[anneal] Add playground metadata

.dockerignore

@@ -8,10 +8,13 @@
 # those terms.
 
 /target/
+/zerocopy/target/
+/anneal/target/
+/anneal/v1/target/
+/tools/target/
+/exocrate/target/
 /hermes/target/
 **/.git/
-tools/vendor
-tools/.cargo/
 
 # FIXME: This is just a symlink to `../hermes`, intended to ensure that old
 # links to `tools/hermes` are less confusing since we've moved that directory to

.gemini/styleguide.md

@@ -8,5 +8,6 @@ those terms. -->
 
 # Coding Guidelines
 
-Please follow the development instructions and coding guidelines defined in the
-`agent_docs/reviewing.md` and `AGENTS.md` files located in this repository.
+Please follow the development instructions and coding guidelines defined in
+`zerocopy/agent_docs/reviewing.md`, `zerocopy/AGENTS.md`, and the `AGENTS.md`
+file nearest the code you are changing.

.github/actions/download-artifact-with-retry/action.yml

@@ -0,0 +1,106 @@
+name: Download artifact with retry
+description: Download one artifact, retrying transient service and transfer failures
+
+inputs:
+  artifact-id:
+    description: Immutable artifact ID received from the producer job
+    required: true
+  path:
+    description: Directory into which the artifact is extracted
+    required: true
+  expected-file:
+    description: File expected directly under path after extraction
+    required: true
+
+runs:
+  using: composite
+  steps:
+    - name: Validate artifact contract
+      shell: bash
+      env:
+        ARTIFACT_ID: ${{ inputs.artifact-id }}
+        ARTIFACT_PATH: ${{ inputs.path }}
+        EXPECTED_FILE: ${{ inputs.expected-file }}
+      run: |
+        set -eu
+
+        # With neither `name` nor `artifact-ids`, download-artifact downloads
+        # *every* artifact in the run. Validate the producer-provided ID before
+        # invoking it so an accidentally empty job output fails closed. IDs also
+        # avoid binding to a stale or similarly named artifact: v4+ artifacts
+        # are immutable, and each successful upload receives a unique ID.
+        if [[ ! "$ARTIFACT_ID" =~ ^[0-9]+$ ]]; then
+          echo "Artifact ID must be a nonempty integer: $ARTIFACT_ID" >&2
+          exit 1
+        fi
+        if [[ -z "$ARTIFACT_PATH" ]]; then
+          echo "Artifact destination path must not be empty" >&2
+          exit 1
+        fi
+        if [[ -z "$EXPECTED_FILE" || "$EXPECTED_FILE" == */* || "$EXPECTED_FILE" == "." || "$EXPECTED_FILE" == ".." ]]; then
+          echo "Expected artifact file must be a filename, not a path: $EXPECTED_FILE" >&2
+          exit 1
+        fi
+
+    # download-artifact retries some blob transfers internally, but failures
+    # while looking up an artifact or obtaining a signed URL happen outside
+    # that retry loop. Retrying the complete action reacquires both. A failed
+    # extraction can leave a partial file behind, so remove exactly the one
+    # expected file before retrying; never clear the caller's whole directory.
+    - name: Download artifact (attempt 1)
+      id: download_1
+      continue-on-error: true
+      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      with:
+        artifact-ids: ${{ inputs.artifact-id }}
+        path: ${{ inputs.path }}
+
+    - name: Clean up and wait to retry artifact download
+      if: ${{ !cancelled() && steps.download_1.outcome == 'failure' }}
+      shell: bash
+      env:
+        ARTIFACT_PATH: ${{ inputs.path }}
+        EXPECTED_FILE: ${{ inputs.expected-file }}
+      run: |
+        set -eu
+        rm -f -- "$ARTIFACT_PATH/$EXPECTED_FILE"
+        delay=$((5 + RANDOM % 11))
+        echo "Artifact download failed; retrying in ${delay}s"
+        sleep "$delay"
+
+    - name: Download artifact (attempt 2)
+      id: download_2
+      if: ${{ !cancelled() && steps.download_1.outcome == 'failure' }}
+      continue-on-error: true
+      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      with:
+        artifact-ids: ${{ inputs.artifact-id }}
+        path: ${{ inputs.path }}
+
+    - name: Clean up and wait to retry artifact download again
+      if: ${{ !cancelled() && steps.download_2.outcome == 'failure' }}
+      shell: bash
+      env:
+        ARTIFACT_PATH: ${{ inputs.path }}
+        EXPECTED_FILE: ${{ inputs.expected-file }}
+      run: |
+        set -eu
+        rm -f -- "$ARTIFACT_PATH/$EXPECTED_FILE"
+        delay=$((15 + RANDOM % 16))
+        echo "Artifact download failed again; retrying in ${delay}s"
+        sleep "$delay"
+
+    - name: Download artifact (attempt 3)
+      if: ${{ !cancelled() && steps.download_2.outcome == 'failure' }}
+      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      with:
+        artifact-ids: ${{ inputs.artifact-id }}
+        path: ${{ inputs.path }}
+
+    - name: Verify downloaded artifact
+      if: ${{ !cancelled() }}
+      shell: bash
+      env:
+        ARTIFACT_PATH: ${{ inputs.path }}
+        EXPECTED_FILE: ${{ inputs.expected-file }}
+      run: test -s "$ARTIFACT_PATH/$EXPECTED_FILE"

.github/actions/setup-docker-with-retry/action.yml

@@ -0,0 +1,102 @@
+name: Set up Docker with retry
+description: Set up Buildx and authenticate to a registry, retrying transient failures
+
+inputs:
+  registry:
+    description: Container registry hostname
+    required: false
+    default: ghcr.io
+  username:
+    description: Container registry username
+    required: true
+  password:
+    description: Container registry password or token
+    required: true
+
+runs:
+  using: composite
+  steps:
+    # Retry the actions themselves rather than reproducing their behavior in
+    # shell. This preserves Buildx's builder cleanup and login-action's use of
+    # password-stdin and its end-of-job logout. The first two attempts use
+    # `continue-on-error` only so this composite can inspect `outcome`; the last
+    # attempt fails the caller normally.
+    - name: Set up Docker Buildx (attempt 1)
+      id: buildx_1
+      continue-on-error: true
+      uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+
+    - name: Wait to retry Docker Buildx
+      if: ${{ !cancelled() && steps.buildx_1.outcome == 'failure' }}
+      shell: bash
+      run: |
+        set -eu
+        delay=$((5 + RANDOM % 11))
+        echo "Docker Buildx setup failed; retrying in ${delay}s"
+        sleep "$delay"
+
+    - name: Set up Docker Buildx (attempt 2)
+      id: buildx_2
+      if: ${{ !cancelled() && steps.buildx_1.outcome == 'failure' }}
+      continue-on-error: true
+      uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+
+    - name: Wait to retry Docker Buildx again
+      if: ${{ !cancelled() && steps.buildx_2.outcome == 'failure' }}
+      shell: bash
+      run: |
+        set -eu
+        delay=$((15 + RANDOM % 16))
+        echo "Docker Buildx setup failed again; retrying in ${delay}s"
+        sleep "$delay"
+
+    - name: Set up Docker Buildx (attempt 3)
+      if: ${{ !cancelled() && steps.buildx_2.outcome == 'failure' }}
+      uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+
+    # Keep the token inside action inputs. In particular, do not pass it to a
+    # shell or expose it in a `docker login` command line.
+    - name: Log in to the container registry (attempt 1)
+      id: login_1
+      continue-on-error: true
+      uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
+      with:
+        registry: ${{ inputs.registry }}
+        username: ${{ inputs.username }}
+        password: ${{ inputs.password }}
+
+    - name: Wait to retry container registry login
+      if: ${{ !cancelled() && steps.login_1.outcome == 'failure' }}
+      shell: bash
+      run: |
+        set -eu
+        delay=$((5 + RANDOM % 11))
+        echo "Container registry login failed; retrying in ${delay}s"
+        sleep "$delay"
+
+    - name: Log in to the container registry (attempt 2)
+      id: login_2
+      if: ${{ !cancelled() && steps.login_1.outcome == 'failure' }}
+      continue-on-error: true
+      uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
+      with:
+        registry: ${{ inputs.registry }}
+        username: ${{ inputs.username }}
+        password: ${{ inputs.password }}
+
+    - name: Wait to retry container registry login again
+      if: ${{ !cancelled() && steps.login_2.outcome == 'failure' }}
+      shell: bash
+      run: |
+        set -eu
+        delay=$((15 + RANDOM % 16))
+        echo "Container registry login failed again; retrying in ${delay}s"
+        sleep "$delay"
+
+    - name: Log in to the container registry (attempt 3)
+      if: ${{ !cancelled() && steps.login_2.outcome == 'failure' }}
+      uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
+      with:
+        registry: ${{ inputs.registry }}
+        username: ${{ inputs.username }}
+        password: ${{ inputs.password }}

.github/actions/upload-file-artifact/action.yml

@@ -0,0 +1,85 @@
+name: Upload file artifact
+description: Publish one already-compressed file for jobs in this workflow run
+
+inputs:
+  name:
+    description: Artifact name; must exactly match the basename of path
+    required: true
+  path:
+    description: Exact path of the nonempty file to publish
+    required: true
+
+outputs:
+  artifact-id:
+    description: Immutable ID assigned to the published artifact
+    value: ${{ steps.upload.outputs.artifact-id }}
+  artifact-digest:
+    description: SHA-256 digest assigned to the published artifact
+    value: ${{ steps.upload.outputs.artifact-digest }}
+
+runs:
+  using: composite
+  steps:
+    - name: Validate artifact contract
+      shell: bash
+      env:
+        ARTIFACT_NAME: ${{ inputs.name }}
+        ARTIFACT_PATH: ${{ inputs.path }}
+      run: |
+        set -euo pipefail
+
+        # upload-artifact v7's direct-file mode derives the published name from
+        # the file basename, even though its overwrite path still looks up the
+        # explicit `name` input. Requiring them to match makes overwrite reliable
+        # on a full workflow rerun and prevents that subtle action contract from
+        # becoming an implicit coupling in each caller.
+        if [[ -z "$ARTIFACT_NAME" || "$ARTIFACT_NAME" == */* || "$ARTIFACT_NAME" == "." || "$ARTIFACT_NAME" == ".." ]]; then
+          echo "Artifact name must be a nonempty filename, not a path: $ARTIFACT_NAME" >&2
+          exit 1
+        fi
+        if [[ "${ARTIFACT_PATH##*/}" != "$ARTIFACT_NAME" ]]; then
+          echo "Artifact name '$ARTIFACT_NAME' does not match path basename '${ARTIFACT_PATH##*/}'" >&2
+          exit 1
+        fi
+        if [[ ! -s "$ARTIFACT_PATH" ]]; then
+          echo "Artifact is missing or empty: $ARTIFACT_PATH" >&2
+          exit 1
+        fi
+
+        artifact_size=$(stat --format=%s "$ARTIFACT_PATH")
+        echo "Uploading $ARTIFACT_NAME ($artifact_size bytes)" | tee -a "$GITHUB_STEP_SUMMARY"
+
+    # Both current callers produce tar archives whose contents are already
+    # compressed (Docker's image layers use gzip; Anneal uses zstd). Version 7's
+    # direct-file mode avoids a redundant ZIP on upload and extraction on every
+    # consumer. Keep this coordinated with download-artifact v8 in
+    # `../download-artifact-with-retry/action.yml`, which understands direct
+    # artifacts and verifies their service-provided digest.
+    - name: Upload artifact
+      id: upload
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      with:
+        name: ${{ inputs.name }}
+        path: ${{ inputs.path }}
+        if-no-files-found: error
+        retention-days: 1
+        archive: false
+        # Artifacts are immutable. Delete an artifact with the same validated
+        # name first so "Re-run all jobs" can republish it under a new ID.
+        overwrite: true
+
+    - name: Verify published artifact metadata
+      shell: bash
+      env:
+        ARTIFACT_DIGEST: ${{ steps.upload.outputs.artifact-digest }}
+        ARTIFACT_ID: ${{ steps.upload.outputs.artifact-id }}
+      run: |
+        set -eu
+        if [[ ! "$ARTIFACT_ID" =~ ^[0-9]+$ ]]; then
+          echo "Upload did not return a numeric artifact ID: $ARTIFACT_ID" >&2
+          exit 1
+        fi
+        if [[ -z "$ARTIFACT_DIGEST" ]]; then
+          echo "Upload did not return an artifact digest" >&2
+          exit 1
+        fi

.github/workflows/Dockerfile

@@ -8,6 +8,13 @@
 
 FROM ubuntu:24.04
 
+# These are the same bounded, download-only retry counts configured in
+# `ci.yml`. Defining them before the first networked build step covers rustup
+# and Cargo operations while the image is built; the workflow-level values
+# cover host operations and are forwarded into containers at runtime.
+ENV CARGO_NET_RETRY=10 \
+    RUSTUP_MAX_RETRIES=10
+
 # Use `DEBIAN_FRONTEND=noninteractive` to prevent timezone prompts.
 RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y \
     gcc-multilib    \
@@ -37,11 +44,12 @@ RUN cargo install cargo-nextest --locked                    && \
 
 WORKDIR /setup
 
-COPY Cargo.toml ./
-COPY cargo.sh   ./
-COPY tools      ./tools
+COPY zerocopy/Cargo.toml ./zerocopy/Cargo.toml
+COPY zerocopy/cargo.sh   ./zerocopy/cargo.sh
+COPY tools              ./tools
 
 ENV CARGO_ZEROCOPY_AUTO_INSTALL_TOOLCHAIN=1
+WORKDIR /setup/zerocopy
 RUN ./cargo.sh +stable --version  && \
     ./cargo.sh +nightly --version && \
     ./cargo.sh +msrv --version    && \