feat(M14-J): promote b4 into canonical J3-J12 substrate

.github/workflows/baseline.yml

@@ -17,6 +17,8 @@ on:
       - vendor.lock.json
       - qualification/**
       - Makefile
+      - scripts/ci-install-apt-deps.sh
+      - tests/ci/test_apt_installer.py
       - .github/workflows/baseline.yml
   pull_request:
     paths:
@@ -31,6 +33,8 @@ on:
       - vendor.lock.json
       - qualification/**
       - Makefile
+      - scripts/ci-install-apt-deps.sh
+      - tests/ci/test_apt_installer.py
       - .github/workflows/baseline.yml
 
 permissions:
@@ -178,14 +182,15 @@ jobs:
           key: engine-nnue-${{ runner.os }}-${{ hashFiles('vendor.lock.json') }}
 
       - name: Fetch and verify pinned engine NNUE artifacts
+        timeout-minutes: 5
         run: |
           ./scripts/fetch-stockfish-network.sh >/dev/null
           ./scripts/fetch-reckless-network.sh >/dev/null
 
       - name: Install LC0 validation dependencies
+        timeout-minutes: 5
         run: |
-          sudo apt-get update
-          sudo apt-get install -y meson ninja-build pkg-config libprotobuf-dev protobuf-compiler zlib1g-dev
+          bash scripts/ci-install-apt-deps.sh meson ninja-build pkg-config libprotobuf-dev protobuf-compiler zlib1g-dev
 
       - name: Toolchain versions
         run: |

.github/workflows/full-game-qualification.yml

@@ -31,6 +31,8 @@ on:
       - 'tests/fixtures/fake_uci_engine.py'
       - 'vendor.lock.json'
       - 'Makefile*'
+      - 'scripts/ci-install-apt-deps.sh'
+      - 'tests/ci/test_apt_installer.py'
       - '.github/workflows/full-game-qualification.yml'
   push:
     branches: [main]
@@ -51,6 +53,8 @@ on:
       - 'tests/fixtures/fake_uci_engine.py'
       - 'vendor.lock.json'
       - 'Makefile*'
+      - 'scripts/ci-install-apt-deps.sh'
+      - 'tests/ci/test_apt_installer.py'
       - '.github/workflows/full-game-qualification.yml'
 
 permissions:
@@ -146,16 +150,18 @@ jobs:
         with:
           ref: ${{ env.ALLFATHER_SOURCE_SHA }}
       - name: Verify checkout identity
+        timeout-minutes: 5
         run: test "$(git rev-parse HEAD)" = "$ALLFATHER_SOURCE_SHA"
       - name: Download source-test attestation
+        timeout-minutes: 5
         uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
         with:
           name: local1-fastchess-source-test
           path: build/fastchess-source-test
       - name: Install build dependencies
+        timeout-minutes: 5
         run: |
-          sudo apt-get update
-          sudo apt-get install -y             build-essential git meson ninja-build pkg-config             libprotobuf-dev protobuf-compiler zlib1g-dev libopenblas-dev
+          bash scripts/ci-install-apt-deps.sh build-essential git meson ninja-build pkg-config libprotobuf-dev protobuf-compiler zlib1g-dev libopenblas-dev
       - name: Build exact qualification binaries
         run: |
           make -f Makefile.local-game build-fastchess
@@ -193,16 +199,17 @@ jobs:
           test "$(git rev-parse HEAD)" = "$ALLFATHER_SOURCE_SHA"
           echo "ALLFATHER_RUNNER_ENVIRONMENT=${{ runner.environment }}" >> "$GITHUB_ENV"
       - name: Download exact qualification build bundle
+        timeout-minutes: 5
         uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
         with:
           name: local1-qualification-build
           path: .
       - name: Restore executable bits and install runtime/test dependencies
+        timeout-minutes: 5
         run: |
           chmod +x build/tools/fastchess/bin/fastchess engines/lc0/build/release/lc0
           find build -path '*/bin/*' -type f -exec chmod +x {} +
-          sudo apt-get update
-          sudo apt-get install -y             meson ninja-build pkg-config libprotobuf-dev protobuf-compiler zlib1g-dev             libopenblas-dev python3-pip python3-setuptools python3-wheel
+          bash scripts/ci-install-apt-deps.sh meson ninja-build pkg-config libprotobuf-dev protobuf-compiler zlib1g-dev libopenblas-dev python3-pip python3-setuptools python3-wheel
           python3 -m pip install --break-system-packages --no-build-isolation --no-deps             --require-hashes -r qualification/local-game-requirements.txt
       - name: Validate legacy G3 resource calibration
         run: |
@@ -247,18 +254,20 @@ jobs:
         with:
           ref: ${{ env.ALLFATHER_SOURCE_SHA }}
       - name: Verify checkout identity
+        timeout-minutes: 5
         run: test "$(git rev-parse HEAD)" = "$ALLFATHER_SOURCE_SHA"
       - name: Download exact qualification build bundle
+        timeout-minutes: 5
         uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
         with:
           name: local1-qualification-build
           path: build
       - name: Restore executable bits and install dependencies
+        timeout-minutes: 5
         run: |
           chmod +x build/tools/fastchess/bin/fastchess engines/lc0/build/release/lc0
           find build -path '*/bin/*' -type f -exec chmod +x {} +
-          sudo apt-get update
-          sudo apt-get install -y             meson ninja-build pkg-config libprotobuf-dev protobuf-compiler zlib1g-dev             libopenblas-dev python3-pip python3-setuptools python3-wheel
+          bash scripts/ci-install-apt-deps.sh meson ninja-build pkg-config libprotobuf-dev protobuf-compiler zlib1g-dev libopenblas-dev python3-pip python3-setuptools python3-wheel
           python3 -m pip install --break-system-packages --no-build-isolation --no-deps             --require-hashes -r qualification/local-game-requirements.txt
       - name: Validate legacy G3 resource calibration
         run: |
@@ -293,16 +302,18 @@ jobs:
         with:
           ref: ${{ env.ALLFATHER_SOURCE_SHA }}
       - name: Verify checkout identity
+        timeout-minutes: 5
         run: test "$(git rev-parse HEAD)" = "$ALLFATHER_SOURCE_SHA"
       - name: Download exact qualification build bundle
+        timeout-minutes: 5
         uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
         with:
           name: local1-qualification-build
           path: build
       - name: Install independent validator dependency
+        timeout-minutes: 5
         run: |
-          sudo apt-get update
-          sudo apt-get install -y python3-pip python3-setuptools python3-wheel
+          bash scripts/ci-install-apt-deps.sh python3-pip python3-setuptools python3-wheel
           python3 -m pip install --break-system-packages --no-build-isolation --no-deps             --require-hashes -r qualification/local-game-requirements.txt
       - name: Download all soak shard artifacts
         uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093

.github/workflows/g3-canonical-b4-triage.yml

@@ -0,0 +1,100 @@
+name: G3 canonical-b4 23-case diagnostic (non-promoting)
+
+on:
+  workflow_dispatch:
+  pull_request:
+    paths:
+      - 'scripts/diagnose-g3-canonical-b4.py'
+      - 'tests/engine_opt/test_g3_canonical_b4_triage.py'
+      - 'config/allfather.online-hybrid-v2.g3-triage.json'
+      - '.github/workflows/g3-canonical-b4-triage.yml'
+
+permissions:
+  contents: read
+
+env:
+  TRIAGE_HEAD_SHA: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
+  ALLFATHER_RUNNER_ENVIRONMENT: github-hosted
+
+concurrency:
+  group: g3-b4-triage-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  static-contracts:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+        with:
+          ref: ${{ env.TRIAGE_HEAD_SHA }}
+      - name: Verify exact HEAD and frozen policy/config contrasts
+        run: |
+          set -euo pipefail
+          test "$(git rev-parse HEAD)" = "$TRIAGE_HEAD_SHA"
+          python3 -m py_compile scripts/diagnose-g3-canonical-b4.py
+          python3 tests/engine_opt/test_g3_canonical_b4_triage.py
+          python3 scripts/diagnose-g3-canonical-b4.py --static
+
+  canonical-b4-triage:
+    needs: static-contracts
+    runs-on: ubuntu-24.04
+    timeout-minutes: 105
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+        with:
+          ref: ${{ env.TRIAGE_HEAD_SHA }}
+      - name: Verify exact source checkout
+        run: test "$(git rev-parse HEAD)" = "$TRIAGE_HEAD_SHA"
+      - name: Install pinned CPU inference build dependencies
+        timeout-minutes: 5
+        run: |
+          bash scripts/ci-install-apt-deps.sh build-essential git meson ninja-build pkg-config libprotobuf-dev protobuf-compiler zlib1g-dev libopenblas-dev
+      - name: Build actual canonical-b4 engine bundle
+        timeout-minutes: 70
+        run: make build-online-engine-opt-v2
+      - name: Validate exact-head engine bundle
+        run: python3 scripts/qualify-engine-opt-v2.py
+      - name: Capture exact execution domain on this worker
+        run: |
+          set -euo pipefail
+          mkdir -p build/test-results/g3-canonical-b4-triage
+          python3 scripts/lc0-hardware-probe.py > build/test-results/g3-canonical-b4-triage/host.json
+          python3 -m tools.engine_opt.domain capture \
+            --probe build/test-results/g3-canonical-b4-triage/host.json \
+            --output build/test-results/g3-canonical-b4-triage/execution-domain.json
+          python3 -m tools.engine_opt.domain validate \
+            --input build/test-results/g3-canonical-b4-triage/execution-domain.json \
+            --expected-source-commit "$TRIAGE_HEAD_SHA"
+      - name: Diagnose 23 frozen G3 cases with canonical b4 (no authority promotion)
+        timeout-minutes: 30
+        run: |
+          python3 scripts/diagnose-g3-canonical-b4.py \
+            --expected-head "$TRIAGE_HEAD_SHA" \
+            --execution-domain build/test-results/g3-canonical-b4-triage/execution-domain.json
+      - name: Summarize diagnostic disposition
+        if: always()
+        run: |
+          python3 - <<'PY' >> "$GITHUB_STEP_SUMMARY"
+          import json
+          from pathlib import Path
+          p=Path("build/test-results/g3-canonical-b4-triage/report.json")
+          print("## G3 23-case b4 triage: diagnostic only")
+          if p.exists():
+              r=json.loads(p.read_text())
+              for key in ("diagnostic_complete","diagnostic_positive_witness","cases_exercised",
+                          "qualification_disposition","promotion_evidence"):
+                  print(f"- {key}: {r.get(key)}")
+          else:
+              print("- No diagnostic disposition was generated.")
+          PY
+      - name: Upload complete source-bound diagnostic and replays
+        if: always()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        with:
+          name: g3-canonical-b4-triage-nonpromoting
+          path: |
+            build/test-results/g3-canonical-b4-triage/**
+            build/replays-g3-canonical-b4-triage/**
+          if-no-files-found: error
+          retention-days: 30

.github/workflows/lc0-artifact-domain-diagnostic.yml

@@ -5,6 +5,8 @@ on:
   pull_request:
     paths:
       - 'tools/diagnostics/**'
+      - 'scripts/ci-install-apt-deps.sh'
+      - 'tests/ci/test_apt_installer.py'
       - '.github/workflows/lc0-artifact-domain-diagnostic.yml'
 
 permissions:
@@ -70,9 +72,9 @@ jobs:
           test "$(git -C source-b rev-parse HEAD)" = "$SOURCE_B"
 
       - name: Install one shared build/runtime substrate
+        timeout-minutes: 5
         run: |
-          sudo apt-get update
-          sudo apt-get install -y             build-essential meson ninja-build pkg-config             libprotobuf-dev protobuf-compiler zlib1g-dev libopenblas-dev
+          bash scripts/ci-install-apt-deps.sh build-essential meson ninja-build pkg-config libprotobuf-dev protobuf-compiler zlib1g-dev libopenblas-dev
           echo "ALLFATHER_RUNNER_ENVIRONMENT=${{ runner.environment }}" >> "$GITHUB_ENV"
 
       - name: Capture J2 host and runtime-substrate evidence

.github/workflows/lc0-strength-qualification.yml

@@ -28,6 +28,8 @@ on:
       - tests/telemetry/**
       - engines/lc0/**
       - vendor.lock.json
+      - scripts/ci-install-apt-deps.sh
+      - tests/ci/test_apt_installer.py
       - .github/workflows/lc0-strength-qualification.yml
   pull_request:
     paths:
@@ -53,6 +55,8 @@ on:
       - tests/telemetry/**
       - engines/lc0/**
       - vendor.lock.json
+      - scripts/ci-install-apt-deps.sh
+      - tests/ci/test_apt_installer.py
       - .github/workflows/lc0-strength-qualification.yml
 
 permissions:
@@ -131,11 +135,9 @@ jobs:
           python3 -m json.tool config/allfather.strength.validation.json >/dev/null
 
       - name: Install LC0 real-inference dependencies
+        timeout-minutes: 5
         run: |
-          sudo apt-get update
-          sudo apt-get install -y \
-            meson ninja-build pkg-config libprotobuf-dev protobuf-compiler \
-            zlib1g-dev libopenblas-dev
+          bash scripts/ci-install-apt-deps.sh meson ninja-build pkg-config libprotobuf-dev protobuf-compiler zlib1g-dev libopenblas-dev
 
       - name: Toolchain and hardware probe
         run: |

.github/workflows/merge-gate.yml

@@ -34,6 +34,9 @@ jobs:
           make telemetry-adapters
           make controller-tests
           make resource-lab-tests
+          python3 tests/engine_opt/test_aggregate_paths.py
+          python3 tests/ci/test_apt_installer.py
+          python3 tests/reckless_repro/test_repro.py
           python3 -m json.tool qualification/resource-profile-evidence-v1.json >/dev/null
           python3 -m json.tool qualification/resource-profile-selection-v1.json >/dev/null
           python3 scripts/qualify-resource-profile-selection.py --output build/test-results/resource-profile-selection/report.json

.github/workflows/meta-1.yml

@@ -12,6 +12,8 @@ on:
       - 'tests/fixtures/meta1/**'
       - 'tests/fixtures/meta1-mini/**'
       - 'Makefile.local-game'
+      - 'scripts/ci-install-apt-deps.sh'
+      - 'tests/ci/test_apt_installer.py'
       - '.github/workflows/meta-1.yml'
   workflow_dispatch:
     inputs:
@@ -144,9 +146,9 @@ jobs:
           name: meta1-fastchess-source-test
           path: build/fastchess-source-test
       - name: Install build and campaign dependencies
+        timeout-minutes: 5
         run: |
-          sudo apt-get update
-          sudo apt-get install -y             build-essential git meson ninja-build pkg-config             libprotobuf-dev protobuf-compiler zlib1g-dev libopenblas-dev             python3-pip python3-setuptools python3-wheel
+          bash scripts/ci-install-apt-deps.sh build-essential git meson ninja-build pkg-config libprotobuf-dev protobuf-compiler zlib1g-dev libopenblas-dev python3-pip python3-setuptools python3-wheel
           python3 -m pip install --break-system-packages --no-build-isolation --no-deps             --require-hashes -r qualification/local-game-requirements.txt
       - name: Build exact-head ENGINE-OPT-V2 bundle
         run: |

.github/workflows/online-hybrid-qualification.yml

@@ -36,6 +36,8 @@ on:
       - engines/**
       - vendor.lock.json
       - Makefile
+      - scripts/ci-install-apt-deps.sh
+      - tests/ci/test_apt_installer.py
       - .github/workflows/online-hybrid-qualification.yml
   push:
     branches: [main]
@@ -72,6 +74,8 @@ on:
       - engines/**
       - vendor.lock.json
       - Makefile
+      - scripts/ci-install-apt-deps.sh
+      - tests/ci/test_apt_installer.py
       - .github/workflows/online-hybrid-qualification.yml
 permissions:
   contents: read
@@ -146,9 +150,9 @@ jobs:
           python3 -m json.tool qualification/replay-history-sources.json >/dev/null
           python3 scripts/validate-online-hybrid-resource-calibration.py
       - name: Install real-inference dependencies
+        timeout-minutes: 5
         run: |
-          sudo apt-get update
-          sudo apt-get install -y meson ninja-build pkg-config libprotobuf-dev protobuf-compiler zlib1g-dev libopenblas-dev
+          bash scripts/ci-install-apt-deps.sh meson ninja-build pkg-config libprotobuf-dev protobuf-compiler zlib1g-dev libopenblas-dev
       - name: Build frozen ONLINE-2 portable bundle
         env:
           JOBS: "2"

.github/workflows/online-profile-qualification.yml

@@ -40,6 +40,8 @@ on:
       - engines/**
       - vendor.lock.json
       - Makefile
+      - scripts/ci-install-apt-deps.sh
+      - tests/ci/test_apt_installer.py
       - .github/workflows/online-profile-qualification.yml
   pull_request:
     paths:
@@ -77,6 +79,8 @@ on:
       - engines/**
       - vendor.lock.json
       - Makefile
+      - scripts/ci-install-apt-deps.sh
+      - tests/ci/test_apt_installer.py
       - .github/workflows/online-profile-qualification.yml
 
 permissions:
@@ -160,9 +164,9 @@ jobs:
           bash -n scripts/build-online-cpu-reference.sh
 
       - name: Install real-inference build dependencies
+        timeout-minutes: 5
         run: |
-          sudo apt-get update
-          sudo apt-get install -y             meson ninja-build pkg-config libprotobuf-dev protobuf-compiler             zlib1g-dev libopenblas-dev
+          bash scripts/ci-install-apt-deps.sh meson ninja-build pkg-config libprotobuf-dev protobuf-compiler zlib1g-dev libopenblas-dev
 
       - name: Cache frozen engine networks
         uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4