Integration: restructuring campaign, do not merge without explicit approval

.cargo/config.toml

@@ -1,9 +1,16 @@
 [build]
-jobs = 16
+# Parallelism is deliberately unset. Cargo's default is the host's logical CPU
+# count, which is right on a 32-thread workstation and on a 4-vCPU hosted
+# runner alike. A fixed 16 under-uses the first and starves the second: it put
+# sixteen concurrent linkers against 16 GiB of hosted-runner memory.
 
 [env]
 PROPTEST_DISABLE_FAILURE_PERSISTENCE = "1"
 
+# The target directory is host configuration. Keeping it outside this tracked
+# file lets each checkout and CI runner choose an isolated writable directory
+# without exporting a build override from this wrapper.
+
 [alias]
 xtask = "run -p xtask --bin xtask --"
 check-vyre = "run -p xtask --bin xtask -- abstraction-gate"

.gitattributes

@@ -1,2 +1,12 @@
-benches/competition/corpora/repo-* linguist-generated=true
-benches/competition/corpora/downloads/** linguist-generated=true
+# A recorded artifact is compared against the bytes its generator writes, and
+# every generator in this tree writes LF. A checkout that rewrites line endings
+# makes that comparison report a difference the tree does not hold: on the
+# Windows legs of the matrix the provenance head parsed off no artifact at all,
+# because `{\n  "source_fingerprint"` never matches a CRLF file.
+* text=auto eol=lf
+
+# cmd.exe reads batch files line by line and wants CRLF.
+*.cmd text eol=crlf
+
+# Fuzz corpora are wire bytes.
+*.vir0 binary

.github/CI_REQUIRED.md

@@ -1,11 +1,20 @@
 # Required CI Jobs for Branch Protection
 
 All jobs listed below are **required** to pass before a PR can merge into `main`.
-This list is enforced by branch protection rules (see `scripts/apply-branch-protection.sh`).
+The `ci-required` gate holds this list to the workflows that define it, and
+`scripts/apply-branch-protection.sh` applies it to the branch.
 
 ## From `ci.yml` (run on every PR + push to main)
 - `CI release gate`
 
+## From `gates.yml` (run on every PR + push to main)
+- `Every registered gate`
+- `Rules the sweep owns, named by domain`
+- `Every feature compiles alone on the MSRV`
+- `Every feature compiles alone or records why it cannot`
+- `Oracle-matrix sweeps ci.yml cannot reach`
+- `Emitted SPIR-V is validated, not just shaped`
+
 ## From `bench.yml` (run on every PR and push to main)
 - `criterion-regression`
 
@@ -18,9 +27,14 @@ This list is enforced by branch protection rules (see `scripts/apply-branch-prot
 ## From `gpu-parity.yml` (run on self-hosted GPU runner)
 - `GPU release gate`
 
-## From `reproducible-build.yml` (nightly schedule)
-- `reproducible`  -  nightly gate; not blocking on individual PRs but tracked in cycle reports.
-
 ## Scheduled or Manual Deep Gates
+
+Not blocking on individual PRs. Tracked in cycle reports.
+
 - `fuzz.yml`  -  full fuzz lane once active fuzz targets exist.
-- `mutation-testing.yml`  -  weekly zero-survivor gate once restored from `workflows-paused`.
+
+A workflow that is paused, superseded or left unprotected is declared in
+`xtask/ci-registry.toml`, which keeps a row for every workflow path the tree
+carries or once carried. It is not named here: this document is the payload of
+branch protection, and a name here that no workflow file answers to declares a
+lane that cannot run.

.github/CODEOWNERS

@@ -1,55 +1,118 @@
-# vyre contributor boundary  -  maintainer-only paths
-# Any change to these files requires review from @santhreal/core-maintainers.
-# See coordination/contributor-boundary.md for the threat model.
+# Generated from docs/PROTECTED_BOUNDARIES.toml by `xtask codeowners --write`.
+# Do not edit this file. Edit the manifest and regenerate.
+#
+# GitHub reads the first CODEOWNERS it finds at CODEOWNERS, .github/CODEOWNERS or
+# docs/CODEOWNERS. A file at an earlier location replaces this one in full, so the
+# `codeowners` gate refuses a second file at any of them.
 
-# The algebraic law enum, invariant catalog, V-rule numbering, and data types.
-# Leak defended: oracle poisoning, decorative laws.
-/spec/src/lib.rs @santhreal/core-maintainers
+# The algebraic law enum, the operation definitions and the cross-engine schemas every other crate is judged against.
+# Defends: oracle poisoning, decorative laws, monotonic weakening
+/vyre-spec/ @santhreal/core-maintainers
 
-# The entire vyre-spec crate.
-# Leak defended: monotonic weakening.
-/spec/ @santhreal/core-maintainers
+# Typed IR, graph validation and the optimizer legality that decides which rewrites are semantically permitted.
+# Defends: monotonic weakening, oracle poisoning
+/vyre-foundation/ @santhreal/core-maintainers
 
-# The CPU reference interpreter (the oracle).
-# Leak defended: oracle poisoning, rigged tests.
-/conform/src/reference/ @santhreal/core-maintainers
+# The CPU reference interpreter. It is the only independent semantic oracle, so a change to it changes what every parity result means.
+# Defends: oracle poisoning, rigged tests
+/vyre-reference/ @santhreal/core-maintainers
 
-# The H1..H10 harnesses that drive conformance testing.
-# Leak defended: rigged tests, silent coverage holes.
-/conform/src/verify/harnesses/ @santhreal/core-maintainers
+# Registers the oracle as a backend, so it is the one place a host result can be presented as a device result.
+# Defends: oracle poisoning, silent host execution
+/vyre-driver-reference/ @santhreal/core-maintainers
 
-# Law-checking infrastructure.
-# Leak defended: decorative laws, no proof for all inputs.
-/conform/src/algebra/laws/ @santhreal/core-maintainers
+# The conformance harness, its certificate schema and the parity matrices.
+# Defends: rigged tests, silent coverage holes, no proof for all inputs
+/conform/ @santhreal/core-maintainers
 
-# Future: mass-testing catalog. Protect on creation.
-# Leak defended: contributor-chosen inputs, no proof for all inputs.
-/test-infra/test_catalog.toml @santhreal/core-maintainers
+# The single schedule-selection owner. Legality, cost, search and artifact identity are decided here.
+# Defends: monotonic weakening, unmeasured winners
+/vyre-megakernel/ @santhreal/core-maintainers
 
-# CODEOWNERS itself  -  contributors must not be able to remove their own restrictions.
-# Leak defended: all seven leaks (meta-gate).
-/.github/CODEOWNERS @santhreal/core-maintainers
+# Neutral lowering from selected schedule to physical kernel representation.
+# Defends: monotonic weakening
+/vyre-lower/ @santhreal/core-maintainers
 
-# Branch protection application script  -  guards the meta-gate.
-# Leak defended: all seven leaks (meta-gate).
-/scripts/apply-branch-protection.sh @santhreal/core-maintainers
+# Concrete emission. A downgraded memory scope or a dropped barrier is invisible in the emitted text.
+# Defends: silent scope downgrade
+/vyre-emit-naga/ @santhreal/core-maintainers
+
+# Concrete emission. A downgraded memory scope or a dropped barrier is invisible in the emitted text.
+# Defends: silent scope downgrade
+/vyre-emit-ptx/ @santhreal/core-maintainers
+
+# Concrete emission. A downgraded memory scope or a dropped barrier is invisible in the emitted text.
+# Defends: silent scope downgrade
+/vyre-emit-spirv/ @santhreal/core-maintainers
+
+# Concrete emission. A downgraded memory scope or a dropped barrier is invisible in the emitted text.
+# Defends: silent scope downgrade
+/vyre-emit-metal/ @santhreal/core-maintainers
+
+# The neutral backend contract, precedence and dispatch seam every concrete device is admitted through.
+# Defends: silent host execution, monotonic weakening
+/vyre-driver/ @santhreal/core-maintainers
+
+# Concrete device execution. A probe failure converted into a skip or a host result would be reported as a pass.
+# Defends: silent host execution
+/vyre-driver-cuda/ @santhreal/core-maintainers
+
+# Concrete device execution. A probe failure converted into a skip or a host result would be reported as a pass.
+# Defends: silent host execution
+/vyre-driver-wgpu/ @santhreal/core-maintainers
+
+# Concrete device execution. A probe failure converted into a skip or a host result would be reported as a pass.
+# Defends: silent host execution
+/vyre-driver-metal/ @santhreal/core-maintainers
+
+# Concrete device execution. A probe failure converted into a skip or a host result would be reported as a pass.
+# Defends: silent host execution
+/vyre-driver-spirv/ @santhreal/core-maintainers
 
-# Future: mutation testing script. Protect on creation.
-# Leak defended: rigged tests, silent coverage holes.
-/scripts/mutants.sh @santhreal/core-maintainers
+# Artifact admission, residency, tenant limits and the caches a stale record would be served from.
+# Defends: stale cache reuse, unbounded tenants
+/vyre-runtime/ @santhreal/core-maintainers
 
-# Future: append-only test enforcement script. Protect on creation.
-# Leak defended: rigged tests, silent coverage holes.
-/scripts/append-only.sh @santhreal/core-maintainers
+# The measurement harness. What it records is what a performance claim is read from.
+# Defends: rigged tests, contributor-chosen inputs
+/vyre-bench/ @santhreal/core-maintainers
 
-# GitHub Actions workflows  -  CI gates and permissions.
-# Leak defended: all seven leaks (meta-gate).
+# The release and evidence tooling that decides what a measured claim is.
+# Defends: rigged tests, contributor-chosen inputs
+/xtask-evidence/ @santhreal/core-maintainers
+
+# The recorded evidence and release train a claim is read from.
+# Defends: contributor-chosen inputs, rigged tests
+/release/ @santhreal/core-maintainers
+
+# The committed public API snapshots. They are the semver trip-wire, so a regenerated snapshot is how an accidental promise ships.
+# Defends: monotonic weakening
+/docs/public-api/ @santhreal/core-maintainers
+
+# Every gate's finding pin. A raised row certifies what it stopped checking.
+# Defends: monotonic weakening
+/xtask/gate-baselines.toml @santhreal/core-maintainers
+
+# The generator and validator of the active CODEOWNERS file.
+# Defends: all boundaries (meta-gate)
+/xtask/src/gates/codeowners.rs @santhreal/core-maintainers
+
+# This manifest. It is the source the active CODEOWNERS is generated from.
+# Defends: all boundaries (meta-gate)
+/docs/PROTECTED_BOUNDARIES.toml @santhreal/core-maintainers
+
+# The generated file itself, so a contributor cannot remove their own restriction.
+# Defends: all boundaries (meta-gate)
+/.github/CODEOWNERS @santhreal/core-maintainers
+
+# CI gates and the permissions they run with.
+# Defends: all boundaries (meta-gate)
 /.github/workflows/ @santhreal/core-maintainers
 
-# This threat model document  -  append-only audit trail.
-# Leak defended: all seven leaks (meta-gate, T59 self-reference).
-/coordination/adversary-threat-model.md @santhreal/core-maintainers
+# Applies the branch protection that makes a required review required.
+# Defends: all boundaries (meta-gate)
+/scripts/apply-branch-protection.sh @santhreal/core-maintainers
 
-# Workspace root manifest  -  controls features, dependencies, and crate topology.
-# Leak defended: oracle poisoning, monotonic weakening.
+# Workspace root manifest. It controls features, dependencies and crate topology.
+# Defends: oracle poisoning, monotonic weakening
 /Cargo.toml @santhreal/core-maintainers

.github/actions/reclaim-runner-disk/action.yml

@@ -0,0 +1,38 @@
+name: reclaim-runner-disk
+description: Delete preinstalled toolchains a Rust build never reads, so a whole-workspace build has room on the runner's root filesystem.
+
+# A hosted Linux runner ships around 21 GB free on the filesystem that holds
+# the checkout, and a debug build of every target in this workspace does not
+# fit in it: the runner dies mid-compile and the job reports `The runner has
+# received a shutdown signal`, which names the symptom and not the cause. The
+# lanes that only `cargo check` or build a subset stay green, which is what
+# makes the failure look intermittent. The deleted trees are .NET, Android,
+# Haskell, Swift, PowerShell and CodeQL, none of which a cargo build reads.
+#
+# The free space is printed before and after, so a lane that still dies has a
+# number in its log and the next reader does not have to guess again.
+
+runs:
+  using: composite
+  steps:
+    - name: Reclaim runner disk
+      shell: bash
+      run: |
+        # These paths are part of the hosted image and are recreated with the
+        # next runner. On a persistent host they are the machine's own system
+        # directories, so the step refuses rather than deleting them.
+        if [ "${RUNNER_ENVIRONMENT:-}" != "github-hosted" ]; then
+          echo "::error::reclaim-runner-disk deletes hosted-image directories and must not run on a self-hosted runner (RUNNER_ENVIRONMENT=${RUNNER_ENVIRONMENT:-unset})"
+          exit 1
+        fi
+        avail() { df -k / | awk 'NR==2 { printf "%.1f", $4 / 1048576 }'; }
+        before="$(avail)"
+        sudo rm -rf \
+          /usr/share/dotnet \
+          /usr/local/lib/android \
+          /opt/ghc \
+          /usr/local/.ghcup \
+          /usr/share/swift \
+          /usr/local/share/powershell \
+          /opt/hostedtoolcache/CodeQL
+        echo "root filesystem: ${before} GiB free before, $(avail) GiB free after"