I3953 — Every local build path of the repository goes through the cache, and a gate refuses a new bypass

✕BLOKOVÁNO vlna 3 · p0 · profil implementation · běží samostatně

Part of builds-reuse-the-mesh-cache — Builds reuse the mesh cache: compiled Rust, the cargo build directory, mix deps and npm packages, keyed by platform, toolchain and inputs.

Cíl

The repository's cargo choke point (lib/rust_bin.sh, which scripts/derive, scripts/rust-check and the just recipes call) starts sccache with the store as its second level through the configuration I2673 derives, credential by file; the local site build installs through mesh build-cache ensure; scripts/ci/build-cache-check refuses a local script that runs cargo or npm install around them unless the line declares why.

Proč

The owner, 2026-10-22, after lundra (the build and deploy host) reached zero free bytes: the shared cache must be part of Majordomus — used when MinIO is available, enforced, dynamic, derived — for compiled Rust, the shared cargo build directory, mix deps.get and npm install, keyed by a triplet for the most reuse. Decided the same day after critique: the store is trusted only through a signed offer (I2671), the build directory archive is measured before it is built (I3955), and the dependency cache is generic and wired first into prismatic-platform. See ADR 0157 and intent a-build-reuses-what-the-mesh-already-built.

Aktuální stav

Measured on master 2034d4a3f0b on 2026-10-22: no key derivation, no S3 client and no dependency cache exist in the crate; I2670 (#1118) holds the offer model and the pure selection only.

Cílový stav

Every local build of this repository reuses what the store holds without anyone setting a variable; GitHub's runners, which cannot reach the store, are a declared exemption; an older installed majordomus without the commands leaves every path working as before.

Rozsah

• lib/rust_bin.sh
• scripts/derive
• scripts/site-build
• scripts/ci/build-cache-check
• apps/majordomus-cli/src/environment/
• .ai/repo/rules/project/
• .ai/repo/project/intents/a-build-reuses-what-the-mesh-already-built.yaml
• test/cases/3953_every_build_path_goes_through_the_cache.sh
• docs/BUILD_CACHE.md

Mimo rozsah

• Editing a user's cargo config or shell profile
• GitHub Actions jobs

Závislosti

• I3952✕BLOCKED A dependency install is restored before and saved after, verified by its digest, local level first and a trusted store second
• I2673✕BLOKOVÁNO Klientská konfigurace sccache je odvozena z vybrané nabídky, nejprve lokální disk

Kritéria přijetí

• With the store healthy when the sccache server starts, the server has it as its second level; with it down the build is local-only and succeeds
• The store is probed only when a server is started, never per compilation
• The gate fails on a fixture script that calls npm ci or cargo build around the choke point, and passes one that declares why
• A cold node with no majordomus yet builds as before, and the cache joins once the executable exists

Validace

• bin/majordomus plan validate
• MJ_TEST_JOBS=2 bash test/run.sh 3953_every_build_path_goes_through_the_cache

Požadované důkazy

• build_paths_case
• bypass_refused_case

Důkazy

Nic nezaznamenáno. Za každým tokenem výše musí stát příkaz nebo artefakt, než lze tento úkol dokončit; vyprávění se odmítá.

Časová osa

zahájeno

—

ověřeno

—

dokončeno

—

Tato tři pole, důkazy výše a stav závislostí jsou vše, z čeho se stav skládá. Neexistuje žádné pole stavu, které by s nimi mohlo být v rozporu.

Canonical record: .ai/repo/project/issues/I3953.yaml. Read it back with majordomus plan show I3953.