ci(cache): declare bosn's cache families, budget and LRU eviction

[zackees]

Draft: adding ci.toml unlocks 461 pre-existing policy findings across bosn (baseline without a ci.toml is 1: "not found at repo root"). None are caused by this file, but they only become visible once one exists, so this needs review before it lands.

Why

bosn's Actions cache is at 221 entries / 9.92 GiB — 99% of GitHub's 10 GiB per-repo cap. Once at the cap, GitHub refuses new saves, so builds go cold. bosn has no ci.toml, so ci-lint cache janitor had no family boundaries and nothing to evict against.

Diagnosis

family	entries	bytes	largest
build-cache	16	9,858,848,811	1003.6 MB
solo-toolchain	4	775,424,833	207.7 MB
soldr-mini	2	21,770,955	10.5 MB
uv	3	616,911	0.3 MB
undeclared att1-*	196	85,704	470 B

Shape 1 — does the prefix encode a per-run content hash? Yes, and this is the whole problem. setup-soldr-buildcache-v2-<os>-<arch>-<digest>-<job-suffix>-<lockhash>: the trailing hash is a per-toolchain/per-lockfile hash, not a per-commit one (setup-soldr#237 deliberately dropped the commit SHA so the cache stays warm across commits). Every distinct lockfile/toolchain combination appends an entry, and nothing ever retires the old one — exactly the CACHE-029 shape. bosn has 13 live Linux build-cache entries under 4 different toolchain digests.

Shape 2 — does it decompose into the documented via families? Yes, all of it, with no residue:

• setup-soldr-buildcache-v2- → setup-soldr:build-cache (16)
• solo-toolchain-v3- → setup-soldr:solo-toolchain (4)
• soldr-mini-v2- → setup-soldr:soldr-mini (2)
• setup-uv-1- → setup-uv (3, legacy prefix)
• att1-* (196, ~440 B each) — ci-lint's own attestation caches, not a setup-soldr family

Shape 3 — platforms. Four runner/target pairs, read from .github/workflows/: linux-x64 (ubuntu-latest), windows-x64 (windows-latest), and the two Darwin targets, which cross-compile on ubuntu-latest and smoke on macos-15-intel / macos-15. Only the first two produce build-cache entries today.

Local gate — confirmed present, and deliberately untouched. bosn declares its gate in local-gate.toml ([gate], plus [gate.isolation], [gate.lanes.*], [gate.trust], [gate.replay]). ci-lint reads ci.toml's [local.gate] only when present, so no [local.gate] key is added here and local-gate.toml stays authoritative. Verified directly: load_gate_config() returns the local-gate.toml config with zero findings after this change.

Arithmetic — it fits

Every max is at or above the largest entry actually observed. This is the direction that matters: ci-lint cache janitor LRU-evicts an evict = "lru" family down to max x cardinality, so an under-stated max would delete caches the next run genuinely restores. An over-stated max only costs budget headroom.

build-cache      1050MB x 4 (platform) = 4,404,019,200 B
solo-toolchain    210MB x 4 (platform) =   880,803,840 B
soldr-mini         12MB x 4 (platform) =    50,331,648 B
uv                  1MB x 4 (platform) =     4,194,304 B
steady total                          = 5,339,348,992 B
+ lockfile-change peak                =             0 B
+ [cache.pr].budget                   =             0 B
= worst case                          = 5,339,348,992 B   (52% of 9.5 GB)

CACHE-004, CACHE-029 and CACHE-030 are all clean, validated against ci.yml at 527cc179 (the ref bosn already pins).

per = "platform" throughout: none of these families can be counted more tightly, because each key already embeds a per-toolchain/per-lockfile hash — the same over-count CACHE-029 documents for setup-uv.

What it reclaims

ci-lint cache janitor --dry-run against the live repository:

family          before(n)   before(B)    after(n)     after(B)
build-cache         16   9858848811          3   2073450482
solo-toolchain      4     775424833          4     775424833
soldr-mini          2      21770955          2      21770955
undeclared        196         85704          0            0
uv                  3        616911          3        616911

~7.8 GB reclaimed on the build cache alone (9.86 GB -> 2.07 GB), via CACHE-006 superseded-entry cleanup. Nothing was deleted — this PR only adds the declaration.

Two deviations worth your review

1. profile = "cache-policy-only". bosn ships a Rust-backed PyPI wheel but has not adopted the rust-pypi-app suite/publish contract. Claiming that profile would assert things bosn has not adopted (its enforced requirements: [python], [rust], required unit+smoke suites, OIDC publish). Only rust-pypi-app has enforced requirements, so this value loads and is not cross-checked.

2. [allow].setup-soldr.only-in / [allow].cache-actions.only-in = .github/workflows. bosn has no .github/actions/ wrapper — it calls setup-soldr and actions/cache directly from its workflows. These keys record bosn's real layout rather than inventing a wrapper directory it does not have. This is a repo-specific deviation from the fleet's wrapper convention, recorded rather than silently assumed. Without them, CACHE-001 and CACHE-009 fire 15 times against a wrapper bosn does not have.

Also note the empty-but-present [suites] / [flow] / [tags] / [local] / [allow] / [publish] tables: schema 3 requires those keys to load, and declaring them empty is the honest "nothing declared yet" — filling them in is a separate piece of work.

Not done here

ci-lint cache janitor (the actual reclaim) and cache trim — this PR only adds the declaration.

[zackees]

Superseded by #512, which merged a ci.toml to main while this was in draft. Closing rather than merging two competing cache declarations for the same repository.

The declaration in #512 is the same shape and reaches the same conclusion this PR did: compile is the large family (3.28 GiB on linux-x64), evict = "lru" on the growing ones, and the janitor dry-run plans 9.86 -> 2.07 GB. Both agree that the 196 att1-* entries are ci-lint's own attestation caches (~440 B each), not a setup-soldr family.

Nothing from this PR's analysis is lost: the agent's findings are recorded in zackees/ci.yml#344 and the setup-soldr-targetcache-* via gap it identified is fixed in zackees/ci.yml#345.