From 348c9ec0ac23b857a70dc20f5acfada44ec03878 Mon Sep 17 00:00:00 2001 From: Hiroshi Shinaoka Date: Sat, 8 Aug 2026 19:11:30 +0200 Subject: [PATCH] rules: add build-artifact hygiene and attestation-gate policies Local And Hosted Validation gains three policies distilled from the tenferro-rs/tensor4all-rs build-size comparison: default profiles carry no full debug info (opt-in debug variants instead), CI-owned measurements may be gated locally by explicit attestation, and stale-artifact pruning must be documented. rust/performance.md adds the concrete Cargo profile shape (dev/test debug=0 with assertions kept, release line-tables-only with a release-debug variant, CI strip=symbols) and the rev-churn orphan warning. Co-Authored-By: Claude Fable 5 --- rules/common/docs-and-tests.md | 16 ++++++++++++++++ rules/rust/performance.md | 18 ++++++++++++++++++ 2 files changed, 34 insertions(+) diff --git a/rules/common/docs-and-tests.md b/rules/common/docs-and-tests.md index d1bbbde..83bb2f7 100644 --- a/rules/common/docs-and-tests.md +++ b/rules/common/docs-and-tests.md @@ -60,6 +60,22 @@ - Repository-local policy may require stricter local validation for a specific project or change class. Such overrides should explain why hosted CI alone is insufficient for that risk. +- Default build profiles should not carry full debug information. Keep the + default local and release profiles lean; provide an opt-in profile variant + (or a documented one-command override) for the sessions that actually attach + a debugger. Line-table-only debug information is usually enough for readable + backtraces at a fraction of the size. CI profiles used for comprehensive + runs should strip symbols. +- When hosted CI owns the measurement for a gate (coverage is the canonical + case), the local pre-PR gate may be attestation-based: an explicit flag or + statement that the changed code was reviewed for that property. The + attestation must be explicit and the check must fail when it is absent; + silence is not attestation. +- Build directories accumulate stale artifacts that no setting prevents: + dependency version and feature churn leaves orphaned object files behind. + Repositories should document a pruning mechanism (an age-based sweep tool or + a periodic full clean) and agents should propose a cleanup when a build + directory's size is clearly dominated by artifacts no current build uses. ## Benchmarks diff --git a/rules/rust/performance.md b/rules/rust/performance.md index 26222e3..8eaeeb4 100644 --- a/rules/rust/performance.md +++ b/rules/rust/performance.md @@ -46,6 +46,24 @@ - Prefer structural cache keys and exact equality checks over formatting whole programs into strings on every lookup. +## Build Profiles And Target Hygiene + +- Default `[profile.dev]` and `[profile.test]` should set `debug = 0` while + keeping `debug-assertions` and `overflow-checks` enabled, and keep + incremental compilation on for edit-test loops. Provide a one-command + override (for example `CARGO_PROFILE_DEV_DEBUG=1`) or an opt-in profile for + debugger sessions. +- `[profile.release] debug = true` in a workspace whose normal verification + runs in release mode multiplies the build directory by gigabytes. Prefer + `debug = "line-tables-only"` for readable backtraces, with a separate + `release-debug` inheriting profile for full debugger information. +- The profile used by comprehensive CI runs should disable incremental + compilation and set `strip = "symbols"`. +- Dependency `rev =` bumps and feature churn leave orphaned rlibs and test + binaries in `target/` that no profile setting removes. Document the pruning + mechanism (an age-based sweep tool, or a periodic `cargo clean`), and + propose a cleanup when `target/` growth is dominated by stale artifacts. + ## GPU Kernels - Launch domains should cover the output or update domain. Avoid