Fix HPC compatibility and harden CI with regression coverage

[arena-ai-coding-agent]

Summary

Maintenance pass informed by hyperpolymath/rsr-template-repo and hyperpolymath/standards, with source revisions and evidence recorded in docs/compliance/2026-09-26-repository-audit.adoc.

• Fix Zig 0.15.2 DynLib, GPU export, CPU-feature and io_uring compatibility; clean up Chapel padding/domain warning sites.
• Harden Dragonfly response framing and timeout handling, failed batch-hash output, prefetch window handling, allocation cleanup and percentile arithmetic; add regression tests.
• Make Idris2 proof CI strict with a pinned, cached, non-root installation. Replace the nonexistent Chapel release asset with a checksum-verified package.
• Replace the ineffective HPC smoke test with a deterministic WAV fixture and exact JSON report assertions for shared/broadcast loading.
• Add standalone Zig and CI-harness gates; enforce action pins, pin the Pages generator, consolidate mise configuration, and make BoJ integration explicit opt-in over authenticated HTTPS.
• Replace stale contribution/agent scaffolding and document distributed proof obligations without claiming unestablished guarantees.

Related issues

Related to #33, #34 and #35; their full pinned-toolchain acceptance checks remain required. No automatic issue closure is requested.

#32 remains deliberately deferred. Its implementation gaps and proof prerequisites are documented in docs/decisions/distributed-aggregation-obligations.adoc; this PR does not add a placeholder Agda proof.

Validation performed locally

• 66 standalone Zig tests passed on Zig 0.15.2.
• 25 tests also passed with -O ReleaseFast across Dragonfly, crypto, prefetch, quality statistics and speaker modules.
• C ABI header compilation/static assertions passed.
• CI harness regression tests and workflow action-pin checks passed.
• All 15 workflow YAML files parsed with duplicate-key checking.
• Bash syntax, changed Zig formatting, banned Idris proof-pattern scan and git diff --check passed.

Verification limitations / acceptance gates

• Full linked FFI build/integration tests, Chapel builds/smoke tests and Idris2 proofs still require CI verification. Native package installation was blocked by network access locally; standalone tests are not a substitute.
• Idris2 cold-install and cache-hit paths both need verification. The pinned source bootstrap is retained intentionally because the suggested prebuilt repository/setup action were unavailable; caching and explicit install paths address the existing setup problem.
• Actionlint download was blocked; YAML parsing is not equivalent to semantic Actionlint validation.
• Containers, multi-locale stress, GPU/ONNX execution and external integrations were not tested.
• No commit signing key was configured in the sandbox; commit 8e531d0 is unsigned. Maintainer signing-policy review is required before merge; no signing credentials were fabricated or repository checks bypassed.

Remaining production blockers and review points

• Shared-state/handle concurrency, checkpoint durability and aggregate restoration, and cache configuration/artifact coherence remain unresolved; see the audit and issue Chapel: docudactyl-specific Agda formalisation (DistributedAggregationInvariants.agda) #32 plan.
• GPU/ML paths contain placeholders; backend discovery and throughput estimates are not execution/benchmark evidence.
• The existing MPL/Palimpsest notice inconsistency requires an owner decision. Existing licence notices/text were not changed.
• BoJ push automation becomes manual-only and requires BOJ_SERVER_URL plus BOJ_TOKEN; this is an intentional behaviour change.
• Remaining Chapel unstable APIs are documented, not globally suppressed.

This PR is a tested maintenance increment, not a claim that every issue is resolved, that distributed operation is production-ready, or that full RSR compliance has been certified.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: ea74d40a-a470-465f-86d0-691c7c5d4e4d

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}