feat(ci): unify Buck2 measurement admission

.github/workflows/ci.yml.genie.ts

@@ -40,7 +40,7 @@ import {
   validateNixStoreStep,
   defaultRefPolicyCheckJob,
 } from '../../genie/ci-workflow.ts'
-import { type CoreCIJobName } from '../../genie/ci.ts'
+import { buck2MeasurementTargets, type CoreCIJobName } from '../../genie/ci.ts'
 import {
   githubWorkflowEvent,
   type GitHubWorkflowArgs,
@@ -302,9 +302,11 @@ const normalCiIf = `\${{ ${ciMeasurementNotBaselineBackfillPredicate} }}`
 const job = ({
   step,
   extraSteps = [],
+  postSteps = [],
 }: {
   step: { name: string; run: string }
   extraSteps?: readonly any[]
+  postSteps?: readonly any[]
 }) => ({
   if: normalCiIf,
   'runs-on': namespaceRunner({
@@ -318,6 +320,7 @@ const job = ({
     ...baseSteps,
     ...extraSteps,
     step,
+    ...postSteps,
     savePnpmStateStep(),
     nixDiagnosticsSummaryStep,
     nixDiagnosticsArtifactStep(),
@@ -482,6 +485,29 @@ const jobs: Record<CoreCIJobName, ReturnType<typeof job> | ReturnType<typeof mul
       name: 'Buck2 local evidence and Nix bridge',
       run: runDevenvTasksBefore('buck2:check'),
     },
+    postSteps: [
+      ...buck2MeasurementTargets.map((target) => ({
+        name: `Adapt and admit Buck measurements: ${target.label}`,
+        if: 'always()',
+        shell: 'bash',
+        env: {
+          CI_MEASUREMENT_BUCK_TARGET: JSON.stringify(target),
+          CI_MEASUREMENT_SUBJECT_SHA: ciMeasurementSubjectEnv.CI_MEASUREMENT_SUBJECT_SHA,
+          CI_MEASUREMENT_CHECKOUT_SHA: '${{ github.sha }}',
+        },
+        run: [
+          'set -euo pipefail',
+          `output="tmp/buck2-ci-measurements/${target.id}/measurements.json"`,
+          'DEVENV_TUI=false "${DEVENV_BIN:?DEVENV_BIN not set}" shell --no-reload -- bun scripts/buck2-benchmark/assert-invalidation.mjs --contract-json "$CI_MEASUREMENT_BUCK_TARGET" --output "$output" "' +
+            target.rawPath +
+            '"',
+        ].join('\n'),
+      })),
+      ciMeasurementsArtifactStep({
+        artifactName: 'buck2-measurements',
+        path: 'tmp/buck2-ci-measurements',
+      }),
+    ],
   }),
   cargo: job({
     step: {
@@ -539,11 +565,11 @@ const downloadCurrentMeasurementArtifactStep = ({
   }) as const
 
 const ciMeasurementReportToolStep = {
-  name: 'Provide CI measurement report tools',
+  name: 'Provide CI measurement comparison tool',
   shell: 'bash',
   run: [
     'set -euo pipefail',
-    'for out in $(nix build --no-link --print-out-paths nixpkgs#jq nixpkgs#nodejs nixpkgs#gh nixpkgs#resvg); do',
+    'for out in $(nix build --no-link --print-out-paths nixpkgs#jq); do',
     '  echo "$out/bin" >> "$GITHUB_PATH"',
     'done',
   ].join('\n'),
@@ -801,8 +827,8 @@ const extraJobs: Record<string, any> = {
   },
   'ci-measurements-report': {
     name: 'ci/measurements-report',
-    if: normalCiIf,
-    needs: ['devenv-perf', 'nix-closure-sizes', 'source-shape'],
+    if: `\${{ always() && ${ciMeasurementNotBaselineBackfillPredicate} }}`,
+    needs: ['buck2', 'devenv-perf', 'nix-closure-sizes', 'source-shape'],
     'runs-on': namespaceRunner({
       profile: 'namespace-profile-linux-x86-64',
       runId: '${{ github.run_id }}',
@@ -815,18 +841,34 @@ const extraJobs: Record<string, any> = {
       checkoutStep(),
       installNixStep(),
       ciMeasurementReportToolStep,
-      downloadCurrentMeasurementArtifactStep({
-        artifactName: 'devenv-perf',
-        outputDir: `${ciMeasurementReportDir}/current/devenv-perf`,
-      }),
-      downloadCurrentMeasurementArtifactStep({
-        artifactName: 'nix-closure-measurements',
-        outputDir: `${ciMeasurementReportDir}/current/nix-closure-measurements`,
-      }),
-      downloadCurrentMeasurementArtifactStep({
-        artifactName: 'source-shape',
-        outputDir: `${ciMeasurementReportDir}/current/source-shape`,
-      }),
+      {
+        ...downloadCurrentMeasurementArtifactStep({
+          artifactName: 'buck2-measurements',
+          outputDir: `${ciMeasurementReportDir}/current/buck2-measurements`,
+        }),
+        'continue-on-error': true,
+      },
+      {
+        ...downloadCurrentMeasurementArtifactStep({
+          artifactName: 'devenv-perf',
+          outputDir: `${ciMeasurementReportDir}/current/devenv-perf`,
+        }),
+        'continue-on-error': true,
+      },
+      {
+        ...downloadCurrentMeasurementArtifactStep({
+          artifactName: 'nix-closure-measurements',
+          outputDir: `${ciMeasurementReportDir}/current/nix-closure-measurements`,
+        }),
+        'continue-on-error': true,
+      },
+      {
+        ...downloadCurrentMeasurementArtifactStep({
+          artifactName: 'source-shape',
+          outputDir: `${ciMeasurementReportDir}/current/source-shape`,
+        }),
+        'continue-on-error': true,
+      },
       downloadPreviousGitHubArtifactStep({
         artifactName: 'devenv-perf',
         outputDir: `${ciMeasurementReportDir}/baseline/devenv-perf`,
@@ -858,6 +900,7 @@ const extraJobs: Record<string, any> = {
         baselineDir: `${ciMeasurementReportDir}/baseline`,
         outputFile: `${ciMeasurementReportDir}/measurement-comparison.json`,
         regressionMode: 'warn',
+        assertionTargets: buck2MeasurementTargets,
         prComment: {
           enabled: true,
           title: 'CI Measurements',

CHANGELOG.md

@@ -4,6 +4,8 @@ All notable changes to this project will be documented in this file.
 
 ## [Unreleased]
 
+- **CI measurements**: Unify Buck2 invalidation evidence with the existing schema-v1 measurement pipeline. Consumer-owned typed assertions now drive both native Buck admission and the required shared report, while complete per-sample evidence gates semantic invalidation and timing profiles remain advisory.
+
 - Fix lazy Buck stage-0 recovery to snapshot only its fingerprinted source inputs, keep unrelated Cargo product manifests out of tool derivations, and retain the observability gate when shell-entry setup is disabled.
 
 - **Buck2 megarepo product**: add Python-free, separately cacheable `mr`,

context/ci-measurements.md

@@ -13,6 +13,7 @@ Active.
 | `deterministic` | Nix closure size, source lines, file counts            | Did a structural quantity exceed its budget?                          | Budget/diff against a comparable baseline.               |
 | `wall-clock`    | Devenv shell eval, task runtime, CLI command latency   | Did this PR make this operation slower on the same runner conditions? | Paired same-run base/head samples before merge blocking. |
 | `diagnostic`    | OTEL-traced shell eval, host context, trace breakdowns | Where did time go?                                                    | Never a regression gate; may be produced by required CI. |
+| `deterministic` | Buck invalidation action/materialization assertions    | Did every measured sample preserve the expected semantic boundary?    | Consumer-owned assertion over complete raw samples.      |
 
 The class is part of the observation contract through `measurementKind`.
 The comparison policy is part of the gate contract through `comparisonMode`.
@@ -27,6 +28,7 @@ semantics match:
 | `wall-clock`      | `paired`                  | Same PR run, same runner, base/head pairs     | Per-pair delta evidence interval.         |
 | `wall-clock`      | `historical`              | Previous comparable successful artifacts      | Advisory robust bands only.               |
 | `diagnostic`      | none                      | Optional context artifact or trace attachment | Not gateable.                             |
+| `deterministic`   | `assertion`               | No baseline; a typed expected value or range  | Every configured raw sample must satisfy. |
 
 Historical comparison is not a substitute for paired wall-clock evidence.
 Budget comparison is not a substitute for owner-approved semantic budgets.
@@ -76,6 +78,17 @@ This keeps probe-specific collection code separate from the reusable regression
 system. A new probe should not fork comparison, markdown rendering, or asset
 publication logic.
 
+Buck invalidation measurements use the same path. `genie/ci.ts` owns the typed
+product expectations consumed independently by the native Buck admission step
+and the shared report. The additive schema-v1 artifact owns measured samples,
+raw-evidence hashes, and an audit snapshot of that policy; it cannot redefine
+the policy. The comparator rejects a mismatched snapshot or fingerprint.
+
+Required assertions evaluate every sample, require exact configured sample
+indexes and complete Buck logs, and fail closed on missing or malformed
+evidence. Their median numeric value exists only for display. Phase timings and
+non-asserted action/materialization profiles remain diagnostic observations.
+
 The reusable engine boundary is specified in
 [ci-measurement-engine.md](./ci-measurement-engine.md). The long-term direction
 is to keep this artifact and comment contract as the source of truth while

devenv.nix

@@ -945,7 +945,6 @@ in
         --irrelevant-path packages/@overeng/megarepo/src/lib/ref.unit.test.ts \
         --runs 7 --warmups 2 --isolation-dir megarepo-mr-benchmark \
         --output "$output"
-      exec ${pkgs.nodejs}/bin/node scripts/buck2-benchmark/assert-invalidation.mjs "$output"
     '';
   };
 
@@ -1308,16 +1307,15 @@ in
         --execute \
         --in-place \
         --buck-incremental-only \
-        --assert-buck-invalidation \
-        --expected-relevant-actions 2 \
         --buck-bin ${buck2Machine}/bin/buck2 \
         --buck-config-file "$buck2_stage0_config" \
         --buck-config-file "$toolchain_config" \
         --buck-target //packages/@overeng/otel-scrape:product \
         --buck-target-platform //buck2/platforms:target_x86_64_linux_musl_static \
         --work-contract effect-utils/otel-scrape-native-product-v1 \
         --relevant-path packages/@overeng/otel-scrape/src/lib.rs \
-        --irrelevant-path context/dependency-materialization/intuition.md
+        --irrelevant-path context/dependency-materialization/intuition.md \
+        --output "$root/tmp/buck2-benchmark/otel-scrape-product.jsonl"
     '';
   };