builds-reuse-the-mesh-cache — Builds reuse the mesh cache: compiled Rust, the cargo build directory, mix deps and npm packages, keyed by platform, toolchain and inputs

✕BLOCKED 0 of 6 issues done

ready

0

blocked

6

active

0

verify

0

done

0

cancelled

0

Problem

On 2026-10-22 lundra, the build and deploy host, reached zero free bytes: 185 GB of GitLab runner volumes duplicated a cache MinIO already held, and every machine compiled, fetched and installed the same dependencies from a cold cache of its own. ADR 0157 (proposed 2026-10-13) designed a shared compiler cache; only its model (I2670, #1118) was ever written, and dependency installs (mix deps.get, npm install, the shared cargo build directory) were never in it. Lundra's own disk is held by its host layer (a systemd disk guard, bounded runner volumes, MinIO bucket quotas), which I2674 turns into a provisioning capability; this milestone does not by itself free lundra's disk.

Outcome

Majordomus derives a key for every dependency install and compilation from the repository and the machine, restores it from the local level and then a trusted node's store before the work, saves it after, and is invisible when the store is absent; every local build path of the repository goes through it, and a gate refuses a new bypass.

Current state

Measured on master 2034d4a3f0b on 2026-10-22: every node runs sccache with a local disk level only (rustc-wrapper in ~/.cargo/config.toml or RUSTC_WRAPPER in a shell profile); lundra serves MinIO on :9000 to the tailnet and LAN (ufw), holding only the GitLab cache bucket; the crate has no S3 client and no key derivation; the shared build directory lives under {cargo-cache-home}, which asdf sets per toolchain; the tree has no mix project and its one npm ci runs on GitHub behind actions/cache.

Desired state

majordomus mesh build-cache key|status|ensure|env on every surface, the store found through a trusted node's signed offer, the local build paths routed through it, and a second node's reuse measured.

Scope

• apps/majordomus-cli/src/mesh/build_cache.rs
• apps/majordomus-cli/src/mesh/build_cache
• apps/majordomus-cli/src/capability/builtin/mesh.rs
• apps/majordomus-cli/src/cli.rs
• apps/majordomus-cli/src/commands/mesh.rs
• lib/rust_bin.sh
• scripts/reap-orphans
• scripts/ci/build-cache-check
• .ai/repo/adrs/0157-the-mesh-offers-a-shared-build-cache.md
• .ai/repo/policy.yaml
• docs/BUILD_CACHE.md
• docs/CLI.md

Out of scope

• Distributed compilation
• Public exposure of the store
• A second provider beside the first

Acceptance criteria

• Every criterion of intent a-build-reuses-what-the-mesh-already-built has its proof in the tree

Validation

• majordomus plan validate
• majordomus intent validate

Risks

• MinIO publishes no binaries since 2025 (ADR 0157): the provider is a field of the offer, not an assumption
• A shared cargo build directory carries each tree's absolute path in its fingerprints (ADR 0139): measured (I3955), dependencies stay Fresh on a second node and only a tree at another path recompiles its own crate
• I2670 (#1118) is the model every issue here builds on; it lands first

Issues

Each one is an execution contract with its own acceptance criteria, validation command and required evidence. The wave column is the layer of the dependency graph it sits in.

The graph

flowchart LR
    I3950["I3950<br/>A cache key is a versioned triplet of platform, toolchain and inputs, derived from the host and the repository"]:::blocked
    I3951["I3951<br/>The mesh store is spoken natively: signed S3 requests, bounded in time, with the credential read from a private file and never answered"]:::blocked
    I3952["I3952<br/>A dependency install is restored before and saved after, verified by its digest, local level first and a trusted store second"]:::blocked
    I3953["I3953<br/>Every local build path of the repository goes through the cache, and a gate refuses a new bypass"]:::blocked
    I3955["I3955<br/>Whether an archived cargo build directory is reused on a second node is measured before anything restores one"]:::blocked
    I3956["I3956<br/>Every worker, and every process it starts on any machine, is traced to its session, and the board names the address that reaches it"]:::blocked
    I3950 --> I3952
    I3951 --> I3952
    I3952 --> I3953
    classDef done stroke:#16a34a,fill:#dcfce7,color:#14532d,stroke-width:2px
    classDef active stroke:#2563eb,fill:#eff6ff,color:#1e3a8a,stroke-width:2px
    classDef verify stroke:#7c3aed,fill:#f5f3ff,color:#4c1d95,stroke-width:2px
    classDef ready stroke:#0891b2,fill:#ecfeff,color:#164e63,stroke-width:2px
    classDef planned stroke:#0891b2,fill:#ecfeff,color:#164e63,stroke-width:2px
    classDef blocked stroke:#b45309,fill:#fffbeb,color:#78350f,stroke-width:2px
    classDef cancelled stroke:#6b7280,fill:#f9fafb,color:#374151,stroke-width:2px
    classDef superseded stroke:#6b7280,fill:#f9fafb,color:#374151,stroke-width:2px

Canonical record: .ai/repo/project/milestones/builds-reuse-the-mesh-cache.yaml. Read it back with majordomus plan show builds-reuse-the-mesh-cache.