ci: make test planning fail closed and checks non-mutating

.changes/changed-test-planning-now-f64b.md

@@ -0,0 +1,7 @@
+---
+"rscrypto" = "patch"
+---
+
+Changed-test planning now runs the workspace test suite when planner output is
+unavailable, invalid, or ambiguous; only a valid explicit empty scope skips
+tests.

.changes/the-check-and-check-eb38.md

@@ -0,0 +1,6 @@
+---
+"rscrypto" = "patch"
+---
+
+The `check` and `check-all` recipes now report formatting and lockfile drift
+without modifying pre-existing source or `Cargo.lock` changes.

.github/workflows/ci.yaml

@@ -23,10 +23,12 @@ jobs:
     if: ${{ github.event_name != 'pull_request' || (!github.event.pull_request.draft && github.actor != 'dependabot[bot]') }}
     runs-on: ubuntu-latest
     outputs:
-      build: ${{ steps.rail.outputs.build || 'true' }}
-      test: ${{ steps.rail.outputs.test || 'true' }}
-      infra: ${{ steps.rail.outputs.infra || 'true' }}
-      cargo_graph: ${{ steps.graph.outputs.enabled || 'true' }}
+      build: ${{ steps.resolve.outputs.build }}
+      test: ${{ steps.resolve.outputs.test }}
+      infra: ${{ steps.resolve.outputs.infra }}
+      cargo_graph: ${{ steps.resolve.outputs.cargo_graph }}
+      plan_valid: ${{ steps.resolve.outputs.valid }}
+      plan_empty: ${{ steps.resolve.outputs.empty }}
     steps:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
@@ -41,25 +43,20 @@ jobs:
         with:
           version: "0.18.0"
 
+      - name: Resolve Build Plan
+        if: always()
+        id: resolve
+        env:
+          RAIL_PLAN_STEP_OUTCOME: ${{ steps.rail.outcome }}
+          RAIL_SCOPE_JSON: ${{ steps.rail.outputs.scope-json }}
+        run: scripts/ci/resolve-rail-plan.sh
+
       - name: Check Release Intent Coverage
         if: github.event_name == 'pull_request'
         env:
           RAIL_BASE_REF: ${{ steps.rail.outputs.base-ref }}
         run: cargo rail change check --since "$RAIL_BASE_REF" --required
 
-      - name: Resolve Cargo Graph Assurance
-        id: graph
-        env:
-          EVENT_NAME: ${{ github.event_name }}
-          RAIL_SCOPE_JSON: ${{ steps.rail.outputs.scope-json }}
-        run: |
-          if [[ "$EVENT_NAME" == "pull_request" ]]; then
-            enabled="$(jq -r '.surfaces["custom:cargo_graph"] // false' <<<"$RAIL_SCOPE_JSON")"
-          else
-            enabled=true
-          fi
-          echo "enabled=$enabled" >> "$GITHUB_OUTPUT"
-
   dependency-smoke:
     name: Dependency Smoke
     if: ${{ github.event_name == 'pull_request' && !github.event.pull_request.draft && github.actor == 'dependabot[bot]' }}
@@ -78,7 +75,7 @@ jobs:
   suite:
     name: CI Suite
     needs: rail-plan
-    if: ${{ github.event_name != 'pull_request' || (!github.event.pull_request.draft && github.actor != 'dependabot[bot]' && (needs.rail-plan.outputs.build == 'true' || needs.rail-plan.outputs.test == 'true' || needs.rail-plan.outputs.infra == 'true')) }}
+    if: ${{ always() && (github.event_name != 'pull_request' || (!github.event.pull_request.draft && github.actor != 'dependabot[bot]' && (needs.rail-plan.result != 'success' || needs.rail-plan.outputs.build == 'true' || needs.rail-plan.outputs.test == 'true' || needs.rail-plan.outputs.infra == 'true'))) }}
     uses: ./.github/workflows/_ci-suite.yaml
     with:
       cache_key_prefix: commit
@@ -97,7 +94,9 @@ jobs:
           ACTOR: ${{ github.actor }}
           DEPENDENCY_SMOKE_RESULT: ${{ needs.dependency-smoke.result }}
           EVENT_NAME: ${{ github.event_name }}
+          PLAN_EMPTY: ${{ needs.rail-plan.outputs.plan_empty }}
           PLAN_RESULT: ${{ needs.rail-plan.result }}
+          PLAN_VALID: ${{ needs.rail-plan.outputs.plan_valid }}
           SUITE_RESULT: ${{ needs.suite.result }}
         run: |
           if [[ "$EVENT_NAME" == "pull_request" && "$ACTOR" == "dependabot[bot]" ]]; then
@@ -114,7 +113,12 @@ jobs:
             exit 1
           fi
 
-          if [[ "$SUITE_RESULT" != "success" && "$SUITE_RESULT" != "skipped" ]]; then
+          if [[ "$SUITE_RESULT" == "skipped" ]]; then
+            if [[ "$PLAN_VALID" != "true" || "$PLAN_EMPTY" != "true" ]]; then
+              echo "CI suite skipped without a valid empty plan"
+              exit 1
+            fi
+          elif [[ "$SUITE_RESULT" != "success" ]]; then
             echo "CI suite result: $SUITE_RESULT"
             exit 1
           fi

justfile

@@ -245,6 +245,8 @@ check-actions:
     @scripts/ci/check-ci-ownership-test.sh
     @scripts/ci/run-rust-job-test.sh
     @scripts/ci/emit-manual-matrix-test.sh
+    @scripts/ci/changed-test-planning-test.sh
+    @scripts/ci/check-worktree-test.sh
     @scripts/ci/pre-push-test.sh
     @scripts/ci/release-evidence-check-test.sh
     @scripts/ci/repository-controls-evidence-test.sh

scripts/README.md

@@ -29,6 +29,8 @@ its caller.
 | `ci/check-ci-ownership-test.sh`| `just check-actions` |
 | `ci/run-rust-job-test.sh`      | `just check-actions` |
 | `ci/emit-manual-matrix-test.sh`| `just check-actions` |
+| `ci/changed-test-planning-test.sh` | `just check-actions` |
+| `ci/check-worktree-test.sh`    | `just check-actions` |
 | `ci/pre-push-test.sh`          | `just check-actions` |
 | `ci/release-plan-check.sh`     | `just release-check` |
 | `ci/release-evidence-check.sh` | `just release-tag`, `release.yaml`, `ci/release-evidence-check-test.sh` |
@@ -76,6 +78,7 @@ claim in [`docs/secret-lifecycle.md`](../docs/secret-lifecycle.md).
 |--------|---------|
 | `ci/install-tools.sh`          | `.github/actions/setup/action.yaml` |
 | `ci/run-rust-job.sh`           | `.github/workflows/_rust-job.yaml` |
+| `ci/resolve-rail-plan.sh`       | `.github/workflows/ci.yaml` |
 | `ci/dependabot-smoke.sh`       | `ci/run-rust-job.sh` |
 | `ci/emit-manual-matrix.sh`     | `bench.yaml`, `ct.yaml` |
 | `ci/mlkem-aarch64-gate.sh`     | `ci/run-rust-job.sh` |

scripts/check/check-all.sh

@@ -90,6 +90,7 @@ run_constrained_check() {
     --no-default-features
     --target "$target"
     --lib
+    --locked
   )
 
   if [[ -n "$feature_set" ]]; then
@@ -146,7 +147,7 @@ run_constrained_target() {
     step "$target check (alloc)"
     for crate in "${alloc_crates[@]}"; do
       if ! RUSTC_WRAPPER="" CARGO_TARGET_DIR="$target_dir" \
-        cargo check -p "$crate" --no-default-features --features alloc --target "$target" --lib \
+        cargo check --locked -p "$crate" --no-default-features --features alloc --target "$target" --lib \
         >>"$log_file" 2>&1; then
         fail
         show_error "$log_file"
@@ -159,7 +160,7 @@ run_constrained_target() {
   step "$target build (no features)"
   for crate in "${CONSTRAINED_CRATES[@]}"; do
     if ! RUSTC_WRAPPER="" CARGO_TARGET_DIR="$target_dir" \
-      cargo build -p "$crate" --no-default-features --target "$target" --lib --release \
+      cargo build --locked -p "$crate" --no-default-features --target "$target" --lib --release \
       >>"$log_file" 2>&1; then
       fail
       show_error "$log_file"
@@ -172,7 +173,7 @@ run_constrained_target() {
     step "$target build (alloc)"
     for crate in "${alloc_crates[@]}"; do
       if ! RUSTC_WRAPPER="" CARGO_TARGET_DIR="$target_dir" \
-        cargo build -p "$crate" --no-default-features --features alloc --target "$target" --lib --release \
+        cargo build --locked -p "$crate" --no-default-features --features alloc --target "$target" --lib --release \
         >>"$log_file" 2>&1; then
         fail
         show_error "$log_file"
@@ -188,7 +189,10 @@ run_constrained_checks() {
   log_dir=$(mktemp -d)
   trap 'rm -rf "$log_dir"' RETURN
 
-  local constrained_targets=("${NOSTD_TARGETS[@]}" "${WASM_TARGETS[@]}")
+  local constrained_targets=(
+    "${NOSTD_TARGETS[@]:+${NOSTD_TARGETS[@]}}"
+    "${WASM_TARGETS[@]:+${WASM_TARGETS[@]}}"
+  )
 
   echo ""
   echo "Constrained targets ${DIM}($CONSTRAINED_SCOPE)${RESET}"
@@ -246,7 +250,7 @@ done
 if [[ "$FEATURE_MODE_SET" == false ]]; then
   HOST_ARGS+=(--feature-matrix)
 fi
-select_constrained_crates "${SCOPE_ARGS[@]}"
+select_constrained_crates "${SCOPE_ARGS[@]:+${SCOPE_ARGS[@]}}"
 
 # Run host checks first (most likely to fail, fastest feedback)
 "$SCRIPT_DIR/check.sh" "${HOST_ARGS[@]}"
@@ -260,13 +264,13 @@ trap 'rm -rf "$log_dir"' EXIT
 jobs=(windows linux ibm constrained)
 pids=()
 
-("$SCRIPT_DIR/check-win.sh" "${SCOPE_ARGS[@]}") >"$log_dir/windows.log" 2>&1 &
+("$SCRIPT_DIR/check-win.sh" "${SCOPE_ARGS[@]:+${SCOPE_ARGS[@]}}") >"$log_dir/windows.log" 2>&1 &
 pids+=( "$!" )
 
-("$SCRIPT_DIR/check-linux.sh" "${SCOPE_ARGS[@]}") >"$log_dir/linux.log" 2>&1 &
+("$SCRIPT_DIR/check-linux.sh" "${SCOPE_ARGS[@]:+${SCOPE_ARGS[@]}}") >"$log_dir/linux.log" 2>&1 &
 pids+=( "$!" )
 
-("$SCRIPT_DIR/check-ibm.sh" "${SCOPE_ARGS[@]}") >"$log_dir/ibm.log" 2>&1 &
+("$SCRIPT_DIR/check-ibm.sh" "${SCOPE_ARGS[@]:+${SCOPE_ARGS[@]}}") >"$log_dir/ibm.log" 2>&1 &
 pids+=( "$!" )
 
 (run_constrained_checks) >"$log_dir/constrained.log" 2>&1 &

scripts/check/check-feature-matrix.sh

@@ -54,7 +54,7 @@ for i in "${!FEATURE_SETS[@]}"; do
   log_path="$LOG_DIR/${display//,/_}.log"
 
   step "[$profile/$TOTAL] cargo check --no-default-features --features $display"
-  args=(check -p rscrypto --no-default-features --lib)
+  args=(check --locked -p rscrypto --no-default-features --lib)
   if [[ -n "$feature_set" ]]; then
     args+=(--features "$feature_set")
   fi

scripts/check/check-ibm.sh

@@ -54,7 +54,7 @@ for i in "${!IBM_TARGETS[@]}"; do
   (
     # shellcheck disable=SC2086
     if ! CC="$ZIG_CC" RUSTC_WRAPPER="" CARGO_TARGET_DIR="$target_dir" \
-      cargo clippy $CRATE_FLAGS --lib --all-features --target "$target" -- -D warnings \
+      cargo clippy $CRATE_FLAGS --lib --all-features --locked --target "$target" -- -D warnings \
       >"$log_file" 2>&1; then
       exit 1
     fi

scripts/check/check-linux.sh

@@ -54,7 +54,7 @@ for i in "${!LINUX_TARGETS[@]}"; do
   (
     # shellcheck disable=SC2086
     if ! CC="$ZIG_CC" RUSTC_WRAPPER="" CARGO_TARGET_DIR="$target_dir" \
-         cargo clippy $CRATE_FLAGS --lib --all-features --target "$target" -- -D warnings \
+         cargo clippy $CRATE_FLAGS --lib --all-features --locked --target "$target" -- -D warnings \
          >"$log_file" 2>&1; then
       exit 1
     fi

scripts/check/check-win.sh

@@ -42,7 +42,7 @@ fi
 step "Initializing SDK cache"
 if ! XWIN_CACHE_DIR="$XWIN_CACHE_DIR_DEFAULT" \
      CARGO_TARGET_DIR="target/cross-check/xwin-init" \
-     cargo xwin check -p rscrypto --no-default-features --lib --target x86_64-pc-windows-msvc \
+     cargo xwin check --locked -p rscrypto --no-default-features --lib --target x86_64-pc-windows-msvc \
      >"$LOG_DIR/xwin-init.log" 2>&1; then
   # In sandboxed/offline environments, cargo-xwin can't fetch the MSVC CRT / SDK.
   # Treat that as a skip rather than a hard failure, while still surfacing
@@ -85,7 +85,7 @@ for i in "${!WIN_TARGETS[@]}"; do
     # shellcheck disable=SC2086
     if ! XWIN_CACHE_DIR="$target_cache_dir" \
          CARGO_TARGET_DIR="$target_dir" \
-         cargo xwin clippy $CRATE_FLAGS --lib --all-features --target "$target" -- -D warnings \
+         cargo xwin clippy $CRATE_FLAGS --lib --all-features --locked --target "$target" -- -D warnings \
          >"$log_file" 2>&1; then
       exit 1
     fi

scripts/check/check.sh

@@ -60,7 +60,7 @@ echo "Host checks ${DIM}($SCOPE_DESC)${RESET}"
 
 # Format
 step "Formatting"
-if ! cargo fmt --all >"$LOG_DIR/fmt.log" 2>&1; then
+if ! cargo fmt --all -- --check >"$LOG_DIR/fmt.log" 2>&1; then
   fail
   show_error "$LOG_DIR/fmt.log"
   exit 1
@@ -94,7 +94,7 @@ ok
 # Check
 step "Checking"
 # shellcheck disable=SC2086
-if ! cargo check $CRATE_FLAGS --all-targets --all-features >"$LOG_DIR/check.log" 2>&1; then
+if ! cargo check $CRATE_FLAGS --all-targets --all-features --locked >"$LOG_DIR/check.log" 2>&1; then
   fail
   show_error "$LOG_DIR/check.log"
   exit 1
@@ -124,7 +124,7 @@ fi
 # Clippy
 step "Linting"
 # shellcheck disable=SC2086
-if ! cargo clippy $CRATE_FLAGS --all-targets --all-features -- -D warnings >"$LOG_DIR/clippy.log" 2>&1; then
+if ! cargo clippy $CRATE_FLAGS --all-targets --all-features --locked -- -D warnings >"$LOG_DIR/clippy.log" 2>&1; then
   fail
   show_error "$LOG_DIR/clippy.log"
   exit 1
@@ -134,7 +134,7 @@ ok
 # Audit/Deny (workspace only). CI owns this in the dedicated supply-chain lane.
 if [[ "$FULL_WORKSPACE" == true && "${RSCRYPTO_SKIP_CHECK_SUPPLY_CHAIN:-}" != "1" ]]; then
   step "Auditing deps"
-  if ! cargo deny check all >"$LOG_DIR/deny.log" 2>&1; then
+  if ! cargo deny --locked check all >"$LOG_DIR/deny.log" 2>&1; then
     fail
     show_error "$LOG_DIR/deny.log"
     exit 1
@@ -153,7 +153,7 @@ fi
 # Documentation
 step "Building docs"
 # shellcheck disable=SC2086
-if ! cargo doc $CRATE_FLAGS --no-deps --all-features >"$LOG_DIR/doc.log" 2>&1; then
+if ! cargo doc $CRATE_FLAGS --no-deps --all-features --locked >"$LOG_DIR/doc.log" 2>&1; then
   fail
   show_error "$LOG_DIR/doc.log"
   exit 1

scripts/check/zeroize-evidence.sh

@@ -6,6 +6,7 @@ TARGET_DIR="$ROOT/target/zeroize-evidence"
 MANIFEST="$ROOT/Cargo.toml"
 
 RUSTC_WRAPPER="" CARGO_TARGET_DIR="$TARGET_DIR" cargo rustc \
+  --locked \
   --manifest-path "$MANIFEST" \
   --release \
   --lib \