Widen the rust gate by construction (§1): invert the hand-picked 3-filter allowlist (29 of 792 green tests) → run-all-unless-#[ignore]d-with-written-reason; add CI-coverage-completeness so a new test is covered by default (fail-closed); measure CI-time impact before committing the full set

.github/workflows/ci.yml

@@ -88,3 +88,102 @@ jobs:
           sccache --show-stats 2>/dev/null || true
           git fetch --no-tags origin main 2>/dev/null || true
           "$ROOT/target/release/claim_executor" --source-root dsl --source-root src/v2 --plan-entry src/v2/workflow/ci_floor_plan.dag --plan-function gunbc_ci_floor_batches --notice-title "v2 claim corpus"
+  rust_tests:
+    runs-on: [self-hosted, linux, arm64]
+    timeout-minutes: 360
+    steps:
+      - name: Isolate toolchain dirs
+        run: |
+          echo "CARGO_HOME=$RUNNER_TEMP/cargo" >> "$GITHUB_ENV"
+          echo "RUSTUP_HOME=$RUNNER_TEMP/rustup" >> "$GITHUB_ENV"
+          if sccache --show-stats >/dev/null 2>&1; then
+            echo "RUSTC_WRAPPER=sccache" >> "$GITHUB_ENV"
+            echo "CARGO_INCREMENTAL=0" >> "$GITHUB_ENV"
+            echo "CARGO_BUILD_JOBS=1" >> "$GITHUB_ENV"
+          else
+            echo "CARGO_BUILD_JOBS=2" >> "$GITHUB_ENV"
+          fi
+      - name: Checkout
+        uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+      - name: Setup Rust
+        uses: actions-rust-lang/setup-rust-toolchain@v1.16.0
+        with:
+          components: rustfmt
+          cache: false
+          rustflags: ''
+        env:
+          HOME: ${{ runner.temp }}
+      - name: Pin rustup default (isolated RUSTUP_HOME has no default toolchain)
+        run: rustup default "$(rustup show active-toolchain | awk '{print $1; exit}')"
+      - name: Cache Cargo
+        uses: actions/cache@v5
+        with:
+          path: |
+            ${{ runner.temp }}/cargo/registry/index/
+            ${{ runner.temp }}/cargo/registry/cache/
+            ${{ runner.temp }}/cargo/git/db/
+            target/
+          key: cargo-ci-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('**/Cargo.lock', 'rust-toolchain.toml') }}
+          restore-keys: |
+            cargo-ci-${{ runner.os }}-${{ runner.arch }}-
+      - name: Install cargo-nextest
+        run: |
+          echo "$CARGO_HOME/bin" >> "$GITHUB_PATH"
+          if ! "$CARGO_HOME/bin/cargo-nextest" nextest --version >/dev/null 2>&1; then
+            mkdir -p "$CARGO_HOME/bin"
+            case "$(uname -m)" in aarch64|arm64) A=linux-arm ;; *) A=linux ;; esac
+            curl -LsSf --retry 3 "https://get.nexte.st/0.9.138/$A" | tar zxf - -C "$CARGO_HOME/bin"
+          fi
+      - name: v1 rust gate (fmt + clippy + nextest)
+        run: |
+          ROOT=$(git rev-parse --show-toplevel 2>/dev/null || pwd)
+          set -o pipefail
+          BUILD_LOG=$(mktemp)
+          if ! (cargo build -p v1-compiler --release --features text_lookup_work_counter --bins) 2>&1 | tee "$BUILD_LOG"; then
+            if grep -qiE 'Resource temporarily unavailable|failed to spawn|sccache: encountered fatal error' "$BUILD_LOG"; then
+              echo "::warning::cargo/sccache EAGAIN under fleet pressure; cold retry CARGO_BUILD_JOBS=1 (keep sccache)"
+              RETRY_LOG=$(mktemp)
+              if ! ( CARGO_BUILD_JOBS=1 cargo build -p v1-compiler --release --features text_lookup_work_counter --bins ) 2>&1 | tee "$RETRY_LOG"; then
+                if grep -qiE 'Resource temporarily unavailable|failed to spawn|sccache:' "$RETRY_LOG"; then
+                  echo "::warning::cargo/sccache still failing; retry without RUSTC_WRAPPER"
+                  env -u RUSTC_WRAPPER CARGO_BUILD_JOBS=1 cargo build -p v1-compiler --release --features text_lookup_work_counter --bins || exit 1
+                else
+                  exit 1
+                fi
+              fi
+              rm -f "$RETRY_LOG"
+            else
+              exit 1
+            fi
+          fi
+          rm -f "$BUILD_LOG"
+          if '[' '!' '-x' "$ROOT"'/target/release/claim_executor' ']'; then 'echo' '::error::build verification: declared artifact '\''claim_executor'\'' absent or not executable after a '\''successful'\'' build (sccache/cache corruption — DESIGN §5 fail-open); failing closed: '"$ROOT"'/target/release/claim_executor' >&2; exit 1; fi
+          GUNBC_BUILD_FRESHNESS_NEWER_SRC=$('find' "$ROOT"'/src/v1/stage0' "$ROOT"'/src/v1/stage0_core' "$ROOT"'/src/v1/stage0_emit_core' '(' '-name' '*.rs' '-o' '-name' 'Cargo.toml' '-o' '-name' 'Cargo.lock' ')' '-newer' "$ROOT"'/target/release/claim_executor' '-print' '-quit')
+          if '[' '-n' "$GUNBC_BUILD_FRESHNESS_NEWER_SRC" ']'; then 'echo' '::error::build verification: declared artifact '\''claim_executor'\'' is older than a source file (stale — DESIGN §5 fail-open); failing closed: '"$ROOT"'/target/release/claim_executor' >&2; exit 1; fi
+          if '[' '!' '-x' "$ROOT"'/target/release/gunbc' ']'; then 'echo' '::error::build verification: declared artifact '\''gunbc'\'' absent or not executable after a '\''successful'\'' build (sccache/cache corruption — DESIGN §5 fail-open); failing closed: '"$ROOT"'/target/release/gunbc' >&2; exit 1; fi
+          GUNBC_BUILD_FRESHNESS_NEWER_SRC=$('find' "$ROOT"'/src/v1/stage0' "$ROOT"'/src/v1/stage0_core' "$ROOT"'/src/v1/stage0_emit_core' '(' '-name' '*.rs' '-o' '-name' 'Cargo.toml' '-o' '-name' 'Cargo.lock' ')' '-newer' "$ROOT"'/target/release/gunbc' '-print' '-quit')
+          if '[' '-n' "$GUNBC_BUILD_FRESHNESS_NEWER_SRC" ']'; then 'echo' '::error::build verification: declared artifact '\''gunbc'\'' is older than a source file (stale — DESIGN §5 fail-open); failing closed: '"$ROOT"'/target/release/gunbc' >&2; exit 1; fi
+          sccache --show-stats 2>/dev/null || true
+          git fetch --no-tags origin main 2>/dev/null || true
+          set -o pipefail
+          BUILD_LOG=$(mktemp)
+          if ! ("$ROOT/target/release/gunbc" run --source-root dsl --source-root src/v2 --entry dsl/tools/rust_gates_ci.dag --function main) 2>&1 | tee "$BUILD_LOG"; then
+            if grep -qiE 'Resource temporarily unavailable|failed to spawn|sccache: encountered fatal error' "$BUILD_LOG"; then
+              echo "::warning::cargo/sccache EAGAIN under fleet pressure; cold retry CARGO_BUILD_JOBS=1 (keep sccache)"
+              RETRY_LOG=$(mktemp)
+              if ! ( CARGO_BUILD_JOBS=1 "$ROOT/target/release/gunbc" run --source-root dsl --source-root src/v2 --entry dsl/tools/rust_gates_ci.dag --function main ) 2>&1 | tee "$RETRY_LOG"; then
+                if grep -qiE 'Resource temporarily unavailable|failed to spawn|sccache:' "$RETRY_LOG"; then
+                  echo "::warning::cargo/sccache still failing; retry without RUSTC_WRAPPER"
+                  env -u RUSTC_WRAPPER CARGO_BUILD_JOBS=1 "$ROOT/target/release/gunbc" run --source-root dsl --source-root src/v2 --entry dsl/tools/rust_gates_ci.dag --function main || exit 1
+                else
+                  exit 1
+                fi
+              fi
+              rm -f "$RETRY_LOG"
+            else
+              exit 1
+            fi
+          fi
+          rm -f "$BUILD_LOG"

dsl/extdeps/rust/cargo_build.dag

@@ -32,6 +32,21 @@ service cargo.Build {
     }
   }
 
+  operation Nextest {
+    input { extra_args: List<String> = [] }
+    output {
+      success: Bool from "exit_success"
+      stdout: String from "stdout"
+      stderr: String from "stderr"
+    }
+    transport shell { argv: ["cargo", "nextest", "run", extra_args] }
+    exit {
+      0 => Unit
+      100 => String "Tests failed"
+      nonzero => String "Nextest run error"
+    }
+  }
+
   operation Clippy {
     input {
       extra_args: List<String> = []

dsl/gunbc/ci_spec.dag

@@ -31,8 +31,7 @@ type CiSpec {
   notice_title: String
 }
 
-data gunbc_ci_gates: List<Gate> = [
-  RustMonolithGate,
+data gunbc_ci_floor_gates: List<Gate> = [
   EmitHostGate,
   LayeringImportsGate,
   ResolvedImportsGate,
@@ -42,8 +41,14 @@ data gunbc_ci_gates: List<Gate> = [
   SourceRootIngestGate
 ]
 
+data gunbc_ci_rust_job_gates: List<Gate> = [
+  RustMonolithGate
+]
+
+data gunbc_ci_gates: List<Gate> = concat(gunbc_ci_floor_gates, gunbc_ci_rust_job_gates)
+
 data gunbc_ci_spec: CiSpec = {
-  gates: gunbc_ci_gates,
+  gates: gunbc_ci_floor_gates,
   diff_policy: {
     base: "origin/main",
     head: "HEAD",
@@ -157,18 +162,6 @@ fn ci_release_build_script() -> String {
   )
 }
 
-fn ci_rust_gate_fmt_command() -> String {
-  "cargo fmt --all --check"
-}
-
-fn ci_rust_gate_clippy_command() -> String {
-  "cargo clippy --all-targets -- -D warnings"
-}
-
-fn ci_rust_gate_test_command() -> String {
-
-  "cargo test -p v1-compiler-tests -- interp_recorded_fixture wet_hermetic resolve_expr_types_retraversal"
-}
 
 fn claim_executor_bin_shell() -> String {
   "\"$ROOT/target/release/claim_executor\""
@@ -217,3 +210,22 @@ fn gunbc_ci_run_script(spec: CiSpec) -> String {
 fn gunbc_ci_workflow_run(spec: CiSpec) -> String {
   gunbc_ci_run_script(spec: spec)
 }
+
+fn gunbc_ci_rust_gate_invoke() -> String {
+  ci_cargo_eagain_retry_script(
+    command: concat(
+      concat("\"$ROOT/target/release/gunbc\" run", witness_layer_source_flags(roots: witness_layer_roots)),
+      " --entry dsl/tools/rust_gates_ci.dag --function main"
+    )
+  )
+}
+
+fn gunbc_ci_rust_job_run() -> String {
+  concat(
+    concat(ci_release_build_script(), "\n"),
+    concat(
+      concat(git_fetch_script(policy: gunbc_ci_spec.diff_policy), "\n"),
+      gunbc_ci_rust_gate_invoke()
+    )
+  )
+}