tests.yml

name: CI

on:
  push:
    # train/** branches are the CI-gated landing path: a train is pushed
    # there, CI runs on all platforms, and master fast-forwards only to a sha
    # that already carries a green check.
    branches: ["train/**"]
  # The push gate asks whether a change is good. This run asks whether what
  # already landed is still good against the siblings as they are now: CI
  # checks out subconscious/commons at their tips, so a sibling bump turns
  # an already-green sha red with no commit here.
  schedule:
    - cron: "0 6 * * *"
  pull_request:
  workflow_dispatch:

# Per-ref group: a repush to the same train cancels its superseded run, while
# a train push never cancels an in-flight master run (a shared group would).
concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

env:
  CARGO_TERM_COLOR: always
  # secrets are not readable inside step `if` expressions, so the presence
  # check is hoisted here where the secrets context IS allowed; steps branch
  # on the env value.
  HAS_CROSS_REPO_TOKEN: ${{ secrets.CK_CI_APP_ID != '' }}
  LLAMA_BUILD_GATE_BUDGET_SECONDS: "900"
  LLAMA_BUILD_EVIDENCE_CONTRACT: "nonmac-build-gates-v1"
  LLAMA_CUDA_TOOLKIT_PACKAGE: "cuda-toolkit-12-6"
  LLAMA_CUDA_TOOLKIT_DEB_VERSION: "12.6.1-1"
  LLAMA_CUDA_KEYRING_SHA256: "d2a6b11c096396d868758b86dab1823b25e14d70333f1dfa74da5ddaf6a06dba"
  LLAMA_CUDA_REPO: "https://developer.download.nvidia.com/compute/cuda/repos/ubuntu2404/x86_64"
  LLAMA_VULKAN_SDK_VERSION: "1.3.296.0"
  LLAMA_VULKAN_SDK_ARCHIVE_URL: "https://sdk.lunarg.com/sdk/download/1.3.296.0/windows/VulkanSDK-1.3.296.0-Installer.exe"
  LLAMA_VULKAN_SDK_ARCHIVE_SHA256: "acb4ae0786fd3e558f8b3c36cc3eba91638984217ba8a6795ec64d2f9ffd8c4b"
  # GPU build evidence is a readiness-matrix contract: GPU jobs run only on
  # workflow_dispatch, retain toolchain/package and binary digests plus output,
  # and mark skipped execution as not a pass. CPU gates remain push-triggered.
  # Production crates gated by CI. Bench lanes are excluded on purpose:
  # heavy engine deps (burn, candle, python venvs) with no gate value.
  SYNAPSE_CRATES: -p synapse-core -p synapse-engine-ort -p synapse-module -p synapse-worker-llama -p owned-decode-worker -p synapse-worker-decode

jobs:
  test:
    strategy:
      fail-fast: false
      matrix:
        include:
          - name: linux
            runner: ubuntu-24.04
          - name: windows
            runner: windows-2025
          # A macOS Metal/ANE lane requires Apple Silicon with real GPU/ANE
          # access (hosted macOS runners virtualize the GPU), so that coverage
          # runs on developer machines. Restore by registering a self-hosted
          # Apple Silicon runner labeled `macos-metal` and adding:
          # - name: macos-metal
          #   runner: [self-hosted, macos-metal]
    name: ${{ matrix.name }}
    runs-on: ${{ matrix.runner }}
    steps:
      # Cross-repo token: only needed while the sibling repositories are
      # private. Once they are public the step self-skips and checkouts fall
      # back to the workflow's default token.
      - name: Create cross-repo token
        id: app-token
        if: ${{ env.HAS_CROSS_REPO_TOKEN == 'true' }}
        uses: actions/create-github-app-token@v2
        with:
          app-id: ${{ secrets.CK_CI_APP_ID }}
          private-key: ${{ secrets.CK_CI_APP_PRIVATE_KEY }}
          owner: cortexkit
          repositories: synapse,subconscious,commons

      - name: Checkout synapse
        uses: actions/checkout@v4
        with:
          path: synapse

      # Validate the workflow before sibling checkouts and toolchain setup spend time.
      - name: Check train CI preconditions
        if: matrix.name == 'linux'
        shell: bash
        run: bash synapse/scripts/check-train-preconditions.sh

      # Sibling layout: Cargo path deps resolve ../subconscious and ../commons.
      - name: Checkout subconscious (sibling)
        uses: actions/checkout@v4
        with:
          repository: cortexkit/subconscious
          token: ${{ steps.app-token.outputs.token || github.token }}
          path: subconscious

      - name: Checkout commons (sibling)
        uses: actions/checkout@v4
        with:
          repository: cortexkit/commons
          token: ${{ steps.app-token.outputs.token || github.token }}
          path: commons

      - uses: dtolnay/rust-toolchain@stable
        with:
          components: clippy, rustfmt

      # Direct prebuilt-binary install instead of taiki-e/install-action: the
      # action's bootstrap script is broken by a runner-image bash regression
      # (actions/partner-runner-images#169) and took every lane down with it.
      # get.nexte.st serves the same prebuilt archives without a bootstrap layer.
      - name: Install cargo-nextest (linux)
        if: matrix.name == 'linux'
        shell: bash
        run: curl -LsSf https://get.nexte.st/latest/linux | tar zxf - -C "${CARGO_HOME:-$HOME/.cargo}/bin"

      - name: Install cargo-nextest (windows)
        if: matrix.name == 'windows'
        shell: pwsh
        run: |
          curl.exe -LsSf https://get.nexte.st/latest/windows-tar -o nextest.tar.gz
          tar zxf nextest.tar.gz -C "$env:USERPROFILE\.cargo\bin"
          Remove-Item nextest.tar.gz

      - uses: Swatinem/rust-cache@v2
        with:
          workspaces: synapse
          # v2: CRT flavor lives in cmake's cached configure (CMakeCache.txt
          # inside OUT_DIR) — a cache from the MD era keeps producing MD
          # objects even after LLAMA_STATIC_CRT changes, because cmake reruns
          # against its cached configuration. Bump to force clean configure.
          prefix-key: v2-static-crt

      # llama-cpp-sys-2 needs cmake everywhere and libclang (bindgen) on
      # linux/windows. GitHub/Blacksmith images ship LLVM + CMake; these
      # steps only pin the env vars the build scripts read.
      - name: Windows build env (libclang for bindgen)
        if: matrix.name == 'windows'
        shell: pwsh
        run: |
          # GitHub-hosted windows images ship LLVM, so the existence guard
          # usually skips this entirely; the retrying install stays for image
          # drift. choco's CDN has failed with a bare exit 1 before — retry so
          # a red here means the failure survived three attempts, not one bad
          # CDN draw.
          if (!(Test-Path "C:\Program Files\LLVM\bin\libclang.dll")) {
            $attempts = 0
            while ($true) {
              $attempts++
              choco install llvm -y --no-progress | Out-Null
              if ($LASTEXITCODE -eq 0) { break }
              if ($attempts -ge 3) { throw "choco install llvm failed after $attempts attempts" }
              Start-Sleep -Seconds 20
            }
          }
          echo "LIBCLANG_PATH=C:\Program Files\LLVM\bin" >> $env:GITHUB_ENV

      - name: MiniLM e2e fixture cache
        id: fixture-cache
        uses: actions/cache@v4
        with:
          path: ~/.cache/huggingface/hub/models--Qdrant--all-MiniLM-L6-v2-onnx
          key: minilm-onnx-fixture-v1

      - name: Download MiniLM e2e fixture
        if: steps.fixture-cache.outputs.cache-hit != 'true'
        shell: bash
        run: |
          snap="$HOME/.cache/huggingface/hub/models--Qdrant--all-MiniLM-L6-v2-onnx/snapshots/main"
          mkdir -p "$snap"
          base="https://huggingface.co/Qdrant/all-MiniLM-L6-v2-onnx/resolve/main"
          for f in config.json model.onnx special_tokens_map.json tokenizer.json tokenizer_config.json vocab.txt; do
            curl -sSfL "$base/$f" -o "$snap/$f"
          done

      # Windows exercises the wave-11 load-dynamic ort path end to end: the
      # official DLL is what ORT_DYLIB_PATH points at in production.
      - name: onnxruntime DLL (windows)
        if: matrix.name == 'windows'
        shell: pwsh
        run: |
          $v = "1.23.2"
          $dir = "C:\onnxruntime"
          if (!(Test-Path "$dir\onnxruntime-win-x64-$v\lib\onnxruntime.dll")) {
            curl.exe -sSfL "https://github.com/microsoft/onnxruntime/releases/download/v$v/onnxruntime-win-x64-$v.zip" -o ort.zip
            Expand-Archive ort.zip -DestinationPath $dir
          }
          echo "ORT_DYLIB_PATH=$dir\onnxruntime-win-x64-$v\lib\onnxruntime.dll" >> $env:GITHUB_ENV

      # The repository is public, so a tracked home path, hostname or credential
      # marker is a disclosure rather than untidiness. This ran only from a
      # developer's shell until a leaked worktree path reached master, so it is
      # a gate here: one lane is enough because the check reads tracked files.
      - name: public banlist
        if: matrix.name == 'linux'
        working-directory: synapse
        run: bash scripts/public-banlist-check.sh

      - name: fmt
        working-directory: synapse
        run: cargo fmt --all --check

      - name: clippy
        working-directory: synapse
        shell: bash
        run: |
          crates="$SYNAPSE_CRATES"
          cargo clippy $crates --all-targets -- -D warnings

      # Windows tests run --release: rust links the release CRT even in debug
      # builds, while cc-built C++ deps (esaxx, onig) follow the cargo profile
      # — release everywhere is the only combination where every object agrees
      # on MD_DynamicRelease (llama.cpp's cmake default matches cc's release
      # default and rust's msvcrt default).
      - name: nextest
        working-directory: synapse
        shell: bash
        run: |
          crates="$SYNAPSE_CRATES"
          profile=""
          if [ "${{ matrix.name }}" = "windows" ]; then
            profile="--release"
          fi
          cargo nextest run $crates $profile --retries 0

      - name: Linux llama CPU build gate
        if: matrix.name == 'linux'
        working-directory: synapse
        shell: bash
        run: |
          set -o pipefail
          mkdir -p build-gates
          command='cargo build -p synapse-worker-llama --no-default-features --features cpu --release'
          log='build-gates/linux-x86_64-gnu-llama-cpu.output'
          set +e
          bash -c "$command" 2>&1 | tee "$log"
          status=${PIPESTATUS[0]}
          set -e
          binary='target/release/ck-synapse-worker-llama'
          digest='unavailable'
          if [ -f "$binary" ]; then digest=$(sha256sum "$binary" | cut -d ' ' -f1); fi
          {
            echo "target_triple=x86_64-unknown-linux-gnu"
            echo "command=$command"
            echo "rustc=$(rustc --version)"
            echo "cargo=$(cargo --version)"
            echo "machine_image=${ImageOS:-unknown}"
            echo "budget_seconds=$LLAMA_BUILD_GATE_BUDGET_SECONDS"
            echo "evidence_contract=$LLAMA_BUILD_EVIDENCE_CONTRACT"
            echo "binary=$binary"
            echo "sha256=$digest"
            echo "execution_status=$([ "$status" -eq 0 ] && echo executed_successful || echo failed)"
            echo "successful_output=$log"
            echo "readiness_matrix_trigger=${{ github.event_name }}"
            echo "skipped_is_not_pass=true"
          } > build-gates/linux-x86_64-gnu-llama-cpu.txt
          if [ "$status" -ne 0 ]; then exit "$status"; fi

      - name: Windows llama CPU build gate
        if: matrix.name == 'windows'
        working-directory: synapse
        shell: pwsh
        run: |
          New-Item -ItemType Directory -Force build-gates | Out-Null
          $command = 'cargo build -p synapse-worker-llama --no-default-features --features cpu --release'
          $log = 'build-gates/windows-x86_64-msvc-llama-cpu.output'
          & cargo build -p synapse-worker-llama --no-default-features --features cpu --release 2>&1 | Tee-Object -FilePath $log
          $status = $LASTEXITCODE
          $binary = 'target/release/ck-synapse-worker-llama.exe'
          $digest = if (Test-Path $binary) { (Get-FileHash $binary -Algorithm SHA256).Hash.ToLowerInvariant() } else { 'unavailable' }
          $execution = if ($status -eq 0) { 'executed_successful' } else { 'failed' }
          @"
          target_triple=x86_64-pc-windows-msvc
          command=$command
          rustc=$(rustc --version)
          cargo=$(cargo --version)
          machine_image=$env:ImageOS
          budget_seconds=$env:LLAMA_BUILD_GATE_BUDGET_SECONDS
          evidence_contract=$env:LLAMA_BUILD_EVIDENCE_CONTRACT
          binary=$binary
          sha256=$digest
          execution_status=$execution
          successful_output=$log
          readiness_matrix_trigger=$env:GITHUB_EVENT_NAME
          skipped_is_not_pass=true
          "@ | Set-Content build-gates/windows-x86_64-msvc-llama-cpu.txt
          if ($status -ne 0) { exit $status }

      - name: Retain llama build-gate evidence
        if: always() && (matrix.name == 'linux' || matrix.name == 'windows')
        uses: actions/upload-artifact@v4
        with:
          name: llama-build-gates-${{ matrix.name }}-${{ github.run_id }}
          path: synapse/build-gates
          if-no-files-found: ignore

      # Hollow-green guard: fixture e2e "pass" with a skip message when the
      # snapshot is missing; fail the lane loudly instead of shipping air.
      - name: Assert no silently-skipped e2e
        working-directory: synapse
        shell: bash
        run: |
          profile=""
          if [ "${{ matrix.name }}" = "windows" ]; then
            profile="--release"
          fi
          out=$(cargo nextest run -p synapse-module --test skeleton_e2e $profile --retries 0 --no-capture 2>&1 || true)
          if echo "$out" | grep -q "skipping"; then
            echo "$out" | grep "skipping"
            echo "::error::fixture e2e silently skipped — fixture staging is broken on this runner"
            exit 1
          fi

      # When a self-hosted `macos-metal` runner returns, restore the
      # checkpoint-gated owned-decode battery steps for that lane: build
      # synapse-worker-decode with the Xcode toolchain, assert the pinned
      # Qwen3/LFM2 checkpoints exist in the runner's HF cache, gate on
      # loadavg, then run the owned_decode_parity, worker_transport, and
      # skeleton_e2e ignored-only batteries.

  linux-llama-cuda-manual:
    if: github.event_name == 'workflow_dispatch'
    name: linux-llama-cuda-manual-gate
    # ubuntu-24.04 pinned (not -latest): the CUDA repo below is the ubuntu2404
    # channel and must move together with the image.
    runs-on: ubuntu-24.04
    steps:
      - name: Create cross-repo token
        id: app-token
        if: ${{ env.HAS_CROSS_REPO_TOKEN == 'true' }}
        uses: actions/create-github-app-token@v2
        with:
          app-id: ${{ secrets.CK_CI_APP_ID }}
          private-key: ${{ secrets.CK_CI_APP_PRIVATE_KEY }}
          owner: cortexkit
          repositories: synapse,subconscious,commons

      - name: Checkout synapse
        uses: actions/checkout@v4
        with:
          path: synapse

      - name: Checkout subconscious (sibling)
        uses: actions/checkout@v4
        with:
          repository: cortexkit/subconscious
          token: ${{ steps.app-token.outputs.token || github.token }}
          path: subconscious

      - name: Checkout commons (sibling)
        uses: actions/checkout@v4
        with:
          repository: cortexkit/commons
          token: ${{ steps.app-token.outputs.token || github.token }}
          path: commons

      - uses: dtolnay/rust-toolchain@stable
        with:
          components: rustfmt

      - name: Provision pinned NVIDIA CUDA toolkit
        shell: bash
        run: |
          set -euo pipefail
          keyring="$RUNNER_TEMP/cuda-keyring_1.1-1_all.deb"
          curl -fsSL "$LLAMA_CUDA_REPO/cuda-keyring_1.1-1_all.deb" -o "$keyring"
          keyring_digest=$(sha256sum "$keyring" | cut -d ' ' -f1)
          test "$keyring_digest" = "$LLAMA_CUDA_KEYRING_SHA256"
          sudo dpkg -i "$keyring"
          sudo apt-get update
          sudo apt-get install --download-only --reinstall -y --no-install-recommends \
            "$LLAMA_CUDA_TOOLKIT_PACKAGE=$LLAMA_CUDA_TOOLKIT_DEB_VERSION"
          mkdir -p "$GITHUB_WORKSPACE/synapse/build-gates"
          sha256sum "$keyring" > "$GITHUB_WORKSPACE/synapse/build-gates/linux-cuda-keyring.sha256"
          find /var/cache/apt/archives -type f -name '*.deb' -print0 \
            | sort -z \
            | xargs -0 -r sha256sum \
            > "$GITHUB_WORKSPACE/synapse/build-gates/linux-cuda-packages.sha256"
          sudo apt-get install -y --no-install-recommends \
            "$LLAMA_CUDA_TOOLKIT_PACKAGE=$LLAMA_CUDA_TOOLKIT_DEB_VERSION"
          export PATH=/usr/local/cuda-12.6/bin:$PATH
          export CUDAToolkit_ROOT=/usr/local/cuda-12.6
          echo "PATH=$PATH" >> "$GITHUB_ENV"
          echo "CUDAToolkit_ROOT=$CUDAToolkit_ROOT" >> "$GITHUB_ENV"
          nvcc --version

      - name: Linux llama CUDA manual build gate
        working-directory: synapse
        shell: bash
        run: |
          set -o pipefail
          command='cargo build -p synapse-worker-llama --no-default-features --features cuda --release'
          log='build-gates/linux-x86_64-gnu-llama-cuda.output'
          set +e
          bash -c "$command" 2>&1 | tee "$log"
          status=${PIPESTATUS[0]}
          set -e
          binary='target/release/ck-synapse-worker-llama'
          digest='unavailable'
          if [ -f "$binary" ]; then digest=$(sha256sum "$binary" | cut -d ' ' -f1); fi
          {
            echo "target_triple=x86_64-unknown-linux-gnu"
            echo "command=$command"
            echo "rustc=$(rustc --version)"
            echo "cargo=$(cargo --version)"
            echo "cuda_repo=$LLAMA_CUDA_REPO"
            echo "cuda_package=$LLAMA_CUDA_TOOLKIT_PACKAGE=$LLAMA_CUDA_TOOLKIT_DEB_VERSION"
            echo "cuda_keyring_sha256=$LLAMA_CUDA_KEYRING_SHA256"
            echo "cuda_toolkit=$(nvcc --version 2>&1)"
            echo "machine_image=${ImageOS:-unknown}"
            echo "budget_seconds=$LLAMA_BUILD_GATE_BUDGET_SECONDS"
            echo "evidence_contract=$LLAMA_BUILD_EVIDENCE_CONTRACT"
            echo "binary=$binary"
            echo "sha256=$digest"
            echo "execution_status=$([ "$status" -eq 0 ] && echo executed_successful || echo failed)"
            echo "successful_output=$log"
            echo "readiness_matrix_trigger=workflow_dispatch"
            echo "skipped_is_not_pass=true"
            echo "manual_gate=mandatory"
            echo "package_digests=build-gates/linux-cuda-packages.sha256"
            echo "keyring_digest=build-gates/linux-cuda-keyring.sha256"
          } > build-gates/linux-x86_64-gnu-llama-cuda.txt
          if [ "$status" -ne 0 ]; then exit "$status"; fi

      - name: Retain Linux CUDA gate evidence
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: llama-build-gates-linux-cuda-manual-${{ github.run_id }}
          path: synapse/build-gates
          if-no-files-found: error

  windows-llama-vulkan-manual:
    if: github.event_name == 'workflow_dispatch'
    name: windows-llama-vulkan-manual-gate
    runs-on: windows-2025
    steps:
      - name: Create cross-repo token
        id: app-token
        if: ${{ env.HAS_CROSS_REPO_TOKEN == 'true' }}
        uses: actions/create-github-app-token@v2
        with:
          app-id: ${{ secrets.CK_CI_APP_ID }}
          private-key: ${{ secrets.CK_CI_APP_PRIVATE_KEY }}
          owner: cortexkit
          repositories: synapse,subconscious,commons

      - name: Checkout synapse
        uses: actions/checkout@v4
        with:
          path: synapse

      - name: Checkout subconscious (sibling)
        uses: actions/checkout@v4
        with:
          repository: cortexkit/subconscious
          token: ${{ steps.app-token.outputs.token || github.token }}
          path: subconscious

      - name: Checkout commons (sibling)
        uses: actions/checkout@v4
        with:
          repository: cortexkit/commons
          token: ${{ steps.app-token.outputs.token || github.token }}
          path: commons

      - uses: dtolnay/rust-toolchain@stable
        with:
          components: rustfmt

      - name: Provision pinned Vulkan SDK archive
        shell: pwsh
        run: |
          $installer = Join-Path $env:RUNNER_TEMP "VulkanSDK-$env:LLAMA_VULKAN_SDK_VERSION-Installer.exe"
          Invoke-WebRequest -Uri $env:LLAMA_VULKAN_SDK_ARCHIVE_URL -OutFile $installer
          $digest = (Get-FileHash $installer -Algorithm SHA256).Hash.ToLowerInvariant()
          if ($digest -ne $env:LLAMA_VULKAN_SDK_ARCHIVE_SHA256) {
            throw "Vulkan SDK installer digest $digest does not match pinned $env:LLAMA_VULKAN_SDK_ARCHIVE_SHA256"
          }
          $install = Join-Path $env:RUNNER_TEMP "vulkan-sdk-$env:LLAMA_VULKAN_SDK_VERSION"
          $process = Start-Process -FilePath $installer -ArgumentList @('/S', "/D=$install") -Wait -PassThru
          if ($process.ExitCode -ne 0) { throw "Vulkan SDK installer failed with exit code $($process.ExitCode)" }
          $sdk = @((Get-Item $install), (Get-ChildItem $install -Directory -Recurse)) |
            Where-Object { Test-Path (Join-Path $_.FullName 'Include\vulkan\vulkan.h') } |
            Select-Object -First 1
          if (-not $sdk) { throw 'Vulkan SDK installer did not provide pinned headers' }
          $sdkPath = $sdk.FullName
          "VULKAN_SDK=$sdkPath" >> $env:GITHUB_ENV
          "LLAMA_VULKAN_SDK_ARCHIVE_SHA256=$digest" >> $env:GITHUB_ENV
          "PATH=$sdkPath\Bin;$env:PATH" >> $env:GITHUB_ENV
          New-Item -ItemType Directory -Force "$env:GITHUB_WORKSPACE\synapse\build-gates" | Out-Null
          "installer=$installer`nsdk=$sdkPath`nsha256=$digest`nrevision=$env:LLAMA_VULKAN_SDK_VERSION" |
            Set-Content "$env:GITHUB_WORKSPACE\synapse\build-gates\windows-vulkan-sdk.txt"
          & "$sdkPath\Bin\glslc.exe" --version

      - name: Windows llama Vulkan manual build gate
        working-directory: synapse
        shell: pwsh
        run: |
          New-Item -ItemType Directory -Force build-gates | Out-Null
          $command = 'cargo build -p synapse-worker-llama --no-default-features --features vulkan --release'
          $log = 'build-gates/windows-x86_64-msvc-llama-vulkan.output'
          & cargo build -p synapse-worker-llama --no-default-features --features vulkan --release 2>&1 | Tee-Object -FilePath $log
          $status = $LASTEXITCODE
          $binary = 'target/release/ck-synapse-worker-llama.exe'
          $digest = if (Test-Path $binary) { (Get-FileHash $binary -Algorithm SHA256).Hash.ToLowerInvariant() } else { 'unavailable' }
          $execution = if ($status -eq 0) { 'executed_successful' } else { 'failed' }
          @"
          target_triple=x86_64-pc-windows-msvc
          command=$command
          rustc=$(rustc --version)
          cargo=$(cargo --version)
          vulkan_sdk=$env:VULKAN_SDK
          vulkan_sdk_revision=$env:LLAMA_VULKAN_SDK_VERSION
          vulkan_sdk_archive=$env:LLAMA_VULKAN_SDK_ARCHIVE_URL
          vulkan_sdk_archive_sha256=$env:LLAMA_VULKAN_SDK_ARCHIVE_SHA256
          vulkan_sdk_archive_digest_recorded=true
          machine_image=$env:ImageOS
          budget_seconds=$env:LLAMA_BUILD_GATE_BUDGET_SECONDS
          evidence_contract=$env:LLAMA_BUILD_EVIDENCE_CONTRACT
          binary=$binary
          sha256=$digest
          execution_status=$execution
          successful_output=$log
          readiness_matrix_trigger=workflow_dispatch
          skipped_is_not_pass=true
          manual_gate=mandatory
          "@ | Set-Content build-gates/windows-x86_64-msvc-llama-vulkan.txt
          if ($status -ne 0) { exit $status }

      - name: Retain Windows Vulkan gate evidence
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: llama-build-gates-windows-vulkan-manual-${{ github.run_id }}
          path: synapse/build-gates
          if-no-files-found: error