ci: scope every expensive job to a classifier capability vector (#1152)

[rickylabs]

Summary

Promotes .github/scripts/ci-classify-changes.ts from a two-output e2e-cli gate to a capability
vector (needs_deno / needs_docker / needs_desktop / needs_docs / needs_surface) consumed
by e2e-cli.yml, ci.yml and surface-diff.yml, with the two #1122 precision fixes: only the
tier-defining workflows (e2e-cli.yml, ci.yml) escalate the scaffold tiers, and a tasks-only
root deno.json edit is a script alias, not a toolchain change. Paths decide, the frozen three
ci:* labels override, every gated job still starts and reports SUCCESS
(scaffold-static's skipped-by-policy pattern), and an unrecognised path forces the whole vector
true. Also bumps all version-tagged actions to Node-24 majors (owner request).

Scope

• Archetype / area: tooling (CI workflows + .github/scripts; no packages//plugins/ source)
• Closes ci: scope every expensive job to a capability vector — paths decide, labels override #1152

Slices

• S1+S2 classifier capability vector + feat(release): derive canary labels from published versions #1122 precision (50 unit tests) — 07727e1-class commit feat(ci): classifier emits a capability vector
• S3 e2e-cli.yml: desktop→needs_desktop, runtime=docker tier, root-config extraction
• S4 ci.yml: classify job; check-test←needs_deno, quality←needs_deno || needs_docs
• S5 surface-diff.yml: paths: filter folded into needs_surface
• S6 live verification (demo PRs test(ci): docs-only vector demo for #1152 (do not merge) #1156/test(ci): release-workflow-only vector demo for #1152 (do not merge) #1157) + measurement on ci: scope every expensive job to a capability vector — paths decide, labels override #1152
• chore: version-tagged actions bumped to Node-24 majors (SHA-pinned actions untouched)

Validation

• deno test .github/scripts/ci-classify-changes.test.ts — 50 passed, 0 failed (every vector
  output has positive AND negative cases; safety property pinned)
• Scoped lint (run-deno-lint.ts --root .github/scripts) — 0 findings; deno fmt --check clean
• All 12 workflow files YAML-parse
• Docs-only demo PR test(ci): docs-only vector demo for #1152 (do not merge) #1156 → run 30827771974:
  scaffold-static, scaffold-runtime, desktop-native-linux all SUCCESS with only
  "Skipped by policy"
• feat(release): derive canary labels from published versions #1122 replay demo PR test(ci): release-workflow-only vector demo for #1152 (do not merge) #1157 (release-canary.yml-only diff) → run 30827782060:
  same — all three expensive jobs skipped by policy
• This PR itself is the positive case: tier-workflow edits force the full suite, and its ci.yml
  run exercises the new classify job live (base=main runs the merge-ref workflow)

Definition of Done

• ci-classify-changes.ts emits the capability vector, unit-tested per output incl. negatives
• check-test/quality consult needs_deno and report skipped-by-policy when false
• scaffold-runtime gated as the docker tier; scaffold-static is the deno-only default tier
  (owner-ratified D5: no third suite)
• No routing table in workflow YAML; jobs read classifier outputs only
• Label set unchanged (ci:full, ci:skip-scaffold, ci:skip-e2e)
• Unrecognised path still forces every gate to run (explicit SAFETY tests)
• Measured before/after recorded on ci: scope every expensive job to a capability vector — paths decide, labels override #1152 (audited baseline + live demo measurements;
  post-merge sample observation continues on the issue)

Harness

• Run dir: .llm/runs/ci-scope-expensive-jobs--1152/
• Phase: impl — owner ratified the plan directly and ordered proceed-to-green (recorded in
  drift.md); formal PLAN-EVAL superseded by owner authority.

Drift / Debt

• quality gate widened to needs_deno || needs_docs (docs PRs still need fmt/docs-accuracy);
  needs_docs excludes agent-context Markdown so the docs(release): a failed canary is fixed forward, not yanked #1055 class skips everything. See drift.md.
• Follow-up: needs_docker package-set tightening against observed green history; sqlite runtime
  tier tracked separately.

[rickylabs]

[PHASE: PLAN]

Capability-vector plan committed (.llm/runs/ci-scope-expensive-jobs--1152/plan.md); PLAN-EVAL pending before any slice lands.

Locked decisions

1. D1 One classifier, five outputs; unrecognised path ⇒ entire vector true (unit-tested); ci:full forces all; skip labels keep exactly their current scaffold-only semantics; label set frozen.
2. D2 v1 stays deliberately wide: needs_deno = !docs_only; needs_docker keeps all of packages/** (v1 docker savings come from workflow/deno.json precision, not package guessing); needs_desktop = packages/cli/** + toolchain (the whole .deb surface lives there).
3. D3 feat(release): derive canary labels from published versions #1122 precision: only e2e-cli.yml/ci.yml escalate scaffold tiers; deno.json gets structural tasks-only vs toolchain discrimination fed from git show BASE/HEAD, unparseable ⇒ toolchain.
4. D4 Every consumer copies the scaffold-static skipped-by-policy pattern verbatim — required checks keep reporting; no second pattern, no routing in YAML.
5. D5 The "deno-only default tier" is the existing scaffold-static; run_runtime := needs_docker. No third e2e suite in this PR (that would be packages/cli/e2e framework work — wrong lane).

Open questions for PLAN-EVAL / owner

• D5 reading of the "splits into a deno-only default tier" acceptance box.
• Whether non-tier workflow edits may drop needs_deno later (v1: keep true).
• .llm/tools/**/*.ts is docs-classified today but root deno test may discover its tests — S2 settles this empirically, defaulting toward running.

Next

• Dispatch PLAN-EVAL (separate open-model evaluator session per lane-policy.md); slices S1–S6 begin only on PASS.

[rickylabs]

[PHASE: IMPL]

All six slices landed and live-verified. The two measured waste classes from the audit are now proven skips:

Class	Demo	Result
docs/agent-context-only (#1055/#1063/#1123)	PR #1156, run 30827771974	scaffold-static, scaffold-runtime, desktop-native-linux all skipped-by-policy, all report SUCCESS
release-tooling (#1122)	PR #1157, run 30827782060	same three skips on a release-canary.yml-only diff

The positive case is this PR's own CI (tier-workflow edit → full run). ci.yml's docs-only negative can only manifest on a post-merge PR (its trigger is branch-filtered); expression parity with the proven e2e-cli pattern plus the classifier's unit tests cover it until the first live observation, which will be recorded on #1152.

Acceptance evidence

• ci-classify-changes.ts emits the capability vector above, unit-tested per output — 50 tests incl. per-output negatives: https://github.com/rickylabs/netscript/pull/1155/files (ci-classify-changes.test.ts)
• check-test and quality consult needs_deno and report skipped-by-policy when it is false — ci.yml classify job + RUN gates in this PR's diff; fail-closed on classify failure; live docs-only observation to follow post-merge on ci: scope every expensive job to a capability vector — paths decide, labels override #1152
• scaffold-runtime splits into a deno-only default tier and a docker tier gated on — owner-ratified D5: the existing scaffold-static IS the deno-only default tier and scaffold-runtime is the docker tier (run_runtime reads the docker signal); demo runs 30827771974 and 30827782060 show the tier skipping by policy
• No second routing table exists in workflow YAML — jobs read classifier outputs only — every gated job reads a two-term classifier expression; all path logic lives solely in the unit-tested script (see the PR diff)
• The label set is unchanged: ci:full, ci:skip-scaffold, ci:skip-e2e, and no others — no label additions in this PR; frozen-semantics negative test "skip labels never widen to the vector"
• Conservative default preserved: an unrecognised path still forces the gate to run — SAFETY tests: unrecognised paths and .github/scripts force the ENTIRE vector true; empty diff and non-PR events run everything
• Measured before/after on a comparable PR sample, recorded on this issue — measurement comment on ci: scope every expensive job to a capability vector — paths decide, labels override #1152 (audited 390-min baseline, live demo class measurements, projection and ongoing-sample commitment)

Next

• PR CI green → acceptance mirror → status:ready-merge → merge (owner-authorized).