mason: wire raw replay review into CI

Co-authored-by: Alfonso <alfonso-magic-context@users.noreply.github.com>

Author: ualtinok

.github/workflows/ci.yml

@@ -1025,8 +1025,9 @@ jobs:
           set -euo pipefail
           target="$GITHUB_WORKSPACE/packages/e2e-tests/.cache/rust-e2e-cargo-target"
           mkdir -p "$target/prebuilt"
-          CARGO_TARGET_DIR="$target" cargo build --release -p mc-module
+          CARGO_TARGET_DIR="$target" cargo build --release -p mc-module --bin ck-mc --example transform_replay
           cp "$target/release/ck-mc" "$target/prebuilt/ckdev-mc-e2e"
+          cp "$target/release/examples/transform_replay" "$target/prebuilt/rust-raw-replay-probe"
           CARGO_TARGET_DIR="$target" cargo build --release -p mc-module --features drive-fault
           cp "$target/release/ck-mc" "$target/prebuilt/ckdev-mc-e2e-drive-fault"
           (cd "$GITHUB_WORKSPACE/.siblings/subconscious" && CARGO_TARGET_DIR="$target" cargo build --release -p subc-core --bins)
@@ -1098,11 +1099,79 @@ jobs:
           MC_E2E_CK_SUBC_BIN: ${{ github.workspace }}/packages/e2e-tests/.cache/prebuilt/ckdev-subc
         run: scripts/run-rust-hermetic-e2e.sh
 
+  rust-raw-replay-review:
+    name: Rust (raw replay review)
+    runs-on: ubuntu-latest
+    needs: [e2e-rust-hermetic-build]
+    timeout-minutes: 120
+    permissions:
+      contents: read
+      actions: read
+    steps:
+      - uses: actions/checkout@v5
+      - uses: dtolnay/rust-toolchain@stable
+      - uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: latest
+      - name: Install workspace dependencies
+        run: bun install --frozen-lockfile
+      - uses: ./.github/actions/wait-ci-artifact
+        id: binaries
+        with:
+          artifact: rust-hermetic-binaries-${{ github.sha }}
+          producer: E2E (Rust hermetic build)
+          timeout-minutes: "120"
+      - uses: actions/download-artifact@v4
+        with:
+          artifact-ids: ${{ steps.binaries.outputs.artifact-id }}
+          merge-multiple: true
+          path: ${{ runner.temp }}/raw-replay-download
+      - name: Restore staged native driver
+        shell: bash
+        run: |
+          set -euo pipefail
+          (cd "$RUNNER_TEMP/raw-replay-download" && sha256sum --check rust-hermetic-binaries.sha256)
+          mkdir -p "$RUNNER_TEMP/raw-replay-artifact"
+          tar -xzf "$RUNNER_TEMP/raw-replay-download/rust-hermetic-binaries.tar.gz" -C "$RUNNER_TEMP/raw-replay-artifact"
+          test "$(cat "$RUNNER_TEMP/raw-replay-artifact/commit.txt")" = "$GITHUB_SHA"
+          test -x "$RUNNER_TEMP/raw-replay-artifact/rust-raw-replay-probe"
+      - name: Fetch pinned master baseline
+        shell: bash
+        run: |
+          set -euo pipefail
+          baseline_commit="$(tr -d '\r\n' < scripts/rust-raw-replay-baseline.commit)"
+          if [[ ! "$baseline_commit" =~ ^[0-9a-f]{40}$ ]]; then
+            echo "Invalid pinned Rust raw replay baseline commit: $baseline_commit" >&2
+            exit 1
+          fi
+          git fetch --no-tags --depth=1 origin "$baseline_commit"
+          git cat-file -e "${baseline_commit}^{commit}"
+          baseline_archive="$RUNNER_TEMP/rust-raw-replay-baseline.tar"
+          git archive --format=tar "$baseline_commit" \
+            crates/mc-module/src packages/plugin/src packages/plugin/package.json \
+            packages/retina-local-fs/src packages/retina-local-fs/package.json package.json \
+            > "$baseline_archive"
+          test -s "$baseline_archive"
+          echo "Pinned Rust raw replay baseline: $baseline_commit"
+      - name: Run staged raw replay witnesses
+        env:
+          MC_RAW_REPLAY_REQUIRED: "1"
+          MC_RAW_REPLAY_BASELINE_RELEASE: "1"
+          MC_REVIEW_ASSERT_LIVENESS: "1"
+          MC_RAW_REPLAY_PROBE: ${{ runner.temp }}/raw-replay-artifact/rust-raw-replay-probe
+          MC_RAW_REPLAY_BASELINE_ARCHIVE: ${{ runner.temp }}/rust-raw-replay-baseline.tar
+        run: |
+          bash scripts/test-rust-raw-replay.sh \
+            packages/plugin/review-tests/rust-cache-review.test.ts \
+            packages/plugin/review-tests/rust-cache-r2.test.ts \
+            packages/plugin/review-tests/rust-cache-restart.test.ts \
+            -t 'round-two|provider-invisible|JSON number|sorted digest|SIGKILL|release recovery census|raw ctx_reduce|durable replay cost|unchanged ID-less native|no-freeze SQL|seed (a19f37|badc0de|c001d00d|92e41b|67d5a3)'
+
   ci-summary:
     name: CI (required)
     runs-on: ubuntu-latest
     if: ${{ always() }}
-    needs: [preflight, check-docs-layout, check-plugin, check-pi-plugin, check-plugin-compat, unit-plugin, unit-pi-plugin, check-dashboard, e2e-opencode, e2e-opencode2, e2e-pi, e2e-omp, e2e-host-opencode, e2e-host-opencode2, e2e-host-pi, e2e-host-omp, rust-clippy, rust-lib-archive, rust-mc-module-lib, rust-mc-module-parity, rust-mc-module-integration, rust-workspace-crates, rust-crates, e2e-rust-hermetic-build, e2e-rust-hermetic]
+    needs: [preflight, check-docs-layout, check-plugin, check-pi-plugin, check-plugin-compat, unit-plugin, unit-pi-plugin, check-dashboard, e2e-opencode, e2e-opencode2, e2e-pi, e2e-omp, e2e-host-opencode, e2e-host-opencode2, e2e-host-pi, e2e-host-omp, rust-clippy, rust-lib-archive, rust-mc-module-lib, rust-mc-module-parity, rust-mc-module-integration, rust-workspace-crates, rust-crates, e2e-rust-hermetic-build, e2e-rust-hermetic, rust-raw-replay-review]
     steps:
       - uses: actions/checkout@v5
       - uses: oven-sh/setup-bun@v2

packages/e2e-tests/scripts/ci-workflow.test.ts

@@ -104,3 +104,33 @@ test("remaining Rust crates retain Bun migration oracles and hermetic archives r
     expect(unpack).toContain("ckdev-mc-e2e ckdev-mc-e2e-drive-fault ckdev-subc");
     expect(unpack).toContain('test -x "packages/e2e-tests/.cache/prebuilt/$binary"');
 });
+
+test("raw replay review reuses the hermetic driver and requires the pinned live witnesses", async () => {
+    const producer = workflow.jobs["e2e-rust-hermetic-build"]!;
+    const build = producer.steps.find((step) => step.name === "Build hermetic binary pair (including fault-injection variant)")!;
+    expect(build.run).toContain("--example transform_replay");
+    expect(build.run).toContain("rust-raw-replay-probe");
+
+    const review = workflow.jobs["rust-raw-replay-review"]!;
+    expect(review.name).toBe("Rust (raw replay review)");
+    expect(review.needs).toEqual(["e2e-rust-hermetic-build"]);
+    expect(review["timeout-minutes"]).toBe(120);
+    const wait = review.steps.find((step) => step.uses === "./.github/actions/wait-ci-artifact")!;
+    expect(wait.with!.artifact).toBe("rust-hermetic-binaries-${{ github.sha }}");
+
+    const fetch = review.steps.find((step) => step.name === "Fetch pinned master baseline")!;
+    expect(fetch.run).toContain("scripts/rust-raw-replay-baseline.commit");
+    expect(fetch.run).toContain("git fetch --no-tags --depth=1 origin");
+    const pin = await Bun.file(resolve(root, "scripts/rust-raw-replay-baseline.commit")).text();
+    expect(pin.trim()).toMatch(/^[0-9a-f]{40}$/);
+
+    const run = review.steps.find((step) => step.name === "Run staged raw replay witnesses")!;
+    expect(run.env!.MC_RAW_REPLAY_REQUIRED).toBe("1");
+    expect(run.env!.MC_REVIEW_ASSERT_LIVENESS).toBe("1");
+    expect(run.run).toContain("rust-cache-review.test.ts");
+    expect(run.run).toContain("rust-cache-r2.test.ts");
+    expect(run.run).toContain("rust-cache-restart.test.ts");
+    expect(run.run).toContain("release recovery census");
+    expect(run.run).toContain("no-freeze SQL");
+    expect(run.run).toContain("seed (a19f37|badc0de|c001d00d|92e41b|67d5a3)");
+});

packages/plugin/review-tests/biome.json

@@ -0,0 +1,11 @@
+{
+    "root": false,
+    "extends": ["../biome.json"],
+    "files": { "includes": ["**/*.ts", "**/*.json"] },
+    "overrides": [
+        {
+            "includes": ["**/*.ts"],
+            "linter": { "rules": { "style": { "noNonNullAssertion": "off" } } }
+        }
+    ]
+}

packages/plugin/review-tests/rust-cache-harness.ts

@@ -40,8 +40,8 @@ export function scratch(prefix: string): string {
     cleanups.push(() => rmSync(path, { recursive: true, force: true }));
     return path;
 }
-export function database(): ContextDatabase {
-    const db = new Database(":memory:") as ContextDatabase;
+export function database(path = ":memory:"): ContextDatabase {
+    const db = new Database(path) as ContextDatabase;
     initializeDatabase(db);
     runMigrations(db);
     cleanups.push(() => db.close());
@@ -125,7 +125,7 @@ export function probe(binary: string, directory: string, body: unknown): Record<
     const result = spawnSync(binary, [directory], {
         input: JSON.stringify(body),
         encoding: "utf8",
-        timeout: 30_000,
+        timeout: 120_000,
     });
     if (result.status !== 0)
         throw new Error(`Rust review probe failed: ${result.stderr} ${result.error ?? ""}`);
@@ -137,9 +137,10 @@ export async function hostFixture(
     factory = createRustModeTransform,
     baselineRoot?: string,
     midTurn = false,
+    persistent: { directory: string; dbPath: string } | undefined = undefined,
 ) {
-    const directory = scratch("independent-module-");
-    const db = database();
+    const directory = persistent?.directory ?? scratch("independent-module-");
+    const db = database(persistent?.dbPath);
     let input: MessageLike[] = [];
     const provider = {
         readMessages: () =>
@@ -188,10 +189,12 @@ export async function hostFixture(
         cleanups.push(baselineRaw.setRawMessageProvider(sid, provider));
     }
     let response: Record<string, unknown> = {};
+    let request: Record<string, unknown> = {};
     let mutate: (value: Record<string, unknown>) => void = () => {};
     const client: RustModeModuleClient = {
         call: async ({ method, body }) => {
             if (method !== "transform") return { ok: true };
+            request = body as Record<string, unknown>;
             response = probe(binary, directory, {
                 ...(body as Record<string, unknown>),
                 ...(midTurn ? { mid_turn: true } : {}),
@@ -248,6 +251,10 @@ export async function hostFixture(
         db,
         sid,
         deps,
+        directory,
+        get request() {
+            return request;
+        },
         get response() {
             return response;
         },