[overtrue]

Summary

Quirk ledger jobs only use Python and shell, but their setup installs Ruby and its package dependencies. On run 40315690990 package installation exhausted the job deadline before any mutation ran. Give those three jobs and the target-consolidation job a Python-only host-tool profile; keep the Ruby profile for full guard shards and require each job's actual profile in the CI check.

Related to #1506. The earlier hosted setup failure has not yet been reproduced with this candidate.

Verification

$ python3 scripts/test_ci_host_tools.py
Ran 19 tests in 1.547s
OK
$ cargo fmt --all --check
exit 0
$ cargo clippy --workspace --all-targets -- -D warnings
exit 0
$ cargo test --workspace
exit 0 on the bounded retry
$ cargo xtask verify --crate xtask
verify: crate xtask build compiled 0 crate(s) in 0.58s outside the budget
verify: crate xtask passed in 27.37s
$ cargo xtask verify --all
verify: workspace test build finished in 0.45s, 0.45s into its 480s budget
verify: workspace tests finished in 357.03s, 357.48s into the 480s budget it shares with workspace test build
verify: guard self-test finished in 396.37s, 396.37s into its 480s budget
verify: workspace tests and build guards passed in 753.85s

The complete verifier exited zero but its reported 753.85 seconds exceeds the documented 600-second whole-command feedback target; phase budgets passed separately. The observation is recorded in #1462. Earlier full-verifier attempts failed independently: one guard census stopped with 28 cases unexecuted, one slow-reader RSS reuse assertion failed, and one unread-body refusal lacked the expected XML response. No cause for these failures has been established.

The first workspace run on this base failed eight conformance socket and HTTP/2 tests. Each exact test passed once with the unchanged main scripts, and the later complete workspace run passed; these controls do not establish the original failure cause.

The three quirk shards each completed all 10 assigned cases with a Ruby sentinel that would fail and record invocation; none was invoked. The target-consolidation suite completed 108 cases. Controlled mutations replaced the installation scope independently in each of the four affected jobs and verified its specific diagnostic, including a diagnostic-attribution fault and a broken CI checker. Existing tool-presence, missing-tool, installation-failure and opt-in rejection controls were retained.

Role Verdicts

• simplicity-adversary: attacked job scope selection, absent Python and timeout, installer failures, Ruby use by quirk shards, and diagnostic attribution — no break found.

Breaking Change

• BREAKING — this PR touches a protected file or changes a public contract.

Checklist

• The four-command gate passed (fmt, clippy, test, cargo xtask verify)
• New or changed public API has rustdoc
• Negative test cases outnumber positive ones
• Every new assertion was mutated — the implementation was broken on purpose and the assertion
  went red. The PR description names which ones
• No Protected File touched; if one was, the PR description contains BREAKING and a migration path
• No unsafe introduced
• No inventory / linkme introduced
• No #[non_exhaustive] added to a DTO
• No s3s code copied; behavioural evidence is URL + self-written summary
• No credentials, signatures, or expected-signature values reachable from logs or error bodies
• No plan document, analysis report, or working note committed
• Commits follow Conventional Commits; PR title ≤72 characters
• A Handoff comment has been appended to the issue

[overtrue]

Role review

• simplicity-adversary: attacked whether all four jobs execute only the tools retained by the narrow profile, whether missing Python or timeout and installation errors fail closed, whether the six Ruby-dependent guard shards retain their Ruby profile, and whether a failure in another job can satisfy a scope-control test. No additional break found. The three quirk shards ran all assigned cases with a failing Ruby sentinel; the hosted-runner setup improvement still requires actual CI evidence.

[overtrue]

Reviewed head 5b54448. The four job profiles match their executed tools, while the six general guard shards retain Ruby and the default build-tool profile is unchanged. The CI checker still requires each job's exact profile and preserves all commands, deadlines and failure propagation. No actionable finding.

Independent verification: all 19 host-tool tests, the unchanged CI time-gate checker and diff whitespace check passed. All three quirk shards completed their 10 assigned cases exactly once, and the target-consolidation suite completed 116 cases. Each ran with a Ruby sentinel that would record invocation and exit 93; none invoked it. These local concurrent runs are dependency controls, not a controlled performance comparison. Actual completed CI logs for all four affected jobs report host tools already present and their case suites passed. This confirms those setup paths avoided installation on this run; it does not reproduce or prove the root cause of the older package-install timeout.

The author records the full ordered local gate. I did not repeat the independent workspace gate. At the latest readback, 30 remote checks passed and the two transport parity jobs were still running, so final CI acceptance remains pending.

Role Verdicts

• simplicity-adversary: attacked job/profile mapping, missing-tool and installer-error paths, opt-in rejection, exact diagnostic attribution, unchanged gate commands and Ruby reachability in all four affected suites — no break found.