dev-ci.yml

name: Dev CI

on:
  push:
    branches: [dev]
  pull_request:
    branches: [dev]
    types: [opened, edited, synchronize, reopened, ready_for_review]
  workflow_dispatch:
    inputs:
      base_ref:
        description: Base branch ref whose tip must equal base_sha.
        required: true
        type: string
      base_sha:
        description: Exact 40-hex base commit SHA to compare against base_ref.
        required: true
        type: string
      base_repository:
        description: Base owner/repository containing base_ref (must be this repository).
        required: true
        type: string
      head_sha:
        description: Exact 40-hex PR head commit SHA to validate against the latest terminal-green dev state.
        required: false
        type: string
      base_sha_override:
        description: Optional exact terminal-green dev SHA; validation rejects a mismatch.
        required: false
        type: string
      wsl_drvfs:
        description: Run nonpublishing real WSLv2/NTFS DrvFS lock qualification for head_sha.
        required: false
        type: boolean
        default: false

# Least privilege by default: no dev-ci job needs a write-scoped GITHUB_TOKEN.
# Every job only checks out, installs, tests, and exchanges artifacts through the
# Actions artifact API, so a read-scoped token is sufficient.
permissions:
  contents: read

# A metadata-only `edited` run must not share the validation group: joining it would
# cancel the in-progress validation for the identical tree before any job-level
# guard is evaluated, leaving the SHA with no completed validation while skipped
# required jobs still report success. Such runs get their own group and never
# cancel anything. Base changes remain validation events even with metadata edits.
#
# Only a superseding `pull_request` run may cancel its predecessor, because a new
# push to the same PR head supersedes the previous validation of that head. A
# `push` to `dev` is a distinct integration state, not a superseded one, and `dev`
# has a single ref: cancelling there meant that when merges arrived faster than a
# run finished, every push run killed its predecessor and `dev` was never verified
# as a whole (#5709). The same reasoning removes the ordinary `workflow_dispatch`
# from the cancelling set -- a manual validation of `dev` must not kill the
# integration run already in flight.
concurrency:
  group: >-
    ${{ github.event_name == 'workflow_dispatch' && inputs.head_sha != '' && format('dev-ci-dispatch-{0}', github.run_id)
    || (github.event_name == 'pull_request' && github.event.action == 'edited' && (github.event.changes.body != null || github.event.changes.title != null) && github.event.changes.base == null)
    && format('{0}-{1}-metadata-edit', github.workflow, github.ref)
    || format('{0}-{1}', github.workflow, github.ref) }}
  cancel-in-progress: >-
    ${{ github.event_name == 'pull_request'
    && !(github.event.action == 'edited' && (github.event.changes.body != null || github.event.changes.title != null) && github.event.changes.base == null) }}

jobs:
  wsl-drvfs-qualification:
    name: Opt-in real WSLv2/NTFS DrvFS qualification
    if: ${{ github.event_name == 'workflow_dispatch' && inputs.wsl_drvfs == true }}
    runs-on: windows-2025
    timeout-minutes: 90
    permissions:
      contents: read
    env:
      QUALIFY_HEAD_SHA: ${{ inputs.head_sha }}
      QUALIFY_BASE_REPOSITORY: ${{ inputs.base_repository }}
      QUALIFY_HARNESS_SHA: ${{ github.workflow_sha }}
      QUALIFY_EVIDENCE: ${{ github.workspace }}/wsl-drvfs-evidence
    steps:
      - name: Validate qualification inputs
        shell: pwsh
        run: |
          $ErrorActionPreference = 'Stop'
          New-Item -ItemType Directory -Force -Path $env:QUALIFY_EVIDENCE | Out-Null
          "head_sha=$env:QUALIFY_HEAD_SHA`nharness_sha=$env:QUALIFY_HARNESS_SHA`nrepository=$env:GITHUB_REPOSITORY" | Set-Content "$env:QUALIFY_EVIDENCE/dispatch.txt"
          if ($env:QUALIFY_HEAD_SHA -cnotmatch '^[0-9a-f]{40}$') { throw 'Qualification requires exact lowercase 40-hex head_sha' }
          if ($env:QUALIFY_BASE_REPOSITORY -cne $env:GITHUB_REPOSITORY) { throw 'Qualification requires this repository' }
      - name: Checkout workflow harness independently
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
        with:
          repository: ${{ github.repository }}
          ref: ${{ github.workflow_sha }}
          path: qualification-harness
          persist-credentials: false
      - name: Checkout exact qualification source
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
        with:
          repository: ${{ github.repository }}
          ref: ${{ inputs.head_sha }}
          path: qualification-source
          fetch-depth: 0
          persist-credentials: false
      - name: Qualify exact source on disposable WSLv2 DrvFS
        shell: pwsh
        run: |
          & ./qualification-harness/scripts/qualify-wsl-drvfs.ps1 -SourcePath (Join-Path $env:GITHUB_WORKSPACE 'qualification-source') -HeadSha $env:QUALIFY_HEAD_SHA -EvidencePath $env:QUALIFY_EVIDENCE
      - name: Upload qualification evidence even on failure
        if: ${{ always() }}
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4
        with:
          name: wsl-drvfs-${{ github.run_id }}
          path: ${{ env.QUALIFY_EVIDENCE }}
          if-no-files-found: error
          retention-days: 14

  # Planner: resolve changed-path relevance and the affected task plan once, then
  # fan the plan out into per-task shards. Emits the matrix, has_tasks/has_native
  # flags, and the resolved changed paths so every downstream job reuses this
  # exact diff via CI_DEV_CHANGED_PATHS instead of re-resolving the base ref.
  affected-plan:
    name: Affected path validation / plan
    # A PR body/title edit without a base change changes no code, so the DAG is
    # skipped for it.
    if: ${{ !(github.event_name == 'workflow_dispatch' && inputs.head_sha != '') && !(github.event_name == 'pull_request' && github.event.action == 'edited' && (github.event.changes.body != null || github.event.changes.title != null) && github.event.changes.base == null) }}

    runs-on: ubuntu-22.04
    timeout-minutes: 10
    outputs:
      relevant: ${{ steps.relevance.outputs.relevant }}
      matrix: ${{ steps.plan.outputs.matrix }}
      has_tasks: ${{ steps.plan.outputs.has_tasks }}
      has_native: ${{ steps.plan.outputs.has_native }}
      has_python: ${{ steps.plan.outputs.has_python }}
      has_risk_canaries: ${{ steps.plan.outputs.has_risk_canaries }}
      has_darwin_arm64_tab_worker_smoke: ${{ steps.plan.outputs.has_darwin_arm64_tab_worker_smoke }}
      has_windows_session_path: ${{ steps.plan.outputs.has_windows_session_path }}
      has_protected_daemon_decl: ${{ steps.plan.outputs.has_protected_daemon_decl }}
      changed_paths: ${{ steps.plan.outputs.changed_paths }}
      plan_mode: ${{ steps.plan.outputs.plan_mode }}
      plan_digest: ${{ steps.plan.outputs.plan_digest }}
      plan_source_sha: ${{ steps.plan.outputs.plan_source_sha }}
    env:
      GITHUB_EVENT_BEFORE: ${{ github.event.before }}
      GITHUB_BASE_SHA: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.sha || github.event_name == 'workflow_dispatch' && inputs.base_sha || github.event.before }}
      CI_DEV_SOURCE_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
        with:
          fetch-depth: 0
          ref: ${{ github.event.pull_request.head.sha || github.sha }}
      - name: Verify checked-out source head
        shell: bash
        run: |
          head="$(git rev-parse HEAD)"
          test "$head" = "$CI_DEV_SOURCE_SHA" || { echo "Checked-out SHA $head does not match $CI_DEV_SOURCE_SHA"; exit 1; }
      - name: Fetch exact workflow-dispatch base
        if: ${{ github.event_name == 'workflow_dispatch' }}
        run: git fetch --no-tags origin "$GITHUB_BASE_SHA"
      - name: Verify PR head contains exact base
        if: ${{ github.event_name == 'pull_request' }}
        shell: bash
        run: |
          set -euo pipefail
          if ! git fetch --no-tags origin "${GITHUB_BASE_SHA}"; then
            echo "::error::Could not fetch immutable event base ${GITHUB_BASE_SHA} from ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}; rerun the PR event or rebase onto current ${GITHUB_BASE_REF}."
            exit 1
          fi
          if git merge-base --is-ancestor "${GITHUB_BASE_SHA}" HEAD; then
            :
          else
            status=$?
            if [ "$status" -eq 1 ]; then
              echo "::error::Exact-head CI requires this PR head to contain base ${GITHUB_BASE_SHA}; rebase onto current ${GITHUB_BASE_REF}."
            else
              echo "::error::Could not compare exact PR head ${CI_DEV_SOURCE_SHA} with immutable event base ${GITHUB_BASE_SHA} (merge-base exit ${status})."
            fi
            exit 1
          fi
      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6  # v2
        with:
          bun-version: "1.4.0"
      - uses: dtolnay/rust-toolchain@5b842231ba77f5c045dba54ac5560fed2db780e2  # nightly
        with:
          toolchain: nightly-2026-08-12
      # Released CHANGELOG sections are append-only. These files have no
      # `merge=union` driver, so a rebase conflicts here for real and a bad
      # resolution can silently drop the whole file — which is exactly what
      # happened to ten open PRs across six authors within ten minutes of the
      # driver being removed. Runs in affected-plan because it already has
      # full history and the immutable event base sha.
      - name: Guard released CHANGELOG history
        if: ${{ github.event_name == 'pull_request' }}
        run: bun scripts/changelog-history-guard.ts
      - name: Compute changed-path relevance
        id: relevance
        run: bun scripts/ci-job-relevance.ts
      - name: Compute affected task matrix
        id: plan
        run: bun scripts/ci-dev-affected.ts --matrix-json
      - name: Upload canonical affected plan
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4
        with:
          name: dev-affected-plan-${{ github.run_id }}
          path: .ci-dev-affected-plan.json
          include-hidden-files: true
          if-no-files-found: error
          retention-days: 1
          overwrite: true


  telegram-daemon-generation:
    name: Telegram daemon generation guard
    needs: [affected-plan]
    if: ${{ needs.affected-plan.outputs.relevant == 'true' && needs.affected-plan.outputs.has_protected_daemon_decl == 'true' }}
    runs-on: ubuntu-22.04
    timeout-minutes: 15
    env:
      GITHUB_BASE_SHA: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.sha || github.event_name == 'workflow_dispatch' && inputs.base_sha || github.event.before }}
      GITHUB_HEAD_SHA: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
      BASE_REF: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.ref || github.event_name == 'workflow_dispatch' && inputs.base_ref || github.ref_name }}
      HEAD_REF: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.ref || github.ref_name }}
      BASE_REPOSITORY: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.repo.full_name || github.event_name == 'workflow_dispatch' && inputs.base_repository || github.repository }}
      HEAD_REPOSITORY: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name || github.repository }}
      GUARD_EVENT_NAME: ${{ github.event_name }}
      GUARD_REPOSITORY: ${{ github.repository }}
    steps:
      - name: Validate exact guard inputs
        shell: bash
        run: |
          set -euo pipefail
          sha='^[0-9a-fA-F]{40}$'
          repo='^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$'
          [[ "${GITHUB_BASE_SHA}" =~ ${sha} ]] || { echo "Guard base SHA must be an exact 40-hex commit"; exit 1; }
          [[ "${GITHUB_HEAD_SHA}" =~ ${sha} ]] || { echo "Guard head SHA must be an exact 40-hex commit"; exit 1; }
          [[ "${BASE_REPOSITORY}" =~ ${repo} ]] || { echo "Guard base repository is invalid"; exit 1; }
          [[ "${HEAD_REPOSITORY}" =~ ${repo} ]] || { echo "Guard head repository is invalid"; exit 1; }
          [[ "${GUARD_REPOSITORY}" =~ ${repo} ]] || { echo "Guard repository is invalid"; exit 1; }
          git check-ref-format --branch "${BASE_REF}" >/dev/null || { echo "Guard base ref is not a valid branch ref"; exit 1; }
          git check-ref-format --branch "${HEAD_REF}" >/dev/null || { echo "Guard head ref is not a valid branch ref"; exit 1; }
          case "${GUARD_EVENT_NAME}" in
            pull_request) [[ "${BASE_REPOSITORY}" == "${GUARD_REPOSITORY}" ]] || { echo "PR base repository must be this repository"; exit 1; } ;;
            push|workflow_dispatch) [[ "${BASE_REPOSITORY}" == "${GUARD_REPOSITORY}" && "${HEAD_REPOSITORY}" == "${GUARD_REPOSITORY}" ]] || { echo "Push and dispatch repositories must be this repository"; exit 1; } ;;
            *) echo "Unsupported guard event"; exit 1 ;;
          esac
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
        with:
          repository: ${{ env.HEAD_REPOSITORY }}
          ref: ${{ github.event.pull_request.head.sha || github.sha }}
          fetch-depth: 0
      - name: Verify checked-out source head
        shell: bash
        run: |
          set -euo pipefail
          head="$(git rev-parse HEAD)"
          [[ "${head}" == "${GITHUB_HEAD_SHA}" ]] || { echo "Checked-out SHA ${head} does not match ${GITHUB_HEAD_SHA}"; exit 1; }
      - name: Fetch and prove authoritative guard revisions
        shell: bash
        run: |
          set -euo pipefail
          git remote add guard-head "https://github.com/${HEAD_REPOSITORY}.git"
          git remote add guard-base "https://github.com/${BASE_REPOSITORY}.git"
          git fetch --no-tags guard-head "refs/heads/${HEAD_REF}:refs/remotes/guard-head/${HEAD_REF}"
          head_ref_sha="$(git rev-parse --verify "refs/remotes/guard-head/${HEAD_REF}^{commit}")"
          base_ref_sha=''
          head_ref_descends_from_event_head=''
          case "${GUARD_EVENT_NAME}" in
            pull_request)
              # The immutable event base object remains authoritative while a queued
              # pull request's live base branch advances.
              git fetch --no-tags guard-base "${GITHUB_BASE_SHA}"
              ;;
            workflow_dispatch)
              git fetch --no-tags guard-base "refs/heads/${BASE_REF}:refs/remotes/guard-base/${BASE_REF}"
              base_ref_sha="$(git rev-parse --verify "refs/remotes/guard-base/${BASE_REF}^{commit}")"
              [[ "${base_ref_sha}" == "${GITHUB_BASE_SHA}" ]] || { echo "Dispatch base ref ${BASE_REF} resolves to ${base_ref_sha}, not ${GITHUB_BASE_SHA}"; exit 1; }
              ;;
            push)
              git fetch --no-tags guard-base "${GITHUB_BASE_SHA}"
              if git merge-base --is-ancestor "${GITHUB_HEAD_SHA}" "${head_ref_sha}"; then
                head_ref_descends_from_event_head=true
              else
                status=$?
                if [ "${status}" -eq 1 ]; then
                  echo "::error::Fetched push head ref ${HEAD_REF} does not descend from immutable event head ${GITHUB_HEAD_SHA}."
                else
                  echo "::error::Could not prove immutable event head ${GITHUB_HEAD_SHA} is an ancestor of fetched push head ref ${HEAD_REF} (merge-base exit ${status})."
                fi
                exit 1
              fi
              ;;
          esac
          {
            echo "GUARD_CHECKED_OUT_HEAD=$(git rev-parse --verify HEAD^{commit})"
            echo "GUARD_HEAD_REF_SHA=${head_ref_sha}"
            echo "GUARD_HEAD_REF_DESCENDS_FROM_EVENT_HEAD=${head_ref_descends_from_event_head}"
            echo "GUARD_BASE_OBJECT_SHA=$(git rev-parse --verify "${GITHUB_BASE_SHA}^{commit}")"
            echo "GUARD_BASE_REF_SHA=${base_ref_sha}"
          } >> "${GITHUB_ENV}"
          printf 'guard evidence: base %s@%s; event head %s; fetched head %s@%s; descendant proof %s\n' "${BASE_REPOSITORY}" "${GITHUB_BASE_SHA}" "${GITHUB_HEAD_SHA}" "${HEAD_REPOSITORY}" "${head_ref_sha}" "${head_ref_descends_from_event_head:-not-applicable}"
      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6  # v2
        with:
          bun-version: "1.4.0"
      - name: Cache bun dependencies
        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830  # v4
        with:
          path: ~/.bun/install/cache
          key: bun-1.4.0-${{ runner.os }}-${{ hashFiles('**/bun.lock') }}
      # The guard's AST canonicalization is parser-version sensitive: install the
      # pinned @babel/parser from the lockfile so the current-tree digest check is
      # deterministic and matches the committed attestations (no auto-install drift).
      - run: bun install --frozen-lockfile
      - run: bun scripts/telegram-daemon-generation-guard.ts --check-authority
      - run: bun scripts/telegram-daemon-generation-guard.ts
  windows-dev-doctor:
    name: Windows dev:doctor + session-path regression
    needs: [affected-plan]
    if: ${{ needs.affected-plan.outputs.relevant == 'true' && (contains(needs.affected-plan.outputs.changed_paths, 'scripts/dev-link') || needs.affected-plan.outputs.has_windows_session_path == 'true' || contains(needs.affected-plan.outputs.changed_paths, 'packages/coding-agent/src/session/blob-store.ts') || contains(needs.affected-plan.outputs.changed_paths, 'packages/coding-agent/src/session/session-manager.ts') || contains(needs.affected-plan.outputs.changed_paths, 'packages/coding-agent/src/capability/fs.ts') || contains(needs.affected-plan.outputs.changed_paths, 'packages/coding-agent/test/pr-4834-home-isolation.test.ts') || contains(needs.affected-plan.outputs.changed_paths, 'packages/coding-agent/test/session/resident-cache-win32-gate.windows.test.ts') || contains(needs.affected-plan.outputs.changed_paths, 'packages/coding-agent/src/cli/doctor') || contains(needs.affected-plan.outputs.changed_paths, 'packages/coding-agent/test/doctor-windows-repair-gate.test.ts')) }}
    runs-on: windows-latest
    timeout-minutes: 60
    env:
      CI_DEV_SOURCE_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
        with:
          ref: ${{ github.event.pull_request.head.sha || github.sha }}
      - name: Verify checked-out source head
        shell: pwsh
        run: |
          $head = (git rev-parse HEAD).Trim()
          if ($head -ne $env:CI_DEV_SOURCE_SHA) { throw "Checked-out SHA $head does not match $env:CI_DEV_SOURCE_SHA" }
      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6  # v2
        with:
          bun-version: "1.4.0"
      - uses: dtolnay/rust-toolchain@5b842231ba77f5c045dba54ac5560fed2db780e2  # nightly
        with:
          toolchain: nightly-2026-08-12
      - name: Prepend rustup toolchain bin to PATH
        shell: bash
        run: |
          toolchain_bin="$(dirname "$(rustup which cargo)")"
          echo "$toolchain_bin" >> "$GITHUB_PATH"
      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32  # v2
        with:
          shared-key: windows-dev-doctor-win32-x64
          cache-on-failure: true
          save-if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/dev' || github.event_name == 'pull_request' }}
          cache-workspace-crates: true
      - name: Cache bun dependencies
        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830  # v4
        with:
          path: ~/.bun/install/cache
          key: bun-1.4.0-${{ runner.os }}-${{ hashFiles('**/bun.lock') }}
      - run: bun install --frozen-lockfile
      - name: Build native addon (win32-x64 baseline)
        env:
          TARGET_PLATFORM: win32
          TARGET_ARCH: x64
          TARGET_VARIANTS: baseline
        run: bun run ci:build:native
      - name: Verify Windows workspace shim and doctor
        shell: pwsh
        run: |
          bun test ./scripts/dev-link.test.ts
          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
          bun run dev:doctor
          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
          # The journal-backed repair refusal is a win32-only contract: the Rust
          # journal authority is #[cfg(unix)], so the gate is proven on this runner.
          bun test ./packages/coding-agent/test/doctor-windows-repair-gate.test.ts
          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
      - name: Windows session-path canonicalization regression
        shell: pwsh
        run: |
          bun test ./packages/coding-agent/test/pr-4834-home-isolation.test.ts
          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
          bun test ./packages/coding-agent/test/session-manager/windows-canonical-path.test.ts
          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
          bun test ./packages/coding-agent/test/session/resident-cache-win32-gate.windows.test.ts
          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
          bun test ./packages/coding-agent/test/session/managed-lock-lease.windows.test.ts
          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
          bun test ./packages/coding-agent/test/sdk-session-directory.windows.test.ts
          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
          bun test ./packages/coding-agent/test/sdk-session-index-fsync.windows.test.ts
          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
          bun test ./packages/coding-agent/test/sdk-session-index-lock-contention.test.ts
          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
          bun test ./packages/coding-agent/test/file-lock-signed-identity.test.ts
          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
          # The session-state lock's owner-record create/retract protocol depends on
          # Windows handle-sharing semantics (no FILE_SHARE_DELETE on the create
          # descriptor), so its suite is proven here rather than on Ubuntu (#4990).
          bun test ./packages/coding-agent/test/empty-delete-receipt-latch.test.ts
          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
          bun test ./packages/coding-agent/test/session-state-lock.test.ts
          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
          bun test ./packages/coding-agent/test/sdk-lifecycle-ready-then-exit.test.ts
          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
          bun test ./packages/natives/test/windows-avx2-probe.windows.test.ts --timeout 10000
          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
          bun test ./packages/utils/test/env-provenance.windows.test.ts
          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
          bun test ./packages/natives/test/windows-hidden-shell.windows.test.ts --timeout 90000
          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
          bun test ./packages/natives/test/windows-shell-path.windows.test.ts --timeout 90000
          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
          bun test ./packages/natives/test/walker-pool-unavailable.windows.test.ts
          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
          bun test ./packages/utils/test/issue-935-repro.test.ts
          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
          bun test ./packages/coding-agent/test/task-cache-key.test.ts
          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
          bun test ./packages/coding-agent/test/sdk-session-router-attach-scope.test.ts
          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
      - name: Windows constrained-memory native runtime install
        shell: pwsh
        run: |
          bun test ./packages/natives/test/windows-runtime-install.windows.test.ts
          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
      - name: Windows hidden-console creation-flag unit tests
        shell: pwsh
        run: |
          cargo test -p pi-shell --lib windows
          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
          cargo test -p pi-shell --lib embedded_external_command_console_window_visibility
          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }


  windows-native-build-toolchain:
    name: Windows native build toolchain path
    needs: [affected-plan]
    if: ${{ needs.affected-plan.outputs.relevant == 'true' && (contains(needs.affected-plan.outputs.changed_paths, 'packages/natives/scripts/build-native.ts') || contains(needs.affected-plan.outputs.changed_paths, 'packages/natives/scripts/rust-toolchain-path.ts') || contains(needs.affected-plan.outputs.changed_paths, 'packages/natives/test/build-native-profile.test.ts') || contains(needs.affected-plan.outputs.changed_paths, 'scripts/ci-build-native.ts')) }}
    runs-on: windows-latest
    timeout-minutes: 60
    env:
      CI_DEV_SOURCE_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
        with:
          ref: ${{ github.event.pull_request.head.sha || github.sha }}
      - name: Verify checked-out source head
        shell: pwsh
        run: |
          $head = (git rev-parse HEAD).Trim()
          if ($head -ne $env:CI_DEV_SOURCE_SHA) { throw "Checked-out SHA $head does not match $env:CI_DEV_SOURCE_SHA" }
      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6  # v2
        with:
          bun-version: "1.4.0"
      - uses: dtolnay/rust-toolchain@5b842231ba77f5c045dba54ac5560fed2db780e2  # nightly
        with:
          toolchain: nightly-2026-08-12
      - name: Cache bun dependencies
        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830  # v4
        with:
          path: ~/.bun/install/cache
          key: bun-1.4.0-${{ runner.os }}-${{ hashFiles('**/bun.lock') }}
      - run: bun install --frozen-lockfile
      - name: Run native build toolchain tests
        run: bun test packages/natives/test/build-native-profile.test.ts
      - name: Build native addon (win32-x64 baseline)
        env:
          TARGET_PLATFORM: win32
          TARGET_ARCH: x64
          TARGET_VARIANTS: baseline
        run: bun run ci:build:native
  windows-telegram-daemon-safety:
    name: Windows Telegram daemon safety
    needs: [affected-plan]
    if: ${{ needs.affected-plan.outputs.relevant == 'true' && (contains(needs.affected-plan.outputs.changed_paths, 'telegram-daemon') || contains(needs.affected-plan.outputs.changed_paths, 'chat-daemon-control.ts') || contains(needs.affected-plan.outputs.changed_paths, 'packages/coding-agent/src/sdk/broker/process-incarnation.ts') || contains(needs.affected-plan.outputs.changed_paths, 'daemon-control.test.ts') || contains(needs.affected-plan.outputs.changed_paths, 'notifications-telegram-daemon.test.ts') || contains(needs.affected-plan.outputs.changed_paths, 'chat-daemon') || contains(needs.affected-plan.outputs.changed_paths, 'crates/pi-natives/src/path_identity.rs') || contains(needs.affected-plan.outputs.changed_paths, 'crates/pi-natives/src/ps.rs') || contains(needs.affected-plan.outputs.changed_paths, 'crates/pi-shell/src/process.rs') || contains(needs.affected-plan.outputs.changed_paths, 'packages/natives/native/index.d.ts') || contains(needs.affected-plan.outputs.changed_paths, 'packages/natives/native/index.js') || contains(needs.affected-plan.outputs.changed_paths, 'packages/natives/test/path-identity-windows.test.ts')) }}
    runs-on: windows-latest
    timeout-minutes: 60
    env:
      CI_DEV_SOURCE_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
        with:
          ref: ${{ github.event.pull_request.head.sha || github.sha }}
      - name: Verify checked-out source head
        shell: pwsh
        run: |
          $head = (git rev-parse HEAD).Trim()
          if ($head -ne $env:CI_DEV_SOURCE_SHA) { throw "Checked-out SHA $head does not match $env:CI_DEV_SOURCE_SHA" }
      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6  # v2
        with:
          bun-version: "1.4.0"
      - uses: dtolnay/rust-toolchain@5b842231ba77f5c045dba54ac5560fed2db780e2  # nightly
        with:
          toolchain: nightly-2026-08-12
      - name: Prepend rustup toolchain bin to PATH
        shell: bash
        run: |
          toolchain_bin="$(dirname "$(rustup which cargo)")"
          echo "$toolchain_bin" >> "$GITHUB_PATH"
      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32  # v2
        with:
          shared-key: windows-telegram-daemon-safety-win32-x64
          cache-on-failure: true
          cache-workspace-crates: true
      - name: Cache bun dependencies
        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830  # v4
        with:
          path: ~/.bun/install/cache
          key: bun-1.4.0-${{ runner.os }}-${{ hashFiles('**/bun.lock') }}
      - run: bun install --frozen-lockfile
      - name: Build native addon (win32-x64 baseline)
        env:
          TARGET_PLATFORM: win32
          TARGET_ARCH: x64
          TARGET_VARIANTS: baseline
        run: bun run ci:build:native
      - name: Run Windows daemon provenance safety contract
        shell: pwsh
        run: |
          bun test ./packages/coding-agent/test/daemon-control.test.ts --test-name-pattern 'incarnation|captured-owner|owner-lock|poll overlap|configured chat providers|hard Windows authority'
          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
          bun test ./packages/coding-agent/test/notifications-telegram-daemon.test.ts --test-name-pattern 'provider owner state contains transport authority|constructing or restarting provider transport cannot mutate session lifecycle'
          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
          bun test ./packages/natives/test/native.test.ts --test-name-pattern 'signals only the pinned root process'
          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
          bun test ./packages/natives/test/path-identity-windows.test.ts
          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }

  # RSS checkpoint compare: runs the existing harness scripts/verify-rss-checkpoints.ts
  # against the compiled gjc binary and compares it with the previous published
  # stable release binary (same baseline convention and same --advisory stage as the
  # release rss_checkpoint job in ci.yml). Regressions over tolerance are reported in
  # the job summary, not failed; a missing baseline or harness error still fails the
  # job. Only the cheap subset runs by default:
  # S1(--help startup), S2(--version), S3(interactive first render). Each scenario
  # costs 13 short-lived runs, so the gate stays minutes-scale; the heavy
  # tool-workload scenarios S4(1 MiB read), S5(8 MiB bash) and S7(MCP echo) remain
  # in the release rss_checkpoint job. The cheap subset still spans the startup,
  # version-print and interactive entrypoints where bundle-splitting changes and
  # session-manager residency show up first.
  #
  # Trigger scoping follows the affected-plan machinery like every sibling job:
  # skipped entirely for metadata-only PR edits and head-only dispatch (affected-plan
  # is skipped there, so this job never schedules), runs on dev push and PR, and
  # only when RSS-relevant paths changed (binary build path, compiled-binary boot
  # entrypoints -- cli.ts, cli-main.ts, cli-ordinary.ts, cli-commands.ts, whose module
  # graph decides what the measured startup processes load -- native addon sources,
  # session manager, or the harness itself).
  rss-checkpoint:
    name: RSS checkpoint compare (S1,S2,S3)
    needs: [affected-plan]
    if: ${{ needs.affected-plan.outputs.relevant == 'true' && (contains(needs.affected-plan.outputs.changed_paths, 'packages/coding-agent/scripts/build-binary.ts') || contains(needs.affected-plan.outputs.changed_paths, 'packages/coding-agent/scripts/compile-args.ts') || contains(needs.affected-plan.outputs.changed_paths, 'packages/coding-agent/src/cli.ts') || contains(needs.affected-plan.outputs.changed_paths, 'packages/coding-agent/src/cli-main.ts') || contains(needs.affected-plan.outputs.changed_paths, 'packages/coding-agent/src/cli-ordinary.ts') || contains(needs.affected-plan.outputs.changed_paths, 'packages/coding-agent/src/cli-commands.ts') || contains(needs.affected-plan.outputs.changed_paths, 'scripts/verify-rss-checkpoints.ts') || contains(needs.affected-plan.outputs.changed_paths, 'scripts/ci-build-native.ts') || contains(needs.affected-plan.outputs.changed_paths, 'packages/natives/native') || contains(needs.affected-plan.outputs.changed_paths, 'packages/natives/scripts') || contains(needs.affected-plan.outputs.changed_paths, 'crates/pi-natives/src') || contains(needs.affected-plan.outputs.changed_paths, 'packages/coding-agent/src/session/session-manager.ts') || contains(needs.affected-plan.outputs.changed_paths, 'packages/coding-agent/src/session/blob-store.ts')) }}
    runs-on: ubuntu-22.04
    timeout-minutes: 60
    permissions:
      contents: read
    env:
      CI_DEV_SOURCE_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
        with:
          ref: ${{ github.event.pull_request.head.sha || github.sha }}
      - name: Verify checked-out source head
        shell: bash
        run: |
          head="$(git rev-parse HEAD)"
          test "$head" = "$CI_DEV_SOURCE_SHA" || { echo "Checked-out SHA $head does not match $CI_DEV_SOURCE_SHA"; exit 1; }
      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6  # v2
        with:
          bun-version: "1.4.0"
      - uses: dtolnay/rust-toolchain@5b842231ba77f5c045dba54ac5560fed2db780e2  # nightly
        with:
          toolchain: nightly-2026-08-12
      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32  # v2
        with:
          shared-key: dev-rss-checkpoint-linux-x64
          cache-on-failure: true
          save-if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/dev' }}
          cache-workspace-crates: true
      - name: Cache bun dependencies
        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830  # v4
        with:
          path: ~/.bun/install/cache
          key: bun-1.4.0-${{ runner.os }}-${{ hashFiles('**/bun.lock') }}
      - name: Install system deps
        run: bash scripts/ci-install-system-deps.sh
      - run: bun install --frozen-lockfile
      - name: Build required Linux native addon variants
        env:
          TARGET_PLATFORM: linux
          TARGET_ARCH: x64
          TARGET_VARIANTS: baseline modern
        run: bun run ci:build:native
      - name: Build compiled gjc binary
        run: bun run --cwd=packages/coding-agent build
      - name: Install GNU time
        run: test -x /usr/bin/time || { sudo apt-get update -qq && sudo apt-get install -y -qq time; }
      - name: Resolve previous published stable release
        id: previous
        env:
          GH_TOKEN: ${{ github.token }}
        shell: bash
        run: |
          set -euo pipefail
          # Fail closed on a missing baseline: with no published stable release
          # there is no comparable baseline for the measured commit, so the job
          # stops with an actionable diagnostic instead of passing silently.
          previous="$(gh api --paginate "repos/$GITHUB_REPOSITORY/releases?per_page=100" \
             --jq ".[] | select(.draft == false and .prerelease == false) | .tag_name" \
             | sed -n 1p)"
          if [ -z "$previous" ]; then
            echo "::error::No comparable RSS baseline: this repository has no published stable release to measure as the baseline. Publish one stable release (its rss_checkpoint artifact ships gjc-linux-x64) and re-run this job."
            exit 1
          fi
          echo "tag=$previous" >> "$GITHUB_OUTPUT"
          git fetch --quiet --force origin "refs/tags/$previous:refs/tags/$previous"
          echo "commit=$(git rev-parse "$previous^{commit}")" >> "$GITHUB_OUTPUT"
          gh release download "$previous" --pattern gjc-linux-x64 --dir "$RUNNER_TEMP/rss/previous"
          chmod +x "$RUNNER_TEMP/rss/previous/gjc-linux-x64"
      - name: Write previous-release RSS baseline
        env:
          PREVIOUS_COMMIT: ${{ steps.previous.outputs.commit }}
        shell: bash
        run: |
          set -euo pipefail
          out="$RUNNER_TEMP/rss/checkpoints"
          bun scripts/verify-rss-checkpoints.ts --scenario S1,S2,S3 --write-baseline --matrix dev-ci \
             --binary "$RUNNER_TEMP/rss/previous/gjc-linux-x64" --commit "$PREVIOUS_COMMIT" --output-dir "$out"
      - name: Measure and compare current binary (advisory)
        env:
          PREVIOUS_TAG: ${{ steps.previous.outputs.tag }}
          PREVIOUS_COMMIT: ${{ steps.previous.outputs.commit }}
          CURRENT_COMMIT: ${{ github.event.pull_request.head.sha || github.sha }}
        shell: bash
        run: |
          set -euo pipefail
          out="$RUNNER_TEMP/rss/checkpoints"
          # Stage 1 of the threshold-promotion process (docs/perf-profiling-corpus.md):
          # RSS thresholds stay advisory until variance is characterized and a human
          # approves enforcement. --advisory reports regressions in the job summary
          # without failing; every other harness error (missing baseline, bad binary,
          # usage) still exits non-zero, and pipefail keeps tee from masking it.
          # The baseline is the previous stable release, so a reported delta is
          # release-to-head drift, not a delta caused by this commit alone.
          {
            echo "### RSS checkpoint compare (advisory)"
            echo "Baseline: \`$PREVIOUS_TAG\` (\`$PREVIOUS_COMMIT\`). Deltas are release-to-head drift, not attributable to this commit alone."
            echo '```'
          } >> "$GITHUB_STEP_SUMMARY"
          bun scripts/verify-rss-checkpoints.ts --scenario S1,S2,S3 --compare --advisory --allow-baseline-drift --matrix dev-ci \
             --baseline "$out/$PREVIOUS_COMMIT.json" \
             --binary packages/coding-agent/dist/gjc --commit "$CURRENT_COMMIT" --output-dir "$out" 2>&1 | tee -a "$GITHUB_STEP_SUMMARY"
          echo '```' >> "$GITHUB_STEP_SUMMARY"
      - name: Upload RSS checkpoint evidence
        if: ${{ always() }}
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4
        with:
          name: dev-rss-checkpoint-${{ github.run_id }}
          path: ${{ runner.temp }}/rss/checkpoints
          if-no-files-found: ignore
          retention-days: 1
          overwrite: true


  # Native addon build runs at most once per run and publishes the built `.node`
  # files as an artifact the runtime-dependent shards download. A content-hash
  # cache of the native sources lets PRs that don't touch crates/natives restore
  # the prebuilt addon and skip the Rust/native source build entirely; only a
  # cache miss (native source actually changed) recompiles. Skipped when the plan
  # needs no native build at all.
  affected-native:
    name: Affected path validation / native-build
    needs: [affected-plan]
    if: ${{ needs.affected-plan.outputs.has_native == 'true' }}
    runs-on: ubuntu-22.04
    timeout-minutes: 30
    env:
      CI_DEV_CHANGED_PATHS: ${{ needs.affected-plan.outputs.changed_paths }}
      CI_DEV_PLAN_MODE: ${{ needs.affected-plan.outputs.plan_mode }}
      CI_DEV_AFFECTED_PLAN: .ci-dev-affected-plan.json
      CI_DEV_PLAN_DIGEST: ${{ needs.affected-plan.outputs.plan_digest }}
      CI_DEV_PLAN_SOURCE_SHA: ${{ needs.affected-plan.outputs.plan_source_sha }}
      CI_DEV_SOURCE_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
        with:
          ref: ${{ github.event.pull_request.head.sha || github.sha }}
      - name: Verify checked-out source head
        shell: bash
        run: |
          head="$(git rev-parse HEAD)"
          test "$head" = "$CI_DEV_SOURCE_SHA" || { echo "Checked-out SHA $head does not match $CI_DEV_SOURCE_SHA"; exit 1; }
      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020  # v4
        with:
          node-version: "24"
      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6  # v2
        with:
          bun-version: "1.4.0"
      - name: Download and validate canonical affected plan
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093  # v4
        with:
          name: dev-affected-plan-${{ github.run_id }}
          path: .
      - run: bun scripts/ci-dev-affected.ts --validate-plan
      - uses: dtolnay/rust-toolchain@5b842231ba77f5c045dba54ac5560fed2db780e2  # nightly
        with:
          toolchain: nightly-2026-08-12
      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32  # v2
        with:
          shared-key: dev-affected-native-linux-x64
          cache-on-failure: true
          save-if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/dev' || github.event_name == 'pull_request' }}
          cache-workspace-crates: true
      - name: Cache bun dependencies
        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830  # v4
        with:
          path: ~/.bun/install/cache
          key: bun-1.4.0-${{ runner.os }}-${{ hashFiles('**/bun.lock') }}
      - name: Install system deps
        run: bash scripts/ci-install-system-deps.sh
      - run: bun install --frozen-lockfile
      - name: Build affected native addon(s)
        run: bun scripts/ci-dev-affected.ts --native-build
      - name: Verify required native addon variants
        run: |
          test -f packages/natives/native/pi_natives.linux-x64-baseline.node
          test -f packages/natives/native/pi_natives.linux-x64-modern.node
      # `if-no-files-found: error` only proves the glob matched something, so assert every
      # named producer sidecar exists before the upload claims to transport trust.
      - name: Verify producer provenance sidecars
        run: |
          test -f packages/natives/native/pi_natives.linux-x64-baseline.node.provenance.json
          test -f packages/natives/native/pi_natives.linux-x64-modern.node.provenance.json
      - name: Upload native addon(s)
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4
        with:
          name: dev-affected-native-${{ github.run_id }}
          path: |
            packages/natives/native/pi_natives.linux-x64-baseline.node
            packages/natives/native/pi_natives.linux-x64-modern.node
            packages/natives/native/pi_natives.linux-x64-baseline.node.provenance.json
            packages/natives/native/pi_natives.linux-x64-modern.node.provenance.json
          if-no-files-found: error
          retention-days: 1
          overwrite: true


  # Darwin arm64 builds the checked-out PR head end-to-end for every compiled
  # tab-worker smoke-graph path. The planner emits this canonical relevance flag.
  affected-darwin-arm64-tab-worker-smoke:
    name: Affected path validation / darwin-arm64 tab-worker smoke
    needs: [affected-plan]
    if: ${{ needs.affected-plan.outputs.has_darwin_arm64_tab_worker_smoke == 'true' }}
    runs-on: macos-14
    timeout-minutes: 45
    env:
      CI_DEV_SOURCE_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
        with:
          ref: ${{ github.event.pull_request.head.sha || github.sha }}
      - name: Verify checked-out source head
        shell: bash
        run: |
          head="$(git rev-parse HEAD)"
          test "$head" = "$CI_DEV_SOURCE_SHA" || { echo "Checked-out SHA $head does not match $CI_DEV_SOURCE_SHA"; exit 1; }
          node -e 'if (process.platform !== "darwin" || process.arch !== "arm64") { throw new Error(`Expected darwin/arm64, got ${process.platform}/${process.arch}`) }'
      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020  # v4
        with:
          node-version: "24"
      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6  # v2
        with:
          bun-version: "1.4.0"
      - uses: dtolnay/rust-toolchain@5b842231ba77f5c045dba54ac5560fed2db780e2  # nightly
        with:
          toolchain: nightly-2026-08-12
      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32  # v2
        with:
          shared-key: dev-affected-darwin-arm64-tab-worker
          cache-on-failure: true
          save-if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/dev' || github.event_name == 'pull_request' }}
          cache-workspace-crates: true
      - name: Cache bun dependencies
        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830  # v4
        with:
          path: ~/.bun/install/cache
          key: bun-1.4.0-${{ runner.os }}-${{ hashFiles('**/bun.lock') }}
      - run: bun install --frozen-lockfile
      - name: Build native addon (darwin-arm64)
        env:
          TARGET_PLATFORM: darwin
          TARGET_ARCH: arm64
        run: bun run ci:build:native
      - name: Build darwin-arm64 coding-agent binary
        run: bun --cwd=packages/coding-agent run build
      - name: Verify local diagnostic manifests on Darwin arm64
        shell: bash
        run: |
          bun test ./packages/natives/test/diagnostic-loader.test.ts --test-name-pattern "verifies a local source addon"
          bun test ./packages/natives/test/diagnostic-loader.test.ts --test-name-pattern "uses the verified local build digest carried by a compiled binary"
      - name: Smoke compiled tab worker with fresh owner directories
        shell: bash
        run: |
          runtime_dir="$(mktemp -d)"
          mkdir -p "$runtime_dir/home" "$runtime_dir/xdg"
          HOME="$runtime_dir/home" XDG_CONFIG_HOME="$runtime_dir/xdg/config" XDG_DATA_HOME="$runtime_dir/xdg/data" XDG_CACHE_HOME="$runtime_dir/xdg/cache" packages/coding-agent/dist/gjc --smoke-test
          printf 'CI_DEV_DARWIN_SMOKE_HOME=%s\n' "$runtime_dir/home" >> "$GITHUB_ENV"
          printf 'CI_DEV_DARWIN_SMOKE_XDG_CONFIG_HOME=%s\n' "$runtime_dir/xdg/config" >> "$GITHUB_ENV"
          printf 'CI_DEV_DARWIN_SMOKE_XDG_DATA_HOME=%s\n' "$runtime_dir/xdg/data" >> "$GITHUB_ENV"
          printf 'CI_DEV_DARWIN_SMOKE_XDG_CACHE_HOME=%s\n' "$runtime_dir/xdg/cache" >> "$GITHUB_ENV"
      - name: Write immutable Darwin smoke receipt
        env:
          CI_DEV_DARWIN_BINARY: packages/coding-agent/dist/gjc
          CI_DEV_DARWIN_NATIVE_ADDON: packages/natives/native/pi_natives.darwin-arm64.node
        run: bun scripts/ci-validate-darwin-receipt.ts --write
      - name: Upload Darwin smoke receipt
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4
        with:
          name: dev-affected-darwin-receipt-${{ github.run_id }}
          path: .ci-dev-darwin-arm64-receipt.json
          include-hidden-files: true
          if-no-files-found: error
          retention-days: 1
          overwrite: true

  # One shard per planned task on the broad runner. Native build tasks are
  # excluded (they run in affected-native); shards that load the native addon at
  # runtime download the prebuilt artifact instead of rebuilding it.
  affected-shards:
    name: Affected path validation / ${{ matrix.key }}
    needs: [affected-plan, affected-native]
    if: ${{ always() && needs.affected-plan.outputs.has_tasks == 'true' && needs.affected-native.result != 'failure' && needs.affected-native.result != 'cancelled' }}
    runs-on: ubuntu-22.04
    # Broad push-mode coding-agent/root test shards can need up to 90 minutes, but
    # the bounded root-check must retain the same 30-minute fail-fast contract as
    # Main CI. SDK closure remains outside that CI command.
    timeout-minutes: ${{ matrix.key == 'root-check' && 30 || 90 }}
    strategy:
      fail-fast: false
      max-parallel: 8
      matrix: ${{ fromJSON(needs.affected-plan.outputs.matrix) }}
    env:
      CI_DEV_CHANGED_PATHS: ${{ needs.affected-plan.outputs.changed_paths }}
      CI_DEV_PLAN_MODE: ${{ needs.affected-plan.outputs.plan_mode }}
      CI_DEV_AFFECTED_PLAN: .ci-dev-affected-plan.json
      CI_DEV_PLAN_DIGEST: ${{ needs.affected-plan.outputs.plan_digest }}
      CI_DEV_PLAN_SOURCE_SHA: ${{ needs.affected-plan.outputs.plan_source_sha }}
      CI_DEV_MATRIX_KEY: ${{ matrix.key }}
      CI_DEV_MATRIX_IDENTITY: ${{ matrix.identity }}
      CI_DEV_SHARD_INDEX: ${{ strategy.job-index }}
      CI_DEV_MATRIX_RUST: ${{ matrix.rust }}
      CI_DEV_MATRIX_NEXTEST: ${{ matrix.nextest }}
      CI_DEV_MATRIX_NATIVE: ${{ matrix.native }}
      CI_DEV_SOURCE_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
        with:
          ref: ${{ github.event.pull_request.head.sha || github.sha }}
          fetch-depth: 0
      - name: Verify checked-out source head
        shell: bash
        run: |
          head="$(git rev-parse HEAD)"
          test "$head" = "$CI_DEV_SOURCE_SHA" || { echo "Checked-out SHA $head does not match $CI_DEV_SOURCE_SHA"; exit 1; }
      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020  # v4
        with:
          node-version: "24"
      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6  # v2
        with:
          bun-version: "1.4.0"
      - name: Download and validate canonical affected plan
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093  # v4
        with:
          name: dev-affected-plan-${{ github.run_id }}
          path: .
      - run: bun scripts/ci-dev-affected.ts --validate-plan
      - uses: dtolnay/rust-toolchain@5b842231ba77f5c045dba54ac5560fed2db780e2  # nightly
        if: ${{ matrix.rust }}
        with:
          toolchain: nightly-2026-08-12
      - uses: taiki-e/install-action@56545b37b57562edd73171cb6c62cc509db4c34e  # v2
        if: ${{ matrix.nextest }}
        with:
          tool: nextest@0.9.137
      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32  # v2
        if: ${{ matrix.rust }}
        with:
          shared-key: dev-affected-rust-linux-x64
          cache-on-failure: true
          save-if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/dev' || github.event_name == 'pull_request' }}
          cache-workspace-crates: true
      - name: Cache bun dependencies
        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830  # v4
        with:
          path: ~/.bun/install/cache
          key: bun-1.4.0-${{ runner.os }}-${{ hashFiles('**/bun.lock') }}
      - name: Install system deps
        run: bash scripts/ci-install-system-deps.sh
      - run: bun install --frozen-lockfile
      - name: Download native addon(s)
        if: ${{ matrix.native }}
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093  # v4
        with:
          name: dev-affected-native-${{ github.run_id }}
          path: packages/natives/native
      # The transferred addons are only trusted through their producer sidecars: rebuild
      # the record from them and verify every addon in the directory before anything in
      # the shard can load one. Version/digest mismatches stay fail-closed.
      - name: Rebuild and verify transferred native provenance
        if: ${{ matrix.native }}
        shell: bash
        run: |
          set -euo pipefail
          bun scripts/verify-diagnostic-artifact-provenance.ts --rebuild-from-sidecars packages/natives/native
          bun scripts/verify-diagnostic-artifact-provenance.ts --verify packages/natives/native
      - name: Run affected task shard
        env:
          AFFECTED_TASK_KEY: ${{ matrix.key }}
          GITHUB_EVENT_BEFORE: ${{ github.event.before }}
          GITHUB_BASE_SHA: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.sha || github.event_name == 'workflow_dispatch' && inputs.base_sha || github.event.before }}
        run: bun scripts/ci-dev-affected.ts --task="$AFFECTED_TASK_KEY"
      - name: Write shard completion receipt
        run: |
          bun -e 'await Bun.write(`.ci-dev-shard-receipts/${process.env.CI_DEV_SHARD_INDEX}.json`, JSON.stringify({ key: process.env.AFFECTED_TASK_KEY, identity: process.env.CI_DEV_MATRIX_IDENTITY }))'
        env:
          AFFECTED_TASK_KEY: ${{ matrix.key }}
      - name: Upload shard completion receipt
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4
        with:
          name: dev-affected-shard-${{ github.run_id }}-${{ strategy.job-index }}
          path: .ci-dev-shard-receipts/${{ strategy.job-index }}.json
          include-hidden-files: true
          if-no-files-found: error
          retention-days: 1
          overwrite: true


  # This producer is deliberately not the protected status: the downstream job
  # validates the finalized bundle downloaded by its immutable artifact ID.
  affected-evidence-producer:
    name: Affected path validation / evidence producer
    # `always()` would otherwise run this after a skipped plan and fail trying to
    # download the plan artifact that was never produced.
    if: ${{ always() && !(github.event_name == 'workflow_dispatch' && inputs.head_sha != '') && !(github.event_name == 'pull_request' && github.event.action == 'edited' && (github.event.changes.body != null || github.event.changes.title != null) && github.event.changes.base == null) }}
    needs: [affected-plan, affected-native, affected-shards, telegram-daemon-generation, windows-dev-doctor, windows-native-build-toolchain, windows-telegram-daemon-safety, affected-darwin-arm64-tab-worker-smoke]
    runs-on: ubuntu-22.04
    timeout-minutes: 5
    outputs:
      artifact_id: ${{ steps.upload-evidence.outputs.artifact-id }}
      artifact_digest: ${{ steps.upload-evidence.outputs.artifact-digest }}
    env:
      CI_DEV_AFFECTED_PLAN: .ci-dev-affected-plan.json
      CI_DEV_PLAN_DIGEST: ${{ needs.affected-plan.outputs.plan_digest }}
      CI_DEV_PLAN_SOURCE_SHA: ${{ needs.affected-plan.outputs.plan_source_sha }}
      CI_DEV_PLAN_MODE: ${{ needs.affected-plan.outputs.plan_mode }}
      CI_DEV_SHARD_RECEIPTS: .ci-dev-shard-receipts
      CI_DEV_EVIDENCE_ROOT: .
      CI_DEV_SOURCE_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
        with:
          ref: ${{ github.event.pull_request.head.sha || github.sha }}
      - name: Verify checked-out source head
        shell: bash
        run: |
          head="$(git rev-parse HEAD)"
          test "$head" = "$CI_DEV_SOURCE_SHA" || { echo "Checked-out SHA $head does not match $CI_DEV_SOURCE_SHA"; exit 1; }
      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6  # v2
        with:
          bun-version: "1.4.0"
      - name: Download canonical affected plan
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093  # v4
        with:
          name: dev-affected-plan-${{ github.run_id }}
          path: .
      - name: Download shard completion receipts
        if: ${{ needs.affected-plan.result == 'success' && needs.affected-plan.outputs.has_tasks == 'true' && needs.affected-shards.result == 'success' }}
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093  # v4
        with:
          pattern: dev-affected-shard-${{ github.run_id }}-*
          path: .ci-dev-shard-receipts
          merge-multiple: true
      - name: Validate canonical shard completion
        if: ${{ needs.affected-plan.result == 'success' && needs.affected-plan.outputs.has_tasks == 'true' && needs.affected-shards.result == 'success' }}
        run: bun scripts/ci-dev-affected.ts --validate-shard-receipts
      - name: Download Darwin smoke receipt
        if: ${{ needs.affected-plan.result == 'success' && needs.affected-plan.outputs.has_darwin_arm64_tab_worker_smoke == 'true' && needs.affected-darwin-arm64-tab-worker-smoke.result == 'success' }}
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093  # v4
        with:
          name: dev-affected-darwin-receipt-${{ github.run_id }}
          path: .
      - name: Validate Darwin smoke receipt
        if: ${{ needs.affected-plan.result == 'success' && needs.affected-plan.outputs.has_darwin_arm64_tab_worker_smoke == 'true' && needs.affected-darwin-arm64-tab-worker-smoke.result == 'success' }}
        run: bun scripts/ci-validate-darwin-receipt.ts
      - name: Produce affected evidence
        env:
          CI_DEV_PLAN_RESULT: ${{ needs.affected-plan.result }}
          CI_DEV_NATIVE_RESULT: ${{ needs.affected-native.result }}
          CI_DEV_SHARDS_RESULT: ${{ needs.affected-shards.result }}
          CI_DEV_HAS_NATIVE: ${{ needs.affected-plan.outputs.has_native }}
          CI_DEV_HAS_TASKS: ${{ needs.affected-plan.outputs.has_tasks }}
          CI_DEV_HAS_PYTHON: ${{ needs.affected-plan.outputs.has_python }}
          CI_DEV_PYTHON_RESULT: skipped
          CI_DEV_WINDOWS_DOCTOR_RESULT: ${{ needs.windows-dev-doctor.result }}
          CI_DEV_WINDOWS_DOCTOR_REQUIRED: ${{ contains(needs.affected-plan.outputs.changed_paths, 'scripts/dev-link') || needs.affected-plan.outputs.has_windows_session_path == 'true' || contains(needs.affected-plan.outputs.changed_paths, 'packages/coding-agent/src/session/blob-store.ts') || contains(needs.affected-plan.outputs.changed_paths, 'packages/coding-agent/src/session/session-manager.ts') || contains(needs.affected-plan.outputs.changed_paths, 'packages/coding-agent/src/capability/fs.ts') || contains(needs.affected-plan.outputs.changed_paths, 'packages/coding-agent/test/pr-4834-home-isolation.test.ts') || contains(needs.affected-plan.outputs.changed_paths, 'packages/coding-agent/test/session/resident-cache-win32-gate.windows.test.ts') || contains(needs.affected-plan.outputs.changed_paths, 'packages/coding-agent/src/cli/doctor') || contains(needs.affected-plan.outputs.changed_paths, 'packages/coding-agent/test/doctor-windows-repair-gate.test.ts') }}
          CI_DEV_WINDOWS_NATIVE_TOOLCHAIN_RESULT: ${{ needs.windows-native-build-toolchain.result }}
          CI_DEV_WINDOWS_NATIVE_TOOLCHAIN_REQUIRED: ${{ contains(needs.affected-plan.outputs.changed_paths, 'packages/natives/scripts/build-native.ts') || contains(needs.affected-plan.outputs.changed_paths, 'packages/natives/scripts/rust-toolchain-path.ts') || contains(needs.affected-plan.outputs.changed_paths, 'packages/natives/test/build-native-profile.test.ts') || contains(needs.affected-plan.outputs.changed_paths, 'scripts/ci-build-native.ts') }}
          CI_DEV_TELEGRAM_GUARD_RESULT: ${{ needs.telegram-daemon-generation.result }}
          CI_DEV_TELEGRAM_GUARD_REQUIRED: ${{ needs.affected-plan.outputs.has_protected_daemon_decl }}
          CI_DEV_TELEGRAM_WINDOWS_RESULT: ${{ needs.windows-telegram-daemon-safety.result }}
          CI_DEV_TELEGRAM_WINDOWS_REQUIRED: ${{ contains(needs.affected-plan.outputs.changed_paths, 'telegram-daemon') || contains(needs.affected-plan.outputs.changed_paths, 'chat-daemon-control.ts') || contains(needs.affected-plan.outputs.changed_paths, 'packages/coding-agent/src/sdk/broker/process-incarnation.ts') || contains(needs.affected-plan.outputs.changed_paths, 'daemon-control.test.ts') || contains(needs.affected-plan.outputs.changed_paths, 'notifications-telegram-daemon.test.ts') || contains(needs.affected-plan.outputs.changed_paths, 'chat-daemon') || contains(needs.affected-plan.outputs.changed_paths, 'crates/pi-natives/src/path_identity.rs') || contains(needs.affected-plan.outputs.changed_paths, 'crates/pi-natives/src/ps.rs') || contains(needs.affected-plan.outputs.changed_paths, 'crates/pi-shell/src/process.rs') || contains(needs.affected-plan.outputs.changed_paths, 'packages/natives/native/index.d.ts') || contains(needs.affected-plan.outputs.changed_paths, 'packages/natives/native/index.js') || contains(needs.affected-plan.outputs.changed_paths, 'packages/natives/test/path-identity-windows.test.ts') }}
          CI_DEV_DARWIN_ARM64_TAB_WORKER_SMOKE_RESULT: ${{ needs.affected-darwin-arm64-tab-worker-smoke.result }}
          CI_DEV_DARWIN_ARM64_TAB_WORKER_SMOKE_REQUIRED: ${{ needs.affected-plan.outputs.has_darwin_arm64_tab_worker_smoke }}
        run: bun scripts/ci-dev-affected.ts --write-affected-evidence
      - name: Upload affected evidence
        id: upload-evidence
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4
        with:
          name: dev-affected-evidence-${{ github.run_id }}
          path: |
            .ci-dev-affected-evidence.json
            .ci-dev-affected-evidence.receipt.json
            .ci-dev-affected-plan.json
            .ci-dev-shard-receipts
            .ci-dev-darwin-arm64-receipt.json
          include-hidden-files: true
          if-no-files-found: error
          retention-days: 1
          overwrite: true

  affected:
    # Skipped jobs still publish success: non-code runs must use distinct contexts.
    name: ${{ ((github.event_name == 'workflow_dispatch' && inputs.head_sha != '') || (github.event_name == 'pull_request' && github.event.action == 'edited' && (github.event.changes.body != null || github.event.changes.title != null) && github.event.changes.base == null)) && 'Not code evidence - affected validation skipped' || 'Affected path validation' }}
    if: ${{ always() && !(github.event_name == 'workflow_dispatch' && inputs.head_sha != '') && !(github.event_name == 'pull_request' && github.event.action == 'edited' && (github.event.changes.body != null || github.event.changes.title != null) && github.event.changes.base == null) }}
    needs: [affected-evidence-producer, affected-plan, affected-native, affected-shards, telegram-daemon-generation, windows-dev-doctor, windows-native-build-toolchain, windows-telegram-daemon-safety, affected-darwin-arm64-tab-worker-smoke]
    runs-on: ubuntu-22.04
    timeout-minutes: 5
    env:
      CI_DEV_PLAN_DIGEST: ${{ needs.affected-plan.outputs.plan_digest }}
      CI_DEV_PLAN_SOURCE_SHA: ${{ needs.affected-plan.outputs.plan_source_sha }}
      CI_DEV_PLAN_MODE: ${{ needs.affected-plan.outputs.plan_mode }}
      CI_DEV_SOURCE_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
      CI_DEV_PLAN_RESULT: ${{ needs.affected-plan.result }}
      CI_DEV_NATIVE_RESULT: ${{ needs.affected-native.result }}
      CI_DEV_SHARDS_RESULT: ${{ needs.affected-shards.result }}
      CI_DEV_HAS_NATIVE: ${{ needs.affected-plan.outputs.has_native }}
      CI_DEV_HAS_TASKS: ${{ needs.affected-plan.outputs.has_tasks }}
      CI_DEV_HAS_PYTHON: ${{ needs.affected-plan.outputs.has_python }}
      CI_DEV_PYTHON_RESULT: skipped
      CI_DEV_WINDOWS_DOCTOR_RESULT: ${{ needs.windows-dev-doctor.result }}
      CI_DEV_WINDOWS_DOCTOR_REQUIRED: ${{ contains(needs.affected-plan.outputs.changed_paths, 'scripts/dev-link') || needs.affected-plan.outputs.has_windows_session_path == 'true' || contains(needs.affected-plan.outputs.changed_paths, 'packages/coding-agent/src/session/blob-store.ts') || contains(needs.affected-plan.outputs.changed_paths, 'packages/coding-agent/src/session/session-manager.ts') || contains(needs.affected-plan.outputs.changed_paths, 'packages/coding-agent/src/capability/fs.ts') || contains(needs.affected-plan.outputs.changed_paths, 'packages/coding-agent/test/pr-4834-home-isolation.test.ts') || contains(needs.affected-plan.outputs.changed_paths, 'packages/coding-agent/test/session/resident-cache-win32-gate.windows.test.ts') || contains(needs.affected-plan.outputs.changed_paths, 'packages/coding-agent/src/cli/doctor') || contains(needs.affected-plan.outputs.changed_paths, 'packages/coding-agent/test/doctor-windows-repair-gate.test.ts') }}
      CI_DEV_WINDOWS_NATIVE_TOOLCHAIN_RESULT: ${{ needs.windows-native-build-toolchain.result }}
      CI_DEV_WINDOWS_NATIVE_TOOLCHAIN_REQUIRED: ${{ contains(needs.affected-plan.outputs.changed_paths, 'packages/natives/scripts/build-native.ts') || contains(needs.affected-plan.outputs.changed_paths, 'packages/natives/scripts/rust-toolchain-path.ts') || contains(needs.affected-plan.outputs.changed_paths, 'packages/natives/test/build-native-profile.test.ts') || contains(needs.affected-plan.outputs.changed_paths, 'scripts/ci-build-native.ts') }}
      CI_DEV_DARWIN_ARM64_TAB_WORKER_SMOKE_RESULT: ${{ needs.affected-plan.outputs.has_darwin_arm64_tab_worker_smoke == 'true' && 'success' || 'skipped' }}
      CI_DEV_DARWIN_ARM64_TAB_WORKER_SMOKE_REQUIRED: ${{ needs.affected-plan.outputs.has_darwin_arm64_tab_worker_smoke }}
      CI_DEV_TELEGRAM_GUARD_RESULT: ${{ needs.telegram-daemon-generation.result }}
      CI_DEV_TELEGRAM_GUARD_REQUIRED: ${{ needs.affected-plan.outputs.has_protected_daemon_decl }}
      CI_DEV_TELEGRAM_WINDOWS_RESULT: ${{ needs.windows-telegram-daemon-safety.result }}
      CI_DEV_TELEGRAM_WINDOWS_REQUIRED: ${{ contains(needs.affected-plan.outputs.changed_paths, 'telegram-daemon') || contains(needs.affected-plan.outputs.changed_paths, 'chat-daemon-control.ts') || contains(needs.affected-plan.outputs.changed_paths, 'packages/coding-agent/src/sdk/broker/process-incarnation.ts') || contains(needs.affected-plan.outputs.changed_paths, 'daemon-control.test.ts') || contains(needs.affected-plan.outputs.changed_paths, 'notifications-telegram-daemon.test.ts') || contains(needs.affected-plan.outputs.changed_paths, 'chat-daemon') || contains(needs.affected-plan.outputs.changed_paths, 'crates/pi-natives/src/path_identity.rs') || contains(needs.affected-plan.outputs.changed_paths, 'crates/pi-natives/src/ps.rs') || contains(needs.affected-plan.outputs.changed_paths, 'crates/pi-shell/src/process.rs') || contains(needs.affected-plan.outputs.changed_paths, 'packages/natives/native/index.d.ts') || contains(needs.affected-plan.outputs.changed_paths, 'packages/natives/native/index.js') || contains(needs.affected-plan.outputs.changed_paths, 'packages/natives/test/path-identity-windows.test.ts') }}
    steps:
      - name: Fail closed on producer and live dependency results
        env:
          CI_DEV_EVIDENCE_ROOT: ${{ runner.temp }}/ci-dev-affected-evidence
        shell: bash
        run: |
          test '${{ needs.affected-evidence-producer.result }}' = success
          test '${{ needs.affected-plan.result }}' = success
          test '${{ needs.affected-evidence-producer.outputs.artifact_id }}' != ''
          test '${{ needs.affected-evidence-producer.outputs.artifact_digest }}' != ''
          test "$CI_DEV_EVIDENCE_ROOT" != "$GITHUB_WORKSPACE"
          case "$CI_DEV_EVIDENCE_ROOT" in "$GITHUB_WORKSPACE"/*) exit 1;; esac
          rm -rf "$CI_DEV_EVIDENCE_ROOT"
          mkdir -p "$CI_DEV_EVIDENCE_ROOT"
      - name: Download finalized affected evidence
      # download-artifact selects the immutable upload by artifact ID; the pinned
      # action exposes no downloaded digest output to compare, so artifact_digest
      # remains a required producer audit binding rather than a path selector.
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093  # v4
        with:
          artifact-ids: ${{ needs.affected-evidence-producer.outputs.artifact_id }}
          path: ${{ runner.temp }}/ci-dev-affected-evidence
          merge-multiple: true
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
        with:
          ref: ${{ github.event.pull_request.head.sha || github.sha }}
      - name: Verify checked-out source head
        shell: bash
        run: |
          head="$(git rev-parse HEAD)"
          test "$head" = "$CI_DEV_SOURCE_SHA" || { echo "Checked-out SHA $head does not match $CI_DEV_SOURCE_SHA"; exit 1; }
      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6  # v2
        with:
          bun-version: "1.4.0"
      - name: Validate finalized Darwin smoke receipt
        if: ${{ needs.affected-plan.outputs.has_darwin_arm64_tab_worker_smoke == 'true' }}
        env:
          CI_DEV_DARWIN_RECEIPT: ${{ runner.temp }}/ci-dev-affected-evidence/.ci-dev-darwin-arm64-receipt.json
        run: bun scripts/ci-validate-darwin-receipt.ts
      - name: Validate finalized affected evidence
        env:
          CI_DEV_EVIDENCE_ROOT: ${{ runner.temp }}/ci-dev-affected-evidence
        run: bun scripts/ci-dev-affected.ts --validate-affected-evidence
      - name: Validate live affected aggregate
        env:
          CI_DEV_AFFECTED_PLAN: ${{ runner.temp }}/ci-dev-affected-evidence/.ci-dev-affected-plan.json
        run: bun scripts/ci-dev-affected.ts --validate-aggregate

  # Resolve relevance without installing dependencies or provisioning natives.
  gjc-state-gates-relevance:
    name: gjc-state-gates / relevance
    if: ${{ !(github.event_name == 'workflow_dispatch' && inputs.head_sha != '') && !(github.event_name == 'pull_request' && github.event.action == 'edited' && (github.event.changes.body != null || github.event.changes.title != null) && github.event.changes.base == null) }}
    runs-on: ubuntu-22.04
    timeout-minutes: 5
    outputs:
      relevant: ${{ steps.relevance.outputs.relevant }}
    env:
      GITHUB_EVENT_BEFORE: ${{ github.event.before }}
      GITHUB_BASE_SHA: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.sha || github.event_name == 'workflow_dispatch' && inputs.base_sha || github.event.before }}
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
        with:
          ref: ${{ github.event.pull_request.head.sha || github.sha }}
          fetch-depth: 0
      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6  # v2
        with:
          bun-version: "1.4.0"
      - name: Resolve GJC state gate relevance
        id: relevance
        run: bun scripts/ci-gjc-state-gates.ts --emit-relevance

  # Relevant state-gate tests need both Linux x64 ISA variants on every shard.
  gjc-state-gates-native:
    name: gjc-state-gates / native addon
    if: ${{ needs.gjc-state-gates-relevance.result == 'success' && needs.gjc-state-gates-relevance.outputs.relevant == 'true' }}
    needs: [gjc-state-gates-relevance]
    runs-on: ubuntu-22.04
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
        with:
          ref: ${{ github.event.pull_request.head.sha || github.sha }}
          fetch-depth: 0
      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020  # v4
        with:
          node-version: "24"
      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6  # v2
        with:
          bun-version: "1.4.0"
      - uses: dtolnay/rust-toolchain@5b842231ba77f5c045dba54ac5560fed2db780e2  # nightly
        with:
          toolchain: nightly-2026-08-12
      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32  # v2
        with:
          shared-key: dev-state-gates-native-linux-x64
          cache-on-failure: true
          save-if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/dev' || github.event_name == 'pull_request' }}
          cache-workspace-crates: true
      - name: Restore bun dependency cache
        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830  # v4
        with:
          path: ~/.bun/install/cache
          key: bun-1.4.0-${{ runner.os }}-${{ hashFiles('**/bun.lock') }}
          restore-keys: |
            bun-1.4.0-${{ runner.os }}-
      - name: Install system deps
        run: bash scripts/ci-install-system-deps.sh
      - run: bun install --frozen-lockfile
      - name: Build required Linux native addon variants
        env:
          TARGET_PLATFORM: linux
          TARGET_ARCH: x64
          TARGET_VARIANTS: baseline modern
        run: bun run ci:build:native
      - name: Verify required native addon variants
        run: |
          test -f packages/natives/native/pi_natives.linux-x64-baseline.node
          test -f packages/natives/native/pi_natives.linux-x64-modern.node
      - name: Upload state-gate native addon(s)
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4
        with:
          name: dev-state-gates-native-${{ github.run_id }}
          path: |
            packages/natives/native/pi_natives.linux-x64-baseline.node
            packages/natives/native/pi_natives.linux-x64-modern.node
          if-no-files-found: error
          retention-days: 1
          overwrite: true

  gjc-state-gates-matrix:
    name: gjc-state-gates / ${{ matrix.group }}
    # Inherit dispatch/metadata-edit filtering from the successful relevance job.
    if: ${{ needs.gjc-state-gates-relevance.result == 'success' && needs.gjc-state-gates-relevance.outputs.relevant == 'true' }}
    needs: [gjc-state-gates-relevance, gjc-state-gates-native]
    runs-on: ubuntu-22.04
    timeout-minutes: 10
    strategy:
      fail-fast: false
      matrix:
        group: [static, runtime, integrity, read]
    env:
      GITHUB_EVENT_BEFORE: ${{ github.event.before }}
      GITHUB_BASE_SHA: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.sha || github.event_name == 'workflow_dispatch' && inputs.base_sha || github.event.before }}
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
        with:
          ref: ${{ github.event.pull_request.head.sha || github.sha }}
          fetch-depth: 0
      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020  # v4
        with:
          node-version: "24"
      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6  # v2
        with:
          bun-version: "1.4.0"
      - name: Restore bun dependency cache
        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830  # v4
        with:
          path: ~/.bun/install/cache
          key: bun-1.4.0-${{ runner.os }}-${{ hashFiles('**/bun.lock') }}
          restore-keys: |
            bun-1.4.0-${{ runner.os }}-
      - run: bun install --frozen-lockfile
      - name: Download state-gate native addon(s)
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093  # v4
        with:
          name: dev-state-gates-native-${{ github.run_id }}
          path: packages/natives/native
      - name: Verify state-gate native addon variants
        run: |
          test -f packages/natives/native/pi_natives.linux-x64-baseline.node
          test -f packages/natives/native/pi_natives.linux-x64-modern.node
      - name: Run GJC state gate shard
        run: bun scripts/ci-gjc-state-gates.ts --group=${{ matrix.group }}

  # Branch protection must keep requiring this stable aggregate status.
  gjc-state-gates:
    name: ${{ ((github.event_name == 'workflow_dispatch' && inputs.head_sha != '') || (github.event_name == 'pull_request' && github.event.action == 'edited' && (github.event.changes.body != null || github.event.changes.title != null) && github.event.changes.base == null)) && 'Not code evidence - state gates skipped' || 'gjc-state-gates' }}
    if: ${{ always() && !(github.event_name == 'workflow_dispatch' && inputs.head_sha != '') && !(github.event_name == 'pull_request' && github.event.action == 'edited' && (github.event.changes.body != null || github.event.changes.title != null) && github.event.changes.base == null) }}
    needs: [gjc-state-gates-relevance, gjc-state-gates-native, gjc-state-gates-matrix]
    runs-on: ubuntu-22.04
    timeout-minutes: 5
    steps:
      - name: Aggregate GJC state gate shards
        run: |
          relevance_result='${{ needs.gjc-state-gates-relevance.result }}'
          relevant='${{ needs.gjc-state-gates-relevance.outputs.relevant }}'
          native='${{ needs.gjc-state-gates-native.result }}'
          shards='${{ needs.gjc-state-gates-matrix.result }}'
          test "$relevance_result" = success || exit 1
          case "$relevant" in
            true) test "$native" = success && test "$shards" = success ;;
            false) test "$native" = skipped && test "$shards" = skipped ;;
            *) echo "Missing or invalid GJC state gate relevance"; exit 1 ;;
          esac

  # Stable pre-merge status: this runs for every PR after the protected affected
  # aggregate, then only materializes a virtual merge when the canonical planner
  # selected risk canaries. A dispatch remains available for exact-head bootstrap
  # evidence. Every merge candidate shares one non-cancelling lane: a candidate
  # selects and materializes against dev, so overlapping candidates could otherwise
  # validate against incompatible integration state. Keep up to 100 candidates
  # pending with queue: max instead of replacing the previous pending validation.
  virtual-integration:
    name: ${{ (github.event_name == 'pull_request' && github.event.action == 'edited' && (github.event.changes.body != null || github.event.changes.title != null) && github.event.changes.base == null) && 'Not code evidence - virtual integration skipped' || 'Virtual integration validation' }}
    needs: [affected-plan, affected]
    if: ${{ always() && ((github.event_name == 'pull_request' && needs.affected.result == 'success') || (github.event_name == 'workflow_dispatch' && inputs.head_sha != '')) }}
    concurrency:
      group: dev-ci-virtual-integration
      cancel-in-progress: false
      queue: max
    runs-on: ubuntu-22.04
    timeout-minutes: 30
    permissions:
      contents: read
      actions: read
    env:
      CI_VI_HEAD_SHA: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || inputs.head_sha }}
      # CI_VI_BASE_SHA is set per-step from the authoritative terminal-green
      # dev base selected by --select-base, never from the stale PR event base.
      CI_VI_REQUIRED: ${{ github.event_name == 'workflow_dispatch' && 'true' || needs.affected-plan.outputs.has_risk_canaries }}
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
        with:
          fetch-depth: 0
          ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || inputs.head_sha }}
      - name: Verify checked-out source head
        shell: bash
        run: |
          head="$(git rev-parse HEAD)"
          test "$head" = "$CI_VI_HEAD_SHA" || { echo "Checked-out SHA $head does not match $CI_VI_HEAD_SHA"; exit 1; }
      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6  # v2
        with:
          bun-version: "1.4.0"
      - name: Select authoritative terminal-green dev base
        id: green-dev
        env:
          GH_TOKEN: ${{ github.token }}
          CI_VI_HEAD_SHA: ${{ env.CI_VI_HEAD_SHA }}
        shell: bash
        run: |
          set -euo pipefail
          bun scripts/ci-virtual-integration.ts --select-base |
            {
              base_sha=""
              base_run_id=""
              base_conclusion=""
              while IFS='=' read -r key value; do
                case "$key" in
                  authority_base_sha) base_sha="$value" ;;
                  authority_base_run_id) base_run_id="$value" ;;
                  authority_base_conclusion) base_conclusion="$value" ;;
                esac
              done
              test -n "$base_sha" || { echo "::error::No authoritative terminal-green dev base selected"; exit 1; }
              echo "base_sha=$base_sha" >> "$GITHUB_OUTPUT"
              echo "base_run_id=$base_run_id" >> "$GITHUB_OUTPUT"
              echo "base_conclusion=$base_conclusion" >> "$GITHUB_OUTPUT"
            }
      - name: Fetch and verify authoritative base
        env:
          CI_VI_AUTHORITY_BASE_SHA: ${{ steps.green-dev.outputs.base_sha }}
        run: |
          git fetch --no-tags origin "${CI_VI_AUTHORITY_BASE_SHA}:refs/remotes/origin/ci-virtual-base"
          fetched="$(git rev-parse origin/ci-virtual-base)"
          test "$fetched" = "$CI_VI_AUTHORITY_BASE_SHA" || { echo "::error::Fetched base $fetched != $CI_VI_AUTHORITY_BASE_SHA"; exit 1; }
      - name: Validate virtual integration evidence
        if: ${{ env.CI_VI_REQUIRED == 'true' }}
        env:
          CI_VI_BASE_SHA: ${{ steps.green-dev.outputs.base_sha }}
          CI_VI_BASE_SHA_OVERRIDE: ${{ inputs.base_sha_override }}
          CI_VI_BASE_RUN_ID: ${{ steps.green-dev.outputs.base_run_id }}
          CI_VI_BASE_CONCLUSION: ${{ steps.green-dev.outputs.base_conclusion }}
        run: bun scripts/ci-virtual-integration.ts --validate
      - name: Provision pinned Rust toolchain for canary native build
        if: ${{ env.CI_VI_REQUIRED == 'true' }}
        uses: dtolnay/rust-toolchain@5b842231ba77f5c045dba54ac5560fed2db780e2  # nightly
        with:
          toolchain: nightly-2026-08-12
      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32  # v2
        if: ${{ env.CI_VI_REQUIRED == 'true' }}
        with:
          shared-key: dev-virtual-integration-linux-x64
      - name: Run risk-selected canaries in the materialized merge
        if: ${{ env.CI_VI_REQUIRED == 'true' }}
        env:
          CI_VI_BASE_SHA: ${{ steps.green-dev.outputs.base_sha }}
          CI_VI_BASE_RUN_ID: ${{ steps.green-dev.outputs.base_run_id }}
        run: bun scripts/ci-virtual-integration.ts --run-canaries
      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4
        if: ${{ env.CI_VI_REQUIRED == 'true' }}
        with:
          name: dev-virtual-integration-${{ github.run_id }}
          path: .ci-virtual-integration.json
          include-hidden-files: true
          if-no-files-found: error
          retention-days: 1
          overwrite: true