ci: fail-slow one-sweep CI (PR-0)

[jason931225]

What

PR-0 (D4 from the CI-overhaul lane packet): every CI run surfaces ALL issues in one sweep, so a lane fixes everything in ONE commit + ONE push instead of micro-commits polling CI.

• Step-level fail-slow in preflight and backend: independent steps run !cancelled(); dependent steps guard on steps.<id>.outcome == 'success' (checkout/setup-node/npm-ci/dotslash/rust-toolchain in preflight, topology in backend). One root failure skips its dependents instead of cascading 20 reds.
• collect-failures closes each job: prints the failing step ids (toJSON(steps) via scripts/ci-collect-failures.mjs) and exits 1, preserving the job-level red that feeds Required / CI.
• Keep-going harnesses: cargo_needs_postgres.sh (default --keep-going, --fail-fast opt-out, per-binary PASS/FAIL summary) and the domain-unit inline block (verbatim cargo invocations, summary exit 1).
• Contract re-locked: scripts/check-ci-preflight.mjs (+test) re-locks the new ids/conditions/digests; scripts/lib/ci-workflow-executables.mjs keeps check-executed-tests attributing every binary under the keep-going ci-keep-going: contract.

No production code, no migration, no lockfile, no OpenAPI, no Buck target. Job display names and required-ci needs: are unchanged.

Rebased onto #773 (kept its unconditional index-0 backend Checkout + added id: checkout).

Verification (local)

• node --test scripts/check-ci-preflight.test.mjs — 57 passed
• node --test scripts/verify.test.mjs — 13 passed
• node --test tools/ci/cargo-test-runner.test.mjs — 3 passed
• npm run check:ci-preflight — exit 0 (incl. check-mjs-dark-suites --strict dark_count 0)
• node scripts/check-executed-tests.mjs — 364 defined / 364 reachable / 1 baseline-pinned dark
• npm run check:doc-manifest — OK (453 files); reasoning-lens structural — OK
• actionlint .github/workflows/ci.yml — clean; git diff --check — clean

Signed C+T: cf47da8c4 (code) → 8dfe645f3 (ledger), both ED25519 SHA256:5grGNUtX9Zgmy1SWne6wF9DR8W1ElUQaF/Z8SYRz8E8.

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 8dfe645f38

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[jason931225]

Codex review — resolutions (re-rolled head e0e39b111)

Thanks @chatgpt-codex-connector. Three findings are fixed in the re-rolled C+T; three are gap-noted.

Fixed:

1. P2 — gate exact-merge consumers on derivation (ci.yml L160): truth-ledger + fanout admission now also require steps.derive.outcome == 'success', so a failed C/T/M derivation skips them instead of producing secondary CONSOLE_*_SHA failures.
2. P2 — explicit ID on every collected backend step (ci.yml L1300): Path-class skip proof now carries id: skip-proof, so collect-failures can see it.
3. P1 — record reviewed head + identities now (ledger L48): the receipt now names the owner/signing principal, the Codex reviewer, and the conductor; the head SHA remains self-referential by the C+T convention (T cannot name its own SHA) and lands in the post-merge readback.

Gap-noted (anti-treadmill clause — filed as ownerLease, not a merge bar):

1. P1 — per-invocation keep-going capture lock (ci-workflow-executables.mjs L334): the domain-unit keep-going block is already locked three independent ways — check-ci-preflight pins the exact cargo/git invocation list verbatim + in order, the ci-keep-going: + summary exit 1 contract is verified, and cargo-test-runner.test.mjs proves the extracted loop captures per-binary failure and exits 1. The described "delete one check_status" requires a deliberate line deletion; locking each invocation→capture pairing is recorded as defense-in-depth, not this PR's bar.
2. P2 — backend setup guards on independent gates (ci.yml L939): D4 specifies "fmt / clippy / gates are independent → all run regardless"; the DB-dependent steps already guard the topology root. Adding per-gate checkout/Rust/DotSlash outcome guards is a spec extension beyond D4 — recorded as a follow-up.
3. P2 — keep-going through the shared cargo test --no-run (cargo_needs_postgres.sh L246): that is a single compilation phase, not a per-binary test invocation; D4's keep-going contract covers the per-binary test phase, and a compile error is a distinct failure class that correctly fails before any binary runs.

[chatgpt-codex-connector]

To use Codex here, create an environment for this repo.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e0e39b1117

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".