ci: restore weekly assurance gates (#87)

Narrow Miri and test-only reachability so warning-denying builds no longer compile unused CRC, dispatch, tuning, Keccak, XXH3, or Linux ML-KEM assembly helpers.

Keep the CT API inventory on the pinned stable compiler, discover emitted evidence across stable and nightly Cargo layouts, and record the six audited public API additions for every release-evidence target.

Document CtDecision's redacted Debug output and cover the stable rustdoc JSON environment in the CT validation regression.

Author: loadingalias

ct.toml

@@ -2737,8 +2737,8 @@ name = "x86_64-unknown-linux-gnu"
 group = "linux"
 backend = "llvm"
 linker = "platform-default-unpinned"
-compiler_api_item_count = 2230
-compiler_api_sha256 = "671da8ccb1855d450418dc6fc3e79c9b9a2d50c518f98761d8c0fda6abb7c3b3"
+compiler_api_item_count = 2236
+compiler_api_sha256 = "ec37f397970ac2d9bce6c5188c48c0e1dfbd9b1d321674bce13395acdd6781f8"
 claim = "ct-intended"
 physical_timing = "required"
 binsec = "required"
@@ -2749,8 +2749,8 @@ name = "aarch64-unknown-linux-gnu"
 group = "linux"
 backend = "llvm"
 linker = "platform-default-unpinned"
-compiler_api_item_count = 2224
-compiler_api_sha256 = "2bc45c4c1aa47db7c9786ca5aae449cfc7e4370899841c96efbaeb7b67a909ae"
+compiler_api_item_count = 2230
+compiler_api_sha256 = "2f64f9277c6acbb0510f9b6bb2753b6adcf862f6e8f2945831c5b7607d0a9240"
 claim = "ct-intended"
 physical_timing = "required"
 binsec = "required"
@@ -2809,8 +2809,8 @@ name = "aarch64-apple-darwin"
 group = "macos"
 backend = "llvm"
 linker = "apple-ld-unpinned"
-compiler_api_item_count = 2224
-compiler_api_sha256 = "2bc45c4c1aa47db7c9786ca5aae449cfc7e4370899841c96efbaeb7b67a909ae"
+compiler_api_item_count = 2230
+compiler_api_sha256 = "2f64f9277c6acbb0510f9b6bb2753b6adcf862f6e8f2945831c5b7607d0a9240"
 claim = "ct-intended"
 physical_timing = "required"
 binsec = "unsupported"
@@ -2834,8 +2834,8 @@ name = "s390x-unknown-linux-gnu"
 group = "ibm"
 backend = "llvm"
 linker = "platform-default-unpinned"
-compiler_api_item_count = 2223
-compiler_api_sha256 = "e54c2a119d506935fda2279f7d7f9f75506ce86fe5b0b6fc72fd08a7e8090883"
+compiler_api_item_count = 2229
+compiler_api_sha256 = "8c5e606f4792a7a5052da0e00093fbaa01f56f2223264b7df67bc3ada774d4d5"
 claim = "ct-intended"
 physical_timing = "required"
 binsec = "unsupported"
@@ -2847,8 +2847,8 @@ name = "powerpc64le-unknown-linux-gnu"
 group = "ibm"
 backend = "llvm"
 linker = "platform-default-unpinned"
-compiler_api_item_count = 2223
-compiler_api_sha256 = "e85c77d60d67a4648efd50cda101b8248026eb57d9008ceaae2511e319b502d9"
+compiler_api_item_count = 2229
+compiler_api_sha256 = "24448b0c3dc339211793edc2999bcb77b57956ddde4c1d1111247c52067b9c9f"
 claim = "ct-intended"
 physical_timing = "required"
 binsec = "unsupported"
@@ -2860,8 +2860,8 @@ name = "riscv64gc-unknown-linux-gnu"
 group = "linux"
 backend = "llvm"
 linker = "platform-default-unpinned"
-compiler_api_item_count = 2223
-compiler_api_sha256 = "119e6aef49beac534d7155cba8b15a7774c7a4fb6990c9e304b07998844a0858"
+compiler_api_item_count = 2229
+compiler_api_sha256 = "3d1b7cfa425696e8d060773d2f2778119ce27b8aac3f69daaef1c24ddfb6e677"
 claim = "ct-intended"
 physical_timing = "required"
 binsec = "unsupported"

docs/constant-time.md

@@ -87,9 +87,10 @@ opaque authentication success/failure result may leak.
 Secret-bearing fixed-size keys, shared secrets, authentication tags, keypairs,
 and keyed outputs do not implement `PartialEq` or `Eq`. Their inherent `ct_eq`
 methods return `CtDecision`, an opaque, non-`Copy` value with no public
-constructor, formatting, equality, or implicit boolean conversion. Decisions
-can be composed with bitwise `&`, `|`, and `!`; the consuming `declassify()`
-method is the only public route to a branchable equality bit.
+constructor, equality, or implicit boolean conversion. Its `Debug` output is
+the fixed redacted string `CtDecision(..)` and does not expose the decision.
+Decisions can be composed with bitwise `&`, `|`, and `!`; the consuming
+`declassify()` method is the only public route to a branchable equality bit.
 
 Verification APIs keep that boundary inside the primitive and return one opaque
 `Result`. Public keys, nonces, signatures, and ciphertext containers are public

scripts/ct/artifacts.sh

@@ -114,7 +114,7 @@ fi
 OUT_DIR="$ROOT/target/ct/$TARGET/$PROFILE"
 ARTIFACT_DIR="$OUT_DIR/artifacts"
 BUILD_TARGET_DIR="$ROOT/target/ct-build/$TARGET/$PROFILE"
-DEPS_DIR="$BUILD_TARGET_DIR/$TARGET/$PROFILE/deps"
+EMIT_ROOT="$BUILD_TARGET_DIR/$TARGET/$PROFILE"
 rm -rf "$OUT_DIR"
 rm -rf "$BUILD_TARGET_DIR"
 mkdir -p "$ARTIFACT_DIR"
@@ -138,7 +138,7 @@ LIB_EMITTED=()
 while IFS= read -r artifact; do
   LIB_EMITTED+=("$artifact")
 done < <(
-  find "$DEPS_DIR" -maxdepth 1 -type f \
+  find "$EMIT_ROOT" -type f \
     \( -name 'rscrypto_ct_harness*.ll' \
     -o -name 'rscrypto_ct_harness*.s' \
     -o -name 'rscrypto_ct_harness*.o' \
@@ -147,7 +147,7 @@ done < <(
 )
 
 if [[ ${#LIB_EMITTED[@]} -eq 0 ]]; then
-  echo "no CT harness emitted artifacts found in $DEPS_DIR" >&2
+  echo "no CT harness emitted artifacts found under $EMIT_ROOT" >&2
   exit 1
 fi
 if [[ ${#LIB_EMITTED[@]} -ne 3 ]]; then
@@ -201,7 +201,7 @@ BIN_EMITTED=()
 while IFS= read -r artifact; do
   BIN_EMITTED+=("$artifact")
 done < <(
-  find "$DEPS_DIR" -maxdepth 1 -type f \
+  find "$EMIT_ROOT" -type f \
     \( -name 'rscrypto_ct_evidence*.ll' \
     -o -name 'rscrypto_ct_evidence*.s' \
     -o -name 'rscrypto_ct_evidence*.o' \

scripts/ct/evidence_validation_test.py

@@ -142,6 +142,36 @@ def main() -> None:
   configure_target_environment("powerpc64le-unknown-linux-gnu", unrelated_environment)
   assert unrelated_environment == {}
 
+  captured_rustdoc: dict[str, object] = {}
+  original_run = manifest_validation.subprocess.run
+
+  def capture_rustdoc(command, **kwargs):
+    captured_rustdoc["command"] = command
+    captured_rustdoc["env"] = kwargs.get("env")
+    return subprocess.CompletedProcess(command, 1, "", "rustdoc unavailable")
+
+  manifest_validation.subprocess.run = capture_rustdoc
+  try:
+    with tempfile.TemporaryDirectory() as temporary:
+      inventory_errors: list[str] = []
+      assert (
+        manifest_validation.compiler_public_api_snapshot(
+          Path(temporary),
+          "aarch64-apple-darwin",
+          ("rscrypto::auth",),
+          inventory_errors,
+        )
+        is None
+      )
+      assert inventory_errors == ["compiler public-API inventory failed: rustdoc unavailable"]
+  finally:
+    manifest_validation.subprocess.run = original_run
+
+  rustdoc_env = captured_rustdoc["env"]
+  assert isinstance(rustdoc_env, dict)
+  assert rustdoc_env["RUSTC_BOOTSTRAP"] == "rscrypto"
+  assert captured_rustdoc["command"][-4:] == ["-Z", "unstable-options", "--output-format", "json"]
+
   commit = "a" * 40
   validate_exact_candidate("1.2.3", commit, "1.2.3", commit)
   expect_failure(lambda: validate_exact_candidate("1.2.3", commit, "1.2.4", commit))

scripts/ct/validate.py

@@ -6,6 +6,7 @@
 import argparse
 import hashlib
 import json
+import os
 import re
 import subprocess
 import sys
@@ -242,7 +243,11 @@ def compiler_public_api_snapshot(
     "--output-format",
     "json",
   ]
-  completed = subprocess.run(command, cwd=root, capture_output=True, text=True, check=False)
+  rustdoc_env = os.environ.copy()
+  # rustdoc JSON is unstable even when the selected release compiler supports it. Scope the escape hatch to
+  # rscrypto so the inventory describes the exact compiler used by this CT evidence lane.
+  rustdoc_env["RUSTC_BOOTSTRAP"] = "rscrypto"
+  completed = subprocess.run(command, cwd=root, capture_output=True, text=True, check=False, env=rustdoc_env)
   if completed.returncode != 0:
     detail = completed.stderr.strip().splitlines()
     suffix = f": {detail[-1]}" if detail else ""

src/auth/mlkem/portable/aarch64.rs

@@ -62,9 +62,9 @@ unsafe extern "C" {
     input2: *const u8,
     caps: *const usize,
   ) -> u64;
-  #[cfg(any(test, feature = "diag"))]
+  #[cfg(test)]
   fn rscrypto_mlkem_rej_uniform_3blocks_aarch64_linux(out: *mut u16, input: *const u8) -> usize;
-  #[cfg(any(test, feature = "diag"))]
+  #[cfg(test)]
   fn rscrypto_mlkem_basemul_accumulate_aarch64_linux(
     acc: *mut u16,
     a: *const u16,
@@ -187,7 +187,7 @@ pub(super) unsafe fn sample_ntt_rej_uniform_triple_block_bounded_asm(
   unpack_triple_counts(packed)
 }
 
-#[cfg(all(any(test, feature = "diag"), target_os = "linux"))]
+#[cfg(all(test, target_os = "linux"))]
 #[inline]
 pub(super) unsafe fn sample_ntt_rej_uniform_3blocks_asm(out: *mut u16, input: *const u8) -> usize {
   // SAFETY: Linux aarch64 three-block SampleNTT rejection parser call because:
@@ -200,7 +200,7 @@ pub(super) unsafe fn sample_ntt_rej_uniform_3blocks_asm(out: *mut u16, input: *c
 }
 
 #[inline]
-#[cfg(any(test, feature = "diag", target_os = "macos"))]
+#[cfg(any(test, target_os = "macos"))]
 /// # Safety
 ///
 /// The active platform must provide the matching ML-KEM AArch64 assembly

src/checksum/common/tests.rs

@@ -33,6 +33,7 @@ where
   /// Test that combine produces crc(A || B) from crc(A) and crc(B).
   ///
   /// This is the fundamental combine property that enables parallel CRC computation.
+  #[cfg(not(miri))]
   #[inline]
   pub(in crate::checksum) fn test_combine_property(data: &[u8], split: usize) {
     let split = split.checked_rem(data.len()).unwrap_or(0);
@@ -63,6 +64,7 @@ where
   }
 
   /// Test combine with empty second part (identity case).
+  #[cfg(not(miri))]
   #[inline]
   pub(in crate::checksum) fn test_combine_empty_suffix(data: &[u8]) {
     let crc_data = C::checksum(data);
@@ -73,6 +75,7 @@ where
   }
 
   /// Test combine with empty first part.
+  #[cfg(not(miri))]
   #[inline]
   pub(in crate::checksum) fn test_combine_empty_prefix(data: &[u8]) {
     let crc_empty = C::checksum(&[]);
@@ -98,6 +101,7 @@ where
   }
 
   /// Test streaming with byte-at-a-time updates.
+  #[cfg(not(miri))]
   #[inline]
   pub(in crate::checksum) fn test_streaming_byte_at_a_time(data: &[u8]) {
     let oneshot = C::checksum(data);
@@ -112,6 +116,7 @@ where
   }
 
   /// Test streaming across a specific chunk size boundary.
+  #[cfg(not(miri))]
   #[inline]
   pub(in crate::checksum) fn test_streaming_chunked(data: &[u8], chunk_size: usize) {
     if chunk_size == 0 {
@@ -167,6 +172,7 @@ where
   /// 1. Streaming first half
   /// 2. Computing second half separately
   /// 3. Combining the results
+  #[cfg(not(miri))]
   #[inline]
   pub(in crate::checksum) fn test_streaming_and_combine(data: &[u8]) {
     if data.is_empty() {

src/checksum/crc64/portable.rs

@@ -10,14 +10,14 @@ use crate::checksum::common::portable;
 
 /// CRC-64-XZ slice-by-8 computation.
 #[inline]
-#[cfg(all(test, any(target_arch = "x86_64", target_arch = "aarch64")))]
+#[cfg(all(test, not(miri), any(target_arch = "x86_64", target_arch = "aarch64")))]
 pub(super) fn crc64_slice8_xz(crc: u64, data: &[u8]) -> u64 {
   crc64_slice8(crc, data, &kernel_tables::XZ_TABLES_8)
 }
 
 /// CRC-64-NVME slice-by-8 computation.
 #[inline]
-#[cfg(all(test, any(target_arch = "x86_64", target_arch = "aarch64")))]
+#[cfg(all(test, not(miri), any(target_arch = "x86_64", target_arch = "aarch64")))]
 pub(super) fn crc64_slice8_nvme(crc: u64, data: &[u8]) -> u64 {
   crc64_slice8(crc, data, &kernel_tables::NVME_TABLES_8)
 }

src/hashes/crypto/keccak.rs

@@ -434,7 +434,7 @@ fn read_unaligned_block_lane<const RATE: usize>(block: &[u8; RATE], lane: usize)
 ///
 /// Since `RATE` is a const generic, `RATE / 8` is compile-time known and LLVM
 /// eliminates all `if lane < lanes` branches — the result is straight-line code.
-#[cfg(target_arch = "aarch64")]
+#[cfg(all(target_arch = "aarch64", not(miri)))]
 #[inline]
 fn keccakf_absorb_portable<const RATE: usize>(state: &mut [u64; 25], block: &[u8; RATE]) {
   debug_assert_eq!(RATE % 8, 0);

src/hashes/fast/xxh3/kernels.rs

@@ -43,7 +43,7 @@ impl Xxh3KernelId {
 
 /// Long-path-only entry for 64-bit hash (>240B, no ≤240B length checks).
 #[cfg(any(
-  test,
+  all(test, not(miri)),
   not(any(
     all(target_arch = "x86_64", any(target_feature = "avx512f", target_feature = "avx2")),
     all(target_arch = "aarch64", target_feature = "neon"),
@@ -69,7 +69,7 @@ pub(crate) fn hash64_long_fn(id: Xxh3KernelId) -> fn(&[u8], u64) -> u64 {
 
 /// Long-path-only entry for 128-bit hash (>240B, no ≤240B length checks).
 #[cfg(any(
-  test,
+  all(test, not(miri)),
   not(any(
     all(target_arch = "x86_64", any(target_feature = "avx512f", target_feature = "avx2")),
     all(target_arch = "aarch64", target_feature = "neon"),