[AnthonyRonning]

What this does

This PR replaces Maple's pull-request CI with one workflow, ci.yml, and one required check, ci-ok.

• One table, scripts/ci/lanes.py, defines every check (a "lane"): its paths, events, labels, runner, Nix shell, command and timeout.
• scripts/ci/plan.py reads the diff and picks the lanes. ci-ok passes only when every picked lane passed.
• The pre-commit hook and just lane <id> read the same table, so every lane also runs on a laptop.
• Release, signing and publishing workflows are not touched. No OpenSecret EIF input changes either: the eif-dev, eif-prod and eif-preview derivations are identical to master's (proof below).

Why. Over 10-10..10-26 (6,000 runs):

• An Agent PR waited 32 min at p50, and 63 min after PR #1297 (the dependency archive).
• The time went to compiling on free 3-core macOS and 4-vCPU Windows runners, building the same Agent 2–3 times per platform, and restoring a 3 GB archive that made most jobs slower.
• Each PR push started 13.5 workflows and showed about 48 checks, 18 of them skipped.
• On master, cancel-in-progress cancelled Agent CI on 36 of 136 commits. With the red-by-design EIF approval status, only 40% of master commits had every workflow green.

Before and after

"Before" is measured from the 10-10..10-26 run data. "After" is an estimate; this PR's own run is the first measurement.

	Before (measured)	After (estimate)
PR to green, all PRs, p50 / p90	30 / 52 min	about 7 / 12
Agent-only PR	32 / 52; 63 / 83 after #1297	about 6–7 / 10–12 (agent-test on 32 vCPU: a cold clippy + test build took 6m22s, against 11m25s on 8 vCPU)
OpenSecret PR	32 / 39	9–10 / 12 with EIF inputs, 6–7 otherwise
SDK PR	38 / 56	TS only 2–3; Rust SDK about 7 / 11
Research-only PR	2.3 / 16	3–4 / 6 (native paths 7–12)
Agent update service PR (services/agent-updates/)	every OpenSecret lane, both EIF builds included	agent-updates only
Workflows started per PR push	13.5	2 (ci.yml + the EIF approval workflow), +1 for a Pages/Auth preview
Check rows per PR push	about 48 (18 skipped)	about 20–25
Master commits with a full verdict	40% all green; Agent CI cancelled on 36 of 136	every master run is grouped per SHA and never cancelled
Master EIF/PCR approval status	red on every revision whose PCRs are not approved yet	a notice with the built PCRs; red only where an approval is actually being edited
New RustSec advisory	turned every Agent PR red (9 Agent CI audit failures; RUSTSEC-2026-0404..0410 on 10-26)	deps-* audits block only PRs that change that manifest, lockfile or deny.toml; otherwise the nightly opens one ci-nightly issue
Dev TestFlight	every master push (88 of 136 rebuilt an identical app)	only when Research web or iOS inputs change; dispatch always builds
CodeQL for a Research release	a manual 40-min dispatch at release time	runs on every master push, never cancelled, not part of ci-ok
GitHub Actions cache	12.07 GB (over the 10 GB cap), 4.5 GB of it from PRs	PRs save no caches (one exception, unchanged from master: the fork-PR EIF approval check's branch-scoped Nix cache); heavy Rust caches live on Blacksmith (6.39 GB in GitHub's store today)
Agent macOS/Windows minutes on free runners	about 4,000 per day on the PR path	0 on the PR path
Blacksmith spend	baseline	about −30 to −45% (estimate)

Tiers

Tier	Trigger	What runs	Blocks
Pre-commit	git commit	the components the staged files select, from the same table (the Agent runs just ci-lint + just ci-test)	locally
PR gate	every PR, any base (each layer of a stack gets its own verdict)	ci.yml: plan → selected lanes → ci-ok. Linux fmt/lint/tests per component, Agent macOS clippy, OpenSecret checks	ci-ok
PR, by path or label	packaging, native or Windows paths; labels ci:full, ci:package, ci:windows, ci:ios, ci:android, ci:research-dev-macos, ci:eif	Agent packaging rehearsal (Linux and macOS: thin LTO, own nightly-refreshed cache, master keeps fat LTO; Windows: the unsigned Dev installer, installed and smoke-tested), PR #1316's native Windows updater tests and app typecheck (agent-windows-updater, same paths on PRs and master), Research iOS/Android/desktop, Agent Windows, EIF candidate	yes, when selected
Master push	push	the selected lanes again, plus the full Agent suites on Linux, macOS and Windows; caches saved. The signed and evidence workflows (same names and jobs), CodeQL, the trusted EIF build	never cancelled
Nightly	schedule	ci.yml nightly lanes, advisories included; nightly.yml: Bun audit and the SQLCipher provider suite on 3 OSes; one ci-nightly issue	no
On demand	dispatch or label	ci.yml with lanes=<ids> or all	—
Release	release / dispatch	unchanged	owner clicks

Runners: Blacksmith runs everything someone waits on (8 vCPU Linux; 32 vCPU for agent-test; macOS 26 with Xcode 26.5; Windows 2025; ARM Linux for every trusted EIF build). Free GitHub runners take light lanes, attestation, Windows signing and the publishers. The repository variables CI_LINUX_RUNNER, CI_LINUX_HEAVY_RUNNER, CI_MACOS_RUNNER and CI_WINDOWS_RUNNER move a lane to another runner without a PR.

docs/ci.md is the how-to (lanes, labels, local runs, adding a lane). docs/repository-workflows.md is the reference (caches, concurrency, contracts, signed builds).

What is deleted

• 22 workflows, whose checks are lanes now: agent-ci, agent-sqlcipher-supply-chain, agent-store-performance, agent-updates-tests, agent-windows-updater-tests, android-pr-build, desktop-pr-build, mobile-pr-build, opensecret-change-detection, opensecret-ci, sdk-integration, pages-tests, release-gates-tests, repository-checks, proxy-container, proxy-supply-chain, supply-chain, sdk-publish-tests, sdk-rust, sdk-supply-chain, sdk-typescript, updates-tests.
• agent-windows-updater-tests.yml (added by Add signed Windows Agent updates and versioned installation #1316) is now the agent-windows-updater lane: the same 20 path filters minus its own file, the same two scripts unchanged (both always run; either failure fails the lane), the same Rust 1.98.0, MSVC, Perl and linker pins through .github/actions/setup-agent-windows, no cache, secret or environment, and its receipts kept as an artifact even on failure. Differences: it runs on blacksmith-8vcpu-windows-2025 instead of GitHub's windows-2025, master runs are no longer cancelled, and the typecheck no longer selects fxc (cargo check on the dev profile never compiles shaders). Add signed Windows Agent updates and versioned installation #1316's manual agent-windows-signature-probe.yml stays; its actions: read moved from the workflow to its one job.
• The Agent dependency archive and its scripts (agent_cache*.py, agent_measure.py). It was slower than no cache everywhere it was measured.
• Three selectors (agent_change_detection.py, agent_master_selection.py, hook_change_detection.py), replaced by the planner; their cases moved to test_plan.py.
• About 2,400 lines of YAML-shape tests that pinned step counts, runner labels and job lists. test_contracts.py now asserts the contracts, and test_workflow_policy.py the rules (pinned actions, read-only permissions, timeouts, no PR cache writes).
• Smaller: agent-desktop-build.yml's PR trigger (the rehearsal is now the agent-package-* lanes); six dead PR routes in change_detection.py; the root flake's 14 unused ci-* apps (its checks go from 13 to 7); docs/agent-ci-performance.md; the Linux fat-LTO job (a duplicate of the Linux bundle); the Agent store benchmark from CI entirely (the crate stays for local runs).
• The x86_64 OpenSecret package build (nix build '.?submodules=1#default'), owner-approved (below).

Size: workflows 52 files / 9,134 lines → 32 / 6,815 (non-release lines 6,155 → 3,836). scripts/ci 119 / 29,689 → 108 / 25,852. The PR: 129 files, +5,750 / −12,138.

What is untouched

• Release and publishers, byte-identical: release.yml, pages-publish, proxy-publish, updates-publish, zapstore-publish, sdk-publish-npm, sdk-publish-rust, agent-updates-publish, auth-pages-publish, opensecret-eif-release. Exactly one workflow is named Release, and every listener still finds its producer.
• What the Agent update publisher reads: agent-desktop-build.yml keeps its path (so run_number is still the build number), every job name publisher.py needs (macOS, Linux and, since Add signed Windows Agent updates and versioned installation #1316, Windows: build, sign and verify), its artifact names, MAPLE_PACKAGE_BUILD_NUMBER: ${{ github.run_number }} on the Windows packaging and verification jobs, its master-only signing and GitHub-hosted attestation. test_contracts C2 runs master's own publisher.trust_run(…, linux=True, windows=True) against this workflow, with each job's if: and needs evaluated for a master push and a dispatch. Its builders now use exact-key caches on Blacksmith; the unsigned Windows build moved to Blacksmith, signing stays on GitHub windows-2025.
• What release preflight reads: every job in ci_evidence.py keeps its file and id, runs on master push with the same push filters, and is never cancelled. ios-dev-testflight.yml keeps its name.
• Signed lanes: the cache keys release.yml restores, the 13 environment names, and every release and publisher script (_common.sh, *-release.sh, web.sh, updates.sh, build-sdk-publish.sh, publisher.py, ci_evidence.py, test-release-gates.sh and the rest) are unchanged.
• Toolchains: no flake.lock changed, no component flake changed, and the root dev shells are the same derivations.

OpenSecret changes the owner approved, and their proofs

The rule for this PR was "OpenSecret verbatim". The owner approved five exceptions:

1. Agent update service PRs stop running OpenSecret. The OpenSecret selector did not know services/agent-updates/ (added later, in PR #1214), so it treated it as a new root and ran every OpenSecret lane, both EIF builds included. The prefix is now listed. A genuinely unknown directory (for example services/new-service/) still runs everything; a test covers both.

2. The x86_64 #default package build is gone. Nothing consumed it, the shipped EIF is aarch64, and the other OpenSecret lanes compile and test the same code. os-flake-check keeps the component nix flake check.

3. A master EIF/PCR mismatch is a notice, not red. check_opensecret_eif.sh now exits 3 for a PCR mismatch (and prints the built pcr.json); build and output failures still exit 1. In opensecret-eif.yml:

   • master push or dispatch: a mismatch is "approval pending", a notice with the built PCRs in the step summary, and the job passes;
   • pull request: a mode must match only if the PR edits that mode's approval files (pcrDev.json + pcrDevHistory.json, or pcrProd.json + pcrProdHistory.json), from the PR's merge base. The base and head SHAs come through env: and must be full commit ids; otherwise the job fails;
   • any other failure (exit not 0 or 3) still fails;
   • a manual run outside master still fails on a mismatch, as before.

   Only the last step of the eif and eif-trusted jobs changed, identically in both. Their if: conditions, runners, permissions, cache steps and matrix are identical to master. opensecret-eif-release.yml is byte-identical and never calls the check script.

4. OpenSecret docs name the new lanes. services/opensecret/README.md and docs/nitro-deploy.md stop naming the deleted workflows, and the hook comment in services/opensecret/.githooks/pre-commit names the new lanes. The docs check now covers services/opensecret with no exception.

5. Dependency audits (deps-*) no longer run on CI-only edits. They run when their manifest, lockfile or deny.toml changes, with ci:full, and nightly. A new advisory in someone else's crate should not turn a CI fix red.

Proof that the PCRs cannot change. nix eval of each EIF's derivation path (services/opensecret, submodules=1, aarch64-linux) gives the same result on master and on this branch:

Output	master 109188c4 and this branch
eif-dev	bwycsxmw56bs5qksr62pz8zr3s28zwd3
eif-prod	hdzf3hidwamjqbg8214p31c08ha8xckw
eif-preview	060l38vsx63bjr87l6nxbsn4sv3r4srr

The same evaluation does see source changes: PR #1184 (OpenSecret src/ edits) moved eif-dev from x0pfcwdr… to bwycsxmw…. The EIF build, verify and publish scripts and the EIF fixtures are unchanged.

Validation done locally (at the final head)

• Root nix flake check: all 7 checks pass (501 CI-script tests, 133 publisher tests, 158 Pages, 27 PCR-compatibility, the release gates, actionlint).
• Tests: every scripts/ci test (501), the publisher tests (133, including Add signed Windows Agent updates and versioned installation #1316's Windows publisher tests), test_ci_evidence.py (21) and test-release-gates.sh (31/31) pass; the edited test modules also pass on Python 3.9.
• Every commit passes plan.py lint and the scripts/ci suite, so bisect never lands on a red one. The exception is the first commit, which still carries master's own test_agent_workflows.py: its provenance test is locale-dependent (it fails under Nix bash with an empty LC_ALL on master too, and passes with LC_ALL=C); the next commit deletes it.
• The EIF approval step runs for real in test_contracts against a fixture git history: 16 event, ref, SHA and mode cases × exit statuses 0, 1, 2, 3 and 42, including option-like and abbreviated SHAs.
• plan.py lint: all 2,220 tracked files are owned or inert, and each ci.yml job's runner and timeout match its lane.
• actionlint over all 32 workflows: clean.
• Byte identity: the ten release and publisher workflows (including Add signed Windows Agent updates and versioned installation #1316's agent-updates-publish.yml), auth-pages-dev-publish.yml and all of services/agent-updates (including publisher.py) are identical to master, both at the base 109188c4 and at the current tip 1df4cf70.
• The real pre-commit hook was run with scratch commits on an earlier commit of this branch (the hook and planner are unchanged since): docs-only runs nothing, a workflow edit runs actionlint and the CI tests, a broken workflow key is refused, an Agent edit runs the Agent lint and 2,277 tests.

Which lanes a PR gets (plan.py explain):

PR type	Lanes
Agent only	agent-lint, agent-test, agent-macos (+ packaging, supply-chain, Windows or the Windows updater tests when those paths change)
TS SDK only	sdk-ts, os-sdk-e2e
Rust SDK	Agent gate lanes, sdk-rust, proxy, research-rust, os-sdk-e2e
Proxy	Agent gate lanes, proxy, research-rust
Research web / Rust / iOS-native	research-web / research-rust / research-ios
OpenSecret backend	os-rust, os-sdk-e2e, os-flake-check, os-eif
OpenSecret PCR approvals	os-pcr
OpenSecret docs	none
Agent update service only	agent-updates
CI only (ci.yml, plan.py, lanes.py)	every gate lane; no deps-* lane, no EIF build
A signed or CodeQL workflow	repo
Docs only	none (plan + ci-ok)
A path no lane owns, or a new service	every lane

What only this PR's own run can prove

This PR edits ci.yml and the planner, so its run selects every gate lane (including agent-windows-updater), Agent packaging on Linux, macOS and Windows, Research Android and the EIF candidate (no deps-* lane). Everything runs cold, because no master cache exists yet. The run should show:

• GitHub accepts ci.yml, the plan matrix and the ci-ok verdict over real job results.
• Blacksmith provisions the 32 vCPU runner on first use; Windows 2025 has the Agent's toolchain; macOS 26 selects Xcode 26.5 for the Agent clippy and the packaging smoke.
• Windows on Blacksmith, first runs. agent-package-windows builds the release-profile Windows binary (fxc, cargo-about, +crt-static), packages it with the run number as the build number, and passes verify --unsigned --smoke; master's Prod Windows build, which publisher.py now consumes, runs the same build on the same runner class. agent-windows-updater runs Add signed Windows Agent updates and versioned installation #1316's native tests, which so far passed only on GitHub's windows-2025: the reparse fixtures need the symlink privilege, one test expects an elevated Administrators owner, and the script checks the catalog signature of powershell.exe. Blacksmith's Windows jobs run as runneradmin on a windows25-full image, like GitHub's. If either lane fails on the runner rather than the code, set runner=Runner("windows-2025") on the lane and runs-on: windows-2025 on its job (and on agent-full-windows).
• agent-windows (Clippy with -D warnings) lints Add signed Windows Agent updates and versioned installation #1316's roughly 4,000 lines of cfg(windows) code for the first time; the typecheck only ran cargo check.
• os-sdk-e2e passes with its PostgreSQL service, os-helpers passes on ARM, and os-eif builds dev and prod. The candidate PCRs should equal the latest master EIF build, because the derivations are unchanged.
• In the EIF approval workflow, changes reports eif=true and pcr_approvals=false, and both approval jobs skip.
• The Pages preview, Auth Pages CI and proxy rehearsal run, because their files changed.

Adding ci:full and re-running also exercises the full Agent suites on macOS and Windows, the Research desktop, iOS and Dev-app lanes, and the deps lanes. Expect deps-research to fail there until the Research advisories are fixed (follow-up 4).

Only master can prove cache saves, never-cancelled master runs, the signed builds with their new caches, the Dev TestFlight gate skipping a non-Research push, CodeQL on push, the EIF approval notice and the nightly issue.

Before merging

1. Re-confirm two owner decisions that Add signed Windows Agent updates and versioned installation #1316 reopened. Both were approved while Windows was not on the Agent feed. Add signed Windows Agent updates and versioned installation #1316 put it there: publisher.py now requires Build Windows binary (prod), Signed Windows (prod) and Verify downloaded Windows (prod) and the Prod Windows artifact (publication itself stays behind include_windows and AGENT_WINDOWS_UPDATES_ENABLED).
   • Agent windows-build on Blacksmith (signing stays on GitHub windows-2025). This matches macOS and Linux, whose Prod builds already compile on Blacksmith, and the publisher README's "compiled on the workflow's Blacksmith runners". It needs one change to a Add signed Windows Agent updates and versioned installation #1316 file: the manual signature probe (windows_signature_reference.py) required windows-2025 for all three Windows Prod jobs, and now also accepts blacksmith-8vcpu-windows-2025 for the build job only. Signing and download verification must still report windows-2025; test_contracts runs the probe against this workflow. To keep the probe strict instead, the build must go back to windows-2025 (the master Windows chain then stays at 53–90 min).
   • Windows packaging on PRs. It was label-only. On master every Agent PR built, installed and smoke-tested an unsigned Windows package; here agent-package-windows now runs when its own inputs change (apps/maple-agent/scripts/windows-*, build-release.sh, release-info.py, release-profiles.json, release_profile.rs, .github/actions/setup-agent-windows/, scripts/ci/agent_windows.py; 15 of 174 Agent commits on master over the last three months, about 9%) or with ci:package/ci:full. To go back to label-only, set its paths to () in lanes.py.
2. Rebase once more. The branch is on 109188c4 (PR #1316). Master has since gained three Agent-only commits (PR #1320, staged Windows build validation in build-release.sh; PR #1309, local API controls; PR #1321, version bump). git merge-tree with 1df4cf70 is clean.

After merge, master's trusted EIF build runs once, because the workflow, check script and selector changed; a revision whose PCRs are not approved yet shows a notice, not red.

Owner follow-ups after merge

1. Require ci-ok in the master ruleset (source: GitHub Actions; strict off; keep the review rules). Until then the old checks are gone and ci-ok is advisory. A few working days without a false red is a good point to switch it on.
2. Enable auto-merge in the repository settings.
3. Create the label ci:eif. The other CI labels already exist. Name a triage owner for the ci-nightly issue.
4. Fix the Research RustSec advisories. deps-research fails on advisories published after its last green run: reported as zstd-sys and zvariant (RUSTSEC-2026-0370, RUSTSEC-2026-0372); a local run on 10-27 found 14 advisories in zstd 0.13.3, zstd-safe 7.2.4 and zstd-sys 2.0.16 (RUSTSEC-2026-0391, 0395–0406, 0410). This PR does not change Research dependencies; it needs a Research dependency PR.
5. Rebase PR #1266 (Xcode 27.1 for the Apple lanes) onto this, and adopt the Metal Toolchain import from PR #1308 (the macOS 27 Blacksmith experiment). ci: build Apple lanes with Xcode 27.1 #1266 moved Agent macOS builds to GitHub's xcode-27 image (about 40 min) because Blacksmith's macOS 27 image lacks the Metal Toolchain. experiment: Agent macOS 27 builds on Blacksmith (do not merge) #1308 exports it on GitHub (36 s) and imports it on blacksmith-6vcpu-macos-27, where a cold Agent build passed in 15m50s. After the rebase, ci: build Apple lanes with Xcode 27.1 #1266's change becomes the macOS runner constant in lanes.py, its label in .github/actionlint.yaml, the Xcode pin, and the import step; most of its shape-test edits disappear.

Smaller decisions, no rush:

• agent-supply-chain (cargo-deny) and sdk-ts (bun audit) still audit advisories whenever they are selected, CI edits included. Decide whether they should follow the deps rule.
• change_detection.py has no services/agent-updates/ prefix, so an Agent update push to master still starts the signed Research builds. That was outside the approved OpenSecret scope.
• A manual EIF dispatch outside master still fails on a mismatch, as before.
• opensecret-eif.yml's eif job (fork PRs that edit approvals, manual runs outside master) is the one pull-request job that saves a cache: magic-nix-cache writes its Nix store to the branch-scoped GitHub cache, which master and other PRs cannot read. It is unchanged from master; the policy test now counts it as a writer and pins the exemption, and the cache docs name it. Disabling it (use-gha-cache: disabled) would make fork EIF checks build cold.
• agent-test defaults to 32 vCPU; a 16 vCPU runner can be tried through CI_LINUX_HEAVY_RUNNER without a PR.
• After the first master runs, optionally dispatch nightly.yml once and run opensecret-eif-release with dry_run.

🤖 Generated with Claude Code

[github-actions]

Maple Auth development preview: https://5b731d43.maple-auth-dev.pages.dev

Commit: 3e744868c88cfacd275d3d5aa32c0348e4dd5759

Uses development services. Cloudflare Access applies. Provider OAuth is not configured for PR URLs; use the stable Auth Dev host for OAuth rehearsal.

[github-actions]

Maple development preview: https://c293e7af.maple-ca8.pages.dev

Commit: 3e744868c88cfacd275d3d5aa32c0348e4dd5759

Uses development API, billing, flags and PCR configuration. Cloudflare Access applies.

[AnthonyRonning]

This PR's own runs (every gate lane, packaging, Research Android and the EIF candidate; all cold, since PRs never save caches).

Run 1 (40453021288) found four problems:

• agent-lint and agent-supply-chain hit 15-minute timeouts on a cold cache. A lane that times out never saves its cache, so the timeouts now cover a cold run, and lint moved to 32 vCPU.
• agent-windows found two Windows-only Clippy lints in existing Agent code. The old CI never ran Clippy on Windows. Both are intentional and now carry scoped allows (c8bd24cd); behaviour is unchanged.
• os-helpers failed Trivy on CVE-2026-84782 (libssl3). That was fixed on master by #1318, and this branch is rebased onto it.

Run 2 (40455950361): all green, ci-ok success. Wall time was 40.6 min and runner time 203 min, both cold. Cold job times in minutes:

Lane	Cold min
agent-package-linux (fat-LTO + Docker smoke)	40.2
research-android	29.6
agent-package-macos (incl. GUI smoke)	17.4
agent-lint (32 vCPU)	15.8
os-rust	13.9
agent-windows (Blacksmith)	10.8
os-eif dev / prod	9.4 / 1.6
agent-macos clippy	6.4
agent-test (32 vCPU)	5.0
research-rust	4.8
os-sdk-e2e (with Postgres)	4.0
every other lane	0.5–3.6

Ordinary PRs select far fewer lanes than this CI-infra PR does, and run warm once master has saved caches. Packaging and Android only run when their own paths change or on a label. Both EIF candidates were substituted from FlakeHub, so their outputs are identical to master's existing builds; the dev PCR0 equals pcrDev.json.