ci: six reviewed guardrail PRs as one branch, plus two gate repairs (#381, #383)

[avrabe]

One branch carrying six reviewed PRs, because main has
required_status_checks.strict = true and this repo has no merge queue.
Under strict, the first merge advances main and every remaining PR must
update-branch and re-run all 18 required contexts. Six sequential merges is
six full CI rounds on an org-shared runner pool; this is one.

Most of this is not new work: six of the commits are the reviewed heads of
existing PRs, cherry-picked unmodified. Four additions arrived while the batch
was being assembled — a small change-filter fix (#379), a link that only became
addable once these landed together, and two gate repairs (#381, #383) that are
the substantive new items and are described below.

What is in it

commits	from	closes
ci(fuzz): stop the scheduler_solver nightly OOMing on ASan bookkeeping	#363	#361
fix(rivet): stop double-loading safety/stpa … + correct the "loses nothing" claim	#368	#360
fix(artifacts): move 276 statuses onto rivet's lifecycle vocabulary	#374	#371
ci(release): gate the tag point … + a clean-room audit disarmed this gate three ways	#376	#366
fix(ci): gate required-context drift … + close four fail-open holes	#377	#372
fix(msrv): declare the Rust floor and gate it against the dependency closure	#378	—
ci: allow-list rivet.yaml in the change filter	new	#379
fix(artifacts): state the link that was deferred to avoid a flaky gate	new	—
fix(ci): the mutation gate reads a path cargo-mutants never writes	new	#381
ci(fmt): check every workspace in the repo, and print how many	new	refs #383

The item that is not a cherry-pick: #381

Mutation Testing is a required status check. It runs for roughly three hours.
It has never once read its own results.

cargo mutants --output DIR creates mutants.out inside DIR, so the report
lands at mutants-out/mutants.out/. The gate read mutants-out/missed.txt, one
level up — a path that has never existed. grep failed into || echo 0, the
-f test was false, 0 -gt 142 was false, exit 0. git log -L puts that read
path byte-identical since 563eb8c on 2026-03-22. Four months.

The proof is the job's own artifact. It uploads with path: mutants-out/, so the
artifact root is a listing of that directory — and it contains exactly one
entry, mutants.out/. Run 30563879100 (main @ cd4d429) uploaded 210
survivors against a threshold of 142 and reported green.

The tell was in the tree the whole time. 5d6d98a, 58 minutes after the gate went
hard:

Current survivors: 142 (down from 220). Threshold will be lowered as tests
improve. Target: 0.

That measurement was real and correct, and structurally impossible for CI to
have produced — CI was printing 0. Someone measured by hand, wrote the number
down, and shipped a gate that could not see it. Two numbers for one quantity sat
in the repository for four months and were never diffed. That diff is now
automated: the checker refuses to score a report whose .txt line counts
disagree with outcomes.json, so the only detector that would have worked from
day one is the one thing the gate can no longer skip.

Beyond the path, three changes, because a corrected path alone would still fail
open:

• Absent report → fail. The cargo-mutants step ends in || true and the job
  runs on lean-mem because it is RAM-hungry, so "the run died" is expected —
  and it produces no files, which scores zero survivors, the best possible
  result. The whole reason this was invisible is that the error path yielded the
  ideal reading.
• caught == 0 → fail. A report that exists but caught nothing means the
  suite never ran. Also scores zero survivors.
• timeout-minutes: 240. The job had none, inheriting GitHub's 6-hour
  default; the one run to reach success in the last 25 took 182.3 minutes.

The logic is no longer in the workflow. Inline shell in a YAML file is only
testable by pushing, which is exactly how a misread survived four months with
nobody able to run it against a report. It now lives in
tools/check_mutants_report.py with a 19-case decision table that runs as
its own step before the gate — the same convention as the human-scoped,
required-context and MSRV guardrails already in this branch. The table's
load-bearing row is the #381 regression itself: a complete, valid set of outcome
files placed at the shallow path must exit 1. mutants-weekly.yml calls the
same script with --summary-file, so the nesting fact lives in one constant;
two copies of a path is how one gets fixed and the other does not.

MAX_MISSED is re-baselined 142 → 210, the measured count on main. This
relaxes nothing that was ever in force — 142 was never enforced, so 210 is the
first value this gate has actually checked against. The 142 → 210 drift over four
blind months is precisely what a ratchet exists to prevent; #382 tracks walking
it back to zero and says not to raise it again.

mutants-weekly.yml had the same wrong path, where it rendered a summary table
of 0 missed / 0 caught / 0 unviable — not merely wrong but impossible, since
zero caught and zero unviable would mean cargo-mutants found nothing to test.
It still read as a plausible table.

This PR will be the first time the gate actually runs. crates/spar-analysis/
is untouched between cd4d429 and this branch's base, so 210 should hold; if it
comes in higher, that is the gate working and I will treat it as a finding rather
than adjust the number.

What #381 turned up next: #383

#381 is not a mutation-testing bug. It is an instance of a property — a check
whose "nothing happened" renders identically to "it worked" — so all 18 required
contexts were audited against one question: can this report success without
having measured the thing its name claims? The audit is #386. It found 11 with
a path to green; four are live today. This branch fixes one of them.

Format runs cargo fmt --all -- --check. --all means "all members of this
workspace", not "all crates in the repo", and this repo has four workspaces — the
23-crate root plus fuzz/, codegen-exec-oracle/ and codegen-kiln-oracle/,
each with its own [workspace] table. Two gates, one tree, opposite verdicts:

cargo fmt --all -- --check                                  -> 0
cargo fmt --manifest-path fuzz/Cargo.toml --all -- --check  -> 1   (13 diff lines)

The drift is tracked code: fuzz/fuzz_targets/fuzz_codegen_roundtrip.rs:32.
A required status check named Format has been green over unformatted Rust, and
nothing in CI has ever formatted fuzz/.

This one has no error path at all — cargo prints nothing on success, so 23-of-26
crates clean is byte-identical to 26-of-26 clean. The fix is therefore a
mandated output rather than a corrected path. tools/check_fmt_workspaces.py
discovers the workspace set, floors it at 4, and prints
4 workspace(s) checked, 4 formatted. on every path including success. A count
is not producible by a broken scan — that is the general fix #386 proposes, and
this is its first application outside #381.

Two details worth review attention:

• Discovery, not a list. Four hard-coded manifests would fix today's bug and
  re-open it the day someone adds a fifth workspace. The floor is what makes a
  discovery failure loud instead of green.
• The prune list is load-bearing. target/ fills with vendored crates.io
  sources, many shipping their own [workspace] table. A naive walk on a machine
  that has built once finds dozens, clears the >= 4 floor comfortably, and asks
  cargo to format other people's build cache. That bug passes, so it is two
  self-test rows rather than a comment.

Clippy has the identical --workspace gap and is not fixed here, so #383
stays open on that half.

#369 stays open deliberately. #378 discharges the gate but not the
nix-eval channel-rustc check it owes, which is blocked on #364 landing. The
commit carries no Closes for that reason.

Why a merge commit rather than a squash

These are unrelated fixes with substantive rationale in their individual
messages; squashing them into one commit would discard that. Merge commits are
enabled on this repo, and the tag-point gate this PR carries walks
--first-parent, so the feature commits sit off the spine and only the merge
commit lands on it, dated at merge time — exactly the case its header
anticipates.

Conflicts

Cherry-picking the nine cherry-picked commits in order produced one conflict:
a pure add/add in .github/workflows/ci.yml between #377's Required-context
guardrail steps and #378's MSRV guardrail steps. Resolved by keeping both, in the
order Human-scoped → Release-plane → Required-context → MSRV.

Worth recording that the earlier n-way merge of the same branches produced
three. A cherry-pick replays a patch against the accumulating tree, so each
earlier fix is already context when the next applies; an n-way merge reconciles
independent trees against one base, so every branch appending at the same anchor
collides with every other. Same content, different reconciliation, different
conflict count.

The deferred link, now stated

REQ-GUARD-STATUS-VOCAB-001 (from #374) deliberately omitted
traces-to: REQ-GUARD-RELEASE-PLANE-001, because that target artifact arrived
in a different unmerged PR and a links: target is resolved at validate time —
the link would have made the branch's oracle pass or fail depending on merge
order. A flaky gate is not a traceability improvement. Both artifacts are now
on main together, so the condition that forced the omission no longer holds
and the link is stated.

Verification run locally before pushing

Exit codes captured from the commands themselves, not from a pipeline tail.

Re-run on the rebased tree, not carried over from the pre-rebase worktree.
That distinction mattered: check_release_plane.py did not exist on this branch
before the rebase (it arrives with #373), and one figure below moved — the
human-scoped artifact count went 887 → 888, because #373's merge added
REQ-GUARD-RELEASE-PLANE-001. Every number here is from the tree being pushed.

Five guardrail decision tables, 56 cases, all invoked bare (so the exec bit
is part of what is tested):

• check_human_scoped.py --self-test — 3 passed, exit 0
• check_required_contexts.py --self-test — 15 passed, exit 0
• check_msrv.py --self-test — 9 passed, exit 0
• check_mutants_report.py --self-test — 19 passed, exit 0
• check_fmt_workspaces.py --self-test — 10 passed, exit 0
• check_release_plane.py --self-test — 4 passed, exit 0

and check_fmt_workspaces.py bare against the rebased tree: 4 workspace(s) checked, 4 formatted., exit 0 — the same command that exits 1 on main.

Then the same checkers against the real tree:

• check_required_contexts.py — scanned 21 PR-triggered jobs: 18 gateable,
  2 advisory, 1 undeliverable; 18 required contexts — PASS

• check_msrv.py — declared floor 1.89 ([workspace.package], inherited by 23
  members), closure maximum 1.89 (set by smol_str@0.3.6; 152 of 212 declare
  one) — PASS

• check_human_scoped.py — 888 artifacts scanned, 6 human-scoped — exit 0

• check_release_plane.py — 11 files scanned, 88 release: keys on the artifact
  key plane that rivet list --release can see, 0 nested where it is blind —
  PASS. This is the post-release: field is on the wrong plane for 59 of 85 artifacts — rivet's release-planning query is blind to 11 shipped releases #370 steady state measured on the merged tree: the 59
  misplaced assignments are gone and none came back through the rebase

• check-tag-point.sh backtested against real history: v0.31.0 exit 1 and
  v0.33.0 exit 1 (both historical misses correctly re-detected), v0.34.0
  exit 0 "PASS (acknowledged) … excludes 6 commit(s)", v0.35.0 exit 0
  "nothing predating the tag was left out" — non-vacuous in both directions

• rivet validate — PASS, exit 0

• #379 allow-list regex, extracted from the file rather than retyped, run over
  positive and negative controls: rivet.yaml allow-listed; rivet.yaml.bak,
  subdir/rivet.yaml, myrivetXyaml, Cargo.toml, src/lib.rs and
  .github/workflows/ci.yml all still classified as code

• the same classifier run over this branch's own 43-file diff: 35 code-ish,
  so code=true and the full suite runs — which is the reachability the two new
  checkers depend on, and rivet.yaml appears in the 43 but not in the 35, so
  the CI path filter: rivet.yaml is not allow-listed, so pure-manifest PRs run the full heavy suite #379 commit is non-vacuous on the very PR that carries it

• #381 both step bodies parsed out of the YAML with yaml.safe_load (not
  retyped) and executed against the real 15 MB artifact from run 30563879100:

  input	new gate	old gate
  no mutants-out at all (crashed / OOM run)	exit 1	exit 0, "0 survivors"
  mutants-out/ present, no mutants.out/	exit 1	exit 0, "0 survivors"
  the real 210-missed / 603-caught report	exit 0, "Surviving mutants: 210"	exit 0, "Surviving mutants: 0"
  report present, caught.txt empty	exit 1	exit 0, "0 survivors"
  211 survivors — one over the threshold	exit 1	exit 0, "0 survivors"
  weekly, no report	warns, omits the table	table of 0/0/0/0
  weekly, real report	210 / 603 / 2 / 793	0 / 0 / 0 / 0

  The third row is the one that matters: the old step body, taken verbatim from
  origin/main and handed the exact directory layout cargo-mutants produces,
  reports zero survivors and passes.

• #383 the new checker run against the real tree, not only fixtures — on
  main's version of the fuzz target it exits 1 with 4 workspace(s) checked, 3 formatted. and reproduces the 13-line rustfmt diff; with :32 reformatted
  it exits 0 with 4 workspace(s) checked, 4 formatted.

One assumption this PR's own CI is the measurement for: the fmt job runs on
the light runner class, and it is the first light consumer of a
tools/check_*.py guardrail — the existing ones run on rust-cpu and
lean-mem. If python3 is absent there the step exits 127 and the required
check goes red, which is the correct direction to fail; the job then moves to
rust-cpu.

Closes #360, #361, #366, #371, #372, #379, #381

Refs #383, #386

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[github-actions]

Rivet verification gate

✅ 20/20 passed

	count
Passed	20
Failed	0
Skipped (no steps)	0

Filter: (and (= type "feature") (or (has-tag "v093") (has-tag "v0100")))

Failed artifacts

(none)

_{Updated automatically by tools/post_verification_comment.py. Source of truth: artifacts/verification.yaml.}