Release 0.73 evidence and publication readiness (#214)

Merge the exact-SHA qualified Release 0.73 candidate, immutable measurement evidence links, honest findings, and tooling-only post-tag proof repair. The annotated v0.73.0 tag remains on the measured runtime-equivalent product commit.

Author: javaquasar

.config/nextest.toml

@@ -19,7 +19,10 @@ slow-timeout = { period = "120s", terminate-after = 3 }
 [[profile.ci.overrides]]
 filter = "test(checked_in_registry_closes_current_production_inventory)"
 threads-required = "num-test-threads"
-slow-timeout = { period = "120s", terminate-after = 2 }
+# A full production-owner inventory scan takes about five minutes on the
+# supported Windows release workstation. Keep the override test-specific so
+# every other CI test retains the global two-minute fail-closed timeout.
+slow-timeout = { period = "120s", terminate-after = 5 }
 
 [[profile.ci.overrides]]
 filter = """

.gitattributes

@@ -20,3 +20,8 @@ docs/testing/perf-artifacts/0.71/**/manifest.json text eol=lf
 docs/testing/perf-artifacts/0.71/**/SHA256SUMS text eol=lf
 docs/testing/perf-artifacts/0.71/**/verify.ps1 text eol=lf
 docs/testing/perf-artifacts/0.71/**/redaction-receipt.json text eol=lf
+docs/testing/perf-artifacts/0.73/**/*.zip -text
+docs/testing/perf-artifacts/0.73/**/README.md text eol=lf
+docs/testing/perf-artifacts/0.73/**/manifest.json text eol=lf
+docs/testing/perf-artifacts/0.73/**/SHA256SUMS text eol=lf
+docs/testing/perf-artifacts/0.73/**/verify.ps1 text eol=lf

.github/workflows/ci.yml

@@ -20,6 +20,16 @@ on:
         required: false
         default: false
         type: boolean
+      run_redis_compat_release_proof:
+        description: "Run only the Redis release proof against an explicit immutable candidate SHA"
+        required: false
+        default: false
+        type: boolean
+      release_proof_candidate_sha:
+        description: "Full candidate SHA used only by the focused Redis release-proof repair lane"
+        required: false
+        default: ""
+        type: string
       run_management_candidate_soak_072:
         description: "Run the exact six-hour 0.72 Management Center candidate soak"
         required: false
@@ -152,7 +162,7 @@ jobs:
         uses: actions/checkout@v5
 
       - name: Install Rust
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@1.94.0
 
       - name: Validate topology through fail-closed watchdog
         run: >-
@@ -186,8 +196,8 @@ jobs:
         with:
           fetch-depth: 0
 
-      - name: Install Rust
-        uses: dtolnay/rust-toolchain@stable
+      - name: Install pinned Rust 1.94.0
+        uses: dtolnay/rust-toolchain@1.94.0
 
       - name: Generate and close the ownership inventory
         timeout-minutes: 15
@@ -260,7 +270,7 @@ jobs:
 
       - name: Install reviewed cargo-semver-checks
         timeout-minutes: 30
-        run: cargo install cargo-semver-checks --version 0.49.0 --locked
+        run: cargo install cargo-semver-checks --version 0.50.0 --locked
 
       - name: Validate every publishable package against v0.70.0
         timeout-minutes: 180
@@ -325,7 +335,7 @@ jobs:
         uses: actions/checkout@v5
 
       - name: Install Rust
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@1.94.0
 
       - name: Cache Rust dependencies
         uses: Swatinem/rust-cache@v2
@@ -391,7 +401,7 @@ jobs:
           fetch-depth: 0
 
       - name: Install Rust
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@1.94.0
 
       - name: Cache Rust dependencies
         uses: Swatinem/rust-cache@v2
@@ -505,7 +515,7 @@ jobs:
         uses: actions/checkout@v5
 
       - name: Install Rust
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@1.94.0
 
       - name: Cache Rust dependencies
         uses: Swatinem/rust-cache@v2
@@ -562,7 +572,7 @@ jobs:
           fetch-depth: 0
 
       - name: Install Rust
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@1.94.0
 
       - name: Materialize fail-loud upstream admission status
         run: >-
@@ -620,7 +630,7 @@ jobs:
         uses: actions/checkout@v5
 
       - name: Install Rust
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@1.94.0
         with:
           components: rustfmt
 
@@ -671,8 +681,8 @@ jobs:
         with:
           fetch-depth: 0
 
-      - name: Install Rust
-        uses: dtolnay/rust-toolchain@stable
+      - name: Install pinned Rust 1.94.0
+        uses: dtolnay/rust-toolchain@1.94.0
         with:
           components: rustfmt, clippy
 
@@ -759,13 +769,21 @@ jobs:
           cargo run -p xtask --locked -- canary-sweep --release 0.71 --tier fast
           cargo run -p xtask --locked -- canary-check --release 0.72
           cargo run -p xtask --locked -- canary-sweep --release 0.72 --tier fast
+          cargo run -p xtask --locked -- canary-check --release 0.73
+          cargo run -p xtask --locked -- canary-sweep --release 0.73 --tier fast
 
       - name: Management Center 0.72 admission contract
         run: |
           cargo test -p xtask --test management_center_072 --locked
           cargo run -p xtask --locked -- management-center-check --release 0.72
           cargo run -p xtask --locked -- release-evidence --release 0.72
 
+      - name: Release 0.73 performance and evidence contracts
+        run: |
+          cargo test -p xtask --test performance_contract_073 --test performance_local_073 --locked
+          cargo run -p xtask --locked -- performance-contract-check --release 0.73
+          cargo run -p xtask --locked -- release-evidence --release 0.73
+
       - name: Fuzz corpus regression
         run: cargo run -p xtask --locked -- evidence-run --release "$HYDRACACHE_CANDIDATE_RELEASE" --gate fast.fuzz-corpus-regression
 
@@ -1282,7 +1300,7 @@ jobs:
         uses: actions/checkout@v5
 
       - name: Install Rust
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@1.94.0
 
       - name: Cache Rust dependencies
         uses: Swatinem/rust-cache@v2
@@ -1303,14 +1321,28 @@ jobs:
     name: Redis Compatibility Release Proof
     runs-on: ubuntu-latest
     timeout-minutes: 120
-    if: github.event_name == 'schedule' || startsWith(github.ref, 'refs/tags/v') || (github.event_name == 'workflow_dispatch' && inputs.run_nightly)
+    if: github.event_name == 'schedule' || startsWith(github.ref, 'refs/tags/v') || (github.event_name == 'workflow_dispatch' && (inputs.run_nightly || inputs.run_redis_compat_release_proof))
 
     steps:
       - name: Checkout
         uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+          ref: ${{ github.event_name == 'workflow_dispatch' && inputs.run_redis_compat_release_proof && inputs.release_proof_candidate_sha || github.sha }}
 
-      - name: Install Rust
-        uses: dtolnay/rust-toolchain@stable
+      - name: Verify focused release-proof candidate
+        if: github.event_name == 'workflow_dispatch' && inputs.run_redis_compat_release_proof
+        shell: bash
+        run: |
+          set -euo pipefail
+          candidate='${{ inputs.release_proof_candidate_sha }}'
+          test "$candidate" != ""
+          test "${#candidate}" -eq 40
+          test "$(git rev-parse HEAD)" = "$candidate"
+          git diff --exit-code
+
+      - name: Install pinned Rust 1.94.0
+        uses: dtolnay/rust-toolchain@1.94.0
         with:
           components: rustfmt, clippy
 
@@ -1367,7 +1399,7 @@ jobs:
         uses: actions/checkout@v5
 
       - name: Install Rust
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@1.94.0
 
       - name: Cache Rust dependencies
         uses: Swatinem/rust-cache@v2
@@ -1462,7 +1494,7 @@ jobs:
           fetch-depth: 0
 
       - name: Install Rust
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@1.94.0
 
       - name: Verify shipped v0.71.0 provenance
         run: |
@@ -1496,7 +1528,7 @@ jobs:
           fetch-depth: 0
 
       - name: Install Rust
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@1.94.0
 
       - name: Prove exact-candidate HC1 and HC2 coexistence
         run: cargo run -p xtask --locked -- evidence-run --release 0.72 --gate tool.hydracache-server.management-hc1-hc2-coexistence-072
@@ -1530,7 +1562,7 @@ jobs:
           fetch-depth: 0
 
       - name: Install Rust
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@1.94.0
 
       - name: Prove exact-candidate HC1 and HC2 coexistence
         run: cargo run -p xtask --locked -- evidence-run --release 0.72 --gate tool.hydracache-server.management-hc1-hc2-coexistence-072
@@ -1569,7 +1601,7 @@ jobs:
         uses: actions/checkout@v5
 
       - name: Install Rust
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@1.94.0
 
       - name: Cache Rust dependencies
         uses: Swatinem/rust-cache@v2
@@ -1622,7 +1654,7 @@ jobs:
           fetch-depth: 0
 
       - name: Install Rust
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@1.94.0
 
       - name: Cache Rust dependencies
         uses: Swatinem/rust-cache@v2
@@ -1663,7 +1695,7 @@ jobs:
           fetch-depth: 0
 
       - name: Install Rust
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@1.94.0
 
       - name: Install Go
         uses: actions/setup-go@v6
@@ -2632,7 +2664,7 @@ jobs:
         uses: actions/checkout@v5
 
       - name: Install Rust
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@1.94.0
 
       - name: Cache Rust dependencies
         uses: Swatinem/rust-cache@v2
@@ -2657,7 +2689,7 @@ jobs:
         uses: actions/checkout@v5
 
       - name: Install Rust
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@1.94.0
 
       - name: Cache Rust dependencies
         uses: Swatinem/rust-cache@v2
@@ -2778,7 +2810,7 @@ jobs:
         uses: actions/checkout@v5
 
       - name: Install Rust
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@1.94.0
 
       - name: Cache Rust dependencies
         uses: Swatinem/rust-cache@v2
@@ -2918,7 +2950,7 @@ jobs:
           fetch-depth: 0
 
       - name: Install stable Rust
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@1.94.0
 
       - name: Install pinned TSan nightly
         timeout-minutes: 15
@@ -3006,7 +3038,7 @@ jobs:
           fetch-depth: 0
 
       - name: Install Rust
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@1.94.0
         with:
           components: llvm-tools-preview
 
@@ -3099,7 +3131,7 @@ jobs:
           fetch-depth: 0
 
       - name: Install Rust
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@1.94.0
 
       - name: Cache Rust dependencies
         uses: Swatinem/rust-cache@v2