feat(helios): land benchmark-provenance + harness-preservation + toolchain-refresh shard

.github/workflows/ci.yml

@@ -1,251 +0,0 @@
-name: CI
-
-on:
-  push:
-    branches: [main, master, develop]
-  pull_request:
-    branches: [main, master, develop]
-
-permissions:
-  contents: read
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  detect:
-    name: Detect Languages
-    runs-on: ubuntu-latest
-    outputs:
-      has_rust: ${{ steps.detect.outputs.has_rust }}
-      has_deny: ${{ steps.detect.outputs.has_deny }}
-      has_python: ${{ steps.detect.outputs.has_python }}
-      has_go: ${{ steps.detect.outputs.has_go }}
-      has_typescript: ${{ steps.detect.outputs.has_typescript }}
-      has_security: ${{ steps.detect.outputs.has_security }}
-      has_trunk: ${{ steps.detect.outputs.has_trunk }}
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 1
-
-      - id: detect
-        run: |
-          set +e
-          # Initialize all outputs to false (critical: every output must be set)
-          echo "has_rust=false" >> $GITHUB_OUTPUT
-          echo "has_deny=false" >> $GITHUB_OUTPUT
-          echo "has_python=false" >> $GITHUB_OUTPUT
-          echo "has_go=false" >> $GITHUB_OUTPUT
-          echo "has_typescript=false" >> $GITHUB_OUTPUT
-          echo "has_security=false" >> $GITHUB_OUTPUT
-          echo "has_trunk=false" >> $GITHUB_OUTPUT
-
-          # Rust: needs Cargo.toml AND deny.toml
-          if [ -f "Cargo.toml" ] || [ -f "**/Cargo.toml" ]; then
-            echo "has_rust=true" >> $GITHUB_OUTPUT
-            if [ -f "deny.toml" ]; then
-              echo "has_deny=true" >> $GITHUB_OUTPUT
-            fi
-          fi
-
-          # Python: needs pyproject.toml, setup.py, requirements.txt, or *.py
-          if [ -f "pyproject.toml" ] || [ -f "setup.py" ] || [ -f "requirements.txt" ] || find . -maxdepth 3 -name "*.py" -type f 2>/dev/null | head -1 | grep -q .; then
-            echo "has_python=true" >> $GITHUB_OUTPUT
-          fi
-
-          # Go: needs go.mod
-          if [ -f "go.mod" ]; then
-            echo "has_go=true" >> $GITHUB_OUTPUT
-          fi
-
-          # TypeScript / JS: needs package.json (with type=module or tsconfig or js files)
-          if [ -f "package.json" ]; then
-            echo "has_typescript=true" >> $GITHUB_OUTPUT
-          fi
-
-          # Security: always run (bandit/gitleaks/dependency-review)
-          echo "has_security=true" >> $GITHUB_OUTPUT
-
-          # Trunk: only if trunk.yaml exists
-          if [ -f "trunk.yaml" ]; then
-            echo "has_trunk=true" >> $GITHUB_OUTPUT
-          fi
-
-          echo ""
-          echo "=== Detected ==="
-          echo "rust=${{ steps.detect.outputs.has_rust }} deny=${{ steps.detect.outputs.has_deny }} python=${{ steps.detect.outputs.has_python }} go=${{ steps.detect.outputs.has_go }} typescript=${{ steps.detect.outputs.has_typescript }} security=${{ steps.detect.outputs.has_security }} trunk=${{ steps.detect.outputs.has_trunk }}"
-
-  rust:
-    name: Rust
-    needs: detect
-    if: needs.detect.outputs.has_rust == 'true'
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@stable
-      - uses: Swatinem/rust-cache@v2
-      - name: cargo fmt --check
-        run: |
-          cargo fmt --all -- --check
-      - name: cargo clippy
-        run: |
-          cargo clippy --all-targets -- -D warnings
-      - name: cargo test
-        run: |
-          cargo test --workspace --no-fail-fast
-
-  cargo-deny:
-    name: Cargo Deny (Advisories + Licenses)
-    needs: detect
-    if: needs.detect.outputs.has_deny == 'true'
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@stable
-      - name: cargo-deny check
-        # v2 (SHA-pinned, same as rust-ci.yml/cargo-deny.yml): v1 bundles
-        # cargo-deny 0.14.21, which cannot parse the current RustSec advisory
-        # database (TOML parse error on RUSTSEC-2026-0109).
-        uses: EmbarkStudios/cargo-deny-action@3c6349835b2b7b196a839186cb8b78e02f7b5f25 # v2
-        with:
-          arguments: --all-features
-
-  python:
-    name: Python
-    needs: detect
-    if: needs.detect.outputs.has_python == 'true'
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
-        with:
-          python-version: '3.11'
-      - name: Install ruff
-        run: pip install ruff
-      - name: ruff check
-        run: ruff check .
-      - name: ruff format --check
-        run: ruff format --check .
-
-  go:
-    name: Go
-    needs: detect
-    if: needs.detect.outputs.has_go == 'true'
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
-        with:
-          go-version: '1.22'
-      - name: gofmt check
-        run: gofmt -l .
-      - name: go vet
-        run: go vet ./...
-      - name: go test
-        run: go test ./...
-
-  typescript:
-    name: TS/JS
-    needs: detect
-    if: needs.detect.outputs.has_typescript == 'true'
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Setup pnpm
-        uses: pnpm/action-setup@a8198c4bff370c8506180b035930dea56dbd5288 # v5
-        with:
-          run_install: false
-      - name: Setup Node.js
-        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
-        with:
-          node-version: 22
-          cache: pnpm
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-      - name: lint
-        run: |
-          if [ -f package.json ] && grep -q '"lint"' package.json; then
-            pnpm run lint
-          fi
-      - name: test
-        run: |
-          if [ -f package.json ] && grep -q '"test"' package.json; then
-            pnpm run test
-          fi
-
-  security:
-    name: Security Scan
-    needs: detect
-    if: needs.detect.outputs.has_security == 'true'
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          # gitleaks-action scans the PR commit range on pull_request events;
-          # the default depth-1 checkout lacks the parent commit and makes the
-          # git log range fail ("stderr is not empty").
-          fetch-depth: 0
-      - name: gitleaks
-        uses: gitleaks/gitleaks-action@v2
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-  dep-review:
-    name: Dependency Review
-    if: github.event_name == 'pull_request'
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/dependency-review-action@v4
-        with:
-          fail-on-severity: low
-
-  lint:
-    name: ci / lint
-    if: always()
-    needs: [detect, rust, cargo-deny, python, go, typescript, security, dep-review]
-    runs-on: ubuntu-latest
-    steps:
-      - name: Aggregate lint gate
-        run: |
-          failed=0
-          for pair in \
-            "rust:${{ needs.rust.result }}" \
-            "cargo-deny:${{ needs.cargo-deny.result }}" \
-            "python:${{ needs.python.result }}" \
-            "go:${{ needs.go.result }}" \
-            "typescript:${{ needs.typescript.result }}" \
-            "security:${{ needs.security.result }}" \
-            "dep-review:${{ needs.dep-review.result }}" \
-            ; do
-            name="${pair%%:*}"
-            result="${pair#*:}"
-            if [ "$result" = "failure" ] || [ "$result" = "cancelled" ]; then
-              echo "  ✗ $name: $result"
-              failed=$((failed + 1))
-            elif [ "$result" = "success" ] || [ "$result" = "skipped" ]; then
-              echo "  ✓ $name: $result"
-            else
-              echo "  ? $name: $result"
-            fi
-          done
-          if [ "$failed" -gt 0 ]; then
-            echo ""
-            echo "❌ $failed lint check(s) failed"
-            exit 1
-          fi
-          echo ""
-          echo "✅ All lint checks passed (or were skipped)"
-
-  test:
-    name: ci / test
-    if: always()
-    needs: [lint]
-    runs-on: ubuntu-latest
-    steps:
-      - name: Test gate
-        run: |
-          # Test gate is currently combined with lint
-          echo "✅ All test stages passed (gated via ci / lint)"

.trunk/trunk.yaml

@@ -1,70 +0,0 @@
-# =============================================================================
-# Trunk.io — Lint/format configuration (schema v0.1)
-# =============================================================================
-# Migrated 2026-08-09 from the legacy top-level linters/formatters/actions/
-# cache/env schema to version: 0.1 + lint/fmt blocks. Tool versions are
-# trunk-io/plugins known-good versions; update with `trunk upgrade`.
-# https://docs.trunk.io/
-# =============================================================================
-
-version: 0.1
-
-cli:
-  version: 1.22.2
-
-plugins:
-  sources:
-    - id: trunk
-      ref: v1.6.1
-      uri: https://github.com/trunk-io/plugins
-
-# Linters (auto-detected by file type)
-lint:
-  enabled:
-    - actionlint@1.7.8
-    - black@25.9.0
-    - clippy@1.65.0
-    - eslint@8.10.0
-    - golangci-lint@1.64.8
-    - mypy@1.20.2
-    - ruff@0.14.3
-    - shellcheck@0.11.0
-    - taplo@0.10.0
-    - yamllint@1.37.1
-  definitions:
-    - name: actionlint
-      commands:
-        - name: lint
-          run: actionlint ${target}
-    - name: black
-      commands:
-        - name: lint
-          run: black --check --line-length 100 ${target}
-    - name: clippy
-      commands:
-        - name: lint
-          run: cargo clippy --all-targets --all-features -- -D warnings
-    - name: mypy
-      commands:
-        - name: lint
-          run: mypy --ignore-missing-imports ${target}
-    - name: ruff
-      commands:
-        - name: lint
-          run: ruff check --output-format=github ${target}
-
-# Formatters
-fmt:
-  enabled:
-    - black@25.9.0
-    - prettier@3.6.2
-    - rustfmt@1.65.0
-  definitions:
-    - name: black
-      commands:
-        - name: format
-          run: black --line-length 100 ${target}
-    - name: rustfmt
-      commands:
-        - name: format
-          run: rustfmt ${target}