CI: all four workflows have been red on master since 2026-09-01 07:59 because php-llvm-structgep-assert.patch has fictional context and apply-patches.sh skips instead of verifying — setup failures are swallowed locally (patches/, script/apply-patches.sh, script/ci-memory-env.sh) (re-#36143)

[PurHur]

Category

Foundation: · CI truthfulness · child of #36188

Problem

• Compiler gate: last green run 33484039714 (07:50 Z); first red 33484786435 = commit af1f293cff "Fix CI patch drift blocking north-star5-verify-fast (CI: php-llvm-structgep-assert.patch fails to apply — blocks north-star5-verify-fast and all bootstrap gates #36143)" — the fix for CI: php-llvm-structgep-assert.patch fails to apply — blocks north-star5-verify-fast and all bootstrap gates #36143 broke it; 26 consecutive red master runs since. Log (33542490696): ERROR: failed to apply php-llvm-structgep-assert.patch. nikic preflight, aot-smoke.sh and the differential sweep have not executed on master since.
• Bootstrap spine gate: 183 failures / 16 cancelled / 1 success in the last 200 master runs; before the patch break it failed on a Pages footnote (stale spine ratio 8035/8036) before its only behavioural step ran.
• compliance-nightly: fails every night on patch drift (php-types-static-var.patch on 08-29 run 33246873878, structgep on 09-01 run 33487996766); artifact 436 bytes. There is no compliance signal at all.
• Why nobody sees it: .cursor/rules/local-ci-only.mdc (alwaysApply: true), README.md:341 and CONTRIBUTING.md all state GitHub Actions is disabled; six workflows exist and run on every push. And gh api repos/PurHur/php-compiler/branches/master/protection → 404 — no required checks, so red cannot block a merge.

Root cause of the patch: patches/php-llvm-structgep-assert.patch:4-6 uses as context

        if (null === $struct->value) {
            throw new \LogicException('LLVM struct value is null in structGep()');
        }

which no patch adds and no vendor file contains (vendor/…/LLVMAbstract/Builder.php:310-311 goes straight from structGep( to the PHP_COMPILER_LLVM_ASSERT block). It "verified" locally because script/apply-patches.sh:31-33 short-circuits on grep -q PHP_COMPILER_LLVM_ASSERT — the marker was already in the dev vendor tree, so the patch was skipped, never applied, never validated; the commit body's "Verified: apply-patches.sh exits 0" was true and meaningless. Locally the failure is doubly hidden: script/ci-memory-env.sh:36 runs apply-patches.sh >/dev/null 2>&1 || true and script/ci-common.sh:59 runs composer install … 2>/dev/null || true.

PHP implementation target

1. Re-diff php-llvm-structgep-assert.patch against a pristine composer install tree; drop the fictional hunk. Verify with docker run … composer install && script/apply-patches.sh from a clean checkout.
2. apply-patches.sh --verify-pristine: in a scratch composer install (or the vendored phpc-vendor-pristine.tar snapshot), apply every patch in order with git apply --check; run it in every workflow's setup step and in check-generated-docs.sh. patch_already_applied must additionally require git apply --check -R to succeed, so an unapplicable patch can never pass by marker.
3. Remove the two || true (ci-memory-env.sh:36, ci-common.sh:59); surface stderr.
4. Workflows: split Setup (image, composer, patches) from Verdict steps so --log-failed names which failed; push php-compiler:22.04-dev to GHCR on Dockerfile change instead of rebuilding per run (60–90 s of every 2-min run).
5. Rewrite local-ci-only.mdc, README §CI, CONTRIBUTING: GitHub Actions is the merge gate; list the four workflows and how to read them. Then enable branch protection requiring Compiler gate (after it is green — otherwise the fleet stalls).

Repro

gh run list --workflow=compiler-gate.yml --branch master --limit 3
docker run --rm -v "$PWD:/compiler" -w /compiler php-compiler:22.04-dev bash -lc 'rm -rf /tmp/v && cp -r vendor /tmp/v && composer install -q --ignore-platform-reqs && script/apply-patches.sh; echo rc=$?'

Done when

• Compiler gate, Bootstrap spine gate and compliance-nightly green on master (link the runs)
• apply-patches.sh --verify-pristine exists, runs in CI setup, and fails on a deliberately corrupted hunk
• grep -rn "|| true" script/ci-memory-env.sh script/ci-common.sh no longer masks patches/composer
• Docs no longer claim CI is disabled; branches/master/protection requires Compiler gate

[PurHur]

claim: compile-trust-automation — starting this run

[PurHur]

Nuance from the front-end audit, worth reading before "fixing" the patch:

patch -p0 --forward --dry-run patches/php-llvm-structgep-assert.patch on the current vendor tree reports hunk 1 succeeding with fuzz 2 and hunk 2 FAILED — while both edits are already present (vendor/ircmaxell/php-llvm/lib/LLVMAbstract/Builder.php:311 and :348). Running the non-dry-run command would therefore duplicate the structGep assert at the fuzzy offset rather than fail. The context line if (null === $struct->value) simply no longer exists in the vendored file.

So the repair is: regenerate the patch from the current vendor file (or convert it to an overlay), add --no-fuzz to every patch(1) call in apply-patches.sh, and make the idempotency guard per hunk (patch_already_applied at apply-patches.sh:31 greps only PHP_COMPILER_LLVM_ASSERT, which cannot distinguish per-hunk state). Broader audit of the mechanism: 3 of 183 patches apply cleanly, 88 reverse cleanly, 92 neither — see the patches/fork child of #36188.