fix(ci): make release gates honest and reproducible [bd-2mo.30]

Dicklesworthstone · Dicklesworthstone · commit a8a670ec2208 · 2026-07-12T11:36:40.000-04:00
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -50,8 +50,8 @@ env:
   # Path dependencies are build inputs. Keep these immutable revisions aligned
   # with the package versions recorded in Cargo.lock; update them deliberately
   # and together, never by floating each job on sibling `main`.
-  FRANKENTORCH_REV: f00c3ce79737ffd0e7c7e2f2e81540907ce26562
-  FRANKENSQLITE_REV: 14c5781680833c248ed18d84914312e233d145df
+  FRANKENTORCH_REV: 062cf3671c194f6ab184da98f0559ebc76cff7c7
+  FRANKENSQLITE_REV: cd9990bb16291d8c7c247b75b47faae8d7701adb
   ASUPERSYNC_REV: 53aa5c72f855352148c3a88e6961f7f09adb535c
   # Surface full backtraces if a test panics, so failures are self-diagnosing.
   RUST_BACKTRACE: 1
@@ -149,7 +149,10 @@ jobs:
       # The full stdout/stderr is captured and uploaded as a CI artifact (the
       # evidence-graph capture, bd-4yks item 10) even when the gate fails.
       - name: Run the gate (scripts/check.sh)
-        run: ./scripts/check.sh 2>&1 | tee gate-log-${{ matrix.os }}.txt
+        shell: bash
+        run: |
+          set -o pipefail
+          ./scripts/check.sh 2>&1 | tee gate-log-${{ matrix.os }}.txt
 
       - name: Bind successful gate evidence
         run: |
@@ -197,9 +200,9 @@ jobs:
           python3 scripts/bench_guardrail.py || echo "guardrail reported (advisory; non-blocking)"
 
   advisory-targets:
-    name: advisory target (${{ matrix.name }})
+    name: target (${{ matrix.name }})
     runs-on: ${{ matrix.os }}
-    continue-on-error: true
+    continue-on-error: false
     strategy:
       fail-fast: false
       matrix:
@@ -236,7 +239,7 @@ jobs:
             skip_reason: ""
           # arm64 Windows checks natively on the hosted windows-11-arm runner.
           # The binary build/no-weights smoke passed in dist run 29048523156;
-          # this remains advisory until full model OCR is proven on that host.
+          # Full model OCR remains covered by the separate weighted parity gate.
           - name: windows-msvc-aarch64
             os: windows-11-arm
             target: aarch64-pc-windows-msvc
@@ -248,11 +251,11 @@ jobs:
       - name: Checkout
         uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
-      - name: Explain advisory skip
+      - name: Explain target skip
         if: ${{ matrix.skip }}
         shell: bash
         run: |
-          echo "Advisory target '${{ matrix.name }}' is not built in Phase 0:"
+          echo "Target '${{ matrix.name }}' is not built in Phase 0:"
           echo "${{ matrix.skip_reason }}"
 
       - name: Provision sibling path dependencies
@@ -310,7 +313,7 @@ jobs:
         if: ${{ !matrix.skip }}
         uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
         with:
-          key: advisory-${{ matrix.name }}-${{ matrix.target }}
+          key: target-${{ matrix.name }}-${{ matrix.target }}
           cache-all-crates: true
 
       - name: Cargo check target
diff --git a/.github/workflows/dist.yml b/.github/workflows/dist.yml
@@ -60,8 +60,8 @@ env:
   RUST_TOOLCHAIN: nightly-2026-07-09
   # The sibling path dependencies are part of the release input. Keep these
   # immutable revisions aligned with the package versions in Cargo.lock.
-  FRANKENTORCH_REV: f00c3ce79737ffd0e7c7e2f2e81540907ce26562
-  FRANKENSQLITE_REV: 14c5781680833c248ed18d84914312e233d145df
+  FRANKENTORCH_REV: 062cf3671c194f6ab184da98f0559ebc76cff7c7
+  FRANKENSQLITE_REV: cd9990bb16291d8c7c247b75b47faae8d7701adb
   ASUPERSYNC_REV: 53aa5c72f855352148c3a88e6961f7f09adb535c
 
 jobs:
diff --git a/.github/workflows/model-parity.yml b/.github/workflows/model-parity.yml
@@ -18,8 +18,8 @@ permissions:
 env:
   CARGO_TERM_COLOR: always
   RUST_TOOLCHAIN: nightly-2026-07-09
-  FRANKENTORCH_REV: f00c3ce79737ffd0e7c7e2f2e81540907ce26562
-  FRANKENSQLITE_REV: 14c5781680833c248ed18d84914312e233d145df
+  FRANKENTORCH_REV: 062cf3671c194f6ab184da98f0559ebc76cff7c7
+  FRANKENSQLITE_REV: cd9990bb16291d8c7c247b75b47faae8d7701adb
   ASUPERSYNC_REV: 53aa5c72f855352148c3a88e6961f7f09adb535c
 
 jobs:
@@ -60,6 +60,15 @@ jobs:
               git -C "$destination" remote add origin "https://github.com/Dicklesworthstone/$repo.git"
               git -C "$destination" fetch --quiet --depth 1 origin "$revision"
               git -C "$destination" checkout --quiet --detach FETCH_HEAD
+            else
+              [[ -z "$(git -C "$destination" status --porcelain=v1 --untracked-files=all)" ]] || {
+                echo "$repo checkout is dirty: $destination" >&2
+                exit 1
+              }
+              if [[ "$(git -C "$destination" rev-parse HEAD)" != "$revision" ]]; then
+                git -C "$destination" fetch --quiet --depth 1 origin "$revision"
+                git -C "$destination" checkout --quiet --detach FETCH_HEAD
+              fi
             fi
             actual=$(git -C "$destination" rev-parse HEAD)
             [[ "$actual" == "$revision" ]] || {
diff --git a/.github/workflows/performance-gauntlet.yml b/.github/workflows/performance-gauntlet.yml
@@ -30,8 +30,8 @@ permissions:
 env:
   CARGO_TERM_COLOR: always
   RUST_TOOLCHAIN: nightly-2026-07-09
-  FRANKENTORCH_REV: f00c3ce79737ffd0e7c7e2f2e81540907ce26562
-  FRANKENSQLITE_REV: 14c5781680833c248ed18d84914312e233d145df
+  FRANKENTORCH_REV: 062cf3671c194f6ab184da98f0559ebc76cff7c7
+  FRANKENSQLITE_REV: cd9990bb16291d8c7c247b75b47faae8d7701adb
   ASUPERSYNC_REV: 53aa5c72f855352148c3a88e6961f7f09adb535c
 
 jobs:
@@ -72,6 +72,15 @@ jobs:
               git -C "$destination" remote add origin "https://github.com/Dicklesworthstone/$repo.git"
               git -C "$destination" fetch --quiet --depth 1 origin "$revision"
               git -C "$destination" checkout --quiet --detach FETCH_HEAD
+            else
+              [[ -z "$(git -C "$destination" status --porcelain=v1 --untracked-files=all)" ]] || {
+                echo "$repo checkout is dirty: $destination" >&2
+                exit 1
+              }
+              if [[ "$(git -C "$destination" rev-parse HEAD)" != "$revision" ]]; then
+                git -C "$destination" fetch --quiet --depth 1 origin "$revision"
+                git -C "$destination" checkout --quiet --detach FETCH_HEAD
+              fi
             fi
             actual=$(git -C "$destination" rev-parse HEAD)
             [[ "$actual" == "$revision" ]] || {
diff --git a/scripts/gauntlet_cert.py b/scripts/gauntlet_cert.py
@@ -7152,6 +7152,7 @@ def _bound_source_pack_artifacts(
     root: Path, bundle_dir: Path, entries: dict[str, dict]
 ) -> set[str]:
     """Return only source packs named by canonical colocated PERF row bindings."""
+    bundle_dir = bundle_dir.resolve()
     bound: set[str] = set()
     for relative, entry in entries.items():
         if "error" in entry or Path(relative).name != "row.json":
@@ -7220,6 +7221,7 @@ def _snapshot_bundle_artifacts(
     max_bundle_bytes: int = CERTIFICATION_MAX_BUNDLE_BYTES,
 ) -> tuple[list[str], float, int, set[str]]:
     """Verify artifacts and materialize an immutable replay snapshot."""
+    bundle_dir = bundle_dir.resolve()
     reasons: list[str] = []
     max_age = 0.0
     total_artifact_bytes = 0
@@ -13204,9 +13206,21 @@ def write_large_row_binding(pack_sha256: str, pack_size: int) -> None:
             snapshotted_large_pack = (
                 Path(large_snapshot_tmp) / large_pack_relative
             )
-            snapshotted_identity = _stream_file_identity(
-                snapshotted_large_pack, PERF_MAX_SOURCE_PACK_BYTES
-            )
+            snapshotted_identity: dict | None = None
+            if not large_snapshot_reasons:
+                if snapshotted_large_pack.is_file():
+                    try:
+                        snapshotted_identity = _stream_file_identity(
+                            snapshotted_large_pack, PERF_MAX_SOURCE_PACK_BYTES
+                        )
+                    except (OSError, ValueError) as error:
+                        large_snapshot_reasons.append(
+                            f"large source-pack snapshot is unreadable: {error}"
+                        )
+                else:
+                    large_snapshot_reasons.append(
+                        "large source-pack snapshot is missing"
+                    )
         check(
             "bundle-large-bound-source-pack-streams-through-manifest-and-snapshot",
             not large_stale
@@ -13215,6 +13229,7 @@ def write_large_row_binding(pack_sha256: str, pack_size: int) -> None:
             and not large_snapshot_reasons
             and large_streamed_paths == {large_pack_relative}
             and large_snapshot_total > CERTIFICATION_MAX_ARTIFACT_BYTES
+            and snapshotted_identity is not None
             and snapshotted_identity["sha256"]
             == large_entries[large_pack_relative]["sha256"]
             and snapshotted_identity["size"] == large_pack_size,
diff --git a/tests/installer_e2e.sh b/tests/installer_e2e.sh
@@ -350,12 +350,27 @@ fi
 rm -rf "$atomic_work"
 
 if command -v pwsh >/dev/null 2>&1; then
-  if pwsh -NoLogo -NoProfile -NonInteractive \
-      -Command '$null = [scriptblock]::Create((Get-Content -Raw -LiteralPath $args[0]))' \
-      "$INSTALL_PS1" >/dev/null 2>&1; then
+  if powershell_parse_output="$(
+    # shellcheck disable=SC2016
+    INSTALL_PS1="$INSTALL_PS1" pwsh -NoLogo -NoProfile -NonInteractive -Command '
+      $ErrorActionPreference = "Stop"
+      $tokens = $null
+      $errors = $null
+      [void][System.Management.Automation.Language.Parser]::ParseFile(
+        $env:INSTALL_PS1,
+        [ref]$tokens,
+        [ref]$errors
+      )
+      if ($errors.Count -gt 0) {
+        $errors | ForEach-Object { [Console]::Error.WriteLine($_.ToString()) }
+        exit 1
+      }
+    ' 2>&1
+  )"; then
     pass "PowerShell installer parses"
   else
     bad "PowerShell installer has a parse error"
+    printf '%s\n' "$powershell_parse_output" >&2
   fi
 else
   skip "pwsh not installed — PowerShell parse check not exercised"
