanding #333's release-target inventory, a new binary-acquisition mechanism, changing the pinned mise version, stronger cache-version policy, new checksum trust policy, automatic retries, atomic-install redesign, or adding failure cleanup promises beyond the frozen command's behavior. The existing thin compatibility paths for unrelated helpers remain outside this split. Fallback retirement is separate D9 work and must wait until every supported bootstrap environment has a viable replacement path.

Approach

Write failed-probe and no-install-on-invalid-input checks first. Move the installation and selection behavior to Go and compare it against frozen shell using local fixture archives and controlled platform responses. Existing first-run callers must still bootstrap when no replacement command is available. The pull request decides implementation details; it does not introduce a permanent exception or another release distribution interface.

Dependencies

Depends on #542, following #333 → #544 → #382 → #545 → #546 and the #359 release chain. #333 and #544 establish released binaries and normal installation; this split must not assume those installations already exist on first bootstrap. #332 records this migration decision for #334, which owns later shell-limit enforcement. Part of #588.

Size

M. One pull request for the bootstrap behavior, thin compatibility entry point and installation fixtures.

Verify plan

• AC7: first port all bootstrap regressions in tests/tools/masked-status.bats:123, tests/tools/masked-status.bats:137, tests/tools/masked-status.bats:168, tests/tools/masked-status.bats:177 and tests/tools/masked-status.bats:195. For each probe, return plausible output then fail; assert the failure propagates, no untrusted value is accepted and no new executable is installed after the failure.
• AC5: first test failed downloads, empty/failed checksum retrieval and mismatched checksums against fixture archives; assert nonzero status, no success diagnostic and no newly installed executable. No test contacts a real download service.
• AC1: default/overridden version, leading v, cache-root and explicit-install-path fixtures compare selected paths and versions with frozen shell.
• AC2: existing-file, absent-file and nonexecutable-cache fixtures compare whether installation runs and the final invocation outcome. Separately cover the helper's optional matching-version branch and rejected failed-version probe; do not add version enforcement to the public cache hit.
• AC3: enumerate every current OS/architecture/libc outcome, explicit OS/architecture/archive overrides, older-version archive behavior and unavailable archive capability. Compare selected artifacts and unsupported-platform refusals; verify existing platforms outside the released replacement inventory still take the frozen fallback when needed.
• AC4: default-source, source override, explicit alternate-source request, alternate-version request, pinned and fetched checksum fixtures compare request selection and precedence. Cover both existing download alternatives and both checksum-tool alternatives, with missing-tool refusals.
• AC6: local archive fixtures cover both supported formats, native and alternate extraction paths, directory-valued destination refusal and root/nonroot mode decisions. Compare installed bytes/modes, stdout/stderr, status and residue after success. Compare failure behavior without inventing rollback or cleanup guarantees.
• AC8: a recording fake installed command checks invocation name, spaced arguments, stdin, separate output streams, working directory and nonzero exit propagation. Successful installation and cache-hit paths emit no activation-help output.
• AC9: provide the released replacement command while making Go and mise unavailable; install and invoke only a fixture mise. Assert neither build tooling nor mise is needed to execute bootstrap selection/installation.
• AC10: no replacement binary, an older binary without the capability and a supported replacement each take the expected path once; assert the read-only probe neither downloads nor installs.
• AC11: supported failure, failure after partial installation and an indeterminate capability probe all return failure with zero shell fallback, zero repeated installation and zero repeated installed-command invocation.
• AC12: compare N-2 environment/argument fixtures on absent, older and new binary paths. Run Go tests for the platform-selection matrix on Linux, macOS and Windows, with native fixture installation and wrapper smoke coverage on supported bootstrap systems. Run focused tests, mise run lint and mise run test on the reviewed head. All subprocesses, downloads and ownership-sensitive operations are isolated fixtures or stubs.
• Definition of done: D1 each AC is verified at the merged head, with the commands and results cited in the pull request's Verification. D2 an independent review approves the exact merged head, and every finding has a recorded disposition. D3 required checks pass with no gate loosened. D4 the leak scans the repository specifies are clean, and every post made for this work (comments, descriptions) passes the per-post leak review before it is posted. D5 every commit is signed. D6 the documentation matches, or the description says No doc impact with the reason. D7 every commit carries an Assisted-by trailer and the pull request carries the provenance:agent-assisted label. D8 the change stays within the pull request size limits. D9 follow-up work, including deferred review findings, is filed as issues, each with a Problem section and numbered acceptance criteria and linking this issue; the pull request's Related section lists them, and any code that defers work links its issue. D10 the merge closes this issue through a closing reference, the project board shows the state Done, and a final Status: comment names the merge commit.

Risks

A replacement that requires mise to launch cannot bootstrap mise. First-run and absent-binary fixtures prevent that cycle. Cache reuse, musl/archive selection and failure handling can also drift; the frozen matrix covers them. Undo: revert the port. Keep the fallback frozen until N-2 support and bootstrap availability permit separate retirement.

Operator authority

None.