ci(e2e-cli): desktop-native-linux ignores the classifier it depends on — builds a .deb on every docs PR

[rickylabs]

Summary

desktop-native-linux in .github/workflows/e2e-cli.yml declares needs: classify but its job
condition never reads the classifier's verdict. It inherits the dependency and ignores the
decision, so it builds a .deb and a signed updater on every pull request — including
documentation-only and run-record-only PRs where scaffold-static and scaffold-runtime correctly
skipped.

Observed

Job conditions as they stand:

Job	needs	Reads env.RUN?
scaffold-static	classify	yes
scaffold-runtime	classify	yes
desktop-native-linux	classify	no — only !cancelled() && needs.classify.result != 'skipped'

Measured across the last 20 closed PRs, three cases prove it directly — the classifier said skip,
static and runtime obeyed, desktop ran anyway:

PR	Scope	scaffold-static	scaffold-runtime	desktop-native-linux
#1055	one file, .agents/ only	0m (skipped)	0m (skipped)	1m — ran
#1063	3 files, harness only	0m (skipped)	0m (skipped)	1m — ran
#1123	RFC, run-record	0m (skipped)	0m (skipped)	1m — ran

Across all 20 PRs desktop-native-linux accounts for ~41 minutes and ran on 20/20, most of
which touched nothing related to desktop packaging.

Why it matters beyond the minutes

The classifier is explicitly designed to be the single decision point for this workflow's expensive
jobs, and it is pure and unit-tested (ci-classify-changes.test.ts). A job that depends on it but
does not read it is a gate wired to a switch that isn't connected — it reads as governed while
being ungoverned. That is the same defect class as the two inert guards this milestone already
shipped and fixed, and it will silently defeat any future tightening of the classifier.

Fix

Read the classifier verdict in the job condition, exactly as its two siblings do. If desktop
packaging warrants a signal distinct from the scaffold tiers, that signal belongs in the
classifier as its own output, not as an unconditional job.

Acceptance

• desktop-native-linux does not run when the classifier says the PR needs no scaffold work
• Verified on a docs-only PR: the job reports skipped-by-policy rather than building
• If a distinct desktop signal is wanted, it is emitted by ci-classify-changes.ts and covered
  by a unit test — not encoded in workflow YAML
• The skipped-by-policy reporting pattern matches scaffold-static's existing one, so the job
  can stay a required check

Provenance

Found 2026-08-03 while auditing CI spend across the last 20 closed PRs, after the owner observed
that the Actions queue is growing and that most PRs run CI unrelated to their scope.
Broader redesign tracked separately.

[rickylabs]

Acceptance evidence mirrored from #1153.

• desktop-native-linux does not run when the classifier says the PR needs no scaffold work — run 30825776156: classify said skip, desktop executed only the "Skipped by policy" step and reported success (https://github.com/rickylabs/netscript/actions/runs/30825776156)
• Verified on a docs-only PR: the job reports skipped-by-policy rather than building — demo PR test(ci): docs-only skip demo for #1151 (do not merge) #1154, run 30825776156: desktop step list is "Set up job; Skipped by policy; Complete job"
• If a distinct desktop signal is wanted, it is emitted by ci-classify-changes.ts and covered — no distinct signal introduced in this PR: the job reads the existing unit-tested outputs (run_static/run_runtime) as a conservative proxy; the dedicated needs_desktop output lands in the classifier with unit tests in ci: scope every expensive job to a capability vector — paths decide, labels override #1152 (PR ci: scope every expensive job to a classifier capability vector (#1152) #1155)
• The skipped-by-policy reporting pattern matches scaffold-static's existing one, so the job — identical env.RUN + SKIP_REASON + printf-notice pattern, fail-closed on classify failure: https://github.com/rickylabs/netscript/pull/1153/files