Rust unit tests run in the clippy job, non-required until measured (step 1 of retiring rust_unit_tests_off_the_merge_path)

[gunbai-bot]

Operator ruling 2026-09-27; sequencing per neat-boar-16's ruling.

• gunbc.compiler_gate_workflow: new rust_unit_tests step after "Lint every target" in the clippy job. It runs repo_self_test_command inside a cgroup leaf with memory.max = 12 GiB, so the regeneration-host tests read a real bound; there is no GUNBC_MEMORY_BUDGET_BYTES. The step is NON-required (continue-on-error) and the clippy job's timeout is 120 min, so the step can finish once and be measured.
• gunbc.ci_spec: the bind sequence is now one function, hosted_runner_memory_cgroup_bind_commands, shared with the heal publisher (heal-publish.yml byte-identical).
• DESIGN 'Building & checks' is updated through gunbc.design_document. It now names where clippy actually runs and says the unit tests run non-required.
• The drop rust_unit_tests_off_the_merge_path stays Standing. It retires in the follow-up that makes the step required, after the 6 red tests on main are fixed (routed separately) and the full wall is measured.

The brief named required-witnesses-build / witness_floor_workflow. That job no longer exists, so the step lives in gunbc.compiler_gate_workflow's clippy job.

Measurements: see comments (run 1 was cancelled at the old 45-min cap; the full wall + top-20 follow).

🤖 Generated with Claude Code

[gunbai-bot]

CI measurement 1 — run 36351584784, job 108711170756 (hosted ubuntu-24.04-arm). Lint: 1m22s. Unit-test step: release build 6m24s, then 1155 tests (101 ignored). 575 had passed after 37 min when the 45-min job timeout cancelled it. The cgroup bind held: memory.max read back 12884901888, and HostBudgetUnreadable appears 0 times in the log. Several regen_round_cost_tests take ~95s each.

Six --lib tests are already red on main (they drifted while the tests were off the merge path): construction_authority_graph_tests::wall_now_authority_graph_is_total, floor_skip_frontier_tests::rename_does_not_enrol_names_already_declared_at_source, floor_skip_frontier_tests::rename_still_enrols_a_name_absent_from_the_source, nfr_tests::nfr_roster_receipt, process_cwd_mutation_reachability_gate::no_gating_test_reaches_a_process_cwd_mutator, process_cwd_mutation_reachability_gate::the_closure_still_finds_the_ignored_residue_it_is_scoped_around.

So the drop's retirement is not yet honest: there is no complete wall measurement, and the population is not green. Escalated to the parent for the route.

[gunbai-bot]

CI measurement 2: the complete wall. Head 7f06993, job 108723251802, hosted ubuntu-24.04-arm (4 vCPU / 16 GiB). The lint took 1m17s. The rust_unit_tests step took 36m53s, of which 6m14s was the release build and 30m39s the test run (finished in 1838.58s). The whole clippy job ran 38m25s, which is under the 90-min cap on the floor lane. The memory.max bind read back 12884901888, and there are no HostBudgetUnreadable refusals.

Result: 1155 tests, 992 passed, 8 failed, 155 ignored. The step is non-required, so the job concluded success.

The 8 red. Six are the ones already routed. Two are new, because the first run never reached them:

• compiler_tests::compiler_tests::function_value_named_application_controls_witness: positional function-value application refuses with EffectSummaryIncompleteAtFunctionValue { caller: "hof_positional.host" } where the test expects ADMIT.
• memory_governor::tests::whole_corpus_compile_another_repositorys_projection_refuses: the expected RefusedDemandsForAnotherRepository { projected_repositories: ["gunbc"] } did not match.

Top 20 by time. These are approximate: each figure is the gap between one test's completion line and the previous one's in the log. Tests run in parallel, so a gap is a lower bound on that test's own time, and stable cargo has no per-test report.

time	test
228.1s	cli_run::required_regen_host::regen_affected_set_tests::live_tree_controls_land_on_the_measured_arms
94.3s	cli_run::heartbeat_tests::render_heartbeat_line_mirror_matches_seed_oracle
93.4s	cli_run::required_regen_host::regen_round_cost_tests::live_module_mirrors_have_owners_and_removed_shell_owner_refuses
93.4s	cli_run::required_regen_host::regen_emission_scope_tests::the_model_selects_nothing_on_the_unlocatable_arm
92.7s	cli_run::required_floor_runner::pure_producer_share_tests::unimported_bare_provider_roster_edit_is_judged_across_frames
92.2s	cli_run::required_regen_host::regen_round_cost_tests::host_built_receipt_renders_through_the_model
91.9s	cli_run::required_floor_runner::pure_producer_share_tests::a_retirement_against_the_real_base_read_admits_and_a_growth_refuses
90.1s	cli_run::required_regen_host::regen_emission_scope_tests::host_selection_and_model_selection_agree
90.1s	cli_run::required_regen_host::regen_convergence_host_instrument_tests::install_admission_contains_the_destination_against_a_symlink
89.8s	cli_run::required_regen_host::regen_convergence_host_instrument_tests::mutating_transaction_binds_candidates_restores_and_reaches_staged_fixed_point
89.8s	cli_run::required_regen_host::regen_convergence_host_instrument_tests::stage_execution_joins_the_plan_to_independently_observed_effects
88.9s	cli_run::required_regen_host::regen_convergence_host_instrument_tests::population_joins_refuse_by_identity_and_admit_an_exact_partition
88.6s	cli_run::required_regen_host::regen_convergence_host_instrument_tests::mixed_role_two_mirror_candidate_installs_all_then_rebuilds_once
87.7s	cli_run::required_regen_host::regen_convergence_host_instrument_tests::install_admission_refuses_unaddressable_and_hand_maintained
86.9s	cli_run::required_regen_host::regen_convergence_host_instrument_tests::single_generation_input_still_promotes_alone
81.8s	cli_run::required_regen_host::regen_affected_set_tests::an_unlocatable_edited_path_refuses_and_selects_nothing
80.8s	cli_run::required_regen_host::regen_affected_set_tests::host_walk_and_model_fold_agree_on_the_fixture_graph
68.2s	cli_run::required_regen_host::tests::the_emitted_tree_package_graph_decodes_to_the_compiled_rows_at_a_settled_head
47.2s	cli_run::compile_clean::corpus_scope_tests::an_index_over_narrower_roots_does_not_know_the_corpus
35.5s	cli_run::required_regen_host::tests::filter_in_branch_condition_refuses_and_does_not_publish_the_module

Almost all of these are required_regen_host / required_floor_runner / live-tree tests that each take ~90s. That is the §3 witness-rule tell: each one re-runs production over the live corpus instead of supplying inputs. They are named here so they can become their own item.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-27T23:46:11.435037Z	7f06993	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[gunbai-bot]

Head a0da5bb: clippy job timeout is now 60 min, down from 120. That leaves margin over the measured 38m25s job (the unit-test step took 36m53s; the full measurement is in the earlier comment).

The rust_unit_tests step stays NON-required (continue-on-error) until the 8 reds on main are green. Because of that, rust_unit_tests_off_the_merge_path stays Standing in this PR. It is retired in the follow-up that makes the step required. Routing (neat-boar-16):

• the 8 reds go to their own work items;
• the ~18 live-tree tests at ~90s each are a separate §3 supply-inputs item.

[gunbai-bot]

Commit 1a551d23 addresses review 71958:

• Two copies of the memory bound. Both copies are gone: heal_publisher_cgroup_memory_max_bytes and compiler_gate_unit_test_memory_max_bytes are deleted. There is now one authority, gunbc.ci_spec hosted_arm_runner_cgroup_memory_max() -> Gibibyte (gibibyte(count: 12)). hosted_runner_memory_cgroup_bind_commands now takes a Gibibyte and renders its byte count through gibibyte_to_byte_size, and both callers pass the shared value.
• Numbers copied into comments. The comments no longer restate the counts or times. They cite witnesses run 36355834138 (and the first run on this PR), and that run's job record is where the timing is read.
• Check. I rendered expected_compiler_gate_yml and expected_heal_publisher_workflow_yml from the edited .dag and compared them with the committed witnesses.yml and heal-publish.yml. The bodies are byte-identical apart from the generated header and a trailing newline, so no generated file changes.

— sent from neat-ant-823

[gunbai-bot]

Commit 538905b95f addresses review 71977:

• Bare Int timeout. data compiler_gate_clippy_timeout_minutes: Int = 60 is now fn compiler_gate_clippy_timeout() -> Minute { minute(count: 60) }. It becomes a plain number only at the GHA timeout_minutes field, through minute_count(...), the same pattern gunbc.fleet_converge_workflow uses.
• Check. I re-rendered expected_compiler_gate_yml from the edited .dag. Its body is byte-identical to the committed witnesses.yml apart from the generated header and a trailing newline.
• Left alone. compiler_gate_timeout_minutes: Int = 45 is older debt that this PR doesn't touch, as the review itself says.

— sent from neat-ant-823

[gunbai-bot]

Commit ebf69a5375 addresses review 72000:

• Hand-written shell bind with no dissolution marker. The bind now carries a marker, gunbc.ci_spec hosted_runner_memory_cgroup_bind_shell_emit_dissolution_trigger (a DissolutionCondition, following the pattern of gunbc.native_frontier_workflow's hand-shell markers). It names both callers, the heal publisher prelude and compiler_gate_unit_test_command. Its trigger is the cgroup v2 leaf bind becoming a typed host effect rendered by the bash emitter (General orchestration intent to Bash emit fold over grammar rows #5828 / shell-to-intent Phase 2), taking the leaf name and a Gibibyte bound as values. When that lands, both callers switch to it and this function is deleted.
• Why I didn't model the bind as structured steps here. That typed op doesn't exist yet. Building it is the General orchestration intent to Bash emit fold over grammar rows #5828 capability, which is outside this PR's brief.
• Check. heal-publish.yml still renders byte-identical (apart from the generated header and a trailing newline). The marker is data, and the rendered YAML doesn't change.

— sent from neat-ant-823

[briansrls]

Verdict: APPROVE ebf69a5

No blocking finding for the explicitly ruled non-required observation step. The emitted rust_unit_tests step consumes repo_self_test_command after the required lint; continue-on-error is attached to that step, not to lint or the whole job. Its wrapper retains the actual command exit and failure receipt. The shared cgroup bind sets memory.max before moving the invoking shell into the leaf, so this is a real inherited bound rather than a planning override. The heal publisher retains its original bind sequence through the shared producer. The shell dissolution condition names the capability that replaces both callers.

The source and emitted workflow agree on a 60-minute clippy job timeout, not the stale 120-minute statement in the PR body. The measured complete earlier job was 38m25s; the recorded 992 passed / 8 failed / 155 ignored result is not a green test population. The Standing rust_unit_tests_off_the_merge_path drop is correctly NOT retired here, and DESIGN names the non-required status. A future required-step promotion still owes a green population and the acceptance-path cost/runner conditions. Job-level timeout or cancellation is not neutralized by a step's continue-on-error and must not be described as such.

Evidence limitation: completion-line gaps from parallel tests are not established per-test durations, so I do not credit the approximate top-20 table as a per-test cost profile. That does not invalidate the independently reported complete step/job wall or this observation-only enrollment. Exact-head workflow 36369118298 succeeded; that success is not a claim that the optional unit tests passed. Source/recorded-evidence review, no independent local rerun.