From e231ab6eebb52e04b742c8356deb60a71d862697 Mon Sep 17 00:00:00 2001 From: Jer Miller Date: Sun, 2 Aug 2026 16:31:49 -0600 Subject: [PATCH] ci: close Rust-only freeze gate gaps --- AGENTS.md | 13 +++++++++---- Makefile | 4 ++-- core/crates/solstone-core/tests/ci_gate_purity.rs | 7 +++++++ docs/PORTING.md | 7 ++++--- 4 files changed, 22 insertions(+), 9 deletions(-) diff --git a/AGENTS.md b/AGENTS.md index 97507c9d1..5323502cb 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -109,6 +109,7 @@ Verified against `Makefile`. Grouped by use. | Target | When to use | |--------|-------------| +| `make` / `make all` / `make build` | Build the native Rust workspace, excluding the Python-provisioned ONNX crate pair during the conversion freeze. | | `make format` | Format the Rust workspace with Cargo fmt; modifies Rust source. | | `make format-check` | Cargo fmt dry-run (`cargo fmt --all -- --check`); one of the Rust-only CI checks. | | `make test` | Alias for `make check-rust-test`: Rust workspace tests only, excluding the ONNX crate pair from host coverage. | @@ -124,7 +125,7 @@ Verified against `Makefile`. Grouped by use. | `make ci` | Rust-only gate: `check-rust-fmt`, MSRV, clippy, Rust tests, iOS canary, and Rust dependency policy. | | `make verify` | Alias for `make ci` during the Rust-conversion freeze. | | `make install-checks` | Directly runnable full Python-and-Rust preflight chain (format, ruff, layer hygiene, and related checks); no longer called by `ci` or `verify`. | -| `make check-layer-hygiene` | Run `scripts/check_layer_hygiene.py` alone. Useful when iterating on an L1–L2 violation flagged by CI. | +| `make check-layer-hygiene` | Run `scripts/check_layer_hygiene.py` alone. Useful when iterating on an L1–L2 violation flagged by `make install-checks`. | During the Rust-conversion freeze, use the narrowest applicable `make check-rust-*` target, then `make ci` as the settled Rust gate. The focused @@ -160,6 +161,10 @@ Do not rerun an unchanged failure merely to seek green. > release targets fail immediately. See > `docs/PORTING.md#rust-conversion-freeze`. +The rest of this section documents the retained release implementation for +post-freeze restoration. These commands do not reach that implementation while +the freeze is active. + DESTRUCTIVE: `bash scripts/release.sh --candidate` is fresh construction; before policy or build work it first runs `make release-checks`, then deletes prior raw build/dist outputs and that version's stale payload/evidence. It verifies the @@ -313,11 +318,11 @@ sets only the local verification path and may use any local filename. ## 6. Testing quickstart -- **Rust gate:** `make ci`, `make test`, `make verify`, and `make build` operate only on the native `core/` Cargo workspace during the Rust-conversion freeze. `make ci` runs formatting, MSRV, clippy, Rust tests, the iOS canary, and Rust dependency policy. -- **Python suite:** pytest files remain `test_*.py` with `test_*` functions, shared fixtures in `tests/conftest.py`, and the fixture journal at `tests/fixtures/journal/`. The autouse `set_test_journal_path` fixture is unchanged; tests that write, scan, or rebuild journal/index state must use `journal_copy` or a smaller `tmp_path` journal (see §8). Run this suite directly with bare `pytest` when needed. `tests/` and `solstone/apps/*/tests/` are unchanged, but the former Python Make rails—including `make test-app`, `make test-only`, and the other `make test-*` targets—now fail with the freeze diagnostic. +- **Rust gate:** `make` / `make all`, `make ci`, `make test`, `make verify`, and `make build` operate only on the native `core/` Cargo workspace during the Rust-conversion freeze. `make ci` runs formatting, MSRV, clippy, Rust tests, the iOS canary, and Rust dependency policy. +- **Python suite:** pytest files remain `test_*.py` with `test_*` functions, shared fixtures in `tests/conftest.py`, and the fixture journal at `tests/fixtures/journal/`. The autouse `set_test_journal_path` fixture is unchanged; tests that write, scan, or rebuild journal/index state must use `journal_copy` or a smaller `tmp_path` journal (see §8). Run this suite directly with bare `pytest` when needed. `tests/` and `solstone/apps/*/tests/` are unchanged, but the former Python Make rails, including `make test-app`, `make test-only`, and the other `make test-*` targets, now fail with the freeze diagnostic. - **Marked Python tests:** integration, performance, and release tests remain in the suite and can be selected with bare pytest as needed; their former Make rails are frozen. Live product verification still uses `make sandbox`. - **After editing `solstone/convey/` or `solstone/apps/`:** `journal restart-convey` to reload code in a running stack. -- **`make dev` + `make sandbox`** both write runtime artifacts into the fixtures journal; `tests/fixtures/journal/.gitignore` covers those — never commit them. +- **Runtime artifacts:** `make dev` writes them into the fixtures journal, where `tests/fixtures/journal/.gitignore` covers them. `make sandbox` uses an ephemeral copy and leaves only its `.sandbox.pid` and `.sandbox.journal` state files until `make sandbox-stop` removes them. - **Test invariants, not snapshots.** A test asserts what must hold in *every* valid state of the system — not what happens to be true today. Never pin a test to hand-edited prose (CHANGELOG / README / docs), to a value the system is *designed* to change (a version, a date, a growing count), or to a transient state. The tell: if doing the correct next thing — cut a release, rename a label, graduate a shipped changelog entry — turns the test red, the test is wrong, not the system. And test the code that *produces* a fact, never the rendered text about it. (A `[Unreleased]`-pinned changelog test was exactly this anti-pattern — its pass condition required the release process to *not* run; removed 2026-05-30.) Full depth: `docs/testing.md`. diff --git a/Makefile b/Makefile index 77f22c925..72b4ccb98 100644 --- a/Makefile +++ b/Makefile @@ -16,8 +16,8 @@ PYTEST_BASETEMP_FLAG := --basetemp "$$BASETEMP" .PHONY: install hopper-install uninstall test test-cov test-integration test-release release-checks test-performance test-app test-only format format-check install-checks ci clean clean-install coverage watch versions update update-prices preflight pre-commit skills render-packaging check-rust-fmt check-rust-msrv check-rust-clippy check-rust-test check-rust-ios check-rust-deny build check-release-advisory-liveness check-rust-release-manifest check-spl-dependency-pin audit openapi check-openapi check-openapi-observer-client-contract contract check-contract journal-resolution-vectors check-journal-resolution-vectors build-native-sol-grammar-oracle check-native-sol-grammar-oracle build-native-sol-root-contract check-native-sol-root-contract check-core-sdist-compile-inputs build-native-sol-journal-host-commands check-native-sol-journal-host-commands build-journal-access-rejection-inventory check-journal-access-rejection-inventory check-native-sol-python-manifest build-native-sol-inventory check-native-sol-inventory check-native-sol-architecture check-native-sol-contract-routes check-native-sol-conformance check-native-sol-coverage check-native-sol-no-python-spawn check-native-sol-compat check-native-sol-docs-links check-removed-time-parser-ready dev all sandbox sandbox-stop install-models speakers-analyze-helper parakeet-helper parakeet-helper-clean wheel-speakers-analyze-linux wheel-speakers-analyze-linux-x86_64 wheel-speakers-analyze-linux-aarch64 wheel-macos wheel-macos-clean verify verify-api verify-schemathesis update-api-baselines eval-schemas service-logs check-layer-hygiene check-api-conventions check-journal-io-access check-journal-io-mechanic check-journal-config-owner check-call-http-only check-no-legacy-chat check-channel-adapter-scrub check-brain-health-cutover check-tools-http-only check-access-imports-clean check-convey-bind-imports-clean check-schema-bounds check-thin-base-install check-extras-consistency check-cogitate-prompts smoke-cogitate release release-test publish-release publish-release-test FORCE -# Default target - install package in editable mode -all: install +# Default target - build the native workspace during the Rust-conversion freeze +all: build # Virtual environment directory VENV := .venv diff --git a/core/crates/solstone-core/tests/ci_gate_purity.rs b/core/crates/solstone-core/tests/ci_gate_purity.rs index c3db6d04a..f60cb51a9 100644 --- a/core/crates/solstone-core/tests/ci_gate_purity.rs +++ b/core/crates/solstone-core/tests/ci_gate_purity.rs @@ -135,10 +135,14 @@ fn make_ci_never_executes_forbidden_interpreters() { let root = repo_root(); let temp = TempDir::new("ci-gate-purity"); let shim_dir = temp.path.join("shims"); + let venv_dir = temp.path.join("venv"); + let venv_bin = venv_dir.join("bin"); let sentinel = temp.path.join("sentinel.log"); fs::create_dir(&shim_dir).expect("create shim directory"); + fs::create_dir_all(&venv_bin).expect("create poison virtualenv bin directory"); for name in ["python", "python3", "pytest", "ruff", "uv"] { write_forbidden_shim(&shim_dir.join(name), &sentinel); + write_forbidden_shim(&venv_bin.join(name), &sentinel); } let path = format!( @@ -148,6 +152,9 @@ fn make_ci_never_executes_forbidden_interpreters() { ); let output = Command::new("make") .arg("ci") + .arg(format!("VENV={}", venv_dir.display())) + .arg(format!("VENV_BIN={}", venv_bin.display())) + .arg(format!("PYTHON={}", venv_bin.join("python").display())) .current_dir(root) .env("PATH", path) .env("SOLSTONE_CI_PURITY_REENTRY", "1") diff --git a/docs/PORTING.md b/docs/PORTING.md index 655adadd6..82dbd9a3c 100644 --- a/docs/PORTING.md +++ b/docs/PORTING.md @@ -133,8 +133,9 @@ retroactively provide `ORT_LIB_PATH` to `ort-sys`. ### Rust-Conversion Freeze The development gate is Rust-only for the duration of the conversion. The -release rail—`release`, `release-test`, `release-checks`, `publish-release`, and -`publish-release-test`—and `scripts/release.sh` itself are hard-frozen: every +default `make` / `make all` target now aliases the native `make build` rail. The +release rail (`release`, `release-test`, `release-checks`, `publish-release`, and +`publish-release-test`) and `scripts/release.sh` itself are hard-frozen: every mode, including `--candidate`, `--recover`, and `--dry-run-linux`, fails immediately with a freeze diagnostic. The alternate Python test rails `test-cov`, `test-integration`, `test-release`, `test-performance`, `test-app`, @@ -142,7 +143,7 @@ immediately with a freeze diagnostic. The alternate Python test rails lifts only when the Makefile and release script are changed again. `make audit` is unaffected and still runs its Python advisory validator. -`make install-checks` and its roughly 45 Python-and-Rust sub-targets also remain +`make install-checks` and its Python-and-Rust sub-targets also remain runnable directly, but `ci` and `verify` no longer reach them. The Python product and pytest suite are unchanged; they are simply no longer gated by `ci`. -- 2.51.2