Deterministic tests, macOS CI and ContextDB re-pin

.github/AGENTS.md

@@ -53,8 +53,8 @@ contextdb, context-graph and Vigil.
 
 - Linux qualification is required: `source`, `lint`, `docs`, `test`, `features`,
   complete `controls` and the stable `PR checks` aggregate remain fail-closed.
-  macOS runs the same lint, default, feature and complete controls commands in
-  `macos-advisory.yml`, with all five physical jobs and six logical receipts.
+  macOS runs the same lint, default, feature, compatibility build and complete
+  controls jobs in `macos-advisory.yml`, ten physical jobs and six logical receipts.
   Its aggregate reports failures honestly and never blocks Linux or delivery.
   Preserve model proofs, test-estate accounting, documentation validation and
   every feature shape. See [macOS follow-up](CI.md#macos-qualification-follow-up).

.github/workflows/build.yml

@@ -88,7 +88,7 @@ jobs:
                          and not job.name.startswith('development-binaries / ')]
           expected = {'source', 'docs', 'PR checks',
                       'Feature compatibility — default and minimal libraries (ubuntu-latest)',
-                      'Feature compatibility — sync, CLI and doctests (ubuntu-latest)'}
+                      'Feature compatibility — sync and CLI (ubuntu-latest)'}
           for os_name in ('ubuntu-latest',):
               expected.update({f'lint ({os_name})', f'CI controls ({os_name})'})
               expected.update(f'Default tests — {bundle} ({os_name})' for bundle in

.github/workflows/ci.yml

@@ -1,8 +1,9 @@
-name: ci
+name: Linux CI
 
 on:
   pull_request:
   push:
+    branches: [dev]
   workflow_dispatch:
     inputs:
       cg_sha:
@@ -183,6 +184,9 @@ jobs:
       - uses: Swatinem/rust-cache@49a0bdc70d2e1b713ca9e2869b211fcce03d3c1c # v2
         with:
           cache-bin: false
+          prefix-key: v1-rust-1.94.1
+          add-rust-environment-hash-key: false
+          save-if: ${{ github.ref == 'refs/heads/dev' }}
           workspaces: workspace/context-graph -> target
       - uses: taiki-e/install-action@1168f6810a3cb30a3514bf5756a3b7f0422c6df8 # v2
         with:
@@ -512,8 +516,13 @@ jobs:
           CG_MODEL_CACHE_ROOT: ${{ runner.temp }}/cg-model-cache
         with:
           cache-bin: false
+          prefix-key: v1-rust-1.94.1
+          add-rust-environment-hash-key: false
+          save-if: ${{ github.ref == 'refs/heads/dev' }}
           workspaces: workspace/context-graph -> target
-          key: test-catalog-seed-v2-${{ matrix.bundle }}
+          cache-on-failure: true
+          key: test-catalog-seed-v3-${{ matrix.bundle == 'acceptance' && 'narrow' || 'workspace' }}
+          add-job-id-key: false
       - uses: taiki-e/install-action@1168f6810a3cb30a3514bf5756a3b7f0422c6df8 # v2
         env:
           CG_MODEL_CACHE_ROOT: ${{ runner.temp }}/cg-model-cache
@@ -652,8 +661,13 @@ jobs:
           CG_MODEL_CACHE_ROOT: ${{ runner.temp }}/cg-model-cache
         with:
           cache-bin: false
+          prefix-key: v1-rust-1.94.1
+          add-rust-environment-hash-key: false
+          save-if: ${{ github.ref == 'refs/heads/dev' }}
           workspaces: workspace/context-graph -> target
-          key: features-catalog-seed-v2-${{ matrix.bundle }}
+          cache-on-failure: true
+          key: features-catalog-seed-v3-workspace
+          add-job-id-key: false
       - uses: taiki-e/install-action@1168f6810a3cb30a3514bf5756a3b7f0422c6df8 # v2
         env:
           CG_MODEL_CACHE_ROOT: ${{ runner.temp }}/cg-model-cache
@@ -768,6 +782,9 @@ jobs:
         CG_MODEL_CACHE_ROOT: ${{ runner.temp }}/cg-model-cache
       with:
         cache-bin: false
+        prefix-key: v1-rust-1.94.1
+        add-rust-environment-hash-key: false
+        save-if: ${{ github.ref == 'refs/heads/dev' }}
         workspaces: workspace/context-graph -> target
         key: feature-qualification-core-v1
     - name: Run feature compatibility qualification
@@ -837,7 +854,7 @@ jobs:
         retention-days: 14
         if-no-files-found: error
   feature-qualification-sync:
-    name: Feature compatibility — sync, CLI and doctests (ubuntu-latest)
+    name: Feature compatibility — sync and CLI (ubuntu-latest)
     runs-on: ubuntu-latest
     timeout-minutes: 120
     steps:
@@ -885,6 +902,9 @@ jobs:
         CG_MODEL_CACHE_ROOT: ${{ runner.temp }}/cg-model-cache
       with:
         cache-bin: false
+        prefix-key: v1-rust-1.94.1
+        add-rust-environment-hash-key: false
+        save-if: ${{ github.ref == 'refs/heads/dev' }}
         workspaces: workspace/context-graph -> target
         key: feature-qualification-sync-v1
     - name: Run feature compatibility qualification