From 21492ededa24d8fd6155c210533a97c5505ae886 Mon Sep 17 00:00:00 2001
From: "J. Kirby Ross" <james@flyingrobots.dev>
Date: Fri, 12 Sep 2025 01:32:28 -0700
Subject: [PATCH 1/7] CI: gate on gcc-14/clang-20; move gcc-12/13, clang-18/19
 to non-blocking canaries; add docs/CI_STRATEGY.md; add gcc-14 target to
 gauntlet Dockerfile

---
 .github/workflows/gauntlet.yml     | 54 +++++++++++++++++++---------
 docs/CI_STRATEGY.md                | 56 ++++++++++++++++++++++++++++++
 tools/gauntlet/Dockerfile.gauntlet | 14 +++++++-
 3 files changed, 106 insertions(+), 18 deletions(-)
 create mode 100644 docs/CI_STRATEGY.md

diff --git a/.github/workflows/gauntlet.yml b/.github/workflows/gauntlet.yml
index 6cddd7f6..f1b6cb55 100644
--- a/.github/workflows/gauntlet.yml
+++ b/.github/workflows/gauntlet.yml
@@ -7,36 +7,56 @@ on:
     branches: [ main ]
 
 jobs:
-  gauntlet:
+  gating:
     runs-on: ubuntu-latest
-    name: C23 Compiler GAUNTLET
+    name: C23 Gating Compilers
     strategy:
       matrix:
-        compiler: [gcc-12, gcc-13, clang-18, clang-19, clang-20]
+        compiler: [gcc-14, clang-20]
       fail-fast: false
-    
     steps:
-    - name: Checkout code
-      uses: actions/checkout@v4
-      
-    - name: Set up Docker Buildx
-      uses: docker/setup-buildx-action@v3
-      
+    - uses: actions/checkout@v4
+    - uses: docker/setup-buildx-action@v3
     - name: Build ${{ matrix.compiler }} Docker image
       run: |
-        echo "🔥 Building ${{ matrix.compiler }} Docker image..."
+        echo "🔥 Building ${{ matrix.compiler }} Docker image (gating)..."
         docker build --target ${{ matrix.compiler }} -t gauntlet-${{ matrix.compiler }}:latest -f tools/gauntlet/Dockerfile.gauntlet .
-        
     - name: Run ${{ matrix.compiler }} GAUNTLET
       run: |
-        echo "🔫 Running ${{ matrix.compiler }} GAUNTLET..."
+        echo "🔫 Running ${{ matrix.compiler }} GAUNTLET (gating)..."
         docker run --rm -v "$PWD":/workspace -w /workspace gauntlet-${{ matrix.compiler }}:latest
-        
     - name: Upload build logs on failure
       if: failure()
       uses: actions/upload-artifact@v4
       with:
         name: gauntlet-logs-${{ matrix.compiler }}
-        path: |
-          build/
-        retention-days: 7
\ No newline at end of file
+        path: build/
+        retention-days: 7
+
+  canary:
+    runs-on: ubuntu-latest
+    name: Compat Canaries (non-blocking)
+    continue-on-error: true
+    needs: [gating]
+    strategy:
+      matrix:
+        compiler: [gcc-12, gcc-13, clang-18, clang-19]
+      fail-fast: false
+    steps:
+    - uses: actions/checkout@v4
+    - uses: docker/setup-buildx-action@v3
+    - name: Build ${{ matrix.compiler }} Docker image
+      run: |
+        echo "🐤 Building ${{ matrix.compiler }} Docker image (canary)..."
+        docker build --target ${{ matrix.compiler }} -t gauntlet-${{ matrix.compiler }}:latest -f tools/gauntlet/Dockerfile.gauntlet .
+    - name: Run ${{ matrix.compiler }} GAUNTLET
+      run: |
+        echo "🐤 Running ${{ matrix.compiler }} GAUNTLET (canary)..."
+        docker run --rm -v "$PWD":/workspace -w /workspace gauntlet-${{ matrix.compiler }}:latest
+    - name: Upload build logs on failure
+      if: failure()
+      uses: actions/upload-artifact@v4
+      with:
+        name: gauntlet-logs-${{ matrix.compiler }}
+        path: build/
+        retention-days: 7
diff --git a/docs/CI_STRATEGY.md b/docs/CI_STRATEGY.md
new file mode 100644
index 00000000..064af4ad
--- /dev/null
+++ b/docs/CI_STRATEGY.md
@@ -0,0 +1,56 @@
+
+# CI/CD Strategy
+
+## Overview
+This repository enforces high correctness and portability while centering on modern C23. CI is split into:
+- Gating jobs that must pass for merges
+- Canary jobs that provide early portability signals but do not block
+- Static analysis (clang-tidy) with a strict baseline
+- Deterministic Docker builds to ensure local=CI parity
+
+## Compiler Matrix
+
+### Gating (C23 focus)
+- `gcc-14` — first broadly usable GCC with C23 support
+- `clang-20` — latest LLVM with strong C23 + clang-tidy 20
+
+Rationale: These represent the C23 target surface we care about. They block the PR when they fail.
+
+### Canaries (non‑blocking)
+- `gcc-12`, `gcc-13` — older GCCs common on LTS distros
+- `clang-18`, `clang-19` — earlier LLVMs
+
+Rationale: Useful signals for downstream consumers. They run with `continue-on-error: true` so they never block merges.
+
+```mermaid
+flowchart LR
+  A[Gating: gcc-14] --> M[Merge]
+  B[Gating: clang-20] --> M
+  C[Canary: gcc-13] -->|non-blocking| M
+  D[Canary: clang-19] -->|non-blocking| M
+  E[Canary: gcc-12] -->|non-blocking| M
+  F[Canary: clang-18] -->|non-blocking| M
+```
+
+## Static Analysis
+- `clang-tidy` 20 with `quality/.clang-tidy`; warnings-as-errors.
+- Baseline file `tools/baseline_count.txt` enforces no regressions.
+- CI builds a deterministic LLVM 20 environment in Docker.
+- CRoaring is installed from apt when available, or built from source in CI to stabilize aarch64 and older runners.
+
+## Builds & Tests
+- Meson + Ninja builds and runs unit tests.
+- Cache artifacts are not pushed; they are derived and may be uploaded only for debugging.
+
+## Docker Hygiene
+- Images are namespaced and labeled for safe cleanup: `gitmind/ci:clang-20`, `gitmind/gauntlet:<compiler>`; label `com.gitmind.project=git-mind`.
+- Local helper: `make docker-clean` removes only project images/containers and builder cache.
+
+## Time & Cost
+- Gating jobs run in parallel and should complete under a few minutes.
+- Canaries may be slower; they are non‑blocking and primarily diagnostic.
+
+## Future Enhancements
+- Add cohesion-report to CI to summarize semantic (advice) changes across merges.
+- Nightly long‑matrix (more compilers/OSes) as a separate scheduled workflow.
+- Cache Docker layers to reduce cold start times.
diff --git a/tools/gauntlet/Dockerfile.gauntlet b/tools/gauntlet/Dockerfile.gauntlet
index f669c04b..5bb08284 100644
--- a/tools/gauntlet/Dockerfile.gauntlet
+++ b/tools/gauntlet/Dockerfile.gauntlet
@@ -41,6 +41,18 @@ RUN apt-get update && apt-get install -y \
 ENV CC=gcc-13
 ENV CXX=g++-13
 
+# GCC 14 - Modern C23 support image (gating)
+FROM base as gcc-14
+RUN apt-get update && apt-get install -y \
+    software-properties-common \
+    wget \
+    gnupg && \
+    add-apt-repository ppa:ubuntu-toolchain-r/test -y && \
+    apt-get update && \
+    apt-get install -y gcc-14 g++-14
+ENV CC=gcc-14
+ENV CXX=g++-14
+
 # Clang 18 - C23 support image
 FROM base as clang-18
 RUN apt-get update && apt-get install -y \
@@ -117,4 +129,4 @@ RUN echo '#!/bin/bash' > /test-compiler.sh && \
     chmod +x /test-compiler.sh
 
 WORKDIR /workspace
-CMD ["/test-compiler.sh"]
\ No newline at end of file
+CMD ["/test-compiler.sh"]

From 52f675365ada24268e9d12aa38856f3bf187be5a Mon Sep 17 00:00:00 2001
From: "J. Kirby Ross" <james@flyingrobots.dev>
Date: Fri, 12 Sep 2025 01:36:13 -0700
Subject: [PATCH 2/7] CI(Security): restrict GITHUB_TOKEN in gauntlet workflow
 (permissions: contents: read)

---
 .github/workflows/gauntlet.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/gauntlet.yml b/.github/workflows/gauntlet.yml
index f1b6cb55..7e1bbdde 100644
--- a/.github/workflows/gauntlet.yml
+++ b/.github/workflows/gauntlet.yml
@@ -1,4 +1,6 @@
 name: GNU CRY GAUNTLET
+permissions:
+  contents: read
 
 on:
   push:

From afaab15d2b89a4f02866ba6f98ab4ce43e3a2773 Mon Sep 17 00:00:00 2001
From: "J. Kirby Ross" <james@flyingrobots.dev>
Date: Fri, 12 Sep 2025 01:40:26 -0700
Subject: [PATCH 3/7] CI(Gauntlet): build gcc-14 on Ubuntu 24.04 base; add
 libroaring-dev to base; fix AS casing

---
 tools/gauntlet/Dockerfile.gauntlet | 40 +++++++++++++++++++-----------
 1 file changed, 26 insertions(+), 14 deletions(-)

diff --git a/tools/gauntlet/Dockerfile.gauntlet b/tools/gauntlet/Dockerfile.gauntlet
index 5bb08284..634f5619 100644
--- a/tools/gauntlet/Dockerfile.gauntlet
+++ b/tools/gauntlet/Dockerfile.gauntlet
@@ -1,5 +1,5 @@
 # Base image with common dependencies
-FROM ubuntu:22.04 as base
+FROM ubuntu:22.04 AS base
 
 ENV DEBIAN_FRONTEND=noninteractive
 ENV TZ=UTC
@@ -13,12 +13,13 @@ RUN apt-get update && apt-get install -y \
     pkg-config \
     libsodium-dev \
     libgit2-dev \
+    libroaring-dev \
     git \
     curl \
     meson
 
 # GCC 12 (THE DEVIL) - Pre-C23 image
-FROM base as gcc-12
+FROM base AS gcc-12
 RUN apt-get update && apt-get install -y \
     software-properties-common \
     wget \
@@ -30,7 +31,7 @@ ENV CC=gcc-12
 ENV CXX=g++-12
 
 # GCC 13 - C23 support image
-FROM base as gcc-13
+FROM base AS gcc-13
 RUN apt-get update && apt-get install -y \
     software-properties-common \
     wget \
@@ -41,20 +42,31 @@ RUN apt-get update && apt-get install -y \
 ENV CC=gcc-13
 ENV CXX=g++-13
 
-# GCC 14 - Modern C23 support image (gating)
-FROM base as gcc-14
+# Base for gcc-14 on Ubuntu 24.04 (native gcc-14)
+FROM ubuntu:24.04 AS base-noble
+ENV DEBIAN_FRONTEND=noninteractive
+ENV TZ=UTC
 RUN apt-get update && apt-get install -y \
-    software-properties-common \
-    wget \
-    gnupg && \
-    add-apt-repository ppa:ubuntu-toolchain-r/test -y && \
-    apt-get update && \
-    apt-get install -y gcc-14 g++-14
+    build-essential \
+    ninja-build \
+    python3 \
+    python3-pip \
+    pkg-config \
+    libsodium-dev \
+    libgit2-dev \
+    libroaring-dev \
+    git \
+    curl \
+    meson
+
+# GCC 14 - Modern C23 support image (gating)
+FROM base-noble AS gcc-14
+RUN apt-get update && apt-get install -y gcc-14 g++-14
 ENV CC=gcc-14
 ENV CXX=g++-14
 
 # Clang 18 - C23 support image
-FROM base as clang-18
+FROM base AS clang-18
 RUN apt-get update && apt-get install -y \
     wget \
     gnupg \
@@ -66,7 +78,7 @@ ENV CC=clang-18
 ENV CXX=clang++-18
 
 # Clang 19 - C23 support image
-FROM base as clang-19
+FROM base AS clang-19
 RUN apt-get update && apt-get install -y \
     wget \
     gnupg \
@@ -78,7 +90,7 @@ ENV CC=clang-19
 ENV CXX=clang++-19
 
 # Clang 20 - Latest C23 support image
-FROM base as clang-20
+FROM base AS clang-20
 RUN apt-get update && apt-get install -y \
     wget \
     gnupg \

From ae575e1d705cd016b7438bf082820752cf80752e Mon Sep 17 00:00:00 2001
From: "J. Kirby Ross" <james@flyingrobots.dev>
Date: Fri, 12 Sep 2025 20:23:22 -0700
Subject: [PATCH 4/7] ci: address CodeRabbit feedback\n\n- Fix YAML indentation
 for steps lists (gating/canary)\n- Dockerfile: --no-install-recommends + apt
 cache cleanup; move test runner/WORKDIR/CMD to base; remove default final
 stage; add HEALTHCHECK; keep uppercase AS stages

---
 .github/workflows/gauntlet.yml     | 68 ++++++++++-----------
 tools/gauntlet/Dockerfile.gauntlet | 98 ++++++++++++------------------
 2 files changed, 74 insertions(+), 92 deletions(-)

diff --git a/.github/workflows/gauntlet.yml b/.github/workflows/gauntlet.yml
index 7e1bbdde..fc025b7a 100644
--- a/.github/workflows/gauntlet.yml
+++ b/.github/workflows/gauntlet.yml
@@ -17,23 +17,23 @@ jobs:
         compiler: [gcc-14, clang-20]
       fail-fast: false
     steps:
-    - uses: actions/checkout@v4
-    - uses: docker/setup-buildx-action@v3
-    - name: Build ${{ matrix.compiler }} Docker image
-      run: |
-        echo "🔥 Building ${{ matrix.compiler }} Docker image (gating)..."
-        docker build --target ${{ matrix.compiler }} -t gauntlet-${{ matrix.compiler }}:latest -f tools/gauntlet/Dockerfile.gauntlet .
-    - name: Run ${{ matrix.compiler }} GAUNTLET
-      run: |
-        echo "🔫 Running ${{ matrix.compiler }} GAUNTLET (gating)..."
-        docker run --rm -v "$PWD":/workspace -w /workspace gauntlet-${{ matrix.compiler }}:latest
-    - name: Upload build logs on failure
-      if: failure()
-      uses: actions/upload-artifact@v4
-      with:
-        name: gauntlet-logs-${{ matrix.compiler }}
-        path: build/
-        retention-days: 7
+      - uses: actions/checkout@v4
+      - uses: docker/setup-buildx-action@v3
+      - name: Build ${{ matrix.compiler }} Docker image
+        run: |
+          echo "🔥 Building ${{ matrix.compiler }} Docker image (gating)..."
+          docker build --target ${{ matrix.compiler }} -t gauntlet-${{ matrix.compiler }}:latest -f tools/gauntlet/Dockerfile.gauntlet .
+      - name: Run ${{ matrix.compiler }} GAUNTLET
+        run: |
+          echo "🔫 Running ${{ matrix.compiler }} GAUNTLET (gating)..."
+          docker run --rm -v "$PWD":/workspace -w /workspace gauntlet-${{ matrix.compiler }}:latest
+      - name: Upload build logs on failure
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: gauntlet-logs-${{ matrix.compiler }}
+          path: build/
+          retention-days: 7
 
   canary:
     runs-on: ubuntu-latest
@@ -45,20 +45,20 @@ jobs:
         compiler: [gcc-12, gcc-13, clang-18, clang-19]
       fail-fast: false
     steps:
-    - uses: actions/checkout@v4
-    - uses: docker/setup-buildx-action@v3
-    - name: Build ${{ matrix.compiler }} Docker image
-      run: |
-        echo "🐤 Building ${{ matrix.compiler }} Docker image (canary)..."
-        docker build --target ${{ matrix.compiler }} -t gauntlet-${{ matrix.compiler }}:latest -f tools/gauntlet/Dockerfile.gauntlet .
-    - name: Run ${{ matrix.compiler }} GAUNTLET
-      run: |
-        echo "🐤 Running ${{ matrix.compiler }} GAUNTLET (canary)..."
-        docker run --rm -v "$PWD":/workspace -w /workspace gauntlet-${{ matrix.compiler }}:latest
-    - name: Upload build logs on failure
-      if: failure()
-      uses: actions/upload-artifact@v4
-      with:
-        name: gauntlet-logs-${{ matrix.compiler }}
-        path: build/
-        retention-days: 7
+      - uses: actions/checkout@v4
+      - uses: docker/setup-buildx-action@v3
+      - name: Build ${{ matrix.compiler }} Docker image
+        run: |
+          echo "🐤 Building ${{ matrix.compiler }} Docker image (canary)..."
+          docker build --target ${{ matrix.compiler }} -t gauntlet-${{ matrix.compiler }}:latest -f tools/gauntlet/Dockerfile.gauntlet .
+      - name: Run ${{ matrix.compiler }} GAUNTLET
+        run: |
+          echo "🐤 Running ${{ matrix.compiler }} GAUNTLET (canary)..."
+          docker run --rm -v "$PWD":/workspace -w /workspace gauntlet-${{ matrix.compiler }}:latest
+      - name: Upload build logs on failure
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: gauntlet-logs-${{ matrix.compiler }}
+          path: build/
+          retention-days: 7
diff --git a/tools/gauntlet/Dockerfile.gauntlet b/tools/gauntlet/Dockerfile.gauntlet
index 634f5619..736ab073 100644
--- a/tools/gauntlet/Dockerfile.gauntlet
+++ b/tools/gauntlet/Dockerfile.gauntlet
@@ -5,7 +5,7 @@ ENV DEBIAN_FRONTEND=noninteractive
 ENV TZ=UTC
 
 # Install base dependencies
-RUN apt-get update && apt-get install -y \
+RUN apt-get update && apt-get install -y --no-install-recommends \
     build-essential \
     ninja-build \
     python3 \
@@ -16,29 +16,51 @@ RUN apt-get update && apt-get install -y \
     libroaring-dev \
     git \
     curl \
-    meson
+    meson && rm -rf /var/lib/apt/lists/*
+
+# Shared test runner and defaults for all compiler stages
+RUN echo '#!/bin/bash' > /test-compiler.sh && \
+    echo 'set -e' >> /test-compiler.sh && \
+    echo 'echo "🔫 Testing $CC..."' >> /test-compiler.sh && \
+    echo 'echo "Compiler: $CC"' >> /test-compiler.sh && \
+    echo 'echo "C++ Compiler: $CXX"' >> /test-compiler.sh && \
+    echo 'rm -rf build' >> /test-compiler.sh && \
+    echo 'if meson setup build --warnlevel=3; then' >> /test-compiler.sh && \
+    echo '  echo "✅ Meson setup successful"' >> /test-compiler.sh && \
+    echo '  if ninja -C build; then' >> /test-compiler.sh && \
+    echo '    echo "✅ Build successful"' >> /test-compiler.sh && \
+    echo '    if ninja -C build test; then' >> /test-compiler.sh && \
+    echo '      echo "✅ Tests passed"' >> /test-compiler.sh && \
+    echo '      echo "PASS"' >> /test-compiler.sh && \
+    echo '    else echo "❌ Tests failed"; echo "FAIL_TEST"; fi' >> /test-compiler.sh && \
+    echo '  else echo "❌ Build failed"; echo "FAIL_BUILD"; fi' >> /test-compiler.sh && \
+    echo 'else echo "❌ Meson setup failed"; echo "FAIL_SETUP"; fi' >> /test-compiler.sh && \
+    chmod +x /test-compiler.sh
+WORKDIR /workspace
+CMD ["/test-compiler.sh"]
+HEALTHCHECK --interval=30s --timeout=5s --retries=3 CMD bash -lc "$CC --version >/dev/null 2>&1 || exit 1"
 
 # GCC 12 (THE DEVIL) - Pre-C23 image
 FROM base AS gcc-12
-RUN apt-get update && apt-get install -y \
+RUN apt-get update && apt-get install -y --no-install-recommends \
     software-properties-common \
     wget \
     gnupg && \
     add-apt-repository ppa:ubuntu-toolchain-r/test -y && \
-    apt-get update && \
-    apt-get install -y gcc-12 g++-12
+    apt-get update && apt-get install -y --no-install-recommends gcc-12 g++-12 && \
+    rm -rf /var/lib/apt/lists/*
 ENV CC=gcc-12
 ENV CXX=g++-12
 
 # GCC 13 - C23 support image
 FROM base AS gcc-13
-RUN apt-get update && apt-get install -y \
+RUN apt-get update && apt-get install -y --no-install-recommends \
     software-properties-common \
     wget \
     gnupg && \
     add-apt-repository ppa:ubuntu-toolchain-r/test -y && \
-    apt-get update && \
-    apt-get install -y gcc-13 g++-13
+    apt-get update && apt-get install -y --no-install-recommends gcc-13 g++-13 && \
+    rm -rf /var/lib/apt/lists/*
 ENV CC=gcc-13
 ENV CXX=g++-13
 
@@ -46,7 +68,7 @@ ENV CXX=g++-13
 FROM ubuntu:24.04 AS base-noble
 ENV DEBIAN_FRONTEND=noninteractive
 ENV TZ=UTC
-RUN apt-get update && apt-get install -y \
+RUN apt-get update && apt-get install -y --no-install-recommends \
     build-essential \
     ninja-build \
     python3 \
@@ -57,88 +79,48 @@ RUN apt-get update && apt-get install -y \
     libroaring-dev \
     git \
     curl \
-    meson
+    meson && rm -rf /var/lib/apt/lists/*
 
 # GCC 14 - Modern C23 support image (gating)
 FROM base-noble AS gcc-14
-RUN apt-get update && apt-get install -y gcc-14 g++-14
+RUN apt-get update && apt-get install -y --no-install-recommends gcc-14 g++-14 && rm -rf /var/lib/apt/lists/*
 ENV CC=gcc-14
 ENV CXX=g++-14
 
 # Clang 18 - C23 support image
 FROM base AS clang-18
-RUN apt-get update && apt-get install -y \
+RUN apt-get update && apt-get install -y --no-install-recommends \
     wget \
     gnupg \
     lsb-release \
     software-properties-common && \
     wget -O - https://apt.llvm.org/llvm.sh | bash -s -- 18 all && \
-    apt-get install -y clang-18 clang++-18 clang-tidy-18
+    apt-get install -y --no-install-recommends clang-18 clang++-18 clang-tidy-18 && rm -rf /var/lib/apt/lists/*
 ENV CC=clang-18
 ENV CXX=clang++-18
 
 # Clang 19 - C23 support image
 FROM base AS clang-19
-RUN apt-get update && apt-get install -y \
+RUN apt-get update && apt-get install -y --no-install-recommends \
     wget \
     gnupg \
     lsb-release \
     software-properties-common && \
     wget -O - https://apt.llvm.org/llvm.sh | bash -s -- 19 all && \
-    apt-get install -y clang-19 clang++-19 clang-tidy-19
+    apt-get install -y --no-install-recommends clang-19 clang++-19 clang-tidy-19 && rm -rf /var/lib/apt/lists/*
 ENV CC=clang-19
 ENV CXX=clang++-19
 
 # Clang 20 - Latest C23 support image
 FROM base AS clang-20
-RUN apt-get update && apt-get install -y \
+RUN apt-get update && apt-get install -y --no-install-recommends \
     wget \
     gnupg \
     lsb-release \
     software-properties-common && \
     wget -O - https://apt.llvm.org/llvm.sh | bash -s -- 20 all && \
-    apt-get install -y clang-20 clang++-20 clang-tidy-20
+    apt-get install -y --no-install-recommends clang-20 clang++-20 clang-tidy-20 && rm -rf /var/lib/apt/lists/*
 ENV CC=clang-20
 ENV CXX=clang++-20
 
-# Default to clang-20 for standalone usage
-FROM clang-20
-
-# Simple test script that works with any compiler
-RUN echo '#!/bin/bash' > /test-compiler.sh && \
-    echo 'set -e' >> /test-compiler.sh && \
-    echo 'echo "🔫 Testing $CC..."' >> /test-compiler.sh && \
-    echo 'echo "Compiler: $CC"' >> /test-compiler.sh && \
-    echo 'echo "C++ Compiler: $CXX"' >> /test-compiler.sh && \
-    echo '' >> /test-compiler.sh && \
-    echo '# Clean previous build' >> /test-compiler.sh && \
-    echo 'rm -rf build' >> /test-compiler.sh && \
-    echo '' >> /test-compiler.sh && \
-    echo '# Setup build with current compiler' >> /test-compiler.sh && \
-    echo 'if meson setup build --warnlevel=3; then' >> /test-compiler.sh && \
-    echo '    echo "✅ Meson setup successful"' >> /test-compiler.sh && \
-    echo '    ' >> /test-compiler.sh && \
-    echo '    # Build' >> /test-compiler.sh && \
-    echo '    if ninja -C build; then' >> /test-compiler.sh && \
-    echo '        echo "✅ Build successful"' >> /test-compiler.sh && \
-    echo '        ' >> /test-compiler.sh && \
-    echo '        # Run tests' >> /test-compiler.sh && \
-    echo '        if ninja -C build test; then' >> /test-compiler.sh && \
-    echo '            echo "✅ Tests passed"' >> /test-compiler.sh && \
-    echo '            echo "PASS"' >> /test-compiler.sh && \
-    echo '        else' >> /test-compiler.sh && \
-    echo '            echo "❌ Tests failed"' >> /test-compiler.sh && \
-    echo '            echo "FAIL_TEST"' >> /test-compiler.sh && \
-    echo '        fi' >> /test-compiler.sh && \
-    echo '    else' >> /test-compiler.sh && \
-    echo '        echo "❌ Build failed"' >> /test-compiler.sh && \
-    echo '        echo "FAIL_BUILD"' >> /test-compiler.sh && \
-    echo '    fi' >> /test-compiler.sh && \
-    echo 'else' >> /test-compiler.sh && \
-    echo '    echo "❌ Meson setup failed"' >> /test-compiler.sh && \
-    echo '    echo "FAIL_SETUP"' >> /test-compiler.sh && \
-    echo 'fi' >> /test-compiler.sh && \
-    chmod +x /test-compiler.sh
-
-WORKDIR /workspace
-CMD ["/test-compiler.sh"]
+## No final default stage; each compiler stage inherits test runner

From 64fe5b408fe27c7d773b2afbf47a8c25b9eadb8e Mon Sep 17 00:00:00 2001
From: "J. Kirby Ross" <james@flyingrobots.dev>
Date: Fri, 12 Sep 2025 20:25:21 -0700
Subject: [PATCH 5/7] ci: fix failing PR #162\n\n- c_core: install
 libroaring-dev and pkg-config; fix fuzz step typo\n- core-quality: install
 libroaring-dev and pkg-config

---
 .github/workflows/c_core.yml       | 6 +++---
 .github/workflows/core-quality.yml | 4 ++--
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/c_core.yml b/.github/workflows/c_core.yml
index 7630492f..ab634fbb 100644
--- a/.github/workflows/c_core.yml
+++ b/.github/workflows/c_core.yml
@@ -10,9 +10,9 @@ jobs:
       - name: Install LLVM 20 and build tools
         run: |
           sudo apt-get update
-          sudo apt-get install -y wget gnupg lsb-release python3-pip
+          sudo apt-get install -y wget gnupg lsb-release python3-pip pkg-config
           wget -O - https://apt.llvm.org/llvm.sh | sudo bash -s -- 20
-          sudo apt-get install -y clang-20 clang-tidy-20 cppcheck libsodium-dev libgit2-dev
+          sudo apt-get install -y clang-20 clang-tidy-20 cppcheck libsodium-dev libgit2-dev libroaring-dev
           sudo ln -sf /usr/bin/clang-tidy-20 /usr/local/bin/clang-tidy
           sudo ln -sf /usr/bin/clang++-20    /usr/local/bin/clang++
           sudo ln -sf /usr/bin/clang-20      /usr/local/bin/clang
@@ -32,4 +32,4 @@ jobs:
       - name: Enforce no new warnings
         run: python3 tools/count_warnings.py check clang-tidy-report.txt tools/baseline_count.txt
       - run: cppcheck --enable=all --inconclusive --quiet src
-      - run: python tools/run_fuzz.py 60
\ No newline at end of file
+      - run: python tools/run_fuzz.py 60
diff --git a/.github/workflows/core-quality.yml b/.github/workflows/core-quality.yml
index 9647ef1b..f1b6809a 100644
--- a/.github/workflows/core-quality.yml
+++ b/.github/workflows/core-quality.yml
@@ -19,7 +19,7 @@ jobs:
     - name: Install dependencies
       run: |
         sudo apt-get update
-        sudo apt-get install -y clang clang-tidy libsodium-dev libgit2-dev build-essential python3-pip
+        sudo apt-get install -y clang clang-tidy libsodium-dev libgit2-dev libroaring-dev build-essential python3-pip pkg-config
         pip3 install --break-system-packages meson ninja
     
     - name: Check for TODOs/FIXMEs
@@ -123,4 +123,4 @@ jobs:
       if: always()
       with:
         name: coverage-report
-        path: build-coverage/coverage.html
\ No newline at end of file
+        path: build-coverage/coverage.html

From e3f80ac3f1df60d065e0ee0472c96396456983be Mon Sep 17 00:00:00 2001
From: "J. Kirby Ross" <james@flyingrobots.dev>
Date: Fri, 12 Sep 2025 23:04:56 -0700
Subject: [PATCH 6/7] ci(gauntlet): add gcc-14 stage and share test runner from
 base; support C23 gating job

---
 tools/gauntlet/Dockerfile.gauntlet | 83 +++++++++++++++++++-----------
 1 file changed, 52 insertions(+), 31 deletions(-)

diff --git a/tools/gauntlet/Dockerfile.gauntlet b/tools/gauntlet/Dockerfile.gauntlet
index ee9c3356..16864961 100644
--- a/tools/gauntlet/Dockerfile.gauntlet
+++ b/tools/gauntlet/Dockerfile.gauntlet
@@ -19,6 +19,31 @@ RUN apt-get update && apt-get install -y \
     curl \
     meson
 
+# Provide test runner in base so all targets inherit it
+RUN echo '#!/bin/bash' > /test-compiler.sh && \
+    echo 'set -e' >> /test-compiler.sh && \
+    echo 'echo "🔫 Testing $CC..."' >> /test-compiler.sh && \
+    echo 'echo "Compiler: $CC"' >> /test-compiler.sh && \
+    echo 'echo "C++ Compiler: $CXX"' >> /test-compiler.sh && \
+    echo '' >> /test-compiler.sh && \
+    echo '# Clean previous build' >> /test-compiler.sh && \
+    echo 'rm -rf build' >> /test-compiler.sh && \
+    echo '' >> /test-compiler.sh && \
+    echo '# Setup build with current compiler' >> /test-compiler.sh && \
+    echo 'if meson setup build --warnlevel=3; then' >> /test-compiler.sh && \
+    echo '    echo "✅ Meson setup successful"' >> /test-compiler.sh && \
+    echo '    if ninja -C build; then' >> /test-compiler.sh && \
+    echo '        echo "✅ Build successful"' >> /test-compiler.sh && \
+    echo '        if ninja -C build test; then' >> /test-compiler.sh && \
+    echo '            echo "✅ Tests passed"' >> /test-compiler.sh && \
+    echo '            echo "PASS"' >> /test-compiler.sh && \
+    echo '        else echo "❌ Tests failed"; echo "FAIL_TEST"; fi' >> /test-compiler.sh && \
+    echo '    else echo "❌ Build failed"; echo "FAIL_BUILD"; fi' >> /test-compiler.sh && \
+    echo 'else echo "❌ Meson setup failed"; echo "FAIL_SETUP"; fi' >> /test-compiler.sh && \
+    chmod +x /test-compiler.sh
+WORKDIR /workspace
+CMD ["/test-compiler.sh"]
+
 # GCC 12 (THE DEVIL) - Pre-C23 image
 FROM base as gcc-12
 RUN apt-get update && apt-get install -y \
@@ -79,44 +104,40 @@ RUN apt-get update && apt-get install -y \
 ENV CC=clang-20
 ENV CXX=clang++-20
 
-# Default to clang-20 for standalone usage
-FROM clang-20
-
-# Simple test script that works with any compiler
+# Ubuntu 24.04 base (for gcc-14)
+FROM ubuntu:24.04 as base-noble
+ENV DEBIAN_FRONTEND=noninteractive
+ENV TZ=UTC
+RUN apt-get update && apt-get install -y \
+    build-essential \
+    ninja-build \
+    python3 \
+    python3-pip \
+    pkg-config \
+    libsodium-dev \
+    libgit2-dev \
+    libroaring-dev \
+    git \
+    curl \
+    meson
+# Provide test runner in base-noble too
 RUN echo '#!/bin/bash' > /test-compiler.sh && \
     echo 'set -e' >> /test-compiler.sh && \
     echo 'echo "🔫 Testing $CC..."' >> /test-compiler.sh && \
     echo 'echo "Compiler: $CC"' >> /test-compiler.sh && \
     echo 'echo "C++ Compiler: $CXX"' >> /test-compiler.sh && \
-    echo '' >> /test-compiler.sh && \
-    echo '# Clean previous build' >> /test-compiler.sh && \
     echo 'rm -rf build' >> /test-compiler.sh && \
-    echo '' >> /test-compiler.sh && \
-    echo '# Setup build with current compiler' >> /test-compiler.sh && \
     echo 'if meson setup build --warnlevel=3; then' >> /test-compiler.sh && \
-    echo '    echo "✅ Meson setup successful"' >> /test-compiler.sh && \
-    echo '    ' >> /test-compiler.sh && \
-    echo '    # Build' >> /test-compiler.sh && \
-    echo '    if ninja -C build; then' >> /test-compiler.sh && \
-    echo '        echo "✅ Build successful"' >> /test-compiler.sh && \
-    echo '        ' >> /test-compiler.sh && \
-    echo '        # Run tests' >> /test-compiler.sh && \
-    echo '        if ninja -C build test; then' >> /test-compiler.sh && \
-    echo '            echo "✅ Tests passed"' >> /test-compiler.sh && \
-    echo '            echo "PASS"' >> /test-compiler.sh && \
-    echo '        else' >> /test-compiler.sh && \
-    echo '            echo "❌ Tests failed"' >> /test-compiler.sh && \
-    echo '            echo "FAIL_TEST"' >> /test-compiler.sh && \
-    echo '        fi' >> /test-compiler.sh && \
-    echo '    else' >> /test-compiler.sh && \
-    echo '        echo "❌ Build failed"' >> /test-compiler.sh && \
-    echo '        echo "FAIL_BUILD"' >> /test-compiler.sh && \
-    echo '    fi' >> /test-compiler.sh && \
-    echo 'else' >> /test-compiler.sh && \
-    echo '    echo "❌ Meson setup failed"' >> /test-compiler.sh && \
-    echo '    echo "FAIL_SETUP"' >> /test-compiler.sh && \
-    echo 'fi' >> /test-compiler.sh && \
+    echo '  if ninja -C build; then' >> /test-compiler.sh && \
+    echo '    if ninja -C build test; then echo "PASS"; else echo "FAIL_TEST"; fi' >> /test-compiler.sh && \
+    echo '  else echo "FAIL_BUILD"; fi' >> /test-compiler.sh && \
+    echo 'else echo "FAIL_SETUP"; fi' >> /test-compiler.sh && \
     chmod +x /test-compiler.sh
-
 WORKDIR /workspace
 CMD ["/test-compiler.sh"]
+
+# GCC 14 target (gating)
+FROM base-noble as gcc-14
+RUN apt-get update && apt-get install -y gcc-14 g++-14
+ENV CC=gcc-14
+ENV CXX=g++-14

From 995e56f6b91cd59ac3e3816300b7d6e66b35689c Mon Sep 17 00:00:00 2001
From: "J. Kirby Ross" <james@flyingrobots.dev>
Date: Fri, 12 Sep 2025 23:15:25 -0700
Subject: [PATCH 7/7] =?UTF-8?q?ci(gauntlet):=20lints=20per=20review=20?=
 =?UTF-8?q?=E2=80=94=20uppercase=20AS,=20no-install-recommends,=20apt=20cl?=
 =?UTF-8?q?ean;=20docs:=20fix=20CI=5FSTRATEGY=20markdown=20spacing?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 docs/CI_STRATEGY.md                |  8 ++++-
 tools/gauntlet/Dockerfile.gauntlet | 54 +++++++++++++++++-------------
 2 files changed, 38 insertions(+), 24 deletions(-)

diff --git a/docs/CI_STRATEGY.md b/docs/CI_STRATEGY.md
index 064af4ad..cbf61609 100644
--- a/docs/CI_STRATEGY.md
+++ b/docs/CI_STRATEGY.md
@@ -1,4 +1,3 @@
-
 # CI/CD Strategy
 
 ## Overview
@@ -11,12 +10,14 @@ This repository enforces high correctness and portability while centering on mod
 ## Compiler Matrix
 
 ### Gating (C23 focus)
+ 
 - `gcc-14` — first broadly usable GCC with C23 support
 - `clang-20` — latest LLVM with strong C23 + clang-tidy 20
 
 Rationale: These represent the C23 target surface we care about. They block the PR when they fail.
 
 ### Canaries (non‑blocking)
+ 
 - `gcc-12`, `gcc-13` — older GCCs common on LTS distros
 - `clang-18`, `clang-19` — earlier LLVMs
 
@@ -33,24 +34,29 @@ flowchart LR
 ```
 
 ## Static Analysis
+ 
 - `clang-tidy` 20 with `quality/.clang-tidy`; warnings-as-errors.
 - Baseline file `tools/baseline_count.txt` enforces no regressions.
 - CI builds a deterministic LLVM 20 environment in Docker.
 - CRoaring is installed from apt when available, or built from source in CI to stabilize aarch64 and older runners.
 
 ## Builds & Tests
+ 
 - Meson + Ninja builds and runs unit tests.
 - Cache artifacts are not pushed; they are derived and may be uploaded only for debugging.
 
 ## Docker Hygiene
+ 
 - Images are namespaced and labeled for safe cleanup: `gitmind/ci:clang-20`, `gitmind/gauntlet:<compiler>`; label `com.gitmind.project=git-mind`.
 - Local helper: `make docker-clean` removes only project images/containers and builder cache.
 
 ## Time & Cost
+ 
 - Gating jobs run in parallel and should complete under a few minutes.
 - Canaries may be slower; they are non‑blocking and primarily diagnostic.
 
 ## Future Enhancements
+ 
 - Add cohesion-report to CI to summarize semantic (advice) changes across merges.
 - Nightly long‑matrix (more compilers/OSes) as a separate scheduled workflow.
 - Cache Docker layers to reduce cold start times.
diff --git a/tools/gauntlet/Dockerfile.gauntlet b/tools/gauntlet/Dockerfile.gauntlet
index 16864961..c9b6e0b3 100644
--- a/tools/gauntlet/Dockerfile.gauntlet
+++ b/tools/gauntlet/Dockerfile.gauntlet
@@ -1,5 +1,5 @@
 # Base image with common dependencies
-FROM ubuntu:22.04 as base
+FROM ubuntu:22.04 AS base
 LABEL com.gitmind.project="git-mind" \
       org.opencontainers.image.title="git-mind-gauntlet"
 
@@ -7,7 +7,7 @@ ENV DEBIAN_FRONTEND=noninteractive
 ENV TZ=UTC
 
 # Install base dependencies
-RUN apt-get update && apt-get install -y \
+RUN apt-get update && apt-get install -y --no-install-recommends \
     build-essential \
     ninja-build \
     python3 \
@@ -15,9 +15,11 @@ RUN apt-get update && apt-get install -y \
     pkg-config \
     libsodium-dev \
     libgit2-dev \
+    libroaring-dev \
     git \
     curl \
-    meson
+    meson && rm -rf /var/lib/apt/lists/*
+HEALTHCHECK --interval=30s --timeout=5s --retries=3 CMD sh -lc "$CC --version >/dev/null 2>&1 || exit 1"
 
 # Provide test runner in base so all targets inherit it
 RUN echo '#!/bin/bash' > /test-compiler.sh && \
@@ -45,70 +47,75 @@ WORKDIR /workspace
 CMD ["/test-compiler.sh"]
 
 # GCC 12 (THE DEVIL) - Pre-C23 image
-FROM base as gcc-12
-RUN apt-get update && apt-get install -y \
+FROM base AS gcc-12
+RUN apt-get update && apt-get install -y --no-install-recommends \
     software-properties-common \
     wget \
     gnupg && \
     add-apt-repository ppa:ubuntu-toolchain-r/test -y && \
     apt-get update && \
-    apt-get install -y gcc-12 g++-12
+    apt-get install -y --no-install-recommends gcc-12 g++-12 && \
+    rm -rf /var/lib/apt/lists/*
 ENV CC=gcc-12
 ENV CXX=g++-12
 
 # GCC 13 - C23 support image
-FROM base as gcc-13
-RUN apt-get update && apt-get install -y \
+FROM base AS gcc-13
+RUN apt-get update && apt-get install -y --no-install-recommends \
     software-properties-common \
     wget \
     gnupg && \
     add-apt-repository ppa:ubuntu-toolchain-r/test -y && \
     apt-get update && \
-    apt-get install -y gcc-13 g++-13
+    apt-get install -y --no-install-recommends gcc-13 g++-13 && \
+    rm -rf /var/lib/apt/lists/*
 ENV CC=gcc-13
 ENV CXX=g++-13
 
 # Clang 18 - C23 support image
-FROM base as clang-18
-RUN apt-get update && apt-get install -y \
+FROM base AS clang-18
+RUN apt-get update && apt-get install -y --no-install-recommends \
     wget \
     gnupg \
     lsb-release \
     software-properties-common && \
     wget -O - https://apt.llvm.org/llvm.sh | bash -s -- 18 all && \
-    apt-get install -y clang-18 clang++-18 clang-tidy-18
+    apt-get install -y --no-install-recommends clang-18 clang++-18 clang-tidy-18 && \
+    rm -rf /var/lib/apt/lists/*
 ENV CC=clang-18
 ENV CXX=clang++-18
 
 # Clang 19 - C23 support image
-FROM base as clang-19
-RUN apt-get update && apt-get install -y \
+FROM base AS clang-19
+RUN apt-get update && apt-get install -y --no-install-recommends \
     wget \
     gnupg \
     lsb-release \
     software-properties-common && \
     wget -O - https://apt.llvm.org/llvm.sh | bash -s -- 19 all && \
-    apt-get install -y clang-19 clang++-19 clang-tidy-19
+    apt-get install -y --no-install-recommends clang-19 clang++-19 clang-tidy-19 && \
+    rm -rf /var/lib/apt/lists/*
 ENV CC=clang-19
 ENV CXX=clang++-19
 
 # Clang 20 - Latest C23 support image
-FROM base as clang-20
-RUN apt-get update && apt-get install -y \
+FROM base AS clang-20
+RUN apt-get update && apt-get install -y --no-install-recommends \
     wget \
     gnupg \
     lsb-release \
     software-properties-common && \
     wget -O - https://apt.llvm.org/llvm.sh | bash -s -- 20 all && \
-    apt-get install -y clang-20 clang++-20 clang-tidy-20
+    apt-get install -y --no-install-recommends clang-20 clang++-20 clang-tidy-20 && \
+    rm -rf /var/lib/apt/lists/*
 ENV CC=clang-20
 ENV CXX=clang++-20
 
 # Ubuntu 24.04 base (for gcc-14)
-FROM ubuntu:24.04 as base-noble
+FROM ubuntu:24.04 AS base-noble
 ENV DEBIAN_FRONTEND=noninteractive
 ENV TZ=UTC
-RUN apt-get update && apt-get install -y \
+RUN apt-get update && apt-get install -y --no-install-recommends \
     build-essential \
     ninja-build \
     python3 \
@@ -119,7 +126,8 @@ RUN apt-get update && apt-get install -y \
     libroaring-dev \
     git \
     curl \
-    meson
+    meson && rm -rf /var/lib/apt/lists/*
+HEALTHCHECK --interval=30s --timeout=5s --retries=3 CMD sh -lc "$CC --version >/dev/null 2>&1 || exit 1"
 # Provide test runner in base-noble too
 RUN echo '#!/bin/bash' > /test-compiler.sh && \
     echo 'set -e' >> /test-compiler.sh && \
@@ -137,7 +145,7 @@ WORKDIR /workspace
 CMD ["/test-compiler.sh"]
 
 # GCC 14 target (gating)
-FROM base-noble as gcc-14
-RUN apt-get update && apt-get install -y gcc-14 g++-14
+FROM base-noble AS gcc-14
+RUN apt-get update && apt-get install -y --no-install-recommends gcc-14 g++-14 && rm -rf /var/lib/apt/lists/*
 ENV CC=gcc-14
 ENV CXX=g++-14