feat: consolidate pending TraceDecay changes

.github/actions/build-cli/action.yml

@@ -37,6 +37,7 @@ runs:
       id: bazel
       if: inputs.prepared-build != 'true'
       with:
+        remote-download-outputs: toplevel
         cache-key: ${{ inputs.cache-key }}
         tailscale-client-id: ${{ inputs.tailscale-client-id }}
 

.github/actions/setup-bazel/action.yml

@@ -1,7 +1,8 @@
 name: Set up Bazel
 description: >
   Installs Bazel through the pinned bazelisk with its repository cache, and a
-  disk cache named by `cache-key` that only master saves automatically: PRs
+  disk cache for hosted-only execution named by `cache-key`. Only master saves
+  automatically: PRs
   restore master's entry; explicit native Windows dispatches may also prime
   their branch's cache. Jobs with the same configuration and
   runner image share a restore prefix; master callers save fresh
@@ -18,6 +19,9 @@ inputs:
       prefix misses. Use when two jobs share rustc flags and runner image so
       Clippy can reuse Test Linux action outputs.
     default: ""
+  remote-download-outputs:
+    description: Remote outputs to materialize; packaging jobs require toplevel.
+    default: "minimal"
   cache-save:
     description: Whether this setup may save Bazelisk and repository caches.
     default: "true"
@@ -42,6 +46,53 @@ outputs:
 runs:
   using: composite
   steps:
+    - name: Free runner disk space
+      if: runner.os == 'Linux' && runner.environment == 'github-hosted'
+      shell: bash
+      run: |
+        set -euo pipefail
+        df -h /
+        status=0
+        sudo rm -rf /usr/local/lib/android &
+        p1=$!
+        sudo rm -rf /usr/share/dotnet &
+        p2=$!
+        sudo rm -rf /opt/ghc &
+        p3=$!
+        sudo rm -rf /opt/hostedtoolcache/CodeQL &
+        p4=$!
+        for pid in "$p1" "$p2" "$p3" "$p4"; do
+          wait "$pid" || status=1
+        done
+        df -h /
+        exit "$status"
+
+    - name: Remove inactive Xcode installations
+      if: runner.os == 'macOS' && runner.environment == 'github-hosted'
+      shell: bash
+      run: |
+        df -h /
+        python3 - <<'PYTHON'
+        import pathlib
+        import subprocess
+
+        applications = pathlib.Path("/Applications")
+        selected = pathlib.Path(subprocess.check_output(["xcode-select", "-p"], text=True).strip()).resolve(strict=True)
+        active = next((path for path in selected.parents if path.suffix == ".app"), None)
+        if active is None:
+            raise SystemExit(f"Selected developer directory is not an Xcode application: {selected}")
+        print(f"Selected Xcode before cleanup: {active}", flush=True)
+        inactive = [path for path in applications.glob("Xcode*.app") if path.resolve() != active]
+        for path in inactive:
+            print(f"Removing inactive Xcode: {path}", flush=True)
+            subprocess.run(["sudo", "rm", "-rf", "--", str(path)], check=True)
+        after = pathlib.Path(subprocess.check_output(["xcode-select", "-p"], text=True).strip()).resolve(strict=True)
+        if after != selected:
+            raise SystemExit(f"Selected developer directory changed: {selected} -> {after}")
+        print(f"Selected Xcode after cleanup: {active}", flush=True)
+        PYTHON
+        df -h /
+
     - name: Verify Windows build runner configuration
       if: runner.os == 'Windows' && runner.environment == 'github-hosted'
       shell: pwsh
@@ -104,18 +155,6 @@ runs:
         );
         JS
 
-    - uses: bazel-contrib/setup-bazel@104e3eea9447cdaa4b00d0fb46191a3985d26ab3 # 0.19.1
-      with:
-        bazelisk-cache: true
-        repository-cache: true
-        disk-cache: false
-        bazelrc: >-
-          build --disk_cache=${{ steps.disk-cache-config.outputs.path }}
-        cache-save: ${{ github.ref == 'refs/heads/master' && inputs.cache-save == 'true' }}
-        # Windows build-script runfiles nest each vendored crate's sources
-        # under its repository name twice; keep the output base short.
-        output-base: ${{ steps.disk-cache-config.outputs.output-base }}
-
     - name: Preserve the runner network environment for Tailscale
       if: runner.os == 'Linux' && inputs.tailscale-client-id != ''
       shell: bash
@@ -153,6 +192,7 @@ runs:
       shell: bash
       env:
         TAILSCALE_OUTCOME: ${{ steps.tailscale.outcome }}
+        REMOTE_DOWNLOAD_OUTPUTS: ${{ inputs.remote-download-outputs }}
       run: |
         if [[ "$TAILSCALE_OUTCOME" == success ]]; then
           # Resolve the peer through the local API without changing runner DNS.
@@ -168,6 +208,18 @@ runs:
         fi
         python3 "$GITHUB_ACTION_PATH/configure_fleet.py"
 
+    - uses: bazel-contrib/setup-bazel@104e3eea9447cdaa4b00d0fb46191a3985d26ab3 # 0.19.1
+      with:
+        bazelisk-cache: true
+        repository-cache: true
+        disk-cache: false
+        bazelrc: >-
+          build --disk_cache=${{ steps.fleet.outputs.enabled != 'true' && steps.disk-cache-config.outputs.path || '' }}
+        cache-save: ${{ github.ref == 'refs/heads/master' && inputs.cache-save == 'true' }}
+        # Windows build-script runfiles nest each vendored crate's sources
+        # under its repository name twice; keep the output base short.
+        output-base: ${{ steps.disk-cache-config.outputs.output-base }}
+
     - name: Map the shared Windows compiler path
       if: steps.fleet.outputs.enabled == 'true' && runner.os == 'Windows'
       shell: pwsh
@@ -207,3 +259,8 @@ runs:
         path: ${{ steps.disk-cache-config.outputs.path }}
         key: ${{ steps.disk-cache-config.outputs.prefix }}run-${{ github.run_id }}-${{ github.run_attempt }}-${{ github.job }}
         restore-keys: ${{ steps.disk-cache-config.outputs.restore-keys }}
+
+    - name: Report available build storage
+      continue-on-error: true
+      shell: bash
+      run: bash "$GITHUB_ACTION_PATH/report_disk.sh"

.github/actions/setup-bazel/configure_fleet.py

@@ -16,7 +16,10 @@ def configure_fleet(
     runner_arch: str,
     host: str = "ubuntu-main",
     port: int = 50051,
+    remote_download_outputs: str = "minimal",
 ) -> bool:
+    if remote_download_outputs not in {"minimal", "toplevel", "all"}:
+        raise ValueError(f"Invalid remote output mode: {remote_download_outputs}")
     profile = {
         ("Linux", "X64"): "rbe-linux",
         ("macOS", "ARM64"): "rbe-macos",
@@ -77,7 +80,7 @@ def configure_fleet(
 build --remote_timeout=600
 # Survive brief coordinator restarts; five retries expire in about 3s.
 build --remote_retries=10
-build --remote_download_outputs=toplevel
+build --remote_download_outputs={remote_download_outputs}
 build --jobs={16 if windows else 40}
 # Leave room for Bazel analysis and downloads while large Rust actions compile.
 build --local_resources=cpu=2
@@ -108,4 +111,5 @@ def configure_fleet(
         os.environ["RUNNER_OS"],
         os.environ["RUNNER_ARCH"],
         host=os.environ.get("BAZEL_FLEET_HOST", "ubuntu-main"),
+        remote_download_outputs=os.environ.get("REMOTE_DOWNLOAD_OUTPUTS", "minimal"),
     )

.github/actions/setup-bazel/report_disk.sh

@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+echo '::group::Build filesystem capacity'
+df -h "$GITHUB_WORKSPACE" "$HOME" "$RUNNER_TEMP"
+df -i "$GITHUB_WORKSPACE"
+echo '::endgroup::'
+echo '::group::Build outputs, caches, and temporary files'
+for path in "$GITHUB_WORKSPACE/bazel-out/" "$HOME/.cache" "$RUNNER_TEMP"; do
+  if [[ -d "$path" ]]; then
+    du -sh "$path"
+  fi
+done
+echo '::endgroup::'

.github/workflows/ci.yml

@@ -161,6 +161,13 @@ jobs:
           if-no-files-found: error
           retention-days: 1
 
+      - name: Report final build disk usage
+        if: ${{ always() && hashFiles('.github/actions/setup-bazel/report_disk.sh') != '' }}
+        continue-on-error: true
+        timeout-minutes: 2
+        shell: bash
+        run: bash .github/actions/setup-bazel/report_disk.sh
+
   benchmark-harness:
     name: Benchmark harness self-tests
     runs-on: ubuntu-latest
@@ -324,6 +331,13 @@ jobs:
       - name: Check rusqlite stays inside storage owners
         run: python3 scripts/check-rusqlite-storage-boundary.py
 
+      - name: Report final build disk usage
+        if: ${{ always() && hashFiles('.github/actions/setup-bazel/report_disk.sh') != '' }}
+        continue-on-error: true
+        timeout-minutes: 2
+        shell: bash
+        run: bash .github/actions/setup-bazel/report_disk.sh
+
   # The macOS and Windows lanes run the same Bazel workspace the Linux
   # authority does, on demand: they exercise target-specific behavior the
   # Linux lane cannot prove.
@@ -343,31 +357,6 @@ jobs:
         with:
           fetch-depth: 0
 
-      - name: Remove inactive Xcode installations
-        shell: bash
-        run: |
-          df -h /
-          python3 - <<'PYTHON'
-          import pathlib
-          import subprocess
-
-          applications = pathlib.Path("/Applications")
-          selected = pathlib.Path(subprocess.check_output(["xcode-select", "-p"], text=True).strip()).resolve(strict=True)
-          active = next((path for path in selected.parents if path.suffix == ".app"), None)
-          if active is None:
-              raise SystemExit(f"Selected developer directory is not an Xcode application: {selected}")
-          print(f"Selected Xcode before cleanup: {active}", flush=True)
-          inactive = [path for path in applications.glob("Xcode*.app") if path.resolve() != active]
-          for path in inactive:
-              print(f"Removing inactive Xcode: {path}", flush=True)
-              subprocess.run(["sudo", "rm", "-rf", "--", str(path)], check=True)
-          after = pathlib.Path(subprocess.check_output(["xcode-select", "-p"], text=True).strip()).resolve(strict=True)
-          if after != selected:
-              raise SystemExit(f"Selected developer directory changed: {selected} -> {after}")
-          print(f"Selected Xcode after cleanup: {active}", flush=True)
-          PYTHON
-          df -h /
-
       - uses: ./.github/actions/setup-bazel
         id: bazel
         with:
@@ -418,6 +407,13 @@ jobs:
           path: ${{ steps.bazel.outputs.disk-cache-path }}
           key: ${{ steps.bazel.outputs.disk-cache-key }}
 
+      - name: Report final build disk usage
+        if: ${{ always() && hashFiles('.github/actions/setup-bazel/report_disk.sh') != '' }}
+        continue-on-error: true
+        timeout-minutes: 2
+        shell: bash
+        run: bash .github/actions/setup-bazel/report_disk.sh
+
   # A trusted fleet run submits the whole workspace from one hosted runner.
   # Hosted-only runs retain their shards so local CPU and disk limits do not
   # serialize the entire workspace. Both routes feed the Test Linux check.
@@ -461,29 +457,6 @@ jobs:
                     || (github.actor_id == '158243242' && vars.TS_BAZEL_BOT_CLIENT_ID)
                     || (github.actor_id == '29139614' && vars.TS_BAZEL_RENOVATE_CLIENT_ID)) || '' }}
 
-      # Fleet measurements leave about 46 GiB free without deleting SDKs.
-      # Keep cleanup for unmeasured hosted shards and fleet fallback, where
-      # local builds have previously exhausted the runner disk.
-      - name: Free runner disk space
-        if: matrix.shard != 'fleet' || steps.bazel.outputs.fleet-enabled != 'true'
-        run: |
-          set -euo pipefail
-          df -h /
-          status=0
-          sudo rm -rf /usr/local/lib/android &
-          p1=$!
-          sudo rm -rf /usr/share/dotnet &
-          p2=$!
-          sudo rm -rf /opt/ghc &
-          p3=$!
-          sudo rm -rf /opt/hostedtoolcache/CodeQL &
-          p4=$!
-          for pid in "$p1" "$p2" "$p3" "$p4"; do
-            wait "$pid" || status=1
-          done
-          df -h /
-          exit "$status"
-
       - name: Select Linux test targets
         id: targets
         env:
@@ -605,11 +578,6 @@ jobs:
               prebuild=false
             fi
           fi
-          if [[ $SHARD == fleet ]]; then
-            # Keep test binaries and intermediate outputs in the remote CAS.
-            # Bazel still downloads test logs and XML for failure diagnostics.
-            echo 'build --remote_download_outputs=minimal' >> .bazelrc.local
-          fi
           {
             echo "patterns=${targets[*]}"
             echo "prebuild=$prebuild"
@@ -647,6 +615,13 @@ jobs:
           path: ${{ steps.bazel.outputs.disk-cache-path }}
           key: ${{ steps.bazel.outputs.disk-cache-key }}
 
+      - name: Report final build disk usage
+        if: ${{ always() && hashFiles('.github/actions/setup-bazel/report_disk.sh') != '' }}
+        continue-on-error: true
+        timeout-minutes: 2
+        shell: bash
+        run: bash .github/actions/setup-bazel/report_disk.sh
+
   # Preserves the "Test Linux" check name for branch protection.
   linux-test-result:
     name: Test Linux
@@ -795,6 +770,13 @@ jobs:
             exit 1
           fi
 
+      - name: Report final build disk usage
+        if: ${{ always() && hashFiles('.github/actions/setup-bazel/report_disk.sh') != '' }}
+        continue-on-error: true
+        timeout-minutes: 2
+        shell: bash
+        run: bash .github/actions/setup-bazel/report_disk.sh
+
   # Blocking Clippy policy over every Bazel Rust target, the
   # `cargo clippy --workspace --all-targets -D warnings` equivalent.
   clippy:
@@ -838,6 +820,13 @@ jobs:
           path: ${{ steps.bazel.outputs.disk-cache-path }}
           key: ${{ steps.bazel.outputs.disk-cache-key }}
 
+      - name: Report final build disk usage
+        if: ${{ always() && hashFiles('.github/actions/setup-bazel/report_disk.sh') != '' }}
+        continue-on-error: true
+        timeout-minutes: 2
+        shell: bash
+        run: bash .github/actions/setup-bazel/report_disk.sh
+
   # Branch protection requires this check name. The generator feature policy
   # test (`//scripts:gen_builds_test`) runs inside Repository gates, whose
   # Bazel analysis it shares; on its own runner it paid 52 s of Bazel setup
@@ -914,6 +903,13 @@ jobs:
           TRACEDECAY_BIN="$binary" bazel run //scripts:mcp-conformance-smoke.sh
           bazel run //scripts:packaged_lsp_bridge -- "$binary" "$smoke_work/lsp"
 
+      - name: Report final build disk usage
+        if: ${{ always() && hashFiles('.github/actions/setup-bazel/report_disk.sh') != '' }}
+        continue-on-error: true
+        timeout-minutes: 2
+        shell: bash
+        run: bash .github/actions/setup-bazel/report_disk.sh
+
   # Frontend checks require no Rust compilation and must also validate drafts.
   # Do not serialize them behind repository-wide Rust formatting and gates.
   dashboard:
@@ -985,6 +981,13 @@ jobs:
           path: ${{ steps.bazel.outputs.disk-cache-path }}
           key: ${{ steps.bazel.outputs.disk-cache-key }}
 
+      - name: Report final build disk usage
+        if: ${{ always() && hashFiles('.github/actions/setup-bazel/report_disk.sh') != '' }}
+        continue-on-error: true
+        timeout-minutes: 2
+        shell: bash
+        run: bash .github/actions/setup-bazel/report_disk.sh
+
   hermes-integration:
     name: Hermes integration (stock)
     needs: debug-cli
@@ -1081,4 +1084,3 @@ jobs:
         env:
           TRACEDECAY_BIN: ${{ github.workspace }}/target/debug/tracedecay
         run: scripts/opencode_stock_integration.sh
-

.github/workflows/hermetic-evals.yml

@@ -56,3 +56,10 @@ jobs:
           --test_output=errors
       - name: Execute stock-edit oracle regressions
         run: python3 evals/agent_adoption/stock_check_selftest.py
+
+      - name: Report final build disk usage
+        if: ${{ always() && hashFiles('.github/actions/setup-bazel/report_disk.sh') != '' }}
+        continue-on-error: true
+        timeout-minutes: 2
+        shell: bash
+        run: bash .github/actions/setup-bazel/report_disk.sh