Phase 1 / Chore / CI cache refresh + ReleaseSafe budget

[guysenpai]

Brief

briefs/chore-ci-cache-refresh.md — Status: CLOSED

Summary

Fixes the fossil-cache mechanism that had the required check build-and-test (windows-2025, ReleaseSafe) dying on its job timeout since M1.0.11. The monolithic actions/cache@v5 step in build-and-test is split into actions/cache/restore@v5 + two actions/cache/save@v5 steps (per-sha primary key, three-level prefix fallback, post-zig build save for timeout immunity, final if: always() save); ReleaseSafe budget 40 -> 55 min (Debug unchanged); the timing artifact now records cache_matched_key. One file changed (.github/workflows/ci.yml) plus the brief.

Acceptance criteria

• All four build-and-test cells green — including windows-2025, ReleaseSafe COMPLETING (35 min 27 s near-cold, under the new 55-min budget)
• windows-2025, ReleaseSafe timing artifact shows test_seconds populated (1652 near-cold; first non-NA since M1.0.11) and reports the matched restore key
• Full required-check set green (ci-gate + matrix + smokes + bench)
• commit-msg hook green on every commit (≤72-char subjects)
• §3.6.1 language audit clean on the milestone diff and the brief

Review notes

• Mechanism proven live on ALL THREE ladder levels: level-3 fossil fallback (near-cold first run), level-2 zon-prefix warm fallback (ubuntu ReleaseSafe 29 min -> 1 min 13 s), exact per-sha hit (cache_hit=true, build_seconds=2, test_seconds=20).
• Timeout immunity demonstrated under real conditions: the known windows-ReleaseSafe hang flake made one test leg red, the if: always() final save salvaged its cache, and the rerun exact-hit that entry and went green in 1 min 47 s.
• Recorded deviation: commit type chore(ci) instead of the prompt's ci(...) — the §4.3 whitelist (hook-enforced) has no ci type; chore(ci) is the spec's own canonical example.
• Flagged residuals (brief Closing notes): the three untouched actions/cache@v5 sites keep the write-once pattern (self-correcting on fossil eviction; the smoke jobs' comment is now slightly stale — left for scope discipline); ubuntu ReleaseSafe showed one warm-lineage variance run (correct cache_matched_key, near-cold wall-time) worth watching in future artifacts.
• §7.3 whitelist: actions/cache/restore@v5 / actions/cache/save@v5 are sub-actions of the already-whitelisted actions/cache@v5 (same repo, same major) — noted in-file.

Merge sequence

This chore unblocks PR #40 (M1.0.12). After this merges, the push run on main writes the fresh main-scoped cache; PR #40's checks are then re-run (warm from main), and M1.0.12 merges + tags. Squash-and-merge, no tag (maintenance chore, §6.1).

Changelog

• chore(ci): split zig cache per-sha and raise releasesafe budget
• docs(brief): add ci cache refresh chore brief (+ specs read, activate, execution log, measurements, close)

🤖 Generated with Claude Code