CI: jeder Job auf dem Pin, jedes Member gegated, ein Ort pro Version

.github/workflows/build.yml

@@ -39,10 +39,6 @@ jobs:
     defaults:
       run:
         working-directory: lance-graph
-    strategy:
-      matrix:
-        toolchain:
-          - stable
     steps:
       - uses: actions/checkout@v4
         with:
@@ -56,10 +52,15 @@ jobs:
         with:
           repository: AdaWorldAPI/OGAR
           path: OGAR
-      - name: Setup rust toolchain
-        run: |
-          rustup toolchain install ${{ matrix.toolchain }}
-          rustup default ${{ matrix.toolchain }}
+      # Toolchain comes from `rust-toolchain.toml` (channel + components), NOT
+      # from a version restated here. `rustup show` installs and activates
+      # whatever that file pins — so a bump is ONE edit in ONE file, which is
+      # exactly what that file's own comment asks for ("a bump edits `channel`
+      # and leaves the prose behind"). Previously this installed `stable` and
+      # set it as default; inside the repo the toolchain file won anyway, so
+      # these jobs already ran on the pin while the workflow said otherwise.
+      - name: Setup rust toolchain (pinned by rust-toolchain.toml)
+        run: rustup show
       - name: Setup mold linker
         # Parity with rust-test.yml: the heavy lance+datafusion build + test
         # binaries hit the GNU-ld/rust-lld RSS+disk cliff at the link step

.github/workflows/jc-proof.yml

@@ -32,8 +32,8 @@ jobs:
         run: git clone --depth 1 https://github.com/AdaWorldAPI/ndarray ../ndarray
       - name: Setup Rust
         run: |
-          rustup toolchain install stable
-          rustup default stable
+          # Pinned by rust-toolchain.toml — never a version restated here.
+          rustup show
 
       - name: Run JC tests (6 unit tests)
         run: cargo test --manifest-path crates/jc/Cargo.toml

.github/workflows/release.yml

@@ -68,7 +68,9 @@ jobs:
 
     - uses: actions-rust-lang/setup-rust-toolchain@v1
       with:
-        toolchain: stable
+        # No `toolchain:` input — the action reads `rust-toolchain.toml`, so the
+        # SHIPPED artifact is built with the pinned channel rather than whatever
+        # `stable` is that week. Same shape style.yml already uses for rustfmt.
         components: rustfmt, clippy
         cache: false
 

.github/workflows/rust-publish.yml

@@ -41,7 +41,9 @@ jobs:
 
       - uses: actions-rust-lang/setup-rust-toolchain@v1
         with:
-          toolchain: stable
+          # No `toolchain:` input — the action reads `rust-toolchain.toml`, so the
+          # SHIPPED artifact is built with the pinned channel rather than whatever
+          # `stable` is that week. Same shape style.yml already uses for rustfmt.
           components: rustfmt, clippy
           cache: false
 

.github/workflows/rust-test.yml

@@ -48,10 +48,6 @@ jobs:
     defaults:
       run:
         working-directory: lance-graph
-    strategy:
-      matrix:
-        toolchain:
-          - stable
     steps:
       - uses: actions/checkout@v4
         with:
@@ -69,10 +65,15 @@ jobs:
         with:
           repository: AdaWorldAPI/OGAR
           path: OGAR
-      - name: Setup rust toolchain
-        run: |
-          rustup toolchain install ${{ matrix.toolchain }}
-          rustup default ${{ matrix.toolchain }}
+      # Toolchain comes from `rust-toolchain.toml` (channel + components), NOT
+      # from a version restated here. `rustup show` installs and activates
+      # whatever that file pins — so a bump is ONE edit in ONE file, which is
+      # exactly what that file's own comment asks for ("a bump edits `channel`
+      # and leaves the prose behind"). Previously this installed `stable` and
+      # set it as default; inside the repo the toolchain file won anyway, so
+      # these jobs already ran on the pin while the workflow said otherwise.
+      - name: Setup rust toolchain (pinned by rust-toolchain.toml)
+        run: rustup show
       - name: Setup mold linker
         # Heavy lance+datafusion integration-test binaries OOM the default GNU `ld`
         # at the `cargo test --no-run` link step (intermittent). mold links them
@@ -221,6 +222,156 @@ jobs:
       - name: Probe falsifier - babel stances (fixture asserts)
         run: cargo run -p lance-graph-planner --example probe_babel_stances
 
+
+  # ── Split out of `test` DELIBERATELY, before it broke ─────────────────────
+  #
+  # Everything below was added to the `test` job in this branch: the workspace
+  # compile gate plus ten per-crate test steps for members that had no gate at
+  # all. They accumulate their test binaries into one `target/`, and `test` is
+  # a job with a MEASURED history at exactly that cliff — its own env block
+  # records "a hard `ld` SIGBUS (signal 7 = object file truncated when the
+  # runner partition fills mid-link)".
+  #
+  # Measured here (clean tree, manifest `debug = 0`): `cargo build --workspace`
+  # costs 3.5 GB, `cargo test --workspace --no-run` costs 14 GB across 86
+  # binaries — the same order as a runner's free disk. Adding a subset of that
+  # to a job already known to have filled its partition is a bet with no upside.
+  #
+  # So `test` goes back to exactly the disk profile it had before this branch,
+  # and every addition lives here with its own runner and its own cache key.
+  # This is preventive: the split is cheaper than the flake it avoids, and a
+  # flake here would be indistinguishable from a real failure.
+  member-tests:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+    env:
+      # Same reason as `test`: CI never opens a debugger, and debug info is
+      # what pushes the link over the partition. See that job's env block.
+      RUSTFLAGS: "-C debuginfo=0 -C target-cpu=x86-64-v3"
+    defaults:
+      run:
+        working-directory: lance-graph
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          path: lance-graph
+      - name: Checkout AdaWorldAPI/ndarray (sibling dependency)
+        uses: actions/checkout@v4
+        with:
+          repository: AdaWorldAPI/ndarray
+          path: ndarray
+      - name: Checkout AdaWorldAPI/OGAR (sibling dependency, NO-PIN path deps)
+        uses: actions/checkout@v4
+        with:
+          repository: AdaWorldAPI/OGAR
+          path: OGAR
+      - name: Setup rust toolchain (pinned by rust-toolchain.toml)
+        run: rustup show
+      - name: Setup mold linker
+        uses: rui314/setup-mold@9c9c13bf4c3f1adef0cc596abc155580bcb04444 # v1
+      # Its OWN cache key. Sharing `lance-graph-deps` with `test` would have two
+      # jobs writing different contents under one key and thrashing it.
+      - uses: Swatinem/rust-cache@v2
+        with:
+          shared-key: "lance-graph-members"
+          workspaces: |
+            lance-graph
+      - name: Install dependencies
+        run: |
+          sudo apt update
+          sudo apt install -y protobuf-compiler
+      # ── The structural net: every member, present and future ─────────────
+      #
+      # The per-crate steps below are a hand-maintained allowlist, and that is
+      # exactly how `lance-graph-hydrate` reached `main` un-compiling: it was a
+      # workspace MEMBER, but membership gates nothing when no job says
+      # `--workspace`. This step is the net that needs no maintenance — a member
+      # added tomorrow is covered the moment it is listed in `[workspace]`.
+      #
+      # Measured before landing (2026-08-22, clean tree, `[profile.dev]
+      # debug = 0` from the manifest):
+      #
+      #   cargo build --workspace           exit 0, 6m18s, target/ 3.5 GB
+      #   cargo test  --workspace --no-run  exit 0, target/ 14 GB, 86 binaries
+      #
+      # BUILD and not TEST, and the reason is the second row. The test scope
+      # SUCCEEDS — an earlier ENOSPC was against a target already holding 15 GB
+      # of debug-laden artifacts from builds predating the manifest default, and
+      # measured that tree rather than the test scope. What rules it out here is
+      # size: linking every member's test binaries costs 14 GB, which is the
+      # same order as a GitHub runner's free disk. The compile costs 3.5 GB.
+      #
+      # KNOWN RISK, stated rather than discovered later: the per-crate test
+      # steps below run in THIS job and accumulate their test binaries into the
+      # same `target/`. They are a subset of those 14 GB, so this job's disk
+      # headroom is not proven — only the workspace compile is. If the job ever
+      # fails on disk, the fix is to split the per-crate tests into their own
+      # job (or `cargo clean -p` between them), not to drop the gate.
+      #
+      # A new member's TESTS therefore still need a line below. That edge
+      # disappears if the runner is ever measured to hold the 14 GB, at which
+      # point these ten steps collapse into one.
+      - name: Build every workspace member (structural gate)
+        run: cargo build --workspace
+
+      # ── The rest of the allowlist gap, closed in one pass ────────────────
+      #
+      # No workflow here runs `--workspace`, so `[workspace] members` gates
+      # nothing and ELEVEN of 25 members were reached by no job at all
+      # (EPIPHANIES E-THE-GATE-IS-A-HAND-MAINTAINED-ALLOWLIST-NOT-THE-WORKSPACE-1,
+      # ISSUES ISS-CI-GATE-IS-AN-ALLOWLIST-NINE-MEMBERS-UNGATED). Two of them
+      # (catalog, planner) are deps of lance-graph, so their LIBS compiled
+      # inside a gated build while their tests ran nowhere; the others compiled
+      # nowhere at all. That is how `lance-graph-hydrate` reached `main`
+      # un-compiling.
+      #
+      # Every step below was RUN LOCALLY on the pinned toolchain before being
+      # added, and the count in each comment is what it returned. A gate is
+      # only added for a crate that is green; nothing here is armed on hope.
+      - name: Run catalog tests (previously ungated)          # 12 + 15 green
+        run: cargo test --manifest-path crates/lance-graph-catalog/Cargo.toml
+      - name: Run planner tests (previously ungated)          # 368 + 4 green, 6 ignored
+        run: cargo test --manifest-path crates/lance-graph-planner/Cargo.toml
+      - name: Run ontology tests (previously ungated)         # 276 + 2 + 6 green
+        run: cargo test --manifest-path crates/lance-graph-ontology/Cargo.toml
+      - name: Run rbac tests (previously ungated)             # 23 green
+        run: cargo test --manifest-path crates/lance-graph-rbac/Cargo.toml
+      - name: Run archetype tests (previously ungated)        # 16 green
+        run: cargo test --manifest-path crates/lance-graph-archetype/Cargo.toml
+      - name: Run consumer-conformance tests (previously ungated)  # 8 green, 2 ignored
+        run: cargo test --manifest-path crates/lance-graph-consumer-conformance/Cargo.toml
+      - name: Run sigma-tier-router tests (previously ungated)     # 20 green
+        run: cargo test --manifest-path crates/sigma-tier-router/Cargo.toml
+      - name: Run neural-debug tests (previously ungated)     # 11 green
+        run: cargo test --manifest-path crates/neural-debug/Cargo.toml
+      - name: Run shader-driver tests (previously ungated)    # 107 + 2 green
+        run: cargo test --manifest-path crates/cognitive-shader-driver/Cargo.toml
+      # lance-graph-benches carries NO tests — it is a benches-only crate with
+      # one `harness = false` target (`graph_execution`). `cargo test` on it
+      # runs zero tests and would be a gate that cannot fail; the meaningful
+      # check is that the bench target still COMPILES, which is the same shape
+      # build.yml already uses for lance-graph's own benches.
+      - name: Check benches compile (previously ungated)      # no tests by design
+        run: cargo check --manifest-path crates/lance-graph-benches/Cargo.toml --benches
+      # lance-graph-hydrate: the crate this whole sweep came out of. It is a
+      # workspace MEMBER and did not compile at #981 — `object_store 0.13.2`, a
+      # semver-compatible release already in the lockfile, moved `get`/`put`
+      # onto `ObjectStoreExt`. The compile fix rides with the crate's own PR
+      # (claude/hydrate-from-zip); the GATE belongs here with the other nine.
+      - name: Run hydrate tests (previously ungated)          # 33 green
+        run: cargo test --manifest-path crates/lance-graph-hydrate/Cargo.toml
+      # These two were missed by the FIRST sweep on this branch, and the miss was
+      # in the measuring, not the workflow: the check extracted members with
+      # `"crates/[a-z0-9-]+"` — no underscore — so `surreal_container` was never
+      # in the list, and `tools/dto-class-check` is not under `crates/` at all.
+      # The claim "every member is gated" was therefore false when it was made.
+      # A membership check that cannot see two of its inputs is the same shape
+      # as a gate that cannot fire.
+      - name: Run surreal_container tests (missed by the first sweep)   # 5 + 5 green
+        run: cargo test --manifest-path crates/surreal_container/Cargo.toml
+      - name: Run dto-class-check tests (missed by the first sweep)     # 1 green
+        run: cargo test --manifest-path tools/dto-class-check/Cargo.toml
+
   test-with-coverage:
     runs-on: ubuntu-24.04
     timeout-minutes: 30
@@ -258,10 +409,15 @@ jobs:
         with:
           repository: AdaWorldAPI/OGAR
           path: OGAR
-      - name: Setup rust toolchain
-        run: |
-          rustup toolchain install stable
-          rustup default stable
+      # Toolchain comes from `rust-toolchain.toml` (channel + components), NOT
+      # from a version restated here. `rustup show` installs and activates
+      # whatever that file pins — so a bump is ONE edit in ONE file, which is
+      # exactly what that file's own comment asks for ("a bump edits `channel`
+      # and leaves the prose behind"). Previously this installed `stable` and
+      # set it as default; inside the repo the toolchain file won anyway, so
+      # these jobs already ran on the pin while the workflow said otherwise.
+      - name: Setup rust toolchain (pinned by rust-toolchain.toml)
+        run: rustup show
       - name: Setup mold linker
         # Parity with the `test` job above (TD-CI-COVERAGE-MOLD-1): the heavy
         # lance+datafusion test binaries OOM the default GNU `ld` at link

.github/workflows/style.yml

@@ -54,10 +54,20 @@ jobs:
         with:
           repository: AdaWorldAPI/OGAR
           path: OGAR
-      - name: Setup rust toolchain
+      # Toolchain comes from `rust-toolchain.toml` (channel + components), NOT
+      # from a version restated here. `rustup show` installs and activates
+      # whatever that file pins — so a bump is ONE edit in ONE file, which is
+      # exactly what that file's own comment asks for ("a bump edits `channel`
+      # and leaves the prose behind"). Previously this installed `stable` and
+      # set it as default; inside the repo the toolchain file won anyway, so
+      # these jobs already ran on the pin while the workflow said otherwise.
+      - name: Setup rust toolchain (pinned by rust-toolchain.toml)
         run: |
-          rustup toolchain install stable
-          rustup default stable
+          rustup show
+          # Redundant with `rust-toolchain.toml`'s `components = ["rustfmt",
+          # "clippy"]`, which `rustup show` already installs — kept because it
+          # is idempotent and because removing it would be a second change in a
+          # step that just broke.
           rustup component add clippy
       - uses: Swatinem/rust-cache@v2
         with:
@@ -154,6 +164,46 @@ jobs:
       # rust-test.yml step for why.
       - name: Rustfmt causal-edge (workspace-excluded, previously ungated)
         run: cargo fmt --manifest-path crates/causal-edge/Cargo.toml -- --check
+      # The same ten crates the test steps above arm. All ten verified
+      # rustfmt-clean locally on the pinned toolchain before this was added —
+      # `sigma-tier-router` was NOT, and is formatted in this commit (14 hunks
+      # in one file, rustfmt output only, its 20 tests unchanged). Nine were
+      # already clean and simply had no gate holding them there.
+      #
+      # Formatting only. Clippy is deliberately NOT gated for these: it has not
+      # been measured crate-by-crate, and `causal-edge` alone already carries 7
+      # pre-existing findings — arming a lint gate on unmeasured crates would
+      # fail PRs for defects they did not introduce.
+      - name: Rustfmt lance-graph-catalog (previously ungated)
+        run: cargo fmt --manifest-path crates/lance-graph-catalog/Cargo.toml -- --check
+      - name: Rustfmt lance-graph-planner (previously ungated)
+        run: cargo fmt --manifest-path crates/lance-graph-planner/Cargo.toml -- --check
+      - name: Rustfmt lance-graph-ontology (previously ungated)
+        run: cargo fmt --manifest-path crates/lance-graph-ontology/Cargo.toml -- --check
+      - name: Rustfmt lance-graph-rbac (previously ungated)
+        run: cargo fmt --manifest-path crates/lance-graph-rbac/Cargo.toml -- --check
+      - name: Rustfmt lance-graph-archetype (previously ungated)
+        run: cargo fmt --manifest-path crates/lance-graph-archetype/Cargo.toml -- --check
+      - name: Rustfmt lance-graph-consumer-conformance (previously ungated)
+        run: cargo fmt --manifest-path crates/lance-graph-consumer-conformance/Cargo.toml -- --check
+      - name: Rustfmt sigma-tier-router (previously ungated)
+        run: cargo fmt --manifest-path crates/sigma-tier-router/Cargo.toml -- --check
+      - name: Rustfmt neural-debug (previously ungated)
+        run: cargo fmt --manifest-path crates/neural-debug/Cargo.toml -- --check
+      - name: Rustfmt cognitive-shader-driver (previously ungated)
+        run: cargo fmt --manifest-path crates/cognitive-shader-driver/Cargo.toml -- --check
+      - name: Rustfmt lance-graph-benches (previously ungated)
+        run: cargo fmt --manifest-path crates/lance-graph-benches/Cargo.toml -- --check
+      - name: Rustfmt lance-graph-hydrate (previously ungated)
+        run: cargo fmt --manifest-path crates/lance-graph-hydrate/Cargo.toml -- --check
+      # See the rust-test.yml note: these two were missed by the first sweep
+      # because the member check's own regex could not see them.
+      # `surreal_container` was rustfmt-dirty (6 hunks in one test file,
+      # formatted in this commit, its 5 + 5 tests unchanged).
+      - name: Rustfmt surreal_container (missed by the first sweep)
+        run: cargo fmt --manifest-path crates/surreal_container/Cargo.toml -- --check
+      - name: Rustfmt dto-class-check (missed by the first sweep)
+        run: cargo fmt --manifest-path tools/dto-class-check/Cargo.toml -- --check
       # deepnsm is a standalone, workspace-excluded codec crate, so
       # `cargo fmt --all` never reaches it. It was brought to a rustfmt-clean
       # baseline in this PR; check it explicitly so it can't silently drift.

.github/workflows/weather-poc.yml

@@ -33,8 +33,8 @@ jobs:
           persist-credentials: false
       - name: Setup Rust
         run: |
-          rustup toolchain install stable
-          rustup default stable
+          # Pinned by rust-toolchain.toml — never a version restated here.
+          rustup show
       - name: Test zero-dependency codec path
         run: cargo test --manifest-path crates/weather-poc/Cargo.toml
       - name: Test live canonical NodeRow agreement path