The v2-native route producer sets -D warnings itself, records the emitted build on its receipt, and separates receipt from telemetry

dag/extdeps/rust/cargo.dag

@@ -114,6 +114,7 @@ type CargoEnvironmentVariable
   | CargoTargetDirEnv
   | CargoBuildJobsEnv
   | RustcWrapperEnv
+  | RustflagsEnv
 
 // THE NAMES LIVE HERE, THE OPERAND FORM DOES NOT, and an earlier revision of this module got that
 // wrong. It carried a cargo_environment_assignment rendering "NAME=value" beside these names,
@@ -129,6 +130,7 @@ fn cargo_environment_variable_name(variable: CargoEnvironmentVariable) -> NonEmp
     CargoTargetDirEnv => "CARGO_TARGET_DIR"
     CargoBuildJobsEnv => "CARGO_BUILD_JOBS"
     RustcWrapperEnv => "RUSTC_WRAPPER"
+    RustflagsEnv => "RUSTFLAGS"
   }
 }
 

dag/gunbc/repo/repo_self_build.dag

@@ -124,12 +124,29 @@ fn repo_self_test_command() -> String {
 fn repo_self_clippy_command() -> String {
   join(
     argv_words(
-      command: cargo_clippy_command(extra_args: ["--all-targets"], lint_args: ["-D", "warnings"])
+      command: cargo_clippy_command(extra_args: ["--all-targets"], lint_args: repo_self_warning_denial)
     ),
     " "
   )
 }
 
+// THAT A WARNING IS AN ERROR IS ONE FACT ABOUT THIS REPOSITORY, SPELLED ONCE. It reaches rustc
+// two ways: as the lint arguments after clippy's `--` separator (the row above), and as the
+// RUSTFLAGS environment cargo forwards to every rustc it spawns -- the form the required
+// v2-native lane sets EXPLICITLY on the emitted compiler crate's build
+// (gunbc.witness_v2_native_route NativeRouteEmittedBuild). Until that lane set it, the emitted
+// crate was built under whatever RUSTFLAGS the runner's toolchain step happened to export -- the
+// setup-rust-toolchain action's DEFAULT input, which this authority never declared -- so the same
+// crate compiled clean on a workstation and refused with status 101 in CI, and the receipt's
+// "compiled" was true of a runner rather than of the crate. The environment form is the lint
+// arguments joined by a space because that is how cargo tokenises RUSTFLAGS (whitespace-split);
+// it is derived here from the same row, never re-spelled at the invocation.
+data repo_self_warning_denial: List<String> = ["-D", "warnings"]
+
+fn repo_self_warning_denial_rustflags() -> String {
+  join(repo_self_warning_denial, " ")
+}
+
 // THE DERIVED STAGE0 PARTITION CRATES, WHICH THE PACKAGE-AS-DATA DECISION ABOVE DOES NOT REACH.
 // repo_self_build_package is one package because that was the whole repository's compiler for as
 // long as this module existed. The stage0 partition splits that compiler across seven SIBLING

dag/gunbc/witness/v2_native_route.dag

@@ -16,6 +16,7 @@ import v2.workflow.compile_door_ledger {
 }
 import v2.workflow.floor_expected_red { floor_expected_red_roster }
 import v2.workflow.floor_route_gap { floor_route_gap_roster }
+import gunbc.repo_self_build { repo_self_warning_denial_rustflags }
 
 // THE LANE AUTHORITY FOR THE required-v2-native CI JOB (operator authorization 2026-09-09: one
 // additional required job, modelled beside the workflow authority that projects it — never a
@@ -445,6 +446,35 @@ type NativeRouteOldRouteControl
   | OldRouteFalsifierArmed { falsifier_identity: String }
   | OldRouteControlAbsent
 
+// THE EMITTED COMPILER'S BUILD, AS A RECEIPT RATHER THAN AS A SIDE EFFECT OF ONE. Before this row
+// the lane recorded that the emitted binary EXISTED (its path and content digest) and nothing about
+// the compilation that produced it, so "the emitted crate compiled" was true of whatever cargo the
+// runner happened to run under whatever RUSTFLAGS the toolchain step exported. Measured: CI's
+// toolchain action defaults RUSTFLAGS to `-D warnings`, a workstation exports none, and the same
+// crate compiled on one and refused with status 101 on the other with the receipt unable to say
+// why. The five facts here are the ones that decide whether one run's "compiled" can be compared
+// with another's: the exact argv cargo was spawned with, the RUSTFLAGS the lane SET on that spawn
+// (never inherited -- the value is the repository's own row, gunbc.repo_self_build
+// repo_self_warning_denial_rustflags, applied at the invocation, on BOTH channels cargo reads),
+// the one compiler executable cargo was BOUND to (RUSTC set on the spawn, both wrapper channels
+// disabled there -- a receipt naming a compiler cargo was free to replace via config or a
+// wrapper would be evidence about a build that did not happen), that executable's
+// self-reported identity in its keyed `--version --verbose` form (extdeps.rust.rustc
+// rustc_version_verbose, asked from the crate's own directory), cargo's own
+// exit status, and the count of `warning` diagnostic headers on its stderr. The count is carried
+// so the receipt names it, and admission requires it zero: under the denial a lint arrives as an
+// error and stops the build, so a non-zero count on a zero status can only be a warning rustc
+// did not own (cargo's own, or a build script's), which is still a warning the receipt would
+// otherwise have swallowed.
+type NativeRouteEmittedBuild {
+  cargo_argv: List<String>
+  rustflags: String
+  compiler_path: String
+  rustc_identity: String
+  exit_status: Int
+  warning_count: Int
+}
+
 // THE TERMINAL OBSERVATION. Every identity the contract names is a field: the tested tree; the
 // seed used ONLY to prepare the emitted compiler (recorded honestly — this job does not claim
 // native bootstrap); the emitted closure's identity; the executed binary's path AND content
@@ -468,6 +498,7 @@ type NativeRouteReceipt {
   true_control: Optional<NativeTestVerdict>
   malformed_control: NativeRouteMalformedControl
   old_route_control: NativeRouteOldRouteControl
+  emitted_build: NativeRouteEmittedBuild
 }
 
 // ADMISSION IS THE CONTRACT, ONE AUTHORITY, ONE CLAUSE PER PREDICATE. The job greens only when
@@ -505,6 +536,10 @@ type NativeRouteAdmissionRefusalCause
   | TrueControlNotObserved
   | MalformedControlAcceptedByRoute
   | OldRouteControlNeverInstalled
+  | EmittedBuildRustcUnrecorded
+  | EmittedBuildCompilerUnbound
+  | EmittedBuildWarningsNotDenied
+  | EmittedBuildNotClean
 
 type NativeRouteAdmission
   = NativeRouteAdmitted
@@ -745,6 +780,26 @@ fn native_route_old_route_closed(receipt: NativeRouteReceipt) -> Bool {
   }
 }
 
+// The build clauses read the emitted-build receipt and nothing else: rustc named itself; the
+// RUSTFLAGS the lane set are exactly the repository's denial row (equality, not containment --
+// a flag string that carries the denial plus something else is a different build environment
+// and the receipt must say so); and the build completed with status 0 and no warning header.
+fn native_route_emitted_build_rustc_recorded(receipt: NativeRouteReceipt) -> Bool {
+  receipt.emitted_build.rustc_identity != ""
+}
+
+fn native_route_emitted_build_compiler_bound(receipt: NativeRouteReceipt) -> Bool {
+  receipt.emitted_build.compiler_path != ""
+}
+
+fn native_route_emitted_build_warnings_denied(receipt: NativeRouteReceipt) -> Bool {
+  receipt.emitted_build.rustflags == repo_self_warning_denial_rustflags()
+}
+
+fn native_route_emitted_build_clean(receipt: NativeRouteReceipt) -> Bool {
+  receipt.emitted_build.exit_status == 0 && receipt.emitted_build.warning_count == 0
+}
+
 fn native_route_admission(receipt: NativeRouteReceipt) -> NativeRouteAdmission {
   let expected_red = floor_expected_red_roster()
   let route_gap = floor_route_gap_roster()
@@ -775,7 +830,11 @@ fn native_route_admission(receipt: NativeRouteReceipt) -> NativeRouteAdmission {
     NativeRouteClauseCheck { holds: native_route_false_control_holds(receipt: receipt), cause: FalseControlNotObserved },
     NativeRouteClauseCheck { holds: native_route_true_control_holds(receipt: receipt), cause: TrueControlNotObserved },
     NativeRouteClauseCheck { holds: native_route_malformed_control_holds(receipt: receipt), cause: MalformedControlAcceptedByRoute },
-    NativeRouteClauseCheck { holds: native_route_old_route_closed(receipt: receipt), cause: OldRouteControlNeverInstalled }
+    NativeRouteClauseCheck { holds: native_route_old_route_closed(receipt: receipt), cause: OldRouteControlNeverInstalled },
+    NativeRouteClauseCheck { holds: native_route_emitted_build_rustc_recorded(receipt: receipt), cause: EmittedBuildRustcUnrecorded },
+    NativeRouteClauseCheck { holds: native_route_emitted_build_compiler_bound(receipt: receipt), cause: EmittedBuildCompilerUnbound },
+    NativeRouteClauseCheck { holds: native_route_emitted_build_warnings_denied(receipt: receipt), cause: EmittedBuildWarningsNotDenied },
+    NativeRouteClauseCheck { holds: native_route_emitted_build_clean(receipt: receipt), cause: EmittedBuildNotClean }
   ]
   let causes = fold_list(
     xs: checks,
@@ -815,6 +874,10 @@ fn native_route_admission_refusal_cause_name(cause: NativeRouteAdmissionRefusalC
     TrueControlNotObserved => "true_control_not_observed"
     MalformedControlAcceptedByRoute => "malformed_control_accepted_by_route"
     OldRouteControlNeverInstalled => "old_route_control_never_installed"
+    EmittedBuildRustcUnrecorded => "emitted_build_rustc_unrecorded"
+    EmittedBuildCompilerUnbound => "emitted_build_compiler_unbound"
+    EmittedBuildWarningsNotDenied => "emitted_build_warnings_not_denied"
+    EmittedBuildNotClean => "emitted_build_not_clean"
   }
 }
 

dag/test/claim/devboot_host_tool_spelling_witness_test.dag

@@ -16,6 +16,7 @@ import extdeps.cargo {
   CargoTargetDirEnv,
   CargoBuildJobsEnv,
   RustcWrapperEnv,
+  RustflagsEnv,
   cargo_environment_variable_name,
 }
 import extdeps.rustup { rustup_home_env_name }
@@ -68,6 +69,7 @@ test fn cargo_environment_variable_names_are_the_cited_upstream_spellings() -> B
     && (cargo_environment_variable_name(variable: CargoTargetDirEnv) as String) == "CARGO_TARGET_DIR"
     && (cargo_environment_variable_name(variable: CargoBuildJobsEnv) as String) == "CARGO_BUILD_JOBS"
     && (cargo_environment_variable_name(variable: RustcWrapperEnv) as String) == "RUSTC_WRAPPER"
+    && (cargo_environment_variable_name(variable: RustflagsEnv) as String) == "RUSTFLAGS"
 }
 
 // THE NAME COMES FROM CARGO, THE OPERAND FORM FROM env(1), AND THE JOIN IS THE ASSERTION. This

src/v1/stage0/src/cli_run/native_lane_runner.rs

@@ -89,6 +89,19 @@ struct EmittedPreparation {
     binary_identity: String,
     closure_identity: String,
     seed_identity: String,
+    build: EmittedBuildObserved,
+}
+
+/// The emitted compiler's build as the receipt records it — mirror of
+/// `gunbc.witness_v2_native_route` `NativeRouteEmittedBuild`. Every field is read from the
+/// spawn that ran or the toolchain that answered, never composed from what was intended.
+struct EmittedBuildObserved {
+    cargo_argv: Vec<String>,
+    rustflags: String,
+    compiler_path: String,
+    rustc_identity: String,
+    exit_status: i64,
+    warning_count: i64,
 }
 
 fn sha256_file(path: &Path) -> Result<String, String> {
@@ -303,17 +316,55 @@ fn prepare_emitted_compiler(source_roots: &[String]) -> Result<EmittedPreparatio
          rss_kb_after={rss_after_kb:?}); cargo build",
         crate_dir.display()
     );
+    // The invocation resolves and binds the one compiler the build runs under and takes its
+    // identity from the crate's own directory; a compiler that cannot be resolved or named is
+    // a refusal before the build is paid for.
+    let invocation =
+        super::emitted_closure_compile_host::probe_cargo_invocation(&crate_dir, &workspace)
+            .map_err(|cause| format!("V2-NATIVE REFUSAL cause={cause}"))?;
+    let rustc = invocation.rustc_identity.clone();
     let verdict = super::emitted_closure_compile_host::run_cargo(
         &crate_dir,
         &workspace,
         "v2_native_lane_carries_no_mutation_probe",
     );
     if !super::emitted_closure_compile_host::cargo_verdict_compiled(&verdict) {
         return Err(format!(
-            "V2-NATIVE REFUSAL cause=EmittedCompilerBuildFailed — {}",
-            super::emitted_closure_compile_host::cargo_verdict_summary(&verdict)
+            "V2-NATIVE REFUSAL cause=EmittedCompilerBuildFailed — {} (argv={:?} RUSTFLAGS={:?} rustc={rustc})",
+            super::emitted_closure_compile_host::cargo_verdict_summary(&verdict),
+            invocation.argv,
+            invocation.rustflags,
         ));
     }
+    // `cargo_verdict_compiled` admitted only the `Completed { status: 0 }` arm, so the fields
+    // below are the run's own; a verdict of any other shape refused above.
+    let (exit_status, warning_count) = match &verdict {
+        super::emitted_closure_compile_host::CargoVerdict::Completed {
+            status,
+            warning_count,
+            ..
+        } => (i64::from(*status), *warning_count as i64),
+        other => {
+            return Err(format!(
+                "V2-NATIVE REFUSAL cause=EmittedCompilerBuildFailed — verdict admitted as compiled \
+                 is not a completed run: {}",
+                super::emitted_closure_compile_host::cargo_verdict_summary(other)
+            ))
+        }
+    };
+    let build = EmittedBuildObserved {
+        cargo_argv: invocation.argv,
+        rustflags: invocation.rustflags,
+        compiler_path: invocation.compiler_path,
+        rustc_identity: rustc,
+        exit_status,
+        warning_count,
+    };
+    eprintln!(
+        "required-ci: v2-native emitted crate built — argv={:?} RUSTFLAGS={:?} compiler={} \
+         exit_status={exit_status} warning_count={warning_count} rustc={}",
+        build.cargo_argv, build.rustflags, build.compiler_path, build.rustc_identity
+    );
     let binary_path = workspace.join("target").join("release").join(
         super::emitted_closure_compile_host::probe_package_name(NATIVE_COMPILE_ENTRY),
     );
@@ -337,6 +388,7 @@ fn prepare_emitted_compiler(source_roots: &[String]) -> Result<EmittedPreparatio
         binary_identity,
         closure_identity,
         seed_identity,
+        build,
     })
 }
 
@@ -712,6 +764,42 @@ fn receipt_value(
     malformed_control: Value,
     withdrawn_executable: &str,
 ) -> Value {
+    let emitted_build = Value::Record {
+        type_name: ctx.sym("NativeRouteEmittedBuild"),
+        fields: Rc::new(vec![
+            (
+                ctx.sym("cargo_argv"),
+                super::list_value_from_vec(
+                    preparation
+                        .build
+                        .cargo_argv
+                        .iter()
+                        .map(|word| str_value(word))
+                        .collect(),
+                ),
+            ),
+            (
+                ctx.sym("rustflags"),
+                str_value(&preparation.build.rustflags),
+            ),
+            (
+                ctx.sym("compiler_path"),
+                str_value(&preparation.build.compiler_path),
+            ),
+            (
+                ctx.sym("rustc_identity"),
+                str_value(&preparation.build.rustc_identity),
+            ),
+            (
+                ctx.sym("exit_status"),
+                Value::Int(preparation.build.exit_status),
+            ),
+            (
+                ctx.sym("warning_count"),
+                Value::Int(preparation.build.warning_count),
+            ),
+        ]),
+    };
     let universe_values: Vec<Value> = universe
         .iter()
         .map(|(module, declaration)| identity_value(ctx, module, declaration))
@@ -807,6 +895,7 @@ fn receipt_value(
                     )]),
                 },
             ),
+            (ctx.sym("emitted_build"), emitted_build),
         ]),
     }
 }
@@ -818,6 +907,7 @@ fn receipt_value(
 /// `native_route_admission_summary` of that same value, so the terminal line and the admission
 /// fold cannot disagree about what was decided.
 pub fn run_required_v2_native(source_roots: &[String]) -> Result<(), String> {
+    let lane_started = std::time::Instant::now();
     let workspace = super::process_workspace_root();
     let tested_tree = std::env::var("GITHUB_SHA").unwrap_or_else(|_| "local".to_string());
 
@@ -1010,6 +1100,21 @@ pub fn run_required_v2_native(source_roots: &[String]) -> Result<(), String> {
             ))
         }
     };
+    // REALIZATION TELEMETRY, ON ITS OWN LINE AND ON NO RECEIPT FIELD: process peak RSS
+    // (getrusage ru_maxrss, process-scoped — the rustc children cargo spawned are not in it),
+    // current RSS, the slot cgroup's memory.current/memory.peak (peak spans the runner service's
+    // lifetime, not this run), and the lane's wall. It re-derives the run's cost; it decides
+    // nothing. Resource preflight (predicted critical path and memory envelope against
+    // gunbc.runner_slot_allocation's slot rows) is std.realization cost vocabulary and lands
+    // with route integration, not here.
+    let (cgroup_current, cgroup_peak) = super::p1_cohort::p1_cohort_cgroup_memory();
+    eprintln!(
+        "required-ci: v2-native telemetry peak_rss_bytes={:?} rss_bytes={:?} cgroup_current_bytes={cgroup_current:?} \
+         cgroup_peak_bytes_slot_lifetime={cgroup_peak:?} wall_s={}",
+        super::peak_rss_vhwm_bytes(),
+        super::current_rss_bytes(),
+        lane_started.elapsed().as_secs()
+    );
     eprintln!("required-ci: v2-native admission {summary_text}");
     if admitted {
         Ok(())