run test-powerset for every GitHub change

.github/workflows/ci.yml

@@ -18,8 +18,8 @@ on:
     branches: [main]
   schedule:
     # Weekly, so that a new RustSec advisory against an unchanged Cargo.lock is
-    # noticed without waiting for the next pull request, and to run the
-    # test-powerset job. A failure is emailed to whoever last changed this line.
+    # noticed without waiting for the next pull request. A failure is emailed to
+    # whoever last changed this line.
     - cron: "23 6 * * 1"
   workflow_dispatch:
 
@@ -156,12 +156,12 @@ jobs:
         run: make latest-stable
 
   test-powerset:
-    # Every combination of vcrd-core's features, weekly and on demand: the check
-    # that ARCHITECTURE §2's rules hold, which lets every change test only the
-    # supported builds. Linux only, to keep the weekly cost down; macOS runs the
-    # supported builds on every change. ci-ok does not wait for it.
+    # Every combination of vcrd-core's features, on every change: the check that
+    # ARCHITECTURE §2's rules hold. Linux only; macOS runs the supported builds.
+    # ci-ok waits for it, but `make ci-ok` leaves it out (see the Makefile). The
+    # number of combinations doubles with each feature: if the job grows slow,
+    # return it to the weekly schedule and take it out of ci-ok's needs.
     name: test (every feature combination)
-    if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
     runs-on: ubuntu-latest
     timeout-minutes: 45
     steps:
@@ -182,10 +182,11 @@ jobs:
     # The one status check the main ruleset requires. GitHub reports a job that
     # was skipped because a job it needs failed as successful, which would let a
     # required check pass; hence if: always() and a test of every result.
-    # `make ci-ok` is the local equivalent; keep its prerequisites equal to needs.
+    # `make ci-ok` is the local equivalent; keep its prerequisites equal to needs,
+    # less test-powerset.
     name: ci-ok
     if: always()
-    needs: [fmt, test, lints-fire, supply-chain]
+    needs: [fmt, test, lints-fire, supply-chain, test-powerset]
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:

ARCHITECTURE.md

@@ -136,8 +136,11 @@ rather than exponential:
 - **`vcrd-cli` supports its default features.** The builds with no format and with no
   proof suite must fail, and CI checks that they do.
 
-Every combination of `vcrd-core`'s features runs weekly and on demand (`make
-test-powerset`), as the check that these rules hold; it does not block a merge.
+Every combination of `vcrd-core`'s features (`make test-powerset`) runs in CI on every
+change, as the check that these rules hold, and a merge waits for it (decided
+2026-10-07). `make ci-ok` leaves it out, so a local run tests the supported builds only.
+The combinations double with each feature; if the job grows slow, it returns to a weekly
+run that does not block a merge.
 
 ## 3. Data structures
 

DEVELOPMENT-PLAN.md

@@ -154,6 +154,8 @@ every other `alg` exercise the by-name rejection path from day one.
   extends; and `vcrd-cli` refuses to build with no suite, as with no format, which the
   feature matrix checks. Decided 2026-09-27: CI builds the supported feature builds of
   ARCHITECTURE §2 on every change, through cargo-hack, and every combination weekly.
+  Decided 2026-10-07: every combination runs on every change too, and a merge waits for
+  it; `make ci-ok` still runs only the supported builds.
 - *Output.* The JSON envelope with every always-present key of ARCHITECTURE §6,
   `schema_version: 0`, `contained: []`; `text` via `tabled`; `plain`; every claim value
   masked by default; `--unsafe` with the stderr banner and the `reveals` list;

Makefile

@@ -1,11 +1,12 @@
 # The CI jobs. Each job in .github/workflows/ci.yml runs one of these targets,
 # so the commands and tool versions live only here.
 #
-#   make ci-ok          the four jobs ci-ok requires, in order, stopping at the
-#                       first failure
+#   make ci-ok          the jobs ci-ok requires except test-powerset, in order,
+#                       stopping at the first failure
 #   make -k ci-ok       the same, but running every job and reporting each failure
 #   make latest-stable  the non-blocking job, on the latest stable toolchain
-#   make test-powerset  the weekly job: every combination of vcrd-core's features
+#   make test-powerset  every combination of vcrd-core's features: required in CI,
+#                       left out of make ci-ok
 #   make clean          our crates' build output; dependencies and tools stay
 #   make clean-build    all build output, lints-fire's included; tools stay
 #   make clean-all      everything, the tools included
@@ -28,15 +29,16 @@ help:
 	@echo "make -k ci-ok       the same, continuing past failures"
 	@echo "make fmt | test | lints-fire | supply-chain    one job"
 	@echo "make latest-stable  the non-blocking job, on the latest stable toolchain"
-	@echo "make test-powerset  every combination of vcrd-core's features (weekly in CI)"
+	@echo "make test-powerset  every combination of vcrd-core's features (CI requires it; ci-ok here does not run it)"
 	@echo "make tools-hack | tools-supply-chain    build the tools into $(TOOLS)"
 	@echo "make clean          our crates' build output; dependencies and tools stay"
 	@echo "make clean-build    all build output, lints-fire's included; tools stay"
 	@echo "make clean-all      everything, the tools included"
 
-# Keep equal to the needs of the ci-ok job in ci.yml.
+# Keep equal to the needs of the ci-ok job in ci.yml, less test-powerset: locally,
+# the supported builds are enough, and `make test-powerset` runs the rest on demand.
 ci-ok: fmt test lints-fire supply-chain
-	@echo "ci-ok: every required job passed"
+	@echo "ci-ok: every required job passed; CI also requires test-powerset"
 
 fmt:
 	cargo fmt --all --check

scripts/feature-matrix.sh

@@ -2,7 +2,8 @@
 # Lints, checks and tests the supported feature builds (ARCHITECTURE §2;
 # REQUIREMENTS §13), then checks that vcrd-cli refuses to build with no format or
 # no proof suite. With --powerset, vcrd-core runs in every combination of its
-# features instead: the weekly check that ARCHITECTURE §2's rules hold.
+# features instead: the check that ARCHITECTURE §2's rules hold, which CI runs on
+# every change and `make ci-ok` leaves out.
 #
 # vcrd-core's builds come from cargo-hack, which reads the features from
 # vcrd-core/Cargo.toml. --each-feature is: no features, each feature alone, the