Require native x86-64 GNU 13.3 Release builds in CI by luisleo526 · Pull Request #742 · pineforge-4pass/pineforge-engine

luisleo526 · 2026-11-05T03:45:18Z

Add a permanent native x86-64 GNU 13.3 Release build leg to engine CI, so no pull request or push to main can skip the release toolchain's architecture.

The PR workflow and the post-merge workflow both run the native x86-64 Release build (scripts/ci_native_x86_release.py), and their aggregates require it.
Preflight pins the new leg and its admission, and its tests cover the aggregate wiring, including mutations scoped to the jobs they target.
docs/ci.md describes the leg; the commit that changes a docs sentence names it.

Validation on this tree: the new module's tests, the rerun controller's tests and the whole preflight test module pass; the doc-reverts check reports no unnamed deletions.

🤖 Generated with Claude Code

Build the exact head with the source layer enabled using native GNU 13.3.0 on the existing uncredentialed x86 runner. Require its actual success in PR and post results, including documentation-only and GitHub-only changes. Retain compiler, configuration and build diagnostics and the independent orchestration controls. This commit names the intentional docs/ci.md deletion required by the doc-revert gate: f85ce18 introduced the sentence "GKE preflight, tiered by the main classifier"; this workflow update removes that sentence as part of the named policy change.

Require the native build dependency in the existing result contract and keep its post job on contents-read permissions. Update the existing ARM and result-shell fixtures for the added dependency and native result while preserving independent failed, canceled, skipped and missing-result checks.

Exercise native success and unsuccessful results in the existing PR and post aggregate matrices, retain each exact refusal assertion, and include the two new declared runner sites in the routing inventory controls.

Keep the result-always mutation scoped to the result job and retain the independent runner-parallelism assertion for the quoted arm job fixture.

+import subprocess
+import sys
+import tempfile
+import unittest


graphify-labs

Graphify reviewed this change.

Worth a look — the grounded gate found no coupling regressions or blocking issues, but 2 advisory finding(s) below merit a look before merge.

Not checked: tests were not run; formal verification proved 0 of 4 changed function(s) (1 sampled, not proven, 2 not verified).

Formal verification. 1 change(s) alter behavior, breaking input(s) attached. PR-changed functions: 2/4 verified (0 proven, 1 may-equivalent, 1 distinguished) · 2 not verified (2 vacuous).

Behavior changes: gke\_admit\_workflow\_findings changes behavior, here is the input that shows it.

The verifier found a concrete input on which gke\_admit\_workflow\_findings behaves differently before and after the change. If that change is intended, ship it; if not, this is your bug.

Guarantee: This difference was REPRODUCED, the verifier actually ran both versions on that input and saw them disagree. It is real, not an artifact.

Evidence: On input \{"workflow":"'a'","name":"''"\}, the old code produced \[': trigger must be exactly pull\_request\_target', ': trigger must restrict branches to main', ': trigger types are incomplete or reordered', ': run\-name must bind the PR number and head SHA', ':… but the new code produces \[': trigger must be exactly pull\_request\_target', ': trigger must restrict branches to main', ': trigger types are incomplete or reordered', ': run\-name must bind the PR number and head SHA', ':…. Paste that input straight into a regression test.

Not verified on this run: check\_commands (vacuous: never exercised), pipeline\_workflow\_findings (vacuous: never exercised).

Graphify review — findings

Adds a required native x86 GNU 13.3.0 Release build, build-x86-gcc133, to both the PR admission workflow and the post workflow. It runs ci_native_x86_release.py on a 32-cpu GKE runner and uploads logs and artifacts even when the build fails. The PR legs and result jobs and the post build-gate aggregate now fail unless it succeeds, so docs-only and GitHub-only changes can no longer skip it, and a skipped result in the post aggregate counts as a failure instead of passing like the other docs-only skips. Updates the preflight checks, their tests and docs/ci.md to cover the new job and its runner policy.

Worth a look

Docs-only and GitHub-only PRs now must run the native x86 build — .github/workflows/gke-pr.yml:285 · Escalate · medium
- NOT verified (no proof, no reproducing execution) — needs human review
Post-CI docs-only aggregate no longer permits the new native x86 leg to be skipped — .github/workflows/ci-post.yml:814 · Escalate · medium
- NOT verified (no proof, no reproducing execution) — needs human review

Review partial — this diff was larger than one review pass covers, so later files were not reviewed; some findings may be missing.

Analysis details — impact, health, verification

Impact & health

Graphify review

Impact — 1033 functions depend on the 1005 functions this change touches.

Health — this change adds coupling hotspots:

worse: gke_admit_workflow_findings() — 16 callers, 12 callees
worse: _job_values() — 30 callers, 3 callees
new: native_x86_job_findings() — 2 callers, 7 callees
worse: pipeline_workflow_findings() — 1 callers, 13 callees
new: main() — 1 callers, 10 callees

Verification — 1033 functions in the blast radius were not formally verified this run (proofs are advisory here).

Gate & verification

graphify gate

PASS — objectively clean (no health regressions, tests not run — proofs not run this pass (advisory)). Grounded, not self-assessed.

Advisory (not blocking):

verification_scope: 1033 function(s) in the blast radius were not formally verified this run

Docs that may be stale (advisory)

AGENTS.md § Build (lines 12-25): references changed symbols cmake
AGENTS.md § Layout (lines 26-41): references changed symbols cmake
AGENTS.md § What CI runs, per trigger (lines 46-69): references changed symbols verify
AGENTS.md § While developing: run only what touches your change (lines 83-90): references changed symbols cmake
AGENTS.md § Safety rules (lines 117-127): references changed symbols cmake
CHANGELOG.md § Unreleased (lines 8-135): references changed symbols run
CHANGELOG.md § Live ledger report-checkpoint layouts (lines 346-353): references changed symbols run
CHANGELOG.md § Native live report checkpoints (lines 354-385): references changed symbols verify
CHANGELOG.md § Native live report stream updates (lines 386-450): references changed symbols run
CHANGELOG.md § Live ledger resource control (lines 527-546): references changed symbols run

…and 10 more.

Formal verification

Behavior changes: gke\_admit\_workflow\_findings changes behavior, here is the input that shows it.

The verifier found a concrete input on which gke\_admit\_workflow\_findings behaves differently before and after the change. If that change is intended, ship it; if not, this is your bug.

Guarantee: This difference was REPRODUCED, the verifier actually ran both versions on that input and saw them disagree. It is real, not an artifact.

Evidence: On input \{"workflow":"'a'","name":"''"\}, the old code produced \[': trigger must be exactly pull\_request\_target', ': trigger must restrict branches to main', ': trigger types are incomplete or reordered', ': run\-name must bind the PR number and head SHA', ':… but the new code produces \[': trigger must be exactly pull\_request\_target', ': trigger must restrict branches to main', ': trigger types are incomplete or reordered', ': run\-name must bind the PR number and head SHA', ':…. Paste that input straight into a regression test.

No difference found (not proven): No behavior difference found in \_sized (not a proof).

The verifier ran both versions of \_sized on many inputs and saw identical behavior every time. Strong evidence the change is safe, but evidence, not a proof.

Guarantee: Empirical: differential testing (both versions run on many generated inputs). A divergence on an untested input remains possible, so this is 'no counterexample found', not 'proven equivalent'.

Note: An input the sampler did not try could still differ.

Could not verify: Could not verify check\_commands.

The verifier did not have enough to check check\_commands, so it is saying so rather than guessing. No false assurance is the whole point.

Guarantee: No guarantee either way, this is an honest abstention, not a pass.

Note: Reason: not verifiable: all 90 sampled inputs raised on both versions — the function never executed, so 'no divergence' would be vacuous (mostly NameError — names the real obstacle, not a sampling gap)

Could not verify: Could not verify pipeline\_workflow\_findings.

The verifier did not have enough to check pipeline\_workflow\_findings, so it is saying so rather than guessing. No false assurance is the whole point.

Guarantee: No guarantee either way, this is an honest abstention, not a pass.

Note: Reason: not verifiable: all 63 sampled inputs raised on both versions — the function never executed, so 'no divergence' would be vacuous (mostly TypeError — names the real obstacle, not a sampling gap)

· 3 grounded finding(s) anchored inline below; 2 more finding(s) on lines outside this diff (see the check run).

graphify-labs · 2026-11-05T06:05:46Z

+    return parser.parse_args(argv)
+
+
+def main(argv: list[str] | None = None) -> int:


⚠️ Health regression — main()

fans out to 10 callees (efferent coupling).

Grounded coupling-delta finding (deterministic), not an LLM guess.

graphify-labs · 2026-11-05T06:05:46Z

    return findings


+def native_x86_job_findings(job: str, name: str, *, pr: bool) -> list[str]:


⚠️ Health regression — native_x86_job_findings()

fans out to 7 callees (efferent coupling).

Grounded coupling-delta finding (deterministic), not an LLM guess.

graphify-labs · 2026-11-05T06:05:46Z

+    return list(dict.fromkeys(findings))
+
+
 def pipeline_workflow_findings(workflow: str, name: str, *, pr: bool) -> list[str]:


⚠️ Health regression — pipeline_workflow_findings()

fans out to 13 callees (efferent coupling).

Grounded coupling-delta finding (deterministic), not an LLM guess.

…elease-required

Merge main aff553b into the #742 branch without rebasing or force-updating it. Keep the complete #743 main delta. Conflict resolutions: - scripts/ci_preflight.py: keep #742's NATIVE_X86_JOB mapping to the spot 32CPU label while retaining main's on-demand build and sanitizer labels. - scripts/test_ci_preflight.py: keep the matching NATIVE_X86_JOB expectation and main's on-demand build and sanitizer expectations. All other main hunks are retained, including the workflow, allowlist, docs, rerun-controller, release-gate, and rerun-preempted changes.

Keep the merge head's on-demand post-merge labels while retaining the spot native-x86 job added by #742. Include the spot label in the post-sized mirror expectations and in the actionlint runner-site map for ci-post.yml. This closes the exact preflight finding on 41f08d2 without changing workflow labels or weakening the runner allowlist.

luisleo526 added 4 commits November 5, 2026 11:38

Complete native x86 aggregate regression fixtures

693443d

Exercise native success and unsuccessful results in the existing PR and post aggregate matrices, retain each exact refusal assertion, and include the two new declared runner sites in the routing inventory controls.

Scope aggregate mutations to their intended jobs

5efac4a

Keep the result-always mutation scoped to the result job and retain the independent runner-parallelism assertion for the quoted arm job fixture.

github-code-quality Bot found potential problems Nov 5, 2026

View reviewed changes

Comment thread scripts/test_ci_native_x86_release.py

import subprocess

import sys

import tempfile

import unittest

graphify-labs Bot reviewed Nov 5, 2026

View reviewed changes

luisleo526 added 3 commits November 5, 2026 16:14

Merge commit '9e42fe999948cc06ece23acde0d5bde803888cbc' into ci/x86-r…

4737131

…elease-required

luisleo526 merged commit 3080b40 into main Nov 5, 2026
12 of 14 checks passed

luisleo526 deployed to release-bot November 5, 2026 15:34 — with GitHub Actions Active

Navigation Menu

Repository navigation

Require native x86-64 GNU 13.3 Release builds in CI - #742

Require native x86-64 GNU 13.3 Release builds in CI#742
luisleo526 merged 7 commits into
mainfrom
ci/x86-release-required

luisleo526 commented Nov 5, 2026

Uh oh!

graphify-labs Bot left a comment •

edited

Loading

Uh oh!

graphify-labs Bot Nov 5, 2026

Uh oh!

graphify-labs Bot Nov 5, 2026

Uh oh!

graphify-labs Bot Nov 5, 2026

Uh oh!

Uh oh!

This branch was successfully deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

		return parser.parse_args(argv)


		def main(argv: list[str] \| None = None) -> int:

		return findings


		def native_x86_job_findings(job: str, name: str, *, pr: bool) -> list[str]:

		return list(dict.fromkeys(findings))


		def pipeline_workflow_findings(workflow: str, name: str, *, pr: bool) -> list[str]:

Conversation

luisleo526 commented Nov 5, 2026

Uh oh!

graphify-labs Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Graphify review — findings

Impact & health

Graphify review

Gate & verification

graphify gate

Docs that may be stale (advisory)

Formal verification

Uh oh!

graphify-labs Bot Nov 5, 2026

Choose a reason for hiding this comment

Uh oh!

graphify-labs Bot Nov 5, 2026

Choose a reason for hiding this comment

Uh oh!

graphify-labs Bot Nov 5, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

This branch was successfully deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

graphify-labs Bot left a comment •

edited

Loading