[ci] Drive matrix jobs from typed plans

ci/workflow-jobs.tsv

@@ -29,7 +29,6 @@ workflow	job	role
 .github/workflows/ci.yml	all-jobs-succeed	aggregate
 .github/workflows/ci.yml	build_docker_env	static-ci
 .github/workflows/ci.yml	build_test	planned
-.github/workflows/ci.yml	check-all-toolchains-tested	static-ci
 .github/workflows/ci.yml	check-job-dependencies	static-ci
 .github/workflows/ci.yml	check-todo	static-ci
 .github/workflows/ci.yml	check_actions	static-ci

ci/zc.toml

@@ -393,8 +393,9 @@ reason = "cargo-semver-checks does not yet support this target"
 
 [baselines]
 # These files are an independent observation of the workflow on main, not
-# generated truth from this policy. Later shadow planning must match them before
-# Actions consumes a plan. Update them only for an intentional coverage change.
+# generated truth from this policy. Planning must match them before Actions can
+# consume a plan or execute a selected cell. Update them only for an intentional
+# coverage change.
 manifest = "ci/baselines/manifest.tsv"
 build_reduced = "ci/baselines/build-pr.tsv"
 build_full = "ci/baselines/build-full.tsv"

githooks/pre-push

@@ -111,7 +111,6 @@ if [[ "$TOOLCHAINS_READY" -eq 1 ]]; then
     ./ci/check_fmt.sh                                      & FMT_PID=$!
     ./ci/check_job_dependencies.sh      >/dev/null         & JOB_DEPS_PID=$!
     ./ci/check_tools.sh                                    & TOOLS_PID=$!
-    ./zerocopy/ci/check_all_toolchains_tested.sh >/dev/null & TOOLCHAINS_PID=$!
     ./zerocopy/ci/check_readme.sh                >/dev/null & README_PID=$!
     ./zerocopy/ci/check_stale_stderr.sh          >/dev/null & STALE_STDERR_PID=$!
     ./zerocopy/ci/check_versions.sh              >/dev/null & VERSIONS_PID=$!
@@ -125,8 +124,6 @@ if [[ "$TOOLCHAINS_READY" -eq 1 ]]; then
     wait_for_check "ci/check_fmt.sh" "$FMT_PID"
     wait_for_check "ci/check_job_dependencies.sh" "$JOB_DEPS_PID"
     wait_for_check "ci/check_tools.sh" "$TOOLS_PID"
-    wait_for_check \
-        "zerocopy/ci/check_all_toolchains_tested.sh" "$TOOLCHAINS_PID"
     wait_for_check "zerocopy/ci/check_readme.sh" "$README_PID"
     wait_for_check "zerocopy/ci/check_stale_stderr.sh" "$STALE_STDERR_PID"
     wait_for_check "zerocopy/ci/check_versions.sh" "$VERSIONS_PID"
@@ -141,9 +138,9 @@ fi
 # catch obvious errors. Also note that this entire hook is a nice-to-have -
 # failures that aren't caught here will still be caught in CI.
 #
-# This was added because, in #728, we added
-# `zerocopy/ci/check_all_toolchains_tested.sh` without calling it from this
-# script.
+# This inventory was added after a check script was once introduced without a
+# corresponding hook invocation. It deliberately inventories the files which
+# exist now, so deleting a retired check also removes that hook obligation.
 shopt -s extglob
 GLOBIGNORE="./*/@(release_crate_version|check_todo|release_anneal_version).sh" # We don't want to run these
 for f in ./ci/*.sh; do

githooks/test_pre_push.py

@@ -34,7 +34,6 @@
     # Keep this fixture coordinated with the explicit fan-out in pre-push.
     # Omitting a real check here would leave its child handling untested.
     "ci/check_tools.sh",
-    "zerocopy/ci/check_all_toolchains_tested.sh",
     "zerocopy/ci/check_readme.sh",
     "zerocopy/ci/check_stale_stderr.sh",
     "zerocopy/ci/check_versions.sh",

tools/zc/src/execution.rs

@@ -17,10 +17,12 @@
 //! `.github/workflows/ci.yml`.
 //!
 //! The operation builders below are the single semantic source for both parity
-//! checking and local execution. Every place where their command spelling or
-//! setup remains duplicated in `ci.yml` is called out explicitly. The
-//! independent files under `ci/baselines/` are comparison evidence only: this
-//! module never reads a baseline row to construct proposed behavior. In
+//! checking and local execution. `ci.yml` passes complete cell selectors back
+//! to this module instead of reproducing Cargo or Miri commands. The semver
+//! action remains an explicit workflow-owned exception because GitHub requires
+//! a literal `uses` value. The independent files under `ci/baselines/` are
+//! comparison evidence only: this module never reads a baseline row to
+//! construct proposed behavior. In
 //! particular, the legacy comparison covers the repository state named by the
 //! baseline manifest. It is not an inventory of control-plane validation jobs
 //! added after that frozen source commit. Live workflow jobs and pre-push
@@ -76,13 +78,11 @@ pub const EXECUTION_CONTEXT_ENV: &str = "ZEROCOPY_INTERNAL_EXECUTION_CONTEXT";
 #[doc(hidden)]
 pub const MIRI_REPOSITORY_ROOT_CONTEXT: &str = "miri-repository-root";
 
-// These environment values are executor-owned command behavior, not policy.
-// Until `.github/workflows/ci.yml` delegates matrix commands to this executor,
-// the base values remain duplicated in its top-level `env` block and the
-// nightly additions in its "Configure environment variables" step. The frozen
-// command goldens prove that this model matches independently captured main;
-// they do not inspect that temporary live-YAML duplication. Migrated workflow
-// jobs must not reproduce these values in YAML.
+// These environment values are executor-owned behavior for planned matrix
+// cells, not policy. The workflow has similar top-level values for handwritten
+// static jobs, but planned cells set this complete map directly and do not
+// inherit changes to those jobs. The frozen command goldens prove that this
+// model matches independently captured main.
 const BASE_RUSTFLAGS: &str = "-Dwarnings";
 const BASE_RUSTDOCFLAGS: &str = "-Dwarnings --cfg=zerocopy_unstable_ptr";
 const NIGHTLY_RUSTFLAGS: &str = "-Zrandomize-layout";
@@ -1430,20 +1430,16 @@ fn docs_operation(docs_rs_rustdoc_args: &[String], cell: &BuildCellSemantics) ->
     argv.extend(cell.features.cargo_args());
 
     // Repository inventory obtains this ordered sequence from the canonical
-    // Zerocopy package's `package.metadata.docs.rs.rustdoc-args`. `ci.yml`
-    // independently performs the same Cargo metadata lookup before invoking
-    // Cargo doc; keep that workflow adapter coordinated until a typed executor
-    // owns the invocation itself. Inventory rejects whitespace inside an
-    // element, so joining with one space preserves every argument boundary
-    // understood by RUSTDOCFLAGS.
+    // Zerocopy package's `package.metadata.docs.rs.rustdoc-args`. Inventory
+    // rejects whitespace inside an element, so joining with one space
+    // preserves every argument boundary understood by RUSTDOCFLAGS.
     let docs_rs_rustdoc_args = docs_rs_rustdoc_args.join(" ");
 
     // Cargo doc inherits the same ordinary matrix environment as every other
-    // command, then its step replaces RUSTDOCFLAGS. Keep this complete map
-    // coordinated with the Cargo doc step in ci.yml and the representative
-    // nightly-docs command golden. The golden used to omit inherited
-    // RUSTFLAGS and MIRIFLAGS; retaining that omission in executable behavior
-    // would make this typed executor silently differ from CI.
+    // command, then replaces RUSTDOCFLAGS. Keep this complete map coordinated
+    // with the representative nightly-docs command golden. The golden used to
+    // omit inherited RUSTFLAGS and MIRIFLAGS; retaining that omission in
+    // executable behavior would silently differ from the captured workflow.
     let mut environment = ordinary_environment(cell.pinned_nightly);
     let rustdocflags = if cell.pinned_nightly {
         format!(
@@ -1457,8 +1453,8 @@ fn docs_operation(docs_rs_rustdoc_args: &[String], cell: &BuildCellSemantics) ->
         kind,
         // `cargo doc` intentionally has no `--target`; all target cells for
         // the same package/toolchain/profile normalize to one obligation with
-        // an occurrence count. Keep this coupled to the Cargo doc step in
-        // `ci.yml` and the comment in logical-obligations.tsv.
+        // an occurrence count. Keep this coupled to the comment in
+        // logical-obligations.tsv.
         logical: matrix_logical_spec(
             kind,
             &cell.package,
@@ -1960,6 +1956,10 @@ const LEGACY_STANDALONE_SPECS: &[StandaloneSpec] = &[
         condition: ALWAYS,
         golden: None,
     },
+    // These two operations belong to the immutable source commit named by the
+    // baseline manifest. The live shell check was retired after typed
+    // inventory and policy validation took ownership of this invariant; keep
+    // the historical operations here so parity still proves what it replaced.
     StandaloneSpec {
         obligation: "check-toolchains",
         job: "check-all-toolchains-tested",

tools/zc/src/plan.rs

@@ -19,11 +19,11 @@
 //! choices, or shell commands. Keep those security-sensitive concerns in the
 //! small hand-written workflows.
 //!
-//! The types below record the intended semantics that a later workflow
-//! projection must preserve. Before a workflow consumes a plan, that
-//! projection and its command behavior must be validated separately. Matrix
-//! membership equality alone cannot prove, for example, that native tests are
-//! executed, cross-target tests are only compiled, or Miri tests are
+//! The types below record the intended semantics preserved by the review
+//! artifact and typed executor. The workflow consumes only complete selectors;
+//! the executor resolves their command behavior again from this checked plan.
+//! Matrix membership equality alone cannot prove, for example, that native
+//! tests are executed, cross-target tests are only compiled, or Miri tests are
 //! interpreted.
 //!
 //! The selectors below coordinate three independently reviewed sources:
@@ -88,7 +88,7 @@ const LEGACY_EVENT_CLASSES: [(&str, EventClass); 4] = [
     ("workflow_dispatch", EventClass::Full),
 ];
 
-/// How a later workflow projection must handle an ordinary compilation target.
+/// How the typed executor must handle an ordinary compilation target.
 #[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd)]
 pub enum ExecutionMode {
     /// Build and execute tests on the runner.
@@ -133,11 +133,8 @@ pub enum FeatureSelection {
 impl FeatureSelection {
     /// Returns the exact ordered Cargo arguments for this selection.
     ///
-    /// The vector preserves argument boundaries; callers must pass its entries
-    /// as arguments rather than joining them into shell text. Until the typed
-    /// executor replaces the live adapter, keep this exhaustive translation
-    /// coordinated with the `FEATURE_PROFILE` case statement in
-    /// `.github/workflows/ci.yml`.
+    /// The vector preserves argument boundaries; the executor passes its
+    /// entries directly to a process rather than joining them into shell text.
     pub fn cargo_args(&self) -> Vec<String> {
         match self {
             Self::Default => Vec::new(),