igneum/tools/ci/README.md

CI checks

Check	What it fails	Since
no text overlaps (overlap-check.mjs)	A served page, or a miner or wallet screen (behind IGNEUM_OVERLAP_APPS=1), where a visible run of text is covered by another element (a pill over a caption, a label over a value, a card over its neighbour, text under the header at rest), clipped by an overflow-hidden ancestor, or past the viewport; a page that scrolls sideways. Five widths, light and dark, the home hero at rest and at each step. A fixture with one deliberate overlap of each kind must be flagged first (--self-test). Needs a headless Chromium: CI installs Playwright; the Mac ships the pages to build-2 (infra/build-server/overlap-browser.sh).	7 October 2026: the hero's step pill sat on the caption's second line ("Two thirds of the weight sign. The checkpoint locks.") at every desktop width, found by the founder on the live site

| master takes only CI-passed commits (ci-state.mjs, merge-to-master.sh, the hook's master_ci_ok) | A push to master whose commit, or whose merge's branch parent, has no green ci run on that exact sha (the runs API through gh: red, queued, none or gh unreachable all refuse); a merge onto a master whose last compiled run is red, unless declared the fix (--fixes-master). The merge tool pushes an unrun branch for a run and waits for a queued one with the clock. A feature-branch push prints the branch's previous red first (--branch-red). | 7 October 2026: era-vdf's tip 0e2d6b1c merged with no ci run; master's igneum-pow suite red from 16:31 UK under five docs-only green merges | | every workflow job carries timeout-minutes (workflow-timeouts-check.sh) | A job in .github/workflows without timeout-minutes, or a budget off its measured line (site 15, changes 10, pow 60, sims 45). | 7 October 2026: three hosted site jobs on master hung over two hours each in the tree gate; the six-hour default was the only stop | | a box or network check gets one retry (retry-once.sh) | Nothing by itself: wraps the box-locks check, the scene parity check and the live public API check so a first failure is printed and retried once; the second is the verdict. The checks keep their own skip line on a runner without the resource. | 7 October 2026 | | the red watcher fires on cancelled and timed-out runs too (ci-red.yml, red-watch.mjs) | The watcher's if missing any of failure, cancelled, timed_out, or the conclusion not handed to the record step (the self-test reads the workflow file); the line names the kind: CI red, CI cancelled, CI timed out. | 7 October 2026 |

| gh's active account is the stored Igneum entry (gh-account-check.sh, in Igneum's own gh directory ~/.config/gh-igneum through gh-env.sh, never the founder's) | A push or a landing from this Mac while Igneum's gh directory names any other account as active, or none (the refusal names the one step: the founder or main stores the Igneum token there with GH_CONFIG_DIR=~/.config/gh-igneum gh auth login --with-token; no lane does); skipped with a line while github-suspended stands. RULE: no lane switches gh accounts on this Mac, ever; the second owner's login belongs to other projects and must never touch Igneum; the stored entry's name is in ~/.config/igneum/gh-user, never in the repository. | 7 October 2026, 21:41 UK: a lane switched gh to the other login during the suspension; nobody could say which | | F02 (Review B): the proof-rule test bypass cannot reach a release build (proof-rule-bypass-check.sh; a cell of the node matrix) | An env read of IGNEUM_TEST_SKIP_PROOF_RULE with no cfg(test) or cfg(feature) guard in the 12 lines above, or under a feature in the crate's default features; a release igneumd carrying the bypass string. Red on every node sha until the proving lane's change (the read under a non-default feature or cfg(test)) lands | 8 Oct 2026 | | the test map merges structurally at a landing (test-map-merge.py) and the harness page regenerates from the merged map (merge-to-master.sh) | Nothing by itself: two lanes adding cells collided as text and the regenerated page lost rule 26's race; the merge now keeps master's cells plus the branch's, minus what the branch removed and master left, and regenerates the page | 8 Oct 2026 | | a push that lost the ref race retries without re-running the hook (merge-to-master.sh push_race, 12 tries) | Nothing by itself: under one landing a minute a 70-second hook per try never won master's compare-and-swap (Review B's landing lost three in a row); once the hook has passed on the first try and the rejection is a ref race, later tries push --no-verify (both parents gated) | 8 Oct 2026 | | the REV suite is generated from an external review's findings.json and dispatch.md (review-suite.mjs; one case per required regression, NOT RUN, the owner from the dispatch table) | A registry whose REV suite differs from the generator's output (--check) | 8 Oct 2026 | | a registry landing carries its batches (tools/ci/batches/<run id>.json; merge-to-master.sh replays them onto master's copy at the merge) | Nothing by itself: the registry is a hot file, and a branch whose own copy of it was recorded during a seven-minute gate lost the race to another lane's rows three times in a row (8 Oct 2026, 19:1x UK). A branch that adds batch files is merged with master's registry, every added batch replayed through test-record.mjs --record (idempotent), and the evidence rules run on the merged result; rule 26 does not bind the registry path for such a branch | 8 Oct 2026 | | the registry's evidence rules (registry-evidence-check.sh, called by merge-to-master.sh after rule 26) | A landing that sets a case's run_status to PASS without an evidence_path that exists (in the tree at the landing, or on a build box over ssh; a box that does not answer is a line, not a refusal); a landing that changes a file under docs/analysis/ or a path a registry row names without moving that row's updated (the row and its evidence move together, GOV-04); a PASS whose evidence record pins another manifest than the registry's pinned_manifest_sha (stale evidence reads NOT RUN, GOV-08); a run_status written while the registry carries no approval block (thresholds before results, GOV-02) | 8 Oct 2026 | | the acceptance layer (test-record.mjs, test-map.json, test-map-doc.mjs; the founder's Test and Acceptance Standard, docs/plans/igneum-2.0-test-registry.json) | An automated case of the registry with no cell in the map and no NOT RUN reason; a map naming an unknown case; a stale harness-map page (generated from the JSON); the recorder's self-test: a run batch writes run_status, run_id, evidence_path, updated and the evidence record to the mapped cases only, never an accept text, and a case with no harness reads NOT RUN with its reason, never PASS by inference | 8 Oct 2026 | | rule 26: a landing that touches a site/ or docs/ path another lane landed since the branch point carries master's copy (rule26-no-revert.sh, called by merge-to-master.sh before the merge) | A branch whose copy of such a path lacks lines master added after the merge base, or that deletes the path; refused with the path named and the fix (merge master on the branch, or name the path in the landing message as intentional). Class: 16b3e140 and 6fc57381 put the reference-apps lane's receipt.html and then all of site/lc back to older copies | 8 Oct 2026 | | rule 24: a landing that touches a .rs, Cargo.toml, Cargo.lock, build.rs or .cargo/config checks and tests its crates on the box first (rule24-crate-gate.sh, called by merge-to-master.sh before the merge and by the hook on a push of master or release-*) | A touched crate that does not cargo check or whose suite is red on the box at gate priority; a file under no crate (the root .cargo/config) runs the core pair igneum-pow and app/igneum-app; a vendor crate is named and left to its lane; docs/ and site/ alone (docs-only-check.sh) run nothing; any other diff takes the full gate alone. Class: master's igneum-pow stopped compiling at 17:07 UK under landings that never built it | 8 Oct 2026 | | no landing on the public host while the marker stands (pre-push.sh forgejo_master_frozen, merge-to-master.sh forgejo_master_refusal); the hook binds every remote rule to the remote's URL | A push of master to git.igneum.network, or a --remote naming it, while tools/ci/github-suspended stands: its master is a rewritten copy replaced at cut-over, so the landing would be lost (a branch pushed there for safekeeping passes). Before the fix the hook matched the remote NAME, so git push origin master bound neither the GitHub refusal nor the CI rule; the self-test now drives the hook by name through a fixture repo. Also: gate-manifest-check.sh and four other pipefail checks no longer pipe a file-sized producer into grep -q (GNU sed took SIGPIPE on an early match and the check read it as a missing run line on the Linux runners and boxes); mirror_master fast-forwards every box with a build-server file after a landing on ANY remote (before, only a GitHub landing fanned out, so a box landing left build-3 and build-4 at a tip 23 hours old), as a --no-verify copy of the master the gate already passed (a stale mirror had re-run the full gate for six minutes per box) | 8 Oct 2026 |

| kill by exact command or pid file (owed as a check) | 6 October 2026, 21:09Z: a Mac-side pkill -f <log file name> matched nothing (the log name was a redirect, not part of the command line), the roll-everything script lived on and wiped a box it had been told to hold. Rule: a job is stopped by its pid file (tools/fleet/fleet-bg.sh start|stop <name>) or by a pattern anchored on its exact command line (^python3 -u /root/fleet/in/box-prover.py), never by a word that may or may not appear in it. The check that flags a pkill -f/pgrep -f whose literal is a path or a name that never starts a command line is owed to the CI lane |

No inline deletion in a shell string (7 October 2026)

The desktop app asks the founder to approve any shell command that carries rm inside an inline bash -c '...' or sh -c '...' string ("runs rm and could not be checked"). Rule for every lane: never an inline rm, rm -rf, find ... -delete or a redirect-truncate inside a bash -c / sh -c string. Put the script in a file under tools/ (or the lane's scratch directory) and run it by path; on the boxes, do deletions through the lease or job tooling, which the checker reads as a plain command. tools/ci/inline-rm-check.sh greps every tracked script for the shape (self-test first, known-failed shapes named) and runs in the gate.