chore(ce): enrol ci-wall-clock and repin the compound packs to de684e25

[systemfsoftware-maker]

CE planning and review in gritlint now load the ci-wall-clock compound pack, and the pack pin moves to systemfsoftware main. This is gritlint's ci-wall-clock enrolment PR: until it merges, gritlint reviews read ci-wall-clock by hand from a systemfsoftware commit (PR #20 used 763fd663).

What changes

One file, .compound-engineering/config.yaml:

• ref: moves from 02bf9653b1ca2b0a2951baf2743bb3f70d19fc77 to de684e25d6d06e6686e06827b24235a3fd73bdf4, the tip of systemfsoftware main on 2026-10-13. Its parent is 31afc65e1ff3e00887985f52caf77a746fc45544, and the compare API puts it 1 ahead of 31afc65e1f and 9 ahead of the old pin, 0 behind either.
• pack: gains ci-wall-clock. The five packs already enrolled stay. turbo-task-graph, ui-state and storybook-testing exist at the pin but are not enrolled: gritlint has no root turbo.json, no .tsx file and no story.

CE's packs-resolve.py, run in this branch, returns six roots with warnings: [] and errors: [] (exit 0), and --declared-only returns declared: true, errors: [].

What the new pin changes in the packs already enrolled

The pin also changes the rules the five kept packs grade with. Rule files at each pin (git diff --name-status 02bf9653 de684e25 -- compound-packs/<pack>, README edits left out):

Pack	Rules at 02bf9653	Rules at de684e25	Added	Removed	Edited
boundary-testing	6	7	expected-values-never-come-from-the-subjects-output		no-mocks-on-internal-glue, port-fakes-pass-the-port-contract, real-system-oracles
cell-architecture	15	15			service-and-layer-boundaries
ci-wall-clock	not enrolled	15	all 15
mutation-discipline	3	3			kill-survivors-with-contract-properties, unkillable-survivors-are-dead-code
package-topology	7	7
schema-laws	10	9	refusal-properties-cover-unobservable-boundaries	law-failure-is-a-codec-defect, refusals-beside-generated-laws	cross-field-invariants-as-struct-checks, invariants-as-refinements, recursive-schema-suspend, rich-type-over-foreign-encoded, tests-own-no-schemas
Total	41	56

The two schema-laws removals are upstream decisions at the pin, and this PR accepts them as part of the repin.

CI wall clock

Target: every pull-request job finishes within 10 minutes (ci-wall-clock/pr-gate-runs-only-what-the-diff-affects; R27 of gritlint's plan docs/plans/2026-10-12-2059-feat-gritlint-standalone-plan.md).

This PR's own run, 38456326800, is within it: x86_64 took 2m28s and aarch64 1m55s. The x86_64 job restored main's bundle nix-store-x86_64-linux-88683b6d… as an exact hit, and its build step took 9 s.

Measured exception (F3): a pull request that changes the workspace version or Cargo.lock takes about 12 minutes on x86_64. The version PR #22 (run 38450576392) restored the same main bundle (88683b6d…) and still took 12m01s:

Step (x86_64, jobs API)	#22, version bump	#23, this PR
Setup, checkout, Nix install, unsupported-system check	15 s	14 s
Every flake output for this system (evaluation)	1m20s	1m20s
Nix store cache restore and load	40 s	34 s
Build every flake output	9m32s	9 s
Tarball, upload, cargo deny	9 s	7 s
Job	12m01s	2m28s

The cause is structural, not a cold cache. Both runs started from the same restored bundle, and #22 changes only workspace versions (0.2.0 → 0.3.0 in Cargo.toml, Cargo.lock and npm/gritlint/package.json). crane's dependency derivations carry that version, so #22 planned 30 builds, including gritlint-deps-0.3.0 (three of them) and gritlint-linux-x64-deps-0.3.0 and gritlint-linux-arm64-deps-…-0.3.0. The longest of the three gritlint-deps-0.3.0 builds logged buildPhase completed in 4 minutes 48 seconds, and the builds that wait on them filled the rest of the 9m32s. The push of #20's merge to main (run 38447766893, 13m01s) is the same case: #20 added the LSP crates to Cargo.lock, so it rebuilt gritlint-deps-0.2.0 from an older bundle.

• Owner: a gritlint follow-up PR, after this one, that makes the dependency derivations independent of the workspace version (crane's dummy source and derivation name still carry it after fix(nix): vendor cargo deps with crane, independent of workspace versions #19 fixed the vendor hash).
• Trigger: the next version PR. Every version bump pays this until the follow-up lands.
• Job timeouts stay at the uniform 60-minute backstop.

Review receipt

ce-code-review full path (depth: full, base 187c25c1, head bca291de), run 20261013-193127-fb7955e8. Reviewers: correctness; project-standards against repos/constitution/CONSTITUTION.md at de684e25 (byte-identical to the copy at 02bf9653); learnings over all six pack roots and docs/solutions/; and the cross-model adversarial pass. Testing, maintainability, reliability, security, performance and api-contract were not selected because the diff changes no runtime behaviour. Verdict: Ready to merge. 0 P0/P1/P2, 2 P3 advisories, validator batch empty (nothing selected).

Cross-model pass: adversarial-reviewer, served by deepseek/deepseek-v4.1-flash (29 turns, 1m41s). The host family is Claude, so this is a different model family. No CE worker receipt exists, so independence_verified stays false and its findings promote nothing. The three local reviewers were also served by deepseek/deepseek-v4.1-flash. No Grok or xai model served any reviewer. All four returned, and none timed out.

Every finding and reviewer note, ruled

Item	Source	Ruling
#1 P3: the repin changes the rules of the kept packs without saying so	adversarial	Fixed in this body: the per-pack table above lists every added, removed and edited rule.
#2 P3: the F3 cause is not isolated by the cited runs	adversarial	Fixed in this body: #23 is the control (same restored bundle, 9 s build), and the comparison shows the version-only rebuild. The report called the #20 merge push "non-dependency". That is wrong, because #20 changed Cargo.lock (+66 lines).
The pin is a branch tip and will not follow later main commits	correctness, project-standards, learnings	Rejected: a full-SHA pin is the reproducible form CE requires (ref must be a SHA or tag), and a later repin is a deliberate PR like this one.
Ancestry of 31afc65e1f not provable in a shallow clone	project-standards, learnings	Rejected: de684e25's commit object names 31afc65e1f as its parent, and the compare API reports ahead 1, behind 0.
The resolver result was taken from a recorded file, not re-run	correctness, project-standards	Rejected: the dispatch context ran packs-resolve.py in this branch (6 roots, no warnings or errors), and the adversarial reviewer reproduced it.
No check fails if a declared pack stops resolving; the resolver warns and exits 0	all four (testing gap), adversarial (residual)	Rejected for this PR: a new CI gate needs operator sign-off (GATE1), and #7 declined the same check for that reason. Every full-path receipt lists the resolved roots, so a missing root shows at review time. This one lists six.
F3 will keep exceeding the target on version PRs	learnings	Follow-up F3, owner and trigger above.
The resolver cache might serve the old pin's checkout	adversarial	Rejected by the adversarial reviewer itself: the cache key is sha256(url + "\n" + ref), so a new ref clones fresh.
ci-wall-clock/mutation-runs-nightly-on-main names a lane on every push to main; gritlint's mutants.yml runs on push: [main]	found while ruling this PR	Pre-existing, not touched here (the rule's applies_when covers changes to a mutation workflow's triggers). Owner: the queued Mutants-nightly change. Trigger: after this PR merges.

Constitution treatment (16 laws, CONSTITUTION.md at de684e25)

Law	Verdict	Evidence at head
CONST-B1	comply	.compound-engineering/config.yaml:3 ref: de684e25d6d06e6686e06827b24235a3fd73bdf4
CONST-B4	comply	.compound-engineering/config.yaml:2 - source: https://github.com/systemfsoftware/systemfsoftware
CONST-D1	not-applicable	.compound-engineering/config.yaml:1 packs:
CONST-D2	not-applicable	.compound-engineering/config.yaml:5 pack: [boundary-testing, cell-architecture, ci-wall-clock, mutation-discipline, package-topology, schema-laws]
CONST-D4	not-applicable	.compound-engineering/config.yaml:5 pack: [boundary-testing, cell-architecture, ci-wall-clock, mutation-discipline, package-topology, schema-laws]
CONST-E7	comply	.compound-engineering/config.yaml:5 pack: [boundary-testing, cell-architecture, ci-wall-clock, mutation-discipline, package-topology, schema-laws]
CONST-N1	comply	.compound-engineering/config.yaml:5 pack: [boundary-testing, cell-architecture, ci-wall-clock, mutation-discipline, package-topology, schema-laws]
CONST-N3	comply	.compound-engineering/config.yaml:5 pack: [boundary-testing, cell-architecture, ci-wall-clock, mutation-discipline, package-topology, schema-laws]
CONST-S1	comply	.compound-engineering/config.yaml:3 ref: de684e25d6d06e6686e06827b24235a3fd73bdf4
CONST-S2	comply	.compound-engineering/config.yaml:3 ref: de684e25d6d06e6686e06827b24235a3fd73bdf4
CONST-S4	comply	.compound-engineering/config.yaml:5 pack: [boundary-testing, cell-architecture, ci-wall-clock, mutation-discipline, package-topology, schema-laws]
CONST-T10	not-applicable	.compound-engineering/config.yaml:1 packs:
CONST-T12	comply	.compound-engineering/config.yaml:5 pack: [boundary-testing, cell-architecture, ci-wall-clock, mutation-discipline, package-topology, schema-laws]
CONST-T3	not-applicable	.compound-engineering/config.yaml:1 packs:
CONST-T8	not-applicable	.compound-engineering/config.yaml:2 - source: https://github.com/systemfsoftware/systemfsoftware
CONST-W1	comply	.compound-engineering/config.yaml:5 pack: [boundary-testing, cell-architecture, ci-wall-clock, mutation-discipline, package-topology, schema-laws]

Pack rules (56 rule files in the six roots; none applies to a one-file CE config change)

Every row's evidence is the two changed lines, .compound-engineering/config.yaml:3 (ref:) and :5 (pack:). Each verdict comes from the rule's applies_when matched to the diff by meaning.

Pack	Rule	Verdict	Why
boundary-testing	expected-values-never-come-from-the-subjects-output.md	not-applicable	applies to a test comparing a generator's output against a file it reads; this diff adds no test and no generated file, only a CE config ref/pack change.
boundary-testing	fake-and-real-store-laws.md	not-applicable	applies to store fakes/adapters and store integration tests; no store, adapter, or test is touched.
boundary-testing	no-mocks-on-internal-glue.md	not-applicable	applies to boundary-adapter/VM tests and mocks; the diff adds no test, mock, or boundary module.
boundary-testing	pin-dependency-semantics.md	not-applicable	applies when adopting/upgrading/wrapping a third-party driver or protocol; the diff repins a docs/config source of review packs, not a runtime dependency, and adds no differential test.
boundary-testing	port-fakes-pass-the-port-contract.md	not-applicable	applies to fakes/stand-ins for a port; no port, fake, or stub is added.
boundary-testing	real-system-oracles.md	not-applicable	applies to integration/oracle tests and CI steps reaching a remote service; the diff adds no test or CI step.
boundary-testing	staged-protocol-evidence.md	not-applicable	applies to wrapping a protocol/client lifecycle; no such adapter is touched.
cell-architecture	callable-vs-resource-syntax.md	not-applicable	applies to ADT/handle invocation ergonomics in TS packages; the diff touches no code.
cell-architecture	decode-never-cast.md	not-applicable	applies to decoding external input at I/O boundaries; no decoder or I/O boundary is changed.
cell-architecture	four-channel-contracts.md	not-applicable	applies to Cell<I,A,E,R> signatures; no Cell or TypeScript is present in the change.
cell-architecture	handle-state-privacy.md	not-applicable	applies to handle/service state encapsulation; no handle or service is touched.
cell-architecture	pipeable-dual-parity.md	not-applicable	applies to blueprint/handle combinators; no blueprint or fluent API is changed.
cell-architecture	pipeline-composition.md	not-applicable	applies to composing cells into a workflow; no pipeline is changed.
cell-architecture	pure-decision-workflows.md	not-applicable	applies to *.workflow.ts deciders; the diff changes no workflow file.
cell-architecture	resource-vs-handle-duality.md	not-applicable	applies to blueprint/handle lifecycle design; no such entity is touched.
cell-architecture	sandwich-phase-order.md	not-applicable	applies to authoring an outside interaction/endpoint; the diff authors none.
cell-architecture	scoped-lifecycle-boundaries.md	not-applicable	applies to Effect Scope/finalizer compilation; no scope or finalizer code is changed.
cell-architecture	service-and-layer-boundaries.md	not-applicable	applies to Context.Service/Layer placement; no service or layer file is touched (gritlint is Rust, and the diff is YAML).
cell-architecture	single-namespace-barrel.md	not-applicable	applies to mod.ts/index.ts export topology; no package exports are changed.
cell-architecture	staged-lawful-builders.md	not-applicable	applies to blueprint builder algebras; no builder or spec model is touched.
cell-architecture	store-serializable-unit-of-work.md	not-applicable	applies to read-decide-save concurrency in a store; no store or transaction code is changed.
cell-architecture	store-unit-of-work-handle.md	not-applicable	applies to store unit-of-work handles; no store port or adapter is touched.
ci-wall-clock	failures-name-the-gate-and-location.md	not-applicable	applies when adding/changing a CI job or verdict step (continue-on-error/// true); the diff changes no workflow.
ci-wall-clock	flake-outputs-build-once-on-main.md	not-applicable	applies when a workflow builds/caches/restores a flake output or permissions change; the diff changes no workflow, flake, or runner config.
ci-wall-clock	gates-share-one-job.md	not-applicable	applies when adding/splitting a PR gate job or its checkout/install; the diff changes no workflow job.
ci-wall-clock	heavy-lanes-state-their-daily-minutes.md	not-applicable	applies when adding/changing a heavy lane; no heavy lane or trigger is changed.
ci-wall-clock	heavy-suites-judge-every-main-commit.md	not-applicable	applies to full-stack/full-corpus postsubmit lanes and concurrency; no lane or concurrency is changed.
ci-wall-clock	light-checks-run-the-pinned-tool.md	not-applicable	applies to commit-message/changeset/PR-title check jobs; no such job is changed.
ci-wall-clock	local-gate-equals-pr-gate.md	not-applicable	applies when changing a root gate script or an agent instruction's pre-push command; the diff changes no gate script or agent instruction file.
ci-wall-clock	mutation-runs-nightly-on-main.md	not-applicable	applies to mutation workflow triggers/triage; no mutation workflow is changed by the diff.
ci-wall-clock	no-dev-shell-on-verdict-lanes.md	not-applicable	applies to lint/typecheck/test jobs entering a dev shell; no workflow job is changed.
ci-wall-clock	no-lane-grades-the-repos-own-docs.md	not-applicable	applies when adding a CI job/check or changing what it validates; the diff adds none.
ci-wall-clock	one-stuck-job-backstop.md	not-applicable	applies to jobs with runs-on and their timeout-minutes; no job or timeout is changed.
ci-wall-clock	pr-gate-runs-only-what-the-diff-affects.md	not-applicable	applies when changing a PR job/trigger/paths or reviewing a diff that changes a workflow/action/flake output/runner/deploy pipeline; this diff changes only .compound-engineering/config.yaml, so it neither adds a lane nor reaches a workflow (the repo's 12m01s dependency-changing PR is recorded as F3, not fixed here).
ci-wall-clock	red-main-reverts-its-culprit-same-day.md	not-applicable	applies to per-push postsubmit on-failure handling; the diff adds no postsubmit handler.
ci-wall-clock	release-promotes-the-staging-proven-build.md	not-applicable	applies to release/deploy/tag jobs and image promotion; no release workflow is changed.
ci-wall-clock	setup-under-a-minute.md	not-applicable	applies to a PR job's first verdict step and pre-verdict steps; the diff changes no PR job.
mutation-discipline	kill-survivors-with-contract-properties.md	not-applicable	applies to a test written for a surviving mutant; the diff adds no test and no mutant is addressed.
mutation-discipline	suppress-by-shape-in-an-ignorer.md	not-applicable	applies to Stryker ignore comments/ignorers; the diff changes no Stryker config.
mutation-discipline	unkillable-survivors-are-dead-code.md	not-applicable	applies to a survivor's written reason or a mutation baseline row; neither is touched.
package-topology	condition-branch-agreement.md	not-applicable	applies to an entry's condition branches and types bundling; no package entry or exports map is changed.
package-topology	declared-entry-points.md	not-applicable	applies to adding/renaming a subpath export; no package exports are changed.
package-topology	enumerated-entry-modules.md	not-applicable	applies to exports in mod.ts/index.ts; no entry module is touched.
package-topology	import-time-inertness.md	not-applicable	applies to top-level code in a published module; the diff changes no published module.
package-topology	one-access-path.md	not-applicable	applies to exporting a symbol from two entries; no export is added.
package-topology	public-signature-types.md	not-applicable	applies to a published signature reaching an unpublished type; no published signature is changed.
package-topology	surface-changes-are-versioned.md	not-applicable	applies to removing/renaming/narrowing an export or subpath of a published package; the diff changes no published surface (a CE config file is not a published package export).
schema-laws	arbitrary-filter-floors.md	not-applicable	applies to a schema check/filter drawn by property tests; no schema or property test is changed.
schema-laws	cross-field-invariants-as-struct-checks.md	not-applicable	applies to a Schema.Struct relating two fields; no schema is changed.
schema-laws	data-only-schema-classes.md	not-applicable	applies to Schema.Class/TaggedClass/TaggedError declarations; no schema class is touched.
schema-laws	invariants-as-refinements.md	not-applicable	applies to a schema field's domain invariant at decode; no schema field is changed.
schema-laws	recursive-schema-suspend.md	not-applicable	applies to recursive schemas and Schema.suspend; no schema is touched.
schema-laws	refusal-properties-cover-unobservable-boundaries.md	not-applicable	applies to adding a refinement/check to a schema; no schema refinement is added.
schema-laws	rich-type-over-foreign-encoded.md	not-applicable	applies to a foreign wire shape's Encoded side; no schema is touched.
schema-laws	tagged-unions-over-state-by-presence.md	not-applicable	applies to mutually exclusive states modeled by presence; no schema is changed.
schema-laws	tests-own-no-schemas.md	not-applicable	applies to a test declaring/copying a schema; the diff adds no test and no schema.

Compound learning

ce-compound: documentation skipped. The repin has no non-obvious lesson that this body and the commit do not already hold. F3's cause is measured but not solved, and its follow-up will record the learning when it lands. docs/solutions/performance-issues/fetch-cargo-vendor-given-whole-source-rebuilds-crane-deps.md makes no claim that F3 contradicts.

Readiness

Head bca291de1bb642b3205413acb1f05153ccb38338, one commit on main at 187c25c1. CI 38456326800 (4 jobs) and Changeset Check 38456328340 are green. This is the only layer of its stack on trunk main, and no other open PR of mine touches this file. The operator merges.

[ryanleecode]

Root verdict at bca291d: one-file repin to full SHA de684e25d6 enrolling ci-wall-clock, resolver 6 roots 0 warnings, 5/5 green, 0 behind, 0 threads, DeepSeek review, F3 recorded as a measured exception with owner and trigger, privacy clean.