ci: build every declared MORPH_BUILD_* option, and let a red leg report every surface it measured (fixes #605, fixes #618)

[Yaraslaut]

Two CI tickets, one commit each, disjoint edits to .github/workflows/ci.yml.
Either commit can be dropped and force-pushed without redoing the other.

fixes #605
fixes #618

---

Commit 1 — #605: build MORPH_BUILD_BANK_GUI, and derive the option list

(a) -DMORPH_BUILD_BANK_GUI=ON and -DMORPH_BUILD_BANK_EXAMPLE=ON added to
linux-all-features' configure step. Both are needed: the root CMakeLists only
descends into examples/bank under the latter, and examples/bank only into
gui/ under the former. That leg is the one that can host them — it already
installs Qt 6.8.1 from aqtinstall (the GUI needs Qml/Quick/QuickControls2 at
6.5+) and already installs the ODBC/SQLite/yaml-cpp/libzip set the bank
example's Lightweight fetch requires.

(b) scripts/check_workflow_option_coverage.py plus a new option-coverage
job. It enumerates every option(MORPH_BUILD_...) in the tracked CMake files
and every -DMORPH_BUILD_*=ON in .github/workflows/, and fails when a
declared option is built by nothing. Covered means: declared default ON, or
enabled by a native workflow, or enabled through a matrix key some leg sets
ON, or exempt with a written reason. The failure message says how to cover
the option; the word "exempt" does not appear in it.

The job lives in ci.yml because drift-guard.yml is held by #614. It belongs
there once that lands.

Non-vacuity — measured, not asserted

Two mutations, real output.

A declared option that no job enables. Added
option(MORPH_BUILD_TELEMETRY "Build the telemetry sink (experiment)" OFF) to
CMakeLists.txt and ran the check:

::error::MORPH_BUILD_TELEMETRY is declared in this tree, defaults OFF, and no native job in .github/workflows/ passes -DMORPH_BUILD_TELEMETRY=ON -- so nothing in CI ever compiles the code it guards. Cover it: add -DMORPH_BUILD_TELEMETRY=ON to the configure step of a job whose runner already has what it needs. 'Linux / all optional features' in ci.yml is the leg meant to carry these, and already installs Qt from aqtinstall plus the ODBC/SQLite/yaml-cpp/libzip set. A CMakePresets.json preset that sets the option is not coverage -- a preset no workflow names is exactly how morph#605 happened.

1 problem(s). 17 MORPH_BUILD_* option(s) declared, 11 enabled by a workflow, 1 exempt.
exit=1

Experiment reverted before committing.

Part (a) reverted — the gate must catch the defect that motivated it.
Deleting the -DMORPH_BUILD_BANK_GUI=ON line this PR adds:

::error::MORPH_BUILD_BANK_GUI is declared in this tree, defaults OFF, and no native job in .github/workflows/ passes -DMORPH_BUILD_BANK_GUI=ON -- so nothing in CI ever compiles the code it guards. It is enabled by wasm-demo.yml, but that is an Emscripten build: the same option can select a different subtree there (examples/bank/CMakeLists.txt builds gui_wasm/ and returns), so it does not prove the native code compiles. Cover it: add -DMORPH_BUILD_BANK_GUI=ON to the configure step of a job whose runner already has what it needs. [...]

1 problem(s). 16 MORPH_BUILD_* option(s) declared, 10 enabled by a workflow, 1 exempt.
exit=1

Both mutations are now permanent cases in
scripts/test_check_workflow_option_coverage.sh — twelve cases, nine mutations
and three false-positive mirrors, each required to be caught for the stated
reason. The option-coverage job runs the self-test before the check, the
same order deprecation-lint, test-type-name-lint and journal-stamp-lint
use:

ok: the unmodified tree passes
ok: caught: a newly declared option that no job enables
ok: caught: MORPH_BUILD_BANK_GUI dropped from ci.yml's all-features job
ok: caught: the Emscripten enablement does not count as native coverage
ok: caught: the only enablement is commented out
ok: caught: every matrix leg sets the fuzzers key OFF
ok: accepted: a matrix leg setting the key ON is the only enablement
ok: caught: an exemption for an option some job does enable
ok: caught: an exemption naming an option no CMake file declares
ok: caught: the option() declarations become unparseable
ok: accepted: a newly declared option that defaults ON
ok: accepted: an option enabled by a different job than before

all cases passed.

The self-test earned its keep during development: matrix-expression values were
never being resolved (\S+ captured the bare ${{), so the "every matrix leg
sets the fuzzers key OFF" case passed for the wrong reason until its
accepted-mirror was added and exposed it.

Two corrections to #605's accounting

Both found by writing the derived check, both recorded on the
issue
rather than shipped around.

1. BANK_GUI was not enabled by nothing. wasm-demo.yml:98 has passed
   -DMORPH_BUILD_BANK_GUI=ON all along; the triage's grep was scoped to
   ci.yml. The conclusion survives only because of what the flag does under
   Emscripten: examples/bank/CMakeLists.txt descends into gui_wasm/ and
   return()s before the native gui/, so it is a disjoint subtree and proves
   nothing about the target build: bank_gui_qml_tests does not compile -- testkit_main.cpp's <testkit/log_level.hpp> is not on its include path #604 found broken. Counting it would have made this
   gate vacuous for its own founding case, so Emscripten workflows are
   classified apart — derived from the workflow text (emcmake / emsdk /
   qt-cmake), not a filename list, and pinned by a self-test case.

2. MORPH_BUILD_DOCUMENTATION is covered, not exempt. The issue put it in
   the exemption set beside CLANG_TIDY, but docs.yml:59 passes it
   literally. Exempting it would be exactly the hand-maintained falsehood the
   gate replaces, so the checker also rejects an exemption for an option that
   is covered, and one naming an option no CMake file declares.
   MORPH_BUILD_CLANG_TIDY is the only exemption.

Also: 16 declared options, not 14 — examples/vetted_hmac/CMakeLists.txt
declares two more. Both default ON, so neither changes the verdict; the check
scans every tracked CMake file so a sub-option that ever defaults OFF is
caught.

Not verified

Whether bank_gui / bank_gui_qml_tests actually compile on that leg
post-#604. Not built locally (Qt 6.8 via aqtinstall plus the Lightweight/ODBC
fetch is not reproducible here); this PR's CI run is the first measurement.
If it fails, that is a new issue, not a fold-in.

---

Commit 2 — #618: a red leg reports every test surface it could measure

if: '!cancelled()' on the later, disjoint test step in three jobs, with each
step's pre-existing guard preserved:

job	step	condition
ladder-tests	Run the scenario corpus against the built servers	!cancelled() && steps.filter.outputs.run == 'true'
ladder-sanitizers	Test (the Qt transport suites, which no sanitizer leg ran)	!cancelled() && steps.filter.outputs.run == 'true'
linux-all-features	Verify the fuzz replay covered the committed reproducers	!cancelled() && matrix.fuzzers == 'ON'

linux-coverage is deliberately unchanged, and now carries a comment saying
so. Its later steps consume the Test step's .profraw output rather than
measuring a surface of their own; forcing them to run over a truncated profile
would produce a coverage number computed from a partial pass, and a number
nobody should trust is worse than no number. Written down because it is the part
someone would otherwise "fix" later.

!cancelled(), not always(). always() also fires during teardown of a
cancelled run, which makes a leg that stopped within seconds of its siblings
read as a defect rather than a cancellation — the artefact this repository's own
triage guidance warns about.

This does not weaken a gate. Neither condition changes a job's conclusion: a
red step keeps the job red. The change makes a failing leg report more, not
gate less.

Known consequence, accepted: with the implicit success() gone, these steps
also run when the Build step failed, where they will fail loudly against a
missing or partial build tree. That is noise on a job already going red, and
narrowing the condition to steps.<build>.outcome == 'success' would
reintroduce a hand-maintained coupling to a step id. Flagged rather than
silently traded.

Verification status: INFERRED, NOT REPRODUCED

The acceptance #618 asks for — deliberately fail the first test step of one of
these jobs and observe the later one still run and still report, on a red job —
needs a CI cycle against a deliberately broken branch. This lane's brief ends at
the push and forbids waiting on or polling CI, and no local Actions runner
(act) is available, so the demonstration was not performed. Saying so
plainly rather than claiming an unmeasured success, as the triage comment
invites.

What was measured: the edited ci.yml parses, and each of the three steps
carries exactly !cancelled() && <its pre-existing guard> while
linux-coverage carries none:

== ladder-tests
   Run the scenario corpus against the built servers -> !cancelled() && steps.filter.outputs.run == 'true'
== ladder-sanitizers
   Test (the Qt transport suites, which no sanitizer leg ran) -> !cancelled() && steps.filter.outputs.run == 'true'
== linux-all-features
   Verify the fuzz replay covered the committed reproducers -> !cancelled() && matrix.fuzzers == 'ON'
== linux-coverage

The behavioural claim rests on GitHub Actions' documented status-check-function
semantics — the same standard as #618's own premise check and the triage's,
both of which recorded it as inferred.

---

Coordination

• Files held by ci: audit mutation_survivors.json's line citations instead of hoping (fixes #608) #614 (drift-guard.yml, docs/spec/testing_charter.md), cmake: let a red leg name every failing test, not just the first (fixes #616) #617
  (CMakePresets.json), qt: move QtWebSocketBackend onto the structural registration surface #585, render/forms: match the QML mirror's separators as whole strings (fixes #599) #609 and fix(util): handle INT64_MIN rational operations #561: untouched. The testing-charter row
  A red CI job reports only its first failing test *step*, hiding the rest (the step-level twin of #616) #618 asks for, and this gate's move into drift-guard.yml, both wait on ci: audit mutation_survivors.json's line citations instead of hoping (fixes #608) #614.
• Rebased onto 0e3b8823 (after render/forms: match the QML mirror's separators as whole strings (fixes #599) #609 landed). cmake: let a red leg name every failing test, not just the first (fixes #616) #617 had not landed at push time;
  it removes stopOnFailure from the test presets, which is the case-level twin
  of this step-level change and does not conflict with it.
• No CHANGELOG.md entry, matching cmake: let a red leg name every failing test, not just the first (fixes #616) #617's precedent for a change of this shape.

Filed while working this

• ci.yml: seven job banner comments sit above the previous job's trailing steps #621 — seven of ci.yml's seventeen job banner comments sit above the
  previous job's trailing cache steps, so each banner's multi-paragraph
  rationale is separated from the job it describes by 6–31 lines of another
  job's steps. Reproduced on a020e69c, readability only, unrelated to these
  changes.

🤖 Generated with Claude Code

https://claude.ai/code/session_01AbwhcguQFkhvVi2AH19sWk

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!