ci: integrate safe issue slices for timeouts, Zig setup and ABI validation

[arena-ai-coding-agent]

Non-destructive issue integration

Related to #39, #43, #44; no umbrella issue is closed. Full queue and dependencies: docs/ISSUE-RESOLUTION-PLAN.adoc.

• Triage Hypatia workflow findings + wire gitbot-fleet learning token (estate) #43: complete the eight missing local job timeouts; preserve all existing budgets, triggers, steps, permissions and pins in that isolated commit. Reusable callers remain unchanged.
• Durable idris2 (+ zig) toolchain for web sessions #44: add an opt-in user-local Zig 0.15.2 installer, using exact SHA-256-pinned Linux PyPI wheels (the distribution route already used by the legacy hook). No sudo, system Python modifications, profile changes, automatic activation or replacement of the existing hook. Offline boundary/restart/failure tests run in Zig CI. Usage and remaining Idris/environment work: docs/WEB-TOOLCHAIN.adoc.
• FFI completion: crypto-integrity (remove Idris stubs + link libochrance.so), blake3Hash ABI, ECHIDNA #39: compile the separate ABI package in the existing Idris2 job. No ABI signatures, stubs, proof assumptions, or runtime implementations changed.

Validation performed locally

• Core and ABI packages compile with Idris2 0.8.0.
• Parser suite passes; property 47/47; integration 55/55.
• Zig 0.15.2 tests: 25/25.
• C dlopen known-answer/link test passes.
• Idris-to-Zig crypto/Merkle/signature runtime suite: 12/12.
• Structural E2E: 27/27.
• Fresh checksum-pinned x86_64 Zig install succeeds; completed installation reuses offline.
• Installer offline scenarios: 8 pass; shell syntax and git diff --check pass.
• All workflow YAML parses; 27 local jobs have timeouts; five reusable callers remain without unsupported timeout keys.

Local compiler qualification: Chez 10.0.0 was built in ignored scratch storage; Idris2 0.8.0 was bootstrapped with Chez support. GMP development headers were unavailable, so refc was omitted only in that scratch build. Results validate the Chez backend used by CI, not refc or a finished devcontainer. The pinned aarch64 Zig wheel is not execution-tested here.

Confirmed merge blocker — not a YAML/build failure

The public Actions annotation says:

Actor is not allowed to trigger Actions workflows. Workflow file: '.github/workflows/idris2.yml'.

Evidence: https://github.com/hyperpolymath/ochrance/actions/runs/36128183989 . All 17 Actions runs at the initial PR head failed before creating jobs, including unchanged workflows. Actions permission APIs return 403. An authorized maintainer must rerun/trigger checks, or correct the GitHub App's Actions-trigger authorization. No permissions/protection bypass, credential change, or merge attempted. External scanner success does not substitute for these gates.

Still open

• Triage Hypatia workflow findings + wire gitbot-fleet learning token (estate) #43 critical-finding evidence/learning-token work remains upstream/access-dependent; no alerts dismissed. Posting an issue progress comment was denied by the integration, so triage is recorded here.
• FFI completion: crypto-integrity (remove Idris stubs + link libochrance.so), blake3Hash ABI, ECHIDNA #39 zero-digest ABI wrapper needs an explicit allocation/error contract and runtime tests before replacement; ECHIDNA needs its real external ABI.
• Durable idris2 (+ zig) toolchain for web sessions #44 full rootless Idris bootstrap and persistent image lifecycle remain follow-up work.
• Confirm/resolve probable standards ↔ rsr-template divergence (Flag A) #40/Sync .machine_readable to current rsr-template scaffold (estate umbrella) #41 canonical estate scaffold reconciliation and Bring wikis to bleeding-edge (estate umbrella) #42 wiki publishing remain separate dependencies, not fabricated local fixes.

Changes are split into revertible commits; no data/schema migrations. Keep unmerged until required GitHub checks pass.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 760c01a7-44a5-460d-8ea1-c4133e95e43c

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}