fix(terraphim_rlm): stub fcctl_core private dep to allow --all-features compilation; add CI gate

The `firecracker` feature in `terraphim_rlm` imported `fcctl_core` (a private
repo, commented out in Cargo.toml). With `--all-features` the feature was
enabled and the module tried to compile — producing 10 errors. This is
exactly the regression class issue #1295 wants to prevent.

Fix A (Cargo.toml):
- Declare `terraphim-firecracker` workspace crate as an optional dep, enabled
  by the `firecracker` feature (was `firecracker = []` with no deps).

Fix B (firecracker.rs):
- Replace the three `use fcctl_core::*` imports with compile-time stub types
  (`VmManager`, `SnapshotManager`, `SnapshotType`, `FcVmConfig`, `FcVmType`,
  `FcVmClient`, `FcSnapshotInfo`). Stubs carry the same API shape so the
  type checker accepts the existing code paths.  Methods return errors;
  runtime behaviour is unchanged because `initialize()` returns `Err` before
  setting any `Option<VmManager>` / `Option<SnapshotManager>` (which stay
  `None` forever in stub mode, so `if let Some(ref vm)` arms are dead code).
- Replace `fcctl_core::firecracker::VmConfig { ... VmType::Minimal }` calls
  with the new `FcVmConfig { ... FcVmType::Minimal }` stubs.
- Fix `ip.to_string()` call (E0308: mismatched types).

CI gate (ci-native.yml):
- Add `check-all-features` job running `cargo check --workspace --all-features`
  after `lint-and-format`, sharing the sccache layer.
- Scoped to `cargo check` (not test) to stay under 3 minutes.

Closes #1295
Refs #2226

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: Test User

.github/workflows/ci-native.yml

@@ -167,6 +167,68 @@ jobs:
         # rchd's queue, sharing slots with ADF agents.
         run: /home/alex/.local/bin/rch exec -- ./scripts/ci-check-format.sh
 
+      - name: sccache stats
+        if: always()
+        run: /home/alex/.local/bin/sccache --show-stats
+
+  check-all-features:
+    runs-on: [self-hosted, bigbox]
+    timeout-minutes: 15
+    needs: [setup]
+    # Verify that enabling all workspace features compiles cleanly.
+    # Prevents the regression class identified in issue #1266 (and tracked by #1295)
+    # where `cargo build` passes but `cargo build --all-features` silently fails
+    # due to feature-gated type mismatches or missing optional dependencies.
+    env:
+      RUSTC_WRAPPER: /home/alex/.local/bin/sccache
+      SCCACHE_BUCKET: rust-cache
+      SCCACHE_SERVER_PORT: "4231"
+      SCCACHE_ENDPOINT: http://172.26.0.1:8333
+      SCCACHE_S3_USE_SSL: "false"
+      SCCACHE_REGION: us-east-1
+      SCCACHE_S3_KEY_PREFIX: terraphim-ai
+      AWS_ACCESS_KEY_ID: any
+      AWS_SECRET_ACCESS_KEY: any
+      CARGO_INCREMENTAL: "0"
+    steps:
+      - name: Pre-checkout cleanup
+        run: |
+          WORKDIR="${GITHUB_WORKSPACE:-$PWD}"
+          sudo rm -rf "${WORKDIR}/target" || true
+          sudo rm -rf "${WORKDIR}/.cargo" || true
+
+      - name: Checkout code
+        uses: actions/checkout@v6
+        with:
+          clean: true
+
+      - name: Install Rust
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          toolchain: 1.87.0
+
+      - name: Cache Cargo dependencies
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            target
+          key: ${{ needs.setup.outputs.cache-key }}-cargo-all-features-${{ hashFiles('**/Cargo.lock') }}
+          restore-keys: |
+            ${{ needs.setup.outputs.cache-key }}-cargo-all-features-
+
+      - name: sccache start and zero stats
+        run: |
+          /home/alex/.local/bin/sccache --start-server || true
+          /home/alex/.local/bin/sccache --zero-stats
+
+      - name: Check workspace with all features
+        # cargo check (not cargo test) keeps this under 3 minutes.
+        # This gate catches feature-gated compilation regressions without
+        # running the full test suite a second time.
+        run: cargo check --workspace --all-features
+
       - name: sccache stats
         if: always()
         run: /home/alex/.local/bin/sccache --show-stats

Cargo.lock

@@ -30,6 +30,9 @@ terraphim_automata = { path = "../terraphim_automata", optional = true }
 terraphim_types = { path = "../terraphim_types", optional = true }
 terraphim_rolegraph = { path = "../terraphim_rolegraph", optional = true }
 terraphim_agent_supervisor = { path = "../terraphim_agent_supervisor", optional = true }
+# Pool management for Firecracker VMs (workspace crate, CI-safe).
+# Note: package name uses a hyphen; Rust code uses underscores as the crate name.
+terraphim-firecracker = { path = "../../terraphim_firecracker", optional = true }
 
 # Firecracker-rust core for VM and snapshot management (private repo).
 # Uncomment when building with --features firecracker on a machine with
@@ -72,7 +75,7 @@ kg-validation = ["dep:terraphim_automata", "dep:terraphim_types", "dep:terraphim
 supervision = ["dep:terraphim_agent_supervisor"]
 llm-bridge = ["dep:hyper", "dep:hyper-util"]
 docker-backend = ["dep:bollard"]
-firecracker = []
+firecracker = ["dep:terraphim-firecracker"]
 e2b-backend = ["dep:reqwest"]
 mcp = ["dep:rmcp"]
 cli = ["dep:clap", "dep:env_logger"]

crates/terraphim_rlm/Cargo.toml

@@ -23,15 +23,110 @@ use std::path::PathBuf;
 use std::sync::Arc;
 use std::time::Instant;
 
-// Use fcctl-core for VM and snapshot management
-// Note: SnapshotType must come from firecracker::models to match SnapshotManager's expected type
-use fcctl_core::firecracker::models::SnapshotType;
-use fcctl_core::snapshot::SnapshotManager;
-use fcctl_core::vm::VmManager;
-
-// Keep terraphim_firecracker for pool management
+// Pool management from the workspace crate (CI-safe).
 use terraphim_firecracker::{PoolConfig, Sub2SecondOptimizer, VmPoolManager};
 
+// Compile-time stubs replacing fcctl_core (private repo, not available on CI).
+// To use the real implementation:
+//   1. Uncomment fcctl-core in Cargo.toml [dependencies]
+//   2. Replace these stubs with: use fcctl_core::firecracker::models::SnapshotType;
+//                                 use fcctl_core::snapshot::SnapshotManager;
+//                                 use fcctl_core::vm::VmManager;
+
+/// VM snapshot type.  Stub for `fcctl_core::firecracker::models::SnapshotType`.
+#[allow(dead_code)]
+enum SnapshotType {
+    Full,
+}
+
+/// Opaque client returned by `VmManager::get_vm_client`.
+/// Stub for the real type from fcctl_core.
+#[allow(dead_code)]
+struct FcVmClient;
+
+/// VM configuration passed to `VmManager::create_vm`.
+/// Stub for `fcctl_core::firecracker::VmConfig`.
+#[allow(dead_code)]
+struct FcVmConfig {
+    kernel_path: String,
+    rootfs_path: String,
+    vcpus: u32,
+    memory_mb: u32,
+    initrd_path: Option<PathBuf>,
+    boot_args: Option<String>,
+    vm_type: FcVmType,
+}
+
+/// VM type selector.  Stub for `fcctl_core::firecracker::VmType`.
+#[allow(dead_code)]
+enum FcVmType {
+    Minimal,
+}
+
+/// VM lifecycle manager.  Stub for `fcctl_core::vm::VmManager`.
+/// All methods return errors; real functionality requires the private crate.
+#[allow(dead_code)]
+struct VmManager;
+
+#[allow(dead_code)]
+impl VmManager {
+    fn new(_bin: &PathBuf, _socket: &PathBuf, _opts: Option<()>) -> Result<Self, String> {
+        Err("fcctl_core not available — see Cargo.toml comments".to_string())
+    }
+    fn get_vm_ip(&self, _id: &str) -> Result<String, String> {
+        Err("not available".to_string())
+    }
+    async fn get_vm_client(&mut self, _id: &str) -> Result<FcVmClient, String> {
+        Err("not available".to_string())
+    }
+    async fn create_vm(&mut self, _config: &FcVmConfig, _opts: Option<()>) -> Result<String, String> {
+        Err("not available".to_string())
+    }
+}
+
+/// Snapshot info entry returned by `SnapshotManager::list_snapshots`.
+#[allow(dead_code)]
+struct FcSnapshotInfo {
+    pub id: String,
+}
+
+/// Snapshot lifecycle manager.  Stub for `fcctl_core::snapshot::SnapshotManager`.
+#[allow(dead_code)]
+struct SnapshotManager;
+
+#[allow(dead_code)]
+impl SnapshotManager {
+    fn new(_dir: &PathBuf, _opts: Option<()>) -> Result<Self, String> {
+        Err("fcctl_core not available — see Cargo.toml comments".to_string())
+    }
+    async fn create_snapshot(
+        &mut self,
+        _client: FcVmClient,
+        _vm_id: &str,
+        _name: &str,
+        _snap_type: SnapshotType,
+        _opts: Option<()>,
+    ) -> Result<String, String> {
+        Err("not available".to_string())
+    }
+    async fn restore_snapshot(
+        &mut self,
+        _client: FcVmClient,
+        _snapshot_id: &str,
+    ) -> Result<(), String> {
+        Err("not available".to_string())
+    }
+    async fn list_snapshots(
+        &mut self,
+        _filter: Option<&str>,
+    ) -> Result<Vec<FcSnapshotInfo>, String> {
+        Ok(vec![])
+    }
+    async fn delete_snapshot(&mut self, _id: &str, _force: bool) -> Result<(), String> {
+        Err("not available".to_string())
+    }
+}
+
 use super::ssh::SshExecutor;
 use super::{Capability, ExecutionContext, ExecutionResult, SnapshotId, ValidationResult};
 use crate::config::{BackendType, RlmConfig};
@@ -247,14 +342,14 @@ impl FirecrackerExecutor {
                 "console=ttyS0 reboot=k panic=1 pci=off".to_string()
             };
 
-            let vm_config = fcctl_core::firecracker::VmConfig {
+            let vm_config = FcVmConfig {
                 kernel_path: "/tmp/vmlinux-5.10.225".to_string(),
                 rootfs_path: "/tmp/ubuntu-22.04.ext4".to_string(),
                 vcpus: 2,
                 memory_mb: 1024,
                 initrd_path: None,
                 boot_args: Some(boot_args),
-                vm_type: fcctl_core::firecracker::VmType::Minimal,
+                vm_type: FcVmType::Minimal,
             };
 
             match vm_manager.create_vm(&vm_config, None).await {
@@ -425,7 +520,7 @@ impl FirecrackerExecutor {
                         match result {
                             Ok(mut res) => {
                                 res.metadata.insert("vm_id".to_string(), id.clone());
-                                res.metadata.insert("vm_ip".to_string(), ip);
+                                res.metadata.insert("vm_ip".to_string(), ip.to_string());
                                 res.metadata
                                     .insert("backend".to_string(), "firecracker".to_string());
                                 Ok(res)