[CI] Restore Flow suite GitHub Actions with staged checkpoints [skip ci] #137

Current merge continuation — November 13, 2026

The maintainer authorized merging the open PR queues and then returning to sync. All 45 initially open Flow-suite PRs are accounted for, plus the Relay prerequisite: 44 PRs merged and two superseded Flow drafts closed. Fresh readback finds zero open PRs in all four Flow repositories.

Flow #130 and #134 are closed unmerged as superseded, with replacement references to already merged #136 and #135. Their history remains available. #131 is narrowed to its unique two requested-coverage schemas and descriptor pins; the newer diagnostics owner, support schemas/commands and scenario implementation remain intact. Genuine older held-file, shared-deadline, installation-membership, coverage, catalog and preset source work is retained. The dated continuation is in the maintained Flow handoff.

Optiflow's older MP4/native source stack is reconciled with the newer diagnostics and CI repairs. Additive architecture/Task conflicts preserve both owners. The formatting reconciliation preserves integrated semantic source: all 80 incoming Rust files from #209 were proven to be formatter output, then the complete integrated root/fuzz sources were normalized with the pinned formatter. No compiler/runtime result is inferred.

SQLite compatibility option is now selected

The whole-queue authorization includes Optiflow #215, reconciled and merged last. Current development source now requires Rust 1.89, with rusqlite 0.41.1 / libsqlite3-sys 0.39.1 in both locks and bundled SQLite retained. Rust 1.85–1.88 product compiler support is no longer promised for this source; canonical formatting remains Rustfmt 1.85.0. This supersedes earlier not-adopted/primary-Rust-1.85 statements below, which remain dated history.

The migration changes only those two dependency package records in each graph, preserves all non-lock corpus bindings and updates only the reviewed Cargo.lock fingerprint. Existing hosted/scheduled job conditions/timeouts, release authority and native mutation gates remain intact; no advisory ignore or implicit system-SQLite substitution is added. The inspected advisory classifies the selected sys range as patched; actual cargo-deny/compiler/native qualification is still unrun. See the source adoption record. No historical release assets are replaced.

Observations and remaining acceptance

All merge results were read back with exact PR heads, source trees and merge parents; all four queues were independently reread empty. Source conflict resolutions were reviewed before adoption. New and merge commit messages retain [skip ci]; no hosted workflow was manually dispatched or rerun.

Executed bounded source checks during reconciliation include:

• Flow: Rustfmt 1.85, 12 budget regressions, pinned Actionlint wrapper, four new JSON schemas parsed and 31 distinct Task aliases.
• Optiflow primary integration: root/fuzz Rustfmt 1.85, 12 budget regressions, 19 example/corpus helper cases, 17 current corpus source bindings, Actionlint and 60 distinct Task aliases.
• Optiflow #215 adoption: root/fuzz Rust 1.89 locked/offline metadata resolution without subsequent lock edits; source-integrity comparison; 17 current bindings; Actionlint/budget plan; one focused release-toolchain source regression.

The prior Aniflow checked source tree is byte-identical after its merges. Renderflow retains its checked repair tree plus only the intended three-line Biome generated-dist exclusion from #513. Prior receipts retain their original scopes; these statements do not claim a new product/native/hosted matrix pass.

This issue stays open. Its acceptance boxes remain unchanged: product compilation/build/test/Clippy, actual security-policy execution, real installer/Snap and supported native-host/platform qualification still need their own exact-source evidence. Skipped jobs, metadata resolution, formatting and source plans are not green release support. Known Flow bounded-wrapper timeout and Aniflow alignment cancellation/start-marker failures remain unresolved with causes unproven. Optiflow #95 stays open and Aniflow #35 stays closed. #88's title/body/state/updated_at and original 45-ticket final-pass ledger remain unchanged and last. [skip ci]

Problem and audit scope

The Flow suite has multiple independent GitHub Actions failures. Restore an honest, reproducible CI baseline across Flow, Aniflow, Renderflow and Optiflow before treating a green release matrix as established.

This is the third work item requested after the #62/#21 source sprint. It does not close unrelated roadmap issues, replace #88's 45-ticket final-pass ledger, or turn source-only drafts into qualified releases. #88 remains unchanged and last. #21's exporter/adoption dependencies remain separate.

Read-only audit: November 13, 2026 (America/New_York). Inspected the latest 30 workflow runs per repository (120 sampled; 83 failure / 37 success), selected jobs/logs, older main failures and matching current source. These are different historical windows, not a complete audit of every run. No tests, builds, validators, workflow dispatches, reruns, cancellations, workflow edits, publication or CI spend were initiated for this audit.

The sampled jobs received runners and executed commands. The evidence does not establish an account-wide billing/runner-outage cause. Some workflows and matrix jobs passed alongside failures. Flow's latest recorded CI run is October 21; Aniflow's is October 17. Those old results do not qualify today's newer source. Skipped steps following a failure are not additional independent defects.

November 13 source repair batch — checkpoints 1 and 2

The maintainer authorized and merged Flow #135 → #136 and the owning diagnostics counterparts: Aniflow #223, Optiflow #205 and Renderflow #508. These are source merges; #62/#21 acceptance and #21's existing dependencies remain open.

Checkpoint 1 source drafts:

• Flow #138
• Aniflow #224 — also fixes the invalid corpus job-level runner context
• Optiflow #206
• Renderflow #509

Each adds a pinned/checksummed, five-minute expression-lint lane and an explicit-local-tool Task alias, plus required invalid/valid context fixtures. It does not build products or dispatch a qualification lane. The 24 current workflow source files (including these new lanes) were inspected for runner references at top/job indentation; this limited source search is not Actionlint validation.

Checkpoint 2 source drafts:

• Aniflow #225, stacked after #224 — borrowed output/tool path comparisons
• Optiflow #207, stacked after #206 — checked SQLite counter conversions, rustix KILL constant and typed pinned launcher/helper paths

Optiflow authors two in-memory SQL boundary/refusal cases and extends literal helper-argv coverage. No dependency/lock/MSRV/schema or native qualification-gate changes are included. The separate SQLite advisory/container-toolchain conflict remains checkpoint 6.

All six repair PRs are draft and unmerged. Tests, compiler/build, lint/formatter, schema/native and hosted qualification remain deferred under the existing maintainer instruction. No workflow was manually dispatched or rerun. The Actionlint binary was not downloaded or executed; only release metadata was read to pin it. Exact Git source-tree/parent readback is transport evidence, not a passed check.

The acceptance boxes below stay unchecked until their actual gates are met. The remaining ten repair checkpoints have not been implemented by this batch. #88 remains unchanged and last.

November 13 next source batch — checkpoints 3 and 4

The next two requested checkpoints are pushed as eight draft, unmerged PRs, stacked after the still-open checkpoint 1/2 source repairs:

Within each repository, merge its existing checkpoint 1/2 draft chain first, then checkpoint 3, then checkpoint 4. No additional PR was merged for this batch.

Checkpoint 3: Cargo metadata refresh repaired Renderflow's missing euclid 0.22.14 / kurbo dependency edge while retaining existing package versions/checksums. The separate Optiflow fuzz lock still recorded jsonschema 0.56 against its owning manifest's 0.60 requirement; its four validator packages now match the root lock at 0.60.2. The other three root locks remain byte-identical. Existing CI/Task lanes gain locked metadata guards, and previously unlocked compiler/test commands retain --locked.

Checkpoint 4: Canonical source formatting is applied with Rustfmt/Cargo 1.85.0 for Flow/Aniflow/Optiflow and 1.94.0 for Renderflow. Task/CI format selection is explicit; moving compiler lanes keep strict Clippy. Flow includes the 39 historical typed assertion fixes plus a delivery match-arm punctuation syntax repair exposed by parsing. Renderflow accounts for the 24 historical diagnostics using SDK export plumbing, equivalent defaults/bounds/borrows/arithmetic, transparent bundle aliases, private parameter contexts and a boxed speech CLI payload; two old literal findings were already repaired on main.

Renderflow's native flags and speech wire contracts stay the same, but Rust source consumers constructing SpeechCommands::Transcribe now need Box::new(arguments). The owning handoff/PR calls this out. The formatting diff is extensive because earlier source checkpoints deferred formatting. No new lint allowance, MSRV increase, continue-on-error behavior, unrelated Identity change or blind fixture regeneration is included.

Actual bounded observations: All five owning lock graphs (four roots plus isolated fuzz) passed explicit-version update --workspace --locked --offline without a lock SHA-256 change after refresh. All five corresponding explicit-version cargo fmt --all -- --check commands exited 0. The selected checkpoints' generated-source maintenance required metadata/format tools; those were installed into a task-private directory. These source/metadata steps ran without product compilation, build scripts, tests, Clippy, native execution or hosted CI dispatch.

Clippy/type/borrow checks and the full build/conformance lanes remain unrun. Historical-diagnostic source repairs and successful formatting are not a green Actions suite; new findings can remain. The acceptance checkboxes below are intentionally unchanged. Checkpoints 5–12 still await their source repair batches, including the separate advisory/MSRV decision, site links, corpus/native work and cost policy. #88's original ledger/history stays unchanged and last.

November 13 remaining source sprint — checkpoints 5–12

The maintainer expanded the scope to all remaining checkpoints, delivered on separate stacked draft PRs. This sprint published 13 drafts: 12 in the primary repair/dependency chains plus one optional compatibility proposal. No PR is merged, no issue is closed, and no hosted workflow is dispatched by this sprint.

Reconciliation order: retain each repository's checkpoint 1–4 chain first, then:

• Flow: [skip ci] Apply canonical formatting and repair observed lint findings #140 → [CI][skip ci] Bound suite CI costs and record remaining repair drafts #141.
• Aniflow: #227 → #232 → #233.
• Optiflow: #209 → #210 → #211 → #212 → #213 → #214 → #216.
• Renderflow: #511 → #514 → #515.
• Reconcile Relay #182 before adopting the immutable action pin in Optiflow #212. This is a narrow backport against Relay main, not adoption of unrelated newer action features.

Optional Optiflow #215 is a fork from #210, not a primary merge dependency. Choosing it changes the supported compiler contract and requires explicit maintainer compatibility review, rebasing later checkpoints, a reviewed corpus lock-binding refresh and actual compiler/security/native qualification. The primary stack does not ignore the advisory, substitute a system library implicitly, or silently raise the MSRV.

Executed bounded observations: all four final source stacks pass the pinned Actionlint wrapper and 12 synthetic budget regressions each (48 executions). Independent source comparison preserves all 36 pre-existing heavy-job expressions beneath the new budget opt-ins. Aniflow passes 31 release-contract cases and 12 applicable mocked release-admission cases (two Renderflow-only skips). Renderflow passes 13 applicable admission cases (one Aniflow-only skip) and its packaging metadata helper. The job guard reads complete counted pages and binds repository, event, workflow, source SHA, attempt, full required inventory and successful critical steps; historical scheduled conformance bytes must match reviewed policy. These tests use synthetic API records, not a newly executed candidate matrix.

Budget plans report qualification deferred/unobserved and explicitly keep product/domain/execution authority false. Existing long artifact retention stays visible: four 30-day Optiflow items; four long-history Renderflow items plus three implicit server-default uploads with unknown days. The source fix does not erase their history or claim a global billing/memory/matrix quota. Manual publication triggers, permissions, approval gates and release authority are preserved; Ani/Render add read-only admission prerequisites only.

These named local source/helper checks supersede the earlier blanket deferral only for their stated scope; dated prior batch statements remain historical. No Rust product type-check/build/test, Clippy, cargo-deny container/scan, native Mac/APFS/physical-volume work, installer/Snap execution, hosted dispatch/rerun, signing, release or publication occurred. The full checkpoint acceptance boxes below remain unchanged and open. Source delivery is not a green supported release matrix.

The maintained source handoff and PR order are in Flow's current sprint handoff. Flow's bounded-wrapper timeout and Aniflow's alignment cancellation/start-marker failure remain unresolved with causes unproven. #88's title, body, state and original 45-ticket final-pass ledger remain untouched and last; Aniflow #35 stays closed and Optiflow #95 stays open. [skip ci]

Confirmed evidence

Ordered repair checkpoints

Each checkpoint should be an independently reviewable source PR with a linked exact revision and actual result when execution is authorized. Work that already has a source repair needs qualification, not duplicate implementation.

• 1. Repair workflow expression validity (Aniflow; audit all four). Move corpus temporary-path initialization into a supported step context or initialize it from RUNNER_TEMP within the step. Preserve the existing opt-in schedule gate. Add workflow/expression linting to the inexpensive local/PR checks. Acceptance: no workflow-file validation errors; disabled/manual/scheduled selection behaves as declared without silently starting deferred qualification.
• 2. Restore Rust compilation (Aniflow and Optiflow). Correct borrowed-path comparisons, checked SQLite integer conversions, rustix signal API and pinned-launcher/controller types. Preserve identity, bounds, authority and platform behavior. Acceptance: all-target checks on each declared MSRV plus the owned supported host/feature matrix; fuzz/performance jobs reach their intended workload rather than stopping in the library compiler.
• 3. Repair manifest/lock consistency (Renderflow; verify all four and Optiflow fuzz). Identify the exact stale edge/package and commit a reproducible lockfile update with reviewed dependency/MSRV changes. Include any new source drafts selected for merge. Acceptance: locked check/build/conformance commands need no lock edits; --locked remains enforced.
• 4. Clear formatting and strict lint debt without lowering gates (all four). Commit reviewed formatting and compatible fixes for actual warnings, including Flow's moving-stable assert_is_empty findings and Renderflow's SDK/import/type-size findings. Document reproducible MSRV and moving-toolchain policy. Acceptance: each advertised formatter/Clippy lane passes at its recorded compiler; no blanket allowances, continue-on-error or MSRV increase just to hide failures.
• 5. Fix release-contract fixture inventory (Aniflow). Use an explicit safe source-fixture snapshot for the immutability assertion rather than applying distributable-bundle path policy to a whole checkout containing dot directories. Keep production archive traversal/link/name defenses. Acceptance: the existing 25-case suite and relevant new regression pass, with dirty/invalid prepare still producing no mutation and no publication.
• 6. Restore dependency-policy execution and resolve the SQLite advisory (Optiflow). Align the cargo-deny container/toolchain override and choose a patched SQLite/rusqlite strategy for root and fuzz locks. The observed suggested upgrades declare Rust 1.88/1.89 while Optiflow promises 1.85; resolve that compatibility conflict explicitly rather than blindly updating or blanket-ignoring the advisory. Acceptance: both manifest policy jobs pass advisories/bans/licenses/sources and the chosen supported Rust matrix is truthful.
• 7. Repair composed-site example links (Optiflow). Provide the intended public example assets/mounts or correct source/rendered links consistently in docs and Pages. Acceptance: a composed-site local-link check passes on a PR build without deploy credentials; required examples remain discoverable and no private/generated run data is copied. Keep the link checker.
• 8. Repair the pinned Relay action's path guard and update its consumer pin (Relay dependency → Optiflow). Keep every relative-path comparison inside valid Bash conditional syntax; reject dot/parent traversal and overlapping managed directories before writes. Add valid/invalid literal-path cases at the owning action, then consume the reviewed immutable revision. Acceptance: no attempted path-command warnings, valid paths succeed, unsafe inputs fail, and the consumer retains exact source/provenance binding. The audit made no Relay change.
• 9. Reconcile filesystem-corpus source drift (Optiflow). Review recipe, expectation, proof/source fingerprint differences; regenerate only through an explicit reviewed authoring step if the source change is intended. Acceptance: drift check plus bounded properties/fault/corpus suites pass on both declared hosts; CI never rewrites its own expectations to pass.
• 10. Repair the macOS candidate-artifact fixture/adapter boundary (Optiflow). Reproduce the observed temporary-directory/ENOTDIR failures on a canonical disposable temp root, distinguish fixture aliasing from product path handling, then make the smallest owning fix. Acceptance: candidate commit/recovery/tamper cases pass on native macOS while symlink refusal still holds. Physical removal/APFS qualification remains feat(ai): deliver private local setup bundles and diagnostic utility [skip ci] #93/[skip ci] Collect accepted delivery files with private evidence and exact review state #111; this checkpoint cannot certify it.
• 11. Requalify current workspace packaging (Renderflow). Verify the already authored typed schema bounds and CLI package selection through normal release/installer/Snap paths; repair any remaining workspace assumptions. Acceptance: build, installer and packaging smoke lanes reach and verify the actual candidate binary. No signing, store release or publication is implied.
• 12. Make the repaired workflow plan affordable and prove its selected gates (all four). Use one bounded cheap PR tier, suitable path filters/concurrency/caching, explicit timeout/output/artifact retention limits, and opt-in or separately budgeted heavy/native/model/scheduled tiers. Preserve required-check semantics and clear unavailable/skipped states. Acceptance: after explicit execution authorization, collect exact-commit results for the selected required lanes and visible deferred lanes; no suppressed failure or missing native support is relabeled green. Do not dispatch paid/heavy CI during implementation of this proposal.

Relationship to existing work and completion

Duplicate search found historical CI issues already closed or consolidated: Flow #34, Aniflow #15/#64, Renderflow #351/#407/#410 and Optiflow #106. This issue isolates observed Actions restoration; it does not erase their criteria or claim those historical closures established qualification. Link relevant fix PRs here and retain #88 as the final deep test/refactor/acceptance owner.

The #62/#21 source work is merged through Flow #135 → #136, with native diagnostics counterparts also merged as recorded above. Their acceptance checks and #21's declared dependencies remain pending; merging did not qualify the implementations.

Close this proposal only after each checkpoint is evidenced or deliberately resolved with its remaining owner and limits recorded. Preserve the unresolved Flow bounded-wrapper timeout and Aniflow alignment cancellation/start-marker cause; this read-only audit neither reproduced nor explained them. It does not audit every past run, org billing configuration, signing credentials, physical drives or new draft compilation. [skip ci]