Phase out hardening flags hurting startup; add three perf wins

[Sam Gammon (sgammon)]

Summary

We're prioritising startup time over defence-in-depth for now. Six hardening flags move to a tracked, non-consumed labs.disabled.txt parking lot; three pure perf/size wins land in the live profiles. -fasynchronous-unwind-tables (profiling) and -fbasic-block-sections=all (Propeller-ready) are kept on per discussion.

Parked in labs.disabled.txt (each with its own re-enable criteria):

• base.txt: -fstack-protector-strong, -fzero-call-used-regs=used-gpr
• linux.txt + darwin.txt: -U_FORTIFY_SOURCE, -D_FORTIFY_SOURCE=2, -D_LIBCPP_HARDENING_MODE_FAST
• linux-amd64.txt: -fcf-protection=full

labs.disabled.txt is not loaded by the rollup or by cli/cflags.{sh,ts} — the resolver matches on a closed set of {base, $os, $os-$arch, $os-bin, $os-$arch-bin}.txt and silently ignores everything else. It's a tracked, reviewable parking lot, not a profile. Re-enabling any flag is a literal cut-and-paste back into the named source file.

Added (small, free startup wins):

• base.txt: -fmerge-all-constants — dedupe equal string/numeric constant pool entries → smaller binary, fewer relocs at load. Mild ISO violation we don't depend on.
• linux.txt: -Wl,--hash-style=gnu — drop legacy sysv-hash; ~2× faster dyn-symbol lookup at load + smaller .dynsym.
• linux.txt: -Wl,-O3 (replaces -Wl,-O2) — more aggressive linker-side string/section merging.

Kept on:

• -fasynchronous-unwind-tables — better profiling > the table size.
• -fbasic-block-sections=all (linux-amd64) — Propeller is on the roadmap; the per-BB sections are a hard prerequisite for the symbol-ordering file. Carrying it now avoids a rebuild-the-world later.

README features matrix updated with a new "Phasing in" subsection that lists parked flags and points at labs.disabled.txt.

Test plan

• All eight (os × arch × {compile, --bin}) outputs from cli/cflags.sh byte-match cli/cflags.ts
• Six dropped flags absent from resolved output; three new flags present
• labs.disabled.txt correctly ignored by the resolver (verified via grep)
• linux-amd64 compile-flag count: 69 → 65 (net 4 dropped)

---

Generated by Claude Code

[Copilot]

Pull request overview

This PR restructures the flag profiles to separate “compile-time” flags from “final-link-only” flags, while temporarily parking several startup-costly hardening options in a tracked labs.disabled.txt file and adding a few startup/size optimizations to the live Linux/base profiles.

Changes:

• Introduces *-bin “final-link-only” profiles (linux-bin.txt, darwin-bin.txt, plus per-arch placeholders) and updates the resolver docs accordingly.
• Parks selected hardening flags in labs.disabled.txt and updates README to document the phased re-enable plan.
• Adds/adjusts optimization and ELF/Mach-O related flags and adds two equivalent CLI resolvers (cli/cflags.sh and cli/cflags.ts).

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
README.md	Expands documentation: profile taxonomy, deployment floor, feature matrix, and phased hardening notes.
base.txt	Updates layering description; adds -fmerge-all-constants; centralizes a clang-compatible warning set; keeps unwind settings.
linux.txt	Adds ELF performance/hardening-related compile/link flags and clarifies final-link-only flag placement.
linux-bin.txt	New: final-link-only Linux flags (gc-sections, z defs, debug compression, fatal warnings).
linux-amd64.txt	New: amd64 ISA baseline/tuning plus retained BB section emission for Propeller readiness.
linux-amd64-bin.txt	New: placeholder for amd64 final-link-only flags.
linux-arm64.txt	New: arm64 ISA baseline and BTI/PAC-related link flags.
linux-arm64-bin.txt	New: placeholder for arm64 final-link-only flags.
darwin.txt	New: macOS compile/link flags (lld + chained-fixups-related options).
darwin-bin.txt	New: final-link-only Mach-O dead-strip settings.
darwin-amd64.txt	New: Intel macOS ISA baseline and rationale for excluding CET.
darwin-amd64-bin.txt	New: placeholder for amd64 Darwin final-link-only flags.
darwin-arm64.txt	New: Apple Silicon baseline and branch protection settings.
darwin-arm64-bin.txt	New: placeholder for arm64 Darwin final-link-only flags.
labs.disabled.txt	New: tracked “parking lot” for temporarily disabled hardening flags and re-enable notes.
cli/cflags.ts	New: Bun/TypeScript resolver for closed-set profile rollup (+ --bin support).
cli/cflags.sh	New: Bash resolver for closed-set profile rollup (+ --bin support).

Comments suppressed due to low confidence (1)

linux.txt:38

• PR description lists three newly added flags, but this change also introduces -fno-semantic-interposition (not mentioned in the PR description's "Added" section). Please either update the PR description/test plan to include it, or clarify why this additional behavior change is intended.

# Skip the dynamic-symbol interposition contract for our own definitions:
# under ELF the linker assumes any global symbol in a shared library can
# be replaced via LD_PRELOAD, which forces every intra-library call through
# the GOT/PLT and disables a wide range of inlining + IPO. Disabling it
# lets clang resolve calls and constants directly inside the same DSO.
# Combined with -fno-plt below, the call-site overhead approaches a static
# build's. Linux/ELF only — Mach-O has different visibility semantics and
# clang ignores this flag there.
-fno-semantic-interposition

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.