From 2c8c0ef571798384a222ce195a0388d93555e08b Mon Sep 17 00:00:00 2001 From: Brian Searls Date: Sun, 26 Jul 2026 01:50:09 +0000 Subject: [PATCH 01/15] =?UTF-8?q?WIP:=20shell=E2=86=92dag=20bucket=20D=20?= =?UTF-8?q?=E2=80=94=20foreign-executor=20emit=20cluster=20(gate=20#7216?= =?UTF-8?q?=20now=20MERGE?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- dag/gunbc/ci_materialization.dag | 13 +-- dag/gunbc/ci_spec.dag | 2 +- dag/gunbc/merge_admission_produce.dag | 17 +-- .../bucket-d-foreign-executor-emit-census.md | 108 ++++++++++++++++++ .../realization_vocabulary_containment.dag | 2 + src/v2/workflow/ci_materialization_emit.dag | 95 +++++++++++++++ .../workflow/ci_materialization_emit_test.dag | 11 ++ src/v2/workflow/ci_merge_admission_emit.dag | 75 ++++++++++++ .../workflow/ci_merge_admission_emit_test.dag | 31 +++++ src/v2/workflow/ci_workflow_run_emit.dag | 2 +- 10 files changed, 326 insertions(+), 30 deletions(-) create mode 100644 docs/plans/bucket-d-foreign-executor-emit-census.md create mode 100644 src/v2/workflow/ci_materialization_emit.dag create mode 100644 src/v2/workflow/ci_materialization_emit_test.dag create mode 100644 src/v2/workflow/ci_merge_admission_emit.dag create mode 100644 src/v2/workflow/ci_merge_admission_emit_test.dag diff --git a/dag/gunbc/ci_materialization.dag b/dag/gunbc/ci_materialization.dag index d834715e2da..7d44fd7832a 100644 --- a/dag/gunbc/ci_materialization.dag +++ b/dag/gunbc/ci_materialization.dag @@ -188,7 +188,7 @@ data ci_floor_resolve_receipt_gate_shell_emit_dissolution_trigger: Disposition = data ci_sccache_provider_shell_injection_dissolution_trigger: Disposition = Scaffold { dissolves_to: RealizationDispatch, bind: DeclarationRef { - module_path: "gunbc.ci_materialization", + module_path: "v2.workflow.ci_materialization_emit", decl_name: "ci_sccache_provider_shell_injection", field: WholeDeclaration } @@ -274,14 +274,3 @@ fn ci_floor_resolve_receipt_gate_script() -> String { data ci_sccache_provider_skip_is_counted_note: String = "The skip arm is LOUD and COUNTED, not silent (§5: a degradation must be a typed, located, countable diagnostic so its frequency is observable and prioritizable). This guard was a bare `if` with no else until 2026-07-24 — when the daemon was down the release build simply ran uncached, and the deficit's frequency was zero by construction, so it never ranked for fixing (shell→dag census §4.I lists it as an absorbing fallback). It is NOT yet a refusal: STEP 2 of the srvN build-cache design flips this to fail-closed, and that flip is operator-sequenced AFTER a live T4 read-back proves P1b provisioning converges on srv1/srv2/srv4 — refusing before then would red the whole fleet, which is why the interim is loudness rather than a wall. The receipt line names the host, so a single misconfigured runner is attributable rather than fleet-wide noise." -fn ci_sccache_provider_shell_injection() -> String { - join([ - "if sccache --show-stats >/dev/null 2>&1; then", - " echo \"RUSTC_WRAPPER=sccache\" >> \"$GITHUB_ENV\"", - " echo \"CARGO_INCREMENTAL=0\" >> \"$GITHUB_ENV\"", - " printf '%s\\n' \"CiSccacheProviderReceipt: provider=bound catalog=sccache_local\"", - "else", - " printf '%s\\n' \"CiSccacheProviderReceipt: provider=SKIPPED catalog=sccache_local host=$(hostname) cause=daemon-unavailable; the release build runs UNCACHED — a counted degradation, not a supported mode (host_build_cache_provision P1b should have converged this host)\"", - "fi", - ], "\n") -} diff --git a/dag/gunbc/ci_spec.dag b/dag/gunbc/ci_spec.dag index 0a35ebc94ea..92d552b6e33 100644 --- a/dag/gunbc/ci_spec.dag +++ b/dag/gunbc/ci_spec.dag @@ -31,9 +31,9 @@ import gunbc.ci_deploy_access { DeployAccess, ci_deploy_srv1_access } import gunbc.ci_deploy_target_host { gunbc_ci_deploy_srv1_runner_spec } import gunbc.merge_admission_produce { ci_floor_stamp_merge_admission_script, - ci_floor_disposition_marker_init_script, ci_repo_root_shell, } +import v2.workflow.ci_merge_admission_emit { ci_floor_disposition_marker_init_script } import extdeps.git { git_remote_ref_parts, git_fetch_no_tags_shell, diff --git a/dag/gunbc/merge_admission_produce.dag b/dag/gunbc/merge_admission_produce.dag index 9b186ba2e30..1f237868b97 100644 --- a/dag/gunbc/merge_admission_produce.dag +++ b/dag/gunbc/merge_admission_produce.dag @@ -248,7 +248,7 @@ data ci_floor_disposition_marker_path: String = "target/ci-floor-disposition.txt data ci_floor_disposition_marker_init_scaffold: Disposition = Scaffold { dissolves_to: SingleAuthority, bind: DeclarationRef { - module_path: "gunbc.merge_admission_produce", + module_path: "v2.workflow.ci_merge_admission_emit", decl_name: "ci_floor_disposition_marker_init_script", field: WholeDeclaration } @@ -258,21 +258,6 @@ data ci_floor_disposition_marker_init_shell_emit_dissolution_trigger: String = " data ci_floor_disposition_marker_init_note: String = "Positive floor-running stamp at the start of every floor step clears stale documentation_only_skipped left in target/ on persistent self-hosted runners (review 37010 / operator ruling 2026-07-11). Receipt gates skip only on an exact documentation_only_skipped match — never on file presence alone." -fn ci_floor_disposition_marker_init_script() -> String { - concat( - concat("# ", concat(ci_floor_disposition_marker_init_shell_emit_dissolution_trigger, "\n")), - concat( - concat("# ", concat(ci_floor_disposition_marker_init_note, "\n")), - concat( - concat("mkdir -p target\n"), - concat( - concat("echo ", merge_admission_floor_disposition_floor_running), - concat(" > ", concat(ci_floor_disposition_marker_path, "\n")) - ) - ) - ) - ) -} data merge_admission_stamp_documentation_only_skip_policy: String = "CI_FLOOR_DISPOSITION=documentation_only_skipped stamps merge-admission conclusion Skipped (not Success) — floor-not-run ≠ floor-green per §5; distinct from CI_FLOOR_EXIT=0 laundering" diff --git a/docs/plans/bucket-d-foreign-executor-emit-census.md b/docs/plans/bucket-d-foreign-executor-emit-census.md new file mode 100644 index 00000000000..078126a6dac --- /dev/null +++ b/docs/plans/bucket-d-foreign-executor-emit-census.md @@ -0,0 +1,108 @@ +# Bucket D re-census — foreign-executor emit cluster + +> **Status:** fresh census @ `origin/main` `95e4bbad69` (post-#7216 merge, 2026-07-26). Supersedes stale §4.E rows in `shell-to-dag-residual-census-and-arc-completion.md` for CI placement files. Authority: `shell-intent-emit-realization-design.md`, `host-effect-orchestration.md`. + +## Scope + +Foreign-executor shell (GHA `run:`, cron, git hooks, pre-runtime bootstrap) **legitimately stays shell**. Bucket D routes each site from hand-built `concat` command strings onto `Pipeline`/`EffectPlan` intent emitted through `orch_emit_pipeline(medium: bash_orchestration_emit_medium())` — a **bounded roster**, not a growth surface. Invariant: intent imports no `bash_build` / `ShellProgram` / `serialize_bash` (`realization_vocabulary_containment`). + +## Already on emit (do not re-migrate) + +| module | symbols | executor | +| --- | --- | --- | +| `v2.workflow.ci_workflow_run_emit` | `ci_isolate_toolchain_script`, `ci_pin_rustup_default_script`, `ci_selection_control_script` | GHA `run:` | +| `v2.workflow.ci_floor_peak_emit` | `ci_cgroup_peak_locate_shell`, `ci_floor_peak_pre_script`, `ci_floor_peak_post_script` | GHA `run:` | +| `v2.workflow.ci_retry_emit` | `ci_cargo_eagain_retry_script` | GHA `run:` (via `ci_release_build_emit`) | +| `v2.workflow.ci_release_build_emit` | `ci_release_build_script`, `gunbc_ci_run_script` | GHA `run:` (partial — still concat-wraps verify script) | +| `gunbc.assimilate.bmc_token_federation` | `gcp_token_smoke_script` | GHA `run:` | +| `gunbc.live_deploy.emit` | `expected_live_deploy_apply_script`, `expected_live_deploy_retract_script` | GHA deploy `run:` | +| `gunbc.host_effect` | `fresh_standup_bootstrap_intent` → `EmitArtifactThenThinRun` bootstrap arm | pre-runtime bootstrap | + +## Typed-op candidates (route to extdeps op, NOT bash emit) + +| site | current | target op | notes | +| --- | --- | --- | --- | +| `ci_spec.dag` · `ci_fmt_gate_line` | `"$CARGO_BIN" fmt --all --check` | `cargo.Build.Fmt` | `ci_fmt_gate_note` already names dissolve-on; **load-bearing ci.yml** | +| `ci_deploy_access_emit.dag` · `deploy_access_emit_principal_read_script` | `"whoami"` | `os.Id.Lookup` / effective-principal read | deploy preflight; Wave C typed argv | +| `fleet_posix_accounts.dag` · `declared_probe.probe_command` | `"id root"` etc. | **NOT a shell emit site** | authored provenance metadata only; live proof is `deploy_access_check_observed` via typed `SudoNopasswdExecuteProbe` | + +## Deferred / out of bucket D + +| site | reason | +| --- | --- | +| `roadmap_static_site.dag` body fns | HTML/JSON content emit, not shell — belt B (`gunbc serve`) | +| `runner_host_deploy.dag` · `runner_host_docker_provision_script` | fleet manual-gap lane | +| `bmc_virtual_media.dag` srv4 gadget scripts | BMC provisioning, separate lane | +| Runtime-present `host_effect_apply` / srvN tails | bucket B (typed effects), not foreign-executor emit | + +## Remaining concat-built foreign-executor punch-list + +### A — `merge_admission_produce.dag` (5 script surfaces) + +| symbol | GHA consumer | emit complexity | +| --- | --- | --- | +| `ci_floor_disposition_marker_init_script` | floor opener (via `gunbc_ci_floor_only_script`) | low (comments + mkdir + redirect) | +| `ci_documentation_only_gate_skip_prefix` | receipt gates, merge gate, selection control | medium (nested if/test + cmdsubst) | +| `ci_merge_admission_stamp_script` | merge-admission stamp step | low | +| `ci_merge_admission_gate_script` | merge-admission gate step | medium | +| `ci_floor_stamp_merge_admission_script` | floor tail | medium (`$?` capture) | + +### B — `ci_materialization.dag` (3 script surfaces) + +| symbol | GHA consumer | emit complexity | +| --- | --- | --- | +| `ci_sccache_provider_shell_injection` | isolate-toolchain pipeline | medium (`if` + env append + printf receipt) | +| `ci_floor_materialization_receipt_gate_script` | ci job gate | high (sed parses + if ladder) | +| `ci_floor_resolve_receipt_gate_script` | ci job gate | high (sed + numeric compare) | + +### C — `ci_spec.dag` (~15 distinct script composers feeding GHA) + +| symbol | GHA consumer | route | +| --- | --- | --- | +| `ci_release_build_line` | build (via retry emit) | emit (partially done) | +| `ci_fmt_gate_line` | build fmt step | **typed op** | +| `ci_floor_build_verify_script` | build verify + unpack | emit (build_step transport pattern) | +| `ci_release_bins_pack_script` | build pack artifact | emit | +| `ci_release_bins_unpack_verify_script` | ci unpack step | emit | +| `gunbc_ci_floor_only_script` | ci floor `run:` | emit (composes A rows) | +| `ci_regen_floor_skip_shortcut_script` | regen skip | emit (`if` + cmdsubst) | +| `gunbc_ci_regen_floor_only_script` | regen job | emit (composer) | +| `gunbc_ci_deploy_invoke` | deploy job | emit (thin gunbc run) | +| `gunbc_ci_heal_regen_invoke` | heal regen | emit | +| `gunbc_ci_heal_commit_push_script` | heal commit/push | emit (git verbs; future typed git ops) | +| `scheduler_invoke` / `scheduler_invoke_with` | floor/regen | emit (thin claim_executor) | +| `git_fetch_script` | floor/regen/deploy | emit (`git fetch` + fallback) | + +**Load-bearing:** every C-row change regenerates `.github/workflows/ci.yml`; drift+parse gate is the byte-oracle. + +### D — permanent roster (emit target, never typed-op dissolve) + +| site | executor | +| --- | --- | +| `gunbc.githooks_pre_push_emit` · `expected_githooks_pre_push_sh` | git pre-push hook | +| cron entry lines (REST transport witness corpus) | cron | + +## Proposed batching (3 PRs) + +### PR 1 (this session) — census + materialization/merge-admission emit seed + +- This document (re-census authority for bucket D). +- `ci_sccache_provider_shell_injection` → `v2.workflow.ci_materialization_emit` (If-band, byte golden). +- `ci_floor_disposition_marker_init_script` → `v2.workflow.ci_merge_admission_emit` (byte golden). +- Witness tests + `realization_vocabulary_containment` roster rows. +- Regenerate `ci.yml`; prove drift gate green. + +**Does not touch** `ci_spec.dag` script composers beyond import delegation through existing call graph. + +### PR 2 — merge-admission cluster completion + receipt gates + +- `ci_documentation_only_gate_skip_prefix`, stamp/gate/stamp scripts, both receipt gate scripts (B rows). +- Depends on PR 1 emit helpers (`emit_pipeline_or_poison` pattern). + +### PR 3 — `ci_spec` composer migration (operator review gate) + +- Pack/unpack/verify, regen skip, deploy/heal invokes, floor/regen composers. +- `ci_fmt_gate_line` → typed `cargo.Build.Fmt` (separate commit within PR). +- Full `gunbc ci` regen + `ci_spec_witness_test` + committed `ci.yml` byte-oracle. + +**Operator review required before PR 3** — load-bearing CI generator. diff --git a/src/v2/lens/realization_vocabulary_containment.dag b/src/v2/lens/realization_vocabulary_containment.dag index 4e97c31ab7a..75cfbba8ea3 100644 --- a/src/v2/lens/realization_vocabulary_containment.dag +++ b/src/v2/lens/realization_vocabulary_containment.dag @@ -43,6 +43,8 @@ data realization_edge_path_prefixes: List = [ "src/v2/workflow/ci_release_build_emit", "src/v2/workflow/ci_retry_emit", "src/v2/workflow/ci_floor_peak_emit", + "src/v2/workflow/ci_materialization_emit", + "src/v2/workflow/ci_merge_admission_emit", "src/v2/workflow/orchestration_", "dag/gunbc/live_deploy/emit", "dag/gunbc/assimilate/bmc_token_federation" diff --git a/src/v2/workflow/ci_materialization_emit.dag b/src/v2/workflow/ci_materialization_emit.dag new file mode 100644 index 00000000000..9e97db3422f --- /dev/null +++ b/src/v2/workflow/ci_materialization_emit.dag @@ -0,0 +1,95 @@ +module v2.workflow.ci_materialization_emit + +import v2.compiler.emit_orchestration { orch_emit_pipeline } +import v2.extdeps.languages.bash_orchestration_emit { bash_orchestration_emit_medium } +import gunbc.ci_materialization { + ci_sccache_provider_skip_is_counted_note, +} +import v2.std.orchestration { + Do, + FailFast, + If, + Pipeline, + PipelineStep, + Run, + ExitZero, + RedirectSpec, + DiscardAll +} +import v2.std.collection { Absent } +import v2.std.diagnostic { Accepted, Rejected, None, Some } + +data ci_materialization_emit_authority_note: String = "Foreign-executor shell emission for gunbc.ci_materialization script surfaces (bucket D). Intent stays out of dag/gunbc/ci_materialization; bash medium binding lives here per shell→intent routing." + +data ci_sccache_provider_emit_refused_poison: String = "__GUNBC_ORCH_EMIT_REFUSED__ sccache provider shell injection was rejected by v2.compiler.emit_orchestration; this marker is not valid workflow shell, so the committed ci.yml drift gate goes red rather than a hand-spelled fallback masking the refusal (DESIGN 5: refuse, never widen)\n" + +data ci_sccache_show_stats_command: String = "sccache --show-stats" + +data ci_sccache_bind_rustc_wrapper_command: String = "echo \"RUSTC_WRAPPER=sccache\" >> \"$GITHUB_ENV\"" + +data ci_sccache_bind_cargo_incremental_command: String = "echo \"CARGO_INCREMENTAL=0\" >> \"$GITHUB_ENV\"" + +data ci_sccache_bound_receipt_command: String = "printf '%s\\n' \"CiSccacheProviderReceipt: provider=bound catalog=sccache_local\"" + +data ci_sccache_skipped_receipt_command: String = "printf '%s\\n' \"CiSccacheProviderReceipt: provider=SKIPPED catalog=sccache_local host=$(hostname) cause=daemon-unavailable; the release build runs UNCACHED — a counted degradation, not a supported mode (host_build_cache_provision P1b should have converged this host)\"" + +fn ci_materialization_run(command: String) -> Run { + Run { + command: command, + env: [], + redirect: Absent, + capture: Absent + } +} + +fn ci_materialization_do(command: String) -> PipelineStep { + Do { run: ci_materialization_run(command: command) } +} + +fn ci_materialization_emit_pipeline(p: Pipeline) -> String { + match orch_emit_pipeline(p: p, medium: bash_orchestration_emit_medium()) { + Accepted { value: source, diagnostics: d } => + match d { + None => source.carried + Some { diagnostics: _ } => ci_sccache_provider_emit_refused_poison + } + Rejected { diagnostics: _ } => ci_sccache_provider_emit_refused_poison + } +} + +fn ci_sccache_provider_shell_injection_intent() -> Pipeline { + let _note = ci_sccache_provider_skip_is_counted_note + Pipeline { + steps: [ + If { + cond: ExitZero { + run: Run { + command: ci_sccache_show_stats_command, + env: [], + redirect: Present { value: DiscardAll }, + capture: Absent + } + }, + then_: Pipeline { + steps: [ + ci_materialization_do(command: ci_sccache_bind_rustc_wrapper_command), + ci_materialization_do(command: ci_sccache_bind_cargo_incremental_command), + ci_materialization_do(command: ci_sccache_bound_receipt_command) + ], + on_failure: FailFast + }, + else_: Present { + value: Pipeline { + steps: [ci_materialization_do(command: ci_sccache_skipped_receipt_command)], + on_failure: FailFast + } + } + } + ], + on_failure: FailFast + } +} + +fn ci_sccache_provider_shell_injection() -> String { + ci_materialization_emit_pipeline(p: ci_sccache_provider_shell_injection_intent()) +} diff --git a/src/v2/workflow/ci_materialization_emit_test.dag b/src/v2/workflow/ci_materialization_emit_test.dag new file mode 100644 index 00000000000..1795b2eb4d1 --- /dev/null +++ b/src/v2/workflow/ci_materialization_emit_test.dag @@ -0,0 +1,11 @@ +module v2.workflow.ci_materialization_emit_test + +import v2.workflow.ci_materialization_emit { ci_sccache_provider_shell_injection } + +data ci_sccache_provider_emit_golden_note: String = "Hand-authored golden independent of grammar row spellings; byte test compares emit output against this literal (#6467 pattern)." + +data ci_sccache_provider_shell_injection_golden: String = "if sccache --show-stats >/dev/null 2>&1; then\necho \"RUSTC_WRAPPER=sccache\" >> \"$GITHUB_ENV\"\necho \"CARGO_INCREMENTAL=0\" >> \"$GITHUB_ENV\"\nprintf '%s\\n' \"CiSccacheProviderReceipt: provider=bound catalog=sccache_local\"\nelse\nprintf '%s\\n' \"CiSccacheProviderReceipt: provider=SKIPPED catalog=sccache_local host=$(hostname) cause=daemon-unavailable; the release build runs UNCACHED — a counted degradation, not a supported mode (host_build_cache_provision P1b should have converged this host)\"\nfi" + +test fn ci_sccache_provider_shell_injection_emit_matches_golden_holds() -> Bool { + ci_sccache_provider_shell_injection() == ci_sccache_provider_shell_injection_golden +} diff --git a/src/v2/workflow/ci_merge_admission_emit.dag b/src/v2/workflow/ci_merge_admission_emit.dag new file mode 100644 index 00000000000..4815847ad02 --- /dev/null +++ b/src/v2/workflow/ci_merge_admission_emit.dag @@ -0,0 +1,75 @@ +module v2.workflow.ci_merge_admission_emit + +import v2.compiler.emit_orchestration { orch_emit_pipeline } +import v2.extdeps.languages.bash_orchestration_emit { bash_orchestration_emit_medium } +import gunbc.merge_admission_produce { + ci_floor_disposition_marker_init_shell_emit_dissolution_trigger, + ci_floor_disposition_marker_init_note, + merge_admission_floor_disposition_floor_running, + ci_floor_disposition_marker_path, +} +import v2.std.orchestration { + Do, + FailFast, + Pipeline, + PipelineStep, + Run +} +import v2.std.diagnostic { Accepted, Rejected, None, Some } + +data ci_merge_admission_emit_authority_note: String = "Foreign-executor shell emission for gunbc.merge_admission_produce script surfaces (bucket D). Intent stays out of dag/gunbc/merge_admission_produce; bash medium binding lives here per shell→intent routing." + +data ci_merge_admission_emit_refused_poison: String = "__GUNBC_ORCH_EMIT_REFUSED__ merge-admission run-step emission was rejected by v2.compiler.emit_orchestration; this marker is not valid workflow shell, so the committed ci.yml drift gate goes red rather than a hand-spelled fallback masking the refusal (DESIGN 5: refuse, never widen)\n" + +data ci_floor_disposition_marker_mkdir_command: String = "mkdir -p target" + +fn ci_merge_admission_floor_disposition_stamp_command() -> String { + concat( + concat("echo ", merge_admission_floor_disposition_floor_running), + concat(" > ", ci_floor_disposition_marker_path) + ) +} + +fn ci_merge_admission_run(command: String) -> Run { + Run { + command: command, + env: [], + redirect: Absent, + capture: Absent + } +} + +fn ci_merge_admission_do(command: String) -> PipelineStep { + Do { run: ci_merge_admission_run(command: command) } +} + +fn ci_merge_admission_comment_line(text: String) -> PipelineStep { + ci_merge_admission_do(command: concat("# ", text)) +} + +fn ci_merge_admission_emit_pipeline(p: Pipeline) -> String { + match orch_emit_pipeline(p: p, medium: bash_orchestration_emit_medium()) { + Accepted { value: source, diagnostics: d } => + match d { + None => source.carried + Some { diagnostics: _ } => ci_merge_admission_emit_refused_poison + } + Rejected { diagnostics: _ } => ci_merge_admission_emit_refused_poison + } +} + +fn ci_floor_disposition_marker_init_intent() -> Pipeline { + Pipeline { + steps: [ + ci_merge_admission_comment_line(text: ci_floor_disposition_marker_init_shell_emit_dissolution_trigger), + ci_merge_admission_comment_line(text: ci_floor_disposition_marker_init_note), + ci_merge_admission_do(command: ci_floor_disposition_marker_mkdir_command), + ci_merge_admission_do(command: ci_merge_admission_floor_disposition_stamp_command()) + ], + on_failure: FailFast + } +} + +fn ci_floor_disposition_marker_init_script() -> String { + ci_merge_admission_emit_pipeline(p: ci_floor_disposition_marker_init_intent()) +} diff --git a/src/v2/workflow/ci_merge_admission_emit_test.dag b/src/v2/workflow/ci_merge_admission_emit_test.dag new file mode 100644 index 00000000000..5cc885bd42a --- /dev/null +++ b/src/v2/workflow/ci_merge_admission_emit_test.dag @@ -0,0 +1,31 @@ +module v2.workflow.ci_merge_admission_emit_test + +import v2.workflow.ci_merge_admission_emit { ci_floor_disposition_marker_init_script } +import gunbc.merge_admission_produce { + ci_floor_disposition_marker_init_shell_emit_dissolution_trigger, + ci_floor_disposition_marker_init_note, + merge_admission_floor_disposition_floor_running, + ci_floor_disposition_marker_path, +} + +data ci_merge_admission_emit_golden_note: String = "Hand-authored golden independent of grammar row spellings; byte test compares emit output against this literal (#6467 pattern)." + +fn ci_floor_disposition_marker_init_concat_golden() -> String { + concat( + concat("# ", concat(ci_floor_disposition_marker_init_shell_emit_dissolution_trigger, "\n")), + concat( + concat("# ", concat(ci_floor_disposition_marker_init_note, "\n")), + concat( + concat("mkdir -p target\n"), + concat( + concat("echo ", merge_admission_floor_disposition_floor_running), + concat(" > ", concat(ci_floor_disposition_marker_path, "\n")) + ) + ) + ) + ) +} + +test fn ci_floor_disposition_marker_init_emit_matches_concat_golden_holds() -> Bool { + ci_floor_disposition_marker_init_script() == ci_floor_disposition_marker_init_concat_golden() +} diff --git a/src/v2/workflow/ci_workflow_run_emit.dag b/src/v2/workflow/ci_workflow_run_emit.dag index 33df2e85212..63c88cbf77d 100644 --- a/src/v2/workflow/ci_workflow_run_emit.dag +++ b/src/v2/workflow/ci_workflow_run_emit.dag @@ -2,7 +2,7 @@ module v2.workflow.ci_workflow_run_emit import v2.compiler.emit_orchestration { orch_emit_pipeline } import v2.extdeps.languages.bash_orchestration_emit { bash_orchestration_emit_medium } -import gunbc.ci_materialization { ci_sccache_provider_shell_injection } +import v2.workflow.ci_materialization_emit { ci_sccache_provider_shell_injection } import gunbc.merge_admission_produce { ci_documentation_only_gate_skip_prefix, ci_repo_root_shell } import v2.std.orchestration { Do, From 6ffccf6f0e6bec1d99c8b76844bcc7bcf6aa4aa0 Mon Sep 17 00:00:00 2001 From: Brian Searls Date: Sun, 26 Jul 2026 02:00:36 +0000 Subject: [PATCH 02/15] =?UTF-8?q?WIP:=20shell=E2=86=92dag=20bucket=20D=20?= =?UTF-8?q?=E2=80=94=20foreign-executor=20emit=20cluster=20(gate=20#7216?= =?UTF-8?q?=20now=20MERGE?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- src/v2/workflow/ci_materialization_emit.dag | 14 +++++++++----- src/v2/workflow/ci_materialization_emit_test.dag | 2 +- 2 files changed, 10 insertions(+), 6 deletions(-) diff --git a/src/v2/workflow/ci_materialization_emit.dag b/src/v2/workflow/ci_materialization_emit.dag index 9e97db3422f..be520c5de8d 100644 --- a/src/v2/workflow/ci_materialization_emit.dag +++ b/src/v2/workflow/ci_materialization_emit.dag @@ -33,6 +33,14 @@ data ci_sccache_bound_receipt_command: String = "printf '%s\\n' \"CiSccacheProvi data ci_sccache_skipped_receipt_command: String = "printf '%s\\n' \"CiSccacheProviderReceipt: provider=SKIPPED catalog=sccache_local host=$(hostname) cause=daemon-unavailable; the release build runs UNCACHED — a counted degradation, not a supported mode (host_build_cache_provision P1b should have converged this host)\"" +data ci_sccache_bound_branch_command: String = concat( + concat(ci_sccache_bind_rustc_wrapper_command, "; "), + concat( + concat(ci_sccache_bind_cargo_incremental_command, "; "), + ci_sccache_bound_receipt_command + ) +) + fn ci_materialization_run(command: String) -> Run { Run { command: command, @@ -71,11 +79,7 @@ fn ci_sccache_provider_shell_injection_intent() -> Pipeline { } }, then_: Pipeline { - steps: [ - ci_materialization_do(command: ci_sccache_bind_rustc_wrapper_command), - ci_materialization_do(command: ci_sccache_bind_cargo_incremental_command), - ci_materialization_do(command: ci_sccache_bound_receipt_command) - ], + steps: [ci_materialization_do(command: ci_sccache_bound_branch_command)], on_failure: FailFast }, else_: Present { diff --git a/src/v2/workflow/ci_materialization_emit_test.dag b/src/v2/workflow/ci_materialization_emit_test.dag index 1795b2eb4d1..09b8d1e40b2 100644 --- a/src/v2/workflow/ci_materialization_emit_test.dag +++ b/src/v2/workflow/ci_materialization_emit_test.dag @@ -4,7 +4,7 @@ import v2.workflow.ci_materialization_emit { ci_sccache_provider_shell_injection data ci_sccache_provider_emit_golden_note: String = "Hand-authored golden independent of grammar row spellings; byte test compares emit output against this literal (#6467 pattern)." -data ci_sccache_provider_shell_injection_golden: String = "if sccache --show-stats >/dev/null 2>&1; then\necho \"RUSTC_WRAPPER=sccache\" >> \"$GITHUB_ENV\"\necho \"CARGO_INCREMENTAL=0\" >> \"$GITHUB_ENV\"\nprintf '%s\\n' \"CiSccacheProviderReceipt: provider=bound catalog=sccache_local\"\nelse\nprintf '%s\\n' \"CiSccacheProviderReceipt: provider=SKIPPED catalog=sccache_local host=$(hostname) cause=daemon-unavailable; the release build runs UNCACHED — a counted degradation, not a supported mode (host_build_cache_provision P1b should have converged this host)\"\nfi" +data ci_sccache_provider_shell_injection_golden: String = "if sccache --show-stats >/dev/null 2>&1; then echo \"RUSTC_WRAPPER=sccache\" >> \"$GITHUB_ENV\"; echo \"CARGO_INCREMENTAL=0\" >> \"$GITHUB_ENV\"; printf '%s\\n' \"CiSccacheProviderReceipt: provider=bound catalog=sccache_local\"; else printf '%s\\n' \"CiSccacheProviderReceipt: provider=SKIPPED catalog=sccache_local host=$(hostname) cause=daemon-unavailable; the release build runs UNCACHED — a counted degradation, not a supported mode (host_build_cache_provision P1b should have converged this host)\"; fi" test fn ci_sccache_provider_shell_injection_emit_matches_golden_holds() -> Bool { ci_sccache_provider_shell_injection() == ci_sccache_provider_shell_injection_golden From 8f6421563415a8489eaaca6e7c93e6ac0f9778ae Mon Sep 17 00:00:00 2001 From: Brian Searls Date: Sun, 26 Jul 2026 02:01:42 +0000 Subject: [PATCH 03/15] Fix sccache emit if-branch semantics and commit regenerated ci.yml. MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Multi-statement if/then bodies must be semicolon-joined in a single Run (the if-else grammar inserts then_body verbatim without braces). The heal job failed because ci.yml drifted and the bot lacks workflows permission to push workflow files — commit the regenerated ci.yml and falsifier.yml here. Co-authored-by: Cursor --- .github/workflows/ci.yml | 8 +------- .github/workflows/falsifier.yml | 8 +------- 2 files changed, 2 insertions(+), 14 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index b4f9820b387..f50d843c997 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -36,13 +36,7 @@ jobs: GUNBC_TOOLCHAIN_SEG=$(rustc -V 2>/dev/null | tr ' ' '-'); if [ -z "$GUNBC_TOOLCHAIN_SEG" ]; then GUNBC_TOOLCHAIN_SEG=toolchain-unresolved; fi mkdir -p "$RUNNER_TOOL_CACHE/gunbc-native/$GUNBC_TOOLCHAIN_SEG" echo "GUNBC_NATIVE_CACHE_ROOT=$RUNNER_TOOL_CACHE/gunbc-native/$GUNBC_TOOLCHAIN_SEG" >> "$GITHUB_ENV" - if sccache --show-stats >/dev/null 2>&1; then - echo "RUSTC_WRAPPER=sccache" >> "$GITHUB_ENV" - echo "CARGO_INCREMENTAL=0" >> "$GITHUB_ENV" - printf '%s\n' "CiSccacheProviderReceipt: provider=bound catalog=sccache_local" - else - printf '%s\n' "CiSccacheProviderReceipt: provider=SKIPPED catalog=sccache_local host=$(hostname) cause=daemon-unavailable; the release build runs UNCACHED — a counted degradation, not a supported mode (host_build_cache_provision P1b should have converged this host)" - fi + if sccache --show-stats >/dev/null 2>&1; then echo "RUSTC_WRAPPER=sccache" >> "$GITHUB_ENV"; echo "CARGO_INCREMENTAL=0" >> "$GITHUB_ENV"; printf '%s\n' "CiSccacheProviderReceipt: provider=bound catalog=sccache_local"; else printf '%s\n' "CiSccacheProviderReceipt: provider=SKIPPED catalog=sccache_local host=$(hostname) cause=daemon-unavailable; the release build runs UNCACHED — a counted degradation, not a supported mode (host_build_cache_provision P1b should have converged this host)"; fi - name: Setup Rust uses: actions-rust-lang/setup-rust-toolchain@v1.16.0 with: diff --git a/.github/workflows/falsifier.yml b/.github/workflows/falsifier.yml index a6b6440a304..be986f55126 100644 --- a/.github/workflows/falsifier.yml +++ b/.github/workflows/falsifier.yml @@ -30,13 +30,7 @@ jobs: GUNBC_TOOLCHAIN_SEG=$(rustc -V 2>/dev/null | tr ' ' '-'); if [ -z "$GUNBC_TOOLCHAIN_SEG" ]; then GUNBC_TOOLCHAIN_SEG=toolchain-unresolved; fi mkdir -p "$RUNNER_TOOL_CACHE/gunbc-native/$GUNBC_TOOLCHAIN_SEG" echo "GUNBC_NATIVE_CACHE_ROOT=$RUNNER_TOOL_CACHE/gunbc-native/$GUNBC_TOOLCHAIN_SEG" >> "$GITHUB_ENV" - if sccache --show-stats >/dev/null 2>&1; then - echo "RUSTC_WRAPPER=sccache" >> "$GITHUB_ENV" - echo "CARGO_INCREMENTAL=0" >> "$GITHUB_ENV" - printf '%s\n' "CiSccacheProviderReceipt: provider=bound catalog=sccache_local" - else - printf '%s\n' "CiSccacheProviderReceipt: provider=SKIPPED catalog=sccache_local host=$(hostname) cause=daemon-unavailable; the release build runs UNCACHED — a counted degradation, not a supported mode (host_build_cache_provision P1b should have converged this host)" - fi + if sccache --show-stats >/dev/null 2>&1; then echo "RUSTC_WRAPPER=sccache" >> "$GITHUB_ENV"; echo "CARGO_INCREMENTAL=0" >> "$GITHUB_ENV"; printf '%s\n' "CiSccacheProviderReceipt: provider=bound catalog=sccache_local"; else printf '%s\n' "CiSccacheProviderReceipt: provider=SKIPPED catalog=sccache_local host=$(hostname) cause=daemon-unavailable; the release build runs UNCACHED — a counted degradation, not a supported mode (host_build_cache_provision P1b should have converged this host)"; fi - name: Setup Rust uses: actions-rust-lang/setup-rust-toolchain@v1.16.0 with: From 6849f8064c6d9e20659edc8adccdc8ea7567efc2 Mon Sep 17 00:00:00 2001 From: Brian Searls Date: Sun, 26 Jul 2026 02:30:51 +0000 Subject: [PATCH 04/15] Fold bucket-D census into arc census; delete orphan doc. MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The standalone bucket-d-foreign-executor-emit-census.md had zero inbound refs and would red the falsifier after merge. True-up §4.E/4.I and add §4.J punch-list to the existing shell-to-dag-residual census (reachable via design_document.dag) — single authority, no bind row needed. Co-authored-by: Cursor --- .../bucket-d-foreign-executor-emit-census.md | 108 ------------------ ...-dag-residual-census-and-arc-completion.md | 108 ++++++++++++++++-- 2 files changed, 99 insertions(+), 117 deletions(-) delete mode 100644 docs/plans/bucket-d-foreign-executor-emit-census.md diff --git a/docs/plans/bucket-d-foreign-executor-emit-census.md b/docs/plans/bucket-d-foreign-executor-emit-census.md deleted file mode 100644 index 078126a6dac..00000000000 --- a/docs/plans/bucket-d-foreign-executor-emit-census.md +++ /dev/null @@ -1,108 +0,0 @@ -# Bucket D re-census — foreign-executor emit cluster - -> **Status:** fresh census @ `origin/main` `95e4bbad69` (post-#7216 merge, 2026-07-26). Supersedes stale §4.E rows in `shell-to-dag-residual-census-and-arc-completion.md` for CI placement files. Authority: `shell-intent-emit-realization-design.md`, `host-effect-orchestration.md`. - -## Scope - -Foreign-executor shell (GHA `run:`, cron, git hooks, pre-runtime bootstrap) **legitimately stays shell**. Bucket D routes each site from hand-built `concat` command strings onto `Pipeline`/`EffectPlan` intent emitted through `orch_emit_pipeline(medium: bash_orchestration_emit_medium())` — a **bounded roster**, not a growth surface. Invariant: intent imports no `bash_build` / `ShellProgram` / `serialize_bash` (`realization_vocabulary_containment`). - -## Already on emit (do not re-migrate) - -| module | symbols | executor | -| --- | --- | --- | -| `v2.workflow.ci_workflow_run_emit` | `ci_isolate_toolchain_script`, `ci_pin_rustup_default_script`, `ci_selection_control_script` | GHA `run:` | -| `v2.workflow.ci_floor_peak_emit` | `ci_cgroup_peak_locate_shell`, `ci_floor_peak_pre_script`, `ci_floor_peak_post_script` | GHA `run:` | -| `v2.workflow.ci_retry_emit` | `ci_cargo_eagain_retry_script` | GHA `run:` (via `ci_release_build_emit`) | -| `v2.workflow.ci_release_build_emit` | `ci_release_build_script`, `gunbc_ci_run_script` | GHA `run:` (partial — still concat-wraps verify script) | -| `gunbc.assimilate.bmc_token_federation` | `gcp_token_smoke_script` | GHA `run:` | -| `gunbc.live_deploy.emit` | `expected_live_deploy_apply_script`, `expected_live_deploy_retract_script` | GHA deploy `run:` | -| `gunbc.host_effect` | `fresh_standup_bootstrap_intent` → `EmitArtifactThenThinRun` bootstrap arm | pre-runtime bootstrap | - -## Typed-op candidates (route to extdeps op, NOT bash emit) - -| site | current | target op | notes | -| --- | --- | --- | --- | -| `ci_spec.dag` · `ci_fmt_gate_line` | `"$CARGO_BIN" fmt --all --check` | `cargo.Build.Fmt` | `ci_fmt_gate_note` already names dissolve-on; **load-bearing ci.yml** | -| `ci_deploy_access_emit.dag` · `deploy_access_emit_principal_read_script` | `"whoami"` | `os.Id.Lookup` / effective-principal read | deploy preflight; Wave C typed argv | -| `fleet_posix_accounts.dag` · `declared_probe.probe_command` | `"id root"` etc. | **NOT a shell emit site** | authored provenance metadata only; live proof is `deploy_access_check_observed` via typed `SudoNopasswdExecuteProbe` | - -## Deferred / out of bucket D - -| site | reason | -| --- | --- | -| `roadmap_static_site.dag` body fns | HTML/JSON content emit, not shell — belt B (`gunbc serve`) | -| `runner_host_deploy.dag` · `runner_host_docker_provision_script` | fleet manual-gap lane | -| `bmc_virtual_media.dag` srv4 gadget scripts | BMC provisioning, separate lane | -| Runtime-present `host_effect_apply` / srvN tails | bucket B (typed effects), not foreign-executor emit | - -## Remaining concat-built foreign-executor punch-list - -### A — `merge_admission_produce.dag` (5 script surfaces) - -| symbol | GHA consumer | emit complexity | -| --- | --- | --- | -| `ci_floor_disposition_marker_init_script` | floor opener (via `gunbc_ci_floor_only_script`) | low (comments + mkdir + redirect) | -| `ci_documentation_only_gate_skip_prefix` | receipt gates, merge gate, selection control | medium (nested if/test + cmdsubst) | -| `ci_merge_admission_stamp_script` | merge-admission stamp step | low | -| `ci_merge_admission_gate_script` | merge-admission gate step | medium | -| `ci_floor_stamp_merge_admission_script` | floor tail | medium (`$?` capture) | - -### B — `ci_materialization.dag` (3 script surfaces) - -| symbol | GHA consumer | emit complexity | -| --- | --- | --- | -| `ci_sccache_provider_shell_injection` | isolate-toolchain pipeline | medium (`if` + env append + printf receipt) | -| `ci_floor_materialization_receipt_gate_script` | ci job gate | high (sed parses + if ladder) | -| `ci_floor_resolve_receipt_gate_script` | ci job gate | high (sed + numeric compare) | - -### C — `ci_spec.dag` (~15 distinct script composers feeding GHA) - -| symbol | GHA consumer | route | -| --- | --- | --- | -| `ci_release_build_line` | build (via retry emit) | emit (partially done) | -| `ci_fmt_gate_line` | build fmt step | **typed op** | -| `ci_floor_build_verify_script` | build verify + unpack | emit (build_step transport pattern) | -| `ci_release_bins_pack_script` | build pack artifact | emit | -| `ci_release_bins_unpack_verify_script` | ci unpack step | emit | -| `gunbc_ci_floor_only_script` | ci floor `run:` | emit (composes A rows) | -| `ci_regen_floor_skip_shortcut_script` | regen skip | emit (`if` + cmdsubst) | -| `gunbc_ci_regen_floor_only_script` | regen job | emit (composer) | -| `gunbc_ci_deploy_invoke` | deploy job | emit (thin gunbc run) | -| `gunbc_ci_heal_regen_invoke` | heal regen | emit | -| `gunbc_ci_heal_commit_push_script` | heal commit/push | emit (git verbs; future typed git ops) | -| `scheduler_invoke` / `scheduler_invoke_with` | floor/regen | emit (thin claim_executor) | -| `git_fetch_script` | floor/regen/deploy | emit (`git fetch` + fallback) | - -**Load-bearing:** every C-row change regenerates `.github/workflows/ci.yml`; drift+parse gate is the byte-oracle. - -### D — permanent roster (emit target, never typed-op dissolve) - -| site | executor | -| --- | --- | -| `gunbc.githooks_pre_push_emit` · `expected_githooks_pre_push_sh` | git pre-push hook | -| cron entry lines (REST transport witness corpus) | cron | - -## Proposed batching (3 PRs) - -### PR 1 (this session) — census + materialization/merge-admission emit seed - -- This document (re-census authority for bucket D). -- `ci_sccache_provider_shell_injection` → `v2.workflow.ci_materialization_emit` (If-band, byte golden). -- `ci_floor_disposition_marker_init_script` → `v2.workflow.ci_merge_admission_emit` (byte golden). -- Witness tests + `realization_vocabulary_containment` roster rows. -- Regenerate `ci.yml`; prove drift gate green. - -**Does not touch** `ci_spec.dag` script composers beyond import delegation through existing call graph. - -### PR 2 — merge-admission cluster completion + receipt gates - -- `ci_documentation_only_gate_skip_prefix`, stamp/gate/stamp scripts, both receipt gate scripts (B rows). -- Depends on PR 1 emit helpers (`emit_pipeline_or_poison` pattern). - -### PR 3 — `ci_spec` composer migration (operator review gate) - -- Pack/unpack/verify, regen skip, deploy/heal invokes, floor/regen composers. -- `ci_fmt_gate_line` → typed `cargo.Build.Fmt` (separate commit within PR). -- Full `gunbc ci` regen + `ci_spec_witness_test` + committed `ci.yml` byte-oracle. - -**Operator review required before PR 3** — load-bearing CI generator. diff --git a/docs/plans/shell-to-dag-residual-census-and-arc-completion.md b/docs/plans/shell-to-dag-residual-census-and-arc-completion.md index 5592ad2470f..29e570c353f 100644 --- a/docs/plans/shell-to-dag-residual-census-and-arc-completion.md +++ b/docs/plans/shell-to-dag-residual-census-and-arc-completion.md @@ -244,17 +244,42 @@ The original table's rows are retained below for provenance: ### 4.E — FOREIGN-EXECUTOR / BOOTSTRAP emit (LEGIT shell — route through `emit(intent,Bash)`, stays shell but bounded) -These are correct as shell (a GHA runner / cron / git / pre-runtime host only understands shell text). Target = emitted through the v2 bash rows, a **roster not a growth surface** — NOT dissolved to a typed op. +> **True-up @ post-#7216 (wise-crane-222, 2026-07-26):** fresh bucket-D re-census; supersedes the 07-22 rows below for CI placement files. Authority: `shell-intent-emit-realization-design.md`, `host-effect-orchestration.md`. Invariant: intent imports no `bash_build` / `ShellProgram` / `serialize_bash` (`realization_vocabulary_containment`). + +These are correct as shell (GHA `run:`, cron, git hooks, pre-runtime bootstrap — the executor only understands shell text). Target = emitted through the v2 bash rows via `orch_emit_pipeline(medium: bash_orchestration_emit_medium())`, a **roster not a growth surface** — NOT dissolved to a typed op unless a row names one. + +**Already on emit (do not re-migrate):** + +| module | symbols | executor | +| --- | --- | --- | +| `v2.workflow.ci_workflow_run_emit` | `ci_isolate_toolchain_script`, `ci_pin_rustup_default_script`, `ci_selection_control_script` | GHA `run:` | +| `v2.workflow.ci_floor_peak_emit` | `ci_cgroup_peak_locate_shell`, `ci_floor_peak_pre_script`, `ci_floor_peak_post_script` | GHA `run:` | +| `v2.workflow.ci_retry_emit` | `ci_cargo_eagain_retry_script` | GHA `run:` (via `ci_release_build_emit`) | +| `v2.workflow.ci_release_build_emit` | `ci_release_build_script`, `gunbc_ci_run_script` | GHA `run:` (partial — still concat-wraps verify script) | +| `v2.workflow.ci_materialization_emit` | `ci_sccache_provider_shell_injection` | GHA `run:` (**LANDED #7265**) | +| `v2.workflow.ci_merge_admission_emit` | `ci_floor_disposition_marker_init_script` | GHA `run:` (**LANDED #7265**) | +| `gunbc.assimilate.bmc_token_federation` | `gcp_token_smoke_script` | GHA `run:` | +| `gunbc.live_deploy.emit` | `expected_live_deploy_apply_script`, `expected_live_deploy_retract_script` | GHA deploy `run:` | +| `gunbc.host_effect` | `fresh_standup_bootstrap_intent` → `EmitArtifactThenThinRun` bootstrap arm | pre-runtime bootstrap | + +**Remaining concat-built foreign-executor punch-list** — per-symbol table and PR batching in §4.J. + +**Deferred / out of bucket D:** + +| site | reason | +| --- | --- | +| `roadmap_static_site.dag` body fns | HTML/JSON content emit, not shell — belt B (`gunbc serve`) | +| `runner_host_deploy.dag` · `runner_host_docker_provision_script` | fleet manual-gap lane | +| `bmc_virtual_media.dag` srv4 gadget scripts | BMC provisioning, separate lane | +| Runtime-present `host_effect_apply` / srvN tails | bucket B (typed effects), not foreign-executor emit | + +**Legacy 07-22 snapshot rows** (superseded for CI sites; non-CI rows unchanged): | site | executor | class | | --- | --- | --- | -| `ci_spec.dag` `ci_floor_build_verify/ci_release_bins_pack/…unpack_verify/ci_regen_floor_skip_shortcut` + retry `command:` | GitHub Actions | E-emit | -| `ci_materialization.dag:217,246` gate scripts | GitHub Actions | E-emit | -| `merge_admission_produce.dag:192,199,261,320` stamp/gate scripts | GitHub Actions | E-emit | -| `fleet_converge_emit.dag` `fresh_standup_bootstrap_script` + the fresh-standup `Run{command: concat(...)}` rows (`:112,120,133,136,140,147,153,161,171`) | pre-runtime bootstrap | E-emit (byte-oracle vs `.github/fleet-converge.sh`) | -| `roadmap_static_site.dag:76,80,144,209` body fns | srv1 dashboard (belt B — being replaced by `gunbc serve`) | E-emit / dissolves with belt B | -| `fleet_posix_accounts.dag` `probe_command: "id "` (×4) | account-existence probe | A2 (an `id` argv op) or E if roster — DFS | -| `assimilate/bmc_token_federation.dag:65` `gcp_token_smoke_script` | GCP token smoke | DFS — likely A (typed gcp op exists) | +| `fleet_converge_emit.dag` `fresh_standup_bootstrap_script` + fresh-standup `Run{command: concat(...)}` rows | pre-runtime bootstrap | E-emit (byte-oracle vs `.github/fleet-converge.sh`) | +| `roadmap_static_site.dag` body fns | srv1 dashboard (belt B) | E-emit / dissolves with belt B | +| `fleet_posix_accounts.dag` `probe_command: "id "` (×4) | account-existence probe | **NOT a shell emit site** — authored provenance metadata; live proof is `deploy_access_check_observed` via typed `SudoNopasswdExecuteProbe` | ### 4.F — bottom transport & brand (Phase-3 WALL — the construction guard) @@ -296,6 +321,7 @@ The 07-22 snapshot is ~7 merges stale. What has landed since, keyed to the rows | #7215 | census doc pass | — | | #7231 | **extdeps positioning restructure** | import paths repointed: `extdeps.os.systemctl` → `extdeps.systemd`, `extdeps.os.hostname` → `extdeps.tools.hostname`, `extdeps.os.exec_arg_limit` → `extdeps.exec`, `os.os` → `extdeps.os` hub-loose. Older rows in §4/§5 still spell the pre-restructure paths; read them through this mapping. | | #7233 | srv3 `Record` | 4.A5 srv\* cluster (still deferred) | +| **#7265** | bucket D PR1 — `ci_sccache_provider_shell_injection` + `ci_floor_disposition_marker_init_script` → `ci_materialization_emit` / `ci_merge_admission_emit` | 4.E/4.I/4.J rows for those two symbols DONE; §4.E/4.J true-up folded here (orphan doc deleted) | | **this PR** | **bucket A** — the last `date -Iseconds` in `host_runner_memory_cap_verify.dag` onto `Clock.Now`; `meta_exec_confinement_exception_roster` **3 → 0** | 4.C `date -Iseconds` and `hostname -s` rows DONE; the meta-exec roster is now empty, so §4.F's wall has no exceptions left to grant | **Meta-exec roster: 3 → 0, and the dark lane that hid it.** Two of the three rows (`dag/gunbc/tools/review.dag`, `dag/gunbc/ci_deploy_target_host.dag`) were **stale** — their sites had stopped importing `extdeps.shell.exec` merges earlier and nobody noticed, because `meta_exec_roster_sound_live` existed in the lens but ran on **no** per-PR cadence; the only enrolled roster RED was synthetic (hand-written fact rows, blind to the live roster). Measured this PR: the live receipt costs **13.5s cold** against a 5s fast-lane budget, so it cannot be enrolled per-PR as-is. The per-PR enforcement is instead a **construction wall** — `stale_count` is bounded above by roster length, so the empty roster proves soundness with no scan, and any re-added row reds `meta_exec_roster_shrunk_to_empty_holds` in the same PR that adds it. The live receipt stays as a backstop in `src/v2/test/claim/long/meta_exec_confinement_clean_tree_test.dag` (with a non-degeneracy control, since a clean tree makes a live scan vacuously true if the walk reads nothing). **Named residue:** that long lane is still dark (not roster-enrolled); its dissolve-on is a falsifier batch admitting live-tree lens receipts. @@ -347,7 +373,7 @@ The state of every PR in this arc, so nothing is missed if work pauses here. **A | `ci_spec.dag` · `gunbc_ci_deploy_invoke` | `ROOT=$(git rev-parse … \|\| pwd); "$ROOT/target/release/gunbc" run … live_deploy_apply_srv1_wet` (deploy job) | GitHub Actions | E-emit (thin `gunbc` invocation wrapped in bash); the `git rev-parse … \|\| pwd` prelude is a §5 fallback (below) | | `ci_spec.dag` · `gunbc_ci_heal_regen_invoke` | `gunbc run … generated_artifact_gate main_wet` (heal job) | GitHub Actions | E-emit (same thin-invoke shape; `ci_heal_regen_note` documents it) | | `ci_spec.dag` · `ci_heal_git_add_lines` + commit/push | `git add` over `committed_generated_artifact_paths()` (each `[ -e ]`-guarded), `git diff --cached --quiet` gate, `git commit`, `git push origin HEAD:` (heal job, 76 lines) | GitHub Actions | E-emit — the git verbs dissolve to typed `git.Core.*` ops (Add/Commit/Push); `ci_heal_commit_push_note` already frames it as "the foreign-executor case that renders through bash" | -| `ci_materialization.dag` · `ci_sccache_provider_shell_injection` | `if sccache --show-stats >/dev/null 2>&1; then RUSTC_WRAPPER=sccache; …; fi` (embedded in "Isolate toolchain dirs") | GitHub Actions | E-emit **+ §5 ABSORBING-FALLBACK** — the opportunistic guard SILENTLY skips caching when the daemon is down (no refusal, no count), exactly the shape of the readiness.dag `\| tail`+`exit 0` at §4.B. Dissolves to a MANDATORY provisioning-ensure (`ci_sccache_opportunistic_detect_scaffold` → srvN build-cache STEP-2) — the sibling of the level-2 `-u RUSTC_WRAPPER` absorbing fallback removed on #7138. | +| `ci_materialization.dag` · `ci_sccache_provider_shell_injection` | `if sccache --show-stats >/dev/null 2>&1; then RUSTC_WRAPPER=sccache; …; fi` (embedded in "Isolate toolchain dirs") | GitHub Actions | **DONE (#7265)** — migrated to `v2.workflow.ci_materialization_emit`; still carries §5 ABSORBING-FALLBACK debt (opportunistic guard silently skips caching when daemon is down → dissolve-on: mandatory provisioning-ensure via srvN build-cache STEP-2) | **§5 absorbing-fallbacks INSIDE the CI scripts** (§5.B rule: each becomes a *modeled outcome*, never re-appended). The census tracked the scripts but not these internal widens: @@ -360,6 +386,70 @@ The state of every PR in this arc, so nothing is missed if work pauses here. **A **Adjacent (NOT shell-string) — cross-ref, tracked elsewhere.** The same audit found a second class the CI shares that is *not* a `ShellProgram`/string sink and so does **not** belong in this census: hand-spelled **config** that should DERIVE from an existing model. The exemplar is toolchain isolation — `ToolchainEnvIsolation = SharedHomeAcrossJobs \| PerJobCargoHome{…} \| HermeticContainer` (`extdeps/toolchain/types.dag`) is modeled and consumed by `sccache`/`fleet_intent`, but the workflow emit never reads `env_isolation`; it hand-spells per-job isolation (build isolates, the ci/gate job shares → the rustup `ETXTBSY` race, documented in PROSE in `ci_floor_gate_toolchain_note` on `ci_workflow.dag` rather than modeled/gated). Same shape for the GHA **cache key** (modeled `gha_actions_cache_facts` key-derivation vs the hand-spelled `ci_cache_key_template`), **artifact** upload/download (un-modeled; the dissolve-on artifact-CacheProvider named in `ci_materialization.dag` is undone), and **permissions** (`std.effect_grant` vs per-job `WorkflowPermissions`). These are the model↔realization-fork open thread + roadmap `2-emit-partition`, not the ShellProgram arc; noted here only so the audit's findings aren't lost across the seam. +### 4.J — Bucket D foreign-executor emit punch-list @ post-#7216 (wise-crane-222, 2026-07-26) + +The per-symbol remaining work and batching plan for §4.E CI sites. **Load-bearing:** every `ci_spec.dag` composer change regenerates `.github/workflows/ci.yml`; drift+parse gate is the byte-oracle. + +**Typed-op candidates (route to extdeps op, NOT bash emit):** + +| site | current | target op | notes | +| --- | --- | --- | --- | +| `ci_spec.dag` · `ci_fmt_gate_line` | `"$CARGO_BIN" fmt --all --check` | `cargo.Build.Fmt` | `ci_fmt_gate_note` already names dissolve-on; **load-bearing ci.yml** | +| `ci_deploy_access_emit.dag` · `deploy_access_emit_principal_read_script` | `"whoami"` | `os.Id.Lookup` / effective-principal read | deploy preflight; Wave C typed argv | + +**Remaining concat-built foreign-executor punch-list:** + +#### A — `merge_admission_produce.dag` (5 script surfaces) + +| symbol | GHA consumer | status / emit complexity | +| --- | --- | --- | +| `ci_floor_disposition_marker_init_script` | floor opener (via `gunbc_ci_floor_only_script`) | **DONE (#7265)** → `ci_merge_admission_emit` | +| `ci_documentation_only_gate_skip_prefix` | receipt gates, merge gate, selection control | open — medium (nested if/test + cmdsubst) | +| `ci_merge_admission_stamp_script` | merge-admission stamp step | open — low | +| `ci_merge_admission_gate_script` | merge-admission gate step | open — medium | +| `ci_floor_stamp_merge_admission_script` | floor tail | open — medium (`$?` capture) | + +#### B — `ci_materialization.dag` (3 script surfaces) + +| symbol | GHA consumer | status / emit complexity | +| --- | --- | --- | +| `ci_sccache_provider_shell_injection` | isolate-toolchain pipeline | **DONE (#7265)** → `ci_materialization_emit` | +| `ci_floor_materialization_receipt_gate_script` | ci job gate | open — high (sed parses + if ladder) | +| `ci_floor_resolve_receipt_gate_script` | ci job gate | open — high (sed + numeric compare) | + +#### C — `ci_spec.dag` (~15 distinct script composers feeding GHA) + +| symbol | GHA consumer | route | +| --- | --- | --- | +| `ci_release_build_line` | build (via retry emit) | emit (partially done) | +| `ci_fmt_gate_line` | build fmt step | **typed op** | +| `ci_floor_build_verify_script` | build verify + unpack | emit (build_step transport pattern) | +| `ci_release_bins_pack_script` | build pack artifact | emit | +| `ci_release_bins_unpack_verify_script` | ci unpack step | emit | +| `gunbc_ci_floor_only_script` | ci floor `run:` | emit (composes A rows) | +| `ci_regen_floor_skip_shortcut_script` | regen skip | emit (`if` + cmdsubst) | +| `gunbc_ci_regen_floor_only_script` | regen job | emit (composer) | +| `gunbc_ci_deploy_invoke` | deploy job | emit (thin gunbc run) | +| `gunbc_ci_heal_regen_invoke` | heal regen | emit | +| `gunbc_ci_heal_commit_push_script` | heal commit/push | emit (git verbs; future typed git ops) | +| `scheduler_invoke` / `scheduler_invoke_with` | floor/regen | emit (thin claim_executor) | +| `git_fetch_script` | floor/regen/deploy | emit (`git fetch` + fallback) | + +#### D — permanent roster (emit target, never typed-op dissolve) + +| site | executor | +| --- | --- | +| `gunbc.githooks_pre_push_emit` · `expected_githooks_pre_push_sh` | git pre-push hook | +| cron entry lines (REST transport witness corpus) | cron | + +**Proposed batching (3 PRs):** + +| PR | scope | +| --- | --- | +| **PR 1 (#7265)** | `ci_sccache_provider_shell_injection` + `ci_floor_disposition_marker_init_script` emit migrations; witness tests + `realization_vocabulary_containment` roster; regen `ci.yml`. Does not touch `ci_spec.dag` composers beyond import delegation. | +| **PR 2** | merge-admission cluster completion + receipt gates (A/B remaining rows). | +| **PR 3** | `ci_spec` composer migration + `ci_fmt_gate_line` → typed `cargo.Build.Fmt`. **Operator review required** — load-bearing CI generator. | + ### Dissolution trigger for §4 This punch-list folds into the **`host_language_transport_script` lens going live** (4.F): once a compile gate reds any raw-string `shell.Exec.Run` / hand-built transport, new instances are unwritable by construction (§5) and a prose punch-list is redundant. Until then, every row here is discharged by *deletion of the concat*, verified green-by-execution + an injection-RED — never by relocation. From de6249601bbd6448bca138c0c45c31ffb1260a28 Mon Sep 17 00:00:00 2001 From: Brian Searls Date: Sun, 26 Jul 2026 03:01:31 +0000 Subject: [PATCH 05/15] Repoint ci_sccache_opportunistic_detect scaffold to emit module. ci_sccache_provider_shell_injection moved to v2.workflow.ci_materialization_emit in this PR; host_build_cache_provision's scaffold bind still pointed at the deleted gunbc.ci_materialization declaration (review 43048). Co-authored-by: Cursor --- dag/gunbc/host_build_cache_provision.dag | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dag/gunbc/host_build_cache_provision.dag b/dag/gunbc/host_build_cache_provision.dag index 9e80c7bf5b3..fc9c1d81dde 100644 --- a/dag/gunbc/host_build_cache_provision.dag +++ b/dag/gunbc/host_build_cache_provision.dag @@ -32,7 +32,7 @@ data host_build_cache_provision_realize_scaffold: Disposition = Scaffold { data ci_sccache_opportunistic_detect_scaffold: Disposition = Scaffold { dissolves_to: RealizationDispatch, bind: DeclarationRef { - module_path: "gunbc.ci_materialization", + module_path: "v2.workflow.ci_materialization_emit", decl_name: "ci_sccache_provider_shell_injection", field: WholeDeclaration, } From 09511ad5f132528f40de4ea80cca60ba3e6a75fe Mon Sep 17 00:00:00 2001 From: Brian Searls Date: Sun, 26 Jul 2026 03:21:12 +0000 Subject: [PATCH 06/15] Fix merge-admission emit golden: hand-authored bytes, no trailing NL. ci_floor_disposition_marker_init_emit_matches_concat_golden_holds failed on CI because the concat-reconstructed golden carried a trailing newline after the echo redirect that orch_emit_pipeline does not emit. Switch to the #6467 hand-authored golden pattern (matches committed ci.yml). Co-authored-by: Cursor --- .../workflow/ci_merge_admission_emit_test.dag | 27 ++++++------------- 1 file changed, 8 insertions(+), 19 deletions(-) diff --git a/src/v2/workflow/ci_merge_admission_emit_test.dag b/src/v2/workflow/ci_merge_admission_emit_test.dag index 5cc885bd42a..ad76c093fc7 100644 --- a/src/v2/workflow/ci_merge_admission_emit_test.dag +++ b/src/v2/workflow/ci_merge_admission_emit_test.dag @@ -1,31 +1,20 @@ module v2.workflow.ci_merge_admission_emit_test import v2.workflow.ci_merge_admission_emit { ci_floor_disposition_marker_init_script } -import gunbc.merge_admission_produce { - ci_floor_disposition_marker_init_shell_emit_dissolution_trigger, - ci_floor_disposition_marker_init_note, - merge_admission_floor_disposition_floor_running, - ci_floor_disposition_marker_path, -} data ci_merge_admission_emit_golden_note: String = "Hand-authored golden independent of grammar row spellings; byte test compares emit output against this literal (#6467 pattern)." -fn ci_floor_disposition_marker_init_concat_golden() -> String { +data ci_floor_disposition_marker_init_golden: String = concat( + concat("# 🟡 dissolve-on: ci_floor_disposition_marker_init_script — concat-built bash floor step opener stamping floor_running into target/ci-floor-disposition.txt (clears stale documentation_only_skipped on persistent self-hosted runners before docs-only branch); DISSOLVES WHEN bash-emit (#5828 / ROADMAP 6-shell-slice0) realizes floor disposition initialization through orchestration emit and the marker init retires without a transport scaffold\n"), concat( - concat("# ", concat(ci_floor_disposition_marker_init_shell_emit_dissolution_trigger, "\n")), + concat("# Positive floor-running stamp at the start of every floor step clears stale documentation_only_skipped left in target/ on persistent self-hosted runners (review 37010 / operator ruling 2026-07-11). Receipt gates skip only on an exact documentation_only_skipped match — never on file presence alone.\n"), concat( - concat("# ", concat(ci_floor_disposition_marker_init_note, "\n")), - concat( - concat("mkdir -p target\n"), - concat( - concat("echo ", merge_admission_floor_disposition_floor_running), - concat(" > ", concat(ci_floor_disposition_marker_path, "\n")) - ) - ) + "mkdir -p target\n", + "echo floor_running > target/ci-floor-disposition.txt" ) ) -} +) -test fn ci_floor_disposition_marker_init_emit_matches_concat_golden_holds() -> Bool { - ci_floor_disposition_marker_init_script() == ci_floor_disposition_marker_init_concat_golden() +test fn ci_floor_disposition_marker_init_emit_matches_golden_holds() -> Bool { + ci_floor_disposition_marker_init_script() == ci_floor_disposition_marker_init_golden } From 4461b1d395213f816df54245b29ab6f4653209a6 Mon Sep 17 00:00:00 2001 From: Brian Searls Date: Sun, 26 Jul 2026 04:08:23 +0000 Subject: [PATCH 07/15] Mark ci_sccache_bound_branch semijoin as declared Scaffold. MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Three bound-branch Runs are semicolon-folded because multi-Do then_ inside realize_if_else inline binding is unguarded by the if-band corpus and byte-diverged on first ci.yml regen — not a carriage bug. Dissolution: emit-lane construction refusal for multi-step then_ at inline if_else bind, or block-bodied if_else row (emit lane, not D). Co-authored-by: Cursor --- src/v2/workflow/ci_materialization_emit.dag | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/src/v2/workflow/ci_materialization_emit.dag b/src/v2/workflow/ci_materialization_emit.dag index be520c5de8d..1d6ef3d88ad 100644 --- a/src/v2/workflow/ci_materialization_emit.dag +++ b/src/v2/workflow/ci_materialization_emit.dag @@ -5,6 +5,8 @@ import v2.extdeps.languages.bash_orchestration_emit { bash_orchestration_emit_me import gunbc.ci_materialization { ci_sccache_provider_skip_is_counted_note, } +import std.decl_ref { DeclarationRef, WholeDeclaration } +import std.disposition { Disposition, RealizationDispatch, Scaffold } import v2.std.orchestration { Do, FailFast, @@ -33,6 +35,19 @@ data ci_sccache_bound_receipt_command: String = "printf '%s\\n' \"CiSccacheProvi data ci_sccache_skipped_receipt_command: String = "printf '%s\\n' \"CiSccacheProviderReceipt: provider=SKIPPED catalog=sccache_local host=$(hostname) cause=daemon-unavailable; the release build runs UNCACHED — a counted degradation, not a supported mode (host_build_cache_provision P1b should have converged this host)\"" +data ci_sccache_bound_branch_semijoin_note: String = "Three bound-branch Run steps are semicolon-folded into one command string. A multi-Do then_ Pipeline routes through realize_if_else, which binds the full newline-joined orch_emit_pipeline.carried into the inline bash_stmt_if_else row (semicolon-delimited single-line grammar, #6475) — not a carriage bug (orch_emit_pipeline joins all then steps before bind). The if-band corpus has no multi-Do then_ witness (orchestration_if_emit_test.dag); newline-joined inline binding is bash-valid but byte-diverged from hand block-formatted ci.yml and produced heal drift on first regen. Semijoin is a declared workaround until the emit lane refuses or block-bodied if_else lands." + +data ci_sccache_bound_branch_semijoin_dissolution_trigger: String = "🟡 dissolve-on: ci_sccache_bound_branch_command — semicolon-fold of three bound-branch Runs; DISSOLVES WHEN orch_emit_if_step refuses a then_/else_ Pipeline with more than one Do step at inline if_else bind (typed IfThenBodyMultiStepRefused construction wall — decidable from step count; end-state is refusal not silent partial bind), OR a block-bodied if_else row lands that preserves multi-line readability without semijoin" + +data ci_sccache_bound_branch_semijoin_scaffold: Disposition = Scaffold { + dissolves_to: RealizationDispatch, + bind: DeclarationRef { + module_path: "v2.workflow.ci_materialization_emit", + decl_name: "ci_sccache_bound_branch_command", + field: WholeDeclaration + } +} + data ci_sccache_bound_branch_command: String = concat( concat(ci_sccache_bind_rustc_wrapper_command, "; "), concat( @@ -67,6 +82,9 @@ fn ci_materialization_emit_pipeline(p: Pipeline) -> String { fn ci_sccache_provider_shell_injection_intent() -> Pipeline { let _note = ci_sccache_provider_skip_is_counted_note + let _semijoin_scaffold = ci_sccache_bound_branch_semijoin_scaffold + let _semijoin_note = ci_sccache_bound_branch_semijoin_note + let _semijoin_dissolve = ci_sccache_bound_branch_semijoin_dissolution_trigger Pipeline { steps: [ If { From e80cc0f83a99b3b0284a597083dc538486f64acd Mon Sep 17 00:00:00 2001 From: Brian Searls Date: Sun, 26 Jul 2026 13:01:30 +0000 Subject: [PATCH 08/15] Add missing Present import to ci_materialization_emit. Present is used for redirect and else_ arms but was not in the import list; golden tests executed green via compilation (review 43241). Co-authored-by: Cursor --- src/v2/workflow/ci_materialization_emit.dag | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/v2/workflow/ci_materialization_emit.dag b/src/v2/workflow/ci_materialization_emit.dag index 1d6ef3d88ad..f5c8efe13d9 100644 --- a/src/v2/workflow/ci_materialization_emit.dag +++ b/src/v2/workflow/ci_materialization_emit.dag @@ -18,7 +18,7 @@ import v2.std.orchestration { RedirectSpec, DiscardAll } -import v2.std.collection { Absent } +import v2.std.collection { Absent, Present } import v2.std.diagnostic { Accepted, Rejected, None, Some } data ci_materialization_emit_authority_note: String = "Foreign-executor shell emission for gunbc.ci_materialization script surfaces (bucket D). Intent stays out of dag/gunbc/ci_materialization; bash medium binding lives here per shell→intent routing." From 26befa2019d0f6ff52386de04772f1869082e001 Mon Sep 17 00:00:00 2001 From: Brian Searls Date: Sun, 26 Jul 2026 13:22:14 +0000 Subject: [PATCH 09/15] Roster ct_render_rust_applied_type_qualified_base_test for scaffold index. #7269 added the hand assertion blob after #7272 landed the inventory witness; merge main exposed compiler_tests_rust_blobs_are_all_rostered red (27 declared, 26 rostered). Co-authored-by: Cursor --- dag/gunbc/language_source_scaffold_index.dag | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/dag/gunbc/language_source_scaffold_index.dag b/dag/gunbc/language_source_scaffold_index.dag index 51a94f22277..6420b9310e9 100644 --- a/dag/gunbc/language_source_scaffold_index.dag +++ b/dag/gunbc/language_source_scaffold_index.dag @@ -314,6 +314,11 @@ data ct_row_ct_rust_btree_set_ord_eligibility_test: LanguageSourceScaffoldRow = disposition: compiler_tests_rust_hand_assertion_scaffold_trigger } +data ct_row_ct_render_rust_applied_type_qualified_base_test: LanguageSourceScaffoldRow = LanguageSourceScaffoldRow { + carrier_module: "v1.compiler.compiler_tests_rust", blob_decl: "ct_render_rust_applied_type_qualified_base_test", + disposition: compiler_tests_rust_hand_assertion_scaffold_trigger +} + data ct_row_ct_unlisted_import_use_witness_test: LanguageSourceScaffoldRow = LanguageSourceScaffoldRow { carrier_module: "v1.compiler.compiler_tests_rust", blob_decl: "ct_unlisted_import_use_witness_test", disposition: compiler_tests_rust_hand_assertion_scaffold_trigger @@ -387,6 +392,7 @@ data language_source_scaffold_roster: List = [ ct_row_ct_type_size_test, ct_row_ct_diagnostics_carrier_grounding_test, ct_row_ct_rust_btree_set_ord_eligibility_test, + ct_row_ct_render_rust_applied_type_qualified_base_test, ct_row_ct_unlisted_import_use_witness_test, ct_row_ct_sole_constructor_test, ct_row_ct_sole_constructor_fieldless_witness_test, From ffcb1a93cedd1ca2c6275d538b4178674be824f3 Mon Sep 17 00:00:00 2001 From: Brian Searls Date: Sun, 26 Jul 2026 14:43:26 +0000 Subject: [PATCH 10/15] =?UTF-8?q?WIP:=20shell=E2=86=92dag=20bucket=20D=20?= =?UTF-8?q?=E2=80=94=20foreign-executor=20emit=20cluster=20(gate=20#7216?= =?UTF-8?q?=20now=20MERGE?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../orchestration_bash_emit_support.dag | 37 +++++++++++++++++++ 1 file changed, 37 insertions(+) create mode 100644 src/v2/workflow/orchestration_bash_emit_support.dag diff --git a/src/v2/workflow/orchestration_bash_emit_support.dag b/src/v2/workflow/orchestration_bash_emit_support.dag new file mode 100644 index 00000000000..11d2be9f7cb --- /dev/null +++ b/src/v2/workflow/orchestration_bash_emit_support.dag @@ -0,0 +1,37 @@ +module v2.workflow.orchestration_bash_emit_support + +import v2.compiler.emit_orchestration { orch_emit_pipeline } +import v2.extdeps.languages.bash_orchestration_emit { bash_orchestration_emit_medium } +import v2.std.orchestration { Do, Pipeline, PipelineStep, Run } +import v2.std.collection { Absent } +import v2.std.diagnostic { Accepted, Rejected, None, Some } + +data orchestration_bash_emit_support_note: String = "Shared run/do/emit_pipeline helpers for v2.workflow.ci_*_emit modules (bucket D PR1 extraction). Each emit module keeps its own refused_poison string; this module holds the byte-identical plumbing only. Pre-existing ci_*_emit forks migrate here in bucket D PR2." + +fn orch_bash_run(command: String) -> Run { + Run { + command: command, + env: [], + redirect: Absent, + capture: Absent + } +} + +fn orch_bash_do(command: String) -> PipelineStep { + Do { run: orch_bash_run(command: command) } +} + +fn orch_bash_comment_line(text: String) -> PipelineStep { + orch_bash_do(command: concat("# ", text)) +} + +fn orch_bash_emit_pipeline(p: Pipeline, refused_poison: String) -> String { + match orch_emit_pipeline(p: p, medium: bash_orchestration_emit_medium()) { + Accepted { value: source, diagnostics: d } => + match d { + None => source.carried + Some { diagnostics: _ } => refused_poison + } + Rejected { diagnostics: _ } => refused_poison + } +} From 4a9077d2336625c415f7f9afb30395c173dd908e Mon Sep 17 00:00:00 2001 From: Brian Searls Date: Sun, 26 Jul 2026 14:44:34 +0000 Subject: [PATCH 11/15] Rework bucket D PR1: dissolve semijoin, extract shared emit plumbing. Replace semicolon-folded sccache bound branch with three Do steps so block-bodied if_else (#7277) emits multi-line workflow text; re-golden and regen ci.yml/falsifier.yml. Route both new emit modules through orchestration_bash_emit_support (run/do/emit_pipeline); pre-existing ci_*_emit forks migrate in PR2. Co-authored-by: Cursor --- .github/workflows/ci.yml | 8 +- .github/workflows/falsifier.yml | 8 +- ...-dag-residual-census-and-arc-completion.md | 3 +- src/v2/workflow/ci_materialization_emit.dag | 75 ++++--------------- .../workflow/ci_materialization_emit_test.dag | 22 +++++- src/v2/workflow/ci_merge_admission_emit.dag | 55 ++++---------- 6 files changed, 63 insertions(+), 108 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index f50d843c997..b4f9820b387 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -36,7 +36,13 @@ jobs: GUNBC_TOOLCHAIN_SEG=$(rustc -V 2>/dev/null | tr ' ' '-'); if [ -z "$GUNBC_TOOLCHAIN_SEG" ]; then GUNBC_TOOLCHAIN_SEG=toolchain-unresolved; fi mkdir -p "$RUNNER_TOOL_CACHE/gunbc-native/$GUNBC_TOOLCHAIN_SEG" echo "GUNBC_NATIVE_CACHE_ROOT=$RUNNER_TOOL_CACHE/gunbc-native/$GUNBC_TOOLCHAIN_SEG" >> "$GITHUB_ENV" - if sccache --show-stats >/dev/null 2>&1; then echo "RUSTC_WRAPPER=sccache" >> "$GITHUB_ENV"; echo "CARGO_INCREMENTAL=0" >> "$GITHUB_ENV"; printf '%s\n' "CiSccacheProviderReceipt: provider=bound catalog=sccache_local"; else printf '%s\n' "CiSccacheProviderReceipt: provider=SKIPPED catalog=sccache_local host=$(hostname) cause=daemon-unavailable; the release build runs UNCACHED — a counted degradation, not a supported mode (host_build_cache_provision P1b should have converged this host)"; fi + if sccache --show-stats >/dev/null 2>&1; then + echo "RUSTC_WRAPPER=sccache" >> "$GITHUB_ENV" + echo "CARGO_INCREMENTAL=0" >> "$GITHUB_ENV" + printf '%s\n' "CiSccacheProviderReceipt: provider=bound catalog=sccache_local" + else + printf '%s\n' "CiSccacheProviderReceipt: provider=SKIPPED catalog=sccache_local host=$(hostname) cause=daemon-unavailable; the release build runs UNCACHED — a counted degradation, not a supported mode (host_build_cache_provision P1b should have converged this host)" + fi - name: Setup Rust uses: actions-rust-lang/setup-rust-toolchain@v1.16.0 with: diff --git a/.github/workflows/falsifier.yml b/.github/workflows/falsifier.yml index be986f55126..a6b6440a304 100644 --- a/.github/workflows/falsifier.yml +++ b/.github/workflows/falsifier.yml @@ -30,7 +30,13 @@ jobs: GUNBC_TOOLCHAIN_SEG=$(rustc -V 2>/dev/null | tr ' ' '-'); if [ -z "$GUNBC_TOOLCHAIN_SEG" ]; then GUNBC_TOOLCHAIN_SEG=toolchain-unresolved; fi mkdir -p "$RUNNER_TOOL_CACHE/gunbc-native/$GUNBC_TOOLCHAIN_SEG" echo "GUNBC_NATIVE_CACHE_ROOT=$RUNNER_TOOL_CACHE/gunbc-native/$GUNBC_TOOLCHAIN_SEG" >> "$GITHUB_ENV" - if sccache --show-stats >/dev/null 2>&1; then echo "RUSTC_WRAPPER=sccache" >> "$GITHUB_ENV"; echo "CARGO_INCREMENTAL=0" >> "$GITHUB_ENV"; printf '%s\n' "CiSccacheProviderReceipt: provider=bound catalog=sccache_local"; else printf '%s\n' "CiSccacheProviderReceipt: provider=SKIPPED catalog=sccache_local host=$(hostname) cause=daemon-unavailable; the release build runs UNCACHED — a counted degradation, not a supported mode (host_build_cache_provision P1b should have converged this host)"; fi + if sccache --show-stats >/dev/null 2>&1; then + echo "RUSTC_WRAPPER=sccache" >> "$GITHUB_ENV" + echo "CARGO_INCREMENTAL=0" >> "$GITHUB_ENV" + printf '%s\n' "CiSccacheProviderReceipt: provider=bound catalog=sccache_local" + else + printf '%s\n' "CiSccacheProviderReceipt: provider=SKIPPED catalog=sccache_local host=$(hostname) cause=daemon-unavailable; the release build runs UNCACHED — a counted degradation, not a supported mode (host_build_cache_provision P1b should have converged this host)" + fi - name: Setup Rust uses: actions-rust-lang/setup-rust-toolchain@v1.16.0 with: diff --git a/docs/plans/shell-to-dag-residual-census-and-arc-completion.md b/docs/plans/shell-to-dag-residual-census-and-arc-completion.md index 29e570c353f..e66054adb98 100644 --- a/docs/plans/shell-to-dag-residual-census-and-arc-completion.md +++ b/docs/plans/shell-to-dag-residual-census-and-arc-completion.md @@ -256,6 +256,7 @@ These are correct as shell (GHA `run:`, cron, git hooks, pre-runtime bootstrap | `v2.workflow.ci_floor_peak_emit` | `ci_cgroup_peak_locate_shell`, `ci_floor_peak_pre_script`, `ci_floor_peak_post_script` | GHA `run:` | | `v2.workflow.ci_retry_emit` | `ci_cargo_eagain_retry_script` | GHA `run:` (via `ci_release_build_emit`) | | `v2.workflow.ci_release_build_emit` | `ci_release_build_script`, `gunbc_ci_run_script` | GHA `run:` (partial — still concat-wraps verify script) | +| `v2.workflow.orchestration_bash_emit_support` | `orch_bash_run`, `orch_bash_do`, `orch_bash_emit_pipeline` | shared emit plumbing (**#7265**; pre-existing four `ci_*_emit` forks migrate in PR2) | | `v2.workflow.ci_materialization_emit` | `ci_sccache_provider_shell_injection` | GHA `run:` (**LANDED #7265**) | | `v2.workflow.ci_merge_admission_emit` | `ci_floor_disposition_marker_init_script` | GHA `run:` (**LANDED #7265**) | | `gunbc.assimilate.bmc_token_federation` | `gcp_token_smoke_script` | GHA `run:` | @@ -446,7 +447,7 @@ The per-symbol remaining work and batching plan for §4.E CI sites. **Load-beari | PR | scope | | --- | --- | -| **PR 1 (#7265)** | `ci_sccache_provider_shell_injection` + `ci_floor_disposition_marker_init_script` emit migrations; witness tests + `realization_vocabulary_containment` roster; regen `ci.yml`. Does not touch `ci_spec.dag` composers beyond import delegation. | +| **PR 1 (#7265)** | `ci_sccache_provider_shell_injection` + `ci_floor_disposition_marker_init_script` emit migrations; `orchestration_bash_emit_support` shared plumbing; semijoin scaffold dissolved onto block-bodied `if_else` (#7277); witness tests + `realization_vocabulary_containment` roster; regen `ci.yml`. Does not touch `ci_spec.dag` composers beyond import delegation. | | **PR 2** | merge-admission cluster completion + receipt gates (A/B remaining rows). | | **PR 3** | `ci_spec` composer migration + `ci_fmt_gate_line` → typed `cargo.Build.Fmt`. **Operator review required** — load-bearing CI generator. | diff --git a/src/v2/workflow/ci_materialization_emit.dag b/src/v2/workflow/ci_materialization_emit.dag index f5c8efe13d9..57e490ab736 100644 --- a/src/v2/workflow/ci_materialization_emit.dag +++ b/src/v2/workflow/ci_materialization_emit.dag @@ -1,25 +1,19 @@ module v2.workflow.ci_materialization_emit -import v2.compiler.emit_orchestration { orch_emit_pipeline } -import v2.extdeps.languages.bash_orchestration_emit { bash_orchestration_emit_medium } -import gunbc.ci_materialization { - ci_sccache_provider_skip_is_counted_note, +import gunbc.ci_materialization { ci_sccache_provider_skip_is_counted_note } +import v2.workflow.orchestration_bash_emit_support { + orch_bash_do, + orch_bash_emit_pipeline } -import std.decl_ref { DeclarationRef, WholeDeclaration } -import std.disposition { Disposition, RealizationDispatch, Scaffold } import v2.std.orchestration { - Do, FailFast, If, Pipeline, - PipelineStep, Run, ExitZero, - RedirectSpec, DiscardAll } import v2.std.collection { Absent, Present } -import v2.std.diagnostic { Accepted, Rejected, None, Some } data ci_materialization_emit_authority_note: String = "Foreign-executor shell emission for gunbc.ci_materialization script surfaces (bucket D). Intent stays out of dag/gunbc/ci_materialization; bash medium binding lives here per shell→intent routing." @@ -35,56 +29,8 @@ data ci_sccache_bound_receipt_command: String = "printf '%s\\n' \"CiSccacheProvi data ci_sccache_skipped_receipt_command: String = "printf '%s\\n' \"CiSccacheProviderReceipt: provider=SKIPPED catalog=sccache_local host=$(hostname) cause=daemon-unavailable; the release build runs UNCACHED — a counted degradation, not a supported mode (host_build_cache_provision P1b should have converged this host)\"" -data ci_sccache_bound_branch_semijoin_note: String = "Three bound-branch Run steps are semicolon-folded into one command string. A multi-Do then_ Pipeline routes through realize_if_else, which binds the full newline-joined orch_emit_pipeline.carried into the inline bash_stmt_if_else row (semicolon-delimited single-line grammar, #6475) — not a carriage bug (orch_emit_pipeline joins all then steps before bind). The if-band corpus has no multi-Do then_ witness (orchestration_if_emit_test.dag); newline-joined inline binding is bash-valid but byte-diverged from hand block-formatted ci.yml and produced heal drift on first regen. Semijoin is a declared workaround until the emit lane refuses or block-bodied if_else lands." - -data ci_sccache_bound_branch_semijoin_dissolution_trigger: String = "🟡 dissolve-on: ci_sccache_bound_branch_command — semicolon-fold of three bound-branch Runs; DISSOLVES WHEN orch_emit_if_step refuses a then_/else_ Pipeline with more than one Do step at inline if_else bind (typed IfThenBodyMultiStepRefused construction wall — decidable from step count; end-state is refusal not silent partial bind), OR a block-bodied if_else row lands that preserves multi-line readability without semijoin" - -data ci_sccache_bound_branch_semijoin_scaffold: Disposition = Scaffold { - dissolves_to: RealizationDispatch, - bind: DeclarationRef { - module_path: "v2.workflow.ci_materialization_emit", - decl_name: "ci_sccache_bound_branch_command", - field: WholeDeclaration - } -} - -data ci_sccache_bound_branch_command: String = concat( - concat(ci_sccache_bind_rustc_wrapper_command, "; "), - concat( - concat(ci_sccache_bind_cargo_incremental_command, "; "), - ci_sccache_bound_receipt_command - ) -) - -fn ci_materialization_run(command: String) -> Run { - Run { - command: command, - env: [], - redirect: Absent, - capture: Absent - } -} - -fn ci_materialization_do(command: String) -> PipelineStep { - Do { run: ci_materialization_run(command: command) } -} - -fn ci_materialization_emit_pipeline(p: Pipeline) -> String { - match orch_emit_pipeline(p: p, medium: bash_orchestration_emit_medium()) { - Accepted { value: source, diagnostics: d } => - match d { - None => source.carried - Some { diagnostics: _ } => ci_sccache_provider_emit_refused_poison - } - Rejected { diagnostics: _ } => ci_sccache_provider_emit_refused_poison - } -} - fn ci_sccache_provider_shell_injection_intent() -> Pipeline { let _note = ci_sccache_provider_skip_is_counted_note - let _semijoin_scaffold = ci_sccache_bound_branch_semijoin_scaffold - let _semijoin_note = ci_sccache_bound_branch_semijoin_note - let _semijoin_dissolve = ci_sccache_bound_branch_semijoin_dissolution_trigger Pipeline { steps: [ If { @@ -97,12 +43,16 @@ fn ci_sccache_provider_shell_injection_intent() -> Pipeline { } }, then_: Pipeline { - steps: [ci_materialization_do(command: ci_sccache_bound_branch_command)], + steps: [ + orch_bash_do(command: ci_sccache_bind_rustc_wrapper_command), + orch_bash_do(command: ci_sccache_bind_cargo_incremental_command), + orch_bash_do(command: ci_sccache_bound_receipt_command) + ], on_failure: FailFast }, else_: Present { value: Pipeline { - steps: [ci_materialization_do(command: ci_sccache_skipped_receipt_command)], + steps: [orch_bash_do(command: ci_sccache_skipped_receipt_command)], on_failure: FailFast } } @@ -113,5 +63,8 @@ fn ci_sccache_provider_shell_injection_intent() -> Pipeline { } fn ci_sccache_provider_shell_injection() -> String { - ci_materialization_emit_pipeline(p: ci_sccache_provider_shell_injection_intent()) + orch_bash_emit_pipeline( + p: ci_sccache_provider_shell_injection_intent(), + refused_poison: ci_sccache_provider_emit_refused_poison + ) } diff --git a/src/v2/workflow/ci_materialization_emit_test.dag b/src/v2/workflow/ci_materialization_emit_test.dag index 09b8d1e40b2..6a95d82014b 100644 --- a/src/v2/workflow/ci_materialization_emit_test.dag +++ b/src/v2/workflow/ci_materialization_emit_test.dag @@ -2,9 +2,27 @@ module v2.workflow.ci_materialization_emit_test import v2.workflow.ci_materialization_emit { ci_sccache_provider_shell_injection } -data ci_sccache_provider_emit_golden_note: String = "Hand-authored golden independent of grammar row spellings; byte test compares emit output against this literal (#6467 pattern)." +data ci_sccache_provider_emit_golden_note: String = "Hand-authored golden independent of grammar row spellings; byte test compares emit output against this literal (#6467 pattern). Block-bodied if_else (#7277) emits multi-line then/else arms for the three-step bound branch." -data ci_sccache_provider_shell_injection_golden: String = "if sccache --show-stats >/dev/null 2>&1; then echo \"RUSTC_WRAPPER=sccache\" >> \"$GITHUB_ENV\"; echo \"CARGO_INCREMENTAL=0\" >> \"$GITHUB_ENV\"; printf '%s\\n' \"CiSccacheProviderReceipt: provider=bound catalog=sccache_local\"; else printf '%s\\n' \"CiSccacheProviderReceipt: provider=SKIPPED catalog=sccache_local host=$(hostname) cause=daemon-unavailable; the release build runs UNCACHED — a counted degradation, not a supported mode (host_build_cache_provision P1b should have converged this host)\"; fi" +data ci_sccache_provider_shell_injection_golden: String = concat( + concat( + concat( + "if sccache --show-stats >/dev/null 2>&1; then\n", + "echo \"RUSTC_WRAPPER=sccache\" >> \"$GITHUB_ENV\"\n" + ), + concat( + concat( + "echo \"CARGO_INCREMENTAL=0\" >> \"$GITHUB_ENV\"\n", + "printf '%s\\n' \"CiSccacheProviderReceipt: provider=bound catalog=sccache_local\"\n" + ), + "else\n" + ) + ), + concat( + "printf '%s\\n' \"CiSccacheProviderReceipt: provider=SKIPPED catalog=sccache_local host=$(hostname) cause=daemon-unavailable; the release build runs UNCACHED — a counted degradation, not a supported mode (host_build_cache_provision P1b should have converged this host)\"\n", + "fi" + ) +) test fn ci_sccache_provider_shell_injection_emit_matches_golden_holds() -> Bool { ci_sccache_provider_shell_injection() == ci_sccache_provider_shell_injection_golden diff --git a/src/v2/workflow/ci_merge_admission_emit.dag b/src/v2/workflow/ci_merge_admission_emit.dag index 4815847ad02..2004f8acfe3 100644 --- a/src/v2/workflow/ci_merge_admission_emit.dag +++ b/src/v2/workflow/ci_merge_admission_emit.dag @@ -1,21 +1,17 @@ module v2.workflow.ci_merge_admission_emit -import v2.compiler.emit_orchestration { orch_emit_pipeline } -import v2.extdeps.languages.bash_orchestration_emit { bash_orchestration_emit_medium } import gunbc.merge_admission_produce { ci_floor_disposition_marker_init_shell_emit_dissolution_trigger, ci_floor_disposition_marker_init_note, merge_admission_floor_disposition_floor_running, ci_floor_disposition_marker_path, } -import v2.std.orchestration { - Do, - FailFast, - Pipeline, - PipelineStep, - Run +import v2.workflow.orchestration_bash_emit_support { + orch_bash_comment_line, + orch_bash_do, + orch_bash_emit_pipeline } -import v2.std.diagnostic { Accepted, Rejected, None, Some } +import v2.std.orchestration { FailFast, Pipeline } data ci_merge_admission_emit_authority_note: String = "Foreign-executor shell emission for gunbc.merge_admission_produce script surfaces (bucket D). Intent stays out of dag/gunbc/merge_admission_produce; bash medium binding lives here per shell→intent routing." @@ -30,46 +26,21 @@ fn ci_merge_admission_floor_disposition_stamp_command() -> String { ) } -fn ci_merge_admission_run(command: String) -> Run { - Run { - command: command, - env: [], - redirect: Absent, - capture: Absent - } -} - -fn ci_merge_admission_do(command: String) -> PipelineStep { - Do { run: ci_merge_admission_run(command: command) } -} - -fn ci_merge_admission_comment_line(text: String) -> PipelineStep { - ci_merge_admission_do(command: concat("# ", text)) -} - -fn ci_merge_admission_emit_pipeline(p: Pipeline) -> String { - match orch_emit_pipeline(p: p, medium: bash_orchestration_emit_medium()) { - Accepted { value: source, diagnostics: d } => - match d { - None => source.carried - Some { diagnostics: _ } => ci_merge_admission_emit_refused_poison - } - Rejected { diagnostics: _ } => ci_merge_admission_emit_refused_poison - } -} - fn ci_floor_disposition_marker_init_intent() -> Pipeline { Pipeline { steps: [ - ci_merge_admission_comment_line(text: ci_floor_disposition_marker_init_shell_emit_dissolution_trigger), - ci_merge_admission_comment_line(text: ci_floor_disposition_marker_init_note), - ci_merge_admission_do(command: ci_floor_disposition_marker_mkdir_command), - ci_merge_admission_do(command: ci_merge_admission_floor_disposition_stamp_command()) + orch_bash_comment_line(text: ci_floor_disposition_marker_init_shell_emit_dissolution_trigger), + orch_bash_comment_line(text: ci_floor_disposition_marker_init_note), + orch_bash_do(command: ci_floor_disposition_marker_mkdir_command), + orch_bash_do(command: ci_merge_admission_floor_disposition_stamp_command()) ], on_failure: FailFast } } fn ci_floor_disposition_marker_init_script() -> String { - ci_merge_admission_emit_pipeline(p: ci_floor_disposition_marker_init_intent()) + orch_bash_emit_pipeline( + p: ci_floor_disposition_marker_init_intent(), + refused_poison: ci_merge_admission_emit_refused_poison + ) } From 51364db5d48ef6baddae9d347e09d172605461ad Mon Sep 17 00:00:00 2001 From: Brian Searls Date: Sun, 26 Jul 2026 14:59:55 +0000 Subject: [PATCH 12/15] =?UTF-8?q?WIP:=20shell=E2=86=92dag=20bucket=20D=20?= =?UTF-8?q?=E2=80=94=20foreign-executor=20emit=20cluster=20(gate=20#7216?= =?UTF-8?q?=20now=20MERGE?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- dag/gunbc/language_source_scaffold_index.dag | 6 ------ 1 file changed, 6 deletions(-) diff --git a/dag/gunbc/language_source_scaffold_index.dag b/dag/gunbc/language_source_scaffold_index.dag index 6420b9310e9..51a94f22277 100644 --- a/dag/gunbc/language_source_scaffold_index.dag +++ b/dag/gunbc/language_source_scaffold_index.dag @@ -314,11 +314,6 @@ data ct_row_ct_rust_btree_set_ord_eligibility_test: LanguageSourceScaffoldRow = disposition: compiler_tests_rust_hand_assertion_scaffold_trigger } -data ct_row_ct_render_rust_applied_type_qualified_base_test: LanguageSourceScaffoldRow = LanguageSourceScaffoldRow { - carrier_module: "v1.compiler.compiler_tests_rust", blob_decl: "ct_render_rust_applied_type_qualified_base_test", - disposition: compiler_tests_rust_hand_assertion_scaffold_trigger -} - data ct_row_ct_unlisted_import_use_witness_test: LanguageSourceScaffoldRow = LanguageSourceScaffoldRow { carrier_module: "v1.compiler.compiler_tests_rust", blob_decl: "ct_unlisted_import_use_witness_test", disposition: compiler_tests_rust_hand_assertion_scaffold_trigger @@ -392,7 +387,6 @@ data language_source_scaffold_roster: List = [ ct_row_ct_type_size_test, ct_row_ct_diagnostics_carrier_grounding_test, ct_row_ct_rust_btree_set_ord_eligibility_test, - ct_row_ct_render_rust_applied_type_qualified_base_test, ct_row_ct_unlisted_import_use_witness_test, ct_row_ct_sole_constructor_test, ct_row_ct_sole_constructor_fieldless_witness_test, From 6decf5cce2d53de219ec4ec7ecd41bd99400751a Mon Sep 17 00:00:00 2001 From: Brian Searls Date: Sun, 26 Jul 2026 15:12:06 +0000 Subject: [PATCH 13/15] Fix CI drift gate: regen ci.yml from emit authority; drop duplicate roster. MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Remove duplicate ct_render_rust_applied_type_qualified_base_test row (main already carries it after #7272/#7288); revert language_source_scaffold_index to main placement. Regenerate ci.yml/falsifier.yml via main_wet — block if then/else body lines use emit indentation (10-space), not hand-indented 12-space; matches heal job 89806546636 output the bot could not push. Co-authored-by: Cursor --- .github/workflows/ci.yml | 8 ++++---- .github/workflows/falsifier.yml | 8 ++++---- 2 files changed, 8 insertions(+), 8 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index b4f9820b387..535f1416274 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -37,11 +37,11 @@ jobs: mkdir -p "$RUNNER_TOOL_CACHE/gunbc-native/$GUNBC_TOOLCHAIN_SEG" echo "GUNBC_NATIVE_CACHE_ROOT=$RUNNER_TOOL_CACHE/gunbc-native/$GUNBC_TOOLCHAIN_SEG" >> "$GITHUB_ENV" if sccache --show-stats >/dev/null 2>&1; then - echo "RUSTC_WRAPPER=sccache" >> "$GITHUB_ENV" - echo "CARGO_INCREMENTAL=0" >> "$GITHUB_ENV" - printf '%s\n' "CiSccacheProviderReceipt: provider=bound catalog=sccache_local" + echo "RUSTC_WRAPPER=sccache" >> "$GITHUB_ENV" + echo "CARGO_INCREMENTAL=0" >> "$GITHUB_ENV" + printf '%s\n' "CiSccacheProviderReceipt: provider=bound catalog=sccache_local" else - printf '%s\n' "CiSccacheProviderReceipt: provider=SKIPPED catalog=sccache_local host=$(hostname) cause=daemon-unavailable; the release build runs UNCACHED — a counted degradation, not a supported mode (host_build_cache_provision P1b should have converged this host)" + printf '%s\n' "CiSccacheProviderReceipt: provider=SKIPPED catalog=sccache_local host=$(hostname) cause=daemon-unavailable; the release build runs UNCACHED — a counted degradation, not a supported mode (host_build_cache_provision P1b should have converged this host)" fi - name: Setup Rust uses: actions-rust-lang/setup-rust-toolchain@v1.16.0 diff --git a/.github/workflows/falsifier.yml b/.github/workflows/falsifier.yml index a6b6440a304..6a94bb34201 100644 --- a/.github/workflows/falsifier.yml +++ b/.github/workflows/falsifier.yml @@ -31,11 +31,11 @@ jobs: mkdir -p "$RUNNER_TOOL_CACHE/gunbc-native/$GUNBC_TOOLCHAIN_SEG" echo "GUNBC_NATIVE_CACHE_ROOT=$RUNNER_TOOL_CACHE/gunbc-native/$GUNBC_TOOLCHAIN_SEG" >> "$GITHUB_ENV" if sccache --show-stats >/dev/null 2>&1; then - echo "RUSTC_WRAPPER=sccache" >> "$GITHUB_ENV" - echo "CARGO_INCREMENTAL=0" >> "$GITHUB_ENV" - printf '%s\n' "CiSccacheProviderReceipt: provider=bound catalog=sccache_local" + echo "RUSTC_WRAPPER=sccache" >> "$GITHUB_ENV" + echo "CARGO_INCREMENTAL=0" >> "$GITHUB_ENV" + printf '%s\n' "CiSccacheProviderReceipt: provider=bound catalog=sccache_local" else - printf '%s\n' "CiSccacheProviderReceipt: provider=SKIPPED catalog=sccache_local host=$(hostname) cause=daemon-unavailable; the release build runs UNCACHED — a counted degradation, not a supported mode (host_build_cache_provision P1b should have converged this host)" + printf '%s\n' "CiSccacheProviderReceipt: provider=SKIPPED catalog=sccache_local host=$(hostname) cause=daemon-unavailable; the release build runs UNCACHED — a counted degradation, not a supported mode (host_build_cache_provision P1b should have converged this host)" fi - name: Setup Rust uses: actions-rust-lang/setup-rust-toolchain@v1.16.0 From f0258444b3e3c78746aaf9771b3cbf18a2f55b21 Mon Sep 17 00:00:00 2001 From: Brian Searls Date: Sun, 26 Jul 2026 15:36:43 +0000 Subject: [PATCH 14/15] =?UTF-8?q?WIP:=20shell=E2=86=92dag=20bucket=20D=20?= =?UTF-8?q?=E2=80=94=20foreign-executor=20emit=20cluster=20(gate=20#7216?= =?UTF-8?q?=20now=20MERGE?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- dag/gunbc/ci_materialization.dag | 1 - .../realization_vocabulary_containment.dag | 49 ++++++++++++++++--- .../lens_unit/discriminators_test.dag | 45 ++++++++++++++++- 3 files changed, 85 insertions(+), 10 deletions(-) diff --git a/dag/gunbc/ci_materialization.dag b/dag/gunbc/ci_materialization.dag index 7d44fd7832a..3fa502021e9 100644 --- a/dag/gunbc/ci_materialization.dag +++ b/dag/gunbc/ci_materialization.dag @@ -273,4 +273,3 @@ fn ci_floor_resolve_receipt_gate_script() -> String { } data ci_sccache_provider_skip_is_counted_note: String = "The skip arm is LOUD and COUNTED, not silent (§5: a degradation must be a typed, located, countable diagnostic so its frequency is observable and prioritizable). This guard was a bare `if` with no else until 2026-07-24 — when the daemon was down the release build simply ran uncached, and the deficit's frequency was zero by construction, so it never ranked for fixing (shell→dag census §4.I lists it as an absorbing fallback). It is NOT yet a refusal: STEP 2 of the srvN build-cache design flips this to fail-closed, and that flip is operator-sequenced AFTER a live T4 read-back proves P1b provisioning converges on srv1/srv2/srv4 — refusing before then would red the whole fleet, which is why the interim is loudness rather than a wall. The receipt line names the host, so a single misconfigured runner is attributable rather than fleet-wide noise." - diff --git a/src/v2/lens/realization_vocabulary_containment.dag b/src/v2/lens/realization_vocabulary_containment.dag index 75cfbba8ea3..953cf7cc3e2 100644 --- a/src/v2/lens/realization_vocabulary_containment.dag +++ b/src/v2/lens/realization_vocabulary_containment.dag @@ -115,21 +115,48 @@ fn path_is_realization_edge(path: String) -> Bool { path_has_any_prefix(prefixes: realization_edge_path_prefixes, path: path) } -fn is_realization_vocab_leak(fact: LayerImportFact, roster: List) -> Bool { +fn is_realization_vocab_leak_under( + fact: LayerImportFact, + roster: List, + edge_prefixes: List +) -> Bool { module_is_target_ast_vocab(module: fact.import_module) - && (path_is_realization_edge(path: fact.path) == false) + && (path_has_any_prefix(prefixes: edge_prefixes, path: fact.path) == false) && (list_contains_str(xs: roster, target: fact.path) == false) } -fn scan_facts_for_leaks( +fn is_realization_vocab_leak(fact: LayerImportFact, roster: List) -> Bool { + is_realization_vocab_leak_under( + fact: fact, + roster: roster, + edge_prefixes: realization_edge_path_prefixes + ) +} + +fn realization_edge_path_prefixes_without(excluded: String) -> List { + fold_list( + xs: realization_edge_path_prefixes, + empty: empty_realization_vocab_path_list, + cons: fn(acc, prefix) { + if prefix == excluded { + acc + } else { + list_snoc_item(xs: acc, item: prefix) + } + } + ) +} + +fn scan_facts_for_leaks_under( facts: List, - roster: List + roster: List, + edge_prefixes: List ) -> List { fold_list( xs: facts, empty: empty_realization_vocab_leaks, cons: fn(acc, fact) { - if is_realization_vocab_leak(fact: fact, roster: roster) { + if is_realization_vocab_leak_under(fact: fact, roster: roster, edge_prefixes: edge_prefixes) { list_snoc_item( xs: acc, item: RealizationVocabularyLeak { @@ -148,14 +175,22 @@ fn realization_vocab_leak_count( facts: List, roster: List ) -> Int { - length(xs: scan_facts_for_leaks(facts: facts, roster: roster)) + length(xs: scan_facts_for_leaks_under(facts: facts, roster: roster, edge_prefixes: realization_edge_path_prefixes)) +} + +fn realization_vocab_leak_count_with_edge_prefixes( + facts: List, + roster: List, + edge_prefixes: List +) -> Int { + length(xs: scan_facts_for_leaks_under(facts: facts, roster: roster, edge_prefixes: edge_prefixes)) } fn realization_vocab_containment_holds( facts: List, roster: List ) -> Bool { - is_empty(xs: scan_facts_for_leaks(facts: facts, roster: roster)) + is_empty(xs: scan_facts_for_leaks_under(facts: facts, roster: roster, edge_prefixes: realization_edge_path_prefixes)) } fn realization_vocab_leak_count_canonical(facts: List) -> Int { diff --git a/src/v2/test/claim/realization_vocabulary_containment/lens_unit/discriminators_test.dag b/src/v2/test/claim/realization_vocabulary_containment/lens_unit/discriminators_test.dag index 8e6e0421f4c..a114db9728c 100644 --- a/src/v2/test/claim/realization_vocabulary_containment/lens_unit/discriminators_test.dag +++ b/src/v2/test/claim/realization_vocabulary_containment/lens_unit/discriminators_test.dag @@ -4,10 +4,12 @@ import v2.std.layer { LayerImportFact } import v2.lens.realization_vocabulary_containment { realization_vocab_exception_paths, realization_vocab_leak_count, - realization_vocab_leak_count_canonical + realization_vocab_leak_count_canonical, + realization_vocab_leak_count_with_edge_prefixes, + realization_edge_path_prefixes_without } import v2.std.collection { List } -import v2.std.layer { LayerPrefixStd, LayerPrefixExtdeps } +import v2.std.layer { LayerPrefixStd, LayerPrefixExtdeps, LayerPrefixWorkflow } import v2.std.logic { Bool } import v2.std.text { String } import v2.std.live_tree { LiveTreeDisposition, SubstrateInputsOnly } @@ -126,3 +128,42 @@ test fn node_http_server_emit_rostered_for_typescript_sidecar_holds() -> Bool { target: "dag/gunbc/node_http_server_emit.dag" ) } + +data bash_orchestration_emit_module: String = "v2.extdeps.languages.bash_orchestration_emit" + +data bucket_d_emit_edge_import_facts: List = [ + LayerImportFact { + layer: LayerPrefixWorkflow, + path: "src/v2/workflow/ci_materialization_emit.dag", + import_module: bash_orchestration_emit_module + }, + LayerImportFact { + layer: LayerPrefixWorkflow, + path: "src/v2/workflow/ci_merge_admission_emit.dag", + import_module: bash_orchestration_emit_module + } +] + +data bucket_d_emit_edge_discriminator_note: String = "Synthetic executing receipt for #7265 bucket-D emit modules: live-corpus containment is dark (pre-existing unrostered TS-AST consumers), so canonical live-tree scan cannot validate the two new realization_edge_path_prefixes rows. These facts mirror the actual imports; GREEN requires leak_count_canonical == 0." + +test fn bucket_d_emit_modules_on_edge_roster_are_not_leak_holds() -> Bool { + realization_vocab_leak_count_canonical(facts: bucket_d_emit_edge_import_facts) == 0 +} + +data ci_materialization_emit_edge_fact: List = [ + LayerImportFact { + layer: LayerPrefixWorkflow, + path: "src/v2/workflow/ci_materialization_emit.dag", + import_module: bash_orchestration_emit_module + } +] + +test fn de_rostered_ci_materialization_emit_edge_is_leak_holds() -> Bool { + realization_vocab_leak_count_with_edge_prefixes( + facts: ci_materialization_emit_edge_fact, + roster: realization_vocab_exception_paths(), + edge_prefixes: realization_edge_path_prefixes_without( + excluded: "src/v2/workflow/ci_materialization_emit" + ) + ) == 1 +} From e3079d9f564d5e114c5e7d5b92c457014c02b501 Mon Sep 17 00:00:00 2001 From: Brian Searls Date: Sun, 26 Jul 2026 16:59:19 +0000 Subject: [PATCH 15/15] Remove duplicate ct_render_rust roster row from #7265 merge. Main already owns this entry via #7288; the branch copy made rostered exceed declared (27/28). Co-authored-by: Cursor --- dag/gunbc/language_source_scaffold_index.dag | 6 ------ 1 file changed, 6 deletions(-) diff --git a/dag/gunbc/language_source_scaffold_index.dag b/dag/gunbc/language_source_scaffold_index.dag index 1eda29d8ad2..51a94f22277 100644 --- a/dag/gunbc/language_source_scaffold_index.dag +++ b/dag/gunbc/language_source_scaffold_index.dag @@ -354,11 +354,6 @@ data ct_row_ct_profile_reconcile_test: LanguageSourceScaffoldRow = LanguageSourc disposition: compiler_tests_profile_trigger } -data ct_row_ct_render_rust_applied_type_qualified_base_test: LanguageSourceScaffoldRow = LanguageSourceScaffoldRow { - carrier_module: "v1.compiler.compiler_tests_rust", blob_decl: "ct_render_rust_applied_type_qualified_base_test", - disposition: compiler_tests_rust_hand_assertion_scaffold_trigger -} - data compiler_tests_coercion_hybrid_trigger: Disposition = Scaffold { dissolves_to: SingleAuthority, bind: DeclarationRef { @@ -400,7 +395,6 @@ data language_source_scaffold_roster: List = [ ct_row_ct_profile_self_compile_test, ct_row_ct_profile_full_pipeline_test, ct_row_ct_profile_reconcile_test, - ct_row_ct_render_rust_applied_type_qualified_base_test, runtime_rust_header_row, runtime_rust_work_counter_row, runtime_rust_concat_trait_row,