[AAASM-2665] 🔧 (ci): Per-PR matrix trim + concurrency + debug native build

[Chisanan232]

Description

Hardens the per-PR CI footprint for the python-sdk reusable-workflow chain
(ci.yaml → rw_run_all_test_and_record.yaml → rw_build_and_test.yaml) while
keeping the full 4-OS matrix on push/scheduled/release. Implements AAASM-2665.

Changes (one commit each):

• Concurrency cancel-in-progress on ci.yaml, native-core-build.yml, benchmarks.yml, type-check.yml (previously only documentation/release had it).
• Matrix operating-systems is now a workflow_call input on rw_build_and_test.yaml (default = the current full 4-OS list), threaded through rw_run_all_test_and_record.yaml and computed in ci.yaml: ["ubuntu-latest"] on pull_request, the full 4-OS list otherwise.
• Native build native-core-build.yml now runs a debug maturin develop (dropped --release); its pull_request paths narrow from agent_assembly/** to rust/** + the FFI-binding Python files (agent_assembly/__init__.py, agent_assembly/types.py).
• Benchmarks gated behind a benchmark PR label (types: [labeled] + job-level if), off the default per-PR path.
• CI Success aggregate gate in ci.yaml (needs: [build-and-test_all], if: always()) → one stable required check.

Default behaviour is preserved when no operating-systems override is passed, so callers like ci_includes_e2e_test.yaml still run all 4 OSes.

Flagged for maintainer decision (NOT changed here)

• Pin the external reusable workflow. Both record/build workflows reference Chisanan232/GitHub-Action_Reusable_Workflows-Python/...@master. Pinning to a SHA/tag is a supply-chain item but needs the maintainer to pick the pin.
• Commented-out e2e schedule cron in ci_includes_e2e_test.yaml ('33 19 * * 2'). Re-enable vs delete is an ops decision (consumes the e2e Slack-token secret); left commented.

Type of Change

• ✨ New feature
• 🔧 Bug fix
• ♻️ Refactoring
• 🍀 Performance improvement
• 📚 Documentation update
• 🚀 Release

Breaking Changes

• No
• Yes (please describe below)

PRs now run unit/integration on ubuntu-only; full 4-OS coverage is retained on master/scheduled/release.

Related Issues

• Related JIRA ticket: AAASM-2665 (impl subtask AAASM-2678, verify subtask AAASM-2679)
• Related GitHub issues: N/A

Testing

Describe the testing performed for this PR:

• Unit tests added/updated
• Integration tests added/updated
• Manual testing performed
• No tests required (explain why)

CI-config-only change. Validated each workflow with python3 -c "import yaml; yaml.safe_load(...)" after every edit; grep-verified concurrency blocks; confirmed the rw_build_and_test default equals the prior hardcoded 4-OS list so no-override behaviour is unchanged. A verification report is included at verification-reports/verification-report-AAASM-2665.md.

Checklist

• Code follows project style guidelines
• Self-review completed
• Comments added for complex logic
• Documentation updated if needed
• All tests passing

🤖 Generated with Claude Code

[Chisanan232]

AC Verification — AAASM-2679

CI-config-only change; verified statically (no runner execution).

#	Criterion	Result
1	cancel-in-progress concurrency on ci.yaml, native-core-build.yml, benchmarks.yml, type-check.yml	✅ all four (grep-verified cancel-in-progress: true)
2	operating-systems parameterised in rw_build_and_test.yaml; default == current 4-OS	✅ new workflow_call input, default ["ubuntu-latest","ubuntu-22.04","macos-latest","macos-14"]; 3 matrix jobs use ${{ inputs.operating-systems }}
3	PRs ubuntu-only; master/scheduled/release full 4-OS	✅ ci.yaml passes ["ubuntu-latest"] on pull_request, full list otherwise, forwarded via rw_run_all_test_and_record.yaml
4	native-core-build debug maturin develop	✅ --release removed
5	native-core-build paths narrowed → rust/** + FFI bindings	✅ rust/**, agent_assembly/__init__.py, agent_assembly/types.py
6	benchmarks label-gated	✅ types: [labeled] + if: contains(...labels.*.name, 'benchmark')
7	CI Success aggregate gate	✅ ci-success job, if: always(), fails on upstream failure/cancel
8	all touched workflow YAML parses	✅ yaml.safe_load clean on all 6 files

Default-behaviour preservation: no-override callers (e.g. ci_includes_e2e_test.yaml) still run all 4 OSes — the intermediate rw_run_all_test_and_record.yaml default equals the prior hardcoded list.

Flagged (not changed): (1) pin external Chisanan232/...@master reusable workflow to a SHA/tag — needs maintainer to choose the pin; (2) commented-out e2e schedule cron in ci_includes_e2e_test.yaml — re-enable vs delete is an ops decision.

FE design-spec fidelity: N/A (CI/CD-only, no UI surface).

Full report: verification-reports/verification-report-AAASM-2665.md.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[Chisanan232]

✅ Review (Claude Code) — ready to merge

CI: 🟢 Green — 17 success, 4 skipped (path-gated). No failures.

Scope vs Story AAASM-2665:

Item	Status
Concurrency on ci.yaml / native-core-build / benchmarks / type-check	✅
operating-systems workflow_call input — ubuntu-only on PR, full 4-OS otherwise (default unchanged)	✅
Debug maturin develop + narrowed native-build paths	✅
Benchmarks label-gated	✅
CI Success aggregate gate	✅
Pin Chisanan232/...@master · re-enable/delete e2e cron	➖ intentionally left per maintainer decision

Verdict: Core scope fully covered; the per-PR 4-OS macOS churn is removed while full coverage is preserved on master/release. Approved & ready to merge.