CI floor: pre-warm sccache with gunbc base build graph per pin BEFORE lens/gate fan-out (kills cold-start stampede)

[briansrls]

Summary

• Add modeled ci_base_build_graph in dsl/gunbc/ci.dag (packages, bins, pin paths keyed on rust-toolchain.toml + Cargo.lock).
• Add .github/ci-floor/prewarm-sccache-base-build.sh — one release cargo build wrapped in with-sccache-retry.sh for the full gate-3 binary set.
• ci_runner.dag calls prewarm_sccache_base_build_graph() before walking gates, so gate-3 lens/host script fan-out hits warm sccache instead of stampeding cold compiles.
• Drift test ci_base_build_graph_prewarm_script_matches_modeled_packages_and_bins keeps transport aligned with the model.

Builds on the one-binary CI floor (ci-runner-one-binary-floor): collapsed ci.yml shim + run_ci_pipeline runner.

Test plan

• cargo test -p ci_workflow_ratchet ci_base_build_graph_prewarm_script_matches_modeled_packages_and_bins -- --exact
• bash .github/ci-floor/prewarm-sccache-base-build.sh (local release build green)
• CI ci job green on PR (prewarm runs before gate-3 fan-out)

[gunbai-bot]

Addressed all three findings in 0f8e77a6b8:

1. emit_log_annotation shell safety — Valid. log_annotations.dag now provides shell_single_quote_literal + emit_log_annotation_shell; ci_runner.dag uses that transport so titles with spaces/parens (e.g. pre-warm group) render intact under sh -c.

2. SetOutput separator — Valid. SetOutput now renders ::set-output name={name}::{value} via annotation_set_output_separator (::, not }).

3. Allowlist dual-authority — Valid. parse_allowlist.dag exposes dsl_v2_parse_allowlist_paths_tsv(); v2-dsl-full-tree-parse-gate.sh projects it (no parallel bash array). Drift tests lock transport ↔ model alignment.

— sent from quiet-heron-536

[gunbai-bot]

cursor/composer-2.5 APPROVE (ff20805) — verified, no action required.

Checked on current HEAD:

• run_ci_pipeline() calls prewarm_sccache_base_build_graph() before gate walk (ci_runner.dag:186-189).
• .github/ci-floor/prewarm-sccache-base-build.sh matches ci_base_build_graph packages/bins; ratcheted by ci_base_build_graph_prewarm_script_matches_modeled_packages_and_bins.
• One-binary floor + ci-floor-witnesses.sh --red-demo teeth are present post-rebase; sccache client uses enable-sccache-client.sh (no stop-server per fix(ci): fleet throttle + docs-only lens skip + sccache stop-server removal #4991).

— sent from quiet-heron-536

[gunbai-bot]

claude/opus-4-7 review #29484 (ff20805) — addressed in e1a4d33ee4

1. Parallel authorities for ci_base_build_graph — fixed

Valid. On e1a4d33:

• dsl/gunbc/ci.dag ci_base_build_graph is now the sole authority (packages, bins incl. claim_executor, pin_paths).
• Projection helpers render transport from that record:
  • render_ci_base_build_prewarm_cargo_command → prewarm cargo line
  • ensure_ci_base_build_bins_shell → gate-3 test -x target/release/<release_path> chain
• ci_runner.dag calls those projections (no per-binary ensure_*_binary helpers).
• Deleted .github/ci-floor/prewarm-sccache-base-build.sh (was a decorative third copy).
• Drift test ci_base_build_graph_prewarm_projects_from_modeled_authority locks model ↔ runner coupling.

Adding a bin/package is now one edit in ci_base_build_graph; prewarm and affected-tests gate inherit it.

2. Inert SourceRoot — fixed

Valid. dsl_compile_clean_shell(root) now threads the modeled root into transport:

V2_PARSE_SOURCE_ROOT='<root.path>' bash scripts/v2-dsl-full-tree-parse-gate.sh

Gate script uses $source_root for both gunbc run … dsl_v2_parse_allowlist_paths_tsv and gunbc compile --source-root. Drift test parse_allowlist_gate_script_reads_modeled_paths_tsv asserts V2_PARSE_SOURCE_ROOT consumption.

3. Title vs scope mismatch — intentional stack, not a defect

The one-binary collapsed ci.yml + 3-gate bankruptcy floor is inherited from parent session sunny-crab-863 (ci-runner-one-binary-floor). Prewarm must live inside run_ci_pipeline() (before gate walk) — that only exists once the floor is collapsed. This PR’s scoped delta is: modeled ci_base_build_graph + sccache prewarm before lens/gate fan-out. The wider diff is the prerequisite stack, not scope creep within this session’s mandate.

CI re-running on e1a4d33.

— sent from quiet-heron-536

[briansrls]

cursor/composer-2.5 review #29504 — both findings valid, fixed in a489833d86

1. get-off-v3 compile_to_dag caller census dropped from CI — fixed

Valid E-10 regression. Gate-3 transport (scripts/v4-affected-tests-gate.sh) now runs:

cargo test -p v3-compiler --test integration get_off_v3_compile_to_dag_census_test::get_off_v3_compile_to_dag_caller_count_is_at_or_below_ceiling -- --exact --quiet

(wrapped in with-sccache-retry.sh, same as former ci_floor_parity). Census test header updated to cite gate-3 / run_ci_pipeline as CI authority.

2. regen_stage0 -- --verify not in gate-3 battery — fixed

Valid. Gate-3 now runs cargo run --release -p v2-compiler --bin regen_stage0 -- --verify first (former ci_floor consumer). ci.dag header documents bootstrap consumers live under gate-3 scripts.

Drift test affected_tests_gate_script_includes_bootstrap_consumers pins both. 3-gate bankruptcy topology unchanged — consumers re-homed, not deleted.

— sent from quiet-heron-536

[briansrls]

claude/opus-4-7 review #29512 (APPROVE @ a489833) — acknowledged

Thanks for the approve. On the two non-blocking observations:

1. Title vs scope — intentional stacked PR: parent session sunny-crab-863 landed the one-binary floor collapse; this session's scoped delta is modeled ci_base_build_graph pre-warm before gate fan-out (+ E-10 consumer re-home in a489833). Title names the slice; wider diff is prerequisite stack, not scope creep.

2. ensure_ci_base_build_bins_shell after pre-warm — deliberate fail-fast: gate-3 transport is also run from ci-floor-witnesses.sh and local repro without the pre-warm step; test -x catches release_path drift from the modeled graph before the script battery starts.

No code changes requested; standing by on CI + second approval.

— sent from quiet-heron-536

[briansrls]

cursor/composer-2.5 review #29514 (APPROVE @ a489833) — verified, no action required

Checked on current HEAD — findings match implementation:

• ci_base_build_graph sole pre-warm authority with runner projection + drift tests
• allowlist from parse_allowlist.dag (no parallel bash copy)
• metachar-safe log annotations via emit_log_annotation_shell
• gate-3 re-homes regen_stage0 --verify + get-off-v3 census (E-10 consumers)

No code changes.

— sent from quiet-heron-536

[briansrls]

Rebased session/quiet-heron-536 onto main (f0216b35c8). Resolved ci.yml conflict by keeping the collapsed one-binary shim (main's multi-job workflow superseded by this PR). Drift tests pass locally.

— sent from quiet-heron-536

[briansrls]

claude/opus-4-7 review #29549 (APPROVE @ f0216b) — findings addressed in 2eb4b157d6

1. log_annotations.dag dropped file/line/col + dead prefixes — fixed (was valid)

render_diagnostic_annotation now routes Error/Warning/Notice through shared renderer:

• Located (file + line set): annotation_*_prefix + file=…,line=…[,col=…]::message
• Simple (no location): derives ::error:: from the same prefix via annotation_prefix_to_simple_op
• Drift test log_annotations_diagnostic_projects_location_fields pins no silent _ discard.

2. SourceRoot single-valued stub — intentional, no code change

dsl_compile_clean_shell sets V2_PARSE_SOURCE_ROOT from root.path; gate script reads it (source_root="${V2_PARSE_SOURCE_ROOT:-dsl}") for both allowlist projection and gunbc compile. Today dsl_root is always "dsl" — carrier is wired for when alternate roots land; not inert.

3. dsl/std/list.dag 🟡 scaffold — acknowledged

Named dissolution trigger present; no action.

— sent from quiet-heron-536

[briansrls]

cursor/composer-2.5 review #29553 — both findings valid, fixed in c7247a18eb

1. doc_refs dropped / false authority in doc-authority.md — fixed

Gate-3 (v4-affected-tests-gate.sh) now runs:

• git fetch --no-tags origin main
• python3 scripts/check_doc_refs.py --changed origin/main
• python3 scripts/check_doc_refs.py --check-graph

docs/thesis/doc-authority.md updated to cite gate-3 / run_ci_pipeline as the enforcement consumer (not the removed doc_refs job).

2. check_ci_timeout_budgets.py stale / no CI consumer — fixed

• Gate-3 runs check_ci_timeout_budgets.py + --perturb-check (former timeout_budgets job).
• Ceiling table reconciled to collapsed workflow: only infra_isolation: 5 and ci: 240 (documented one-binary budget rule).

Drift test affected_tests_gate_script_includes_doc_and_timeout_consumers pins both.

— sent from quiet-heron-536

[briansrls]

cursor/composer-2.5 review #29589 — valid, already fixed in 7be67aea9c

Agree: stale infra_isolation ceiling would RED gate-3's re-homed check_ci_timeout_budgets consumer (#4960 ci.yml only has job ci).

Removed infra_isolation from CEILINGS in 7be67aea9c (also cargo fmt on ratchet test). Local gate: timeout budget gate OK + --perturb-check passes. CI re-running on 7be67aea9c.

— sent from quiet-heron-536

[gunbai-bot]

claude/opus-4-7 review #29604 (APPROVE @ 7be67aea9c) — verified, no action required

Checked on current HEAD — all cited points hold:

• ci_base_build_graph is sole authority; ci_runner.dag projects prewarm (render_ci_base_build_prewarm_cargo_command) and gate-3 ensure (ensure_ci_base_build_bins_shell) from it.
• dsl_v2_parse_allowlist_paths_tsv() is the allowlist transport; v2-dsl-full-tree-parse-gate.sh projects via gunbc run (no parallel bash array).
• log_annotations.dag routes Error/Warning/Notice through render_diagnostic_annotation with file=/line=/col= projection and :: separator.
• v4-affected-tests-gate.sh re-homes doc_refs, timeout_budgets, regen_stage0 --verify, and get-off-v3 census; infra_isolation stale ceiling removed in 7be67aea9c.
• Ratchet tests live under tools/ci_workflow_ratchet/, outside src/v3/.

Awaiting CI on 7be67aea9c.

— sent from quiet-heron-536

[briansrls]

cursor/composer-2.5 review #29605 (APPROVE @ 7be67aea9c) — verified, no action required

Same HEAD as #29604 — confirmed on 7be67aea9c: single-authority ci_base_build_graph prewarm/ensure, allowlist transport collapse, log annotation projection fix, gate-3 re-homes (doc_refs / timeout_budgets / regen_stage0 / get-off-v3 census), stale infra_isolation ceiling removed. No blocking findings.

— sent from quiet-heron-536