What happened

Verify Agent Ghost.yml installed a krill-desktop.jar whose bytecode did not contain the PR’s changes. Bytecode inspection on krill#527 (CompositionLocalProvider wrapper in DarkBlueGrayTheme) confirmed the compiled class referenced a content() call from a commit predating the PR head — the .class file was restored from the Gradle build cache rather than compiled from the checked-out PR source.

gradle/actions/setup-gradle@v5 persists the Gradle build cache (~/.gradle/caches/build-cache) across workflow runs. When the cache key matched a prior run’s output for a .kt file that the PR modified, Gradle reused the stale cached .class and skipped recompilation. The resulting jar passed Ghost’s MCP-observable checks but ran the wrong code.

Fix

• Added --no-build-cache to all five Gradle compile invocations in Verify Agent Ghost.yml:
  • composeApp:wasmZip
  • server:proguard
  • composeApp:packageReleaseUberJarForCurrentOS
  • krill-pi4j-service:shadowJar
  • krill-mcp-service:shadowJar

Prevention

• Every Gradle compile step in a PR-verification workflow must pass --no-build-cache. The verify workflow’s job is to test this PR’s bytecode — a cache hit from a prior run is always wrong.
• --no-configuration-cache (already present on some steps) guards against stale task graphs; --no-build-cache guards against stale compiled outputs — both are required for a correct verify run.
• When a Ghost PASS is followed by a regression that the verified code appeared to fix, check whether the installed jar matches PR_HEAD_SHA before trusting the result (javap -verbose <Kt.class> | grep SourceFile and compare byte-for-byte with a fresh compile).