Bound Miri release gate coverage

Author: eldryoth

scripts/check_miri.sh

@@ -11,19 +11,61 @@ no_default_output="$evidence_dir/no-default-features.txt"
 all_features_output="$evidence_dir/all-features.txt"
 manifest="$evidence_dir/MANIFEST.txt"
 
+run_miri_case() {
+    output="$1"
+    feature_args="$2"
+    test_filter="$3"
+
+    echo "command: rustup run nightly cargo miri test $feature_args $test_filter -- --exact" >>"$output"
+    rustup run nightly cargo miri test $feature_args "$test_filter" -- --exact >>"$output" 2>&1
+}
+
 mkdir -p "$evidence_dir"
 
 echo "Miri checks: no-default-features scalar surface"
 no_default_status=0
-rustup run nightly cargo miri test --no-default-features >"$no_default_output" 2>&1 || no_default_status="$?"
+{
+    echo "base64-ng Miri no-default-features evidence"
+    echo
+} >"$no_default_output"
+
+for test_filter in \
+    "tests::encodes_standard_vectors" \
+    "tests::decodes_standard_vectors" \
+    "tests::rejects_non_canonical_padding_bits" \
+    "tests::supports_unpadded_url_safe" \
+    "decode_backend::tests::boundary_uses_only_admitted_backends" \
+    "errors::tests::index_offsets_saturate_on_overflow"
+do
+    if [ "$no_default_status" -eq 0 ]; then
+        run_miri_case "$no_default_output" "--no-default-features" "$test_filter" || no_default_status="$?"
+    fi
+done
 cat "$no_default_output"
 
 if [ "$no_default_status" -ne 0 ]; then
     all_features_status=99
 else
     echo "Miri checks: all-features scalar, alloc, and stream surface"
     all_features_status=0
-    rustup run nightly cargo miri test --all-features >"$all_features_output" 2>&1 || all_features_status="$?"
+    {
+        echo "base64-ng Miri all-features evidence"
+        echo
+    } >"$all_features_output"
+
+    for test_filter in \
+        "tests::encodes_standard_vectors" \
+        "tests::decodes_standard_vectors" \
+        "decode_slice_clear_tail_scrubs_output_on_error" \
+        "ct_decode_slice_staged_clear_tail_copies_only_after_success" \
+        "stream_encoder_direct_write_buffers_tail_bytes" \
+        "stream_decoder_direct_write_processes_multiple_quads" \
+        "stream_decoder_fails_closed_after_malformed_input"
+    do
+        if [ "$all_features_status" -eq 0 ]; then
+            run_miri_case "$all_features_output" "--all-features" "$test_filter" || all_features_status="$?"
+        fi
+    done
     cat "$all_features_output"
 fi
 
@@ -47,8 +89,7 @@ fi
     fi
     echo
     echo "commands:"
-    echo "rustup run nightly cargo miri test --no-default-features"
-    echo "rustup run nightly cargo miri test --all-features"
+    echo "See no-default-features.txt and all-features.txt for exact per-test Miri commands."
     echo
     echo "status:"
     echo "no_default_features=$no_default_status"
@@ -64,7 +105,8 @@ fi
     fi
     echo
     echo "interpretation:"
-    echo "This evidence records Miri coverage for scalar, alloc, and stream surfaces on this machine."
+    echo "This evidence records bounded Miri coverage for representative scalar, alloc, and stream surfaces on this machine."
+    echo "Exhaustive/property-style parity sweeps are intentionally handled by normal test, nextest, hardware, and CI gates."
     echo "It checks undefined behavior that Miri can observe, but it is not a formal proof."
 } >"$manifest"