build: make sccache and fast linkers repository defaults

.agents/skills/manage-ci/references/current-inventory.md

@@ -458,29 +458,14 @@ bump `@playwright/test` in `crates/mesh-llm-ui/package.json`.
 
 ### `setup-macos-lld` composite
 
-`.github/actions/setup-macos-lld` replaces per-callsite
-`brew install lld` plus a hand-rolled `PATH`/`RUSTFLAGS` export with one
-composite: install lld via brew, resolve `$(brew --prefix lld)/bin`, link a
-real `edition = "2024"` probe binary with `-Clink-arg=-fuse-ld=lld`, then
-export `CARGO_ENCODED_RUSTFLAGS=-Clink-arg=-fuse-ld=lld` and the resolved bin
-directory. `CARGO_ENCODED_RUSTFLAGS` **replaces** any
-`target.<triple>.rustflags` from a checked-in `.cargo/config.toml` rather
-than merging with it -- confirmed safe here because every call site is
-macOS-gated and no call site touches an `android` target (the repo's
-`.cargo/config.toml` android entries carry a `-Wl,-z,max-page-size=16384`
-flag that would otherwise silently stop applying). Seven call sites:
+`.github/actions/setup-macos-lld` installs lld through Homebrew, adds its
+resolved bin directory to the job path, and invokes the checked-in
+`scripts/cargo-linker` probe. It does not export Rust flags. The repository
+Cargo config owns every later link, so Android target flags and caller flags
+continue to compose normally. Seven call sites:
 `ci-platform-checks-slice.yml`, `ci-macos-host-slice.yml`,
 `swift-sdk-artifact.yml`, `native-sdk-artifact.yml`,
-`node-sdk-addon-artifact.yml`, and two in `release.yml`. Only the first
-three were reachable by the temporary branch-head harness used to validate
-PR #1380 (no macOS row in
-`native-sdk-artifact.yml`/`node-sdk-addon-artifact.yml` ran there, and
-`release.yml` only runs on an actual release cut) -- the other four are
-statically cleared (macOS-gated, no android target on any of them) rather
-than proven by a real run. `node-sdk-addon-artifact.yml`'s own
-`Validate macOS x64 cross-linker` step is a deliberate near-duplicate of the
-composite's probe, not dead code: it passes `--target x86_64-apple-darwin`
-where the composite only probes the host target.
+`node-sdk-addon-artifact.yml`, and two in `release.yml`.
 
 ### A pinned digest is a frozen artifact
 
@@ -549,6 +534,23 @@ fail-open policy.
 
 ## Artifact and cache owners
 
+Repository Cargo defaults require `sccache` and select a target-specific
+linker driver. Full Linux runner images provide mold as the primary linker and
+lld as the compatibility control. macOS jobs install lld through the shared
+setup action; an installed ld64.lld that fails the active SDK/target probe
+falls back to Apple ld. Windows resolves rust-lld or lld-link. The Unix probe
+cache includes the linker, compiler, SDK, host and target-driver identity.
+
+The persistent macOS llama canary keeps a stable arm64-only sccache directory
+and adds an explicit C/C++ cache buster over architecture, backend, profile,
+compiler/SDK identity and native recipe inputs. Its CMake build directory
+remains run-unique, every staged archive is checked with `lipo`, and cache
+statistics are retained in the job log. The nightly KV workflow no longer
+clears the repository Rust wrapper. Every managed Windows compile job uses
+sccache with short `C:\\s` and `C:\\t` roots, and every Windows native backend
+asks CMake to hash object paths at 180 characters before the legacy MAX_PATH
+boundary.
+
 - `restore-release-ui` / `scripts/ui-distribution.py`: verify the shared release
   console's source SHA, version, complete file hashes and built JavaScript entry
   before platform-specific Rust compilation or SDK resource packaging. The
@@ -807,14 +809,15 @@ other historical receipts and CPU seed workload coverage remain unknown.
 See [CI topology](../../../../ci/ci.md#qualified-lean-ui-consumers) for admission
 scope and the required candidate-branch lane execution before merge.
 
-### Existing-seed CPU runtime canary
+### CPU runtime seed canary
 
-`depot-canary.yml` has an isolated manual `runtime-seed` mode with three cold/warm
-pairs on fresh GitHub-hosted CPU jobs. It restores only the admitted main seed,
+`depot-canary.yml` has an isolated default-branch-only manual `runtime-seed` mode
+with three cold/warm pairs on fresh GitHub-hosted CPU jobs. It restores only the
+current image-bound, recipe-bound main seed,
 never saves caches or changes production eligibility, and retains negative or
 inconclusive results. The catalog tracks this qualification restore separately
 from the five production restore-action bindings, including the explicitly
-disabled runtime binding. See [CI topology](../../../../ci/ci.md#existing-seed-cpu-runtime-canary)
+disabled runtime binding. See [CI topology](../../../../ci/ci.md#cpu-runtime-seed-canary)
 for identity, measurements and the completed qualification limits.
 
 Runtime exclusion evidence: run `34272984200/1`, source

.cargo/config.toml

@@ -1,3 +1,24 @@
+[build]
+rustc-wrapper = "sccache"
+
+[target.aarch64-apple-darwin]
+linker = "scripts/cargo-linker"
+
+[target.x86_64-apple-darwin]
+linker = "scripts/cargo-linker"
+
+[target.aarch64-unknown-linux-gnu]
+linker = "scripts/cargo-linker-linux-aarch64"
+
+[target.x86_64-unknown-linux-gnu]
+linker = "scripts/cargo-linker-linux-x86_64"
+
+[target.aarch64-pc-windows-msvc]
+linker = "scripts/cargo-linker.cmd"
+
+[target.x86_64-pc-windows-msvc]
+linker = "scripts/cargo-linker.cmd"
+
 [target.aarch64-linux-android]
 rustflags = ["-C", "link-arg=-Wl,-z,max-page-size=16384"]
 
@@ -7,10 +28,9 @@ rustflags = ["-C", "link-arg=-Wl,-z,max-page-size=16384"]
 [target.x86_64-linux-android]
 rustflags = ["-C", "link-arg=-Wl,-z,max-page-size=16384"]
 
-# No macOS linker is configured here on purpose. A checked-in absolute
-# `-fuse-ld=/opt/homebrew/bin/ld64.lld` applied to every cargo invocation,
-# hardcoded an Apple-Silicon Homebrew path, and could not check that the
-# linker works first. When lld fell behind the macOS SDK, every `cargo build`
-# and `cargo test` failed to link while `cargo check` stayed green, because
-# check never links. lld is now resolved and probed at build time by
-# scripts/lib/lld.sh, which `just with-lld` and scripts/build-host.sh use.
+# The repository linker drivers resolve and probe the active platform linker
+# before they execute it. Linux prefers mold and falls back to a compatible
+# lld or the platform linker; macOS prefers Homebrew ld64.lld and falls back
+# to Apple ld when the installed lld cannot parse the active SDK. Windows
+# resolves rust-lld/lld-link and fails with setup instructions when neither is
+# installed.

.github/actions/compute-changes/derive-outputs.sh

@@ -349,7 +349,7 @@ BACKEND_CHANGED="false"
 if [[ "$ALL_RUST" == "true" ]]; then
   BACKEND_CHANGED="true"
 elif [[ -n "$CHANGED_FILES" ]]; then
-  BACKEND_INPUTS=$(echo "$CHANGED_FILES" | grep -E '(^third_party/llama\.cpp/|^crates/skippy-ffi/|^scripts/(build-llama|prepare-llama|build-linux|build-linux-rocm|build-mac|build-windows|install-windows-sdk|build-host|build-release|package-release|package-native-runtime|verify-native-runtime-package|verify-checksum-sidecar|safe-extract-tar|compose-product-bundle|ci-compose-product-input|ci-client-readiness-smoke)\.|^\.github/actions/(prepare-host-input|prepare-windows-host-input|prepare-native-runtime-input|compose-product-input|resolve-native-toolchain-epoch|restore-smoke-inputs|restore-windows-abi-cache|save-and-verify-actions-cache|setup-windows-rocm-sdk)/|^\.github/workflows/(ci|main_[a-z]+|pr_[a-z]+|release|sdk-smoke|smoke)\.yml$|^\.github/cache-version\.txt$)' || true)
+  BACKEND_INPUTS=$(echo "$CHANGED_FILES" | grep -E '(^third_party/llama\.cpp/|^crates/skippy-ffi/|^scripts/(build-llama|prepare-llama|build-linux|build-linux-rocm|build-mac|build-windows|install-windows-sdk|build-host|build-release|package-release|package-native-runtime|verify-native-runtime-package|verify-checksum-sidecar|safe-extract-tar|compose-product-bundle|ci-compose-product-input|ci-client-readiness-smoke)\.|^\.github/actions/(prepare-host-input|prepare-windows-host-input|prepare-native-runtime-input|compose-product-input|resolve-native-toolchain-epoch|restore-smoke-inputs|restore-windows-abi-cache|save-and-verify-actions-cache|setup-windows-rocm-sdk|setup-windows-short-paths)/|^\.github/workflows/(ci|main_[a-z]+|pr_[a-z]+|release|sdk-smoke|smoke)\.yml$|^\.github/cache-version\.txt$)' || true)
   if [[ -n "$BACKEND_INPUTS" ]] || [[ "$BACKEND_RECIPE_CHANGED" == "true" ]]; then
     BACKEND_CHANGED="true"
   fi
@@ -361,8 +361,8 @@ if [[ "$FORCE_ALL" == "true" ]]; then
   WINDOWS_CPU_BUILD_REQUIRED="true"
   WINDOWS_GPU_BUILD_REQUIRED="true"
 elif [[ -n "$CHANGED_FILES" ]]; then
-  WINDOWS_CPU_INPUTS=$(echo "$CHANGED_FILES" | grep -E '(^crates/mesh-llm-release-footer/|^crates/mesh-llm-nodejs/|^crates/skippy-ffi/|^scripts/(build-windows|package-release)\.ps1$|^scripts/verify-host-dependencies\.py$|^scripts/(package-native-runtime|verify-native-runtime-package|verify-checksum-sidecar|safe-extract-tar|compose-product-bundle|ci-compose-product-input|ci-client-readiness-smoke)\.|^third_party/llama\.cpp/|^Cargo\.toml$|^Cargo\.lock$|^\.github/cache-version\.txt$|^\.github/workflows/(ci|main_[a-z]+|pr_[a-z]+|release|windows-warm-caches)\.yml$|^\.github/actions/(compute-changes/|prepare-windows-host-input/|prepare-native-runtime-input/|compose-product-input/|resolve-native-toolchain-epoch/|restore-windows-abi-cache/|save-and-verify-actions-cache/))' || true)
-  WINDOWS_GPU_INPUTS=$(echo "$CHANGED_FILES" | grep -E '(^crates/skippy-ffi/|^scripts/(build-windows|install-windows-sdk|package-release)\.ps1$|^scripts/verify-host-dependencies\.py$|^scripts/(package-native-runtime|verify-native-runtime-package|verify-checksum-sidecar|safe-extract-tar|compose-product-bundle|ci-compose-product-input|ci-client-readiness-smoke)\.|^scripts/windows-native-runtime-deps\.py$|^scripts/tests/test_windows_native_runtime_deps\.py$|^third_party/llama\.cpp/|^\.github/cache-version\.txt$|^\.github/workflows/(ci|main_[a-z]+|pr_[a-z]+|release|windows-warm-caches)\.yml$|^\.github/actions/(compute-changes/|prepare-windows-host-input/|prepare-native-runtime-input/|compose-product-input/|resolve-native-toolchain-epoch/|restore-windows-abi-cache/|save-and-verify-actions-cache/|setup-windows-rocm-sdk/))' || true)
+  WINDOWS_CPU_INPUTS=$(echo "$CHANGED_FILES" | grep -E '(^crates/mesh-llm-release-footer/|^crates/mesh-llm-nodejs/|^crates/skippy-ffi/|^scripts/(build-windows|package-release)\.ps1$|^scripts/verify-host-dependencies\.py$|^scripts/(package-native-runtime|verify-native-runtime-package|verify-checksum-sidecar|safe-extract-tar|compose-product-bundle|ci-compose-product-input|ci-client-readiness-smoke)\.|^third_party/llama\.cpp/|^Cargo\.toml$|^Cargo\.lock$|^\.github/cache-version\.txt$|^\.github/workflows/(ci|main_[a-z]+|pr_[a-z]+|release|windows-warm-caches)\.yml$|^\.github/actions/(compute-changes/|prepare-windows-host-input/|prepare-native-runtime-input/|compose-product-input/|resolve-native-toolchain-epoch/|restore-windows-abi-cache/|save-and-verify-actions-cache/|setup-windows-short-paths/))' || true)
+  WINDOWS_GPU_INPUTS=$(echo "$CHANGED_FILES" | grep -E '(^crates/skippy-ffi/|^scripts/(build-windows|install-windows-sdk|package-release)\.ps1$|^scripts/verify-host-dependencies\.py$|^scripts/(package-native-runtime|verify-native-runtime-package|verify-checksum-sidecar|safe-extract-tar|compose-product-bundle|ci-compose-product-input|ci-client-readiness-smoke)\.|^scripts/windows-native-runtime-deps\.py$|^scripts/tests/test_windows_native_runtime_deps\.py$|^third_party/llama\.cpp/|^\.github/cache-version\.txt$|^\.github/workflows/(ci|main_[a-z]+|pr_[a-z]+|release|windows-warm-caches)\.yml$|^\.github/actions/(compute-changes/|prepare-windows-host-input/|prepare-native-runtime-input/|compose-product-input/|resolve-native-toolchain-epoch/|restore-windows-abi-cache/|save-and-verify-actions-cache/|setup-windows-rocm-sdk/|setup-windows-short-paths/))' || true)
   if echo "$CHANGED_FILES" | grep -Eq '^\.github/workflows/(main|pr)_[a-z]+\.yml$'; then
     WINDOWS_CPU_INPUTS="ci-entry-workflow"
     WINDOWS_GPU_INPUTS="ci-entry-workflow"

.github/actions/setup-macos-lld/action.yml

@@ -1,8 +1,8 @@
-name: Set up macOS lld linker
+name: Set up macOS build accelerators
 description: >
-  Install and verify Homebrew's lld on a macOS runner. Always probe-links a
-  throwaway crate before any caller trusts the result -- a bad install must
-  fail loudly, not build silently against the wrong (or no) linker.
+  Install the required sccache and Homebrew lld tools on a macOS runner,
+  then run the repository linker probe. Cargo links keep using the same
+  repository driver afterwards.
   Deliberately uncached: mesh-llm's Actions cache is already over the 10GB
   per-repo quota (see gh cache list), so a ~1.9GB lld/llvm/z3 Cellar entry
   here would evict the far more expensive macOS Rust target/ cache for a
@@ -12,27 +12,38 @@ description: >
 runs:
   using: composite
   steps:
-    - name: Install lld
+    - name: Install required build tools
       shell: bash
-      run: brew install lld
+      run: |
+        set -euo pipefail
+        brew install lld
+        if ! command -v sccache >/dev/null 2>&1; then
+          brew install sccache
+        fi
 
-    - name: Verify lld links a real binary
+    - name: Verify repository build accelerators
       shell: bash
       run: |
         set -euo pipefail
+        command -v sccache >/dev/null 2>&1
+        sccache --version
+        if [[ "${SCCACHE_GHA_ENABLED:-}" == "true" &&
+              -z "${ACTIONS_CACHE_URL:-}" &&
+              -z "${ACTIONS_RESULTS_URL:-}" ]]; then
+          cache_dir="${SCCACHE_DIR:-$RUNNER_TEMP/mesh-llm-sccache}"
+          mkdir -p "$cache_dir"
+          echo "SCCACHE_DIR=$cache_dir" >> "$GITHUB_ENV"
+          echo "SCCACHE_GHA_ENABLED=false" >> "$GITHUB_ENV"
+          echo "SCCACHE_MULTILEVEL_CHAIN=disk" >> "$GITHUB_ENV"
+          echo "SCCACHE_IGNORE_SERVER_IO_ERROR=1" >> "$GITHUB_ENV"
+          export SCCACHE_GHA_ENABLED=false
+          export SCCACHE_DIR="$cache_dir"
+          export SCCACHE_MULTILEVEL_CHAIN=disk
+          export SCCACHE_IGNORE_SERVER_IO_ERROR=1
+          sccache --stop-server >/dev/null 2>&1 || true
+          sccache --start-server
+        fi
         lld_bin="$(brew --prefix lld)/bin"
         test -x "$lld_bin/ld64.lld"
-        probe="$RUNNER_TEMP/mesh-setup-macos-lld-probe"
-        mkdir -p "$probe/src"
-        printf '[package]\nname = "mesh-setup-macos-lld-probe"\nversion = "0.0.0"\nedition = "2024"\n' > "$probe/Cargo.toml"
-        printf 'fn main() {}\n' > "$probe/src/main.rs"
-        PATH="$lld_bin:$PATH" CARGO_ENCODED_RUSTFLAGS='-Clink-arg=-fuse-ld=lld' \
-          cargo rustc --quiet --manifest-path "$probe/Cargo.toml"
         echo "$lld_bin" >> "$GITHUB_PATH"
-        # Job-global via GITHUB_ENV, and cargo prefers CARGO_ENCODED_RUSTFLAGS
-        # over RUSTFLAGS -- any later step in the same job that sets RUSTFLAGS
-        # is silently ignored, and any macOS job that cross-builds an android
-        # target loses .cargo/config.toml's -Wl,-z,max-page-size=16384 for
-        # that job. Verified safe today: no other RUSTFLAGS setter and no
-        # android targets on any of this action's macOS call sites.
-        echo 'CARGO_ENCODED_RUSTFLAGS=-Clink-arg=-fuse-ld=lld' >> "$GITHUB_ENV"
+        PATH="$lld_bin:$PATH" scripts/cargo-linker --mesh-probe >/dev/null

.github/actions/setup-windows-short-paths/action.yml

@@ -0,0 +1,21 @@
+name: Configure short Windows build paths
+description: Keep compiler cache and temporary files below Windows toolchain path limits.
+
+runs:
+  using: composite
+  steps:
+    - name: Create short compiler paths
+      shell: pwsh
+      run: |
+        $ErrorActionPreference = "Stop"
+        $paths = @{
+          SCCACHE_DIR = "C:\s"
+          TEMP = "C:\t"
+          TMP = "C:\t"
+        }
+        New-Item -ItemType Directory -Force -Path $paths.SCCACHE_DIR, $paths.TEMP | Out-Null
+        foreach ($entry in $paths.GetEnumerator()) {
+          "$($entry.Key)=$($entry.Value)" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
+        }
+        Write-Host "Windows compiler cache: $($paths.SCCACHE_DIR)"
+        Write-Host "Windows temporary root: $($paths.TEMP)"

.github/workflows/cache-warm-sccache.yml

@@ -26,7 +26,6 @@ jobs:
       CARGO_INCREMENTAL: "0"
       MESH_LLM_SKIP_UI: "1"
       RUSTC_WRAPPER: sccache
-      RUSTFLAGS: "-C link-arg=-fuse-ld=lld"
       SCCACHE_GHA_ENABLED: "false"
       SCCACHE_CACHE_SIZE: 2G
     steps:
@@ -41,7 +40,7 @@ jobs:
         shell: bash
         run: |
           set -euo pipefail
-          key="mesh-llm-sccache-seed-linux-x86_64-img-f499b79b-epoch-f499b79b-v3-${{ hashFiles('Cargo.lock', '.github/cache-version.txt', 'Justfile', 'just/**') }}"
+          key="mesh-llm-sccache-seed-linux-x86_64-img-f499b79b-epoch-f499b79b-v3-${{ hashFiles('Cargo.lock', '.github/cache-version.txt', '.cargo/config.toml', 'scripts/cargo-linker', 'scripts/cargo-linker-linux-*', 'scripts/lib/lld.sh', 'Justfile', 'just/**') }}"
           echo "key=$key" >> "$GITHUB_OUTPUT"
       - name: Check for an existing exact seed
         id: restore

.github/workflows/ci-linux-host-slice.yml

@@ -108,7 +108,6 @@ jobs:
       MESH_LLM_SKIP_UI: "1"
       MESH_LLM_REQUIRE_SCCACHE: "1"
       RUSTC_WRAPPER: sccache
-      RUSTFLAGS: "-C link-arg=-fuse-ld=lld"
     steps:
       - uses: Mesh-LLM/mesh-llm/.github/actions/audit-depot-pr-isolation@ed07043b84d720aab30e75ed2f038f7042576f16
         with:
@@ -126,7 +125,7 @@ jobs:
         uses: ./.github/actions/restore-sccache-seed
         with:
           allow_trusted_seed: ${{ needs.runner_policy.outputs.allow_trusted_sccache_seed == 'true' && matrix.host.architecture == 'x86_64' && 'true' || 'false' }}
-          cache_key: mesh-llm-sccache-seed-linux-x86_64-img-f499b79b-epoch-f499b79b-v3-${{ hashFiles('Cargo.lock', '.github/cache-version.txt', 'Justfile', 'just/**') }}
+          cache_key: mesh-llm-sccache-seed-linux-x86_64-img-f499b79b-epoch-f499b79b-v3-${{ hashFiles('Cargo.lock', '.github/cache-version.txt', '.cargo/config.toml', 'scripts/cargo-linker', 'scripts/cargo-linker-linux-*', 'scripts/lib/lld.sh', 'Justfile', 'just/**') }}
       - uses: ./.github/actions/configure-sccache-gha
         with:
           allow_depot_remote_cache: ${{ needs.runner_policy.outputs.allow_depot_remote_cache }}

.github/workflows/ci-linux-runtime-slice.yml

@@ -134,7 +134,7 @@ jobs:
         with:
           # Three verified warm samples in run 34272984200/1 observed zero reuse.
           allow_trusted_seed: "false"
-          cache_key: mesh-llm-sccache-seed-linux-x86_64-img-f499b79b-epoch-f499b79b-v3-${{ hashFiles('Cargo.lock', '.github/cache-version.txt', 'Justfile', 'just/**') }}
+          cache_key: mesh-llm-sccache-seed-linux-x86_64-img-f499b79b-epoch-f499b79b-v3-${{ hashFiles('Cargo.lock', '.github/cache-version.txt', '.cargo/config.toml', 'scripts/cargo-linker', 'scripts/cargo-linker-linux-*', 'scripts/lib/lld.sh', 'Justfile', 'just/**') }}
       - uses: ./.github/actions/configure-sccache-gha
         with:
           allow_depot_remote_cache: ${{ needs.runner_policy.outputs.allow_depot_remote_cache }}

.github/workflows/ci-platform-checks-slice.yml

@@ -111,6 +111,8 @@ jobs:
         with:
           ref: ${{ inputs.source_sha || github.sha }}
           persist-credentials: false
+      - uses: ./.github/actions/setup-windows-short-paths
+        if: ${{ matrix.check.platform == 'windows' }}
       - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable 2026-08-20
       - name: Configure macOS linker
         if: ${{ matrix.check.platform == 'macos' }}

.github/workflows/ci-quality-slice.yml

@@ -238,7 +238,6 @@ jobs:
       run:
         shell: bash
     env:
-      RUSTFLAGS: "-C link-arg=-fuse-ld=lld"
       RUSTC_WRAPPER: sccache
     steps:
       - uses: Mesh-LLM/mesh-llm/.github/actions/audit-depot-pr-isolation@ed07043b84d720aab30e75ed2f038f7042576f16
@@ -257,7 +256,7 @@ jobs:
         uses: ./.github/actions/restore-sccache-seed
         with:
           allow_trusted_seed: ${{ needs.runner_policy.outputs.allow_trusted_sccache_seed }}
-          cache_key: mesh-llm-sccache-seed-linux-x86_64-img-f499b79b-epoch-f499b79b-v3-${{ hashFiles('Cargo.lock', '.github/cache-version.txt', 'Justfile', 'just/**') }}
+          cache_key: mesh-llm-sccache-seed-linux-x86_64-img-f499b79b-epoch-f499b79b-v3-${{ hashFiles('Cargo.lock', '.github/cache-version.txt', '.cargo/config.toml', 'scripts/cargo-linker', 'scripts/cargo-linker-linux-*', 'scripts/lib/lld.sh', 'Justfile', 'just/**') }}
       - uses: ./.github/actions/configure-sccache-gha
         with:
           allow_depot_remote_cache: ${{ needs.runner_policy.outputs.allow_depot_remote_cache }}