Remote Test Roadmap

Snapshot date: 2026-05-18. Author: C5 of the May 10-16 sprint plan, reconciled after the Codex RBE eligibility proof updates (2026-05-10-cache-forward-toward-rbe.md).

This is a framing document, not a broad-RBE implementation plan. It identifies the shortest credible path from the first proved remote-test classes to remote test-class proof per language without overstating where the substrate is.

Where we are today

Thirty-five executor-backed target classes are recorded; twenty-six are check/test/smoke-style classes. This roadmap details the twenty-six check/test/smoke classes. The other nine manifest entries are build, packaging, or public input-handoff proofs and are tracked in config/rbe-target-eligibility.json. //app:unit_tests is proved by GF REAPI Cell run 25601913985 with bazel_command=test, GF_RBE_PROOF_FORCE_EXECUTION=true, 527 remote processes, worker image sha256:be2832171ac69cc9a2d012b3c789e8b765afb7cae0df8f7e9677dd6d8542dbc0, and Vitest evidence for 20 files / 168 passing tests. The public consumer tinyland-inc/omux.xoxd.ai //:unit_tests class is proved by run 25742782051 with bazel_command=test, forced execution, browser-capable worker image sha256:a567696e341f6eb0589ece9efd6014a2133a4f10831bdad31e8dd84055eff8a0, 1437 processes: 2 action cache hit, 551 remote cache hit, 882 internal, 4 remote, and a remote test-setup.sh unit_tests_/unit_tests ... Vitest action through ./vitest.config.ts. The public consumer Jesssullivan/jesssullivan.github.io //:types_unit_tests class is proved by run 25892939448 with bazel_command=test, forced execution, proof nonce 20260515T001050Z-25892939448-1, the same browser-capable worker image, 2331 processes: 1477 internal, 855 remote, remote lifecycle-hook execution for esbuild, sharp, and puppeteer, and remote test-setup.sh types_unit_tests_/types_unit_tests evidence. The pure-Go //examples/hello-go:hello_test class is proved by run 25634296833 with bazel_command=test, forced execution, worker image sha256:bb5455a038bdbff2560f22491c131c2163d3089ffafedee08f937d63f35fa848, 20 processes: 9 internal, 11 remote, and a passing Go test action. The Rust //examples/hello-rust:hello_test class is proved by run 25648670844 with bazel_command=test, forced execution, worker image sha256:98b78964245baf5d5fbb0ab382c1106c3d4006a3a30918c0a1a8f5e0fad9f62a, 175 processes: 170 internal, 5 remote, and one passing Rust test action. The C++ //examples/hello-cc:hello_test class is proved by run 25648975728 with bazel_command=test, forced execution, the same worker image, 8 processes: 4 internal, 4 remote, remote gcc compile/link and test-setup evidence, and one passing C++ test action. The cgo-backed //examples/hello-go-cgo:cgo_test class is proved by run 25649628233 with bazel_command=test, forced execution, the same worker image, 18 processes: 7 internal, 11 remote, remote runtime/cgo, GoCompilePkg, GoLink, and test-setup evidence, and one passing cgo test action. The browser/web //docs-site:playwright_chromium_smoke class is proved by run 25712694947 with bazel_command=test, forced execution, browser-capable worker image sha256:a567696e341f6eb0589ece9efd6014a2133a4f10831bdad31e8dd84055eff8a0, 2549 processes: 1489 internal, 1060 remote, remote sveltekit_sync, remote vite_build, remote test-setup evidence, and a passing playwright-core smoke with /bin/chromium. The public consumer tinyland-inc/omux.xoxd.ai //:puppeteer_chromium_smoke class is proved by run 25826953857 with bazel_command=test, forced execution, the same browser-capable worker image, 3162 processes: 1 action cache hit, 1043 remote cache hit, 1982 internal, 137 remote, remote sveltekit_sync, remote vite_build, remote test-setup evidence, and a passing puppeteer-core smoke with /bin/chromium. The public consumer tinyland-inc/omux.xoxd.ai //:playwright_chromium_smoke class is proved by run 25897326537 with bazel_command=test, forced execution, proof nonce 20260515T024138Z-25897326537-1, public main commit d3608a5a6325adee0a5e625cf7ad76b470e7b83f, the same browser-capable worker image, 3162 processes: 1 action cache hit, 1174 remote cache hit, 1982 internal, 6 remote, remote @tailwindcss/oxide and esbuild lifecycle hooks, remote sveltekit_sync, remote vite_build, remote test-setup.sh playwright_chromium_smoke_/playwright_chromium_smoke, remote generate-xml.sh, and a passing Playwright Chromium static-output smoke. The public consumer tinyland-inc/omux.xoxd.ai //:playwright_local_route_smoke class is proved by run 26005817853 with bazel_command=test, forced execution, proof nonce 20260517T232840Z-26005817853-1, GitHub App checkout authority, public main commit cd730bdc432b6eb2af4cac7032c040e4ab734da7, the same browser-capable worker image, 3162 processes: 1167 remote cache hit, 1982 internal, 13 remote, remote @tailwindcss/oxide and esbuild lifecycle hooks, remote sveltekit_sync, remote vite_build, remote test-setup.sh playwright_local_route_smoke_/playwright_local_route_smoke, remote generate-xml.sh, and a passing Playwright route smoke for /agent-snippet over declared adapter-static output. The public consumer tinyland-inc/omux.xoxd.ai //:puppeteer_local_route_smoke class is proved by run 26037732121 with bazel_command=test, forced execution, proof nonce 20260518T135044Z-26037732121-1, GitHub App checkout authority, public main commit 50e0b796cbc44bc82de67891b1999e7e48cff473, the same browser-capable worker image, 3162 processes: 2 action cache hit, 1170 remote cache hit, 1982 internal, 10 remote, remote @tailwindcss/oxide and esbuild lifecycle hooks, remote sveltekit_sync, remote vite_build, remote test-setup.sh puppeteer_local_route_smoke_/puppeteer_local_route_smoke, remote generate-xml.sh, and a passing Puppeteer route smoke for /agent-snippet over declared adapter-static output. The public consumer Jesssullivan/jesssullivan.github.io //:puppeteer_chromium_smoke class is proved by run 25777472760 with bazel_command=test, forced execution, the same browser-capable worker image, 2331 processes: 1477 internal, 855 remote, remote Puppeteer lifecycle-hook execution without browser download, remote test-setup evidence, and a passing Chromium smoke. The public consumer Jesssullivan/jesssullivan.github.io //:playwright_chromium_smoke class is proved by run 25894297074 with bazel_command=test, forced execution, proof nonce 20260515T005745Z-25894297074-1, the same worker image, 2331 processes: 1477 internal, 855 remote, remote lifecycle-hook execution without browser download, remote test-setup.sh playwright_chromium_smoke_/playwright_chromium_smoke, and a passing Playwright Chromium runtime smoke with /bin/chromium. The public consumer Jesssullivan/jesssullivan.github.io //:sveltekit_vite_build_smoke class is proved by run 25779597385 with bazel_command=test, forced execution, the same worker image, 2331 processes: 1477 internal, 855 remote, remote npm package extraction and lifecycle-hook execution, remote test-setup evidence, and a passing SvelteKit/Vite build smoke. The private consumer Jesssullivan/MassageIthaca //:svelte_check_test class is proved by run 25938855554 with bazel_command=test, forced execution, proof nonce 20260515T200641Z-25938855554-1, repo-scoped deploy key checkout, the same browser-capable worker image, 7662 processes: 3 action cache hit, 4343 internal, 3319 remote, remote lifecycle-hook execution for esbuild, sharp, @sparticuz/chromium, msw, and @vercel/speed-insights, remote sveltekit_sync_bin_/sveltekit_sync_bin, remote test-setup.sh svelte_check_test_/svelte_check_test, remote generate-xml.sh, and a passing SvelteKit/svelte-check action. The private consumer Jesssullivan/MassageIthaca //:tsc_noemit_test class is proved by run 25948484331 with bazel_command=test, forced execution, proof nonce 20260516T005553Z-25948484331-1, repo-scoped deploy key checkout, the same browser-capable worker image, 7662 processes: 4 action cache hit, 4343 internal, 3319 remote, remote lifecycle-hook execution for esbuild, sharp, @sparticuz/chromium, msw, and @vercel/speed-insights, remote sveltekit_sync_bin_/sveltekit_sync_bin, remote test-setup.sh tsc_noemit_test_/tsc_noemit_test, remote generate-xml.sh, and a passing TypeScript no-emit action in 24.2s. The private consumer Jesssullivan/MassageIthaca //:playwright_tmd_smoke class is proved by run 25953478878 with bazel_command=test, forced execution, proof nonce 20260516T050753Z-25953478878-1, repo-scoped deploy key checkout, consumer commit 08555e16b9ee0504b1b23e6373b5b6bbfb799f5f, the same browser-capable worker image, 7670 processes: 3 action cache hit, 4352 internal, 3318 remote, remote sveltekit_sync_bin_/sveltekit_sync_bin, remote vite_build_bin_/vite_build_bin, remote test-setup.sh playwright_tmd_smoke_/playwright_tmd_smoke, remote generate-xml.sh, and a passing Playwright TMD smoke in 4.5s. The private consumer tinyland-inc/tinyland.dev //:app_typecheck class is proved by run 25970619559 with bazel_command=build, forced execution, proof nonce 20260516T191944Z-25970619559-1, GitHub App checkout authority, the verified private tummycrypt_tinyland_schemas:0.2.4 distdir handoff, the same browser-capable worker image, 5578 processes: 1 action cache hit, 2567 remote cache hit, 2955 internal, 56 remote, remote TypeScript tsc, remote Svelte build tool, remote Vite build tool, remote app_typecheck_tool, artifact verifier success, and Kubernetes restart evidence that stayed at 0 before and after the proof. The private consumer tinyland-inc/tinyland.dev //:app_build class is proved by run 25978934708 with bazel_command=build, forced execution, proof nonce 20260517T021820Z-25978934708-1, GitHub App checkout authority, the verified private tummycrypt_tinyland_schemas:0.2.4 distdir handoff, the same browser-capable worker image, 6146 processes: 3125 remote cache hit, 2959 internal, 62 remote, remote TypeScript package fanout, remote JsRunBinary app_build.log, artifact verifier success, and Kubernetes restart evidence that stayed at 0 before and after the proof. The private consumer Jesssullivan/MassageIthaca //:sveltekit_node_build class is proved by run 25983800544 with bazel_command=build, forced execution, proof nonce 20260517T064447Z-25983800544-1, repo-scoped deploy key checkout, consumer commit e06a70d12417f04568092a62e225b6c6595c3b39, the same browser-capable worker image, 7379 processes: 2 action cache hit, 4186 internal, 3193 remote, remote lifecycle-hook execution for esbuild, msw, and sharp, remote sveltekit_sync_bin_/sveltekit_sync_bin, remote vite_build_bin_/vite_build_bin, artifact verifier success, and Kubernetes restart evidence that stayed at 0 before and after the proof. The private consumer tinyland-inc/tinyland.dev //packages/tinyland-a11y-engine:typecheck class is proved by run 25984827370 with bazel_command=build, forced execution, proof nonce 20260517T073751Z-25984827370-1, GitHub App checkout authority, workspace_path=consumer-workspace, the verified private tummycrypt_tinyland_schemas:0.2.4 distdir handoff, the same browser-capable worker image, 553 processes: 223 remote cache hit, 328 internal, 2 remote, remote esbuild lifecycle-hook execution, remote TypeScript tsc for packages/tinyland-color-utils, artifact verifier success, and Kubernetes restart evidence that stayed at 0 before and after the proof. The private consumer tinyland-inc/tinyland.dev //:playwright_local_route_smoke class is proved by run 25989829826 with bazel_command=test, forced execution, proof nonce 20260517T114200Z-25989829826-1, GitHub App checkout authority, workspace_path=consumer-workspace, the verified private tummycrypt_tinyland_schemas:0.2.4 distdir handoff, the same browser-capable worker image, 6155 processes: 3139 remote cache hit, 2963 internal, 53 remote, remote TypeScript tsc, remote Vite build-tool execution, remote test-setup.sh playwright_local_route_smoke_/playwright_local_route_smoke, remote generate-xml.sh, a loopback SvelteKit Node server inside the Bazel test action, and a passing local-route Playwright smoke using /bin/chromium. The private consumer tinyland-inc/tinyland.dev //:puppeteer_local_route_smoke class is proved by run 26051698671 with bazel_command=test, forced execution, proof nonce 20260518T181314Z-26051698671-1, GitHub App checkout authority, workspace_path=consumer-workspace, the verified private tummycrypt_tinyland_schemas:0.2.4 distdir handoff, the same browser-capable worker image, 6319 processes: 1 action cache hit, 3135 remote cache hit, 3052 internal, 132 remote, remote npm lifecycle-hook execution for @tailwindcss/oxide, sharp, and esbuild, remote TypeScript tsc, remote Svelte and Vite build-tool execution, remote test-setup.sh puppeteer_local_route_smoke_/puppeteer_local_route_smoke, remote generate-xml.sh, a loopback SvelteKit Node server inside the Bazel test action, and a passing local-route Puppeteer smoke using /bin/chromium. The consumer WebKit static-smoke class Jesssullivan/darkmap.phasi.space //:playwright_webkit_shell_smoke plus //:playwright_webkit_mobile_hud_smoke is proved by run 27330688866 (consumer dispatch 27330681726 for //:webkit_smoke_suite with force_execution=true) with bazel_command=test, forced execution, worker image digest sha256:9db80cc90cb6736430cdbfcf0a0773fd89073d897ec084b9b141ded1d58661af, 1703 processes: 985 internal, 718 remote, @playwright/test pinned exactly to 1.59.1, the pinned worker WebKit launched through the gf-webkit-launcher shim from GF_RBE_WEBKIT_EXECUTABLE, and both smoke targets passing in 4.5s and 14.1s.
The proof is target-class scoped. It proves the in-repo SvelteKit Vitest class, one public omux Vite/SvelteKit Vitest class, one public ghio SvelteKit/Vite/Vitest class, plus one pure-Go rules_go unit-test class, one rules_rust unit-test class, one cc_test class, one cgo-backed rules_go unit-test class, and one Chromium static-site Playwright smoke class, one public consumer Chromium Playwright static-output smoke class, one public consumer Chromium Playwright runtime smoke class, two public consumer Chromium static-output Puppeteer smoke classes, one public consumer SvelteKit/Vite build-smoke class, one private MassageIthaca booking-operation Vitest class, one private MassageIthaca SvelteKit/svelte-check class, and one private MassageIthaca TypeScript no-emit class, and one private MassageIthaca Playwright TMD smoke class, one private tinyland.dev root app typecheck class, one private tinyland.dev root Vite/SvelteKit production-build class, and three private tinyland.dev package Vitest/typecheck classes, one private tinyland.dev local-server Playwright route-smoke class, one private tinyland.dev local-server Puppeteer route-smoke class, one private MassageIthaca SvelteKit/Vite production-build class, and one consumer darkmap WebKit static-smoke class, not all JavaScript tests, not all omux tests, not all private tinyland.dev package tests, not all MassageIthaca tests, not all Go or cgo-backed Go tests, not broader Rust or C++ tests, not deployed-environment browser E2E, not broad Puppeteer, not all tinyland.dev routes, and not broad/default RBE. The source of truth remains config/rbe-target-eligibility.json.
The first high-impact web test class is proved. //docs-site:playwright_chromium_smoke is the first web-playwright-chromium-static-smoke class for Vite/SvelteKit-style projects. It serves static docs-site output inside the Bazel test action and uses playwright-core with Chromium from the worker image. Run 25711894340 proved the graph could remote-execute at scale (1059 remote actions) but failed the final Chromium action on crashpad’s writable-home assumption. Run 25712694947 then passed after the harness created scratch-backed HOME, XDG_CONFIG_HOME, and XDG_CACHE_HOME and fixed static route fallback for generated Vite/SvelteKit output.
The first public consumer Puppeteer class is proved. tinyland-inc/omux.xoxd.ai //:puppeteer_chromium_smoke is the first web-puppeteer-chromium-static-smoke class. It uses puppeteer-core with explicit GF_RBE_CHROMIUM_EXECUTABLE=/bin/chromium and the same pinned worker-image Chromium authority. Run 25826953857 proved that class after the consumer disabled Puppeteer lifecycle browser downloads; run 25747017023 remains the negative evidence for why npm lifecycle browser downloads do not count as RBE proof.
The first public consumer Playwright static-output class is proved. tinyland-inc/omux.xoxd.ai //:playwright_chromium_smoke is the first omux Playwright Chromium static-output smoke class. Run 25897326537 proved that class with the same pinned worker-image Chromium authority, proof nonce 20260515T024138Z-25897326537-1, 6 remote processes, remote sveltekit_sync, remote vite_build, remote test-setup, remote generate-xml, and no action-time browser installation. It does not promote all omux Playwright tests, Vitest browser mode, deployed E2E, or broad/default web RBE.
The first public omux local-server Playwright route-smoke class is proved. tinyland-inc/omux.xoxd.ai //:playwright_local_route_smoke serves declared adapter-static output inside the Bazel test action and verifies /agent-snippet with the same pinned worker-image Chromium authority. Run 26005817853 proved that class with GitHub App checkout, proof nonce 20260517T232840Z-26005817853-1, 13 remote processes, remote @tailwindcss/oxide and esbuild lifecycle hooks, remote sveltekit_sync, remote vite_build, remote test-setup, remote generate-xml, and no action-time browser installation. It does not promote all omux routes, deployed E2E, or broad Playwright.
The first public omux local-server Puppeteer route-smoke class is proved. tinyland-inc/omux.xoxd.ai //:puppeteer_local_route_smoke serves declared adapter-static output inside the Bazel test action and verifies /agent-snippet with puppeteer-core and the same pinned worker-image Chromium authority. Run 26037732121 proved that class with GitHub App checkout, proof nonce 20260518T135044Z-26037732121-1, 10 remote processes, remote @tailwindcss/oxide and esbuild lifecycle hooks, remote sveltekit_sync, remote vite_build, remote test-setup, remote generate-xml, and no action-time browser installation. It does not promote all omux routes, deployed E2E, or broad Puppeteer.
Additional public ghio browser/build-smoke classes are proved. Jesssullivan/jesssullivan.github.io //:puppeteer_chromium_smoke, //:playwright_chromium_smoke, and //:sveltekit_vite_build_smoke passed runs 25777472760, 25894297074, and 25779597385 with 855 remote processes each. These are useful consumer-lane proofs, but they still do not promote repo-wide Playwright/Puppeteer, hosted E2E, publication, or broad/default web RBE.
Multi-language test coverage has a Stage 1 foothold. Per Toolchain Coverage, rust/c++/go now have Bazel-hermetic BCR binary examples plus one trivial test target each: //examples/hello-rust:hello_test, //examples/hello-cc:hello_test, //examples/hello-go:hello_test, and //examples/hello-go-cgo:cgo_test. Zig and Chapel remain backlog.
The Go proofs now split pure-Go from cgo-backed Go. PR #605 fixed the gf-reapi-cell output inlining bug found by run 25631848864. The retry, run 25632300253, progressed to real remote rules_go actions and exposed the separate runtime/cgo / cc: no such file or directory worker/toolchain gap. Run 25634296833 proved the pure = "on" target. After the worker image carried the C/C++ closure, run 25649628233 proved //examples/hello-go-cgo:cgo_test with remote runtime/cgo and GoLink evidence. Broader cgo-backed Go remains unproved.
The C++ proof followed a worker toolchain-closure blocker. Run 25638930305 forced the //examples/hello-cc:hello_test test proof through the GF REAPI Cell and reached the remote C++ compile action, but the worker failed to execute /nix/store/zx71vq7s1v840wqsrw2m2ckmxn413a2b-gcc-wrapper-13.3.0/bin/gcc. Bazel reported Remote Execution Failure and 6 processes: 6 internal, so that is blocker evidence, not a C++ remote-test proof. After the worker image carried the C/C++ wrapper closure, run 25648975728 proved the trivial C++ unit-test class with 4 remote processes and one passing test.
The Rust proof followed two useful blocker runs. Run 25647399161 forced //examples/hello-rust:hello_test through the GF REAPI Cell and reached the remote rules_rust compile action for tinyjson, but the rules_rust rustc binary failed on the worker with error while loading shared libraries: libz.so.1: cannot open shared object file. Bazel reported 172 processes: 172 internal. After zlib was added to image sha256:fb77cc74124c1b235981ecf85e71b8de3d14d7b0d7e316c1172c52698990453c, run 25648006195 recorded one successful remote tinyjson Rust compile action, then failed linking process_wrapper because the selected Nix gcc-wrapper path was not present in the worker. Bazel reported 173 processes: 172 internal, 1 remote. Run 25648670844 then proved the trivial Rust unit-test class with 5 remote processes and one passing test.

The path

The remote-test story has three credible stages, in order. Skipping ahead introduces aspirational claims that the substrate can’t currently back.

Stage 0 — Toolchain hermeticity baseline

Rust, C++, and Go now have trivial Bazel-hermetic BCR binary targets. That makes cache-backed test proof meaningful for those languages. The Stage 1 test targets exist, but they do not promote those languages to remote execution.

Stage 1 — Cache-backed test proof per language

Per language with a hermetic toolchain, prove one trivial test target runs cache-backed on the shared runner contract:

TypeScript: //app:unit_tests and public consumer tinyland-inc/omux.xoxd.ai //:unit_tests already have cache-backed and remote-test proof. Private Jesssullivan/MassageIthaca //:booking_operation_unit_tests now has forced REAPI proof from run 25928429263 with 3319 remote processes. Private tinyland.dev package Vitest is past checkout and private codeload distdir staging: run 25933145419 reached //packages/tinyland-grafana:test, produced 4 remote processes and remote test-setup evidence, then failed because the remote test environment made tests/grafana-config.test.ts throw GRAFANA_SERVICE_ACCOUNT_TOKEN is not set under kubernetes semantics. tinyland.dev PR #401 fixed that test-environment assumption, and run 25935041748 then proved //packages/tinyland-grafana:test from main with the repo-scoped deploy key, verified codeload distdir input tummycrypt_tinyland_schemas:0.2.4, proof nonce 20260515T184435Z-25935041748-1, 1531 processes: 468 remote cache hit, 1059 internal, 4 remote, remote test-setup.sh packages/tinyland-grafana/test_/test, and a passing Vitest action. This is one private tinyland.dev package target class only. Run 25981546207 then proved //packages/tinyland-activitypub:test from main with GitHub App checkout authority, workspace_path=consumer-workspace, verified codeload distdir input tummycrypt_tinyland_schemas:0.2.4, proof nonce 20260517T044208Z-25981546207-1, 728 processes: 1 action cache hit, 299 remote cache hit, 415 internal, 14 remote, remote test-setup.sh packages/tinyland-activitypub/test_/test, remote generate-xml.sh, and a passing Vitest action. This is a second private tinyland.dev package target class only, not broad tinyland.dev package-test RBE. Run 25984827370 separately proved //packages/tinyland-a11y-engine:typecheck from main with GitHub App checkout authority, workspace_path=consumer-workspace, verified codeload distdir input tummycrypt_tinyland_schemas:0.2.4, proof nonce 20260517T073751Z-25984827370-1, 553 processes: 223 remote cache hit, 328 internal, 2 remote, remote esbuild lifecycle-hook execution, remote TypeScript tsc for packages/tinyland-color-utils, and successful completion of the package typecheck target. This is one private tinyland.dev package TypeScript typecheck target class only, not broad tinyland.dev package typecheck RBE. Run 25989829826 separately proved //:playwright_local_route_smoke from main with GitHub App checkout authority, workspace_path=consumer-workspace, verified codeload distdir input tummycrypt_tinyland_schemas:0.2.4, proof nonce 20260517T114200Z-25989829826-1, 6155 processes: 3139 remote cache hit, 2963 internal, 53 remote, remote TypeScript tsc, remote Vite build-tool execution, remote test-setup.sh playwright_local_route_smoke_/playwright_local_route_smoke, remote generate-xml.sh, and a passing local-route Playwright smoke over loopback-served SvelteKit output. This is one private tinyland.dev local-server Playwright route-smoke target class only, not broad Playwright, all tinyland.dev routes, or deployed E2E. Run 26051698671 separately proved //:puppeteer_local_route_smoke from main with GitHub App checkout authority, workspace_path=consumer-workspace, verified codeload distdir input tummycrypt_tinyland_schemas:0.2.4, proof nonce 20260518T181314Z-26051698671-1, 6319 processes: 1 action cache hit, 3135 remote cache hit, 3052 internal, 132 remote, remote npm lifecycle-hook execution for @tailwindcss/oxide, sharp, and esbuild, remote TypeScript tsc, remote Svelte and Vite build-tool execution, remote test-setup.sh puppeteer_local_route_smoke_/puppeteer_local_route_smoke, remote generate-xml.sh, and a passing local-route Puppeteer smoke over loopback-served SvelteKit output. This is one private tinyland.dev local-server Puppeteer route-smoke target class only, not broad Puppeteer, all tinyland.dev routes, or deployed E2E. Private Jesssullivan/MassageIthaca //:svelte_check_test now also has forced REAPI proof from run 25938855554 with repo-scoped deploy-key checkout, proof nonce 20260515T200641Z-25938855554-1, 3319 remote processes, remote sveltekit_sync_bin_/sveltekit_sync_bin, remote test-setup.sh svelte_check_test_/svelte_check_test, remote generate-xml.sh, and a passing SvelteKit/svelte-check action. This is one private MassageIthaca typecheck target class only. Private Jesssullivan/MassageIthaca //:tsc_noemit_test is now a separate forced REAPI proof from run 25948484331 with repo-scoped deploy-key checkout, proof nonce 20260516T005553Z-25948484331-1, 3319 remote processes, remote sveltekit_sync_bin_/sveltekit_sync_bin, remote test-setup.sh tsc_noemit_test_/tsc_noemit_test, remote generate-xml.sh, and a passing TypeScript no-emit action in 24.2s. This is one private MassageIthaca TypeScript no-emit target class only. Private Jesssullivan/MassageIthaca //:playwright_tmd_smoke is now a separate forced REAPI proof from run 25953478878 with repo-scoped deploy-key checkout, consumer commit 08555e16b9ee0504b1b23e6373b5b6bbfb799f5f, proof nonce 20260516T050753Z-25953478878-1, 3318 remote processes, remote sveltekit_sync_bin_/sveltekit_sync_bin, remote vite_build_bin_/vite_build_bin, remote test-setup.sh playwright_tmd_smoke_/playwright_tmd_smoke, remote generate-xml.sh, and a passing Playwright TMD smoke action in 4.5s. This is one private MassageIthaca browser-smoke target class only. Private tinyland-inc/tinyland.dev //:app_typecheck is now a separate forced REAPI proof from run 25970619559 with GitHub App checkout authority, the verified private tummycrypt_tinyland_schemas:0.2.4 distdir handoff, proof nonce 20260516T191944Z-25970619559-1, 56 remote processes, remote TypeScript tsc, remote Svelte build tool, remote Vite build tool, remote app_typecheck_tool, proof artifact verifier success, and Kubernetes restart evidence that stayed at 0 before and after the proof. This is one private tinyland.dev root app typecheck target class only; it does not prove all tinyland.dev builds, all tinyland.dev tests, browser E2E, the Vite production build class, durable private mirror/repository-cache authority, broad/default web RBE, or CAS/action-cache backend suitability. Private tinyland-inc/tinyland.dev //:app_build is now a separate forced REAPI proof from run 25978934708 with GitHub App checkout authority, the verified private tummycrypt_tinyland_schemas:0.2.4 distdir handoff, proof nonce 20260517T021820Z-25978934708-1, 62 remote processes, remote TypeScript package fanout, remote JsRunBinary app_build.log, proof artifact verifier success, and Kubernetes restart evidence that stayed at 0 before and after the proof. This is one private tinyland.dev root Vite/SvelteKit production-build target class only; it does not prove all tinyland.dev builds/tests, browser E2E, deployed app behavior, durable private mirror/repository-cache authority, broad/default web RBE, or CAS/action-cache backend suitability. Private Jesssullivan/MassageIthaca //:sveltekit_node_build is now a separate forced REAPI proof from run 25983800544 with repo-scoped deploy-key checkout, consumer commit e06a70d12417f04568092a62e225b6c6595c3b39, proof nonce 20260517T064447Z-25983800544-1, 3193 remote processes, remote lifecycle-hook execution for esbuild, msw, and sharp, remote sveltekit_sync_bin_/sveltekit_sync_bin, remote vite_build_bin_/vite_build_bin, proof artifact verifier success, and Kubernetes restart evidence that stayed at 0 before and after the proof. This is one private MassageIthaca SvelteKit/Vite production-build target class only; it does not prove all MassageIthaca builds/tests, deployed booking E2E, image publication, durable private mirror/repository-cache authority, broad/default web RBE, or CAS/action-cache backend suitability.
Browser/Web: //docs-site:playwright_chromium_smoke now has a forced REAPI proof for one static Vite/SvelteKit Chromium Playwright smoke class, and tinyland-inc/omux.xoxd.ai //:puppeteer_chromium_smoke has a forced REAPI proof for one public consumer static-output Puppeteer smoke class. tinyland-inc/omux.xoxd.ai //:playwright_chromium_smoke adds a public consumer Playwright Chromium static-output proof. Jesssullivan/jesssullivan.github.io //:puppeteer_chromium_smoke adds a second public consumer Puppeteer smoke proof, Jesssullivan/jesssullivan.github.io //:playwright_chromium_smoke adds a public consumer Playwright Chromium runtime-smoke proof, and Jesssullivan/jesssullivan.github.io //:sveltekit_vite_build_smoke adds a public consumer SvelteKit/Vite build-smoke proof. Private Jesssullivan/MassageIthaca //:playwright_tmd_smoke adds a private Playwright TMD smoke proof over built Vite/SvelteKit output.
Python: needs a trivial py_test proof on tinyland-nix — there is no current Python test target in the repo.
Rust: //examples/hello-rust:hello_test.
C++: //examples/hello-cc:hello_test.
Go: //examples/hello-go:hello_test and //examples/hello-go-cgo:cgo_test.

Stage 1 proof acceptance runs through scripts/bazel-cache-backed.sh test, shows the shared-cache path working on the runner contract, and has no --remote_executor involvement. Source Bazel Proof now exercises the four rust/c++/go language test targets through that wrapper.

Stage 2 — Remote-test proof per language (one class at a time)

Only after Stage 1 lands per language is remote-test even on the table for that language. The Stage 2 unit is one target class per language — e.g. “rust_test on x86_64-linux,” not “all rust tests everywhere.”

Stage 2 proof acceptance:

Wraps through scripts/bazel-rbe-proof.sh (or its evolution) with explicit proof mode and forced execution.
Logs show test execution running on the REAPI worker, not on the runner.
Worker provenance, action digest, and platform identity are all captured.
Eligibility is reflected in config/rbe-target-eligibility.json (Codex stream owns this).

Stage 3 — Backend decision and broader rollout

Stage 3 is not in scope for this roadmap. It belongs to the broad-RBE gate work (see Roadmap “Later” section). The narrow proof cell does not survive scaling to broad RBE without a backend decision covering CAS, action cache, retention, auth, and observability.

What gates each stage

Stage	Per-language gate	Substrate gate
0 (hermeticity)	Bazel-hermetic toolchain registered	Rust/c++/go binary wedges landed; zig/chapel backlog
1 (cache test)	One trivial test target green on `tinyland-nix`	Stage 0 done for that language; actual test target exists and Source Bazel Proof exercises it
2 (remote test)	Forced REAPI proof through gf-reapi-cell, evidence captured	Stage 1 done for that language; gf-reapi-cell stable enough for repeated proof runs
3 (broad RBE)	(out of scope here)	Backend decision, retention/auth/obs design

What this roadmap explicitly does NOT do

Promise zig or chapel remote test. They are backlog at the toolchain layer; remote test conversation is meaningless before that.
Promise broad/default RBE for any test class. //app:unit_tests, pure-Go //examples/hello-go:hello_test, Rust //examples/hello-rust:hello_test, and C++ //examples/hello-cc:hello_test, and cgo-backed Go //examples/hello-go-cgo:cgo_test have narrow forced proofs; default developer and CI posture remains cache-forward unless explicitly opted into the proved executor-backed path.
Generalize //docs-site:playwright_chromium_smoke, tinyland-inc/omux.xoxd.ai //:puppeteer_chromium_smoke, tinyland-inc/omux.xoxd.ai //:playwright_chromium_smoke, tinyland-inc/omux.xoxd.ai //:playwright_local_route_smoke, tinyland-inc/omux.xoxd.ai //:puppeteer_local_route_smoke, or the Jesssullivan/jesssullivan.github.io browser/build-smoke targets beyond their proofs. They are proved for one Chromium static-site Playwright smoke class, one public omux Chromium Playwright static-output smoke class, one public omux local-server Playwright route-smoke class, one public omux local-server Puppeteer route-smoke class, one Chromium Playwright runtime smoke class, two Chromium static-output Puppeteer smoke classes, and one SvelteKit/Vite build-smoke class only, not all Playwright, not all Puppeteer, not deployed-environment E2E, and not Firefox. WebKit is proved separately for one consumer static-smoke class only (Jesssullivan/darkmap.phasi.space, run 27330688866); do not generalize it beyond that class either. Do not generalize the public tinyland-inc/omux.xoxd.ai //:unit_tests proof beyond one Vite/SvelteKit Vitest unit-test target class.
Replace the eligibility JSON. Codex stream owns config/rbe-target-eligibility.json. This roadmap describes the path; the JSON describes what is actually proven.

Recommended current slice

Keep Stage 1 cache-backed test proof for rust/c++/go and cgo-backed Go green in Source Bazel Proof.
Keep the pure-Go, cgo-backed Go, Rust, and C++ proof promotions in config/rbe-target-eligibility.json using runs 25634296833, 25649628233, 25648670844, and 25648975728; keep broader cgo-backed Go and broader C++ unproved.
Move the next forced REAPI language proof to the next real toolchain gap rather than widening claims from these trivial targets.
Keep //docs-site:playwright_chromium_smoke, tinyland-inc/omux.xoxd.ai //:unit_tests, tinyland-inc/omux.xoxd.ai //:puppeteer_chromium_smoke, tinyland-inc/omux.xoxd.ai //:playwright_chromium_smoke, tinyland-inc/omux.xoxd.ai //:playwright_local_route_smoke, tinyland-inc/omux.xoxd.ai //:puppeteer_local_route_smoke, and the public Jesssullivan/jesssullivan.github.io Playwright/Puppeteer/build-smoke target classes green as the first web/browser RBE classes. Keep the private Jesssullivan/MassageIthaca //:booking_operation_unit_tests, //:svelte_check_test, //:tsc_noemit_test, //:playwright_tmd_smoke, and //:sveltekit_node_build target classes green as separate private app proofs. Keep the private tinyland.dev //packages/tinyland-a11y-engine:typecheck, //:playwright_local_route_smoke, and //:puppeteer_local_route_smoke classes green as the first private TypeScript/package and local-server browser slices. Then design the next browser or TypeScript slice deliberately: additional private package typechecks, private package Vitest, Vitest browser mode, broader Puppeteer, broader svelte-check/typecheck, or deployed E2E should each receive its own target-class proof rather than inheriting these proofs.
Keep the Browser Runtime Authority as the gate for those browser slices: Chromium 138.0.7204.49 from locked pkgs.chromium is the current worker-image authority, exposed through GF_RBE_CHROMIUM_EXECUTABLE=/bin/chromium. Playwright/Puppeteer proofs must consume a pinned browser by executablePath and must not use npm lifecycle browser downloads.
Hold zig / chapel as backlog; revisit only after rust/cc/go are at Stage 1 stably.

Toolchain Coverage — hermeticity status table
GF REAPI Cell — narrow proof cell
Remote Execution Proof Contract
Roadmap