build(ci): pin Rust 1.99 and share Cargo acquisition policy

.bazelrc

@@ -8,21 +8,12 @@ common --show_progress_rate_limit=15
 # The shared fleet CAS uses size-based eviction, so it cannot guarantee
 # Bazel's default three-hour retention. Revalidate remote outputs before reuse.
 build --experimental_remote_cache_ttl=0s
-# crate_universe re-fetches git dependencies into an empty CARGO_HOME on every
-# splice. libgit2 indexes asupersync's ~1 GB history on one thread for over 25
-# minutes; the git CLI indexes it in about 2.
-common --repo_env=CARGO_NET_GIT_FETCH_WITH_CLI=true
-# Fetch only the pinned commit of each git dependency: 76 MB instead of 1.3 GB,
-# and a cold splice drops from about 6 minutes to 1. The splice runs rules_rust's
-# stable host cargo, which reads -Z options only under RUSTC_BOOTSTRAP. A nightly
-# host cargo would download another 418 MB toolchain on every CI job.
-common --repo_env=CARGO_UNSTABLE_GIT=shallow-deps
+# Cargo reads the unstable acquisition policy during repository evaluation.
 common --repo_env=RUSTC_BOOTSTRAP=1
-# MODULE.bazel registers only nightly/2026-10-25. Without this, rules_rust
-# resolves the stable channel and the build fails closed.
+# MODULE.bazel registers the pinned stable compiler.
 # Hosts can extend this repository profile with their private fleet settings.
 build --config=tracedecay
-build:tracedecay --@rules_rust//rust/toolchain/channel=nightly
+build:tracedecay --@rules_rust//rust/toolchain/channel=stable
 build --incompatible_enable_cc_toolchain_resolution
 build --action_env=BAZEL_DO_NOT_DETECT_CPP_TOOLCHAIN=1
 build --workspace_status_command=scripts/bazel/workspace_status.sh
@@ -72,11 +63,17 @@ build:clippy --@rules_rust//rust/settings:pipelined_compilation=true
 build:clippy --@rules_rust//rust/settings:clippy_flag=-Dwarnings
 build:clippy --@rules_rust//rust/settings:clippy.toml=//:clippy.toml
 
+# Default tests and their build-time tools use the assertion-enabled perf levels.
+build --compilation_mode=fastbuild
+build --host_compilation_mode=fastbuild
+
 # Externals return to opt-level 3 over the perf overrides below.
 build:release --compilation_mode=opt
+build:release --host_compilation_mode=opt
 build:release --@rules_rust//rust/settings:per_crate_rustc_flag=external/@-Copt-level=3
 
 build:dist --compilation_mode=opt
+build:dist --host_compilation_mode=opt
 build:dist --@rules_rust//rust/settings:per_crate_rustc_flag=external/@-Copt-level=3
 build:dist --@rules_rust//rust/settings:lto=thin
 build:dist --@rules_rust//rust/settings:extra_rustc_flag=-Ccodegen-units=1

.cargo/acquisition.toml

@@ -0,0 +1,5 @@
+[net]
+git-fetch-with-cli = true
+
+[unstable]
+git = "shallow-deps"

.cargo/config.toml

@@ -101,20 +101,9 @@ linker = "scripts/macos-sign-linker.sh"
 [alias]
 # Full Rust test suite. Requires cargo-nextest:
 # https://nexte.st/docs/installation/pre-built-binaries/
-# Both aliases build with the perf cargo profile, which keeps the
-# critical-path kernels (code index, graph, sha2, …) optimized for the
-# generation-scale suites; see [profile.perf] in the root Cargo.toml.
-#
-# `test-ci` is the hosted acceptance selection: nextest's `ci` policy
-# (.config/nextest.toml: fail-fast off, one retry that still fails flaky
-# results, 8 threads, slow-timeout termination), the root fixture feature and
-# `search-eval`, which is what compiles the evaluator acceptance suites (the
-# root crate's dependency on the evaluator is optional so the Linux transport
-# partition does not link it; a `--workspace` run resolves the evaluator
-# anyway). `.github/workflows/ci.yml` runs this
-# exact alias, and its support binaries/archives are built with `--profile
-# perf` so they share artifacts with it. Extra flags append: `cargo test-ci
-# --locked -E 'binary(=x)'`.
+# Full-suite aliases share the assertion-enabled perf profile. Hosted CI
+# runs Bazel targets generated from the same per-crate optimization levels.
+# Extra filters append, for example: cargo test-ci --locked -E 'binary(=x)'.
 test-ci = "nextest run --workspace --profile ci --features tracedecay/test-helpers,tracedecay/search-eval --cargo-profile perf"
 # Deliberately broader than CI: every optional feature (test-transport
 # acceptance suites, …) under the same cargo profile, with the

.github/actions/build-cli/action.yml

@@ -9,14 +9,18 @@ inputs:
       Bazel config. `dist` is the shipping-tuned compile (thin LTO, strip,
       codegen-units=1). `release` is opt-level 3 without LTO, the CI / cargo
       `--release` equivalent; tracedecay-cli's default features are
-      `production`, the release source profile. `ci` is a dev-profile build.
+      `production`, the release source profile. `ci` uses the assertion-enabled
+      per-crate optimization levels from Cargo's `perf` profile.
     required: true
   dest:
     description: Directory the binary is copied into, as tracedecay[.exe].
     required: true
   cache-key:
     description: Disk-cache name (see the setup-bazel action).
     required: true
+  prepared-build:
+    description: Whether the caller already configured Bazel for this build.
+    default: "false"
   tailscale-client-id:
     description: Restricted OIDC client for compatible trusted CI builds.
     default: ""
@@ -31,6 +35,7 @@ runs:
   steps:
     - uses: ./.github/actions/setup-bazel
       id: bazel
+      if: inputs.prepared-build != 'true'
       with:
         cache-key: ${{ inputs.cache-key }}
         tailscale-client-id: ${{ inputs.tailscale-client-id }}

.github/actions/setup-bazel/action.yml

@@ -27,8 +27,8 @@ inputs:
 
 outputs:
   fleet-enabled:
-    description: Whether this job uses private workers and dynamic execution.
-    value: ${{ inputs.tailscale-client-id != '' }}
+    description: Whether Tailscale enrollment and executor connectivity enabled the fleet.
+    value: ${{ steps.fleet.outputs.enabled }}
   disk-cache-path:
     description: Action-cache directory to save after the caller's build.
     value: ${{ steps.disk-cache-config.outputs.path }}
@@ -88,17 +88,6 @@ runs:
         # D:/_bazel) keeps MSVC's header paths under MAX_PATH.
         output-base: ${{ runner.os == 'Windows' && 'D:/b' || '' }}
 
-    # Bazel validates action contents itself. A fresh save key retains new
-    # source-build outputs even when MODULE.bazel and BUILD files are unchanged.
-    - name: Restore master action cache
-      id: disk-cache
-      if: inputs.tailscale-client-id == ''
-      uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-      with:
-        path: ${{ steps.disk-cache-config.outputs.path }}
-        key: ${{ steps.disk-cache-config.outputs.prefix }}run-${{ github.run_id }}-${{ github.run_attempt }}-${{ github.job }}
-        restore-keys: ${{ steps.disk-cache-config.outputs.restore-keys }}
-
     - name: Preserve the runner network environment for Tailscale
       if: runner.os == 'Linux' && inputs.tailscale-client-id != ''
       shell: bash
@@ -118,57 +107,39 @@ runs:
         sudo visudo -cf /etc/sudoers.d/tailscale-ci-network
 
     - name: Connect to the private Bazel fleet
+      id: tailscale
       if: inputs.tailscale-client-id != ''
+      # Private infrastructure is optional; compilation and test failures are not.
+      continue-on-error: true
       uses: tailscale/github-action@99a8333667fff04fdd6cffb46dfd409f8329a7bf # v4
       with:
         oauth-client-id: ${{ inputs.tailscale-client-id }}
         audience: api.tailscale.com/${{ inputs.tailscale-client-id }}
         tags: tag:bazel-ci
         ping: ubuntu-main
 
-    - name: Share compilation and tests with private workers
-      if: inputs.tailscale-client-id != ''
+    - name: Select private executor or hosted execution
+      id: fleet
       shell: bash
+      env:
+        TAILSCALE_OUTCOME: ${{ steps.tailscale.outcome }}
       run: |
-        case "$RUNNER_OS/$RUNNER_ARCH" in
-          Linux/X64)
-            profile=rbe-linux
-            mkdir -p /tmp/zig-cache
-            ;;
-          macOS/ARM64) profile=rbe-macos ;;
-          *)
-            echo "No compatible fleet worker for $RUNNER_OS/$RUNNER_ARCH" >&2
-            exit 1
-            ;;
-        esac
-        # Use the checkout's existing local rc import for fleet settings.
-        # Tests carry their tools in runfiles, so both branches use identical inputs.
-        printf 'build --config=%s\n' "$profile" > .bazelrc.local
-        cat >> .bazelrc.local <<'RC'
-        build --remote_executor=grpc://ubuntu-main:50051
-        build --remote_cache=grpc://ubuntu-main:50051
-        build --remote_instance_name=main
-        build --remote_timeout=600
-        # Survive brief coordinator restarts; five retries expire in about 3s.
-        build --remote_retries=10
-        # Fleet compilation must not fall back onto the smaller hosted VM.
-        # Dynamic tests still have their explicitly scheduled local branch.
-        build --noremote_local_fallback
-        build --remote_download_outputs=toplevel
-        build --jobs=40
-        build --local_resources=cpu=HOST_CPUS
-        build --local_resources=memory=HOST_RAM*.5
-        build --internal_spawn_scheduler
-        build --dynamic_local_strategy=sandboxed
-        build --dynamic_remote_strategy=remote
-        # Large Rust links raced on the hosted VM while the same actions ran
-        # remotely. local_resources only schedules estimates; it does not cap
-        # rustc memory. Keep compilation on the fleet and tests hybrid.
-        build --strategy=Rustc=remote
-        build --strategy=TestRunner=dynamic
-        build --bes_backend=grpc://ubuntu-main:1985
-        build --bes_results_url=https://ubuntu-main.tail039078.ts.net/invocation/
-        build --bes_timeout=30s
-        build --bes_upload_mode=fully_async
-        RC
+        python3 "$GITHUB_ACTION_PATH/configure_fleet.py"
 
+    - name: Prepare the Linux fleet toolchain cache
+      if: steps.fleet.outputs.enabled == 'true' && runner.os == 'Linux'
+      shell: bash
+      run: mkdir -p /tmp/zig-cache
+
+    # Bazel validates action contents itself. A fresh save key retains new
+    # source-build outputs even when MODULE.bazel and BUILD files are unchanged.
+    # Restore after enrollment so an offline private executor gets the same
+    # hosted cache as a job without a fleet identity.
+    - name: Restore master action cache
+      id: disk-cache
+      if: steps.fleet.outputs.enabled != 'true'
+      uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+      with:
+        path: ${{ steps.disk-cache-config.outputs.path }}
+        key: ${{ steps.disk-cache-config.outputs.prefix }}run-${{ github.run_id }}-${{ github.run_attempt }}-${{ github.job }}
+        restore-keys: ${{ steps.disk-cache-config.outputs.restore-keys }}

.github/actions/setup-bazel/configure_fleet.py

@@ -0,0 +1,90 @@
+#!/usr/bin/env python3
+"""Select the private executor for the invoking CI checkout when reachable."""
+
+from __future__ import annotations
+
+import os
+import socket
+from pathlib import Path
+
+
+def configure_fleet(
+    workspace: Path,
+    output: Path,
+    connection_outcome: str,
+    runner_os: str,
+    runner_arch: str,
+    host: str = "ubuntu-main",
+    port: int = 50051,
+) -> bool:
+    profile = {("Linux", "X64"): "rbe-linux", ("macOS", "ARM64"): "rbe-macos"}.get(
+        (runner_os, runner_arch)
+    )
+    enabled = False
+    if connection_outcome == "success" and profile:
+        try:
+            # This checks the coordinator, not the number or capacity of workers.
+            with socket.create_connection((host, port), timeout=5):
+                pass
+            enabled = True
+        except OSError as error:
+            print(
+                f"::warning::Private Bazel executor is unreachable: {error}; "
+                "using hosted execution."
+            )
+    elif connection_outcome == "failure":
+        print("::warning::Private Bazel enrollment failed; using hosted execution.")
+    elif connection_outcome == "success":
+        print(
+            f"::warning::No fleet profile for {runner_os}/{runner_arch}; "
+            "using hosted execution."
+        )
+
+    if enabled:
+        rc = f"""# Generated by CI setup; workstation configuration is unchanged.
+build --config={profile}
+build --remote_executor=grpc://{host}:{port}
+build --remote_cache=grpc://{host}:{port}
+build --remote_instance_name=main
+build --remote_timeout=600
+# Survive brief coordinator restarts; five retries expire in about 3s.
+build --remote_retries=10
+# Fleet compilation must not fall back onto the smaller hosted VM.
+# Dynamic tests still have their explicitly scheduled local branch.
+build --noremote_local_fallback
+build --remote_download_outputs=toplevel
+build --jobs=40
+build --local_resources=cpu=HOST_CPUS
+build --local_resources=memory=HOST_RAM*.5
+build --internal_spawn_scheduler
+build --dynamic_local_strategy=sandboxed
+build --dynamic_remote_strategy=remote
+# asupersync and other Rust crates use the fleet first. Do not race large
+# compilations on the hosted VM; local_resources does not cap rustc memory.
+build --strategy=Rustc=remote
+# Tag `local` requires the local strategy; dynamic-only cannot spawn those tests.
+build --strategy=TestRunner=dynamic,local
+build --bes_backend=grpc://ubuntu-main:1985
+build --bes_results_url=https://ubuntu-main.tail039078.ts.net/invocation/
+build --bes_timeout=30s
+build --bes_upload_mode=fully_async
+"""
+    else:
+        rc = "# Private executor unavailable or not configured; use hosted execution.\n"
+
+    # This action owns the CI checkout's local rc. Clear a previous fleet
+    # selection on retry, before advertising that hosted execution is selected.
+    (workspace / ".bazelrc.local").write_text(rc)
+    with output.open("a") as handle:
+        handle.write(f"enabled={str(enabled).lower()}\n")
+    return enabled
+
+
+if __name__ == "__main__":
+    configure_fleet(
+        Path.cwd(),
+        Path(os.environ["GITHUB_OUTPUT"]),
+        os.environ.get("TAILSCALE_OUTCOME", ""),
+        os.environ["RUNNER_OS"],
+        os.environ["RUNNER_ARCH"],
+    )