Consolidate required CI gate (#115)

ci/ci-coverage.json

@@ -0,0 +1,117 @@
+{
+  "schema": 1,
+  "required_workflow": ".gitea/workflows/ci.yml",
+  "release_workflow": ".gitea/workflows/release.yml",
+  "hard_timeout_minutes": 15,
+  "internal_target_seconds": 720,
+  "required_checks": [
+    "format",
+    "deterministic-generation",
+    "api-semver",
+    "workspace-tests",
+    "compatibility-parity",
+    "minimal-features",
+    "jpeg2000",
+    "skia-binary",
+    "program-offline-smoke",
+    "clippy",
+    "documentation",
+    "dependency-policy",
+    "provenance-policy",
+    "performance-evidence",
+    "concurrency-regressions"
+  ],
+  "legacy_workflows": [
+    {
+      "workflow": "api-surface.yml",
+      "responsibility": "Generated API mappings, SemVer baseline and audit, downstream consumer compilation, and focused lint",
+      "destination": "required",
+      "checks": ["deterministic-generation", "api-semver", "clippy"],
+      "rationale": "Public API drift must block every code-ready change."
+    },
+    {
+      "workflow": "artifact-audit.yml",
+      "responsibility": "Source packages, release binaries, native linkage, and artifact/provenance inspection",
+      "destination": "release",
+      "checks": ["release-packaging", "native-artifact-audit"],
+      "rationale": "Full packaging is expensive; routine provenance policy and package metadata validation remain required."
+    },
+    {
+      "workflow": "codegen.yml",
+      "responsibility": "Deterministic generation, generated wire/catalog tests, API fixture, and clean generator artifact",
+      "destination": "required",
+      "checks": ["format", "deterministic-generation", "workspace-tests", "compatibility-parity"],
+      "rationale": "Generated-source and translated compatibility drift must fail before compilation proceeds."
+    },
+    {
+      "workflow": "concurrency-audit.yml",
+      "responsibility": "Focused race regressions and bounded resource soak",
+      "destination": "split",
+      "checks": ["concurrency-regressions", "long-resource-soak"],
+      "rationale": "Focused regressions remain required; the 16-cycle resource soak runs in the non-routine release gate."
+    },
+    {
+      "workflow": "documentation.yml",
+      "responsibility": "Documentation audit, warning-free docs, doctests, examples, and documented program tests",
+      "destination": "required",
+      "checks": ["documentation", "program-offline-smoke"],
+      "rationale": "Documentation and documented offline behavior are part of the public release surface."
+    },
+    {
+      "workflow": "imaging-meshing.yml",
+      "responsibility": "Imaging and meshing tests, parity cases, benchmark compilation, lint, and docs",
+      "destination": "split",
+      "checks": ["workspace-tests", "compatibility-parity", "clippy", "documentation", "benchmark-compilation"],
+      "rationale": "Tests, parity, lint, and docs remain required; redundant benchmark compilation moves to the release gate."
+    },
+    {
+      "workflow": "jpeg2000.yml",
+      "responsibility": "Optional OpenJPEG/JPEG 2000 feature build and tests",
+      "destination": "required",
+      "checks": ["jpeg2000"],
+      "rationale": "The optional native codec is tested independently with an exact cached OpenJPEG 2.5.4 identity."
+    },
+    {
+      "workflow": "performance.yml",
+      "responsibility": "Pinned C# comparison harness and committed performance evidence audit",
+      "destination": "split",
+      "checks": ["performance-evidence", "performance-regeneration"],
+      "rationale": "Committed evidence validation remains required; C# checkout and evidence regeneration are manual release work."
+    },
+    {
+      "workflow": "release-candidate.yml",
+      "responsibility": "Aggregate release-readiness gate and evidence",
+      "destination": "release",
+      "checks": ["release-candidate-audit"],
+      "rationale": "The aggregate release decision is non-routine and no longer recompiles the required gate."
+    },
+    {
+      "workflow": "release-matrix.yml",
+      "responsibility": "MSRV, default, minimal, features, release profiles, and portable cross-target checks",
+      "destination": "split",
+      "checks": ["minimal-features", "jpeg2000", "skia-binary", "msrv", "portable-cross-targets", "release-profile"],
+      "rationale": "Fast feature isolation remains required; clean MSRV, cross-target, and release-profile builds run non-routinely."
+    },
+    {
+      "workflow": "rust-workspace.yml",
+      "responsibility": "Milestone checks, workspace compilation, program smoke, audio feature, extension lint, and docs",
+      "destination": "required",
+      "checks": ["workspace-tests", "compatibility-parity", "program-offline-smoke", "clippy", "documentation"],
+      "rationale": "One all-feature test graph replaces overlapping compile and test invocations."
+    },
+    {
+      "workflow": "skia.yml",
+      "responsibility": "Default and Skia feature tests plus package listing",
+      "destination": "required",
+      "checks": ["skia-binary", "workspace-tests"],
+      "rationale": "The required gate proves the exact ARM64 GNU archive is installed and forbids source compilation."
+    },
+    {
+      "workflow": "supply-chain.yml",
+      "responsibility": "Dependency graph, advisory, license, source, provenance, duplicate, and unused-dependency audits",
+      "destination": "required",
+      "checks": ["dependency-policy", "provenance-policy"],
+      "rationale": "Pinned prebuilt audit tools and cached advisory data keep policy enforcement in the routine gate."
+    }
+  ]
+}

ci/evidence/documentation-audit.json

@@ -8,7 +8,7 @@
   "documented_members": 30789,
   "tested_rust_snippets": 5,
   "linked_programs": 9,
-  "checked_local_links": 86,
+  "checked_local_links": 84,
   "required_guide_sections": 11,
   "status": "ok"
 }

ci/evidence/provenance-audit.json

@@ -1,18 +1,18 @@
 {
   "schema": 1,
-  "recorded_unix_seconds": 1786546522,
+  "recorded_unix_seconds": 1786572918,
   "upstream_commit": "2aa70bb68513b39795da5d13c88f31b86e85a3ba",
   "material_count": 27,
   "generated_output_count": 8,
   "provenance_ledger_count": 3,
-  "source_file_count": 538,
+  "source_file_count": 531,
   "dependency_count": 389,
-  "dependency_notice_count": 284,
+  "dependency_notice_count": 283,
   "native_component_count": 6,
-  "dependency_manifest_sha256": "6482698a22201b04f3234363790edc0be0dba39f445ac939e3fc8d4edeb372e9",
-  "third_party_notices_sha256": "de5088841682813cc952af4d1dcc57d2521694e192888042d5585e344e570d16",
+  "dependency_manifest_sha256": "a4095621c7975f6b01c5b1653b375c571be15657f7fa824d6b5a2e46f3434dcc",
+  "third_party_notices_sha256": "da051a965d39715d10da5c17fdfdafd8059b83d2491837d223607e9c5e16a5fa",
   "native_notices_sha256": "b417ee7bf6b748cc86839e5354753c0f8c1f8309d13c0fea379c77f602e69fc0",
-  "distribution_manifest_sha256": "18afd63d96e675c826cf138293df0ae73be279f45c9efa258bbbb30a1c7577e7",
+  "distribution_manifest_sha256": "937d842df90f9dbda2895ec166b82aececbc0007f95a7052c6dc3867c7aeff57",
   "unknown_materials": 0,
   "unknown_bundled_assets": 0,
   "status": "ok"