Observe the Go cache write policy natively in required CI #570

🤖 Generated by the Agentic Engineer

Problem and impact

The Go cache write policy from #569 (one module-cache writer on the default branch, no cache writes from pull requests) is guarded by a static check of the workflow text with rejected mutations. Nothing in CI observes what the runner actually did, so a change in how GitHub evaluates the save conditions, or in the cache action's behaviour, would not fail a pull request. The native behaviour was read by hand once (see #569).

Expected outcome

A required CI job observes the real steps of the catalogue's own Go validation run and fails when they contradict the policy:

• On a pull request: every Go job's module-cache restore step ran, and no Go cache save step ran in any job.
• On the default branch: the Test job's module-cache save ran on a miss, and exactly one module archive exists for that key afterwards; a second run with unchanged dependencies restores it and saves nothing.

Notes for whoever picks this up

• The fixture the Go validation callers use has no dependencies, so its module archive would be empty. A real main-branch save needs a fixture with at least one dependency, or a dedicated caller on one of the fixtures that already has dependencies.
• A new job must be added to the test inventory, the affected-test selection and both places of the required-check reducer; the parity and selection guards enforce this.
• The organisation-required direct invocation cannot be exercised from this repository's own CI. Its evidence comes from a consumer run and is recorded on Bound Go cache writes while preserving main-backed restores #565.

Acceptance criteria

• A required job reads the current run attempt's jobs and asserts the step outcomes above, with complete pagination and fail-closed handling of missing jobs.
• A negative control shows the observer fails when a pull-request run reports a Go cache save.
• The default-branch observation proves a real, non-empty module archive is written once.

Part of #565.

Priority rationale: Medium: enforce the delivered cache write policy against actual runner behavior before a regression creates redundant archives. Existing static controls remain enabled. Native Effort is Medium for the observer, its failure controls and required-CI integration.

First started: 2026-10-12. The maintainer explicitly approved this one bounded implementation WIP exception in the interactive session. It does not admit further starts.

Use the existing dependency-bearing PostgreSQL caller from #574. The observer reads only this public catalogue's current run attempt, complete job pages, action logs and exact main archive. Consumer adoption and the full KSail cache-budget measurement remain #565 / devantler-tech/ksail#7348; no budget conclusion follows from this CI guard.

Delivery and verification

Merged #576 at 0ab32e7c094026a234d06c8c2dab84c81e33cfd7; the supporting PostgreSQL lifecycle repair #581 merged at 9ff2ad68306cc73df6814861c7804a11a25e0788. The current catalogue release v7.10.3 resolves to that verified merge.

Native PR CI observed all eight module restores and no Go archive saves. Regression controls reject a PR save, missing/partial/duplicate job evidence and unbound restores, including old/new CLI log-download interfaces.

The first real main producer 38300507280 saved a nonempty archive. Current-main observer 38317347126, attempt 1 passed at 9ff2ad68306cc73df6814861c7804a11a25e0788: all eight restores; Test restored the exact module key and skipped its module save. The complete exact-key main cache read still shows the same one archive, ID 8851118866, created at 2026-10-12T19:55:49.196513Z, containing 14,519,689 bytes. It was reused, not replaced or duplicated.

Complete main CI passed with 204 successful checks, 54 intentional skips and zero pending/failed checks; CI - Required Checks is present and successful. This completes the catalogue observer slice. Consumer adoption and the KSail budget measurement remain #565 / devantler-tech/ksail#7348.