fix(hw-gate): import the runner user's login toolchain before building

[Kaden-Schutt]

Summary

Second live run on #686 (33849478193): Sol read the diff and authorized hardware, both lanes started, both failed inside 40 s — no GPU was ever touched:

"build_error": "[Errno 2] No such file or directory: 'cargo'"

Both runners are systemd services. actions-runner/.path was written at install (2026-07-11) and is the distro default; the service environment has no ~/.cargo/bin, no /opt/rocm/core/bin, no ROCM_PATH. The #679 evidence runs were driven by hand from a login shell, which is why this never surfaced. Nothing on either host changed.

Changes

hw-run and fable-decide gain one step before their build: import the runner user's login PATH (→ GITHUB_PATH) and the ROCm variables ROCM_PATH, HIP_PATH, HSA_PATH, HIP_PLATFORM, LD_LIBRARY_PATH (→ GITHUB_ENV) via bash -lc. Host-agnostic; no runner reconfiguration.

Which surface(s) does this touch?

• policy files — hw-gate.yml (hard floor: a human merges this)

Evidence

Step body executed under a bare service environment on hiptrx (env -i PATH=<distro default>): yields ROCM_PATH=/opt/rocm/core, HIP_PATH=/opt/rocm/core, LD_LIBRARY_PATH=/opt/rocm/core/lib, and cargo / hipcc / omp resolve on the resulting PATH. hipx's login shell carries the same variables (/opt/rocm/core/bin, ~/.cargo/bin). Workflow YAML parses.

After merge

Re-dispatch on #686: gh workflow run hw-gate.yml -f pr=686 (gate workflow comes from base).

[hipfire-sol]

hw-gate sol prelim

summary: The workflow imports the self-hosted runner user's login-shell PATH and selected ROCm environment variables into GitHub Actions before hardware-route execution and Fable's head/base builds, fixing service jobs that could not resolve cargo or hipcc. The commands only read the trusted runner user's login environment and append recognized values to GitHub-managed environment files; they do not alter repository code, runner configuration, or external state.

run_hardware: true
run_hardware_reasons: The changed shell is bounded and legible: bash -lc obtains the runner user's login environment, PATH entries are written to GITHUB_PATH, and only five explicitly named ROCm variables are written to GITHUB_ENV.; No network access, credential output, repository mutation, encoded content, or unaccounted executable is introduced.; A live hardware dispatch is the appropriate confirmation because the claimed defect exists specifically in the systemd runner environment; successful route startup and head/base builds would prove cargo and ROCm tooling are available to subsequent steps.

routes:

mode	tag	source	why
—	—	—	no routes

unavailable_routes:

(none)

claim_assessment: The author claims both self-hosted service lanes lacked cargo/ROCm paths and that importing the login environment fixes hardware-route and Fable builds. This is proven only if a dispatch reaches and completes the build portions on both hiptrx and hipx without the prior cargo-not-found error; no model fixture route is needed because the diff changes CI environment setup rather than model behavior.

[hipfire-sol]

hw-gate evidence — 2 lane(s) — verdict fail

lane hiptrx (unknown)

hw-gate evidence

field	value
base	23925666c8d528c8a5e3185014e99cacb4d39a49
head	48da203e78bcb082e66c398f441adf895d634c7f
buckets
host gfx	unknown
host rocm	7.15.26333-0000000
device	3
runner	hiptrx
daemon_md5	None
hipfire_md5	None
build_seconds	0.0003571510314941406
verdict	fail
logs_dir	hw-gate-logs
build_error	[Errno 2] No such file or directory: 'cargo'

fixtures

no fixtures

kernel

not run

lane hipx (gfx1100)

hw-gate evidence

field	value
base	23925666c8d528c8a5e3185014e99cacb4d39a49
head	48da203e78bcb082e66c398f441adf895d634c7f
buckets
host gfx	gfx1100
host rocm	7.15.26333-0000000
device	0
runner	hipx
daemon_md5	None
hipfire_md5	None
build_seconds	0.00036263465881347656
verdict	fail
logs_dir	hw-gate-logs
build_error	[Errno 2] No such file or directory: 'cargo'

fixtures

no fixtures

kernel

not run

[hipfire-sol]

hw-gate sol verdict

{
  "claim_verdict": "disproven",
  "confidence": 0.99,
  "coverage": {
    "gaps": [
      "The policy-file change still requires human review.",
      "Neither lane reached a successful build or any hardware route."
    ],
    "surfaces_evidenced": [
      "ci",
      "build",
      "environment"
    ],
    "surfaces_touched": [
      "policy",
      "ci",
      "build",
      "environment"
    ]
  },
  "decision": "block",
  "eyeball": [
    "Both lane reports show build_error \"[Errno 2] No such file or directory: 'cargo'\", null binary MD5s, and build durations below one millisecond."
  ],
  "phase": "verdict",
  "rationale": "The added login-shell import at .github/workflows/hw-gate.yml:227-228 was exercised but did not make cargo available to the following route step. Both hiptrx and hipx failed at subprocess creation with the same cargo-not-found error this PR claims to fix; no binaries or fixture evidence were produced. The claim is therefore disproven and the failed hardware evidence requires block.",
  "regressions": []
}

Floor: hard=['hw_run_result=failure', "evidence verdict='fail'", 'policy_paths: .github/workflows/hw-gate.yml'] soft=["coverage_gaps: ['The policy-file change still requires human review.', 'Neither lane reached a successful build or any hardware route.']"] model_decision=block final=block

[hipfire-sol]

hw-gate sol verdict block: The added login-shell import at .github/workflows/hw-gate.yml:227-228 was exercised but did not make cargo available to the following route step. Both hiptrx and hipx failed at subprocess creation with the same cargo-not-found error this PR claims to fix; no binaries or fixture evidence were produced. The claim is therefore disproven and the failed hardware evidence requires block.