feat(checkpoint): make integrity.rs write opt-in via --integrity-out

checkpoint/src/builder.rs

@@ -53,6 +53,12 @@ struct Args {
     /// AWS CLI profile name
     #[arg(long, requires = "upload")]
     profile: Option<String>,
+
+    /// Path of a Rust source file to write the checkpoint constant to.
+    /// Skipped if not set. Typically `checkpoint/src/integrity.rs` from a
+    /// workspace checkout; irrelevant on servers.
+    #[arg(long)]
+    integrity_out: Option<PathBuf>,
 }
 
 fn main() -> anyhow::Result<()> {
@@ -78,8 +84,10 @@ fn main() -> anyhow::Result<()> {
     );
     eprintln!("SHA-256: {}", hex::encode(digest));
 
-    spaces_checkpoint::write_integrity(height, &block_hash, &digest)?;
-    eprintln!("Updated checkpoint/src/integrity.rs");
+    if let Some(path) = args.integrity_out.as_deref() {
+        spaces_checkpoint::write_integrity(path, height, &block_hash, &digest)?;
+        eprintln!("Updated {}", path.display());
+    }
 
     if let Some(bucket) = &args.upload {
         let bucket = bucket.trim_end_matches('/');

checkpoint/src/lib.rs

@@ -302,20 +302,14 @@ pub fn checkpoint() -> super::Checkpoint {{
     )
 }
 
+/// Write the checkpoint constant to a Rust source file at `path`.
 #[cfg(feature = "cli")]
-const INTEGRITY_PATH: &str = "checkpoint/src/integrity.rs";
-
-/// Write the checkpoint constant to integrity.rs.
-/// Must be run from the workspace root.
-#[cfg(feature = "cli")]
-pub fn write_integrity(height: u32, block_hash: &str, digest: &[u8; 32]) -> anyhow::Result<()> {
-    let path = Path::new(INTEGRITY_PATH);
-    if !path.exists() {
-        anyhow::bail!(
-            "{} not found — run checkpoint-builder from the workspace root",
-            INTEGRITY_PATH
-        );
-    }
+pub fn write_integrity(
+    path: &Path,
+    height: u32,
+    block_hash: &str,
+    digest: &[u8; 32],
+) -> anyhow::Result<()> {
     std::fs::write(path, format_integrity_file(height, block_hash, digest))?;
     Ok(())
 }