Today — the security posture document and the CI disagree. SECURITY.md:34: "no build cache that could serve a stale artifact"; ADR-0016 decision: "zizmor at pedantic, no build cache, a tag-guarded and changelog-gated release". CI: Swatinem/rust-cache@6323deb… # v2 at ci.yml:137-142 (test lanes), ci.yml:205-210 (metal) and stress.yml:38-42, dependencies only (cache-bin: false, cache-workspace-crates: false), skipped for release calls (ADR-0017). The 2026-09-07 CI audit that motivated ADR-0017 recorded the pre-cache baseline (median 59 min) and asked for cold/warm runs to be compared before any saving is claimed; no measurement has been recorded since.
Why it is worth fixing — a posture document that CI no longer satisfies is a broken promise either way. The owner's standing rule for this ecosystem's workflows is to install tools prebuilt and not to cache; ADR-0017 is the one deliberate exception and it has not yet paid for itself with a number.
Fix — measure first: three equivalent runs (cold, warm, one-line source change) from the timings-* artifacts, queue time separated from execution. Then either (a) keep the caches and amend SECURITY.md and ADR-0016 to "dependency-only caches, never restored for release builds (ADR-0017)", or (b) remove the three rust-cache steps and mark ADR-0017 superseded. Whichever is chosen, verification.md's "CI reuse" paragraph and SECURITY.md say the same thing.
Done when — the measurement is in docs/ with run URLs; SECURITY.md, ADR-0016/0017 and the workflows agree.
Today — the security posture document and the CI disagree.
SECURITY.md:34: "no build cache that could serve a stale artifact"; ADR-0016 decision: "zizmorat pedantic, no build cache, a tag-guarded and changelog-gated release". CI:Swatinem/rust-cache@6323deb… # v2atci.yml:137-142(test lanes),ci.yml:205-210(metal) andstress.yml:38-42, dependencies only (cache-bin: false,cache-workspace-crates: false), skipped for release calls (ADR-0017). The 2026-09-07 CI audit that motivated ADR-0017 recorded the pre-cache baseline (median 59 min) and asked for cold/warm runs to be compared before any saving is claimed; no measurement has been recorded since.Why it is worth fixing — a posture document that CI no longer satisfies is a broken promise either way. The owner's standing rule for this ecosystem's workflows is to install tools prebuilt and not to cache; ADR-0017 is the one deliberate exception and it has not yet paid for itself with a number.
Fix — measure first: three equivalent runs (cold, warm, one-line source change) from the
timings-*artifacts, queue time separated from execution. Then either (a) keep the caches and amend SECURITY.md and ADR-0016 to "dependency-only caches, never restored for release builds (ADR-0017)", or (b) remove the threerust-cachesteps and mark ADR-0017 superseded. Whichever is chosen,verification.md's "CI reuse" paragraph and SECURITY.md say the same thing.Done when — the measurement is in
docs/with run URLs; SECURITY.md, ADR-0016/0017 and the workflows agree.