feat(semiotic): gate trust UX, fast activity reads, and symmetric persistence

.config/nextest.toml

@@ -114,11 +114,11 @@ test-group = "llm-heavy"
 slow-timeout = { period = "360s", terminate-after = 2 }
 retries = { backoff = "fixed", count = 2, delay = "5s" }
 
+
 [[profile.ci.overrides]]
-filter = 'package(baml-agent-runner) and binary(drift_integration_test)'
+filter = 'package(baml-rt-semiotic) and test(corpus_p4_gate_oracle)'
 test-group = "llm-heavy"
-slow-timeout = { period = "360s", terminate-after = 2 }
-retries = { backoff = "fixed", count = 2, delay = "5s" }
+slow-timeout = { period = "120s", terminate-after = 2 }
 
 [[profile.ci.overrides]]
 filter = 'package(baml-agent-runner) and binary(runner_starvation_test)'
@@ -217,12 +217,11 @@ test-group = "llm-heavy"
 slow-timeout = { period = "360s", terminate-after = 2 }
 retries = { backoff = "fixed", count = 2, delay = "5s" }
 
-# Security-eval + LLM drift integration is timing/network heavy; serialize this binary.
+# Semiotic corpus oracle — pure-function gate decisions.
 [[profile.ci-merged.overrides]]
-filter = 'package(baml-agent-runner) and binary(drift_integration_test)'
+filter = 'package(baml-rt-semiotic) and test(corpus_p4_gate_oracle)'
 test-group = "llm-heavy"
-slow-timeout = { period = "360s", terminate-after = 2 }
-retries = { backoff = "fixed", count = 2, delay = "5s" }
+slow-timeout = { period = "120s", terminate-after = 2 }
 
 [[profile.ci-merged.overrides]]
 filter = 'package(baml-agent-runner) and binary(runner_starvation_test)'

.github/workflows/rust-ci.yml

@@ -43,8 +43,6 @@ env:
   CI_FEATURES_UNTRUSTED: >-
     baml-rt-tools/http-tools,baml-rt-builder/http-tools,baml-rt-builder/dev-tools,baml-agent-runner/http-tools,
     baml-agent-runner/memory
-  # Prefer workspace-local ONNX model cache in CI for deterministic loading.
-  BAML_MODELS_DIR: ${{ github.workspace }}/models
   # Disable OTEL exporters in CI tests to avoid noisy collector connection errors
   # and timing variance when no collector is available.
   OTEL_SDK_DISABLED: "true"
@@ -127,25 +125,6 @@ jobs:
           # cost ~9 min compressing/uploading target/ on every PR run.
           save-if: ${{ github.ref == 'refs/heads/main' || github.event_name == 'workflow_dispatch' }}
 
-      - name: Cache ONNX model artifacts
-        id: onnx_cache
-        uses: actions/cache@v4
-        with:
-          path: |
-            models/fastembed
-            ~/.cache/fastembed
-          key: ${{ runner.os }}-fastembed-v1-${{ hashFiles('crates/baml-rt-embedding/Cargo.toml', 'crates/baml-rt-embedding/src/bin/download_models.rs') }}
-          restore-keys: |
-            ${{ runner.os }}-fastembed-v1-
-
-      - name: Ensure ONNX model artifacts are materialized (git-lfs)
-        if: steps.onnx_cache.outputs.cache-hit != 'true'
-        run: |
-          git lfs install --local
-          # Best-effort hydrate checked-in model blobs; validation/repair happens
-          # in the dedicated warm-up step via fastembed model initialization.
-          git lfs pull --include="models/fastembed/**"
-
       - name: Install Node.js and TypeScript
         run: |
           if ! command -v node &>/dev/null; then
@@ -174,13 +153,6 @@ jobs:
             exit 1
           }
 
-      - name: Warm ONNX caches and validate model load
-        if: steps.onnx_cache.outputs.cache-hit != 'true'
-        run: |
-          cargo run -p baml-rt-embedding --bin download_models
-        env:
-          RUSTUP_TOOLCHAIN: stable
-
       - name: System info
         run: |
           echo "=== lscpu ==="
@@ -332,35 +304,12 @@ jobs:
           cache-targets: "true"
           save-if: false
 
-      - name: Cache ONNX model artifacts
-        id: onnx_cache
-        uses: actions/cache@v4
-        with:
-          path: |
-            models/fastembed
-            ~/.cache/fastembed
-          key: ${{ runner.os }}-fastembed-v1-${{ hashFiles('crates/baml-rt-embedding/Cargo.toml', 'crates/baml-rt-embedding/src/bin/download_models.rs') }}
-          restore-keys: |
-            ${{ runner.os }}-fastembed-v1-
-
-      - name: Ensure ONNX model artifacts are materialized (git-lfs)
-        if: steps.onnx_cache.outputs.cache-hit != 'true'
-        run: |
-          git lfs install --local
-          git lfs pull --include="models/fastembed/**"
-
       - name: Install Node.js and TypeScript
         run: |
           curl -fsSL https://deb.nodesource.com/setup_22.x | sudo -E bash -
           sudo apt-get install -y nodejs
           sudo npm install -g typescript@6
 
-      - name: Warm ONNX caches and validate model load
-        if: steps.onnx_cache.outputs.cache-hit != 'true'
-        run: cargo run -p baml-rt-embedding --bin download_models
-        env:
-          RUSTUP_TOOLCHAIN: stable
-
       - name: Install cargo-nextest
         uses: taiki-e/install-action@v2
         with: