Implement the remaining candidate rules in ci-lint #44

Activity

1. zackees commented on Sep 29, 2026

   

   zackees

   on Sep 29, 2026

   OwnerAuthor

   More actions

   Adding the #5 items that were routed here when #5 closed:

   • Implement RUST-008, RUST-009 and RUST-010 (candidates owned by policy(rust): make coverage-per-compile-minute the objective; require cheap cross-target checks, a cache budget, and a toolchain sourcing order #5) with RED/GREEN fixtures.
   • Write the objective/tier section in policy-rust.md, plus a measured bug-class ratio showing whether cheap checks catch ~90–95% (policy(rust): make coverage-per-compile-minute the objective; require cheap cross-target checks, a cache budget, and a toolchain sourcing order #5 treats that figure as a target to measure, not a fact).
   • Record clud's stale-docs finding in docs/case-studies/clud-ci-cost.md: its docs/architecture/ci.md claims native three-OS Dylint that no longer runs, a GEN-010-shaped mismatch.
2. zackees

   added a parent issue on Sep 29, 2026

   • meta: round 2 — pristine rust-pypi-app template (resolve every #6 follow-up against template-python-rust-cmd) #52
3. zackees

   added a commit that references this issue on Sep 29, 2026

   feat(ci-lint): GEN-003 (skip guard), PY-001 (benchmark dataclass scan…

   ...

   ab275b4
4. zackees

   closed this as completedin ab275b4on Sep 29, 2026
5. zackees

   reopened this on Sep 29, 2026
6. zackees commented on Sep 29, 2026

   

   zackees

   on Sep 29, 2026

   OwnerAuthor

   More actions

   Reopening: my squash-merge commit message included "Closes #44 (partially — see below)" and GitHub's auto-close parser matched the "Closes #44" pattern regardless of the qualifier, closing this prematurely. This round (M2-21) is a partial completion.

   Done (PR #67, merged)

   • RUST-001 now emitted as its own Finding alongside TOOL-001 (bare cargo/rustc/rustup/maturin) and CACHE-009 (setup-soldr outside its sanctioned wrapper).
   • GEN-003 (ci_lint.rules.profile_required, precheck group 13): a literal if: false disabling every step invoking a [suites.<id>].required = true suite's run command is a violation. A required suite whose run command appears in no literal run: line at all is needs_review (the "missing" half still needs the fleet-wide inventory from chore: inventory slow PR CI and manual Soldr setup across repos #2 to check reliably against plan-dispatched invocation — that half stays open).
   • PY-001 (ci_lint.rules.py_benchmark, precheck group 14): AST scan of [suites.perf].run's declared entry point(s), one ci/*.py level deep, for typing.Any and a result/record/benchmark/bench-named function returning a bare/subscripted dict.

   All three have RED/GREEN fixtures under ci_lint/tests/fixtures/{RUST-001,GEN-003,PY-001}/, and python3 -m ci_lint selftest / uv run --no-project --with pyyaml python3 -m ci_lint selftest both pass (455 tests).

   Not done in this round

   • PERF-001 (PR timing breach from recorded run-history JSON)
   • GEN-007 (paths: filter broader than blast radius)
   • GEN-009 (cache budget rollup, live)
   • GEN-010 (docs claim merge queue/protection settings don't have, live audit)
   • RUST-008, RUST-009, RUST-010
   • policy-rust.md's objective/tier section (policy(rust): make coverage-per-compile-minute the objective; require cheap cross-target checks, a cache budget, and a toolchain sourcing order #5)
   • Recording clud's stale ci.md Dylint claim in docs/case-studies/clud-ci-cost.md under GEN-010

   These need a follow-up round before this issue is closed for real.
7. zackees

   closed this as completedin 3c61187on Sep 29, 2026
8. zackees commented on Sep 29, 2026

   

   zackees

   on Sep 29, 2026

   OwnerAuthor

   More actions

   Part A done (round M2-20), merged in #68:

   • CACHE-007 — cache payload content classification against [cache].never (static: every sanctioned actions/cache* step's declared path: inputs; runtime: ci-lint cache payload-check --manifest <file>)
   • PKG-001 — PyPI app quick gate must select a required wheel-install-smoke suite
   • PKG-002 — npm app (only when package.json exists) quick gate must run npm pack + npm ci/npm install
   • BIN-001 — native-binary apps must declare a musl Linux platform floor (or a recorded exception)
   • BIN-002 — native-binary apps' Windows platforms restricted to MSVC ABI, arch-matching ids, covering both x64 and arm64
   • ACT-001 — ci-lint act audit --store-dir <dir>, ported from template-python-rust-cmd's ci/localrun/cache_audit.py into ci_lint.act_audit

   All six now "Enforced by ci-lint" in docs/policy-general.md / docs/policy-rust.md / docs/ci-toml.md, with RED/GREEN fixtures under ci_lint/tests/fixtures/{BIN-001,BIN-002,PKG-001,PKG-002,CACHE-007} and 20 new unit tests. python3 -m ci_lint selftest: 473 tests, OK, verified both with and without PyYAML, rebased onto current main (part B's M2-21 changes included).

   Part B (the remaining IDs in this issue) is still pending — not closing this issue yet.
9. zackees

   added a commit that references this issue on Sep 29, 2026

   feat(ci-lint): GEN-009 cache-budget rollup, GEN-010 doc-claim audit (…

   ...

   6cdb55a
10. zackees commented on Sep 29, 2026

    

    zackees

    on Sep 29, 2026

    OwnerAuthor

    More actions

    M2-23 done, merged in #72:

    • GEN-009 — live cache-budget rollup over CACHE-003/004/006/008 (a fleet-level verdict, no new detection signal): ci_lint.cache.audit's _check_gen_009 (full rollup, wired into audit_classified → ci-lint cache audit / precheck --live), plus a same-call gen_009_reason on ci-lint cache budget's verdict (CACHE-003/006 only, zero extra live calls).
    • GEN-010 — docs (README.md/AGENTS.md/CLAUDE.md/docs/architecture/*.md) claiming a merge queue, branch protection, or native-OS Dylint that settings/workflows don't actually have: new module ci_lint.rules.doc_claims resolves the native-Dylint claim fully offline against the repo's own workflow runs-on labels; ci_lint.settings_audit.check_gen_010 (live) resolves the merge-queue/branch-protection claims for real, reusing GEN-006/GEN-011's existing branch-protection/rulesets fetch.
    • docs/policy-rust.md gains the objective/tier section from policy(rust): make coverage-per-compile-minute the objective; require cheap cross-target checks, a cache budget, and a toolchain sourcing order #5 (coverage-per-compile-minute tradeoff, the four tiers, and how to measure the 90–95% cheap-tier target — clud#1439/#1440/#1446 as the reference fixture).
    • docs/case-studies/clud-ci-cost.md records the GEN-010 native-Dylint claim shape; re-verified live against clud's current docs/architecture/ci.md (2026-09-28) — the original stale claim is gone (clud fixed its own docs since policy(rust): make coverage-per-compile-minute the objective; require cheap cross-target checks, a cache budget, and a toolchain sourcing order #5 was filed), so it's recorded as historical evidence, not a live fixture.

    RED/GREEN fixtures and evidence in #72. python3 -m ci_lint selftest / uv run --no-project --with pyyaml python3 -m ci_lint selftest: 487 tests, OK, both ways.

    Remaining in this issue (owned by the parallel M2-22 round, not this one): PERF-001, GEN-007, RUST-008–RUST-010. Not closing #44 — leaving that to whichever round finishes last.
11. zackees

    added 2 commits that reference this issue on Sep 29, 2026

    feat(ci-lint): GEN-007, RUST-008/009/010, PERF-001 (M2-22, ci.yml#52 …

    ...

    71262b0

    feat(ci-lint): GEN-007, RUST-008/009/010, PERF-001 (M2-22, ci.yml#52 …

    ...

    38ccb07
12. zackees commented on Sep 29, 2026

    

    zackees

    on Sep 29, 2026

    OwnerAuthor

    More actions

    M2-22 status: done. Implemented and merged the five reserved rule IDs this sub-round assigned (PERF-001, GEN-007, RUST-008, RUST-009, RUST-010): PR #73 (squash-merged into main).

    • GEN-007 -- static precheck, always needs_review: a pull_request/push trigger with no paths: filter (or a repo-wide wildcard) while a job fans out over a >=3-entry strategy.matrix.
    • RUST-008 -- static precheck: the "fast"/"quick" job must run cargo check/soldr cargo check --target <T> for every declared [platforms].*.target, unless a dylints/**/*.rs path naming "boundary" proves a Dylint boundary lint.
    • RUST-009 -- runtime (ci-lint rust toolchain-build-check --log <file>...): per-run std/core/driver builds from real job-log evidence.
    • RUST-010 -- static precheck: soldr cook off Linux, saves with no default-branch guard, or post-build target/ capture.
    • PERF-001 -- runtime (ci-lint perf pr-timing --history <scan.json>...): PR timing breach from recorded run-history JSON, docs/policy-general.md's sample/threshold rule, confirmed only on two successive scans.

    docs/policy-general.md/docs/policy-rust.md Status columns and AGENTS.md's rule-ID registry updated to "Enforced by ci-lint" for all five. python3 -m ci_lint selftest passes both with and without PyYAML (509 tests). Rebased twice mid-round to absorb M2-20 (#68) and M2-23 (#72, GEN-009/GEN-010) landing concurrently.

    No new upstream issues filed this round.