docs(codex): log M6 recheck-2 fixes (R2-P1-1..R2-P2-4; round-3 user-g… #27
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Chaos | |
| # Driven stress / chaos harness (design/STRESS_HARNESS.md s7). | |
| # | |
| # COST POLICY (maintainer budget): the chaos jobs run WINDOWS-ONLY on every PR | |
| # and push to main (Windows is the primary target platform). The full 3-OS | |
| # matrix [ubuntu, macos, windows] runs ONLY on `v*` tag pushes (release gates), | |
| # where the extra macOS/Windows runner cost is worth the release-time coverage. | |
| # The weekly 6-hour fuzz soak is NOT run in CI - it is a local/on-demand task | |
| # (`just chaos-fuzz` / `just chaos-soak`); the bounded `fuzz-smoke` row still | |
| # runs in the per-PR sweep. Unix-shaped rows (POSIX perms, case-sensitive FS) | |
| # are exercised on the ubuntu leg of the tag-push 3-OS run and locally on Linux. | |
| # | |
| # Jobs: | |
| # chaos-hermetic - every PR/push: windows-only; on a `v*` tag: 3-OS matrix. | |
| # Runs every scenario whose requires() is satisfiable on a | |
| # stock non-elevated runner; the rest SKIP cleanly. | |
| # chaos-fake-drive - every PR/push: windows-only; on a `v*` tag: 3-OS matrix. | |
| # The dedicated fault-injection gate (STRESS_HARNESS s7): | |
| # runs ONLY the s3.7 Drive-side hazards + s4.2/s5 drive-side | |
| # mutator faults against InMemoryRemoteStore | |
| # (`run-all --fault-injection`). | |
| # chaos-real-drive - WIRED but SKIPPED until M4: gated on the | |
| # DRIVEN_E2E_REFRESH_TOKEN secret, which is absent until | |
| # the GoogleDriveStore (M4) lands. It skips cleanly, it | |
| # does NOT fail (STRESS_HARNESS s7 "Gating on M4"). | |
| # | |
| # The long fuzz soak + soak-gated massive-input rows (million-files-nested, | |
| # tiny-files-100k) run LOCALLY via the justfile (`just chaos-soak`, | |
| # `just chaos-fuzz`), not in CI. | |
| on: | |
| push: | |
| branches: [main] | |
| tags: ["v*"] | |
| pull_request: | |
| branches: [main] | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| env: | |
| CARGO_TERM_COLOR: always | |
| RUST_BACKTRACE: 1 | |
| # The harness boots the headless core whose state layer uses sqlx | |
| # compile-time-checked queries; CI has no live DB, so resolve against the | |
| # committed .sqlx/ cache (same as ci.yml). | |
| SQLX_OFFLINE: "true" | |
| jobs: | |
| chaos-hermetic: | |
| name: chaos hermetic (${{ matrix.os }}) | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| # WINDOWS-ONLY on a normal PR/push (the primary platform, cheapest | |
| # coverage); the FULL 3-OS matrix only on a `v*` tag push, where Linux + | |
| # macOS add the Unix-shaped rows for the release gate. The admin / VSS / | |
| # real-Drive rows SKIP cleanly on every unelevated runner (never red). | |
| os: ${{ startsWith(github.ref, 'refs/tags/') && fromJSON('["ubuntu-latest","macos-latest","windows-latest"]') || fromJSON('["windows-latest"]') }} | |
| runs-on: ${{ matrix.os }} | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: dtolnay/rust-toolchain@stable | |
| - name: Install Linux Tauri deps | |
| if: runner.os == 'Linux' | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y libwebkit2gtk-4.1-dev libxdo-dev libssl-dev \ | |
| libayatana-appindicator3-dev librsvg2-dev libsoup-3.0-dev javascriptcoregtk-4.1 | |
| - uses: Swatinem/rust-cache@v2 | |
| # run-all capability-gates every scenario: on a stock non-elevated runner | |
| # the admin / real-Drive rows SKIP (recorded, never red); the rest run | |
| # against the headless core + InMemoryRemoteStore. | |
| # Exit code: 0 = all pass/skip, 1 = any fail (STRESS_HARNESS s9). | |
| - name: chaos run-all (hermetic) | |
| run: cargo run -p driven-chaos -- run-all --hermetic | |
| chaos-fake-drive: | |
| name: chaos fake-drive (${{ matrix.os }}) | |
| # The dedicated fault-injection gate (STRESS_HARNESS s7). Runs ONLY the | |
| # s3.7 / s4.2 / s5 fault-injection subset against InMemoryRemoteStore; | |
| # capability-gated rows SKIP cleanly, never red. Same cost policy as | |
| # hermetic: windows-only normally, 3-OS on a `v*` tag. | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| os: ${{ startsWith(github.ref, 'refs/tags/') && fromJSON('["ubuntu-latest","macos-latest","windows-latest"]') || fromJSON('["windows-latest"]') }} | |
| runs-on: ${{ matrix.os }} | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: dtolnay/rust-toolchain@stable | |
| - name: Install Linux Tauri deps | |
| if: runner.os == 'Linux' | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y libwebkit2gtk-4.1-dev libxdo-dev libssl-dev \ | |
| libayatana-appindicator3-dev librsvg2-dev libsoup-3.0-dev javascriptcoregtk-4.1 | |
| - uses: Swatinem/rust-cache@v2 | |
| - name: chaos run-all (fault-injection) | |
| run: cargo run -p driven-chaos -- run-all --fault-injection | |
| chaos-real-drive: | |
| name: chaos real-drive (M4-gated, skipped) | |
| # WIRED but SKIPPED until M4 (STRESS_HARNESS s7 "Gating on M4"): the | |
| # real-Drive E2E refresh token does not exist until the GoogleDriveStore | |
| # (M4) lands, so this job is configured now and stays `if: false`-skipped. | |
| # The `secrets` context is NOT available in a job-level `if`, so we cannot | |
| # gate on the secret being present here - instead the maintainer flips this | |
| # literal `false` to `true` (or to a `vars.*` flag) when the | |
| # DRIVEN_E2E_REFRESH_TOKEN secret is configured at M4. Until then the job is | |
| # SKIPPED, never FAILED. | |
| if: ${{ false }} | |
| runs-on: ubuntu-latest | |
| env: | |
| DRIVEN_E2E_REFRESH_TOKEN: ${{ secrets.DRIVEN_E2E_REFRESH_TOKEN }} | |
| DRIVEN_E2E_DEST_FOLDER_ID: ${{ secrets.DRIVEN_E2E_DEST_FOLDER_ID }} | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: dtolnay/rust-toolchain@stable | |
| - name: Install Linux Tauri deps | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y libwebkit2gtk-4.1-dev libxdo-dev libssl-dev \ | |
| libayatana-appindicator3-dev librsvg2-dev libsoup-3.0-dev javascriptcoregtk-4.1 | |
| - uses: Swatinem/rust-cache@v2 | |
| # With real creds present, the cap:real_drive_creds rows run against a | |
| # throwaway Drive folder; everything else runs as in the hermetic job. | |
| - name: chaos run-all (real Drive) | |
| run: cargo run -p driven-chaos -- run-all --hermetic |