ci: gate cargo test --workspace (minus xtask) over per-crate cargo suites (kd-i9oc)

.github/workflows/force-rebuild.yml

@@ -895,11 +895,10 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - suite: cargo-kernel
-            needs_submodules: false
-            needs_toolchain: false
-            needs_workspace: false
-          - suite: fork-instrument
+          - suite: cargo-workspace
+            # Single host-target cargo suite covering every workspace crate
+            # except xtask; replaces the former cargo-kernel and fork-instrument
+            # suites. xtask keeps its own always-run cargo-xtask suite.
             needs_submodules: false
             needs_toolchain: false
             needs_workspace: false

.github/workflows/prepare-merge.yml

@@ -1377,12 +1377,13 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - suite: cargo-kernel
-            kernel_only: true
-            needs_submodules: false
-            needs_toolchain: false
-            needs_workspace: false
-          - suite: fork-instrument
+          - suite: cargo-workspace
+            # Single host-target cargo suite covering every workspace crate
+            # except xtask (kernel, fork-instrument, shared, userspace,
+            # wasm-local-root-spill). Replaces the former per-crate cargo-kernel
+            # and fork-instrument suites; closed-by-default so new crates under
+            # crates/ are gated with no matrix edit. xtask keeps its own
+            # always-run cargo-xtask suite (kernel-independent, tools/-scoped).
             kernel_only: true
             needs_submodules: false
             needs_toolchain: false

.github/workflows/staging-build.yml

@@ -781,12 +781,13 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - suite: cargo-kernel
-            kernel_only: true
-            needs_submodules: false
-            needs_toolchain: false
-            needs_workspace: false
-          - suite: fork-instrument
+          - suite: cargo-workspace
+            # Single host-target cargo suite covering every workspace crate
+            # except xtask (kernel, fork-instrument, shared, userspace,
+            # wasm-local-root-spill). Replaces the former per-crate cargo-kernel
+            # and fork-instrument suites; closed-by-default so new crates under
+            # crates/ are gated with no matrix edit. xtask keeps its own
+            # always-run cargo-xtask suite (kernel-independent, tools/-scoped).
             kernel_only: true
             needs_submodules: false
             needs_toolchain: false

docs/agent-guidance/validation.md

@@ -20,8 +20,7 @@ Core validation surface:
 
 | Suite | Command | Primary evidence for |
 |---|---|---|
-| Kernel unit tests | `cargo test -p kandelo --target <host-target> --lib` | Kernel logic changes |
-| Fork instrument tests | `cargo test -p fork-instrument --target <host-target>` | Fork instrumentation/tooling changes |
+| Workspace unit tests | `cargo test --workspace --exclude xtask --target <host-target>` | Any change under `crates/`: kernel, fork-instrument, shared, userspace, wasm-local-root-spill. `--target` is required (default wasm32 target has no host runner); `--exclude xtask` because xtask is gated by its own always-run `cargo-xtask` suite |
 | Host integration tests | `cd host && npx vitest run` | Host/runtime behavior |
 | Browser app/runtime tests | `cd apps/browser-demos && npx playwright test --grep-invert "@slow" --project=chromium` | Browser host, UI, demo, service worker, VFS image behavior |
 | Browser lazy VFS contract | `cd apps/browser-demos && npx playwright test test/browser-kernel-lazy-registration.spec.ts --project=chromium --project=firefox --project=webkit` | Browser-host lazy VFS registration ordering, including Safari/WebKit |
@@ -34,7 +33,7 @@ Core validation surface:
 For CI-shaped local runs, prefer:
 
 ```bash
-bash scripts/dev-shell.sh bash scripts/ci-run-test-suite.sh <cargo-kernel|fork-instrument|vitest|browser|libc|posix|sortix>
+bash scripts/dev-shell.sh bash scripts/ci-run-test-suite.sh <cargo-workspace|vitest|browser|libc|posix|sortix>
 ```
 
 For direct Cargo commands, compute `<host-target>` with: