ci.yml

name: CI

on:
  push:
    # TRAIN BRANCHES ARE PART OF THE GATE, NOT A CONVENIENCE.
    #
    # Pushes to master land only after a green run on all platforms, so the run
    # has to exist on the branch BEFORE the fast-forward. With `[master]` alone a
    # train branch gets no run at all -- and once branch protection requires a
    # status check, master becomes unpushable from this repository, because no
    # check will ever exist for the sha being pushed. That reads as a broken key
    # or a permissions fault; it is this line.
    #
    # `pull_request` does not cover it: our own commits land without a PR by
    # ruling, so nothing would trigger.
    branches: [master, 'train/**']
  pull_request:
  # Daily runs check landed code against the world as it is now: a new stable
  # Rust/clippy can add lints (as on 2026-09-28), and real_daemon_e2e builds ck-subc
  # from subconscious's current default branch. Registry dependencies stay pinned
  # in Cargo.lock; sibling releases no longer invalidate the committed lock.
  schedule:
    - cron: '17 6 * * *'
  workflow_call:
  # Manual re-run without a dummy commit. Added when the repo went public: a
  # contributor whose run failed on infrastructure rather than on their change
  # otherwise has to push an empty commit to retry, which puts noise in the
  # history to work around a missing button.
  workflow_dispatch:

# Rapid pushes supersede each other: only the tip ships, so paying for a full run
# of every intermediate commit buys nothing.
#
# READING THE RUN LIST LATER, ESPECIALLY MID-BISECT: a cancelled run means a newer
# push arrived first, NOT that the commit failed, and a commit with no run at all
# was superseded before its run started rather than never pushed. Neither is
# evidence about that commit. What this list supports is "the tip is green", not
# "every commit is green" — and since history here is cumulative, a later green run
# on a descendant did execute the earlier commits' code.
#
# The exception, and the reason to watch a run to completion rather than trust the
# badge: when the WORKFLOW ITSELF changes. A run cancelled before it reached a newly
# added step never executed that step anywhere, and nothing in the run's status says
# so. Verify a new step's own result the first time it ships.
concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

env:
  CARGO_TERM_COLOR: always

jobs:
  # Linux and Windows. macOS stays the development platform (local cargo test +
  # clippy) and is not a CI leg, so the macOS-only code paths — the Chrome cookie
  # store and the antigravity local probe — are covered by their
  # cfg(not(target_os = "macos")) stubs here rather than executed.
  #
  # The Windows leg exists because this module discovers credentials by building
  # paths on the machine it runs on, and that is the class of code which compiles
  # everywhere and is silently wrong per platform: a path built for the wrong
  # convention finds nothing and reports healthy. Cross-compiling does not
  # substitute for it — from macOS it fails in a dependency's C build for want of
  # MSVC headers, and even where it links it exercises no filesystem or OS-API
  # behaviour.
  #
  # The #[ignore] tests split into two groups for two different reasons, and only
  # one of them is a CI limit. The live provider proofs need real credentials and
  # macOS desktop state, so they cannot run here. real_daemon_e2e needs only the
  # sibling's ck-subc binary, built by the test from the checkout below, so it
  # runs in its own step.
  #
  # Runners are GitHub-hosted. They were Blacksmith while this repo was private,
  # because GitHub bills private-repo Actions minutes against a free-plan org that
  # blocks jobs at its zero spending limit, and third-party runners do not consume
  # the included minutes. Actions minutes are free on public repositories, so the
  # reason expired when the repo went public on 2026-08-27 and the third-party
  # dependency went with it.
  test:
    name: Test (${{ matrix.os }})
    runs-on: ${{ matrix.runner }}
    strategy:
      # Both legs run to completion. A Windows failure and a Linux failure have
      # different causes here, and cancelling one on the other's failure hides
      # whichever finished second.
      fail-fast: false
      matrix:
        include:
          - os: ubuntu
            runner: ubuntu-latest
          - os: windows
            runner: windows-latest
    # A wedged test must surface as a fast red run, not burn the runner for
    # the 6-hour Actions default. Healthy runs finish well under 15 minutes.
    timeout-minutes: 20
    defaults:
      run:
        working-directory: insula
    steps:
      # These are checkout DIRECTORY names on the runner, not repository
      # references: `actions/checkout` with no `repository:` uses
      # `github.repository`, which follows a repository rename on its own. They
      # are named after this repository only so the sibling layout below reads
      # the way it does on a developer's machine.
      - name: Checkout insula
        uses: actions/checkout@v5
        with:
          path: insula

      # BEFORE THE SIBLING CHECKOUT, so a sibling failure cannot mask it and so
      # drift fails in seconds rather than after the full matrix.
      #
      # The three facts the CI-gated push shape rests on were each verified by
      # hand once and then trusted. They are facts about THIS FILE, which keeps
      # being edited, and a narrowed trigger goes unnoticed until the day branch
      # protection is enabled -- when the symptom is main becoming unpushable and
      # it reads as a protection fault rather than a workflow one.
      # ONE LEG, because this asserts facts about a FILE -- its answer cannot
      # differ by platform, so a second run buys nothing and costs a portability
      # surface.
      #
      # And it cost one: without this guard the Windows leg reported SUCCESS and
      # produced ZERO OUTPUT. GitHub runs steps under pwsh there, which sourced
      # the shell script rather than executing it, and exited 0 having done
      # nothing. A green check for a gate that never ran.
      #
      # Only the denominator line caught it -- `train preconditions: <file>, push
      # branches [...]` appeared ONCE across a two-leg run instead of twice. The
      # conclusion said success on both. That is the whole argument for printing
      # what was examined rather than a verdict.
      #
      # A platform guard is not the path-dependent condition the checker itself
      # forbids: `matrix.os` is identical between a train push and a master push,
      # where `github.ref` is not.
      - name: Train preconditions
        if: matrix.os == 'ubuntu'
        working-directory: insula
        run: ./scripts/check-train-preconditions.sh

      - name: Public .cortexkit layout
        if: matrix.os == 'ubuntu'
        working-directory: insula
        run: ./scripts/check-cortexkit-layout.sh

      # Only real_daemon_e2e needs this public sibling checkout: it builds the
      # ck-subc binary from ../subconscious to test against subconscious master.
      # Compiling insula itself uses crates.io and does not need the sibling, and
      # that test runs on Ubuntu only, so Windows skips the clone.
      - name: Checkout subconscious
        if: matrix.os == 'ubuntu'
        uses: actions/checkout@v5
        with:
          repository: cortexkit/subconscious
          path: subconscious

      - uses: dtolnay/rust-toolchain@stable
        with:
          components: clippy, rustfmt

      # Reuses compiled dependencies across runs, keyed on the toolchain and the
      # lock. A cold run compiles every crate from scratch, which was most of each
      # leg's wall time. A changed lock or toolchain misses the cache and builds
      # clean, so a stale cache can't hide a dependency change.
      # Windows Defender scans every test binary and scratch file the suite
      # creates, which made the Windows leg the slowest. These are throwaway CI
      # VMs, so excluding the build, temp and cargo folders costs nothing and was
      # measured on another fleet repository to cut its Windows test run by
      # about 40%.
      - name: Exclude build folders from Defender
        if: matrix.os == 'windows'
        shell: pwsh
        run: |
          Add-MpPreference -ExclusionPath "$env:GITHUB_WORKSPACE", "$env:RUNNER_TEMP", "$env:TEMP", "$env:USERPROFILE\.cargo", "$env:USERPROFILE\.rustup"
          Set-MpPreference -DisableRealtimeMonitoring $true

      # The subconscious entry caches the ck-subc daemon build the Ubuntu-only
      # real-daemon test compiles from the sibling checkout, its slowest step.
      - uses: Swatinem/rust-cache@v2
        with:
          workspaces: |
            insula -> target
            subconscious -> target

      - name: Format check
        run: cargo fmt --all -- --check

      # Clippy runs with --locked, so this step is also the check that the
      # committed lock resolves: the cargo invocations after it run without
      # --locked and could resolve a new graph if a manifest requirement changes.
      # It used to be a separate `cargo check --locked` pass, which compiled the
      # whole workspace a second time for the same answer. After a deliberate
      # dependency update, regenerate the lock with `cargo update -p <crate>` and
      # commit it with the requirement change.
      - name: Clippy, on the committed lock
        run: cargo clippy --locked --workspace --all-targets -- -D warnings

      # Runs the quota-core unit tests + the in-process skeleton_e2e CI test
      # (skeleton_round_trips_usage_get_over_the_wire). The #[ignore] tests do not
      # run in this step; the daemon one runs in its own step below.
      - name: Test
        run: cargo test --workspace --all-targets

      # SEPARATE STEP BECAUSE --all-targets EXCLUDES DOCTESTS. The flag reads as
      # "everything" and silently omits this one target, which is how an ASCII
      # table in a /// comment reached master with both this pipeline and the
      # local gate green (insula#13). An indented block in a doc comment is a
      # Rust code block to rustdoc, so prose gets compiled.
      - name: Doctests
        run: cargo test --workspace --doc

      # The only test where the subc module id must round-trip through daemon
      # config, process launch and a routed call: a real ck-subc binary reads a
      # generated subc.jsonc, spawns this module from it, and serves usage.get
      # back over the route channel.
      #
      # Nothing else covers that. The unit tests read the module id from the same
      # definition on both sides, so they pass for any value of it, including a
      # wrong one. Supervision is what a rename breaks, and it breaks silently: a
      # module registered under an id nobody dials is not an error, it is a module
      # nobody calls.
      #
      # It needs no credentials. HOME is redirected to an empty directory so the
      # result cannot depend on what this runner happens to have: the assertion is
      # that supervision and routing work, and a registry of degraded entries
      # proves that as well as a healthy one would.
      #
      # CARGO_HOME and RUSTUP_HOME are pinned to the real home first, because both
      # default to paths under HOME and the test shells out to cargo itself to
      # build the sibling daemon. Without them the toolchain disappears along with
      # the credentials.
      # Ubuntu only, and not because it could not work on Windows: the property
      # under test is that this module's subc id round-trips through daemon
      # config, process launch and a routed call, which is platform-independent.
      # The script below is also POSIX shell, where the Windows runner defaults
      # to PowerShell.
      - name: Real daemon supervision
        if: matrix.os == 'ubuntu'
        run: |
          rig="$(mktemp -d)"
          export CARGO_HOME="${CARGO_HOME:-$HOME/.cargo}"
          export RUSTUP_HOME="${RUSTUP_HOME:-$HOME/.rustup}"
          HOME="$rig" XDG_CONFIG_HOME="$rig/config" CK_QUOTA_STATE_DIR="$rig/state" \
            cargo test -p quota-module --test it -- --ignored real_daemon_e2e::

      # `--all-targets` above COMPILES the examples but never RUNS them, so an
      # example's own assertions are unexecuted by every other step here.
      #
      # This one carries a property a downstream consumer pins its reconciliation
      # against: the withheld-account and genuine-removal envelopes must differ
      # ONLY in `completeProviders`, so that a consumer proving "retain" versus
      # "delete" is isolating that key and nothing else. It needs no credentials
      # and no network -- it drives stub providers through the real registry.
      #
      # Without this step, breaking that property leaves this repository green
      # and fails in the consumer's pipeline instead, where the cause is a
      # producer change nobody there can see.
      - name: Completeness envelope pair check
        run: cargo run -p quota-core --example completeness-envelopes