Design sub-ten-minute CI/CD without weakening release gates

[tamashi095]

Design sub-ten-minute CI/CD without weakening release gates

One-line summary

Ask Fable 5.1 to design the smallest, fastest GitHub Actions and test
architecture that protects distinct production risks. Remove obsolete,
duplicated, non-discriminating, and otherwise unnecessary tests instead of
preserving the current suite by default.

Problem

Routine development cannot tolerate 20–30 minute pull-request feedback. The
current repository has path detection, but its full route is too coarse and
the principal host job is too monolithic. A single late or flaky failure wastes
the entire critical path and a failed-workflow rerun may repeat already-green
prerequisites.

PR #358 provides a concrete incident rather than a hypothetical concern:

• release-build.yml passed in 21m31s (run 33841397089);
• SDK qualification passed in 7m23s (run 33841397131);
• browser qualification took up to 7m43s (run 33841397119);
• the first host quality and native shell job failed after 11m35s in run
  33841397115, during cargo test --locked --workspace --all-targets;
• its allocation-accounting failure passed immediately in isolation on both
  the candidate and unchanged old worktree, but rerunning the failed workflow
  repeated several green jobs and again entered the long host test; and
• the host job contains roughly 68 sequential steps after setup, including the
  workspace suite, policy/mutation suites, release-mode DSP gates, realtime
  audits, target checks, fixture checks, and native smoke tests.

The result is correct but operationally hostile: a developer can wait most of
an hour across one late failure and rerun even when the edited capability is
small.

Current topology Fable must inspect

• .github/workflows/ci.yml: route, one very large host job, x86-probes,
  wasm, wasm-gates, and required aggregate qualification.
• .github/workflows/sdk.yml: route plus SDK package/headless qualification;
  it still builds the pinned Engine AudioWorklet because the Wasm is part of
  the npm archive.
• .github/workflows/browser-qualification.yml: builds the shipped artifact
  once, then runs Chromium, Firefox, and WebKit qualification in parallel.
• .github/workflows/release-build.yml: path-filtered workspace release build.
• .github/workflows/fuzz.yml: path-filtered bounded PR fuzzing.
• .github/workflows/nightly.yml: non-blocking descriptive/deep work.
• scripts/ci-path-router.py, scripts/check-ci-path-routing.py, and
  scripts/test-ci-path-routing.py: fail-safe evidence / sdk / full
  classification, including rename/copy/base handling.

Pure sdk/** changes already skip the Rust host/x86/Wasm test matrix and run
the SDK workflow. Evidence-only changes skip heavy work. Unknown, mixed, Cargo,
Rust, and workflow changes route to full. One known omission is
scripts/test-sdk-artifact-builder-output-contract.sh, which is SDK-owned but
is not in the narrow SDK path set.

Consultation objective

Fable 5.1 should recommend one coherent target architecture—not merely a list
of possible optimizations—and support it with expected critical-path timing,
failure behavior, security boundaries, and a staged migration plan.

Test-suite reduction mandate

The current test inventory is not presumed correct or necessary. Fable is
explicitly authorized and expected to audit it aggressively. Every blocking
test, script, mutation suite, target build, fixture check, and repeated
debug/release invocation must justify its cost with a distinct, credible
failure mode.

Classify each current gate family as keep, consolidate, move, or
delete:

• delete obsolete tests and gates for retired or unreachable product surfaces;
• delete byte/prose/ceremony checks that do not discriminate a product claim;
• consolidate repeated tests that exercise the same code and failure mode;
• remove redundant debug/release/target repetitions unless code generation or
  conditional compilation gives them a distinct assertion;
• reduce mutation matrices to the minimum representatives that prove the
  validator catches each semantic class;
• move valuable but non-merge-critical breadth to scheduled or manual runs;
• keep blocking only the smallest representative tests needed to protect
  correctness, realtime safety, deterministic behavior, supported targets,
  package integrity, and release provenance; and
• identify tests whose flakiness, global state, runtime, or maintenance cost is
  greater than their demonstrated signal, then delete or redesign them.

“It already exists” and “it once belonged to an issue” are not reasons to keep
a test. Conversely, removal must name the stronger surviving check or explain
why the asserted behavior is no longer a product requirement.

The design should make the fastest correct route the default. It should answer:

1. What measurable P50/P95 budgets should apply to first signal, routine PR
   completion, full-impact PR completion, merge/main, and release qualification?
2. What is the right unit of change classification: path families, Cargo
   dependency closures, generated-artifact ownership, job inputs, or a hybrid?
3. How should the monolithic host job be sharded so independent gates run in
   parallel without hiding failures or introducing nondeterministic shared
   state?
4. Which checks should be deleted or consolidated, which must run on every
   relevant PR, which may run after merge, and which belong only in
   nightly/manual qualification—and why?
5. How can Rust, npm, browser, toolchain, and built-artifact caching reduce cold
   setup while remaining correct and resistant to cache poisoning from
   untrusted pull requests?
6. When may a previously built Engine Wasm or compilation output be reused, and
   which final release artifacts must always be rebuilt and byte-attested?
7. How should required aggregate checks behave when path-filtered workflows or
   jobs are skipped, so branch protection never waits forever or accepts an
   unknown state?
8. How should a failed shard be rerun without repeating unrelated green shards?
9. How should flaky/global-state tests—especially allocation tracking—be
   isolated, serialized, or redesigned without weakening their assertion?
10. What observability should record queue time, setup time, cache hit rate,
    execution time, critical path, reruns, and flake rate so the latency budget
    cannot silently regress?

Non-negotiable correctness and security constraints

• Remove every test that has no distinct, current, merge-relevant claim. Do not
  weaken a necessary assertion merely to improve time; when deleting a
  redundant assertion, name the stronger surviving check, and when deleting an
  obsolete assertion, name the retired requirement.
• Realtime allocation/syscall/lock rules, deterministic PCM/DSP fixtures,
  scalar/SIMD parity, PDC, browser targets, native targets, and package mutation
  tests remain real assertions.
• The sealed Engine AudioWorklet digest and npm provenance must describe the
  exact built release artifact. A dependency cache is not release evidence.
• Unknown paths, malformed diffs, missing bases, unexpected rename/copy status,
  and manual dispatch must fail safe to the broad route.
• Pull requests from untrusted forks must not gain secrets or poison caches used
  by trusted release jobs. Cache restore/save permissions and key provenance
  must be explicit.
• A check that can fail a merge belongs in a required PR workflow. Descriptive
  benchmarks and deep fuzzing stay outside blocking CI.
• GitHub paths: filters operate at workflow scope. Before a workflow stops
  reporting on any PR, its status context must be removed or replaced in branch
  protection so skipped checks never remain permanently pending.
• Feature-branch pushes should not duplicate pull-request CI. main and manual
  release behavior must remain explicit, with superseded runs cancelled by ref.
• No compiled MAX_TRACKS, no weakening of supported-target coverage, and no
  change to engine/runtime semantics is authorized by this design issue.

Required Fable 5.1 deliverable

Post a design comment containing:

1. a diagram of proposed workflows, jobs, dependencies, required aggregates,
   artifacts, and cache boundaries;
2. a path/input ownership matrix showing the exact route for SDK-only, docs,
   Rust crate, root Cargo/lock/toolchain, browser host, workflow/policy,
   fixture, and mixed changes;
3. the proposed sharding of every current blocking gate, including why each
   shard is safe to parallelize and its estimated duration;
4. a gate-reduction ledger classifying each current test family as keep,
   consolidate, move, or delete, with unique claim, measured cost, historical
   signal/flakes, and the surviving protection for every removal;
5. exact required-check and GitHub Actions skip/failure/rerun semantics;
6. cache keys, restore/save rules, invalidation inputs, fork protections, and
   which artifacts are never reused as release evidence;
7. latency and cost estimates derived from recent run evidence, with explicit
   P50/P95 acceptance budgets;
8. a staged migration that keeps main protected at every step, including the
   branch-protection transition order and rollback plan;
9. a validation plan that intentionally mutates path routing, cache inputs,
   job failures, skipped jobs, and aggregate results; and
10. a short list of bounded implementation issues in dependency order.

Fable should call out any current gate whose purpose is unclear rather than
guessing that it is redundant. The answer must distinguish queue/setup time
from execution time and distinguish routine PR checks from release
qualification.

Acceptance gates

1. The comment recommends one architecture and accounts for every current
   blocking workflow/job family.
2. The proposal removes all tests it cannot justify with a unique current
   product claim and documents why each deletion or consolidation is safe.
3. Every proposed skip has a concrete input/dependency argument and a fail-safe
   fallback.
4. Required status checks always resolve to an explicit success or failure for
   every pull request shape.
5. The design includes a credible route to sub-ten-minute routine PR completion
   and defines a separate bounded target for genuinely full-impact changes.
6. Release artifact/provenance integrity and untrusted-PR isolation are not
   weakened.
7. Migration can be split into small issue-first checkpoints without a period
   in which main is less protected.
8. Sol adversarially reviews Fable's proposal before any implementation issue
   is authorized.

Scope

This issue authorizes design and review only. It does not authorize workflow,
branch-protection, cache, test, or runtime changes. After Fable 5.1 comments,
Sol and the owner will accept, amend, or reject the proposal and create bounded
implementation issues.

[tamashi095]

CI/CD target architecture for sub-ten-minute routine PRs (Fable 5.1 design, #359)

Status: design only. Nothing here is authorized for implementation until Sol's adversarial review. Every number below is either read from the Actions API for a named run or is marked estimate. Estimates are calibrated against those runs, not guessed from first principles.

Evidence base: ci run 33836318855 (PR #353 full route, 38m0s wall), 33838915826 (same commit merged to main, 24m10s), 33841397115 attempt 1 (PR #358, host failed at 11m35s), 33841397089 (release build 21m31s), browser runs 33841397119 (9m48s) and 33745884964 (4m25s), SDK runs 33841397131 (7m46s) and 33745884872 (3m48s), nightly 33731067773, plus the job/step timings of 28 runs, the failing-step logs of every red run since 2026-09-02, the last 80 first-parent commits on main, and a source audit of all 7 workflows, 152 scripts and 45 workspace crates. Where a claim comes from reading code rather than running it, it says (unverified).

---

1. Current critical path and duplication analysis

1.1 Where the 38 minutes go (run 33836318855, full route, PR)

Job	Wall	Queue	Notes
route ×3 (ci, sdk, browser)	15–17s each	2s	three identical fetch-depth: 0 checkouts + router self-test
host quality and native shell	2277s	2s	the critical path
browser Wasm artifact probes	390s	2s	builds the shipped closure ~10 times in 10 target dirs
cross-target digest gates (wasmtime)	372s	2s	219s native+guests, 121s G6 rebuild
x86 probes	27s	2s
browser qualification (separate workflow)	122s artifact → 65–457s per browser	2s	variance is Playwright install, not tests
SDK qualification (separate workflow)	162–572s	2s	variance is npm ci (1s warm, 289s cold)
release build (separate, not required)	1291s	2s	fat-LTO link of every test/bench/example target
fuzz (separate, not required)	96s	2s

Queue time is negligible (2–3s in every job of every run examined; one 70s outlier). The problem is entirely execution and serialization.

Host job, step by step (2277s):

Segment	Seconds	What it actually is
checkout + toolchain + apt	22
fmt, clippy, doc	100
cargo test --workspace --all-targets (debug)	1140	compile 129s, execution 1011s
↳ of which tools/audit unit tests (29 tests)	470	fixture-corpus mutation proofs rendered in debug
↳ wasm-gates debug tests (G5/G6 corpus renders)	81	re-run in release 6 minutes later in another job
↳ console-workload (chain_shape)	71
↳ builtins-compiler (scale, allocation_tracker)	69
↳ session 47, builtins 38, graph-compiler 34, graph 33, parametric-eq 30, multiband 25, math 21, lane 15, rest ≈ 80
26 serial release-mode cargo test --release -p X / audit steps	≈ 905	each pays its own release compile of its closure
~40 script steps	≈ 150	of which ≈ 90s is duplicate cargo work inside "cheap" gates (§1.3)

The 129s compile figure corrects the issue text's implicit assumption that the debug step is build-bound. It is execution-bound, and one evidence-tool crate is 46% of it.

Runner variance. The identical commit on main (33838915826) ran the same host job in 1429s: compile 97s, execution 503s, audit tests 233s. GitHub-hosted 4-vCPU runners vary by ~1.6–2.0× on this workload. Any P95 budget must absorb that; any design that puts a 5-minute serial chain on the critical path will see 10 minutes at P95.

1.2 Failure and flake history (all red ci runs since 2026-09-02)

Run	Trigger	Failing step	Class
33598887208	main push, docs-only commit	engine a_million_windows_are_read_whole_and_in_order	scheduler-bound livelock assertion (observation_transport.rs:124-127)
33621484972	main push, sdk-only commit	host-core observation_cost_classes_are_what_they_claim	wall-clock ratio assertions (effect_observation.rs:1005-1018)
33651977993	main push	transient-shaper allocation	later fixed by "isolate transient shaper allocation counts"
33709604095	PR	host-web …finishes_under_one_second	wall-clock budget in debug (src/tests.rs:546)
33711749622, 33737806035	PR	env-vocabulary policy	real failures (0s, first-failure was 18 minutes in)
33841397115 att.1	PR #358	builtins-compiler allocation_tracker	first-touch/global layout table nondeterminism

Five of roughly 25 full runs in ten days failed on tests whose outcome depends on wall clock, scheduler interleaving, or process-global allocation state. Two of those were on commits that could not have changed the tested code. That is a 20% false-red rate on the 38-minute job, and each false red costs a full rerun because the job is monolithic. This flake class, not raw compute, is the single largest contributor to developer-perceived latency. Only two runs in the last 60 used a second attempt, meaning developers mostly push again instead of rerunning, which the router then treats as a fresh full run.

1.3 Duplication ledger

Duplicate	Cost per full PR	Evidence
Shipped AudioWorklet built 3× (ci wasm, sdk, browser artifact)	≈ 75–186s ×3	ci.yml:434, sdk.yml:68, browser-qualification.yml:66
Effect-crate test suites executed 3× (debug workspace, per-crate release, and wasm-gates G5 native corpus in release which renders every crate's corpus against the same pins)	≈ 330s of serial release steps + ≈ 150s debug execution	tools/wasm-gates/tests/g5_native_corpus.rs:177; the 8 effect crates have no cfg(debug_assertions), no profile-conditional pins
cargo test -p effect-package -p effect-compiler -p conformance run 3–4× (workspace, check-effect-interchange-targets.sh:62, check-effect-contract.sh:8/:47, cold scratch dir in check-effect-package-v1.sh:19)	≈ 90s	script audit
Wasm closure built in 10 separate CARGO_TARGET_DIRs in one job (wasm-realtime-local, wasm-scalar, wasm-simd, wasm-console, issue005-* ×4, the build script's mktemp, plus default)	≈ 250s	ci.yml:386-448, check-wasm-realtime-atomics.sh:22
check-protocol-benchmark-wasm-parity.sh: two whole-workspace wasm fat-LTO builds of bench whose checksum assertion never executes (wabt --run-all-exports skips parameterised exports and exits 0 on traps, per check-protocol-wasm-parity.sh:7-16)	≈ 17s here, but only because the target dirs were warm from previous steps; cold ≈ 2–3 min	(inert by in-tree reasoning; unverified by execution)
web-audioworklet-browser-correctness.py --check fully subsumed by check-browser-expected-resources.py --artifacts (same oracle, asserts before print); --self-test step repeats what line 439 already runs	≈ 10s	direct-oracle.mjs:481-486, check-browser-expected-resources.py:749
npm run matrix -- --check ×3 = --check-matrix already asserted in run.mjs:378	trivial
check-sdk-generated.sh twice per SDK job (sdk.yml:69 and via sdk-package.sh:43)	≈ 30s (native release parameter-metadata run)
G6 cargo test --release -p wasm-gates rebuilds the wasmtime closure a second time (unwind test profile vs abort cargo run)	121s	docs/REALTIME_DEPENDENCY_POLICY.md:199-201
Route job ×3 workflows	45s runner time, 17s wall
Release build --no-run: 21 minutes, not a required check, and its stated pre-merge coverage gap (cfg(debug_assertions) items) is empty today: the only attribute-level sites are multiband-compressor/src/lib.rs:1109,1290, already compiled in release at ci.yml:179	1291s runner time, 0s critical path, but developers wait for it	workflow header comment vs grep
Per-crate RUSTFLAGS overrides (+fma M3 leg, loom leg) in the shared target/ invalidate fingerprints for everything built after them	hidden; every later release step recompiles	Cargo fingerprint semantics

No live references to retired surfaces (FLAC delivery, V2, nudge, Effect SDK, Blacksmith) remain in any test or script; every hit is a ban. There is nothing obsolete to delete on those grounds. What is obsolete is ceremony: ~15 ci.yml comments cite scripts/sweep.sh, deleted in #319.

---

2. Unit of change classification (Q2)

Recommendation: a hybrid, weighted toward path families, with exactly two closure-derived step conditions.

• Workflow routing stays path-family based (evidence / sdk / full) with the existing fail-safe router. It is proven, mutation-tested, and 47 of the last 80 main commits are docs-only, 13 are SDK+docs. Those already take 25s and ~3 min. The routing problem is not classification; it is what full costs.
• Cargo dependency closures are not used to skip shards. I computed the reverse closure from the 45 manifests: engine reaches 41 crates, lane 39, math 35, effect-contract 34, every effect crate 17. A closure-pruned matrix would skip shards on perhaps a third of Rust PRs, but the critical path is the slowest shard, not the number of shards, so pruning saves runner-minutes (free on a public repo) and shortens nothing. It also adds a second classifier to keep fail-safe. Revisit only if telemetry (§11) shows shard count, not shard length, dominating.
• Two closure-derived step conditions inside shards, where the closure is tiny and the step is expensive:
  1. Math/lane exhaustive sweeps (m1_exhaustive --ignored, f1_fast_db_bounds --ignored, 93s) run on PRs only when the diff touches crates/math/**, crates/lane/**, Cargo.lock, rust-toolchain.toml or .cargo/config.toml (math's workspace closure is exactly {lane}), and nightly unconditionally.
  2. cargo check --release --workspace --all-targets (the release-shape probe, §6.7) runs on PRs only for the existing release-build.yml paths: set, and on every main push.
     Both conditions are computed by the same router (new outputs math-closure, release-inputs), so the same fail-safe rules apply: unknown path, malformed diff, missing base, rename/copy status, dispatch ⇒ condition true.
• Generated-artifact ownership is handled by building once and passing the artifact by upload-artifact within the run (§4), never by path filters.
• Browser host (hosts/host-web/**) is not a family. host-web is a Rust crate; its JS is asserted by a Rust-built oracle and native examples; its tests/browser-v1/expected.json pins come from hosts/host-web/src/tests.rs. Over 80 commits it changed 5 times, always with other families. It routes full.
• scripts/** and .github/workflows/** are not families (fail-safe full), except the five SDK scripts plus scripts/test-sdk-artifact-builder-output-contract.sh, which is SDK-owned and is the known omission the issue names. Add it to SDK_FILES in the router, checker and paths-ignore lists together (the routing policy checker enforces the three stay in sync).
• dsp-research/** markdown and docs/**: dsp-research/**/*.md joins the evidence family; check-dsp-research.sh and check-builtins-listening.sh move to the evidence lane so a research note edit does not ride the full route.

---

3. Change-to-workflow routing matrix

Routes are computed once by route and consumed by every shard's if:. "—" means the job is skipped and the aggregate expects skipped for it.

Change shape (examples)	Route	Jobs that run	Expected wall (P50, warm cache)
docs/, .github/ISSUE_SPECS/, README.md, dsp-research/**/*.md	evidence	route, docs-gates (dsp-research + listening validators, ≈10s), verdict	< 1 min
sdk/**, the 5 SDK scripts, test-sdk-artifact-builder-output-contract.sh (+ evidence)	sdk	route, artifact (build + pin), sdk, verdict	≈ 4 min (artifact 2 + sdk 2)
One Rust crate (e.g. crates/transient-shaper/src)	full	all shards	≈ 6 min typical runner, ≈ 9–10 slow runner
Root Cargo.toml / Cargo.lock / rust-toolchain.toml / .cargo/config.toml	full + release-inputs + math-closure	all shards + release-shape check + sweeps; cache miss	≈ 12–15 min
crates/math or crates/lane	full + math-closure	all shards + sweeps	≈ 8 min
hosts/host-web/** (Rust or JS)	full	all shards	≈ 6 min
.github/workflows/, scripts/ (non-SDK)	full	all shards	≈ 6 min
fixtures/, fuzz/, artifacts/**	full	all shards (fuzz.yml also runs on its own filter)	≈ 6 min
Mixed (sdk + crate, docs + scripts)	full (union, fail-safe)	all shards	≈ 6 min
Unknown path, malformed diff, missing base, unexpected rename/copy status, empty diff	full	all shards
workflow_dispatch	full	all shards
push to main (any)	as PR + save-cache: true	as PR; caches saved	≈ +1 min
Fuzz closure paths (crates/{engine,effect-contract,effect-package,lane,math,protocol,session}, fuzz/**, …)	fuzz.yml runs in addition	unchanged, not required	1.5 min

---

4. Target topology

One PR workflow, one required status context, twelve leaf jobs, one aggregate. sdk.yml, browser-qualification.yml, release-build.yml and the ci.yml monolith are retired; fuzz.yml, nightly.yml, npm-publish.yml remain (with the changes in §6).

qualification.yml   (pull_request → main; push → main; workflow_dispatch)
concurrency: qualification-${{ github.event.pull_request.number || github.ref }}, cancel-in-progress: true
permissions: contents: read      (no secrets, no write scopes anywhere in this workflow)

 route (15s) ──┬─ evidence ─▶ docs-gates (10s) ───────────────────────────────────────┐
               │                                                                      │
               ├─ sdk|full ─▶ artifact (build shipped AudioWorklet once, pin-check,   │
               │              upload `audioworklet-<sha>`; ≈2 min warm) ─┬─▶ sdk (≈2m) ┤
               │                                                        ├─▶ browser ×3 (≈1.5m each, cached Playwright)
               │                                                        └─▶ artifact-gates (exports/atomics/kernel ratchet,
               │                                                              resource report, hermetic JS tests; ≈2m)
               │
               └─ full ─┬─▶ lint       fmt → clippy → doc → 30 hermetic policy/mutation scripts → x86 probes (≈3m)
                        ├─▶ test-debug-a   workspace minus DSP minus evidence tools (≈4m)
                        ├─▶ test-debug-b   DSP crates in debug: lane, math, effect-runtime, 9 effects, builtins,
                        │                  dsp-reference, conformance (≈4m)
                        ├─▶ test-release   lane + math (+FMA M3 leg, own target dir) + engine loom + wasm-gates G5/G6
                        │                  + [math-closure] exhaustive sweeps (≈5m; +1.5m with sweeps)
                        ├─▶ audit-native   build audit+bench+capi in release once → every trace/probe/allocation audit,
                        │                  capi ABI (+self-test), graph determinism, builtins fixture check,
                        │                  console fixtures, effect-contract conformance bench,
                        │                  `cargo test --release -p audit -p console-workload` (≈5m)
                        ├─▶ wasm-guests    run-wasm-gates.sh guest legs (scalar+simd128 under wasmtime), wasm realtime
                        │                  atomics, scalar lane wasm build, protocol wasm parity, wasm evidence-crate
                        │                  check (≈3m)
                        ├─▶ cross-target   android/ios/wasm `cargo check` matrix for parametric-eq, builtins,
                        │                  effect-interchange (one script, one cached target dir), effect package/
                        │                  descriptor V1 corpora with one shared wasm `--emit=obj` (≈3m)
                        └─▶ [release-inputs] release-shape: cargo-metadata crate-type/profile policy (5s) +
                                           `cargo check --release --workspace --all-targets` with unwind override (≈3m)

 verdict (required check "qualification")  if: always(), needs: [every job above]
   ├─ route must be success; each job's result must equal the route's expectation (success | skipped)
   ├─ any failure / cancelled / unexpected-skipped / unexpected-success ⇒ fail
   └─ writes telemetry (queue, setup, cache-hit, duration, critical path, attempt) to job summary + artifact

Caches (restore on PR, save only on main):  rust-cache per shard (key: shard + lockfile + toolchain + config +
RUSTFLAGS), npm (sdk lockfile), npm (qualification lockfile), ~/.cache/ms-playwright (lockfile + browser).
Artifacts (per run, never cross-run, never release evidence): audioworklet-<sha>, wasm-gates evidence jsonl,
ci-telemetry.json.

Why one workflow: GitHub paths: filters are workflow-scoped and a required context that stops reporting leaves PRs pending forever. With one always-running workflow and job-level if: there is exactly one required context and it always reports. The three route jobs collapse to one; the artifact is built once and consumed by three jobs by download-artifact (the pattern browser-qualification.yml already uses).

---

5. Sharding of the host job: contents, safety, estimates

Estimates assume a warm rust-cache and a typical runner; "slow" multiplies by ≈1.8. Shard contents are exact lists so the aggregate's completeness check (§7) can be mutation-tested.

Shard	Contents	Why safe to run in parallel with the others	Warm est. (typical / slow)	Cold est.
lint	cargo fmt --check (first, 2s); cargo clippy --workspace --all-targets --all-features -D warnings; cargo doc; all hermetic policy gates + their mutation suites (workspace, session, env-vocab, bench-policy, host-core, protocol-control, realtime + audit-leak + evidence-leak, lane, unfused-seal, rack/builtins/graph policy, native-pcm-runner, conformance-boundaries, effect-runtime policy/fixtures, effect-interchange qualification + policy test, step-vocabulary, console/rack benchmark fixture checks, bench-preconditions, validator mutation suites, realtime-trace-validator test, stem-store static + 3 product tests, delivery-codec boundary); x86 sub-v3 refusal probes	Every gate reads the checkout and writes only to mktemp; clippy/doc use a target dir no test shard touches (check artifacts differ from test artifacts anyway)	3 / 5 min	4 min
test-debug-a	cargo test --locked --workspace --all-targets --exclude <DSP set> --exclude audit --exclude bench --exclude console-workload --exclude wasm-gates --exclude wasm-console --exclude wasm-gate-guest --exclude wasm-console-guest --exclude wasm-gate-corpus with --features builtins-compiler/test-support,source/test-support,graph/test-support,engine/realtime-audit pinned explicitly	Separate runner, separate target dir. Global state inside a cargo test invocation is unchanged from today (test binaries run sequentially; allocator counters are thread-local, §10). Explicit features remove the dependence on unification that currently makes -p runs compile a different program	4 / 6 min (execution ≈ 200s on the slow runner after removals)	6 min
test-debug-b	cargo test --locked --all-targets -p lane -p math -p effect-runtime -p delay -p compressor -p multiband-compressor -p gate-expander -p true-peak-limiter -p transient-shaper -p soft-clip -p parametric-eq -p builtins -p dsp-reference -p conformance --features math/lane	Leaf crates; execution ≈ 190s slow-runner. Keeps every debug_assert and overflow check in the DSP crates (lane 43, true-peak-limiter 29, builtins 16, parametric-eq 14, …)	4 / 6 min	5 min
test-release	One invocation: cargo test --locked --release -p lane -p math -p wasm-gates --features math/lane (G5 native corpus asserts the identical native_report() the script's --native leg prints, so the separate cargo run --native is dropped); then RUSTFLAGS=+fma … --test m3_determinism and the loom leg each in their own CARGO_TARGET_DIR; [math-closure] sweeps	Only profile-distinct claims live here: lane's release-only exhaustive sizes, math's release sweeps and FMA leg, engine's loom model, G6 "in the profile the divergence was measured in", G5 in release for every effect crate's digest pins. Own target dirs for every RUSTFLAGS variant stop fingerprint thrash	5 / 8 min	9 min (wasmtime)
audit-native	cargo build --locked --release -p audit -p bench -p capi; cargo test --locked --release -p audit -p console-workload; audit delay/compressor/parametric-eq/gate-expander --blocks 100000, audit protocol, audit source (release binary, not the debug cargo run at trace-source-audit.sh:8); trace-realtime/builtins/builtins-graph/graph/effect-contract audits; probe mutation tests for all three subjects; check-builtins-fixtures.sh audit half; check-capi-abi.sh and --self-test (capi release link is the shipped-crate link proof, §6.7); check-graph-determinism.sh; check-console-fixtures.sh (session-validator); bench effect-contract --conformance	Needs strace (present on the ubuntu-24.04 image today; must be apt-installed explicitly). Every trace writes to its own dir under target/ci. Running audit's 29 unit tests in release is what removes 470s from the debug path; they are mutation proofs over PCM corpora and gain nothing from debug except 4 debug_asserts in an evidence tool	5 / 8 min	7 min
artifact	build-web-audioworklet.sh (already pin-checks its own sha256 against hosts/host-web/web/…artifact.sha256 and refuses to write on mismatch) → upload-artifact	No other job builds the wasm closure; consumers re-sha256sum after download	2 / 3 min	4 min
artifact-gates (needs artifact)	check-web-audioworklet.sh, check-browser-expected-resources.py --artifacts (includes the oracle and its self-test), test-web-audioworklet.sh; the two native cargo run --release witnesses (parameter-metadata --check, host-web examples)	Reads the downloaded artifact + native builds in its own target dir	2.5 / 4 min	5 min
browser ×3 (needs artifact)	as today minus the redundant matrix --check step; Playwright from cache	Independent engines	1.5 / 2 min	2–8 min (download)
sdk (needs artifact)	npm ci --no-audit --no-fund; check-sdk-generated.sh once, comparing against the JSON documents the artifact job already emitted (so no Rust toolchain in this job); check-sdk-deletions.py + --self-test; check-sdk-types.sh; check-sdk-headless.sh; sdk-package.sh check	Artifact-only after the generated-surface change	2 / 3 min	4 min
wasm-guests	run-wasm-gates.sh guest legs (two wasm builds + wasmtime runner downloaded from test-release as an artifact, or rebuilt if absent), check-wasm-realtime-atomics.sh pointed at the shared wasm-scalar dir, scalar cargo build --target wasm32 of the 18-package list (lane scalar path claim), check-protocol-wasm-parity.sh, wasm cargo check of dsp-reference/conformance at both feature levels	Wasm target dirs only; two RUSTFLAGS variants ⇒ two dirs, both cached	3 / 5 min	6 min
cross-target	One new scripts/check-cross-targets.sh replacing the three target scripts' cargo halves: cargo check android/ios/wasm±simd for parametric-eq, builtins(+compiler), effect-package/effect-compiler; one wasm --emit=obj + wasm-objdump export/SIMD assertion shared by package-V1 and descriptor-V1; the Python reference encoders; test-effect-descriptor-capi.sh once	Read-only over the checkout, one cached target dir per target triple	3 / 5 min	6 min
release-shape [release-inputs]	scripts/check-release-shape.py: cargo metadata asserts the cdylib/staticlib set is exactly {capi, effect-package, host-web, wasm-gate-guest, wasm-console-guest} and [profile.release].panic == "abort"; then CARGO_PROFILE_RELEASE_PANIC=unwind cargo check --release --workspace --all-targets	Metadata-only + check-only; no link	3 / 5 min	6 min
docs-gates [evidence]	check-dsp-research.sh, check-builtins-listening.sh	Read-only	10s

Critical path (full route, warm, typical runner): route 0.3 + max(test-release 5, audit-native 5, artifact 2 → artifact-gates 2.5) + verdict 0.2 ≈ 5.5–6 min; slow runner ≈ 9–10 min. Cold cache (lockfile/toolchain change) ≈ 10–13 min typical. Today: 38 min typical, 44 min with one rerun.

Runner-minutes per full PR: today ≈ 38 + 6.5 + 6.5 + 0.5 + 2 + 3×2 + 3 + 21 + 2 + 0.8 ≈ 85. Target ≈ 3 + 4 + 4 + 5 + 5 + 2 + 2.5 + 3×1.5 + 2 + 3 + 3 + 3 ≈ 41 warm (≈ 60 cold). Public repository, so the cost that matters is wall clock and cache storage, not minutes.

---

6. Gate-reduction ledger

Classification of every current blocking family. "Surviving protection" is named for every delete/consolidate. Costs are measured seconds from run 33836318855 unless marked.

6.1 Rust test profiles

Family	Unique claim	Cost	Signal history	Verdict
Debug workspace tests (--all-targets)	overflow checks, 200+ debug_asserts, every non-DSP behavioural test	1140s (129 compile, 1011 run)	4 flakes/25 runs, all timing/global-state	keep, shard into test-debug-a/b; remove audit, console-workload, wasm-* from it (run in release elsewhere); pin unification features explicitly
Doctests	none: --all-targets disables them and no runnable doc example was found (unverified)	0		delete the implicit expectation; add --doc only if a runnable example ever appears
cargo test --release -p X for effect-runtime, delay, compressor, multiband, true-peak-limiter, transient-shaper, soft-clip, parametric-eq, gate-expander, builtins (10 steps)	none distinct: identical test sets (no cfg(debug_assertions), no profile-conditional pins; digests "pinned from the scalar Lane instantiation", not a profile); the ci.yml rationale (ci.yml:178-184) is a comment about codegen no test asserts	≈ 330s serial	never failed alone	delete. Surviving protection: (a) the same tests in debug under the same +avx2,+fma ISA pin; (b) G5 native corpus in release (tools/wasm-gates/tests/g5_native_corpus.rs:177) renders every one of these crates' corpora against the owning crate's pins in the shipped profile; (c) release audits over the shipped binaries for delay/compressor/parametric-eq/gate-expander/builtins; (d) the unfused-FMA seal, which is the only mechanism by which release codegen could legally change a float result
multiband-compressor release run	the debug build asserts more (lib.rs:1109)	50s		delete with the above; the debug shard is the stronger run
cargo test --release -p lane	release-only exhaustive sizes (g1:30,37, g2:24, g4:19,22)	39s		keep (test-release)
cargo test --release -p math --features lane + FMA M3 leg	M3 pins under a distinct codegen environment	21 + 11s		keep; give the FMA leg its own target dir (today it replaces .cargo/config.toml flags and invalidates the shared dir)
M1 exhaustive, F1 exhaustive (--ignored)	full-domain kernel bounds	43 + 50s	never failed	move: nightly unconditionally; PR only when math-closure (§2)
engine loom leg	SPSC race model	32s		keep (test-release, own target dir)
wasm-gates in debug (workspace run)	none: G5/G6 exist for release	81s		delete from debug; release run kept
G6 in release (cargo test --release -p wasm-gates)	FTZ/DAZ divergence "in the profile the divergence was measured in"	121s (mostly a second wasmtime compile)		keep, consolidate into the single test-release invocation so wasmtime compiles once
tools/audit unit tests in debug	mutation proofs that the fixture checker discriminates (24 corruptions, 24 format mutations, …)	470s (233 on a fast runner)	never failed	move to release in audit-native (cargo test --release -p audit). Lost: 4 debug_asserts in an evidence tool. (Release execution time unverified; estimate 30–90s. If it exceeds 120s, the 24-way mutation loops move to nightly and the PR keeps one representative per mutation class.)
console-workload chain_shape (21 tests)	placement/collapse bit-identity	71s		move to release in audit-native (bench is built there)
builtins-compiler allocation_tracker + scale, graph-compiler scale, session scale_transaction (65 537-track compiles)	scale claims	≈ 125s	1 flake	keep in test-debug-a; redesign tracker (§10)
Wall-clock assertions in non-ignored tests: host-web/src/tests.rs:546 (<1s boot), host-core/tests/prepare.rs:579 (<1s), host-core effect_observation.rs:1005-1018 (ratio + 4×+5ms), effect-package package_allocation.rs:491 (500ms debug/10ms release), engine observation_transport.rs:124-127 (livelock bound)	performance budgets, measured in debug on a shared 4-vCPU runner	trivial	3 of 5 red runs	redesign (§10): keep the deterministic half of each test blocking, move the wall-clock half to a nightly release-mode run that records the number. Surviving protection for the "<1s boot" product claim: nightly release measurement with a hard threshold, plus the deterministic diagnostic-count and allocation-count assertions that stay on PR
Descriptive/print-only tests: compressor/tests/stall.rs, protocol/tests/controller_response_api.rs (compile-only), target-smoke/src/lib.rs:52 (constant vs itself), effect-package/tests/effect_interchange_mutation.rs:322 (ignored, no assert)	none	seconds		delete the first and last (retired issue 046/081 one-shots); keep the compile-only API test (it is a type-level claim at zero cost); rewrite target-smoke's tautology or delete it
21 #[ignore] descriptive benches	none in CI (never run with --ignored)	0		leave; nightly may run the release ones as descriptive evidence

6.2 Host-job script gates (from the script audit; "hermetic" = no cargo, no clock)

Family	Verdict	Reason / surviving protection
Hermetic policy checkers + their mutation suites (workspace, session, env-vocab, bench-policy, host-core, protocol-control, realtime + audit-leak + evidence-leak, lane, unfused seal, rack/builtins/graph, native-pcm-runner ×2, conformance-boundaries, effect-runtime policy + fixtures, effect-interchange qualification + policy test, step-vocabulary, bench-preconditions, rack/console fixture checks, realtime-trace-validator test, wasm-console/console/rack(validator half)/wasm-kernel-timing/protocol validator mutation suites)	keep, consolidate into lint as one ordered step list (fmt first for fastest first failure)	each is a distinct static claim, all 0–8s; the mutation suites are what make them assertions rather than prose
check-delivery-codec-boundary.py + test (cargo metadata + cargo generate-lockfile ×2)	consolidate into check-workspace-policy.sh as a forbidden-name scan of manifests, lockfile and tree; drop the metadata/lockfile legs	#358's claim ("no FLAC crate in the workspace") is a name-absence claim; cargo metadata --locked already runs in the metadata step and --locked fails on a drifted lockfile
check-effect-contract.sh (88s)	split: preconditions + factory-count grep → lint; cargo test lines 8 and 47 → delete (workspace run covers exactly those crates/tests); bench --conformance → audit-native	duplicate cargo work
check-effect-interchange-targets.sh, check-builtins-targets.sh, check-parametric-eq-targets.sh (93 + 27s)	consolidate into one cross-target script with one cached target dir per triple; delete the second qualification run, the duplicate cargo test (line 62) and duplicate test-effect-descriptor-capi.sh (line 63); the rg half of the parametric-eq script → lint	today each uses a fresh mktemp target dir, so every run is cold
check-effect-package-v1.sh (33s), check-effect-descriptor-v1.sh (15s)	consolidate into one step in cross-target: one wasm --emit=obj, one objdump, Python encoders; delete the five precondition re-runs (package-v1.sh:101-105) and the cold scratch cargo test (line 19)	the wasm object build is byte-identical between the two scripts
test-builtins-benchmark.sh (bulk of the 36s validator step)	move to nightly	certifies preflight-builtins-benchmark.sh, which refuses to run unless on branch codex/batch-benchmark-072 (does not exist) and pins issue-035 artifact hashes; keep only its jq validator section on PR if split
test-graph-benchmark.sh	move to nightly	guards a "future" runner (run-graph-compiler-benchmark.sh:2) with zero field-level validator mutations
test-rack-benchmark.sh lifecycle half	move to nightly	reads /proc/cpuinfo and real rustc unstubbed; validator half stays
check-stem-store-v1.mjs --self-test (22 product mutations, each cp -r hosts/host-web)	split: static checks + 3 product tests blocking; mutation ledger nightly; its <5000ms/<2000ms wall-clock asserts (stem-store-core-v1.mjs:911-912) redesigned as in §10	flake risk
check-builtins-listening.sh, check-dsp-research.sh	move to the evidence lane (docs-gates)	doc/packet validators; 033.py pins target/issue110 artifact digests and 111.py pins the sha256 of 033.py
check-console-fixtures.sh, check-builtins-fixtures.sh (hidden debug cargo builds)	move to audit-native using the release binaries; manifest halves → lint	the ci.yml comments calling these "pure grep gates" are wrong
trace-source-audit.sh (cargo run -p audit in debug)	consolidate: ./target/release/audit source after the shared build	a second, debug compile of audit for no claim
run-protocol-allocation-audit.sh, all trace-*-audit.sh, test-realtime-audit-probes.sh ×3 subjects	keep, consolidate behind one release build in audit-native; scripts take the binary path (as trace-realtime-audit.sh already does)	realtime allocation/syscall/lock rules are non-negotiable
check-capi-abi.sh	keep; run its unwired --self-test (8 mutations); build capi in release	becomes the release link proof for the shipped C ABI crate (§6.7)
check-graph-determinism.sh (100 fresh processes)	keep in audit-native	HashMap-order nondeterminism is only observable cross-process
check-host-core-policy.sh:22 host-web exemption "pending #106"	fix	host-web already depends on host-core (hosts/host-web/Cargo.toml:30); the exemption is dead
check-session-policy.sh, check-graph-policy.sh, check-conformance-boundaries.sh, check-dsp-research.sh, check-graph-determinism.sh	keep; flag: no mutation suite. Not a reason to delete; an implementation issue to add one for the first two (siblings have them)
Feature-resolution tree, metadata report (cargo tree, cargo metadata)	delete as steps; cargo metadata moves into the release-shape policy where it asserts something	today they print and assert nothing
x86-probes job	consolidate into lint as three steps	27s, dominated by toolchain install; three distinct refusal claims kept

6.3 Wasm job

Family	Verdict	Surviving protection
check-wasm-realtime-atomics.sh (per-object rlib inspection)	keep (wasm-guests), pointed at the shared scalar target dir	distinct from the linked-module atomics check
Scalar wasm build of 18 packages	keep (lane's scalar wasm path has no other home)
SIMD128 wasm build of 18 packages	delete; keep cargo check --target wasm32 -p target-smoke -p protocol with +simd128	host-web closure is built with +simd128 by the artifact job; protocol is rebuilt by the parity script
wasm-console-guest build	move to nightly as cargo check	it exists so the nightly measurement does not discover a broken input; the nightly is that run
Evidence-crate wasm builds (dsp-reference, conformance, both feature levels)	keep as cargo check	required by the evidence-leak gate's coverage rule (check-artifact-evidence-leak.sh:76 accepts build or check)
build-web-audioworklet.sh + check-web-audioworklet.sh	keep, once, in artifact / artifact-gates
web-audioworklet-browser-correctness.py --check (ci.yml:436)	delete	fully subsumed by check-browser-expected-resources.py --artifacts (same direct-oracle.mjs, asserts every digest before printing)
check-browser-expected-resources.py --self-test (ci.yml:442)	delete	line 439 already runs self_test() (:749)
test-web-audioworklet.sh	keep (artifact-gates; needs no wasm target)
check-protocol-wasm-parity.sh	keep (wasm-guests)	the only wasm-side protocol decode parity
check-protocol-benchmark-wasm-parity.sh	delete	inert: its assertion never executes under --run-all-exports; if the claim is wanted, fix it to -r main -a i32:0 -a i32:0 like its sibling and it costs one small build. Until then it is two whole-workspace fat-LTO wasm builds for a green light (unverified by execution)

6.4 wasm-gates job

Keep the claim, restructure: native leg = G5 test in release (test-release); guest legs in wasm-guests, consuming the wasmtime runner binary uploaded by test-release (or rebuilding it if the artifact is missing, never failing open); detector-residency pin per guest; evidence jsonl uploaded per leg. Safe to shard: pins are compiled into the runner, the guest shape check refuses mismatched sources.

6.5 Browser qualification

Family	Verdict
artifact job	consolidate into the single artifact job
per-browser qualify --check-matrix --self-test-mutations	keep ×3: bit-identical PCM and stall survival per engine are distinct per-engine claims
npm run matrix -- --check	delete ×3: identical to the generated-document gate at run.mjs:378
Playwright install (24–457s)	cache ~/.cache/ms-playwright keyed on hosts/host-web/qualification/package-lock.json + browser + OS; install-deps (apt) stays uncached

6.6 SDK

Family	Verdict
npm ci (1–289s)	keep; add --no-audit --no-fund --prefer-offline; the 289s is a registry stall on a cold setup-node cache (cause unverified; the lockfile has three packages and no install scripts)
check-sdk-generated.sh ×2	keep once; compare against the JSON documents the artifact already contains so the SDK job needs no Rust toolchain (implementation issue)
check-sdk-deletions.py	keep; wire its 37-mutation --self-test
check-sdk-types.sh, check-sdk-headless.sh, sdk-package.sh check, test-sdk-artifact-builder-output-contract.sh	keep; the last joins the SDK path set

6.7 Release build (release-build.yml, 21m31s, not required)

Delete the workflow. Replace with release-shape (§5) on PRs touching release inputs and on every main push, and the full --no-run link proof on nightly. Reasoning: the --no-run step proves "with the unwind override applied, the workspace links in release". The clobber it was created for is prevented by construction by the override, so a green run does not witness the clobber; the inputs of the clobber (which crates carry cdylib/staticlib, [profile.release].panic) are exactly what the metadata policy pins. The cfg(debug_assertions) class the workflow's header says it trades away is empty today. Link-stage coverage for shipped crates survives elsewhere: capi (release build in audit-native), host-web (wasm release in artifact, native release example in artifact-gates), effect-package (wasm --emit=obj in cross-target; native release link (gap, unverified whether any other step links it in release; the nightly link proof covers it)). Every non-shipped fat-LTO test/bench/example link moves to nightly, where a break is found within a day and cannot reach a release because npm-publish qualify rebuilds from source.

6.8 Fuzz, nightly, npm-publish

• fuzz.yml: keep as is (not required, closure-filtered, 96s). Fix the hard-coded evidence counters in run-protocol-fuzz.sh:42-43 (they are constants presented as measurements). Add .cargo/config.toml to its paths:.
• nightly.yml: keep, and it gains: full release --no-run link proof, math sweeps, wasm-console guest check, the moved benchmark-lifecycle mutation suites, the stem-store mutation ledger, the wall-clock budget tests in release with recorded values, the 8-target deep fuzz (unchanged), and a weekly CI-latency report (§11). Still non-blocking, still reports through the failure issue.
• npm-publish.yml: keep; qualify mode continues to rebuild the worklet closure, dist/ and the tarball from source with no cargo cache, and publish/verify operate only on the qualified tgz. Delete the duplicated EXPECTED_WORKLET_SHA256 constant (the pin file is authoritative and the build script already refuses a mismatch), or turn it into a check that the constant equals the pin file.

---

7. Required-check, skip, cancellation, failure and rerun semantics

Required contexts on main: exactly one, qualification (the verdict job's check name). Today's three (engine qualification, SDK qualification, browser qualification) are retired in the order in §12.

Verdict job (if: always(), needs: lists every leaf job):

route.result == success                       else FAIL "router did not run"
route.outputs.route ∈ {evidence, sdk, full}   else FAIL "unknown route"
for each job J with expectation E(route, J) ∈ {success, skipped}:
    needs.J.result == E                       else FAIL "J: expected E, got <result>"

E is a static table in the workflow (not computed in the leaf jobs' if:), so a leaf if: that drifts from the table fails the verdict in both directions: a job that ran when it should not have, and a job that was skipped when it should have run. cancelled and failure never satisfy any expectation. Conditional steps inside a shard (math-closure, release-inputs) are steps, not jobs, so they cannot produce a skipped job result; their skip is recorded in telemetry.

• Skipped workflows cannot occur: the required workflow has no paths: filter. fuzz.yml and nightly.yml are never required.
• Cancellation: concurrency group per PR number (or ref for main) with cancel-in-progress: true. A superseded run's verdict reports cancelled on the old commit only; the new commit gets its own run. Main pushes are also cancelled by a newer main push; the newer commit's run supersedes, and cache save happens on whichever main run completes.
• Failure: every leaf job has timeout-minutes (15 for Rust shards, 10 for others) so a hung runner fails the verdict instead of pending for six hours. Matrix jobs use fail-fast: false so one browser's failure does not hide another's.
• Rerun: "Re-run failed jobs" re-executes only the failed leaf job(s) and the verdict. Artifacts from the original attempt (audioworklet-<sha>, the wasmtime runner) remain available to the rerun, so a failed browser shard does not rebuild the artifact. This is the answer to the Remove in-repository FLAC delivery and prepare Engine-only SDK release #358 incident: a flaky allocation test would have cost one 4-minute shard rerun, not an 11-minute job plus several green jobs.
• Feature-branch pushes never trigger the workflow (push: is main only; pull_request covers branches). Unchanged.
• workflow_dispatch: route full, no cache save unless on main.
• Policy check (check-ci-path-routing.py, extended): the verdict's needs: list equals the set of all other jobs; every leaf has a timeout-minutes; the expectation table covers every (route, job) pair; the workflow has no paths:; permissions are contents: read. Mutation-tested like today.

---

8. Caches, invalidation, fork protections, artifact restrictions

Rust (per shard): Swatinem/rust-cache@v2 with shared-key: <shard>, key: ${{ hashFiles('Cargo.lock','rust-toolchain.toml','.cargo/config.toml') }}-${{ env.RUSTFLAGS }}, save-if: ${{ github.ref == 'refs/heads/main' }}. One cache per shard, never shared between shards (their target dirs differ in profile, features and flags and would thrash). Every distinct RUSTFLAGS gets its own CARGO_TARGET_DIR and therefore its own cache entry. Expected footprint ≈ 8 entries × 0.5–2 GB (estimate; must be measured in stage 0 against the 10 GB repository cap; rust-cache prunes test binaries and the registry to what the lockfile needs). Eviction (7-day LRU) degrades to the cold path, never to a wrong result.

Invalidation inputs (any change ⇒ full miss): lockfile, toolchain, .cargo/config.toml, RUSTFLAGS, shard identity, runner OS/arch. Source changes are handled by Cargo fingerprints inside the restored target dir, which is the same correctness argument as a developer's local incremental build. Main-only saves mean a PR can never write a cache a trusted job later reads.

npm: setup-node cache: npm keyed on each lockfile (exists). Playwright: actions/cache on ~/.cache/ms-playwright, key playwright-${{ hashFiles('hosts/host-web/qualification/package-lock.json') }}-${{ matrix.browser }}-${{ runner.os }}; npx playwright install <browser> is a no-op on hit; install-deps runs always. Toolchain: not cached (20s; rustup download variance is small).

Fork protections: the workflow uses pull_request, never pull_request_target; top-level permissions: contents: read; no secrets referenced; PR-scoped caches are isolated by GitHub (a fork PR can read the base branch's caches but cannot write into that scope) and additionally save-if is main-only; artifacts uploaded by a PR run are consumed only within that run and never by npm-publish; actions pinned by full SHA (as npm-publish.yml already does; ci.yml uses tags). The nightly failure-notice job keeps its issues: write in a separate workflow.

Never reused as release evidence: the shipped worklet closure, sdk/dist, the npm tarball. npm-publish qualify rebuilds all three from source without a cargo cache, and publish/verify take only the qualified tgz by run id + sha. A restored target/ is a build accelerator for PR gates, never an input to an attestation. The AudioWorklet artifact passed between jobs in a PR run is re-hashed against the source pin by every consumer.

---

9. Latency and cost budgets (P50/P95)

Measured baseline (last two weeks, GitHub-hosted): evidence route 23–27s; SDK route 3m0s P50 / 9m58s P95 (cold npm + cold Playwright); full route 38m (P50 of successful PR runs: 2239–2310s) / 44m P95 (with one rerun: 2630s); main push 24–39m; release build 17–22m.

Budget	P50	P95	Derivation
First signal (fmt, policy, router, a compile error)	≤ 90s	≤ 3 min	route 15s + checkout + toolchain 25s + fmt 2s; clippy ≈ 60s
Evidence-only PR complete	≤ 45s	≤ 90s	measured 23–27s today + docs-gates
SDK-only PR complete	≤ 4 min	≤ 7 min	artifact 2 min (74–186s measured build) + sdk 2 min warm
Routine full PR (one crate, warm cache)	≤ 6 min	≤ 10 min	§5 critical path; P95 = slow runner (×1.8)
Full-impact PR (lockfile/toolchain/engine core, cold cache)	≤ 13 min	≤ 20 min	cold test-release ≈ 9 min (wasmtime) is the bound
Main push	≤ 7 min	≤ 12 min	as routine + cache save ≈ 1 min
Release qualification (npm-publish qualify, manual)	≤ 10 min	≤ 15 min	unchanged workload; no cache by design
Nightly	≤ 75 min	—	deep fuzz 26 min + release link proof ≈ 21 min in parallel jobs
False-red rate on full route	< 2%	—	from 20%; §10

The routine P50 is an estimate with two soft spots called out honestly: the release execution time of tools/audit's tests (§6.1) and the warm incremental compile of test-debug-a after an engine change (41 dependents relink ≈ 150 test binaries; estimate 2–3 min, unverified). Stage 0 measures both before the shard boundaries are frozen.

---

10. Flaky and global-state tests (Q9)

Findings from the source audit: every hand-rolled test allocator in the workspace gates on a thread-local armed flag and counts in thread-locals (e.g. soft-clip/tests/allocation.rs:74, transient-shaper/tests/allocation.rs:104-160 proves foreign-thread exclusion). They are safe under cargo test's in-binary parallelism and trivially safe across processes. Three mechanisms explain "fails in the workspace run, passes in isolation":

1. Feature unification. Under --workspace, engine/realtime-audit, builtins-compiler/test-support, graph/test-support, source/test-support, math/lane, effect-package/c-abi are on for every crate; under -p X they may be off, so the isolated run compiles a different program (audit scopes armed, prepare_session_builtins taking a mutex and recording layouts). The fix is in §5: every shard invocation names its features explicitly, and the local reproduction command in the failure message must too.
2. Process-global layout table in builtins-compiler (src/lib.rs:931-933, TEST_PHASE_TWO_ACTIVE + Mutex<…LayoutTable>), armed inside prepare_session_builtins. The Remove in-repository FLAC delivery and prepare Engine-only SDK release #358 failure shows four extra retained layouts (48, 96, 148/16, 608 bytes) on the observed side only — first-touch allocations (lazy std/thread state) that landed inside the armed window on that runner and not on others. Redesign: measure the second prepare in-process (warm-up then measure), attribute by thread id in the table, and assert observed == reported on the steady-state run. Keep the exact-equality assertion; it is the claim. Add the missing test-support feature to the shard command so the test cannot silently compile to zero tests under -p.
3. Wall-clock and scheduler assertions in debug on shared runners (§6.1 list). Redesign: split each test into (a) the deterministic counting half (resident reads, diagnostic line counts, allocation counts), which stays blocking, and (b) the timing half, which becomes #[ignore] and runs nightly in release with the number recorded and a threshold that is a product budget (e.g. boot < 1s in the shipped profile), not a debug-build guess. For observation_transport, drop the "coarse livelock bound" and keep torn == 0, regressions == 0, newest == WINDOWS; the seqlock's correctness claim does not depend on how often the reader won.

Nothing here weakens an assertion: each redesign keeps the exact claim and removes the dependence on runner scheduling. The 1.8× runner variance makes any debug-mode wall-clock assertion a coin flip at P95.

Global state that stays and is fine: MXCSR writes are per-thread with drop guards; temp dirs are pid-unique; env vars are read-only re-pin switches CI never sets; bench-support's process-global MODE is set idempotently. Conformance tests in bench-support-linked binaries abort the whole binary on an armed allocation (alloc.rs:96); that is intended, and sharding does not change it.

---

11. Observability (Q10)

The verdict job (the only job that declares actions: read; every other job stays at contents: read) runs one script after evaluating expectations: it reads runs/<id>/jobs, computes per job queue = started_at - created_at, setup (time to the first non-setup step), execution, cache_hit (each shard exposes rust-cache's cache-hit output as a job output), and the run's critical path; records route, attempt number, runner variance proxy (clippy seconds), and writes ci-telemetry.json as an artifact and a Markdown table into the job summary. The nightly workflow gains a ci-latency-report job that aggregates the last 7 days by route into P50/P95 tables, flake rate (attempt > 1, and first-attempt failures whose rerun passed), cache hit rate, and appends the table to the nightly issue if any budget in §9 is exceeded on the week. No external service; the repo already treats its issue list as the dashboard. GitHub's org-level Actions usage metrics are the cross-check.

---

12. Staged migration and rollback

Invariant at every step: the set of required contexts on main never shrinks before its replacement has reported on at least 10 PRs, and never is empty.

Stage	Change	Required contexts	Rollback
0	Inside the existing workflows only: rust-cache on host/wasm/wasm-gates; Playwright and npm flags; delete the inert/duplicate steps (§6.3); own target dirs for RUSTFLAGS variants; flaky-test redesigns (§10); explicit features. Measure audit release test time and warm incremental compile.	unchanged (3)	revert the commit; nothing structural moved
1	Add qualification.yml with all shards and the verdict, not required. Old workflows keep running. Run both for ≥ 10 PRs; compare verdicts and telemetry; run §13 mutations on a scratch branch.	unchanged (3)	delete the file
2	Add qualification to required contexts (now 4). Main is strictly more protected.	4	remove the new context
3	After ≥ 10 PRs with 4 contexts agreeing: remove the three old contexts, then delete ci.yml, sdk.yml, browser-qualification.yml, release-build.yml in the same PR that updates the routing policy checker.	1	re-add the three contexts (their workflows are restored by reverting one commit; while reverted, PRs simply need all four again)
4	Nightly additions (link proof, sweeps, moved suites, latency report).	1	revert
5	Optional, data-driven: shard-level closure pruning, larger runners for test-release, or splitting test-debug-a further, only if §11 shows the critical path is still above budget.	1	revert

Branch-protection edits are made by the owner through the API with the exact contexts list recorded in the implementation issue, before and after, so a rollback is a copy-paste.

---

13. Adversarial validation plan

Executed on a scratch branch against the stage-1 workflow before stage 2; each row must produce the stated observable.

Mutation	Expected observable
PR touching docs/x.md only	route evidence; every Rust/browser/sdk job skipped; verdict success
PR touching docs/x.md + crates/engine/src/lib.rs	route full; all shards run
Rename sdk/a.ts → sdk/b.ts (R100)	route sdk; C/R status parsed, both names classified
Copy LICENSE into sdk/ (the #328 copy case)	route full
Force github.event.before to 40 zeros (first push)	route full
Add a path family to the router without the checker/paths-ignore update	routing policy check fails in route
Remove one job from the verdict's needs:	routing policy check fails
Set a leaf job's if: to always false	verdict fails with "expected success, got skipped" on a full PR
Set a leaf job's if: to always true	verdict fails with "expected skipped, got success" on an evidence PR
Inject panic!() into one test in test-debug-b	only that shard red; "Re-run failed jobs" re-runs one shard + verdict; artifacts still downloadable
kill -STOP a shard's cargo (simulated hang)	job times out; verdict fails; nothing pending
Corrupt the restored cache (truncate a .rlib)	Cargo rebuilds the unit; verdict unaffected; telemetry shows cache-hit true but longer compile (the risk to document, not to accept silently)
Change one byte of Cargo.lock	every rust-cache key misses; cold timings within the §9 full-impact budget
Open a PR from a fork with a modified qualification.yml that adds save-if: true	cache saved only under the PR's scope; main's next run restores its own entry; verify by key listing
Tamper one byte of the uploaded host_web.wasm between artifact and browser jobs (test-only step)	browser, sdk and artifact-gates all fail the sha256 pin compare
Change [profile.release].panic to unwind	release-shape policy fails on a manifest PR
Add a cdylib crate-type to a fourth crate	release-shape policy fails
Flip a digit in hosts/host-web/web/…artifact.sha256	artifact job refuses to upload; three consumers skipped-by-dependency; verdict fails
Push a second commit while the first run is in flight	first run cancelled; only the second reports; PR mergeability follows the second
Run test-debug-a ten times on the same main commit	zero failures (flake gate before stage 2)
Set RUST_TEST_THREADS=1 in one shard	identical pass/fail set (no order dependence)
Delete the strace install step	trace audits fail loudly (script hard-exits), not silently pass

---

14. Bounded implementation issues, in dependency order

1. Telemetry + measurement baseline (stage 0): verdict-side telemetry script and a one-off measurement of cargo test --release -p audit -p console-workload and of warm incremental compile after an engine edit. Everything below is sized by this.
2. Rust/Playwright/npm caching inside the existing workflows, main-only save, own target dirs per RUSTFLAGS variant, pinned action SHAs.
3. Delete the inert and duplicate steps (§1.3, §6.3): protocol-benchmark wasm parity, browser-correctness --check, expected-resources --self-test, matrix --check ×3, second check-sdk-generated.sh, cargo tree/cargo metadata print steps, ten per-crate release re-runs, wasm-gates from the debug run, SIMD128 18-package build. Each deletion names its survivor in the PR body.
4. Flaky-test redesigns (§10): allocation tracker warm-up, five wall-clock splits, observation_transport bound, explicit features in every cargo invocation.
5. Script consolidation: check-cross-targets.sh (three target scripts + shared wasm object for package/descriptor V1), check-effect-contract.sh split, audit-binary argument for trace-* scripts, trace-source-audit.sh release binary, delivery-codec boundary folded into workspace policy, check-capi-abi.sh --self-test + release build, check-sdk-deletions.py --self-test, host-core policy exemption removal, sweep.sh comment cleanup.
6. check-release-shape.py (metadata policy + cargo check --release with override) and its mutation tests.
7. Router extension: math-closure and release-inputs outputs; test-sdk-artifact-builder-output-contract.sh into the SDK set; dsp-research/**/*.md into evidence; policy checker + tests updated; paths-ignore lists synchronized.
8. qualification.yml with all shards, the static expectation table, timeouts, the verdict, and the extended routing policy checker (needs completeness, no paths:, permissions). Runs non-required (stage 1).
9. Adversarial validation run (§13) on a scratch branch; results attached to the issue.
10. Branch protection stage 2 → 3 with the exact before/after contexts recorded; workflow deletions.
11. Nightly additions: release link proof, math sweeps, wasm-console guest check, moved mutation suites, wall-clock budgets in release, latency report, run-protocol-fuzz.sh counters.
12. Follow-ups the audit surfaced but that are out of this design's scope: mutation suites for check-session-policy.sh and check-graph-policy.sh; orphaned fixtures/effects/v1/; scripts/fixtures/abi-layout-v1-self-test.json duplicate; tools/parameter-metadata/tests/abi_layout.rs:410 string-scraping a shell script; the four uncalled effect-interchange test suites.

---

15. Uncertainty register

• tools/audit unit-test time in release: estimated 30–90s, unverified; if it exceeds 120s the mutation loops split as described in §6.1.
• Warm incremental relink of test-debug-a after an engine change: estimated 2–3 min, unverified; it bounds the routine P50.
• Cache footprint versus the 10 GB cap: estimated 4–12 GB across shards; if it does not fit, test-release and wasm-guests share the rust registry cache and keep separate target caches, or the two debug shards merge.
• check-protocol-benchmark-wasm-parity.sh inertness is argued from the sibling script's documented wabt behaviour, not executed.
• Whether cargo check --release --all-targets needs the unwind override at all (rmeta filenames are hashed).
• The 289s npm ci cause.
• wasmtime runner artifact reuse between test-release and wasm-guests: if upload/download proves fragile, wasm-guests builds its own runner (+2 min cold, cached after).
• Whether any gate's purpose I classified as "consolidate" carries a claim its author considers profile-specific. The candidates are the ten per-crate release re-runs; the case for deletion rests on G5-in-release and the unfused seal, and Sol should attack exactly that argument first.

[tamashi095]

Test-usefulness ledger for #359: what every test in the workspace is actually protecting

1,550 Rust tests audited across 40 crates and tool packages, plus 80 non-Rust test/gate rows (sdk, host-web JS, browser qualification, script self-tests, fuzz targets, fixture consumers).
Verdicts: keep ~1,140 · merge-or-trim ~300 (+5 move to the right crate) · nightly-or-release-only 27 · delete ~106.
Estimated saving on one debug workspace run: 660 to 1,370 seconds (11 to 23 CPU-minutes), plus roughly 2 to 6 minutes of CI job time per PR on the non-Rust side, dominated by four hidden native cargo run invocations inside node and bash tests.
Three structural moves with the widest reach: (1) tools/audit renders generated() once (memoised) and calls stage functions for post-oracle mutations instead of rendering five times and re-running the oracle 22 times (233 to 470 s becomes 25 to 40 s); (2) collapse the nine per-effect-crate digest-pin tests and G5's native pin test into one owner (the three reports disagree on which side is the owner, see Uncertainties); (3) fix the conformance harness continuation probe so it compares latency + quantum samples instead of 4 samples at offset 2, which today makes it vacuous for every effect with latency above 6 samples, then arm reset / snapshot / restore / process_bank so the four hand-rolled allocator files collapse onto bench_support.
This ledger is consistent with the CI design already posted on this issue: it assumes the release shard already owns tools/audit, console-workload and wasm-gates, that the ten per-crate release re-runs are gone (so the DSP report's "doubled by the release leg" figures should be read single-leg), and that the five named wall-clock assertions are already nightly. The audits found at least four more wall-clock assertions the design's list does not name.

---

Totals

crate / scope	tests	keep	merge/trim	nightly or release-only	delete	est. debug s saved
engine	37	33	4	0	2	3–5
lane	34	24	8	2	3	12–18
math	42	27	12	8	1	20–35
session	52	30	12	1	9	40–75
source	58	40	10	1	7	2–30
protocol	132	99	21	1	11	60–170
capi	32 (+2 C)	22	9	0	1	8–15
target-smoke	2	0	0	0	2	0
dsp-reference	25	17	7	0	1	<1
conformance	23	13	8	0	1	<1
effect-contract	40	36	4	0	0	<1
effect-runtime	85	73	9 (+2 move)	0	3	1.5–2.5
parametric-eq	59	46	10	1	3	~30
compressor	63	42	15	0	— (stall.rs plus the named tests)	4–7
multiband-compressor	39	29	6	0	4	30–80
delay	16	13	2	0	1	5–15
gate-expander	27	20	5	0	2	2–5
true-peak-limiter	39	34	3	0	2	5–10
soft-clip	27	19	6	0	2	3–8
transient-shaper	22	17	3	0	2	<1
effect-compiler	50	34	11	0	5	10–30
effect-package	88 (+1 C)	63	14	2	9	~0.5
tools/audit	29	20	5	0	4	200–430
rack	34	30	3	0	2	≈0
rack-compiler	13	11	2	0	0	≈0.2
host-core	66	54	9	1	4	8–15
builtins	71	60	11	3 (release-only)	3	20–35
builtins-compiler	28	22	5	1 (release-only)	2	45–85
graph	45	36	7	0	3	8–15
graph-compiler	74	~48	~24	2 (1 release-only, 1 nightly)	2–3	60–100
hosts/host-web (Rust)	60	48	10	1 (release-only)	1	3–6
tools/wasm-gates	9	4	2	2 (release-only)	1	38–81
tools/parameter-metadata	10	5	3	0	2	≈0
tools/session-validator	9	5	3	0	1	<1
tools/console-workload	28	18	9	0	1	30–45
tools/bench	29	22	4	0	6	6–18
tools/bench-support	23	16	6 merge-or-delete (report does not split them) + 1 rewrite	0	—	≈0
tools/native-pcm-runner	19	9	11	0	1	1–2
tools/stem-hasher	11	4	7	0	0	≈0
hosts/host-native, hosts/host-mobile	0	—	—	—	—	0
non-Rust (sdk, host-web JS, qualification, script self-tests, fuzz, fixtures)	80 rows (not test counts)	49	17 (12 trim, 5 merge)	4	10	≈120–360 CI job s
total (Rust)	1,550	~1,140	~300 (+5 move)	27	~106	≈660–1,370

Notes on the total row: the compressor delete count is not stated numerically in its report (arithmetic implies 6, not asserted here); tools/bench-support reports "merge/delete 6" without splitting the two; graph-compiler reports "delete 2–3" and approximate keep/merge/trim counts. The Rust total therefore carries roughly six units of slack, all in the delete column. Non-Rust rows are gate rows, not individual assertions, and its seconds are CI job wall-clock, not workspace debug seconds, so they are not added into the Rust total.

---

Top 25 actions by value

1. tools/audit: render generated() once (memoised in a OnceLock) and call stage functions for post-oracle mutations. tools/audit/src/fixture_builtins.rs:5196-5614 (five generated() renders, 22 independent oracle passes). 200–430 s (233–470 s becomes 25–40 s). Surviving protection: the read-only checker pass, one memoised production render for issue067's baseline, one end-to-end post-oracle mutation through check_fixture_root to prove nothing short-circuits, all six semantic-hole cases, and three manifest-stage cases in place of eighteen.
2. sdk: drop the in-test cargo run from render-evals.mjs and agent-evals.mjs. sdk/test/render-evals.mjs:31 (host-web --example sdk_render_oracle three times), sdk/test/agent-evals.mjs:42 (parameter_metadata_lattice_oracle). 60–180 s cold on the SDK job (unverified). Surviving protection: one document with a fixture-pinned native digest; native-versus-wasm parity is already gated by run-wasm-gates.sh and check-protocol-wasm-parity.sh.
3. protocol: trim mutation_million to 10,000 runs by default and put the 1,000,000 form behind #[ignore] in nightly release. crates/protocol/tests/mutation_million.rs:9. 60–170 s (unverified). Surviving protection: the four libFuzzer protocol_* targets drive the same decoders from the same corpus nightly; also delete the dead LimitExceeded branch at :58 or make one seed exceed the limit.
4. graph-compiler: trim the 64-track console render counts across src/lib.rs. 100 in-process repeats to 2 (L9940), 10,000 mutations to 1,000 (L10086), 100 seeded layouts to 27 (L9061), block counts 16/12 to 10 and 32 to 8 (L3221, L3680, L3931, L4008, L4400, L6550, L6794), and drop the six launch_* cap-rejection boilerplate arms keeping the limiter and soft-clip as representatives. 40–70 s (unverified). Surviving protection: scripts/check-graph-determinism.sh runs 100 fresh processes, which is the stronger determinism gate; every layout field is asserted per layout.
5. wasm-gates out of the debug leg. tools/wasm-gates/tests/g6_full_corpus_ftz.rs release-only (five full renders, L122/129/138/163/166), merge the identity test at L159 into the main one (5 renders becomes 4). 38–81 s. Surviving protection: ci.yml:481 already runs the crate in release, plus run-wasm-gates.sh:31 --native. Already covered by the posted design's move of wasm-gates to the release shard.
6. multiband-compressor: delete tests/lr4_two_section_mapping_f64.rs (both tests) and trim the crossover flatness grid. Flatness probes 61 to 5 per config (20 Hz, fc/2, fc, 2fc, 0.45fs), rates to {44.1k, 96k} at tests/crossover.rs:84-115. 30–80 s, the largest of any effect crate. Surviving protection: crossover.rs:55 proves production lr4_step against the same f64 oracle; the f64 file's own mutation rows mutate the test file, not production; dsp-reference's LR4 gates keep the analytic identity. All three recorded mutations fail at any probe near fc.
7. console-workload: BLOCKS 64 to 16 file-wide and collapse the three 16-workload sweeps into one build-once sweep. tools/console-workload/tests/chain_shape.rs:353, :836, :1047; folded-master 30 builds to 4 representatives at 8 blocks (L797). 35–62 s becomes 12–20 s. Surviving protection: the count claims themselves, unchanged, at 16 blocks; rack/tests/mono_reengage.rs isolates the same collapse mechanisms at ≤40 blocks of 4 lanes.
8. test-web-audioworklet.sh: drop the three hidden native cargo builds. cargo run -p host-web --example worst_boot_document in check-web-boot-budget.mjs and three cargo run -p parameter-metadata invocations. 30–120 s on the browser-probes job (unverified). Surviving protection: emit the worst-boot document once into the artifact dir at build time; check-parameter-metadata-v1.py --self-test already carries 33 in-memory mutations and tools/parameter-metadata/tests/round_trip.rs:184 covers the refusal half.
9. session: src/value.rs:86 ten million f32 spellings to one million with recomputed pins, or nightly. 30–60 s (unverified). Surviving protection: the ignored exhaustive_f32_round_trip (:169) proves the fallback population over all 2^32; :65 keeps the directed signed-zero and double-rounding spellings.
10. parametric-eq: tests/time_domain.rs:141 million-sample stability to nightly (release, recorded) with a 4-row debug representative. ~25 s. Surviving protection: E5 contractivity, the flush test at :99, and E3; no recorded mutation is red only here.
11. builtins: tests/response.rs DFT once per (rate, cutoff, kind), quanta {1, 1024}, extended rates to nightly, L790 stride 4,096 plus endpoints, L82 10,000 to 1,000, then release-only for L207/L266/L332. 18–37 s. Surviving protection: partition invariance is bit-gated by stage.rs:425; the file itself calls the extended rates "informational, not a support claim" (L34-35); the release leg already exists.
12. builtins-compiler: tests/allocation_tracker.rs tracks [1, 4, 65_537] to [1, 4]. L161-163. 18–41 s becomes under 2 s. Surviving protection: layout-class equality is count-invariant and 4 tracks already exercise the linear Vecs; the 65,537 row is pinned by fixtures/builtins/v1/resources.jsonl through tools/audit and by scale.rs.
13. builtins-compiler: tests/scale.rs 65,537-track compile to release or nightly with an optional 4,097-track debug smoke; delete the constrained re-prepare (L59-72). 22–42 s. Surviving protection: the one-below state-cap rejection is asserted at src/lib.rs:4508; 65,537 = 2^16 + 1 cannot be shrunk for the "no u16 ceiling" claim itself, so only its placement moves.
14. graph-compiler: tests/scale.rs to 10,923 tracks (76,463 nodes, 65,540 edges, crossing 65,536 on both counts) and drop the constrained arm. ~6x cheaper, from 22–42 s. Surviving protection: tools/bench/src/graph.rs:213 graph_validate_65537_tracks compiles the identical fixture in release; the cap rejection is asserted seven times in src/lib.rs.
15. math: merge the three m3_determinism.rs corpus passes into one pass over run_case. m3_corpus_digests_match_pins (:142), m3_corpus_is_nan_free, m3_corpus_exercises_each_domain each recompute 32 cases of 1,000,000 points. 15–25 s. Surviving protection: identical assertions, one traversal instead of three.
16. delay: src/lib.rs:2201 partition invariance to {reference 512, block 1, chunk cap 1}, dropping 7/64/128. 10–30 s (unverified; 7 renders of 96,000 frames at quantum 512). Surviving protection: block size 1 covers every boundary and M7a-c are all recorded red at block size 1.
17. effect-compiler: tests/native_session.rs:232 ten thousand identical seeds to three (24.0, 24.01, f32::MAX). All 10,000 seeds are identically out of [-24, 24]. 10–30 s. Surviving protection: domain rejection is also asserted in effect-contract; :164, :195, :213 keep the transactional claims.
18. graph: src/program.rs trim both 4,000-graph corpora to 1,000 and turn the seven exact corpus-count pins into >= bounds. L2182, L2336. 8–20 s (unverified). Surviving protection: the symbolic-interpreter oracle is the sole home of this claim and is unchanged; only the corpus size moves.
19. session: tests/scale_transaction.rs:18 drop the 65,537-track compile, keep the cap=1 rejection and estimate.track_count at n≈4,097. 5–20 s (unverified). Surviving protection: graph-compiler/tests/scale.rs:28 and builtins-compiler/tests/scale.rs:34 both compile a 65,537-track session. Note the posted design keeps this test in test-debug-a; see Uncertainties.
20. soft-clip: tests/polyphase_identity.rs six structured cases from 100,000 to 8,000 samples, keeping the four noise cases at 100,000. 5–15 s (unverified). Surviving protection: recorded mutation row 2 first separates at sample 64,603, which only the noise cases reach.
21. lane: tests/input_chain_elision.rs:291 collapse 256 pattern/shape pairs to the 81 distinct cases and drop the second seed. The shapes bit for a disabled section is a no-op. 5–15 s, roughly 6x cheaper. Also trim :428 from 256 sign assignments to the 8 single-word cases plus all-eight. Surviving protection: identical coverage; the plan decides per section and inertness is per word.
22. true-peak-limiter: tests/gain_law.rs E4 from 1,152 configurations to 288. Rates {44.1k, 96k}, ceilings {-1, -12}, lookaheads {0, 1 (W_MIN clamp), 10}, both releases, all six corpora. 5–10 s. Surviving protection: every retained axis keeps its boundary values; E5's oracle tracking at 1e-4 is untouched.
23. host-core: tests/effect_observation.rs:864 split the cost-class test. Timing half to nightly, delete the deterministic half. 4–8 s. Surviving protection: the deterministic half exercises a transcribed copy of publish_observations (L910-919), so no production mutation can fail it; the eight retained observation tests carry the real per-lane reduction claims.
24. Collapse the nine per-effect digest-pin tests and G5's native pin test into one owner, and delete the three print_pins/print_digests regen twins. effect-runtime/tests/determinism.rs:39, parametric-eq :34, compressor cross_target.rs:43, multiband cross_target_digest.rs, gate-expander :30, limiter determinism.rs, soft-clip :34, transient-shaper cross_target.rs:70, delay :27, versus tools/wasm-gates/tests/g5_native_corpus.rs:21. Structural: removes nine duplicate render paths and seven MISO_ENGINE_REPIN_* env-var branches that silently skip the pin compare. Surviving protection depends on which side is chosen as owner (the reports disagree; see Uncertainties). Either way the per-family finiteness and non-vacuity checks must be kept, because has_lane_values (wasm-gate-corpus/src/lib.rs:480) excludes delegated families from G5's vacuity checks.
25. Fix the conformance harness continuation probe and arm the unarmed entry points. crates/conformance/src/effect.rs:1440-1470 compares 4 samples at offset 2, which is vacuous for compressor (882/960), multiband (960), gate-expander (480), soft-clip (31) and the limiter; make it continue for latency + quantum. Then arm reset, snapshot_state_payload, restore_state_payload and a bound bank's process_bank inside armed_process (:730-770). Structural, strengthens rather than removes: it makes about seven per-crate "idle restore continues bit-exactly" copies genuinely redundant and lets the four hand-rolled ~70-line allocator files (soft-clip, transient-shaper, true-peak-limiter, multiband) collapse onto bench_support::alloc.

Two more that are pure CI-time rather than test-time: drop the six-of-eight bounded per-PR fuzz runs from fuzz.yml keeping workflow_dispatch (≈48 job-seconds plus the cargo-fuzz and nightly-toolchain install; surviving protection is the nightly 180 s per target plus session/tests/fuzz_smoke.rs and protocol/tests/mutation_million.rs), and run the browser-independent qualification proofs once instead of three times (run.mjs mutationProofs, artifactSetProofs, validateLineage, playwright-version and generated-document checks; ~2–6 s across the matrix).

---

Cross-cutting patterns

• Tautologies and print-only tests (delete). tools/audit/src/source.rs:463, builtins/tests/speed.rs, graph/src/lib.rs:2450 and :2463, bench/src/conformance.rs, bench/src/floor.rs:504, bench-support/src/stats.rs:65, host-web/src/tests.rs:2904, parameter-metadata rendering_is_deterministic, session-validator the_report_is_deterministic, builtins-compiler/tests/builtin_automation_targets.rs:94, engine/src/lib.rs:116 and :121, session/tests/invalid_matrix.rs:1158 and :1198, math/tests/f1_fast_db_bounds.rs:627, target-smoke/src/lib.rs:47, source/src/native_source.rs:3930, compressor/tests/stall.rs, multiband/tests/descriptive_frame_cost.rs, multiband/src/split.rs:833, parametric-eq/tests/bank.rs:488, true-peak-limiter/tests/bench.rs, soft-clip/tests/descriptive_bench.rs, effect-package/tests/effect_interchange_mutation.rs:318. None of these can fail on a production change.
• Source-text scrapes (include_str! of sibling or foreign files). source/src/lib.rs:1720, :2197, :2379; source/src/native_wave.rs:1193; source/src/native_source.rs:1790, :2608 (lints another test's body), :2673, :4036; capi/src/ffi.rs:2441; tools/audit/src/builtins_graph.rs:845 and capi.rs:328 (concat!-split tokens, replaceable by a clippy::disallowed_methods entry the repo already has a mechanism for); tools/audit/src/builtins_fixture_check.rs:538; parameter-metadata/tests/abi_layout.rs export-set test (scrapes check-web-audioworklet.sh); session-validator/tests/skill.rs (scrapes .claude/skills); host-core/tests/track_delay.rs:191 (scrapes JSON the helper itself wrote); effect-package/tests/state_vectors.rs:889; effect-compiler/tests/migration.rs:1053 and migration_terminal.rs:1644. The reverse direction also exists: check-effect-interchange-benchmark-108.sh:37-50, check-native-pcm-runner.sh and check-effect-interchange-qualification.sh:142 scrape test source instead of running the test.
• Env-var reads inside tests. math/tests/m2_lane_identity.rs:184 (MISO_ENGINE_MATH_PIN, prints and returns green without asserting, while m3_determinism.rs:143 reads the same var and fails closed), session/src/canonical.rs:~362 (MISO_ENGINE_UPDATE_CANONICAL_WRITER_CORPUS, writes into the repo), seven MISO_ENGINE_REPIN_*_CORPUS reads across the effect crates that skip the pin compare, native-pcm-runner/src/lib.rs:1528 (MISO_ENGINE_REPIN_NATIVE_PCM_RUNNER, outside the documented family), graph-compiler/src/lib.rs:2852 (MISO_ENGINE_AUDIT_037 hides a 100,000-block render inside a normal test), builtins/tests/determinism.rs:35, bench-support/src/metadata.rs:450 (live PATH), sdk/test/builder-evals.mjs:36 (MISO_ENGINE_SDK_SKIP_ASSET, set by nothing).
• Hidden global state. #[global_allocator] in twelve places, ten of them single-binary and safe; the two that are not are builtins-compiler's process-global TEST_PHASE_TWO_ACTIVE plus Mutex<LayoutTable> (src/lib.rs:931-933), linked into every workspace test binary via graph-compiler/Cargo.toml:28, and bench-support's process-global MODE (alloc.rs:158). Also: protocol's test-only thread_local! counters woven into production paths (btlv.rs:23, typed_frame.rs:21, controller.rs:13-19), MXCSR writes in lane/tests/fp_env.rs, lane/tests/g6_ftz_inert.rs and host-core/tests/fp_environment.rs (drop-guarded, per-thread), and source/src/native_source.rs:2076, which requires exactly one thread named source process-wide via /proc/self/task while about twenty sibling tests spawn workers in parallel: flaky by construction.
• Arch-coupled vacuous skips. About thirty bank tests across parametric-eq, compressor, gate-expander, true-peak-limiter, transient-shaper and effect-compiler return silently on a non-x86 or scalar-only host and pass green without asserting; nineteen graph-compiler console tests do the same; builtins-compiler/src/lib.rs:4301 compares scalar to scalar on a scalar host. In the other direction, bench/src/rack.rs:126 and four chain_shape.rs pins assert 8-lane constants and fail outright on aarch64. soft-clip/tests/lane_identity.rs's trailing assert!(bank_available…) is the pattern to copy.
• Names that over-promise. engine/src/realtime/mod.rs:145 (…drops_once… never asserts a drop count), session/src/lib.rs:66 compile_is_transactional_and_non_publishable (asserts only is_err()), the four invalid_matrix "N distinct cases" tests (assert only a counter), math f1_the_container_pins_exactly_six_crossings (counts function names), source/src/lib.rs:2170, native_wave.rs:1465, native_source.rs:2403, :3778, :3930, capi/src/runtime/tests.rs:389, protocol/tests/mutation_million.rs:12, session_wire.rs:1971, typed_frame.rs:1517, controller.rs:3852, conformance/tests/effect_contract.rs:263 ("ten thousand mutations" is ten distinct), effect-contract/tests/observation_lane.rs:254 ("formula", asserts > 0), gate-expander/tests/contract.rs:200 (renders production but asserts only on the reference model), console-workload every_standing_workload_folds_one_route_per_track (two rows fold zero) and no_workload_transitions_unless… (vacuous on 13 of 16 rows), rack-compiler program_comparison_is_a_total_order (three comparisons prove no total order).
• Wall-clock assertions in debug. The five named in the posted design (host-web/src/tests.rs:546, host-core/tests/prepare.rs:579, host-core/tests/effect_observation.rs:1005-1018, effect-package/tests/package_allocation.rs:491, engine/tests/observation_transport.rs:124-127) plus at least four the design does not name: source/src/native_source.rs:2076 (two 500 ms sleeps, 10 s waits, /proc census), sdk/test/boot-evals.mjs:189-217 (<1000 ms), hosts/host-web/tests/stem-store-core-v1.mjs:911-912 (<5000/<2000 ms) and :325-330 (<100 ms abort against a 300 ms race, flake risk), lane/tests/b1_speed.rs and b2_interleave.rs (already #[ignore], belong in tools/bench).
• Dead in CI (feature-gated). source/src/native_source.rs:2143, :2444, :2506 and the layout block at :2315 compile only under source/test-support, which ci.yml:70 never enables, so the only behavioural coverage of exact-frame seek resume and back-pressure coalescing never runs; engine/src/realtime/audit.rs:213 runs only when realtime-audit is unified in from another crate (unverified for the CI invocation); builtins-compiler/tests/allocation_tracker.rs:4 is #![cfg(feature = "test-support")] and compiles to zero tests under a bare -p builtins-compiler.
• Stale MUTATIONS.md references. crates/graph/tests/MUTATIONS.md names M5, M6, M8 (_in_both_executors) and 218-4 (the_folded_master_is_the_reductions_own_bits), none of which exist in that crate any more (218-4 lives only in console-workload); tools/wasm-gates/MUTATIONS.md says 331 digest comparisons where the corpus now has 337 (unverified); multiband-compressor/src/split.rs's twelve tests have no recorded mutation rows at all (unverified red).
• Orphan fixtures. fixtures/capi-qualification/v1 (13 files, consumed by nothing since the qualification scripts were deleted in f0509c3; only docs/C_ABI_V1_QUALIFICATION.md cites it), fixtures/effects/v1 (3 placeholder files plus a manifest, referenced by nothing since the initial checkpoint), fixtures/rack/v1 (4 files read only by graph-compiler/src/bin/rack_fixture.rs, which no script or workflow runs). Also scripts/fixtures/abi-layout-v1-self-test.json is byte-identical to sdk/assets/miso-engine-v1-abi-layout.json, so the checker's self-test can go stale silently.

---

What is NOT recommended for deletion, and why

• The G5 and G6 claims themselves. Every verdict about the digest-pin family is about where the pin lives, never about dropping it. g5_delegated_cases_use_the_owning_crates_pins, the lane corpus at all three widths, lane_fma unfusedness, and G6's proof that a caller's FTZ and DAZ never reach a guarded render all stay; G6 only changes profile (release-only), where its own documentation says the divergence was measured.
• The conformance harness. All eight effect crates' tests/conformance.rs stay, and the harness is the one thing the audit proposes to strengthen (continuation probe, armed reset/snapshot/restore/process_bank, an optional bank-binding probe). crates/conformance/tests/effect_contract.rs:187 every_faulty_mock_is_detected, which proves the harness detects all 22 faulty mocks, is kept as-is.
• The C ABI proofs. crates/capi/tests/c/abi_smoke.c and header_smoke.cpp stay, and so do both Rust-side pins (abi.rs:429, :466): they are complementary halves of a Rust-equals-header-equals-C proof, not duplicates of each other or of scripts/check-capi-abi.sh. effect-package/tests/c/descriptor_smoke.c is the only C-header proof for the descriptor ABI and stays.
• Allocation and realtime gates. session/tests/allocation_budget.rs (dynamic, strictly stronger than the static check-session-policy.sh ban), capi/tests/resource_lifecycle.rs:375 and :2158 (render and event dequeue allocate zero), multiband/tests/no_alloc_render.rs (both, because the harness arms only process and mutation row 11's reallocating reset is caught nowhere else), soft-clip's row 12 (reset_full rebuilding via Self::new), the limiter's and transient-shaper's bank allocation gate, and every trace-*-audit.sh / run-protocol-allocation-audit.sh realtime rule. Only the redundant loop counts (1,000 blocks to 64) and the allocator self-tests move.
• Protocol goldens and wire tests. 99 of 132 protocol tests are keeps: the 48-byte header goldens, every truncation and cross-kind rejection, the 39-opcode session-wire canonical encodings, the frozen 46-frame corpus hash (which check-protocol-wasm-parity.sh deliberately re-asserts from the guest side), and the MessageSpec id-ascending property.
• effect-contract's lattice, live-control, observation-lane and symmetry laws. 36 of 40 keeps with zero deletes: each of these names a distinct recorded red mutation, they are trivially cheap, and they localise failures that host-core, rack and builtins-compiler only see through a console plan.
• The oracle families. dsp-reference's E1 through E4 grids, the LR4 all-pass identity, the D11 reference ramp and the gate reference (17 of 25 keeps, one delete); graph/src/program.rs's symbolic-interpreter oracle (sole home of the lowering claim, only its corpus size is trimmed); lane's G1/G2/G4 identity and flush gates and fp_env's unwind and sticky-flag tests; builtins/tests/response.rs's claims (only the recomputation is trimmed, no claim is dropped).
• The hermetic JS and Python mutation self-tests, and the per-browser qualification gates. All of check-web-audioworklet-callgraph.py, check-abi-layout-v1.py, check-command-kind-vocabulary.py, check-command-reason-vocabulary.py, check-parameter-metadata-v1.py, check-session-map-shape.py and check-browser-expected-resources.py self-tests are keeps: they cost under 6 seconds combined and are what turn those gates into assertions. The three-browser qualify run stays at three, because bit-identical PCM and stall survival per engine are distinct per-engine claims; only the browser-independent proofs inside it run once. check-graph-determinism.sh's 100 fresh processes stay, because HashMap-order nondeterminism is only observable cross-process.

---

Uncertainties that matter for the decision

• No cargo was run. Every cost figure is estimated from loop bounds and corpus sizes, and the largest ones are explicitly unverified: protocol mutation_million (60–180 s), session value.rs ten million spellings (30–60 s), graph-compiler/src/lib.rs in aggregate (150–300 s), the tools/audit oracle pass O (5–10 s each, 22 of them), multiband's two f64/f32 probe sweeps (15–40 s and 20–60 s), and delay's partition_invariance (10–30 s). If any of these is materially cheaper than estimated, the corresponding action drops down the ranking but its redundancy argument is unaffected.
• Three reports disagree about who owns the corpus digest pins. The foundation report says math/tests/m3_determinism.rs:142 is the owning gate and G5's native math half is the duplicate. The DSP report says G5 owns all delegated families and the nine per-crate pin tests should be deleted. The compilers/hosts/tools report says the opposite: delete g5_native_digests_match_pins (tools/wasm-gates/tests/g5_native_corpus.rs:21) because each owning crate already pins natively in release, and keep builtins/tests/determinism.rs as "the cheap owner". These cannot all be acted on; one direction must be chosen before any of the ten tests is touched, and whichever direction is chosen, the per-family finiteness and non-vacuity checks must be preserved because G5 excludes delegated families from its vacuity checks.
• protocol/tests/controller_response_api.rs. The foundation report says delete it (the field is pub at controller.rs:1105 and downstream compilation gives the same guarantee); the posted CI design says keep it as a type-level claim at zero cost. The consumer that would break is unverified.
• The 65,537-track scale tests. The posted design keeps builtins-compiler allocation_tracker and scale, graph-compiler scale and session scale_transaction in test-debug-a and redesigns the tracker; the compilers report moves two of them to release or nightly and trims graph-compiler's to 10,923 tracks; the foundation report trims session's to about 4,097. Three positions on the same 125 seconds.
• effect-package/tests/effect_interchange_mutation.rs:318. The design says delete it (ignored, no assertion); the DSP report says keep it as nightly while noting it only prints a digest and never compares. Both agree it asserts nothing today.
• The release re-run assumption. The DSP report states its savings as "doubled by the release leg". The posted design deletes the ten per-crate release re-runs, so those figures should be read single-leg once the design lands; the totals table above is already single-leg.
• tools/audit placement versus restructuring. The design moves the audit tests to a release shard; the restructuring above is independent of that and is what actually removes the 200–430 s. If only the move happens, the release shard still pays 233–470 s, which exceeds the design's own 120 s trigger for pushing the 24-way mutation loops to nightly.
• Feature unification. Whether engine's realtime-audit tests, source's four test-support tests and builtins-compiler's allocation_tracker actually execute under the current CI invocation is unverified, and whether unification moves any allocation-count number is unverified. Shard invocations must name features explicitly before any count assertion is trusted.
• Gates whose invocation could not be confirmed. check-abi-layout-v1.py --self-test (no CI invocation found), graph_fixture --check (runs nowhere; the fixture's verify-mode diff against the checked-in files is unverified), fixtures/rack/v1's external consumer, and whether --test-threads=1 at check-effect-package-v1.sh:21 exists to stabilise the 500 ms timing assertion. Each of these blocks a delete until confirmed.
• Behavioural questions behind three deletes. Whether reversing the field order at source/src/lib.rs:1718 would deadlock observably, whether prepare_native_source has its own rate whitelist (native_source.rs:3842), and whether host-core/tests/track_delay.rs:215 has a ring boundary above N=200.
• Flake risk not yet reproduced. stem-store-core-v1.mjs:325-330 compares a 100 ms abort against a 300 ms race; source/src/native_source.rs:2076's single-source-thread requirement is violated by construction under parallel siblings. Neither has a recorded failure in the sampled runs.

Recommended resolution of the conflicts (Fable's position, for Sol to attack)

• Digest pins: keep both sides, delete the twins. Once the posted design lands, the per-crate pin tests run only in the debug shard and G5 runs only in the release shard, so they are complementary by profile rather than duplicates. Keep the nine per-crate pin tests and g5_native_digests_match_pins; delete the three print_pins/print_digests regen twins; change the seven MISO_ENGINE_REPIN_* branches to fail closed the way m3_determinism.rs:143 does (print, then panic), so a stray environment variable can never turn a pin test green.
• Scale tests: adopt the compilers report. Trim allocation_tracker to tracks [1, 4], trim graph-compiler/tests/scale.rs to 10,923 tracks, move builtins-compiler/tests/scale.rs (the one claim that genuinely needs 2^16 + 1) into the release shard, and trim session/tests/scale_transaction.rs to about 4,097 tracks. That keeps one 65,537-track compile per workspace run instead of four.
• controller_response_api.rs, effect_interchange_mutation.rs:318: delete both; the first is a pub field the compiler already enforces for every consumer, the second asserts nothing.
• tools/audit: do the restructuring (action 1) in addition to the shard move; the shard move alone leaves the release shard paying for five renders.

---

The full per-file ledgers, with every test file, its claim, kind, cost bound, redundancy and verdict, are committed under docs/audits/test-usefulness-2026-09-04/ in the CI redesign PR, and each deletion requires Sol's per-item acceptance before any test is removed.

[tamashi095]

Implementation status: PR #361 (migration stage 1)

Per the owner's instruction, the design above has been implemented through stage 1 on PR #361: the new qualification workflow runs on every PR and main push but is not a required check; branch protection is untouched, and the three existing required contexts keep reporting. Stages 2 and 3 remain owner actions after the two check sets agree on at least ten PRs.

Process: six implementation packages (Sonnet), each followed by an adversarial review (Opus), then a fix round, then a final integration review that executed every shard's step list locally. Every blocker and should-fix from the reviews is closed on the branch; the review notes are summarised per finding in the commit messages.

Findings for the owner and Sol (not changed by the PR):

1. The sealed AudioWorklet digest is a source-line pin on the whole shipped closure. Experiment: one blank line at the top of crates/builtins-compiler/src/lib.rs changes the digest (panic Location data survives strip=debuginfo). Any edit to any closure crate, test-only or comment-only, forces a re-seal with browser qualification. WP-2's tracker fix was moved out of src/lib.rs into the test file for this reason; src/lib.rs is byte-identical to main.
2. Swatinem/rust-cache does not cache workspace crates, so "warm" saves only the dependency compile (locally at 4 threads: 68% on clippy, 7% on the audit-native release build). The §5 warm estimates and the §9 P50 must be re-derived from the telemetry the verdict job now emits; that is what stage 1 is for.
3. tools/audit's release tests execute in about 61s at 4 threads here, so roughly 150s on a 4-vCPU runner, above the design's own 120s trigger. The ledger's top action (render generated() once, call stage functions for post-oracle mutations) is the root fix and awaits per-item acceptance.
4. docs-gates in the posted design ran only on the evidence route, which would have lost the research and listening-packet validators for any mixed docs+code PR. The PR runs it on the full route too; the design text above should be read with that amendment.
5. mutation_trials: 30000 in the effect-interchange benchmark seal literals now describes a retired requirement (operator-only, branch-gated scripts that no workflow runs).

The per-file test ledgers are committed under docs/audits/test-usefulness-2026-09-04/ in the PR. Beyond the three print-only or tautological tests named in the PR description, no test from the ledger is deleted; each further deletion needs Sol's per-item acceptance.

[tamashi095]

Branch protection, stage 2 (partial), 2026-09-04 ~10:30 UTC, at the owner's direction on PR #361.

Required status checks on main changed from
["engine qualification", "SDK qualification", "browser qualification"]
to
["qualification", "SDK qualification", "browser qualification"] (strict: false, app_id 15368 for all).

Rationale: the new qualification workflow passed all 17 jobs and its verdict on PR #361 in 8m08s cold; the old ci run on the same commit was cancelled at the owner's request rather than waiting 25 to 40 minutes. main was never less protected: three required contexts at every moment, all of which report on every PR shape.

Revert command, if needed:

gh api -X PATCH repos/misofm/engine/branches/main/protection/required_status_checks --input - <<'EOF'
{"strict": false, "checks": [{"context": "engine qualification", "app_id": 15368}, {"context": "SDK qualification", "app_id": 15368}, {"context": "browser qualification", "app_id": 15368}]}
EOF

Still outstanding for stage 3 (follow-up PR): delete ci.yml, sdk.yml, browser-qualification.yml, release-build.yml, drop the two remaining old contexts so qualification is the sole required check, and update check-ci-path-routing.py accordingly. Until then the old workflows keep running on every PR without gating anything except the two SDK/browser contexts.

[tamashi095]

Migration complete (stages 1 to 3), 2026-09-04.

• ci: sub-ten-minute qualification topology (#359, migration stage 1) #361 merged: qualification.yml plus the script, router, policy, test and nightly changes.
• ci: retire the old PR workflows (#359, migration stage 3) #362 merged: ci.yml, sdk.yml, browser-qualification.yml and release-build.yml retired; the routing policy checker fails if any reappears and pins the surviving workflow's route job, SDK closure and workspace-policy step; qualification.yml is the release-shape self-reference.
• Required status checks on main: exactly ["qualification"]. Remaining workflows: qualification.yml (required), fuzz.yml and nightly.yml (not required), npm-publish.yml (manual).

Measured on real runs today (GitHub-hosted, cold caches): full route 8m08s (#361) and 10m34s (#362, with the routing self-tests and a cache-less artifact rebuild); the sdk route is bounded by artifact + sdk at about 4.5 min cold; docs-only under a minute. Caches populate from the main pushes just made. The verdict job's telemetry artifact (ci-telemetry-<run>-<attempt>) is the source for the P50/P95 tables the design asked for; the first week of data should confirm or correct the §9 budgets, especially against the two findings noted above (rust-cache does not cache workspace crates; tools/audit release tests near the 120 s trigger).