formal-governance.yml

name: Gate A

on:
  push:
    branches: [main]
  pull_request:
  merge_group:

permissions:
  contents: read

env:
  CARGO_BUILD_JOBS: "2"
  RUST_VERSION: 1.97.1
  RUSTUP_TOOLCHAIN: 1.97.1
  ACTIONLINT_VERSION: 1.7.12
  ACTIONLINT_LINUX_SHA256: 8aca8db96f1b94770f1b0d72b6dddcb1ebb8123cb3712530b08cc387b349a3d8
  VERUS_VERSION: 0.2026.08.09.92f466f
  VERUS_LINUX_SHA256: 2f5a41c553f424aacdd732339e9d125563716a0b003c27730f75d6f81a282cef
  PERITUS_PROOF_IMPACT_BASE: ${{ github.event.pull_request.base.sha || github.event.merge_group.base_sha || github.event.before }}

jobs:
  bootstrap:
    name: Candidate bootstrap
    runs-on: ubuntu-24.04
    timeout-minutes: 5
    steps:
      - name: Check out candidate revision
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          repository: ${{ github.repository }}
          ref: ${{ github.sha }}
          path: candidate
          fetch-depth: 0
          persist-credentials: false
      - name: Verify candidate pre-Cargo policy
        shell: bash
        run: git -C candidate diff --no-ext-diff --no-textconv --exit-code 6ca5f56d2ab12e93f155d684b33f4a86c2f877b8 -- .cargo/config.toml .gitattributes

  policy:
    name: Candidate policy
    needs: bootstrap
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    steps:
      - name: Check out candidate revision
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          repository: ${{ github.repository }}
          ref: ${{ github.sha }}
          path: candidate
          fetch-depth: 0
          persist-credentials: false
      - name: Verify candidate pre-Cargo policy
        shell: bash
        run: git -C candidate diff --no-ext-diff --no-textconv --exit-code 6ca5f56d2ab12e93f155d684b33f4a86c2f877b8 -- .cargo/config.toml .gitattributes
      - name: Install pinned Rust
        uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # v1
        env:
          RUSTUP_MAX_RETRIES: "10"
        with:
          toolchain: ${{ env.RUST_VERSION }}
      - name: Evaluate candidate policy
        working-directory: candidate
        run: cargo +1.97.1 run --locked --package xtask -- all

  workflow-lint:
    name: Workflow lint
    needs: policy
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    steps:
      - name: Check out candidate revision
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          repository: ${{ github.repository }}
          ref: ${{ github.sha }}
          path: candidate
          fetch-depth: 0
          persist-credentials: false
      - name: Install digest-checked actionlint archive
        shell: bash
        run: |
          set -euo pipefail
          archive="$RUNNER_TEMP/actionlint.tar.gz"
          install_root="$RUNNER_TEMP/peritus-actionlint"
          curl --fail --location --retry 3 \
            --output "$archive" \
            "https://github.com/rhysd/actionlint/releases/download/v$ACTIONLINT_VERSION/actionlint_${ACTIONLINT_VERSION}_linux_amd64.tar.gz"
          printf '%s  %s\n' "$ACTIONLINT_LINUX_SHA256" "$archive" | sha256sum --check --strict
          mkdir -p "$install_root"
          tar -xzf "$archive" -C "$install_root" actionlint
          printf '%s\n' "$install_root" >> "$GITHUB_PATH"
      - name: Lint every workflow
        working-directory: candidate
        run: actionlint -config-file .github/actionlint.yaml

  rust-format:
    name: Rust format source
    needs: policy
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    steps:
      - name: Check out candidate revision
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          repository: ${{ github.repository }}
          ref: ${{ github.sha }}
          path: candidate
          fetch-depth: 0
          persist-credentials: false
      - name: Verify candidate pre-Cargo policy
        shell: bash
        run: git -C candidate diff --no-ext-diff --no-textconv --exit-code 6ca5f56d2ab12e93f155d684b33f4a86c2f877b8 -- .cargo/config.toml .gitattributes
      - name: Install pinned Rust
        uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # v1
        env:
          RUSTUP_MAX_RETRIES: "10"
        with:
          toolchain: ${{ env.RUST_VERSION }}
          components: rustfmt
      - name: Check formatting
        working-directory: candidate
        run: cargo run --locked --package xtask -- format-check

  rust-shards:
    name: Rust shard ${{ matrix.operation }} ${{ matrix.shard }} (${{ matrix.os }})
    needs: policy
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-24.04, macos-15, windows-2025]
        operation: [build, test, doc-test, clippy, docs]
        shard: [foundation-state, runtime-tools, model-orchestration, app-runner, app-shell, testing, testing-platform, testing-external, edge]
        include:
          - { os: ubuntu-24.04, operation: test-platform-terminal-interactive, shard: testing-platform }
          - { os: ubuntu-24.04, operation: test-platform-terminal-signal, shard: testing-platform }
          - { os: ubuntu-24.04, operation: test-platform-terminal-cancel, shard: testing-platform }
          - { os: macos-15, operation: test-platform-terminal-interactive, shard: testing-platform }
          - { os: macos-15, operation: test-platform-terminal-signal, shard: testing-platform }
          - { os: macos-15, operation: test-platform-terminal-cancel, shard: testing-platform }
          - { os: windows-2025, operation: test-platform-terminal-interactive, shard: testing-platform }
          - { os: windows-2025, operation: test-platform-terminal-signal, shard: testing-platform }
          - { os: windows-2025, operation: test-platform-terminal-cancel, shard: testing-platform }
          - { os: ubuntu-24.04, operation: test-runner-recovery, shard: app-runner }
          - { os: ubuntu-24.04, operation: test-runner-product, shard: app-runner }
          - { os: macos-15, operation: test-runner-recovery, shard: app-runner }
          - { os: macos-15, operation: test-runner-product, shard: app-runner }
          - { os: windows-2025, operation: test-runner-recovery, shard: app-runner }
          - { os: windows-2025, operation: test-runner-product, shard: app-runner }
          - { os: ubuntu-24.04, operation: test-daemon, shard: app-shell }
          - { os: macos-15, operation: test-daemon, shard: app-shell }
          - { os: windows-2025, operation: test-daemon, shard: app-shell }
          - { os: windows-2025, operation: test-daemon-product, shard: app-shell }
          - { os: windows-2025, operation: test-daemon-cancellation, shard: app-shell }
          - { os: windows-2025, operation: test-daemon-continuation, shard: app-shell }
          - { os: windows-2025, operation: test-daemon-interaction, shard: app-shell }
          - { os: windows-2025, operation: test-daemon-folder, shard: app-shell }
          - { os: windows-2025, operation: test-daemon-workbench, shard: app-shell }
          - { os: windows-2025, operation: test-daemon-checkpoints, shard: app-shell }
          - { os: windows-2025, operation: test-daemon-models, shard: app-shell }
          - { os: windows-2025, operation: test-daemon-library, shard: app-shell }
          - { os: windows-2025, operation: test-daemon-review, shard: app-shell }
          - { os: windows-2025, operation: test-daemon-rewinds, shard: app-shell }
    runs-on: ${{ matrix.os }}
    timeout-minutes: 15
    steps:
      - name: Check out candidate revision
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          repository: ${{ github.repository }}
          ref: ${{ github.sha }}
          path: candidate
          fetch-depth: 0
          persist-credentials: false
      - name: Verify candidate pre-Cargo policy
        shell: bash
        run: git -C candidate diff --no-ext-diff --no-textconv --exit-code 6ca5f56d2ab12e93f155d684b33f4a86c2f877b8 -- .cargo/config.toml .gitattributes
      - name: Install pinned Rust
        uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # v1
        env:
          RUSTUP_MAX_RETRIES: "10"
        with:
          toolchain: ${{ env.RUST_VERSION }}
          components: clippy,rustfmt
      - name: Run reviewed package shard
        working-directory: candidate
        run: cargo run --locked --target-dir target/xtask-bootstrap --package xtask -- ci-shard ${{ matrix.operation }} ${{ matrix.shard }}

  rust:
    name: Rust ${{ matrix.operation }} (${{ matrix.os }})
    if: always()
    needs: [rust-format, rust-shards]
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-24.04, macos-15, windows-2025]
        operation: [fmt, build, test, doc-test, clippy, docs]
    runs-on: ubuntu-24.04
    timeout-minutes: 5
    steps:
      - name: Require every Rust shard
        shell: bash
        env:
          FORMAT_RESULT: ${{ needs.rust-format.result }}
          SHARD_RESULT: ${{ needs.rust-shards.result }}
        run: |
          test "$FORMAT_RESULT" = success
          test "$SHARD_RESULT" = success

  supply-chain:
    name: Supply chain
    needs: policy
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    steps:
      - name: Check out candidate revision
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          repository: ${{ github.repository }}
          ref: ${{ github.sha }}
          path: candidate
          fetch-depth: 0
          persist-credentials: false
      - name: Verify candidate pre-Cargo policy
        shell: bash
        run: git -C candidate diff --no-ext-diff --no-textconv --exit-code 6ca5f56d2ab12e93f155d684b33f4a86c2f877b8 -- .cargo/config.toml .gitattributes
      - name: Install pinned Rust
        uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # v1
        env:
          RUSTUP_MAX_RETRIES: "10"
        with:
          toolchain: ${{ env.RUST_VERSION }}
      - name: Install pinned cargo-deny
        working-directory: candidate
        run: cargo install cargo-deny --version 0.20.2 --locked
      - name: Check advisories, licenses, bans, and sources
        working-directory: candidate
        run: cargo deny --locked check

  verus-policy:
    name: Verus policy
    needs: policy
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    steps:
      - name: Check out candidate revision
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          repository: ${{ github.repository }}
          ref: ${{ github.sha }}
          path: candidate
          fetch-depth: 0
          persist-credentials: false
      - name: Verify candidate pre-Cargo policy
        shell: bash
        run: git -C candidate diff --no-ext-diff --no-textconv --exit-code 6ca5f56d2ab12e93f155d684b33f4a86c2f877b8 -- .cargo/config.toml .gitattributes
      - name: Install pinned Rust
        uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # v1
        env:
          RUSTUP_MAX_RETRIES: "10"
        with:
          toolchain: ${{ env.RUST_VERSION }}
      - name: Install digest-checked Verus archive
        shell: bash
        run: |
          set -euo pipefail
          archive="$RUNNER_TEMP/verus.zip"
          install_root="$RUNNER_TEMP/peritus-verus"
          curl --fail --location --retry 3 \
            --output "$archive" \
            "https://github.com/verus-lang/verus/releases/download/release/$VERUS_VERSION/verus-$VERUS_VERSION-x86-linux.zip"
          printf '%s  %s\n' "$VERUS_LINUX_SHA256" "$archive" | sha256sum --check --strict
          mkdir -p "$install_root"
          unzip -q "$archive" -d "$install_root"
          printf '%s\n' "$install_root/verus-x86-linux" >> "$GITHUB_PATH"
      - name: Probe every pinned tool component
        working-directory: candidate
        run: cargo +1.97.1 run --locked --package xtask -- toolchain-check
      - name: Enforce ordinary-Rust formal API contracts
        working-directory: candidate
        run: cargo +1.97.1 run --locked --package xtask -- ordinary-api-check

  verus-shards:
    name: Verus shard ${{ matrix.operation }} ${{ matrix.shard }}
    needs: policy
    strategy:
      fail-fast: false
      matrix:
        operation: [verus-verify, verus-verify-strict, verus-build, verus-build-strict]
        shard: [foundation-state, runtime-tools, model-orchestration, app-runner, app-shell, edge]
    runs-on: ubuntu-24.04
    timeout-minutes: 15
    steps:
      - name: Check out candidate revision
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          repository: ${{ github.repository }}
          ref: ${{ github.sha }}
          path: candidate
          fetch-depth: 0
          persist-credentials: false
      - name: Verify candidate pre-Cargo policy
        shell: bash
        run: git -C candidate diff --no-ext-diff --no-textconv --exit-code 6ca5f56d2ab12e93f155d684b33f4a86c2f877b8 -- .cargo/config.toml .gitattributes
      - name: Install pinned Rust
        uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # v1
        env:
          RUSTUP_MAX_RETRIES: "10"
        with:
          toolchain: ${{ env.RUST_VERSION }}
      - name: Install digest-checked Verus archive
        shell: bash
        run: |
          set -euo pipefail
          archive="$RUNNER_TEMP/verus.zip"
          install_root="$RUNNER_TEMP/peritus-verus"
          curl --fail --location --retry 3 \
            --output "$archive" \
            "https://github.com/verus-lang/verus/releases/download/release/$VERUS_VERSION/verus-$VERUS_VERSION-x86-linux.zip"
          printf '%s  %s\n' "$VERUS_LINUX_SHA256" "$archive" | sha256sum --check --strict
          mkdir -p "$install_root"
          unzip -q "$archive" -d "$install_root"
          printf '%s\n' "$install_root/verus-x86-linux" >> "$GITHUB_PATH"
      - name: Run reviewed Verus package shard
        working-directory: candidate
        run: cargo +1.97.1 run --locked --package xtask -- ci-shard ${{ matrix.operation }} ${{ matrix.shard }}

  verus:
    name: Verus
    if: always()
    needs: [verus-policy, verus-shards]
    runs-on: ubuntu-24.04
    timeout-minutes: 5
    steps:
      - name: Require every Verus shard
        shell: bash
        env:
          POLICY_RESULT: ${{ needs.verus-policy.result }}
          SHARD_RESULT: ${{ needs.verus-shards.result }}
        run: |
          test "$POLICY_RESULT" = success
          test "$SHARD_RESULT" = success

  gate-a:
    name: Gate A
    if: always()
    needs: [policy, workflow-lint, rust, supply-chain, verus]
    runs-on: ubuntu-24.04
    timeout-minutes: 5
    steps:
      - name: Require every Gate A job
        shell: bash
        env:
          POLICY_RESULT: ${{ needs.policy.result }}
          WORKFLOW_LINT_RESULT: ${{ needs.workflow-lint.result }}
          RUST_RESULT: ${{ needs.rust.result }}
          SUPPLY_CHAIN_RESULT: ${{ needs.supply-chain.result }}
          VERUS_RESULT: ${{ needs.verus.result }}
        run: |
          test "$POLICY_RESULT" = success
          test "$WORKFLOW_LINT_RESULT" = success
          test "$RUST_RESULT" = success
          test "$SUPPLY_CHAIN_RESULT" = success
          test "$VERUS_RESULT" = success