briansrls · May 29, 2026 · May 28, 2026 · May 28, 2026 · May 28, 2026 · May 28, 2026
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -59,9 +59,10 @@ jobs:
       run: rustup default "$(rustup show active-toolchain | awk '{print $1; exit}')"
     - name: cargo fmt --all --check
       run: cargo fmt --all --check
-  # Affected-set detection — drives gating of v2/v3 jobs (frozen components
-  # only run their heavy CI when their source is touched, or on push-to-main
-  # for trunk verification). Cheap (~30s); other jobs depend on its outputs.
+  # Affected-set detection — drives gating of v2/v3/v4 jobs (path buckets modeled in
+  # `src/v4/workflow/ci.dag`; host transport `detect-ci-affected-components` in
+  # `tools/ci_affected_components`, outside v3-compiler so v3=false can emit without
+  # compiling the frozen v3 package). First run on a cold runner compiles this tiny crate only.
   affected:
     if: github.event.pull_request.draft != true
     runs-on: [self-hosted, linux, arm64]
@@ -72,18 +73,29 @@ jobs:
       v4: ${{ steps.detect.outputs.v4 }}
       workflow_policy: ${{ steps.detect.outputs.workflow_policy }}
     steps:
+    - name: Isolate toolchain dirs (srv1/srv2 shared-$HOME concurrent-rustup race)
+      run: |
+        echo "CARGO_HOME=$RUNNER_TEMP/cargo" >> "$GITHUB_ENV"
+        echo "RUSTUP_HOME=$RUNNER_TEMP/rustup" >> "$GITHUB_ENV"
     - name: Clear inherited GitHub auth header (shared runner HOME)
       run: git config --global --unset-all http.https://github.com/.extraheader || true
     - name: Checkout
       uses: actions/checkout@v4
       with:
         fetch-depth: 0
+    - name: Setup Rust
+      uses: actions-rust-lang/setup-rust-toolchain@v1.16.0
+      with:
+        cache: false
+        rustflags: ''
+    - name: Pin global rustup default (isolated RUSTUP_HOME has no default toolchain)
+      run: rustup default "$(rustup show active-toolchain | awk '{print $1; exit}')"
     - name: Fetch main for diff base
       if: github.event_name == 'pull_request'
       run: git fetch origin main:refs/remotes/origin/main
     - name: Detect affected components
       id: detect
-      run: bash scripts/detect-affected-components.sh "${{ github.event_name }}" "$GITHUB_OUTPUT"
+      run: cargo run -p ci_affected_components --bin detect-ci-affected-components -- "${{ github.event_name }}" "$GITHUB_OUTPUT"
   ci:
     if: github.event.pull_request.draft != true
     needs: [affected]
@@ -230,6 +242,7 @@ jobs:
       timeout-minutes: 20
       env:
         V4_M1_RUST_EMIT_OUT: ${{ runner.temp }}/v4-rust-emit
+        V4_M1_CARGO_CHECK_JOBS: "4"
       run: bash scripts/v4-m1-rust-emit-probe.sh
     - name: v2 → v4 bootstrap compile (fail-closed full)
       if: needs.affected.outputs.v4 == 'true'

diff --git a/Cargo.lock b/Cargo.lock
diff --git a/Cargo.toml b/Cargo.toml
@@ -6,6 +6,7 @@ members = [
     "src/v2/tests",
     "src/v3/compiler",
     "tools/gen_gunbc_ci_workflow_dag",
+    "tools/ci_affected_components",
     "src/v3/grounding_pilot",
     "src/v3/grounding_engine",
     "src/v3/grounding_lifetime",

diff --git a/_internal/INVARIANTS_OPS.md b/_internal/INVARIANTS_OPS.md
diff --git a/dsl/gunbc/ci_github_actions_workflow.dag b/dsl/gunbc/ci_github_actions_workflow.dag
@@ -101,6 +101,16 @@ data gunbc_ci_github_actions_workflow: Workflow = {
       name: none,
       runner: SelfHosted { labels: ["self-hosted", "linux", "arm64"] },
       steps: [RunStep {
+          name: Some { value: "Isolate toolchain dirs (srv1/srv2 shared-$HOME concurrent-rustup race)" },
+          id: none,
+          run: "echo \"CARGO_HOME=$RUNNER_TEMP/cargo\" >> \"$GITHUB_ENV\"\necho \"RUSTUP_HOME=$RUNNER_TEMP/rustup\" >> \"$GITHUB_ENV\"\n",
+          shell: Bash,
+          env: none,
+          working_directory: none,
+          if_condition: none,
+          continue_on_error: false,
+          timeout_minutes: none
+        }, RunStep {
           name: Some { value: "Clear inherited GitHub auth header (shared runner HOME)" },
           id: none,
           run: "git config --global --unset-all http.https://github.com/.extraheader || true",
@@ -119,6 +129,25 @@ data gunbc_ci_github_actions_workflow: Workflow = {
           if_condition: none,
           continue_on_error: false,
           timeout_minutes: none
+        }, UsesStep {
+          name: Some { value: "Setup Rust" },
+          id: none,
+          uses: { owner: "actions-rust-lang", repo: "setup-rust-toolchain", ref: "v1.16.0" },
+          with: { "cache": "false", "rustflags": "" },
+          env: none,
+          if_condition: none,
+          continue_on_error: false,
+          timeout_minutes: none
+        }, RunStep {
+          name: Some { value: "Pin global rustup default (isolated RUSTUP_HOME has no default toolchain)" },
+          id: none,
+          run: "rustup default \"$(rustup show active-toolchain | awk '{print $1; exit}')\"",
+          shell: Bash,
+          env: none,
+          working_directory: none,
+          if_condition: none,
+          continue_on_error: false,
+          timeout_minutes: none
         }, RunStep {
           name: Some { value: "Fetch main for diff base" },
           id: none,
@@ -132,7 +161,7 @@ data gunbc_ci_github_actions_workflow: Workflow = {
         }, RunStep {
           name: Some { value: "Detect affected components" },
           id: Some { value: "detect" },
-          run: "bash scripts/detect-affected-components.sh \"${{ github.event_name }}\" \"$GITHUB_OUTPUT\"",
+          run: "cargo run -p ci_affected_components --bin detect-ci-affected-components -- \"${{ github.event_name }}\" \"$GITHUB_OUTPUT\"",
           shell: Bash,
           env: none,
           working_directory: none,
@@ -453,7 +482,7 @@ data gunbc_ci_github_actions_workflow: Workflow = {
           id: none,
           run: "bash scripts/v4-m1-rust-emit-probe.sh",
           shell: Bash,
-          env: { "V4_M1_RUST_EMIT_OUT": "${{ runner.temp }}/v4-rust-emit" },
+          env: { "V4_M1_RUST_EMIT_OUT": "${{ runner.temp }}/v4-rust-emit", "V4_M1_CARGO_CHECK_JOBS": "4" },
           working_directory: none,
           if_condition: Some { value: "needs.affected.outputs.v4 == 'true' || needs.affected.outputs.workflow_policy == 'true'" },
           continue_on_error: true,

diff --git a/scripts/ci-merge/sg0-pr-body-append.3853.txt b/scripts/ci-merge/sg0-pr-body-append.3853.txt
@@ -0,0 +1,5 @@
+SG-0 hand-path delta: +0
+
+SG-0 pairing: (c) Net +0 on `EXPECTED_HAND_AUTHORED_NON_TEST` — T-24 interim Rust mirrors (`tools/ci_affected_components` lib/main/runner_pool) live outside v3-compiler SG-0 census with INVARIANTS §P5(b) rows. Follow-up dispatch: dissolve when `ci.dag` eval / generated CI runner owns affected-set and M1 parallelism without parallel Rust path logic (T-24 emission slice; tracked gunbc#3853).
+
+SG-0 pairing: (c) Net +0 on `EXPECTED_HAND_AUTHORED_TEST` — same-path expansion of `v4_workflow_ci_runner_dag_smoke_test.rs` (INVARIANTS §P5(b) row updated per PR #3853): set-equality `ci.dag` ↔ `tools/ci_affected_components` path-bucket parity (`v4_workflow_ci_workflow_policy_prefixes_align_rust_mirror`, `v4_workflow_ci_component_bucket_prefixes_align_rust_mirror`) plus behavioral fixtures aligned with `ci_component_affected.dag` (`assert_ci_dag_rust_mirror_full_parity` in M1 `--exact` binding step). Deferral: `_internal/ROADMAP_OPS.md` § **Nine lanes** row **T-PB-B** / `pb_rust_tests_outside_residual_zero`; dissolve when affected-set projection runs from `.dag` eval only (tracked gunbc#3853).
diff --git a/scripts/detect-affected-components.sh b/scripts/detect-affected-components.sh
diff --git a/scripts/v4-m1-rust-emit-probe.sh b/scripts/v4-m1-rust-emit-probe.sh
@@ -15,7 +15,8 @@
 #   V4_M1_RUSTC_LOG           — cargo check log (default: ${OUT}.rustc.log)
 #   V4_M1_RUST_EMIT_PROBE_STRICT — if 1, exit non-zero when compile or rustc fails
 #   V4_M1_RUSTC_TIMEOUT_SECS  — optional timeout for cargo check (CI: 600)
-#   V4_M1_CARGO_CHECK_JOBS    — parallelism cap for cargo check (default: 4)
+#   V4_M1_CARGO_CHECK_JOBS    — parallelism cap for cargo check (default: 4; modeled
+#                               as m1_probe_cargo_check_jobs in src/v4/workflow/ci.dag)
 
 set -euo pipefail
 
@@ -115,7 +116,8 @@ if [[ "$compile_status" -eq 0 && -f "$out/Cargo.toml" ]]; then
   fi
   # Cap parallelism: many concurrent CI runs each fan out rustc workers through
   # ctrl-build wrappers; without a cap the aggregate process count can reach swap
-  # on shared self-hosted runners (incident 2026-05-28).
+  # on shared self-hosted runners (incident 2026-05-28). CI sets
+  # V4_M1_CARGO_CHECK_JOBS from v4.workflow.ci `m1_probe_cargo_check_jobs` (srv1/srv2 pool).
   cargo_check_jobs="${V4_M1_CARGO_CHECK_JOBS:-4}"
   set +e
   if [[ -n "$rustc_timeout" ]]; then

diff --git a/src/v3/compiler/Cargo.toml b/src/v3/compiler/Cargo.toml
@@ -45,6 +45,7 @@ libc = { version = "0.2", default-features = false }
 # `docs/briefs/r3-pb-tier3-perf-budget-worker.md` deliverable 0a/0b.
 criterion = "0.5"
 gen_gunbc_ci_workflow_dag = { path = "../../../tools/gen_gunbc_ci_workflow_dag" }
+ci_affected_components = { path = "../../../tools/ci_affected_components" }
 serde = { workspace = true }
 serde_json = { workspace = true }
 # T-V2 G-1 manifest ratchet: structured Cargo.toml walk (`toml` value parse).