fix(runtime): repair cross-host storage and verification journeys

.bazelignore

@@ -9,6 +9,5 @@ target
 .codex-worktrees
 .claude-worktrees
 .claude/worktrees
-evals
 mockups
 vendor

.github/workflows/ci.yml

@@ -114,6 +114,9 @@ jobs:
         working-directory: benchmark_data/runtime
         run: python3 -m unittest discover -s tests -p 'test_*.py'
 
+      - name: Test benchmark result publication
+        run: python3 scripts/test-claude-observation-benchmark-publication.py
+
   # The cheap repository gates in one job: commit lint, cache lineage, the
   # release guards, and rustfmt. Each used to hold its own ubuntu-latest
   # runner for a couple of minutes of work; on 20 free slots that is three
@@ -189,21 +192,17 @@ jobs:
           bash tests/release_pr_integrity_test.sh
           bash tests/dashboard_bundle_check_test.sh
 
-      # Judge formatting with the toolchain `rust-toolchain.toml` pins, not
-      # whatever `stable` is on the runner: rustfmt's output changes between
-      # releases (1.98.1 breaks a chain 1.97.1 keeps inline), and
-      # `dtolnay/rust-toolchain@stable` exports `RUSTUP_TOOLCHAIN`, which
-      # overrides the file. Installing through rustup with no override keeps
-      # the pin in one place.
-      - name: Install the repository's pinned toolchain
-        run: rustup show active-toolchain || rustup toolchain install
+      - uses: ./.github/actions/setup-bazel
+        with:
+          cache-key: ci-format-linux
+
       - name: Check formatting
-        run: cargo fmt --all -- --check
+        run: bazel build --config=ci //:rustfmt_check
 
       # Manifest edits that skip a gen_builds.py rerun leave stale BUILD
       # files; compare the committed files against a fresh generation.
       - name: Check generated Bazel BUILD files are current
-        run: python3 scripts/bazel/gen_builds.py --check
+        run: bazel run //scripts:bazel/gen_builds.py -- --check
 
       - name: Test and check dev skill host copies
         run: |

.github/workflows/distribution-acceptance.yml

@@ -35,6 +35,7 @@ jobs:
     timeout-minutes: 240
     env:
       TARGET: x86_64-unknown-linux-gnu
+      AST_GREP_VERSION: "0.44.0"
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
@@ -46,6 +47,11 @@ jobs:
 
       - uses: ./.github/actions/setup-pnpm
 
+      - uses: ./.github/actions/setup-bazel
+        with:
+          cache-key: distribution-acceptance-linux
+          test-tools: "true"
+
       - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.14.8"

.github/workflows/release-please.yml

@@ -145,6 +145,11 @@ jobs:
             pnpm-lock.yaml
             Cargo.lock
 
+      - uses: ./.github/actions/setup-bazel
+        if: steps.release.outputs.prs_created == 'true'
+        with:
+          cache-key: release-metadata-ubuntu-latest
+
       - name: Update release PR generated metadata
         if: steps.release.outputs.prs_created == 'true'
         env:

AGENTS.md

@@ -79,7 +79,9 @@ unauthorized external action after completing independent, authorized work.
 - Bazel is the sole workspace build, test, check, run, benchmark, and
   code-generation authority. Run `bazel build //...`,
   `bazel test //... --test_output=errors`, `bazel run //crates/...`, and
-  `bazel test //... --test_arg=--bench` for benchmarks. Edition 2024,
+  `bazel test //crates/<crate>:<benchmark> --test_arg=--bench` for an explicit
+  benchmark target. Benchmarks with Cargo `test = false` remain compiled by
+  default builds but run only when selected explicitly. Edition 2024,
   resolver 3, and the toolchain pinned in `rust-toolchain.toml` remain
   canonical inputs. Never invoke `cargo` directly; route every build, test,
   check, run, bench, and codegen through Bazel.

BUILD.bazel

@@ -1,11 +1,19 @@
 load("@npm//:defs.bzl", "npm_link_all_packages")
+load("@rules_rust//rust:toolchain.bzl", "current_rustfmt_toolchain")
+
+current_rustfmt_toolchain(
+    name = "rustfmt_toolchain",
+    tags = ["manual"],
+    visibility = ["//visibility:public"],
+)
 
 npm_link_all_packages(name = "node_modules")
 
 exports_files(
     [
         "version.txt",
         "Cargo.toml",
+        "rustfmt.toml",
         "pnpm-lock.yaml",
         "pnpm-lock.bazel.yaml",
     ],
@@ -28,3 +36,11 @@ config_setting(
     values = {"compilation_mode": "opt"},
     visibility = ["//visibility:public"],
 )
+
+# BEGIN generated by scripts/bazel/gen_builds.py
+filegroup(
+    name = "rustfmt_check",
+    srcs = ["//crates/tracedecay-agent-hosts:rustfmt_check_2024", "//crates/tracedecay-api:rustfmt_check_2024", "//crates/tracedecay-application:rustfmt_check_2024", "//crates/tracedecay-automation-runtime:rustfmt_check_2024", "//crates/tracedecay-automation:rustfmt_check_2024", "//crates/tracedecay-capture:rustfmt_check_2024", "//crates/tracedecay-cli:rustfmt_check_2024", "//crates/tracedecay-code-extraction:rustfmt_check_2024", "//crates/tracedecay-code-index-retention:rustfmt_check_2024", "//crates/tracedecay-code-index-runtime:rustfmt_check_2024", "//crates/tracedecay-code-index:rustfmt_check_2024", "//crates/tracedecay-configuration:rustfmt_check_2024", "//crates/tracedecay-contracts:rustfmt_check_2024", "//crates/tracedecay-daemon-control:rustfmt_check_2024", "//crates/tracedecay-daemon-identity:rustfmt_check_2024", "//crates/tracedecay-daemon-protocol:rustfmt_check_2024", "//crates/tracedecay-daemon-service:rustfmt_check_2024", "//crates/tracedecay-dashboard-api:rustfmt_check_2024", "//crates/tracedecay-domain:rustfmt_check_2024", "//crates/tracedecay-framing:rustfmt_check_2024", "//crates/tracedecay-global-db:rustfmt_check_2024", "//crates/tracedecay-graph-db:rustfmt_check_2024", "//crates/tracedecay-graph-query:rustfmt_check_2024", "//crates/tracedecay-hooks:rustfmt_check_2024", "//crates/tracedecay-host-admission:rustfmt_check_2024", "//crates/tracedecay-host-integration:rustfmt_check_2024", "//crates/tracedecay-lcm:rustfmt_check_2024", "//crates/tracedecay-lsp:rustfmt_check_2024", "//crates/tracedecay-maintenance:rustfmt_check_2024", "//crates/tracedecay-mcp-catalog:rustfmt_check_2024", "//crates/tracedecay-mcp:rustfmt_check_2024", "//crates/tracedecay-policy:rustfmt_check_2024", "//crates/tracedecay-privacy:rustfmt_check_2024", "//crates/tracedecay-private-fs:rustfmt_check_2024", "//crates/tracedecay-project:rustfmt_check_2024", "//crates/tracedecay-query:rustfmt_check_2024", "//crates/tracedecay-runtime-core:rustfmt_check_2024", "//crates/tracedecay-rusqlite-runtime:rustfmt_check_2024", "//crates/tracedecay-sdk:rustfmt_check_2024", "//crates/tracedecay-search-eval:rustfmt_check_2024", "//crates/tracedecay-session-memory:rustfmt_check_2024", "//crates/tracedecay-session-runtime:rustfmt_check_2024", "//crates/tracedecay-session-temporal-store:rustfmt_check_2024", "//crates/tracedecay-sessions:rustfmt_check_2024", "//crates/tracedecay-source-edit:rustfmt_check_2024", "//crates/tracedecay-store-runtime:rustfmt_check_2024", "//crates/tracedecay-store:rustfmt_check_2024", "//crates/tracedecay-temporal-query:rustfmt_check_2024", "//crates/tracedecay-tool-catalog:rustfmt_check_2024", "//crates/tracedecay:rustfmt_check_2024", "//scripts:rustfmt_check_2024", "//sdks/codegen:rustfmt_check_2024"],
+    tags = ["manual"],
+)
+# END generated by scripts/bazel/gen_builds.py

MODULE.bazel

@@ -6,9 +6,14 @@ bazel_dep(name = "rules_rust", version = "0.74.0")
 # Rustc adds every dependency search directory to PATH on Windows; large
 # graphs exceed its environment limit (rust-lang/rust#110889). Native
 # shared symlinks preserve artifact identities with one search directory.
+# Build-script flags use response files to keep the compiler wrapper's own
+# command line within Windows' separate CreateProcessW limit.
 single_version_override(
     module_name = "rules_rust",
-    patches = ["//scripts:bazel/patches/rules-rust-windows-dependency-search.patch"],
+    patches = [
+        "//scripts:bazel/patches/rules-rust-windows-dependency-search.patch",
+        "//scripts:bazel/patches/rules-rust-windows-build-flags.patch",
+    ],
     patch_strip = 1,
 )
 bazel_dep(name = "aspect_rules_js", version = "3.5.1")
@@ -27,6 +32,7 @@ rust.toolchain(
         "opt": "3",
     },
     versions = ["1.97.1"],
+    rustfmt_version = "1.97.1",
 )
 use_repo(rust, "rust_toolchains")
 register_toolchains("@rust_toolchains//:all")

benchmark_data/BUILD.bazel

@@ -1,5 +1,5 @@
 # Generated by scripts/bazel/gen_builds.py from Cargo.toml + Cargo.lock.
-# Regenerate instead of editing. python3 scripts/bazel/gen_builds.py
+# Regenerate instead of editing. bazel run //scripts:bazel/gen_builds.py
 
 # BEGIN generated by scripts/bazel/gen_builds.py
 filegroup(
@@ -31,4 +31,14 @@ filegroup(
 exports_files(["runtime/fixtures/project/tests/catalog.rs"],
     visibility = ["//visibility:public"],
 )
+
+filegroup(
+    name = "session-temporal",
+    srcs = glob(["session-temporal/**"]),
+    visibility = ["//visibility:public"],
+)
+
+exports_files(["session-temporal/workload-v1.json"],
+    visibility = ["//visibility:public"],
+)
 # END generated by scripts/bazel/gen_builds.py

benchmark_data/claude-observation/README.md

@@ -63,8 +63,10 @@ The legacy schema records real SHA-256 identities for workload members and
 native fixtures plus the host target, Rust/Cargo versions, kernel, and hardware.
 Those source/content digests remain useful provenance. Do not recreate the
 former clean-checkout archive, tracked-source snapshot, compiler-input
-attestation, or evidence-only commit workflow. Run ordinary Cargo against the
-working checkout and report the source revision and dirty state truthfully.
+attestation, or evidence-only commit workflow. The runner uses Bazel `--config=release` in the current clean checkout and
+records the source revision before and after measurement, the Bazel and Rust
+versions, and the measured executable identity. It validates new output before
+publishing the result and index, without archive or backup copies.
 
 Linux `/proc` is the explicit measurement platform contract. Preflight requires
 all measured interfaces, a successful write of `5` to

benchmark_data/claude-observation/workload-v1.json

@@ -652,6 +652,6 @@
       ]
     }
   },
-  "command": "cargo test --quiet --release -p tracedecay --features test-helpers --test claude_observation_benchmark production_observation_pipeline_baseline -- --ignored --exact --nocapture --test-threads=1",
+  "command": "scripts/run-claude-observation-benchmark.sh",
   "evidence_runner": "scripts/run-claude-observation-benchmark.sh"
 }

benchmark_data/session-temporal/README.md

@@ -37,10 +37,9 @@ Runtime sanitizer provenance for those fixtures is in
 scripts/run-session-temporal-benchmark.sh --dry-run
 scripts/run-session-temporal-benchmark.sh --run   # diagnostic on Linux or macOS
 scripts/run-session-temporal-benchmark.sh --refresh-contract  # Linux only
-cargo bench --bench session_temporal --all-features -- --run
 ```
 
-Dry-run is Cargo-free. `--run` isolates `HOME` and `TRACEDECAY_DATA_DIR` and
+Dry-run performs no build. The measurement runner uses Bazel `--config=release`. `--run` isolates `HOME` and `TRACEDECAY_DATA_DIR` and
 measures: `rebuild_activate`, `exact_replay`, `compact_rank`, and `late_hydrate`.
 `--run` prints diagnostic samples but never changes checked-in evidence.
 `--refresh-contract` is Linux-only and the only publishing path: it requires a
@@ -57,7 +56,7 @@ record counts.
 Recorded only when executed in the same capture window:
 
 ```bash
-cargo test --test session_suite --all-features temporal_derived_evidence:: -- --test-threads=1
+bazel test --config=ci //crates/tracedecay:session_suite --test_arg=temporal_derived_evidence:: --test_arg=--test-threads=1
 ```
 
 Quantiles are descriptive nearest-rank sample labels, not inferential claims.

benchmark_data/session-temporal/workload-v1.json

@@ -49,15 +49,6 @@
       "SessionRetrievalService with GlobalDbSessionTemporalExecution and AllSessionsInAuthorizedRoot hydration"
     ]
   },
-  "profile": {
-    "cargo_profile": "bench",
-    "debug": false,
-    "debug_assertions": false,
-    "incremental": false,
-    "manifest_path": "Cargo.toml",
-    "opt_level": 3,
-    "overflow_checks": false
-  },
   "runner": {
     "path": "scripts/run-session-temporal-benchmark.sh"
   },

crates/tracedecay-agent-hosts/BUILD.bazel

@@ -1,5 +1,5 @@
 # Generated by scripts/bazel/gen_builds.py from Cargo.toml + Cargo.lock.
-# Regenerate instead of editing. python3 scripts/bazel/gen_builds.py
+# Regenerate instead of editing. bazel run //scripts:bazel/gen_builds.py
 
 package(default_visibility = ["//visibility:public"])
 
@@ -91,7 +91,7 @@ cargo_build_script(
 
 rust_test(
     name = "context_scout_evidence",
-    srcs = glob(["tests/**/*.rs"]),
+    srcs = glob(["tests/**/*.rs"], exclude = ["tests/fixtures/**"]),
     crate_root = "tests/context_scout_evidence.rs",
     edition = crate_edition(),
     version = "0.1.0",
@@ -106,7 +106,7 @@ rust_test(
 
 rust_test(
     name = "hooks_boundary",
-    srcs = glob(["tests/**/*.rs"]),
+    srcs = glob(["tests/**/*.rs"], exclude = ["tests/fixtures/**"]),
     crate_root = "tests/hooks_boundary.rs",
     edition = crate_edition(),
     version = "0.1.0",
@@ -135,6 +135,24 @@ rust_test(
     data = glob(["tests/**","assets/**","fixtures/**","data/**","resources/**","vendor/**"], allow_empty = True) + ["//tests:fixtures"],
 )
 
+filegroup(
+    name = "rustfmt_sources_2024",
+    srcs = depset(["build.rs", "src/product_version/root_manifest.rs"] + glob(["src/**/*.rs"]) + glob(["tests/**/*.rs"], exclude = ["tests/fixtures/**"])).to_list(),
+    tags = ["manual"],
+)
+
+genrule(
+    name = "rustfmt_check_2024",
+    srcs = [":rustfmt_sources_2024", "//:rustfmt.toml"],
+    outs = ["rustfmt_check_2024.ok"],
+    cmd = "\"$(RUSTFMT)\" --config-path \"$(location //:rustfmt.toml)\" --edition 2024 --config skip_children=true --check $(locations :rustfmt_sources_2024) && touch \"$@\"",
+    cmd_ps = "foreach ($$source in ('$(locations :rustfmt_sources_2024)' -split ' ')) { & \"$(RUSTFMT)\" --config-path \"$(location //:rustfmt.toml)\" --edition 2024 --config skip_children=true --check $$source; if ($$LASTEXITCODE -ne 0) { exit $$LASTEXITCODE } }; New-Item -ItemType File -Path \"$@\" -Force | Out-Null",
+    tools = ["//:rustfmt_toolchain"],
+    toolchains = ["//:rustfmt_toolchain"],
+    tags = ["manual"],
+    visibility = ["//visibility:public"],
+)
+
 filegroup(
     name = "src_agents_hermes_templates",
     srcs = glob(["src/agents/hermes/templates/**"]),

crates/tracedecay-agent-hosts/src/hooks/dispatch.rs

@@ -154,20 +154,26 @@ pub fn publish_daemon_bindings(
         // admission waits behind that cold filesystem work. A live callback
         // already appending to a prepared spool is a legitimate peer writer,
         // so publication waits the same bounded budget instead of failing.
-        drop(
-            tracedecay_hooks::HookSpoolV1::open_within(
-                tracedecay_hooks::hook_v2_spool_root(&layout.data_root, *host),
-                tracedecay_hooks::HookSpoolConfigV1::stock(*host),
-                now,
-                tracedecay_hooks::HOOK_SYNCHRONOUS_BUDGET,
-            )
+        let (capture, _) = tracedecay_hooks::HookSpoolV1::open_within(
+            tracedecay_hooks::hook_v2_spool_root(&layout.data_root, *host),
+            tracedecay_hooks::HookSpoolConfigV1::stock(*host),
+            now,
+            tracedecay_hooks::HOOK_SYNCHRONOUS_BUDGET,
+        )
+        .map_err(|error| tracedecay_domain::errors::TraceDecayError::Config {
+            message: format!(
+                "failed to prepare {} Hook capture spool: {error}",
+                host.hook_key()
+            ),
+        })?;
+        capture
+            .prepare()
             .map_err(|error| tracedecay_domain::errors::TraceDecayError::Config {
                 message: format!(
-                    "failed to prepare {} Hook capture spool: {error}",
+                    "failed to prepare {} Hook capture durability: {error}",
                     host.hook_key()
                 ),
-            })?,
-        );
+            })?;
         drop(
             tracedecay_hooks::HookDeliveryReceiptWriterV1::open_within(
                 tracedecay_hooks::hook_delivery_receipt_spool_root(&layout.data_root, *host),

crates/tracedecay-agent-hosts/src/hooks/dispatch/tests.rs

@@ -859,6 +859,25 @@ fn binding_publication_waits_for_a_live_callback_holding_the_spool() {
     publish_daemon_bindings(&runtime, &layout).unwrap();
 
     let host = NativeHostIdentityV1::ClaudeCode;
+    let capture_root = tracedecay_hooks::hook_v2_spool_root(&layout.data_root, host);
+    let (prepared, report) =
+        HookSpoolV1::open(&capture_root, HookSpoolConfigV1::stock(host), UtcMicros(1)).unwrap();
+    assert_eq!((report.pending_records, report.next_sequence), (0, 1));
+    assert!(
+        !report.checkpoint_rewritten,
+        "publication prepares the first callback's checkpoint"
+    );
+    let barriers = tracedecay_private_fs::framed_log::sync_latency::inject(
+        &capture_root,
+        std::time::Duration::ZERO,
+    );
+    prepared.prepare().unwrap();
+    assert_eq!(
+        barriers.syncs(),
+        0,
+        "publication already prepared this exact file"
+    );
+    drop(barriers);
     let held = std::time::Duration::from_millis(20);
     let (capture, _) = HookSpoolV1::open(
         tracedecay_hooks::hook_v2_spool_root(&layout.data_root, host),