Add no-key Codex issue and PR workflow gates

[besmpl]

Summary

• replace the API-key Codex Action design with a no-key Codex GitHub mention router
• add an issue brief router for needs-brief + comments
• add a PR gate that labels CI failures and posts @codex review after passing CI
• translate Codex brief decisions and Codex PR reviews into ready-for-build, needs-ai-fix, and ready-for-human labels
• document setup and fallback behavior in .github/AI_WORKFLOW.md

Changed files

• .github/AI_WORKFLOW.md
• .github/workflows/ai-issue-brief-router.yml
• .github/workflows/ai-pr-gate.yml

Removed files

• .github/codex/prompts/brief-gate.md
• .github/codex/prompts/pr-review-gate.md
• .github/codex/schemas/brief-decision.schema.json
• .github/codex/schemas/pr-review-decision.schema.json
• .github/workflows/ai-brief-gate.yml
• .github/workflows/ai-pr-review-gate.yml

Tests run

• ruby YAML parse for all workflow files
• node --check on embedded github-script blocks, wrapped as async functions
• git diff --check
• ASCII scan on workflow/docs files
• trailing-whitespace scan on workflow/docs files
• scripts/check
• go build ./...

Security notes

• No OPENAI_API_KEY or OpenAI API secret is required.
• Workflows do not run an AI agent inside GitHub Actions.
• Workflows do not use pull_request_target.
• PR routing is limited to open same-repository PRs from trusted repository actors.
• Issue brief routing requires needs-brief, a trusted author, and an AI brief marker.

Risks

• Codex cloud/GitHub integration must be enabled for this repository.
• If Codex does not react to @codex comments from github-actions[bot], a maintainer can manually comment @codex review or use the documented codex-brief line.
• The watcher infers PR readiness from Codex review state and inline review comments; first live Codex review should be watched once.

Out of scope

• Cursor-side automation is not implemented here.
• Branch protection is not changed.
• AI PR gate is not a required status check; existing required ci remains the merge gate.

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[besmpl]

Compiler Throughput Phase 0 update

This branch now also includes the approved Phase 0/M0 compiler-throughput foundation:

• compile-only benchmarks for scaling, Top10, Scenario, and cold/warm LoadProgram workloads;
• test-only instruction, constant, register, packed-byte, and retained-Proto metrics;
• one conservative opcode-effect model covering all 78 opcodes;
• metamethod mutation regressions and conservative DCE/LICM expectations;
• deterministic compiler allocation/shape budgets and a complete eight-side-table ratchet;
• a permanent CGO_ENABLED=0 build/test gate wired into scripts/check.

Verification passed:

• focused Phase 0 safety and budget tests;
• Top10, Classic, and Scenario result checks;
• the full five-count compile and LoadProgram benchmark matrix;
• scripts/check-fast;
• scripts/check-purego;
• scripts/check.

Coordinator checkpoints: 49fb0bd, 1102764, 8ac46c2. Existing uncommitted interpreter work was excluded from these commits through delta-only staging and independently tested staged trees.

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[besmpl]

Phase 1.1 is now pushed in 98ee54a.

• LoadProgram owns one source artifact store across graph discovery, compilation, and checking.
• Parallel entrypoints share per-identity in-flight preparation, so diamond dependencies parse and bind once.
• Successful immutable artifacts remain cached after a later graph error; failed preparation remains retryable.
• Public API and deterministic report/error ordering are unchanged.

Verification passed: focused artifact tests, relevant compiler/parser tests, behavioral benchmark tests, full compile/load benchmark matrix with five samples, scripts/check-fast, scripts/check, CGO_ENABLED=0 go build ./..., focused race tests, and the full non-allocation race suite.

The literal go test -race ./... command reaches no race report, but fails five existing allocation-budget assertions because race instrumentation adds allocations. Those budgets and unrelated interpreter changes were left untouched.

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[besmpl]

Phase 1.2 is pushed in d1222b5.

• Compiler functions now remain private functionDraft values until the full tree is ready.
• Drafts seal postorder: child metadata is attached first, runtime facts and packed code are built once, and local verification does not recursively reverify sealed descendants.
• Parent attachment still validates immediate child upvalue relationships.
• Public Compile behavior and the low-level bytecode builder interface are unchanged.

Measured results from the same five-sample matrix:

• closures_upvalues median: 40.6 us to 35.8 us, about 11.9 percent faster; 556 to 493 allocations.
• 12-level nested closure tracer: 4,472 to 2,973 allocations, a 33.5 percent reduction.
• output metrics, child counts, instructions, registers, line metadata, and string symbols remain stable.

Verification passed: focused red-green tracers, compiler/parser/optimizer suites, runtime benchmark-result checks, root lane, full five-sample compile/load benchmark matrix, scripts/check-fast, scripts/check, CGO_ENABLED=0 go build ./..., and a detached staged-patch test without the unrelated dirty interpreter changes.

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[besmpl]

Phase 1.3 is complete in 9b50702.

• Removed six stored diagnostic fact tables from Proto and now derives them only when disassembling diagnostics.
• Removed compile-only string symbol metadata and redundant direct-frame flags.
• Kept the two runtime side tables that execution still consumes.
• Reduced the Proto side-table budget from 8 to 2.

Observed compile results versus Phase 1.2 on the focused closure case: about 35.8us -> 33.0us, 493 -> 474 allocations, and 2141 -> 1661 prototype bytes. The 10k straight-line case is now about 651,168 prototype bytes versus about 1,683,600 at Phase 1.1.

Verification: focused diagnostics/budget/compiler tests, broad compiler and behavior tests, CGO_ENABLED=0 go build ./..., scripts/check-lane root, scripts/check-fast, scripts/check, compile/load benchmark suite, and a clean detached-worktree test of the exact staged patch.

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[besmpl]

Phase 1.4 is complete in 2b21eee.

• Production function drafts now create one assembly object containing executable code, old-to-new PC mapping, source anchors, line metadata, and packed instructions.
• Register sizing, sealing, source lines, and packing reuse that assembly instead of assembling the same IR three times.
• Newline offsets are built once per source and shared by child-function compilers.
• Standalone parsing no longer computes SHA-256 identity; identity remains at module/cache seams.
• Added exact assembly/line/packing tests and allocation ratchets.

Measured versus Phase 1.3: tiny arithmetic 400 -> 394 allocs/op; closure/upvalue 474 -> 462 allocs/op; straight-line/1000 about 45.3 ms and 5.09 MB -> about 42.5 ms and 4.95 MB.

Verification: focused assembly/source-line/allocation tests, broad compiler/parser/binder/optimizer/proto tests, Top10/Classic/Scenario semantics, CGO_ENABLED=0 go build ./..., scripts/check-lane root, scripts/check-fast, scripts/check, the full compile/load benchmark matrix at count=5, and a detached-worktree verification of the exact staged patch.

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[besmpl]

Phase 2.1 is complete in e0ff80d.

• Replaced production registerCandidates/registersMatching map+sort+slice construction with a zero-allocation metadata-bounded iterator.
• Migrated liveness use/def, DCE, numeric/constant facts, frame compaction, and register remapping.
• Centralized register access policy in register_effects.go.
• Added exhaustive opcode parity, dynamic call/return/vararg/concat/iterator windows, >64-register coverage, and a zero-allocation tracer.
• Tightened compile allocation ratchets.

Measured versus Phase 1.4: tiny arithmetic about 31.4us / 394 allocs -> about 21.7us / 202 allocs; closure/upvalue about 32.5us / 462 allocs -> about 23.8us / 290 allocs; straight-line/1000 40,244 -> 16,196 allocs. The full count=5 matrix passed and showed broad allocation reductions.

Verification: focused exhaustive register-effect and allocation tests, broad compiler/optimizer/proto/liveness tests, Top10/Classic/Scenario semantics, CGO_ENABLED=0 go build ./..., scripts/check-lane root, scripts/check-fast, scripts/check, full compile/load benchmark matrix count=5, and detached-worktree verification of the exact staged patch.

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[besmpl]

Phase 2.2 is complete in 6cf9f03.

• Replaced map[int]bool register sets with an inline uint64 plus []uint64 overflow representation.
• Added in-place contains/add/remove/clear/union/subtract/equality/assign operations.
• The liveness solver reuses function-local scratch sets across iterations.
• Migrated DCE, number facts, move propagation/coalescing, frame sizing consumers, and entry-nil liveness.
• Added inline zero-allocation tests, copy/union/subtract isolation, and >64-register liveness coverage.
• Tightened compile allocation ratchets again.

Measured versus Phase 2.1: tiny 202 -> 159 allocs; closure/upvalue 290 -> 202; branch-dense 86,060 -> 22,904; straight-line/1000 16,196 -> 14,165. The full count=5 matrix passed with broad time and allocation improvements on scenario sources.

Verification: focused dense-set/liveness/allocation tests, broad compiler/optimizer/proto tests, Top10/Classic/Scenario semantics, CGO_ENABLED=0 go build ./..., scripts/check-lane root, scripts/check-fast, scripts/check, full compile/load benchmark matrix count=5, and detached-worktree verification of the exact staged patch.

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[besmpl]

Phase 2.3 is complete in 89f41c7.

• Added private functionIR revision ownership and automatic content-change detection.
• Added one cached functionAnalysis per revision.
• Analysis owns blocks, successors, predecessors, reachability, use/def, liveness, and per-instruction effects.
• Peephole cleanup, move propagation, producer coalescing, and DCE now consume the cached analysis; DCE shares the same blocks/liveness with number-fact computation.
• Added exact cache reuse/stale invalidation and CFG/dataflow/effect ownership tests.
• Tightened allocation ratchets.

Measured versus Phase 2.2: tiny about 19.5us -> 16.7-17.7us, branch-dense about 29.8ms -> about 28.0ms in the count=5 matrix, and closure/upvalue about 19.6us -> about 17.3us. Tiny allocations are 155 and straight-line/1000 is 14,157.

Verification: focused cache/dataflow/allocation tests, broad compiler/optimizer/proto/liveness tests, Top10/Classic/Scenario semantics, CGO_ENABLED=0 go build ./..., scripts/check-lane root, scripts/check-fast, scripts/check, full compile/load benchmark matrix count=5, and detached-worktree verification of the exact staged patch.

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[besmpl]

Phase 2.4 is complete in 673714e.

• Replaced the up-to-len(IR) full simplification loop with one deterministic pipeline.
• Constant branches fold once, jump chains resolve through a memoized resolver, reachability uses a non-allocating-successor worklist, and one removal bitmap covers unreachable instructions plus jumps to the next surviving instruction.
• Control-flow simplification performs one final compaction/remap.
• Deleted per-jump seen[len(IR)] allocations and the repeated unreachable/compaction loop.
• Added combined folding/threading/reachability/cascading-removal semantics and a 256-jump allocation tracer.

Measured versus Phase 2.3: the jump-chain tracer fell from 266 allocations to <=20; branch-dense allocations fell 20,269 -> 16,669. Small/straight-line allocations remained stable, while scenario rows in the count=5 matrix showed further broad reductions.

Verification: focused control-flow and allocation tests, broad compiler/optimizer/proto/bytecode tests, Top10/Classic/Scenario semantics, CGO_ENABLED=0 go build ./..., scripts/check-lane root, scripts/check-fast, scripts/check, full compile/load benchmark matrix count=5, and detached-worktree verification of the exact staged patch.

[besmpl]

Phase 2 gate passed against committed Phase 0 checkpoint 8ac46c2 across all 45 BenchmarkCompileMatrix cases (same machine, 100ms bench time, count=1 gate run):

• Compile-time geomean speedup: 2.48x (required >=2x).
• Allocation geomean reduction: 79.5% (required >=70%).
• Aggregate allocations: 954,724 -> 235,701, a 75.3% reduction.

The count=5 Phase 2.4 matrix and all semantic/check gates also passed. Phase 2 is therefore closed; work can advance to Phase 3.1.

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[besmpl]

Phase 3.1 is complete in 2235955.

• assigns stable syntax/function IDs during parsing
• indexes definitions, uses, and expression arity/multiret facts in one dense node table
• records assignment, capture, mutation-after-capture, and immutable-copy eligibility during binding
• uses per-scope name maps with lexical restoration and dense capture deduplication
• removes source-range useAt scans, bindCursor traversal, and the emitter assignment re-walk
• uses immutable-copy facts for by-value upvalue capture

Verification:

• full go test ./... passed
• focused compiler/analyzer/Top10/classic/scenario behavior passed
• CGO_ENABLED=0 go build ./... passed
• scripts/check-lane root, scripts/check-fast, and scripts/check passed
• the exact isolated staged patch passed full tests and no-CGo build from detached 673714e
• allocation ratchets remain green: tiny arithmetic improved 158 -> 156 allocs/op; closure/upvalue remains 205 allocs/op

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[besmpl]

Phase 3.2 is complete in 5526044.

• replaces symbol-register and symbol-upvalue maps with dense -1-sentinel slices
• keeps assigned/captured state dense in binder symbol facts from Phase 3.1
• makes all five emitter shape maps lazy and preserves nil state across lexical copies
• makes name-keyed upvalue state lazy as well

Verification:

• full go test ./... passed
• focused compiler/behavior suites and CGO_ENABLED=0 go build ./... passed
• scripts/check-lane root, scripts/check-fast, and scripts/check passed
• exact isolated staged patch passed full tests and no-CGo build from detached 2235955
• all 45 BenchmarkCompileMatrix cases passed five runs
• tiny arithmetic allocations: 156 -> 150 allocs/op
• closure/upvalue allocations: 205 -> 191 allocs/op

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[besmpl]

Phase 3.3 is complete in f3915a7.

• replaces linear runtime-Value constant scans with a comparable hash key
• preserves exact float identity, including distinct +0/-0 and bit-identical NaN deduplication
• keys native functions by stable native ID
• interns compiler-generated strings before constructing boxed Values
• interns structural table-shape keys with exact field order
• migrates every emitter-generated field/global string constant to the pre-box interner

Verification:

• focused identity tests cover number bits, strings, native IDs, and table shapes
• full go test ./... and CGO_ENABLED=0 go build ./... passed
• scripts/check-lane root, scripts/check-fast, and scripts/check passed
• all 45 BenchmarkCompileMatrix cases passed five runs
• exact isolated staged patch passed full tests and no-CGo build from detached 5526044

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[besmpl]

Phase 3.4 is complete in 2e75625.

• deletes the shallow lowering module and its internal wrapper tests
• compiles statements, loops, branches, tables, and require traversal directly from immutable syntax
• replaces materialized value lists with non-allocating item plans
• uses immutable call and closure views; method self is exposed without copying the parameter slice
• emits folded constants directly instead of constructing a six-level synthetic expression tree
• net change: 501 insertions, 1,687 deletions

Verification:

• full go test ./... and CGO_ENABLED=0 go build ./... passed
• scripts/check-lane root, scripts/check-fast, and scripts/check passed
• all 45 BenchmarkCompileMatrix cases passed five runs
• exact isolated staged patch passed full tests and no-CGo build from detached f3915a7
• tiny arithmetic allocations: 152 -> 133 allocs/op
• closure/upvalue allocations: 191 -> 173 allocs/op
• table-string-field allocations: 172 -> 149 allocs/op

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[besmpl]

Phase 4 opcode diet is pushed in 39007d6.

• Reduced the compiler opcode set from 78 to 71.
• Removed compiler-unreachable NOOP, generic GET_FIELD, and dedicated COROUTINE_RESUME operations.
• Canonicalized the four string-field truth/nil branches through GET_STRING_FIELD plus generic comparison/branch operations.
• Preserved established wire IDs as invalid holes so existing hot dispatch IDs do not shift.
• Removed five compiler shape-state maps, their deep-copy/inference machinery, dead row matchers, the no-op row fusion pass, unused table-key call recognition, and dormant Fibonacci recognition.
• Net: 230 insertions / 1,466 deletions.

Runtime A/B (10 alternating paired samples, one CPU):

• suite geomean: -0.04%
• RunStringFieldReads: ~-1.5%, statistically flat
• bytes/op: unchanged
• allocs/op: unchanged

Verification:

• go test ./... -count=1
• CGO_ENABLED=0 go build ./...
• Top10 / Classic / Scenario behavior and allocation gates
• scripts/check-lane root
• scripts/check-fast
• scripts/check
• full 45-case BenchmarkCompileMatrix, -count=5
• exact staged tree matched the verified detached worktree byte-for-byte.

[besmpl]

Phase 4 opcode diet is pushed in .\n\n- Reduced the compiler opcode set from 78 to 71.\n- Removed compiler-unreachable NOOP, generic GET_FIELD, and dedicated COROUTINE_RESUME operations.\n- Canonicalized the four string-field truth/nil branches through GET_STRING_FIELD plus generic comparison/branch operations.\n- Preserved established wire IDs as invalid holes so existing hot dispatch IDs do not shift.\n- Removed five compiler shape-state maps, their deep-copy/inference machinery, dead row matchers, the no-op row fusion pass, unused table-key call recognition, and dormant Fibonacci recognition.\n- Net: 230 insertions / 1,466 deletions.\n\nRuntime A/B (10 alternating paired samples, one CPU):\n- suite geomean: -0.04%\n- RunStringFieldReads: ~-1.5%, statistically flat\n- bytes/op: unchanged\n- allocs/op: unchanged\n\nVerification:\n- ok github.com/besmpl/ember 35.460s\n- \n- Top10 / Classic / Scenario behavior and allocation gates\n- ok github.com/besmpl/ember 35.938s\n- ok github.com/besmpl/ember 36.532s
ok github.com/besmpl/ember 40.017s\n- ok github.com/besmpl/ember 36.369s
ok github.com/besmpl/ember (cached)\n- full 45-case , \n- exact staged tree matched the verified detached worktree byte-for-byte.

[besmpl]

Phase 4 follow-up opcode experiments complete against 39007d6 (8 alternating paired runtime samples, 1 CPU, behavior gates first). No additional specialization met the keep/delete evidence threshold:

• Four string-field comparison branches: generic lowering was statistically flat (+0.26% runtime geomean).
• Add/SubStringField: generic lowering regressed RunMethodCalls by 7.03%.
• Get/SetStringFieldIndex: generic lowering was flat (+0.28% geomean).
• JumpIfModKNotEqualK: generic lowering regressed while_branching by 48.47%.
• JumpIfTableHasMetatable / tag-chain recognizer: generic lowering was flat/slower on buff_stack_tick.
• CallOne: generic CALL regressed runtime geomean by 1.27%.
• ReturnOne: generic RETURN count=1 was flat overall (-0.05%) and regressed RunArithmetic by 1.14%.

Allocations were unchanged in all runtime comparisons. The committed Phase 4 result therefore remains the evidence-supported 71-opcode set; no temporary experiment changes were retained.

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[besmpl]

Phase 5.1 landed in 043ffce (Propagate scalar constants across compiler IR).

What changed:

• Added SCCP-style nil/bool/number/string lattice propagation across local aliases, executable CFG edges, and same-value joins.
• Folded proven scalar arithmetic, ordering/equality, concat, string length, and constant branches; tables/functions never enter the lattice.
• Calls and other callback-capable unknown operations invalidate mutable captured-local facts.
• Preserved NaN comparison errors, negative zero bits, Luau modulo/floor-divide behavior, and metamethod/error ordering.
• Added dead-constant compaction and a low-overhead straight-line path; removed the now-redundant production map-per-instruction constant-branch analysis.

Paired A/B evidence vs 39007d6:

• Compile corpus generated instruction geomean: -50.42%; constants: -27.56%; retained Proto bytes: -41.25%; registers: -2.41%.
• 37 Top10/Classic/Scenario ember_run rows: -1.34% runtime geomean, no significant regressions, allocations effectively unchanged.
• Focused BenchmarkRunArithmetic: -21.80%.
• Compile-time geomean tradeoff: +5.54%, compile allocations -6.65%.

Exact required five-count compile/load sweep passed in 450s. Representative medians: tiny arithmetic ~17.1µs / 132 allocs / 2 instructions; combat_tick ~257µs; command_vararg_router ~532µs.

Verification:

• go test ./... -count=1
• CGO_ENABLED=0 go test ./... -count=1
• CGO_ENABLED=0 go build ./...
• compiler/optimizer/binder/lexer/parser/proto focused suite
• Top10/Classic/Scenario behavior suite at -count=5
• scripts/check-lane root
• scripts/check-fast
• scripts/check
• go test -run '^$' -bench 'BenchmarkCompile|BenchmarkLoadProgram' -benchmem -count=5 .\n\nUnrelated interpreter work was stashed only for the clean cherry-pick and restored with an identical stable patch ID.