CI false-green build fix (§1): derive build-step success from declared-artifact presence+freshness, not exit-code alone — sccache corruption ⇒ exit-0-with-no-artifact is a §5 fail-open IN the floor itself, masks every downstream gate

[gunbai-bot]

Summary

Closes the §1/§5 CI false-green build hole: a build that exits 0 with no/stale artifact (sccache false cache-hit ⇒ no relink) was a fail-open inside the CI floor itself — downstream gates then ran a stale/missing binary and passed green, masking every check. Build success was judged by exit code alone (ci_release_build_script; host_prelude ensure_*_built checked -x only before building, never after, and never freshness).

Fixed by construction, not validation (DESIGN §5/§6) and with single authority (§3): a build step is modeled as producing declared artifacts, and success is derived:

built ⟺ exit_success ∧ (∀ a ∈ produces: a exists ∧ no source is newer than a)

What changed

• dsl/tools/build_step.dag (new): BuildStep{command, produces, source_roots, source_pattern} + one generator (emit_verifications / verifications_script) that emits, after the build, existence (PRIMARY — catches exit-0-with-no-artifact) then source-relative freshness (find <roots> -name '*.rs' -newer <artifact> -print -quit, the make/ninja up-to-date definition — false-positive-free, unlike a ≥ build_start proxy that cries wolf on a legit no-op rebuild). Both are fail-closed exit 1 statements built on the existing extdeps.languages.bash.program substrate.
• Realizer = bash codegen from the model (not a live host effect). Every floor build site is emitted shell run as a bootstrap: ci.yml bash runs before the interpreter binary exists; host gates serialize one shell.Exec that builds and uses the binary atomically under set -e. There is no live-interpreter seam, so: no new host effect, no transport-type edit, no interpreter edit.
• All three build sites routed through the one generator: gunbc.ci_spec release bootstrap (declares claim_executor + gunbc) and host_prelude ensure_*_built ×2 (new ensure_bin_built_and_verified helper — kills the forked -x paste).
• Regenerated .github/workflows/ci.yml (main_wet; CiYamlGate byte-exact drift gate green).

Construction honesty (instance-fixed + class-residue-named)

The three existing build sites are construction-correct: each is authored through the generator, which always appends exists-then-fresh from the declared produces. The class-level guarantee — no build invocation exists outside BuildStep — is not structurally enforced: .dag does not stop someone hand-authoring a new cargo/rustc build as raw shell.Exec.Run bash that bypasses the model. That residue is a named follow-on lens: catch a cargo/rustc build in emitted/inline bash not routed through build_step (ties into the inline-shell reducibility lens family). Named here, not built in this PR — instance fixed, class residue honestly deferred.

Filesystem.Stat{path}->{exists,mtime} (a live readonly file-transport op) is the right realizer for any future interpreter-run build; named-deferred — it has no call site for this hole (all floor builds are bootstrap/emitted-shell).

Test plan

Proven by execution (DESIGN §5 — not spec-without-execution):

• Wet sabotage on the generated verification script (ci_floor_build_verify_script):
  • real build (bins present + fresh) → exit 0 (green)
  • deleted target/release/claim_executor → exit 1 (existence RED)
  • touched a src/**/*.rs newer than the bin + no-op build → exit 1 (freshness RED)
• Hermetic floor witness dsl/test/claim/build_artifact_verification_witness_test.dag::build_artifact_verification_holds → GREEN (shape exists→assign→fresh; existence precedes find -newer; tokens; floor covers both bins). Goes RED if either generator arm is dropped.
• Local floor green: ci_yaml_serializer_keystone_holds, ci_spec_witnesses, dsl_compile_clean_witnesses (real whole-tree gunbc compile through the verified host prelude), layering imports gate (gunbc → tools import clean).

Note: the MODELING-COHERENCE check reports unavailable due to a circular dependency in the operator's ctrl pure-.dag coherence harness (plans.coherence → plans.reducible, std.reducible not found) — infra, not this gunbc dsl/ change (no file here is in that graph).

[gunbai-bot]

Thanks — verified all three findings against the current tree. Two valid (one deferred), one confirmed benign.

Finding 1 (build_step.dag — BuildStep + emit_build_with_verification unused). Valid. Confirmed by grep: zero consumers anywhere (emit_build_with_verification/BuildStep appear only in their own definitions; both real sites call emit_verifications/verifications_script directly). This is speculative scaffold (DESIGN §6 — model just-in-time). Neither site cleanly fits BuildStep{command, …}: the ci.yml site's build command is the hand-authored EAGAIN-retry String (would need a banned RawLine), and the host-prelude site builds conditionally (if ! -x then build), not command-then-verify. So the right move is to delete BuildStep + emit_build_with_verification, keeping the used authority (BuildArtifact / verify_artifact / emit_verifications / verifications_script) and tightening the header claim. Deferred — see note at bottom.

Finding 2 (freshness scans only $ROOT/src/**/*.rs). Valid, minor. One correction: build.rs is covered (it matches *.rs). The genuine residual gap is Cargo.toml/Cargo.lock (non-.rs): a corruption that skips a relink after a manifest-only change, with .rs unchanged, would slip past freshness. As you note, the existence conjunct still catches the primary reported vector (exit-0-with-no-artifact), and in practice a Cargo.lock change forces a cargo relink (fresh mtime). I'll add a dissolve-on: limitation note (and can broaden the pattern to include the manifests) in the same deferred push.

Finding 3 (ensure_discover_source_root_ingest_built now emits assign_root_stmt()). Confirmed benign, no change needed. Both callers (src/v2/workflow/compiler_closure_ingest_transport.dag:87, source_root_ingest_transport.dag:53) run ensure_gunbc_built() immediately before, which already assigns ROOT=$(git rev-parse --show-toplevel || pwd); my added reassign sets the identical value (idempotent). No caller sets a different ROOT in scope — the old discover fn relied on exactly that prior assignment, so this removes a latent ordering dependency rather than changing behavior.

Deferral note: PR #5432 is under a coordinated cross-PR head-freeze (#5431/#5432/#5427) while the operator repoints the ctrl coherence-gate harness (the failing MODELING-COHERENCE check is ctrl infra — a std.reducible import circular dep — not this diff). Pushing now would re-stale this approval and trigger CI during the hold for non-blocking nits. I'll fold the Finding-1 deletion + Finding-2 dissolve-on note into the single push when the freeze lifts.

— sent from jolly-newt-77