feat(ultracode): complete workflow orchestration support

.bazelrc

@@ -27,6 +27,18 @@ build:ci --disk_cache=~/.cache/bazel-disk
 build:ci --repository_cache=~/.cache/bazel-repo
 test:ci --test_output=all
 
+# Rust branch coverage
+coverage:rust_branch --combined_report=lcov
+coverage:rust_branch --experimental_fetch_all_coverage_outputs
+coverage:rust_branch --experimental_split_coverage_postprocessing
+coverage:rust_branch --@rules_rust//rust/settings:extra_rustc_env=RUSTC_BOOTSTRAP=1
+coverage:rust_branch --@rules_rust//rust/settings:extra_rustc_flag=-Zcoverage-options=branch
+# LLVM 21.1.8 (bundled with Rust 1.94) can crash while exporting branch maps
+# from async/generic Rust test binaries. The branch-only toolchain setting pins
+# both producer and collector to Rust 1.92/LLVM 21.1.3 without changing the
+# compiler used by ordinary builds and tests.
+build:rust_branch --//:rust_branch_toolchain=true
+
 # Clippy
 build:clippy --aspects=@rules_rust//rust:defs.bzl%rust_clippy_aspect
 build:clippy --output_groups=clippy_checks

.github/workflows/ci.yml

@@ -7,6 +7,27 @@ on:
     branches: [main]
 
 jobs:
+  coverage:
+    name: Scoped Rust Coverage
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Install system dependencies
+        run: sudo apt-get update && sudo apt-get install -y libssl-dev pkg-config bubblewrap
+
+      - name: Setup Bazel
+        uses: bazel-contrib/setup-bazel@0.14.0
+        with:
+          bazelisk-cache: true
+          disk-cache: ${{ github.ref == 'refs/heads/main' && 'bazel-disk-coverage' || '' }}
+          repository-cache: true
+
+      - name: Scoped Rust coverage gate
+        run: bash tools/coverage/run_scoped_gate.sh
+
   build-and-test:
     name: Build & Test (${{ matrix.os }})
     runs-on: ${{ matrix.os }}
@@ -31,6 +52,23 @@ jobs:
       - name: Build
         run: bazel build //...
 
+      - name: Windows workflow journal identity gate
+        if: runner.os == 'Windows'
+        run: >-
+          bazel test
+          //crates/loopal-storage:loopal-storage-unit-test
+          //crates/loopal-storage:workflow_journal_windows_test
+          --config=ci
+          --test_output=errors
+
+      - name: Windows Job Object runtime gate
+        if: runner.os == 'Windows'
+        run: >-
+          bazel test
+          //crates/loopal-backend:process_group_windows_test
+          --config=ci
+          --test_output=errors
+
       - name: Test
         run: bazel test //... --config=ci
 

.github/workflows/release.yml

@@ -12,8 +12,30 @@ permissions:
   contents: write
 
 jobs:
+  coverage:
+    name: Scoped Rust Coverage
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Install system dependencies
+        run: sudo apt-get update && sudo apt-get install -y libssl-dev pkg-config bubblewrap
+
+      - name: Setup Bazel
+        uses: bazel-contrib/setup-bazel@0.14.0
+        with:
+          bazelisk-cache: true
+          disk-cache: release-coverage
+          repository-cache: true
+
+      - name: Scoped Rust coverage gate
+        run: bash tools/coverage/run_scoped_gate.sh
+
   build:
     name: Build ${{ matrix.target }}
+    needs: coverage
     runs-on: ${{ matrix.os }}
     strategy:
       fail-fast: false
@@ -46,6 +68,16 @@ jobs:
           disk-cache: release-${{ matrix.target }}
           repository-cache: true
 
+      - name: Windows production execution safety gate
+        if: runner.os == 'Windows'
+        run: >-
+          bazel test
+          //crates/loopal-storage:loopal-storage-unit-test
+          //crates/loopal-storage:workflow_journal_windows_test
+          //crates/loopal-backend:process_group_windows_test
+          --config=ci
+          --test_output=errors
+
       - name: Build release binary
         run: bazel build //:loopal -c opt
 

BUILD.bazel

@@ -1,9 +1,33 @@
+load("@bazel_skylib//rules:common_settings.bzl", "bool_flag")
 load("//build_defs/rust:platforms.bzl", "loopal_platforms")
 load("//build_defs/rust:root_binary.bzl", "loopal_binary")
 load("//build_defs/rust:root_tests.bzl", "loopal_root_tests")
 load("//build_defs/web:npm_workspace.bzl", "desktop_npm_workspace")
 load("//tools:version_env.bzl", "version_env")
 
+# Select the compatibility Rust toolchain only for real branch coverage. The
+# ordinary toolchain remains the release compiler (currently Rust 1.94).
+bool_flag(
+    name = "rust_branch_toolchain",
+    build_setting_default = False,
+    visibility = ["//visibility:public"],
+)
+
+config_setting(
+    name = "rust_branch_toolchain_disabled",
+    flag_values = {":rust_branch_toolchain": "false"},
+    visibility = ["//visibility:public"],
+)
+
+config_setting(
+    name = "rust_branch_toolchain_enabled",
+    flag_values = {
+        ":rust_branch_toolchain": "true",
+        "@rules_rust//rust/toolchain/channel:channel": "stable",
+    },
+    visibility = ["//visibility:public"],
+)
+
 desktop_npm_workspace()
 
 loopal_platforms()