From a2ee36e320d5ee4f19abdba38ea139aa76a0cfc7 Mon Sep 17 00:00:00 2001
From: rustfuture <>
Date: Sat, 12 Sep 2026 00:38:09 +0300
Subject: [PATCH 1/2] ci: run deterministic offline evaluation controls on PRs
 and main

Wire evaluation/run_controls.sh into CI as a required ubuntu-latest job.
Every control uses the scripted fake provider (AGY_BIN=/usr/bin/false),
so no model call is made. The job has a 15 minute cap, gets a unique
EVAL_CONTROLS_STAMP per run, and uploads evaluation/runs/controls-<stamp>*
as the eval-controls-evidence artifact on failure.
---
 .github/workflows/ci.yml | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 107ee50..6e74f9f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -21,6 +21,26 @@ jobs:
       - run: cargo clippy --locked --all-targets -- -D warnings
       - run: cargo test --locked
 
+  controls:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+      - name: Configure controls run stamp
+        run: echo "EVAL_CONTROLS_STAMP=${GITHUB_RUN_ID}-${GITHUB_SHA::8}" >> "$GITHUB_ENV"
+      - name: Run deterministic evaluation controls (fake provider, no model)
+        env:
+          AGY_BIN: /usr/bin/false
+        run: bash evaluation/run_controls.sh
+      - name: Upload controls evidence on failure
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: eval-controls-evidence
+          path: evaluation/runs/controls-${{ env.EVAL_CONTROLS_STAMP }}*
+          if-no-files-found: warn
+
   msrv:
     runs-on: ubuntu-latest
     steps:

From 8f75286cc572b05c4aba8b7866a54c2ab0d32150 Mon Sep 17 00:00:00 2001
From: rustfuture <>
Date: Sat, 12 Sep 2026 09:10:36 +0300
Subject: [PATCH 2/2] ci: preserve controls evidence across reruns

---
 .github/workflows/ci.yml | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 6e74f9f..fd00431 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -28,18 +28,20 @@ jobs:
       - uses: actions/checkout@v4
       - uses: dtolnay/rust-toolchain@stable
       - name: Configure controls run stamp
-        run: echo "EVAL_CONTROLS_STAMP=${GITHUB_RUN_ID}-${GITHUB_SHA::8}" >> "$GITHUB_ENV"
+        run: echo "EVAL_CONTROLS_STAMP=${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}-${GITHUB_SHA::8}" >> "$GITHUB_ENV"
       - name: Run deterministic evaluation controls (fake provider, no model)
         env:
           AGY_BIN: /usr/bin/false
-        run: bash evaluation/run_controls.sh
-      - name: Upload controls evidence on failure
-        if: failure()
+        run: |
+          set -o pipefail
+          bash evaluation/run_controls.sh 2>&1 | tee "evaluation/runs/controls-${EVAL_CONTROLS_STAMP}-ci.log"
+      - name: Upload controls evidence
+        if: always()
         uses: actions/upload-artifact@v4
         with:
-          name: eval-controls-evidence
+          name: eval-controls-evidence-${{ env.EVAL_CONTROLS_STAMP }}
           path: evaluation/runs/controls-${{ env.EVAL_CONTROLS_STAMP }}*
-          if-no-files-found: warn
+          if-no-files-found: error
 
   msrv:
     runs-on: ubuntu-latest