ci.yml

name: CI

on:
  push:
    branches: [master, feature/holographic-memory]
  workflow_dispatch:
    inputs:
      run_os:
        description: "Also run macOS and Windows matrices"
        type: boolean
        default: false
      run_hosts:
        description: "Also run stock host integrations"
        type: boolean
        default: false
      run_perf:
        description: "Also run hotpath parity"
        type: boolean
        default: false
      run_full_nextest:
        description: "Also run the full Linux search and transport selections"
        type: boolean
        default: false

permissions:
  contents: read

# One run per ref, and a newer push cancels the run in flight, master
# included. The newest master commit contains every merge before it, so its
# run is the verdict on what ships; a superseded run proves nothing the newer
# one does not. One master push spends 16 of the account's 20 hosted jobs, and
# keeping superseded master runs (keyed per SHA) serialized a merge burst at
# ~27 min per merge and left release-please waiting 80-93 min for a runner.
# To attribute a break inside a burst, bisect or dispatch this workflow on a
# branch at the suspect commit.
concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

env:
  CARGO_TERM_COLOR: always
  CARGO_INCREMENTAL: "0"
  CARGO_PROFILE_DEV_DEBUG: "0"
  CARGO_PROFILE_TEST_DEBUG: "0"
  AST_GREP_VERSION: "0.44.0"

jobs:
  # Manual dispatch is the only PR-head entry point. GitHub queues a
  # pull_request workflow before evaluating job conditions, and automation
  # applied every opt-in label to 173 PRs; only removing the trigger prevents
  # that volume from occupying the account FIFO. A dispatch runs the Linux
  # lane and may add OS, host, perf, or full-workspace work through explicit
  # inputs. A master push runs the Linux lane only so release jobs retain
  # runner slots.
  scope-gate:
    name: Scope gate
    runs-on: ubuntu-latest
    timeout-minutes: 5
    outputs:
      run-heavy: ${{ steps.decide.outputs.run-heavy }}
      run-os: ${{ steps.decide.outputs.run-os }}
      run-hosts: ${{ steps.decide.outputs.run-hosts }}
      run-perf: ${{ steps.decide.outputs.run-perf }}
      linux-partitions: ${{ steps.linux-partitions.outputs.matrix }}
      windows-partitions: ${{ steps.windows-partitions.outputs.matrix }}
      macos-groups: ${{ steps.macos-groups.outputs.matrix }}
    steps:
      - name: Decide what this run may spend
        id: decide
        env:
          EVENT: ${{ github.event_name }}
          RUN_OS: ${{ inputs.run_os || false }}
          RUN_HOSTS: ${{ inputs.run_hosts || false }}
          RUN_PERF: ${{ inputs.run_perf || false }}
        run: |
          heavy=true
          os=false
          hosts=false
          perf=false
          if [[ $EVENT == workflow_dispatch ]]; then
            [[ $RUN_OS == true ]] && os=true
            [[ $RUN_HOSTS == true ]] && hosts=true
            [[ $RUN_PERF == true ]] && perf=true
          fi
          {
            echo "run-heavy=$heavy"
            echo "run-os=$os"
            echo "run-hosts=$hosts"
            echo "run-perf=$perf"
          } >>"$GITHUB_OUTPUT"
          echo "run-heavy=$heavy run-os=$os run-hosts=$hosts run-perf=$perf (event=$EVENT)"

      # The Linux, Windows and macOS test matrices come from the same manifest
      # the partition jobs select their targets from, so a partition cannot
      # exist without a job or a job without a partition.
      - uses: actions/checkout@v7
        with:
          sparse-checkout: |
            .github/linux-test-partitions.json
            scripts
          sparse-checkout-cone-mode: false

      - name: Derive the Linux test matrix
        id: linux-partitions
        run: echo "matrix=$(python3 scripts/linux-test-partitions.py matrix)" >> "$GITHUB_OUTPUT"

      - name: Derive the Windows test matrix
        id: windows-partitions
        run: echo "matrix=$(python3 scripts/linux-test-partitions.py windows-matrix)" >> "$GITHUB_OUTPUT"

      - name: Derive the macOS test matrix
        id: macos-groups
        run: echo "matrix=$(python3 scripts/linux-test-partitions.py macos-matrix)" >> "$GITHUB_OUTPUT"

  # One dev-profile `tracedecay` binary for the explicitly requested stock
  # host integrations. Ordinary Linux validation needs no CLI artifact, so
  # this build is absent unless `run_hosts=true`.
  debug-cli:
    name: Build debug CLI
    needs: scope-gate
    if: ${{ needs.scope-gate.outputs.run-hosts == 'true' }}
    runs-on: ubuntu-24.04-arm
    timeout-minutes: 45
    steps:
      - uses: actions/checkout@v7

      - uses: dtolnay/rust-toolchain@stable

      - uses: ./.github/actions/setup-linux-mold

      - uses: ./.github/actions/setup-pnpm

      # This is the workflow's only dev-profile build, so `ci-dev-*` has one
      # writer. rust-cache stores dependency artifacts only. The repository
      # cache is capped at 10 GB and was full of per-job copies of the same
      # dependencies (`pr-dogfood` and `dashboard` each built this graph too),
      # which evicted the test lanes' caches between runs and made every test
      # run a cold build. Only the lockfile-keyed dependency cache is kept:
      # the workspace crates are exactly what a push changes, so caching
      # their outputs per run re-saved ~1 GB per push for a restore that hit
      # nothing.
      - name: Cache Rust build outputs
        uses: Swatinem/rust-cache@v2
        with:
          shared-key: ci-dev-${{ runner.os }}-${{ runner.arch }}
          cache-on-failure: true

      - name: Build tracedecay binary
        run: cargo build -p tracedecay-cli --bin tracedecay --locked

      - name: Publish the binary for the host integration jobs
        uses: actions/upload-artifact@v4
        with:
          name: debug-tracedecay-cli
          path: target/debug/tracedecay
          if-no-files-found: error
          retention-days: 1

  benchmark-harness:
    name: Benchmark harness self-tests
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@v7

      # The runtime benchmark harness produces the evidence PRs cite; its own
      # unit tests only count if something runs them.
      - name: Test the runtime benchmark harness
        working-directory: benchmark_data/runtime
        run: python3 -m unittest discover -s tests -p 'test_*.py'

  # The cheap repository gates in one job: commit lint, cache lineage, the
  # release guards, and rustfmt. Each used to hold its own ubuntu-latest
  # runner for a couple of minutes of work; on 20 free slots that is three
  # queue entries per push doing what one does.
  gates:
    name: Repository gates
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0

      - uses: actions/setup-node@v4
        with:
          node-version: 22

      - uses: ./.github/actions/setup-pnpm

      - name: Reject tracked ignored files
        run: scripts/check-release-pr-integrity.sh HEAD HEAD

      - name: Test bounded commit range linting
        run: python3 scripts/test-lint-commit-range.py

      - name: Test worktree GC classification and build reclamation
        run: python3 scripts/test-worktree-gc.py

      - name: Check Rust cache key lineage and the superseded-entry selection
        run: |
          python3 scripts/test-prune-superseded-actions-caches.py
          python3 scripts/test-rust-cache-lineage.py
          python3 scripts/check-rust-cache-lineage.py

      # Packager unit tests. They do not need a release binary, so they run
      # once here instead of once per release matrix target.
      - name: Test release packagers
        run: |
          python3 scripts/test-check-packaged-lsp-bridge.py
          python3 scripts/test-build-mcpb.py
          python3 scripts/test-resolve-installed-binary.py
          python3 scripts/test-check-packaged-mcp-stdio.py
          python3 scripts/test-check-distribution-feature-wiring.py
          python3 scripts/test-resolve-release-source-profile.py
          python3 scripts/test-package-release-archive.py
          python3 scripts/test-plan-release-recovery.py
          python3 scripts/test-check-release-artifacts.py
          python3 scripts/test-neutralize-release-pr-closing-keywords.py
          bash scripts/test-check-distribution-clean-source.sh
          bash scripts/test-check-distribution-snapshot.sh
          bash scripts/test-check-distribution-reuse.sh
          bash tests/macos_stable_codesign_test.sh

      # Release guards: drift, safety, installer, PR integrity, bundle check.
      # Pull requests only; the release PR itself is exempt because it is
      # the one change allowed to move the version authorities.
      - name: Check the release guards
        if: github.event_name == 'workflow_dispatch'
        run: |
          bash tests/release_drift_check_test.sh
          bash tests/release_safety_test.sh
          bash tests/install_script_test.sh
          bash tests/release_pr_integrity_test.sh
          bash tests/dashboard_bundle_check_test.sh

      # Judge formatting with the toolchain `rust-toolchain.toml` pins, not
      # whatever `stable` is on the runner: rustfmt's output changes between
      # releases (1.98.1 breaks a chain 1.97.1 keeps inline), and
      # `dtolnay/rust-toolchain@stable` exports `RUSTUP_TOOLCHAIN`, which
      # overrides the file. Installing through rustup with no override keeps
      # the pin in one place.
      - name: Install the repository's pinned toolchain
        run: rustup show active-toolchain || rustup toolchain install
      - name: Check formatting
        run: cargo fmt --all -- --check

      - name: Test and check dev skill host copies
        run: |
          python3 scripts/test-check-dev-skill-mirrors.py
          python3 scripts/check-dev-skill-mirrors.py check

      # Dispatch admits an integration branch. Judge the commits a merge onto
      # the default branch would introduce, with the same linter a push uses.
      # A push still uses the before SHA, so published history is not rejudged.
      - name: Validate commit messages
        if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'
        env:
          EVENT_NAME: ${{ github.event_name }}
          BEFORE_SHA: ${{ github.event.before }}
          HEAD_SHA: ${{ github.sha }}
          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
        run: scripts/lint-ci-commits.sh

  macos-test-partition:
    name: Test macOS ${{ matrix.group }}
    needs: scope-gate
    if: ${{ needs.scope-gate.outputs.run-os == 'true' }}
    runs-on: macos-14
    # Each group's budget is set in the manifest beside the group, with the
    # measurement it rests on.
    timeout-minutes: ${{ matrix.timeout }}
    # Re-signs the product after release strip (see .cargo/config.toml).
    env:
      CARGO_BUILD_RUSTC_WORKSPACE_WRAPPER: ${{ github.workspace }}/scripts/macos-rustc-wrapper.sh
    strategy:
      fail-fast: false
      matrix: ${{ fromJSON(needs.scope-gate.outputs.macos-groups) }}
    steps:
      # Full history: the search-quality workload fixture pins a
      # `source_repository_commit`, and `validate_source_bindings` resolves that
      # object out of this checkout to prove the checked-in corpus really is the
      # product source at that commit. A depth-1 checkout carries only the tip,
      # so every candidate_output/report test fails with "resolve fixture source
      # commit: An object with id ... could not be found".
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0

      # `rust-analyzer` is a test dependency of this lane, not a convenience.
      # `runtime_surface_acceptance::production_lsp_negotiates_and_projects_\
      # canonical_context` asserts that a routed analyzer negotiates the
      # standard methods the client declared, and the upstream `initialize`
      # response is the only authority for those. Without the component the
      # runner still has rustup's `rust-analyzer` proxy on PATH, so the daemon
      # routes the language and only the spawn fails. The test would then
      # measure a missing component instead of the negotiation contract. This
      # action exports `RUSTUP_TOOLCHAIN`, so the component has to be installed
      # here rather than through `rust-toolchain.toml`, which it overrides.
      - uses: dtolnay/rust-toolchain@stable
        with:
          components: rust-analyzer

      - uses: actions/setup-node@v4
        with:
          node-version: 22

      - uses: ./.github/actions/setup-pnpm

      - uses: actions/setup-python@v6
        with:
          python-version: "3.12"

      - name: Install ast-grep
        uses: ./.github/actions/install-ast-grep
        with:
          version: ${{ env.AST_GREP_VERSION }}

      - name: Install cargo-nextest
        uses: taiki-e/install-action@nextest

      # rust-cache carries the dependency graph, keyed by toolchain and
      # lockfile; the workspace crates compile fresh every run. No per-run
      # compiler store: the perf-profile test graph wrote 15.7 GB of outputs
      # per build on macOS, which no store inside the repository's 10 GB
      # cache budget can hold. One writer keeps the lane at one entry:
      # `root-suites` resolves the widest root graph (the root crate with
      # its dev-dependencies, the CLI and the evaluator), so its save covers
      # `root-lib` and the `root-transport` group exactly (test-transport
      # re-resolves 31 workspace crates but no dependency unit). The lower
      # partitions unify the dependencies differently and recompile ~100-200
      # units against it, which costs nothing measurable here: `runtime`
      # compiled in 28.5-29.6 min with every one of its 604 dependency units
      # built from source and in 29.5 with a full-match cache of its own
      # (runs 36087768140 and 36095356282), because on three cores the
      # serial workspace chain plus the test targets are the whole path and
      # the dependency units fill the slots beside it. A lineage for them
      # was tried and removed on that evidence. Crate sources come from the
      # pnpm store that setup-pnpm restores, not from this cache.
      - name: Cache Rust build outputs
        uses: Swatinem/rust-cache@v2
        with:
          shared-key: ci-test-full-${{ runner.os }}
          save-if: ${{ matrix.group == 'root-suites' }}
          cache-on-failure: true

      # Every group job re-proves the cover and the grouping before it
      # compiles anything: a gap found here fails the lane rather than passing
      # it with a target nobody ran.
      - name: Check the partitions cover every test target
        run: |
          python3 scripts/test-linux-test-partitions.py
          python3 scripts/linux-test-partitions.py check

      # Each partition in turn, as `linux-test-partition` runs it: the
      # executables its suites spawn are built into the same resolution first
      # (`build-args`; nothing for a partition whose tests spawn nothing),
      # then nextest under the `ci` policy and the perf cargo profile with
      # `--no-tests=fail`. One target directory for the group, so a later
      # partition's shared units are fingerprint hits; the manifest pairs
      # partitions of one resolution where they exist (run 36051245663 had
      # `root-transport` re-resolve 31 workspace crates behind
      # `root-journeys`, 18 min on three cores, and `root-dashboard-api` as
      # a lone `-p tracedecay` selection recompile 48 workspace crates and
      # 108 dependency units, 24 min, because the CLI's clap graph changes
      # `mio`'s features and so tokio's and every crate above it) and
      # otherwise balances the sums of the measured partition costs, since
      # a group's wall time is that sum. Every partition runs
      # even after an earlier one fails, as nextest's `ci` policy runs every
      # test, and the step fails if any did. Every nextest run rewrites the
      # `ci` profile's junit.xml, so each partition's report is moved under
      # its own name before the next runs. The per-partition wall times this
      # prints are the measurements the manifest's macOS budgets wait for.
      - name: Run the group's partitions
        env:
          PARTITIONS: ${{ matrix.partitions }}
        run: |
          set -uo pipefail
          run_partition() {
            local partition="$1" build selection
            build="$(python3 scripts/linux-test-partitions.py build-args "$partition")" || return 1
            selection="$(python3 scripts/linux-test-partitions.py cargo-args "$partition")" || return 1
            if [ -n "$build" ]; then
              eval cargo build --locked --profile perf "$build" || return 1
            fi
            eval cargo nextest run --profile ci --cargo-profile perf --locked "$selection" --no-tests=fail
          }
          read -ra partitions <<< "$PARTITIONS"
          mkdir -p target/nextest/macos
          failed=""
          for partition in "${partitions[@]}"; do
            echo "::group::Test partition ${partition}"
            started=$SECONDS
            if run_partition "$partition"; then
              echo "${partition}: passed in $(( SECONDS - started )) s"
            else
              failed="${failed} ${partition}"
              echo "${partition}: failed after $(( SECONDS - started )) s"
            fi
            [ ! -f target/nextest/ci/junit.xml ] || mv target/nextest/ci/junit.xml "target/nextest/macos/${partition}.xml"
            echo "::endgroup::"
          done
          if [ -n "$failed" ]; then
            echo "::error::Failed partitions:${failed}"
            exit 1
          fi

      # `macos-test` folds the group reports back into one report.
      - name: Upload macOS group nextest report
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: nextest-junit-macOS-${{ matrix.group }}
          path: target/nextest/macos/
          if-no-files-found: ignore
          retention-days: 1

  # The one `Test macOS` verdict, as when a single job carried the suite:
  # every group must pass. It also folds the group reports back into the
  # `nextest-junit-macOS` artifact the single job published, one directory
  # per group holding a junit.xml per partition.
  macos-test:
    name: Test macOS
    if: ${{ !cancelled() && needs.scope-gate.outputs.run-os == 'true' }}
    needs: [macos-test-partition, scope-gate]
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - name: Merge the group reports into the macOS nextest report
        if: ${{ needs.macos-test-partition.result != 'skipped' }}
        uses: actions/upload-artifact/merge@v4
        with:
          name: nextest-junit-macOS
          pattern: nextest-junit-macOS-*
          separate-directories: true
          retention-days: 7

      - name: Check macOS groups
        if: ${{ !cancelled() }}
        run: |
          if [ "${{ needs.macos-test-partition.result }}" != "success" ]; then
            echo "macOS group result: ${{ needs.macos-test-partition.result }}"
            exit 1
          fi
          echo "All macOS groups passed."

  # Linux compiles and runs the suite as parallel partitions of the test
  # targets (.github/linux-test-partitions.json), one hosted 4-vCPU job each,
  # so the lane's wall time is the slowest partition instead of the whole
  # workspace. The single job that preceded it (run 34278967966, warm
  # dependency cache, four compile slots) spent 55.5 min compiling: 32 min of
  # workspace libraries beneath the root crate, then the root library
  # (~8 min) and its library test target (~15.5 min), a serial chain that no
  # job count shortens; the other 300-odd test units fit in the slots beside
  # it. Tests then took 22.5 min, the dashboard's `test-transport` rebuild
  # and run 11 min, and the hotpath parity rebuild ~16 min. Partitioned, the
  # root chain is one job (`root-lib`: 19.7 min compile + 5.2 min tests, 25.9
  # min in run 34296614024, the first partitioned run) while every other
  # partition finishes in 17–27 min, so the lane's critical path drops from
  # ~105 min to the slowest partition; the parity rebuild runs beside the
  # partitions as `hotpath-parity` rather than after the root chain. Building
  # the graph once and sharding only the test execution (the Windows lane's
  # shape) keeps the whole 55 min compile plus an archive round trip on the
  # path and then the dashboard rebuild and parity on the same job: ~88 min,
  # or ~70 with both moved elsewhere. The partitions pay for the shorter path
  # with duplicated compile. Each root partition rebuilds the library chain
  # beneath the root crate, about 200 core-minutes per run across the seven
  # jobs, which is free on hosted runners where only wall time and the
  # 20-job concurrency cap count. A cold dependency cache adds ~6 min to every
  # job alike (the dependencies compile at opt-level 0 in ~17 core-minutes).
  # The floor no partitioning reaches is the root chain itself: library
  # chain + root lib + root lib-test + its tests, the ~26 min above.
  #
  # The partitions are cargo selections, not nextest filters: `-p` plus
  # `--lib` / `--test <name>` / `--bins` decide what compiles, and a filterset
  # would compile everything and skip at run time. The three root partitions
  # share one package selection (`tracedecay`, `tracedecay-cli`,
  # `tracedecay-search-eval`) with the root fixture feature. Journeys also
  # enable `tracedecay/search-eval`, the only link from the root crate to the
  # evaluator library. It stays off every other partition: an unconditional
  # dependency links the evaluator into every test target of the package.
  # Every cargo invocation inside a job (the test build,
  # the executables the suites spawn) is a cache hit against that job's
  # resolution. `scripts/linux-test-partitions.py check` proves, from `cargo
  # metadata`, that every test target in the workspace is selected by exactly
  # one partition or listed under `not_run` with a reason, so a new crate or
  # suite cannot fall out of the lane silently; `scope-gate` derives the
  # matrix from the same manifest.
  linux-test-partition:
    name: Test Linux ${{ matrix.partition }}
    needs: scope-gate
    if: ${{ needs.scope-gate.outputs.run-heavy == 'true' }}
    runs-on: ubuntu-24.04-arm
    # Each partition's budget is its measured wall time plus headroom, set in
    # the manifest beside the selection it covers.
    timeout-minutes: ${{ matrix.timeout }}
    strategy:
      fail-fast: false
      matrix: ${{ fromJSON(needs.scope-gate.outputs.linux-partitions) }}
    steps:
      # Full history: the search-quality workload fixture pins a
      # `source_repository_commit`, and `validate_source_bindings` resolves that
      # object out of this checkout to prove the checked-in corpus really is the
      # product source at that commit. A depth-1 checkout carries only the tip,
      # so every candidate_output/report test fails with "resolve fixture source
      # commit: An object with id ... could not be found".
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0

      # `rust-analyzer` is a test dependency of this lane, not a convenience.
      # `runtime_surface_acceptance::production_lsp_negotiates_and_projects_\
      # canonical_context` asserts that a routed analyzer negotiates the
      # standard methods the client declared, and the upstream `initialize`
      # response is the only authority for those. Without the component the
      # runner still has rustup's `rust-analyzer` proxy on PATH, so the daemon
      # routes the language and only the spawn fails. The test would then
      # measure a missing component instead of the negotiation contract. This
      # action exports `RUSTUP_TOOLCHAIN`, so the component has to be installed
      # here rather than through `rust-toolchain.toml`, which it overrides.
      - uses: dtolnay/rust-toolchain@stable
        with:
          components: rust-analyzer

      - uses: ./.github/actions/setup-linux-mold

      - uses: actions/setup-node@v4
        with:
          node-version: 22

      - uses: ./.github/actions/setup-pnpm

      - uses: actions/setup-python@v6
        with:
          python-version: "3.12"

      - name: Install ast-grep
        uses: ./.github/actions/install-ast-grep
        with:
          version: ${{ env.AST_GREP_VERSION }}

      - name: Install cargo-nextest
        uses: taiki-e/install-action@nextest

      # One dependency cache for the lane, as before the split. rust-cache
      # stores the dependency graph only, keyed by toolchain and lockfile; the
      # workspace crates compile fresh every run. A single writer keeps the
      # lane at one entry in the repository's 10 GB cache: `root-journeys`
      # resolves the widest graph (the root crate with its dev-dependencies,
      # the CLI and the evaluator), so its save covers the other root
      # partitions exactly (`root-dashboard-api` selects the CLI package for
      # that reason: alone, `-p tracedecay` resolves `mio` without the
      # features the CLI's clap graph adds, so tokio and every workspace
      # crate above it hash differently). The three lower partitions unify
      # dependency features differently and each recompile ~150 dependency
      # units (syn, serde_json, tokio, gix-*, grafeo-*, ...) against it every
      # run, measured in run 36051245663: 4-6 min beside chains that end
      # 4-12 min before `root-transport` does, cheaper than three more cache
      # entries in the 10 GB budget (macOS, where the same recompile is 2.5x
      # longer and on the lane's critical path, carries one). Crate sources
      # come from the pnpm store that setup-pnpm restores, not from this cache.
      - name: Cache Rust build outputs
        uses: Swatinem/rust-cache@v2
        with:
          shared-key: ci-test-full-Linux-${{ runner.arch }}
          save-if: ${{ matrix.partition == 'root-journeys' }}
          cache-on-failure: true

      # Every partition job re-proves the cover before it compiles anything:
      # the manifest is consumed here, and a gap found here fails the lane
      # rather than passing it with a target nobody ran.
      - name: Check the partitions cover every test target
        run: |
          python3 scripts/test-linux-test-partitions.py
          python3 scripts/linux-test-partitions.py check

      - name: Resolve this partition's cargo selection
        id: selection
        run: |
          {
            echo "test=$(python3 scripts/linux-test-partitions.py cargo-args '${{ matrix.partition }}')"
            echo "build=$(python3 scripts/linux-test-partitions.py build-args '${{ matrix.partition }}')"
          } >> "$GITHUB_OUTPUT"

      # Suites that spawn the CLI (`tests/common::tracedecay_bin`) or the
      # search-eval evaluators (`search_eval_bin`) resolve them out of the
      # profile directory, and cargo links a package's bins for a test build
      # only when that package's own integration tests are selected. This
      # builds the partition's selection plus those executables in one
      # resolution: the test targets keep dev-dependencies in the graph, so
      # the nextest build below is a cache hit, and the selection includes
      # `tracedecay-search-eval` so the evaluator resolves
      # `tracedecay-code-index` with its language tiers (a lone
      # `-p tracedecay-search-eval` build yields one that cannot parse Rust).
      # The `tracedecay-host-cli-fixture` example is the host fixture the CLI
      # suites drive. Partitions whose tests spawn nothing skip this.
      - name: Build the executables the suites spawn
        if: ${{ steps.selection.outputs.build != '' }}
        run: cargo build --locked --profile perf ${{ steps.selection.outputs.build }}

      # nextest `ci` policy (.config/nextest.toml: fail-fast off, one retry
      # that still fails flaky results, 8 threads, slow-timeout termination)
      # and the perf cargo profile, as `cargo test-ci`; the selection replaces
      # the alias's `--workspace`. `--no-tests=fail` so a selection that
      # resolves to nothing cannot report green.
      - name: Run tests
        run: cargo nextest run --profile ci --cargo-profile perf --locked ${{ steps.selection.outputs.test }} --no-tests=fail

      # `linux-test` folds the partition reports back into one report.
      - name: Upload Linux partition nextest report
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: nextest-junit-Linux-${{ matrix.partition }}
          path: target/nextest/ci/junit.xml
          if-no-files-found: ignore
          retention-days: 1

  # The controlled-workload hotpath parity gate: `tracedecay-search-eval`'s
  # `emit_controlled_workload_reports` example, built once with the hotpath
  # profiler compiled out and once with `controlled-workload-hotpath`
  # (`hotpath/hotpath`) on, must produce byte-identical durable results for
  # the framed-log (private-fs) and cursor-parse (capture) workloads, from
  # provably distinct executables. `scripts/build-controlled-workload-
  # hotpath-helpers.py` builds the pair into target/controlled-workload-
  # hotpath/, and the `#[ignore]`d test in the crate's library test target
  # (`controlled_workloads::tests::hotpath_off_vs_on_durable_results_are_
  # identical`) spawns them from there; `--run-ignored only` with
  # `--no-tests=fail` is the only way it runs, and nothing else. No
  # partition, artifact upload or junit merge consumes the executables.
  #
  # Its own job rather than a tail on the `root-lib` partition, where it ran
  # after the root library's tests: the feature-on build recompiles every
  # workspace crate beneath the evaluator (all 21 depend on `hotpath`, so
  # the feature flip changes each one's metadata hash) plus the example,
  # ~10 min on top of the ~26 min root chain, which made that job the lane's
  # critical path. Here the graph beneath the evaluator compiles from the
  # checkout in both modes. A serial chain domain → contracts →
  # rusqlite-runtime → runtime-core → code-index → sessions → query →
  # search-eval → example of ~9 min per mode with four compile slots (cargo
  # `--timings`, -j4 on EPYC 7742 cores; the same pair of builds took 19.5
  # min on a hosted runner in run 34138693824, when the single-job lane
  # still built them as their own resolution). Then the library test target
  # (24 s against the feature-off graph) and the test itself (under 1 s).
  # With setup, ~24 min hosted: beside the partitions and no longer than the
  # slowest of them (25.9 and 27.4 min in run 34296614024), so the `Test
  # Linux` verdict no longer waits for it. The property does not depend on
  # the platform (the Windows lane never provisioned it for that reason), so
  # a Linux runner carries it.
  #
  # Not a job in hotpath-coverage.yml: that workflow is path-filtered to
  # Rust inputs and never runs on `push`, while this is a gate on every pull
  # request head, and its feature-on slices (storage, sessions) do not cover
  # the query/code-index/runtime-core graph the evaluator needs; rust-cache
  # keeps dependency artifacts only, so no other job's compiled workspace
  # crates could be reused anyway. The evaluator alone (`-p
  # tracedecay-search-eval`) is the selection: the root partitions' wider
  # one would turn every language tier on in `tracedecay-code-extraction`
  # and `-code-index` for two builds that parse no source, and carry the root
  # fixture feature for a crate this job never compiles. No cache: under
  # this selection ~160 of the 420 registry crates (`syn`, `serde_core`,
  # `tokio` and their dependents) unify differently from the lane's
  # `ci-test-full-Linux` graph and would miss it, and the rest compile in
  # the slots the serial chain leaves idle (the cold build measured 8.8 min
  # against 9.1 for the warm feature-on one), so a restore
  # would buy about what it costs, while another lineage would compete for
  # the 10 GB budget the test lanes' dependency caches are already evicted
  # from.
  hotpath-parity:
    name: Hotpath parity
    needs: scope-gate
    if: ${{ needs.scope-gate.outputs.run-perf == 'true' }}
    runs-on: ubuntu-24.04-arm
    # 19.5 min for the two builds (hosted, above) + ~1.5 cold registry the
    # chain does not hide + ~1.5 setup + 0.5 test target + 0.5 run ≈ 24 min,
    # plus 25 % headroom, as for the partition budgets.
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@v7

      - uses: dtolnay/rust-toolchain@stable

      - uses: ./.github/actions/setup-linux-mold

      - uses: ./.github/actions/setup-pnpm

      - name: Install cargo-nextest
        uses: taiki-e/install-action@nextest

      # Both modes under the evaluator's own selection; the helper copies
      # each result out of target/perf/examples immediately so the second
      # resolution cannot replace the first.
      - name: Build controlled-workload hotpath parity executables
        run: python3 scripts/build-controlled-workload-hotpath-helpers.py --profile perf

      # The library test target resolves the same feature-off graph as the
      # first build above, so only the test target itself compiles here.
      # nextest `ci` policy and the perf cargo profile, as the partitions.
      - name: Verify controlled-workload hotpath parity
        run: |
          cargo nextest run --profile ci --cargo-profile perf --locked -p tracedecay-search-eval --lib \
            --run-ignored only \
            -E 'test(=controlled_workloads::tests::hotpath_off_vs_on_durable_results_are_identical)' \
            --no-tests=fail

  # The one `Test Linux` verdict, as when a single job carried the suite:
  # every partition and the hotpath parity gate must pass. It also folds the
  # partition reports back into the `nextest-junit-Linux` artifact the single
  # job published; the parity verdict is its step's exit status, as it was
  # inside the partition, and is not part of that report.
  linux-test:
    name: Test Linux
    if: ${{ !cancelled() && needs.scope-gate.outputs.run-heavy == 'true' }}
    needs: [linux-test-partition, hotpath-parity, scope-gate]
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      # Each partition's junit.xml keeps its name under its partition's
      # directory; the partition artifacts themselves expire after a day.
      - name: Merge the partition reports into the Linux nextest report
        if: ${{ needs.linux-test-partition.result != 'skipped' }}
        uses: actions/upload-artifact/merge@v4
        with:
          name: nextest-junit-Linux
          pattern: nextest-junit-Linux-*
          separate-directories: true
          retention-days: 7

      - name: Check Linux partitions and hotpath parity
        if: ${{ !cancelled() }}
        run: |
          if [ "${{ needs.linux-test-partition.result }}" != "success" ]; then
            echo "Linux partition result: ${{ needs.linux-test-partition.result }}"
            exit 1
          fi
          if [ "${{ needs.hotpath-parity.result }}" != "success" ] && [ "${{ needs.hotpath-parity.result }}" != "skipped" ]; then
            echo "Hotpath parity result: ${{ needs.hotpath-parity.result }}"
            exit 1
          fi
          echo "All Linux partitions and the hotpath parity gate passed."

  # Optional cross-test isolation proof. The partition lane cannot expose
  # authorities leaked between targets that it runs in separate jobs. Keep
  # the evaluator and transport resolutions separate: the transport surface
  # includes a generation-scale cancellation journey whose bounded receipts
  # assume it is not competing with the entire workspace. Each compatible
  # selection still shares one nextest process across all of its targets.
  # Keep this off ordinary pushes and run it after the normal Linux verdict so
  # its extra compilation and eight concurrent tests do not crowd that lane.
  linux-full-nextest:
    name: Test Linux full selection isolation
    needs: linux-test
    if: ${{ !cancelled() && needs.linux-test.result != 'skipped' && github.event_name == 'workflow_dispatch' && inputs.run_full_nextest }}
    runs-on: ubuntu-24.04-arm
    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0

      - name: Verify pinned Rust toolchain and analyzer
        run: |
          rustup show active-toolchain
          rustup which rust-analyzer
          rust-analyzer --version

      - uses: ./.github/actions/setup-linux-mold

      - uses: actions/setup-node@v4
        with:
          node-version: 22

      - uses: ./.github/actions/setup-pnpm

      - uses: actions/setup-python@v6
        with:
          python-version: "3.12"

      - name: Install ast-grep
        uses: ./.github/actions/install-ast-grep
        with:
          version: ${{ env.AST_GREP_VERSION }}

      - name: Install cargo-nextest
        uses: taiki-e/install-action@nextest

      # Build the evaluator selection and the executables its journeys spawn
      # with the same feature set and perf resolution nextest uses below.
      - name: Build full evaluator selection and support executables
        run: cargo build --workspace --bins --tests --example tracedecay-host-cli-fixture --locked --profile perf --features tracedecay/test-helpers,tracedecay/search-eval

      - name: Run full evaluator selection
        run: |
          set +e
          cargo test-ci --locked --no-tests=fail
          status=$?
          set -e
          if [ -f target/nextest/ci/junit.xml ]; then
            mv target/nextest/ci/junit.xml target/nextest/ci/full-evaluator.xml
          fi
          exit "$status"

      # Transport-only modules live inside otherwise ordinary root targets, so
      # run every root library, binary, and integration target in one process.
      # The evaluator selection above already covers the remaining workspace
      # crates without implicitly linking evaluator code into this resolution.
      - name: Build full transport selection and support executables
        id: transport_build
        if: ${{ always() && !cancelled() }}
        run: cargo build -p tracedecay -p tracedecay-cli --bins --tests --example tracedecay-host-cli-fixture --locked --profile perf --features tracedecay/test-helpers,tracedecay/test-transport,tracedecay-cli/test-transport

      - name: Run full transport selection
        if: ${{ always() && !cancelled() && steps.transport_build.outcome == 'success' }}
        run: |
          set +e
          cargo nextest run -p tracedecay -p tracedecay-cli --bins --tests --profile ci --cargo-profile perf --locked --features tracedecay/test-helpers,tracedecay/test-transport,tracedecay-cli/test-transport --no-tests=fail
          status=$?
          set -e
          if [ -f target/nextest/ci/junit.xml ]; then
            mv target/nextest/ci/junit.xml target/nextest/ci/full-transport.xml
          fi
          exit "$status"

      - name: Upload full-selection nextest reports
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: nextest-junit-Linux-full-selections
          path: target/nextest/ci/full-*.xml
          if-no-files-found: ignore
          retention-days: 7

  # Windows compiles and runs the suite as the same partitions as Linux, one
  # hosted 4-vCPU `windows-latest` job each. The lane that preceded it built
  # every test of the workspace in one job and sharded only the execution
  # from a nextest archive: in run 36051245663 (warm dependency cache, full
  # match) that build spent 27 min compiling the library chain beneath the
  # root crate and then 67 min on the root crate's library and its ~40 test
  # targets alone, 94 min of `cargo build` plus 5 of archive in a job that
  # nothing could shorten, then the five shards ran 10-14 min each: 116 min
  # for the lane's verdict, against 27 for Linux. As partitions each job pays
  # the chain and its own selection's test targets, as `linux-test-partition`
  # does, so the lane's wall time is the slowest partition: 66.5 min in run
  # 36077289779 (`runtime`: 25 min of library chain with its dependency
  # units beside it, 23 min of 31 test targets, 15 min of tests; the root
  # partitions compile 35-38 min each). The manifest's
  # `windows_timeout_minutes` are the budgets; the executables the suites
  # spawn are built into the same resolution first, as on Linux.
  windows-test-partition:
    name: Test Windows ${{ matrix.partition }}
    needs: scope-gate
    if: ${{ needs.scope-gate.outputs.run-os == 'true' }}
    runs-on: windows-latest
    timeout-minutes: ${{ matrix.timeout }}
    strategy:
      fail-fast: false
      matrix: ${{ fromJSON(needs.scope-gate.outputs.windows-partitions) }}
    steps:
      # Full history for the same reason as the Linux and macOS partition
      # jobs: the pinned search-quality fixture commit must be resolvable here.
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0

      - name: Tune Windows runner for build and test I/O
        uses: ./.github/actions/tune-windows-runner
        with:
          redirect-temp: "true"

      # Install only the toolchain pinned by rust-toolchain.toml, with the
      # components it lists (`rust-analyzer` is a test dependency of the LSP
      # negotiation acceptance). Installing `stable` as well makes
      # Swatinem/rust-cache include an unused compiler in its environment
      # key, fragmenting the cache whenever stable moves. The architecture
      # tests exec `cargo metadata` at runtime under nextest, so the install
      # has to be serial and up front: concurrent rustup shims racing to
      # self-install corrupt each other's partial downloads.
      - name: Install pinned toolchain
        shell: pwsh
        run: |
          rustup toolchain install
          rustup show active-toolchain

      - name: Use lld-link linker
        shell: pwsh
        run: |
          where.exe lld-link.exe
          lld-link.exe --version
          "CARGO_TARGET_X86_64_PC_WINDOWS_MSVC_LINKER=lld-link.exe" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append

      # Node so build.rs can produce the embedded dashboard dist assets for
      # the partitions that compile the CLI.
      - uses: actions/setup-node@v4
        with:
          node-version: 22

      - uses: ./.github/actions/setup-pnpm

      - uses: actions/setup-python@v6
        with:
          python-version: "3.12"

      - name: Install ast-grep
        uses: ./.github/actions/install-ast-grep
        with:
          version: ${{ env.AST_GREP_VERSION }}

      - name: Install cargo-nextest
        uses: taiki-e/install-action@nextest

      # One dependency cache for the lane, as on Linux: `root-journeys`
      # resolves the widest graph, so its save covers the other root
      # partitions; the lower partitions recompile the dependency units they
      # unify differently, beside their shorter chains.
      - name: Cache Windows Rust build outputs
        uses: Swatinem/rust-cache@v2
        with:
          shared-key: ci-test-full-windows-msvc-lld
          save-if: ${{ matrix.partition == 'root-journeys' }}
          cache-on-failure: true

      # Every partition job re-proves the cover before it compiles anything,
      # as on Linux.
      - name: Check the partitions cover every test target
        shell: bash
        run: |
          python scripts/test-linux-test-partitions.py
          python scripts/linux-test-partitions.py check

      - name: Resolve this partition's cargo selection
        id: selection
        shell: bash
        run: |
          {
            echo "test=$(python scripts/linux-test-partitions.py cargo-args '${{ matrix.partition }}')"
            echo "build=$(python scripts/linux-test-partitions.py build-args '${{ matrix.partition }}')"
          } >> "$GITHUB_OUTPUT"

      # The CLI and evaluator executables the suites spawn, in the same
      # resolution as the test build below (see `linux-test-partition`); the
      # test resolvers find them beside the test executables under
      # target/perf, so no override or preflight is needed.
      - name: Build the executables the suites spawn
        if: ${{ steps.selection.outputs.build != '' }}
        shell: bash
        run: cargo build --locked --profile perf ${{ steps.selection.outputs.build }}

      # nextest `ci` policy and the perf cargo profile, as on Linux;
      # `--test-threads num-cpus` as the Windows shards ran, since the
      # Windows test groups in .config/nextest.toml are sized for it.
      - name: Run tests
        shell: bash
        run: cargo nextest run --profile ci --cargo-profile perf --locked ${{ steps.selection.outputs.test }} --no-tests=fail --test-threads num-cpus --status-level slow

      - name: Clean abandoned Windows test children
        if: always()
        shell: pwsh
        run: |
          $workspace = (Resolve-Path $env:GITHUB_WORKSPACE).Path
          $all = Get-CimInstance Win32_Process
          $liveProcessIds = [System.Collections.Generic.HashSet[uint32]]::new()
          foreach ($process in $all) {
            [void]$liveProcessIds.Add([uint32]$process.ProcessId)
          }
          $stale = foreach ($process in $all) {
            if ($process.Name -ne "tracedecay.exe") {
              continue
            }
            if (-not $process.CommandLine) {
              continue
            }
            $inCurrentWorkspace = $process.CommandLine.IndexOf($workspace, [StringComparison]::OrdinalIgnoreCase) -ge 0
            if (-not $inCurrentWorkspace) {
              continue
            }
            if (-not $liveProcessIds.Contains([uint32]$process.ParentProcessId)) {
              $process
            }
          }
          foreach ($process in $stale) {
            Write-Host "Stopping abandoned tracedecay child pid=$($process.ProcessId)"
            Stop-Process -Id $process.ProcessId -Force -ErrorAction SilentlyContinue
          }

      # `windows-test` folds the partition reports back into one report.
      - name: Upload Windows partition nextest report
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: nextest-junit-Windows-${{ matrix.partition }}
          path: target/nextest/ci/junit.xml
          if-no-files-found: ignore
          retention-days: 1

  # The one `Test Windows` verdict: every partition must pass. It also folds
  # the partition reports into the `nextest-junit-Windows` artifact, one
  # directory per partition, as `linux-test` does.
  windows-test:
    name: Test Windows
    if: ${{ !cancelled() && needs.scope-gate.outputs.run-os == 'true' }}
    needs: [windows-test-partition, scope-gate]
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - name: Merge the partition reports into the Windows nextest report
        if: ${{ needs.windows-test-partition.result != 'skipped' }}
        uses: actions/upload-artifact/merge@v4
        with:
          name: nextest-junit-Windows
          pattern: nextest-junit-Windows-*
          separate-directories: true
          retention-days: 7

      - name: Check Windows partitions
        if: ${{ !cancelled() }}
        run: |
          if [ "${{ needs.windows-test-partition.result }}" != "success" ]; then
            echo "Windows partition result: ${{ needs.windows-test-partition.result }}"
            exit 1
          fi
          echo "All Windows partitions passed."

  clippy:
    name: Clippy
    needs: scope-gate
    if: ${{ needs.scope-gate.outputs.run-heavy == 'true' }}
    # The free 4-vCPU Arm runner (Cobalt 100), as a measured comparison
    # against the x64 `ubuntu-latest` this lane took 19 minutes on: same
    # workload, same cache shape, different core. Public repositories get it
    # at no cost; the result decides whether the partitioned test jobs move.
    runs-on: ubuntu-24.04-arm
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@v7

      - uses: dtolnay/rust-toolchain@stable
        with:
          components: clippy
          targets: x86_64-pc-windows-gnu

      - uses: ./.github/actions/setup-linux-mold

      - uses: ./.github/actions/setup-pnpm

      - name: Cache Rust build outputs
        uses: Swatinem/rust-cache@v2
        with:
          shared-key: ci-clippy-full-${{ runner.os }}-${{ runner.arch }}
          cache-on-failure: true

      - name: Run blocking Clippy policy
        run: cargo clippy --workspace --all-targets --locked -- -D warnings

      - name: Check lean build
        run: cargo check -p tracedecay --no-default-features --locked

      # Master pushes run no Windows lane, so `cfg(windows)` code otherwise
      # first compiles in the release build. `cargo check` needs no linker;
      # mingw supplies the C compiler the native build scripts run. macOS has
      # no equivalent: its build scripts need the Apple SDK headers.
      - name: Install the Windows C cross-compiler
        run: |
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends gcc-mingw-w64-x86-64

      - name: Check the Windows target
        run: >-
          cargo check --workspace --all-targets --locked
          --target x86_64-pc-windows-gnu
          --features tracedecay/test-transport,tracedecay/test-helpers,tracedecay-cli/test-transport

  # Compile-only gate for feature graphs beyond the default test-lane
  # selections. `test-transport` acceptance suites (`mcp_suite`,
  # `transport_acceptance_suite`, `host_journeys_suite`, `work_loop_journey`)
  # now run as the `root-transport` Linux partition; this job still
  # `cargo check`s the full `--features test-transport` / hotpath graphs so
  # non-selected targets cannot rot until release `--all-features`.
  #
  # Its own job, not a tail on the Linux build: these are dev-profile check
  # builds, a graph the perf-profile test lanes share nothing with, so there
  # is no compiled tree to reuse and nothing to gain from waiting for one.
  # As the last steps of the Linux test job they ran only after a green
  # suite, never once on this branch, and would have held the Linux shards
  # back by their own duration. Here the verdict lands independently at
  # about clippy's cost: the cold `cargo clippy --workspace --all-targets`
  # took 13.7 min (run 34231734416), the second check re-resolves only the
  # crates the hotpath features touch (clippy's lean re-check: 2.7 min).
  # Feature wiring does not vary by host, so one OS carries the gate. No
  # cache: it is off every lane's critical path, and another lineage would
  # compete for the 10 GB budget the test lanes' dependency caches are
  # already evicted from.
  feature-gates:
    name: Feature gates
    needs: scope-gate
    if: ${{ needs.scope-gate.outputs.run-heavy == 'true' }}
    runs-on: ubuntu-24.04-arm
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@v7

      - uses: dtolnay/rust-toolchain@stable

      - uses: ./.github/actions/setup-linux-mold

      - uses: ./.github/actions/setup-pnpm

      - name: Check feature-gated surfaces compile
        run: |
          cargo check --workspace --all-targets --features test-transport --locked
          cargo check --workspace --all-targets --features hotpath,hotpath-mcp --locked
          # Lights the hotpath backend without any crate's own hotpath feature.
          # The two lines above keep them in sync, which hides a type that
          # forks on the local feature while hotpath::io! expands on the backend.
          # It also carries tracedecay-hotpath-guard's live MCP proof, whose
          # required-features name these two dependency features. That guard is
          # a leaf and holds no backend feature of its own (see its manifest).
          cargo check --workspace --all-targets --features hotpath/hotpath,hotpath/hotpath-mcp --locked

      # One graph walk per push. The release resolver repeats it on the tag it
      # builds, since a release is dispatched without waiting on this run.
      - name: Check the production feature graph
        run: python3 scripts/check-production-feature-profile.py

  # The configuration users actually receive. `scripts/resolve-release-source-profile.py`
  # resolves the release build to `--no-default-features --features production`
  # on the release profile, and nothing on a push compiled it: `debug-cli` is a
  # dev-profile binary built only for the stock host integrations, and every
  # other lane runs the default feature graph. A break confined to the
  # `production` graph (the mimalloc allocator, the embedded dashboard, the
  # release profile itself) therefore first appeared while a release was being
  # cut, which is the most expensive place to find it.
  #
  # Compile plus a smoke run, on one target. The packaging battery that sits on
  # top of this binary (`cargo package`, the extracted-crate rebuild, MCPB, the
  # MCP stdio checks) stays in distribution-acceptance.yml, which is
  # dispatch-only and explicitly not a ship gate. This job does not repeat any
  # of it, and that workflow keeps its own cache lineage.
  shipped-cli:
    name: Shipped CLI build (x86_64-linux)
    needs: scope-gate
    if: ${{ needs.scope-gate.outputs.run-heavy == 'true' }}
    runs-on: ubuntu-latest
    timeout-minutes: 45
    env:
      TARGET: x86_64-unknown-linux-gnu
    steps:
      - uses: actions/checkout@v7

      - uses: actions/setup-node@v6
        with:
          node-version: "22"

      - uses: ./.github/actions/setup-pnpm

      # `production` embeds the dashboard, so the bundle has to exist before
      # cargo runs. Handing build.rs the digest of this bundle keeps the build
      # script from building the frontend a second time.
      - name: Build the embedded dashboard bundle
        working-directory: dashboard
        run: pnpm run build

      - name: Pin the embedded bundle for the skip-mode build
        shell: bash
        run: |
          set -euo pipefail
          digest="$(python3 scripts/check-dashboard-bundle.py dashboard/app-dist --print-digest)"
          echo "TRACEDECAY_SKIP_DASHBOARD_BUILD=1" >> "$GITHUB_ENV"
          echo "TRACEDECAY_DASHBOARD_BUNDLE_SHA256=${digest}" >> "$GITHUB_ENV"

      # rust-toolchain.toml, not floating stable: the release workflows build
      # this configuration with the pinned compiler, so a push gate on a
      # different one is not evidence about the same artifact.
      - name: Resolve pinned toolchain
        id: pin
        shell: bash
        run: |
          python3 -c 'import pathlib, tomllib; print("toolchain=" + tomllib.loads(pathlib.Path("rust-toolchain.toml").read_text(encoding="utf-8"))["toolchain"]["channel"])' >> "$GITHUB_OUTPUT"

      - uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # 1.97.1 pin
        with:
          toolchain: ${{ steps.pin.outputs.toolchain }}
          targets: ${{ env.TARGET }}

      - uses: ./.github/actions/setup-linux-mold

      # Dependencies only. The workspace crates are what a push changes, so
      # caching their release artifacts would re-save the tree every run for a
      # restore that hits nothing, against the repository's 10 GB budget that
      # the test lanes' caches are already evicted from.
      - name: Cache Rust build outputs
        uses: Swatinem/rust-cache@v2
        with:
          shared-key: ci-shipped-cli-${{ env.TARGET }}
          cache-workspace-crates: "false"
          cache-on-failure: true

      - name: Build the shipped binary
        shell: bash
        run: |
          cargo build --package tracedecay-cli --bin tracedecay --release \
            --target "$TARGET" --no-default-features --features production --locked

      - name: Smoke-run the shipped binary
        shell: bash
        run: |
          set -euo pipefail
          binary="target/${TARGET}/release/tracedecay"
          test -x "$binary"
          "$binary" --version
          "$binary" --help >/dev/null

  dashboard:
    name: Dashboard
    needs: scope-gate
    if: ${{ needs.scope-gate.outputs.run-heavy == 'true' }}
    runs-on: ubuntu-latest
    timeout-minutes: 25
    steps:
      - uses: actions/checkout@v7

      - uses: actions/setup-node@v6
        with:
          node-version: "22"

      - uses: ./.github/actions/setup-pnpm

      - name: Build dashboard assets
        working-directory: dashboard
        run: pnpm run build

      - name: Run dashboard unit tests
        working-directory: dashboard
        run: pnpm test

      # The dashboard is one rsbuild app emitting `app-dist/` (the legacy
      # shell/holographic/lcm/graph/savings bundle split no longer exists), so
      # the bundle validator is the artifact authority and the determinism
      # check hashes whatever the build actually produced.
      - name: Verify embedded dist artifacts
        working-directory: dashboard
        run: |
          set -euo pipefail
          python3 ../scripts/check-dashboard-bundle.py app-dist
          (cd app-dist && find . -type f | sort | xargs sha256sum) > /tmp/dashboard-dist.sha
          pnpm run build
          (cd app-dist && find . -type f | sort | xargs sha256sum) | diff /tmp/dashboard-dist.sha -

  hermes-integration:
    name: Hermes integration (stock)
    needs: [scope-gate, debug-cli]
    if: ${{ needs.scope-gate.outputs.run-hosts == 'true' }}
    runs-on: ubuntu-24.04-arm
    timeout-minutes: 30
    env:
      # Stock (upstream) Hermes pin. The generated plugin must keep working
      # against this exact upstream commit. Bump deliberately after rerunning
      # scripts/hermes_stock_integration.sh against the new ref locally.
      HERMES_UPSTREAM_REPO: https://github.com/NousResearch/hermes-agent.git
      HERMES_UPSTREAM_REF: 9dd9ef0ec99a87f078f7272b4323df5440b4b3f9
    steps:
      - uses: actions/checkout@v7

      - name: Install ast-grep
        uses: ./.github/actions/install-ast-grep
        with:
          version: ${{ env.AST_GREP_VERSION }}
      - name: Fetch the debug CLI built once for this run
        uses: actions/download-artifact@v4
        with:
          name: debug-tracedecay-cli
          path: target/debug
      - name: Restore the executable bit the artifact store drops
        run: chmod +x target/debug/tracedecay

      - name: Run generated-plugin unit checks (no Hermes required)
        run: python3 scripts/hermes_plugin_unit_check.py

      - name: Clone stock Hermes at pinned ref
        run: |
          set -euo pipefail
          git init -q "$RUNNER_TEMP/hermes-upstream"
          git -C "$RUNNER_TEMP/hermes-upstream" remote add origin "$HERMES_UPSTREAM_REPO"
          git -C "$RUNNER_TEMP/hermes-upstream" fetch --depth 1 origin "$HERMES_UPSTREAM_REF"
          git -C "$RUNNER_TEMP/hermes-upstream" checkout --detach FETCH_HEAD

      - uses: astral-sh/setup-uv@v8.2.0
        with:
          enable-cache: true
          cache-dependency-glob: ${{ runner.temp }}/hermes-upstream/uv.lock
          cache-suffix: hermes-${{ env.HERMES_UPSTREAM_REF }}

      - name: Set up stock Hermes environment
        working-directory: ${{ runner.temp }}/hermes-upstream
        run: uv sync --frozen --no-dev

      - name: Run stock Hermes integration checks
        env:
          TRACEDECAY_BIN: ${{ github.workspace }}/target/debug/tracedecay
          HERMES_UPSTREAM_DIR: ${{ runner.temp }}/hermes-upstream
        run: scripts/hermes_stock_integration.sh

  host-stock-integration:
    name: Claude Code + OpenCode integration (stock)
    needs: [scope-gate, debug-cli]
    if: ${{ needs.scope-gate.outputs.run-hosts == 'true' }}
    runs-on: ubuntu-24.04-arm
    timeout-minutes: 30
    env:
      # Stock host pins. The installed bundle must keep working against these
      # exact host releases. Bump deliberately after rerunning
      # scripts/claude_stock_integration.sh and
      # scripts/opencode_stock_integration.sh against the new versions locally.
      CLAUDE_CODE_VERSION: 2.1.224
      OPENCODE_VERSION: 1.18.4
    steps:
      - uses: actions/checkout@v7

      - name: Fetch the debug CLI built once for this run
        uses: actions/download-artifact@v4
        with:
          name: debug-tracedecay-cli
          path: target/debug
      - name: Restore the executable bit the artifact store drops
        run: chmod +x target/debug/tracedecay

      - name: Install stock Claude Code and OpenCode at pinned versions
        run: |
          npm install --global "@anthropic-ai/claude-code@${CLAUDE_CODE_VERSION}" "opencode-ai@${OPENCODE_VERSION}"
          claude --version
          opencode --version

      - name: Run MCP conformance smoke
        env:
          TRACEDECAY_BIN: ${{ github.workspace }}/target/debug/tracedecay
        run: scripts/mcp-conformance-smoke.sh

      - name: Run stock Claude Code integration checks
        env:
          TRACEDECAY_BIN: ${{ github.workspace }}/target/debug/tracedecay
        run: scripts/claude_stock_integration.sh

      - name: Run stock OpenCode integration checks
        env:
          TRACEDECAY_BIN: ${{ github.workspace }}/target/debug/tracedecay
        run: scripts/opencode_stock_integration.sh