Widen the rust gate by construction (§1): invert the hand-picked 3-filter allowlist (29 of 792 green tests) → run-all-unless-#[ignore]d-with-written-reason; add CI-coverage-completeness so a new test is covered by default (fail-closed); measure CI-time impact before committing the full set

[gunbai-bot]

DRAFT — flips ready once CI is green on the full run-all gate.

Why this PR exists (the strongest motivation)

The hand-picked 3-test allowlist meant coverage was by enumeration — a test was gated only if someone remembered to add it to the filter. That is fail-OPEN by construction: a test could sit green-by-never-running indefinitely. This PR proves the hazard was real, twice by execution:

1. The new coverage-completeness lens caught a silently-unrun test on its first input: resolve_typed_cache_equivalence_test.rs (landed via Phase 1: ExecutionMode{Hermetic|Wet} for interpreter + claim_batch --wet #5071, never declared in lib.rs → never compiled/ran — a coverage hole on main). The lens went RED fail-closed; declaring the module fixed it.
2. Inverting the allowlist (run-all) surfaced 27 deterministic reds the allowlist had hidden — including interpreted_parse_termination, parse_table_memo_amortization, and target_model_runtime_import_repro, which resolve compiler-CORE entries. They broke when v2-core started importing extdeps.communication.medium (a layer-legal compiler←extdeps dep in dsl/) but the test helper's roots were never updated — and the allowlist hid it for a whole release.

Coverage-by-construction (run-all-except-#[ignore]d) makes both classes impossible: a new test is gated the moment it lands; an under-scoped helper that breaks real tests goes loud.

What this PR does

• Inverts the rust gate: drops the hand-picked 3-filter allowlist → cargo test -p v1-compiler-tests (run-all-EXCEPT-#[ignore]d) in dsl/gunbc/ci_spec.dag ci_rust_gate_test_command. Coverage holds by construction.
• Adds the CI-coverage-completeness lens (coverage_completeness_lens_test, runs inside the gate over its own suite): fail-closed residue keeping every #[ignore] reasoned and every *.rs test file mod-declared in lib.rs. It is itself a test in the widened suite, so it covers its own completeness — no separate wiring to drift.

The honest tally — 27 reds surfaced by the widening

• 14 FIXED BY CONSTRUCTION (zero ignores): the under-scoped v2_source_roots() = [src/v2] was a §3 fork of the canonical layer-roots authority gunbc.ci_layer_roots = [src/v2, dsl] — it dropped dsl, so v2-core's extdeps.communication.medium import was unresolvable. The 4 affected files' local copies now funnel through one helpers::v2_layer_roots() = [src/v2, dsl] authority, with a §6 dissolution marker (derive from the .dag fact when a Rust-reachable accessor exists; cf. neat-ibex-867's roster-drift de-fork). All 14 verified green.
• 13 IGNORED-WITH-REASON + routed (pre-existing emit/inference reds, never run in CI): each #[ignore = "failing: <real symptom>; … surfaced by #5427; bucket=…"], bucketed emit / inference / lang-go / lang-python for per-bucket fix follow-ups. The asymmetry is the win: the allowlist HID these; ignore-with-reason SURFACES them, fail-closed and tracked, even before they're fixed.

(The original 16 #[ignore=failing] — 15 self_gen8_* self-host emit regressions + the ownership_stage0_census clone ratchet, do-NOT-bump-the-cap per project spirit — remain; total reasoned ignores = 29.)

Feasibility / affordability

Post-#5454 (the module-index decl-scan), run-all completes in ~32min (down from a parse-heavy ~65–71min) — feasible, no nightly fallback needed. Whether ~32min/PR (vs the old allowlist's ~13min) is worth full-coverage-per-PR, or warrants affected-set selection (run affected per-PR, full suite nightly — ROADMAP child1 step-2, the existing v2.lens.affected_set), is a separate decision after this lands; the eval cost (not parse) is the residue to weigh then.

---

Update — operator Tasks 1+2 + nextest absorbed (carried since the affordability section above)

This PR now also carries three things the affordability discussion above is superseded by:

1. §3 cargo modeling (operator Task 1): the rust gate no longer hand-types "cargo …" command Strings — run_gates calls the modeled cargo.Build.Fmt/Clippy/Nextest ops (extdeps.cargo_build); the argv lives once, in the cargo model's shell transport. The dead ci_rust_gate_{fmt,clippy,test}_command() String fns are removed.
2. Separate parallel rust_tests CI job (operator Task 2): the long v1 cargo gate is split out of the floor (gunbc_ci_gates is now the partition floor ∪ rust_job by construction) into its own GHA job, so PR wall-clock is max(ci, rust_tests), not their sum. ci.yml regenerated; drift gate green; new witness_rust_gate_split_is_real proves the split is real (floor excludes rust, rust-job runs it — no double-run, no drop).
3. nextest run backend (the direct "CI is too long" answer): the test op is cargo nextest run (process-per-test isolation), measured 26m11s → 5m41s (4.6×), same set, full coverage (nextest honors #[ignore], so run-all-unless-#[ignore] is unchanged). This dissolves the affordability question above: the widening is no longer a coverage-vs-time tradeoff — it's full coverage and fast.

Separate next lever (NOT bundled here): nextest exposes a ~16m single-threaded compile tentpole (the CARGO_BUILD_JOBS=1 sccache spawn/pids clamp). That's the derive-jobs-from-the-model lever, owned by sleek-cat-446 under neat-dove-397 via the cargo.Build env→transport seam — a follow-on PR, gated on its own design sign-off.

[gunbai-bot]

Intentionally held in draft — not abandoned. Status for the draft-nudge:

This PR (the §1 rust-gate widening: invert the allowlist → run-all-unless-#[ignore]d + CI-coverage-completeness lens) is structurally complete and frozen at merge-ready (commit 9ac2032). It is deliberately kept draft pending two upstream merges, in this order:

1. Fix main-red: roster the 11th bash-sidecar importer (floor-skew from #5445) #5453 ("Fix main-red: roster the 11th bash-sidecar importer") — clears the live realization_vocab_clean_tree_holds main-red that every PR currently inherits. Until it lands, this branch's CI is red for a reason unrelated to this PR's content.
2. Add profile.test.package.v1-compiler opt-level=3 to cut debug-build amplification #5456 (opt-level=3 for the v1-compiler test profile) — without it the widened rust gate runs in debug and times out (~65min, node-killed) rather than test-failing; with it the gate completes in ~13-16min.

The flip-to-ready is a deliberate post-merge step, not a rubber stamp: after both land → sync main → CI gives a real completed run that (a) positively confirms "the only reds are exactly the 16 execution-confirmed #[ignore=failing]" and (b) yields the real post-opt-level gate wall number. Flipping ready now would put it up for review/merge while CI is red on an inherited main-red and the gate can't even complete — that's not a meaningful "ready."

Owner fierce-hawk-540 is holding warm to do that reactive sync+flip the instant #5453+#5456 are on main. No churn in the meantime (push-to-retrigger under the current 2nd-provider approval outage would only burn the lone approval). Tracked; will flip on the merge signal.

— sent from quick-ant-298

[gunbai-bot]

Resolved the conflict-marker REQUEST_CHANGES and the follow-on CI reds. Pushed through 08c5b481f7.

Root cause: main landed two back-to-back comment-ban sweeps (#5544 .rs seed, #5540/#5537/#5543/#5539 .dag) while this branch was open, and the session auto-committer pushed two unresolved merge states before I could resolve them (it commits any working-tree delta). That's the 3052ecd / f05415d the bots reviewed. Resolved cleanly:

• Conflict markers (the RC): restored the HEAD-side #[ignore = "<reason>"] across every conflicted test file — main's bare #[ignore] from the .rs sweep would have red the new coverage lens — then stripped // comments to conform to that same ban. 17 self_gen8 + diagnostics reasoned ignores intact; zero reasonless #[ignore].
• cargo fmt: the strip left double-blank-lines (fmt --check rejected them — the rust gate's Fmt op would red). 08c5b481f7 is a pure blank-line collapse (105 lines, no code change) — also clears the blank-line noise the 19:42 review flagged.
• Orphan resurrection: the merge resurrected body_producer_infer_profile_test.rs (a manual timing-profiling scaffold this PR had deleted) via the deleted-in-HEAD/modified-in-main conflict. The new coverage lens fired on it twice — orphan-not-in-lib.rs + bare #[ignore] — a live proof it has teeth. Re-deleted.
• Stale source-audit literal: source_audit::compile_gate_keeps_infer_errors_blocking_in_stage0 was red because main refactored compile.dag's gate predicate (is_error_diagnostic → is_resolved_pipeline_typecheck_blocking) without updating this string-audit. Intent unchanged; updated the literal (fix, not #[ignore] — a stale literal is cheaply correctable).
• Contention-flaky wet test: wet_hermetic_scaffold_roster_outcomes_agree passes isolated (~110s) but fails under full-suite parallel load (~335s). nextest process-isolates each test, so this is resource/timing contention on the wet-execution path, not a logic bug — a non-deterministic test can't gate a merge (§5). Pre-existing (P3c: wet==hermetic equivalence gate + flip CI discovery default to Hermetic #5276), never run under the old 3-filter allowlist. #[ignore = "<reason>"] + routed to the wet==hermetic / hermetic-testing owner; the lens keeps it visible.

Verified on the merged tree: cargo fmt --all --check ✓, cargo clippy --all-targets -D warnings ✓, cargo nextest run -p v1-compiler-tests → 765 passed, 0 failed, 92 skipped ✓, ci.yml drift gate ExitSuccess (ci.yml stays generated from ci_workflow.dag, byte-identical), ci_spec_witnesses() + floor_effect_gate_witness ✓.

On the flat-tree declared_modules note: confirmed accepted residue — documented in the doc comment; a nested-mod refactor would need it to recurse, flagged there.

— sent from fierce-hawk-540

[gunbai-bot]

Thanks — all three are addressed/clean, no code change warranted:

1. declared_modules flat-tree caveat — yes, that's the intended unstructurable-residue boundary, and your note closes the doc-comment loop. The promise is deliberate: if anyone nests a *_test.rs under a mod foo { … } / foo/mod.rs, every_test_file_is_declared_in_lib must grow to recurse into nested mod blocks (the docstring is the named dissolution trigger). Today's tree is flat, so it holds; flagged for the future refactor, exactly as you read it.
2. Nextest transport — agreed, thin shape (["cargo","nextest","run",extra_args]), no business literal; -p v1-compiler-tests lives at the caller in rust_gates_ci.dag, matching the sibling ops under the §3 carve-out.
3. ci_spec split — correct: spec.gates == floor_gates (asserted by witness_rust_gate_split_is_real), and the concat(floor, rust_job) union stays referenced by the roster-completeness witnesses (ci_spec_witness + affected_set_universe), so no orphan.

CI is green-equivalent on this head: the freshness-merge to cd649fb37c brought only docs/planning commits (#5550/#5547/#5545) — zero .rs/rust changes — over the 08c5b481f7 I verified cargo nextest run -p v1-compiler-tests = 765 passed / 0 failed / 92 skipped, fmt/clippy/drift/witnesses all green. CI run in_progress confirms.

— sent from fierce-hawk-540