build(evals): run evals on the shipping Bazel binary

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -33,7 +33,7 @@ body:
     attributes:
       label: Installation method
       options:
-        - cargo install
+        - Built from source (Bazel)
         - Homebrew (brew)
         - Scoop
         - Built from source

.github/workflows/ci.yml

@@ -205,18 +205,11 @@ jobs:
         run: |
           python3 scripts/test-check-packaged-lsp-bridge.py
           python3 scripts/test-build-mcpb.py
-          python3 scripts/test-resolve-installed-binary.py
-          python3 scripts/test-check-packaged-mcp-stdio.py
-          python3 scripts/test-check-distribution-feature-wiring.py
-          python3 scripts/test-resolve-release-source-profile.py
           python3 scripts/test-package-release-archive.py
           python3 scripts/test-plan-release-recovery.py
           python3 scripts/test-check-release-artifacts.py
           python3 scripts/test-update-release-checksums.py
           python3 scripts/test-neutralize-release-pr-closing-keywords.py
-          bash scripts/test-check-distribution-clean-source.sh
-          bash scripts/test-check-distribution-snapshot.sh
-          bash scripts/test-check-distribution-reuse.sh
           bash tests/macos_stable_codesign_test.sh
 
       # Exercise the release guard scripts when admitting proposed changes.
@@ -604,12 +597,17 @@ jobs:
       - name: Run blocking Clippy policy
         run: bazel build --config=ci --config=clippy //...
 
-      # Master pushes run no Windows lane, so `cfg(windows)` code otherwise
-      # first compiles in the release build. Bazel has no MSVC toolchain on
-      # Linux, so this cross-target type check stays on Cargo: `cargo check`
-      # needs no linker, and mingw supplies the C compiler the native build
-      # scripts run. macOS has no equivalent: its build scripts need the Apple
-      # SDK headers.
+      # The one deliberate Cargo step left in CI, and only because Bazel cannot
+      # replace it yet. Master pushes and ordinary PRs run no Windows lane
+      # (`windows-test` is dispatch-only), so `cfg(windows)` code otherwise
+      # first compiles in the release build. The workspace registers no
+      # Windows target toolchain for Linux, so this cross-target type check
+      # stays on Cargo: `cargo check` needs no linker, and mingw supplies the
+      # C compiler the native build scripts run. It type-checks only and
+      # produces no executable, so no eval, test, or release consumes its
+      # output and it cannot diverge a shipped runtime. Remove it when Bazel
+      # grows a Linux-hosted Windows target. macOS has no equivalent: its
+      # build scripts need the Apple SDK headers.
       - name: Install pinned toolchain and Windows check target
         run: |
           rustup toolchain install
@@ -702,6 +700,16 @@ jobs:
           archive: tar.gz
           epoch: ${{ steps.packaging.outputs.epoch }}
 
+      - name: Exercise shipped MCP and LSP transports
+        shell: bash
+        run: |
+          set -euo pipefail
+          binary="$GITHUB_WORKSPACE/target/x86_64-unknown-linux-gnu/release/tracedecay"
+          smoke_work="$(mktemp -d)"
+          trap 'rm -rf -- "$smoke_work"' EXIT
+          TRACEDECAY_BIN="$binary" bazel run //scripts:mcp-conformance-smoke.sh
+          bazel run //scripts:packaged_lsp_bridge -- "$binary" "$smoke_work/lsp"
+
   # Frontend checks require no Rust compilation and must also validate drafts.
   # Do not serialize them behind repository-wide Rust formatting and gates.
   dashboard:

.github/workflows/hawk.yml

@@ -6,8 +6,7 @@
 # softening -D warnings.
 name: Hawk
 
-# On demand only; see distribution-acceptance.yml for why nothing runs on a
-# timer here.
+# On demand only; an optional diagnostic should run when someone will read it.
 on:
   workflow_dispatch:
 

.github/workflows/hermetic-evals.yml

@@ -5,12 +5,14 @@ on:
     paths:
       - "evals/hermetic/**"
       - "evals/agent_adoption/**"
+      - "scripts/build-eval-binary.sh"
       - ".github/workflows/hermetic-evals.yml"
   push:
     branches: [master]
     paths:
       - "evals/hermetic/**"
       - "evals/agent_adoption/**"
+      - "scripts/build-eval-binary.sh"
       - ".github/workflows/hermetic-evals.yml"
 
 permissions:
@@ -34,11 +36,13 @@ jobs:
         run: |
           bash -n evals/hermetic/run.sh
           bash -n evals/agent_adoption/run.sh
+          bash -n scripts/build-eval-binary.sh
       - name: Run scorer and shell-runner regressions
         run: >-
           bazel test
           //evals/hermetic:score_test
           //evals/hermetic:run_test
           //evals/hermetic:scorecard_test
           //evals/agent_adoption:selftest
+          //scripts:build_eval_binary_test
           --test_output=errors

BUILD.bazel

@@ -12,6 +12,7 @@ npm_link_all_packages(name = "node_modules")
 exports_files(
     [
         ".github/release-targets.json",
+        "MODULE.bazel",
         "version.txt",
         "Cargo.toml",
         "clippy.toml",

README.md

@@ -269,9 +269,9 @@ bazel build //...
 bazel test //... --test_output=errors
 ```
 
-Use Cargo when you need to validate Cargo packaging, a feature combination that
-has no Bazel target, or a platform-specific workflow. The release workflows
-continue to build the published Cargo artifact.
+Bazel owns workspace builds, tests, checks, and code generation. Release
+workflows package its production CLI as binary archives and MCP bundles;
+Rust workspace crates are private and are not published to crates.io.
 
 On macOS `tracedecay` is ad-hoc signed as `dev.tracedecay.cli` with
 designated requirement `identifier "dev.tracedecay.cli"`. macOS TCC keys
@@ -280,14 +280,9 @@ requirement is the binary's cdhash, so an Allow does not survive the next
 rebuild; the linker default identifier (`tracedecay-<hash>`) changes every
 build as well, and the daemon blocks in `open()` until the prompt is
 answered. A release build strips after linking, which mints that identifier
-again from the deps filename. Export
-`CARGO_BUILD_RUSTC_WORKSPACE_WRAPPER="$PWD/scripts/macos-rustc-wrapper.sh"`
-from the checkout root (the macOS CI and release jobs do) and the wrapper
-signs the product once rustc has finished, so `cargo build --release` and
-`cargo install --path crates/tracedecay-cli` keep the stable identity on
-the binary cargo copies into place. The committed Cargo config cannot set
-it, because Cargo has no per-target wrapper and Windows cannot run the
-script. `install.sh` and `tracedecay update`
+again from the deps filename. The shared release build action applies
+`scripts/macos-stable-codesign.sh` to the Bazel-built binary before packaging.
+`install.sh` and `tracedecay update`
 apply the same identity to the installed file after the archive checksum
 check when the binary is unsigned or ad-hoc signed, including an ad-hoc
 signature whose identifier already matches but whose requirement is still

benchmark_data/BUILD.bazel

@@ -81,4 +81,8 @@ filegroup(
 exports_files(["session-temporal/workload-v1.json"],
     visibility = ["//visibility:public"],
 )
+
+exports_files(["run_benchmarks.py"],
+    visibility = ["//evals/memory:__pkg__"],
+)
 # END generated by scripts/bazel/gen_builds.py

crates/tracedecay-application/Cargo.toml

@@ -6,7 +6,6 @@ edition.workspace = true
 license = "MIT"
 repository = "https://github.com/ScriptedAlchemy/tracedecay"
 description = "TraceDecay product use cases shared by CLI, MCP, HTTP, hooks, and daemon adapters"
-include = ["/src/**"]
 
 [features]
 default = []

crates/tracedecay-capture/Cargo.toml

@@ -10,7 +10,6 @@ description = "Bounded event capture primitives for TraceDecay"
 readme = "README.md"
 keywords = ["ai", "code-intelligence", "observability", "capture"]
 categories = ["development-tools", "parsing"]
-include = ["/src/**", "/tests/**", "/README.md"]
 
 [dependencies]
 chrono = { version = "0.4.45", default-features = false, features = ["std"] }

crates/tracedecay-cli/Cargo.toml

@@ -6,18 +6,6 @@ edition.workspace = true
 description = "TraceDecay command-line interface and daemon binary"
 license = "MIT"
 repository = "https://github.com/ScriptedAlchemy/tracedecay"
-# Packaged-crate whitelist. `/dashboard/app-dist/**` is staged into the crate
-# directory by release packaging (the distribution gate validates it); the
-# packaged-crate mode in build.rs embeds it from there, mirroring the old
-# root-crate arrangement.
-include = [
-    "/build.rs",
-    "/build-support/**",
-    "/src/**",
-    "/tests/**",
-    "/dashboard/app-dist/**",
-    "!/src/resources/logo.png",
-]
 
 [[bin]]
 name = "tracedecay"

crates/tracedecay-cli/build.rs

@@ -110,22 +110,6 @@ impl EmbeddedDashboard {
         )
     }
 
-    fn packaged(
-        asset_paths: Vec<String>,
-        digest_hex: String,
-        app_dist: &Path,
-        out_dir: &Path,
-    ) -> Result<Self, Box<dyn Error>> {
-        Self::from_sources(
-            &asset_paths,
-            "CARGO_MANIFEST_DIR",
-            "/dashboard/app-dist",
-            app_dist,
-            out_dir,
-            digest_hex,
-        )
-    }
-
     fn from_sources(
         asset_paths: &[String],
         identity_include_env: &'static str,
@@ -233,30 +217,18 @@ impl EmbeddedDashboard {
 /// `TRACEDECAY_SKIP_DASHBOARD_BUILD` is set the prebuilt `dashboard/app-dist`
 /// is staged instead and must match the digest
 /// `TRACEDECAY_DASHBOARD_BUNDLE_SHA256` names, so a skip can never embed
-/// unproven bytes. Packaged crates carry a staged `dashboard/app-dist` whose
-/// integrity Cargo's package checksums already guarantee. A missing or invalid
-/// bundle always fails the build; there is no empty-assets fallback.
+/// unproven bytes. A missing or invalid bundle always fails the build;
+/// there is no empty-assets fallback.
 fn embed_dashboard(
     manifest_dir: &Path,
     out_dir: &Path,
 ) -> Result<EmbeddedDashboard, Box<dyn Error>> {
-    let package_local_dashboard = manifest_dir.join("dashboard");
-    if package_local_dashboard.is_dir() {
-        // Packaged-crate mode: release packaging staged the bundle into the
-        // crate directory and Cargo's checksums are the integrity authority.
-        let app_dist = package_local_dashboard.join("app-dist");
-        let asset_paths = dashboard_manifest::dashboard_asset_paths(&app_dist)?;
-        let digest_hex = dashboard_bundle::bundle_digest(&app_dist, &asset_paths)?;
-        return EmbeddedDashboard::packaged(asset_paths, digest_hex, &app_dist, out_dir);
-    }
-
     let repository_root = manifest_dir.join(REPOSITORY_ROOT_FROM_CRATE);
     let dashboard = repository_root.join("dashboard");
     if !dashboard.join("package.json").is_file() {
         return Err(format!(
-            "no dashboard to embed: {} has no package-local dashboard/ and {} has no \
-             package.json; a tracedecay binary cannot build without its dashboard bundle",
-            manifest_dir.display(),
+            "no dashboard to embed: {} has no package.json; a tracedecay binary cannot \
+             build without its dashboard bundle",
             dashboard.display(),
         )
         .into());

crates/tracedecay-code-extraction/Cargo.toml

@@ -7,15 +7,6 @@ license = "MIT"
 repository = "https://github.com/ScriptedAlchemy/tracedecay"
 description = "Tree-sitter language extraction for TraceDecay"
 build = "build.rs"
-include = [
-    "/src/**",
-    "/fixtures/**",
-    "/tests/**",
-    "/vendor/tree-sitter-wgsl/src/**",
-    "/vendor/tree-sitter-wgsl/LICENSE",
-    "/vendor/tree-sitter-wgsl/PROVENANCE.md",
-    "/build.rs",
-]
 
 [features]
 default = ["lite", "medium", "full"]

crates/tracedecay-code-index/Cargo.toml

@@ -6,7 +6,6 @@ edition.workspace = true
 license = "MIT"
 repository = "https://github.com/ScriptedAlchemy/tracedecay"
 description = "In-process structural code search for TraceDecay"
-include = ["/src/**"]
 
 [features]
 default = [

crates/tracedecay-global-db/Cargo.toml

@@ -6,7 +6,6 @@ edition.workspace = true
 license = "MIT"
 description = "TraceDecay user-level global database: project registry, observations, session temporal store"
 repository = "https://github.com/ScriptedAlchemy/tracedecay"
-include = ["/src/**"]
 
 [features]
 # Explicit opt-in (same policy as the query kernel): exposes the registered

crates/tracedecay-graph-db/Cargo.toml

@@ -6,7 +6,6 @@ edition.workspace = true
 license = "MIT"
 description = "Embedded graph storage boundary for TraceDecay"
 repository = "https://github.com/ScriptedAlchemy/tracedecay"
-include = ["/src/**"]
 
 [features]
 test-helpers = []