[AnthonyRonning]

Recent completed master Agent builds took roughly 32–50 minutes and rebuilt all workspace units because native cache reservations were rejected as read-only while the jobs still concluded success. Increasing configured capacity did not establish persistence. The same audit found about 24 minutes of SDK integration setup spent realizing unrelated interactive developer tooling, and a master cancellation/selection gap that could replace unfinished Agent validation with selector-only green checks.

This change:

• Restores Agent dependency reuse through the working Actions artifact service, with native archives retained as read-only bootstrap. Only successful canonical master platform jobs produce seeds; readers verify repository/run/attempt/job provenance, digests, actual compiler/native compatibility and bounded extraction. Workspace/path outputs and credentials are excluded. PRs only restore. Three-day retention and refresh after 24 hours or dependency changes bound storage; failed required publication fails the builder.
• Wraps the unchanged legacy fingerprint with conservative target scoping, preventing a provably inactive macOS-only optional dependency from invalidating Windows. Unknown or ambiguous target/features remain conservative; provider caches retain their exact verified graph.
• Selects master Agent CI cumulatively from the last ancestor with all seven real workspace/provider/release jobs passed, preserving cancellation while retaining unfinished changes. Desktop retains its separate downloaded-consumer baseline.
• Adds a minimal backend #ci shell using the same Rust/native/PostgreSQL inputs, without local container/credential tooling. Backend and SDK integration keep their migrations, OAuth and both language integration suites.
• Fixes the confirmed pending-history reader race behind the concurrent project/task failures. Shared observations of None no longer reject admission; retained history and exclusive transitions remain closed.

The audit and acceptance contract are recorded in docs/agent-ci-performance.md. Signing, publication, PCR approval, runner/billing settings and external branch rules are outside this change. Refs #1224.

Validation:

• Full current nix flake check --no-update-lock-file --max-jobs 2 passed on aarch64-darwin; the checked archive-helper hash matches this commit.
• Normal hooks passed: 625 repository tests and workflow lint; Agent formatting, workspace Clippy and workspace tests (696 core and 957 app tests passed, plus the other workspace crates); backend formatting, all-feature/all-target Clippy and 893 tests passed.
• Real offline Cargo roundtrip: BLAKE3 native output and serde proc macro restored into empty fixture cache roots; all 19 public compiler artifacts remained fresh, no build script reran, and changed local targets rebuilt.
• Existing live Actions artifact download and its API ZIP SHA256 verified. Actual source-corpus preflight accepted all reviewed dependencies and excluded all 10 path packages; nine Git repositories were separately verified public.
• The new Linux shell graph has 2,213 derivations versus 3,830; eight retained Rust/native/database derivations match exactly. Local backend compilation in #ci passed.
• Additional macOS disposable-DB check is a known local blocker: 23 AEAD DB tests passed and both OAuth DB tests reported OK, then the process SIGSEGVed. The unchanged default shell reproduces the same crash with the identical binary/native dependencies. Cleanup verified no remaining temporary clusters; no test was suppressed. Hosted Linux OAuth and both SDK integration suites subsequently passed; this does not fix the separate local macOS native crash.

An initial unchanged packaging fixture timed out; its isolated retry and the full current Nix check passed without increasing its timeout.

Hosted cache recovery requires the first successful master seed and a subsequent actual consumer. PRs cannot publish the initial seed, so this PR may still build cold. Local fixtures, configured capacity and earlier warm runs do not establish deployed recovery or a promised speedup.

First hosted performance/validation result on exact head 1e32bd94624bad5cc0a3b05cb9ed24e7b2e03a82:

• SDK integration passed in 8m07s, versus 34m34s in the audited chore: prepare next Research, SDK, and proxy patches #1291 run. These are different revisions/conditions, not a controlled benchmark. The same setup/migration/backend-build step was 3m06s versus 27m48s; the CI shell was ready in about 54s, versus about 24m19s previously.
• Actual coverage: 33 database/OAuth cases, zero skipped; TypeScript 83 passed with 18 existing conditional skips; Rust 123 library + 54 integration tests, plus the explicit native-handoff roundtrip, passed. Existing conditional integration ignores remain.
• Backend Rust gate passed in 5m37s on a fresh dependency-target miss, including 893 tests passed. Nix package and other platform jobs remain tracked separately.

Final hosted validation on the unchanged head above: 49 successful checks, 7 intentional skips, no pending or failed checks. All seven Agent lanes, Dev desktop producers and actual downloaded Dev consumers passed; Research desktop/mobile and the complete backend/Nix/SDK workflows also passed. The backend Nix/application package job passed in 12m37s, including nine actual host checks.

Mac/Windows workspace jobs passed in 45m13s / 45m07s, both genuinely cold: all 1,293 / 908 build units compiled. All nine Agent builders exercised the new scope/reader plus read-only native fallback, and all nine correctly skipped dependency-seed publishing on the PR. This validates the PR and its guard behavior; master seed publication and a subsequent actual warm consumer remain unproven. The first master run may still build cold before publishing its seed.

[github-actions]

Maple development preview: https://00523f4d.maple-ca8.pages.dev

Commit: 1e32bd94624bad5cc0a3b05cb9ed24e7b2e03a82

Uses development API, billing, flags and PCR configuration. Cloudflare Access applies.

[github-actions]

Maple Auth development preview: https://994a20c3.maple-auth-dev.pages.dev

Commit: 1e32bd94624bad5cc0a3b05cb9ed24e7b2e03a82

Uses development services. Cloudflare Access applies. Provider OAuth is not configured for PR URLs; use the stable Auth Dev host for OAuth rehearsal.