ci: consolidate validation and reduce pull request runner demand

.github/ci-paths.toml

@@ -1,9 +1,10 @@
-# Shared runtime, dependency, and CI changes can affect every consumer.
+# Shared runtime and dependency changes can affect every consumer.
 # Patterns use Python fnmatch semantics: * also matches path separators.
 full = [
-  "src/**", "openapi/**", "pyproject.toml", "uv.lock", "Makefile", "tox.ini",
-  ".mise.toml", ".pre-commit-config.yaml", ".github/actions/**", ".github/workflows/**",
-  ".github/ci-paths.toml", "scripts/ci_changes.py", "tests/test_ci_changes.py",
+  "Makefile", "tox.ini",
+  ".mise.toml", ".pre-commit-config.yaml", ".github/actions/setup-python-env/**",
+  ".github/workflows/ci-changes.yml", ".github/workflows/master.yml",
+  ".github/ci-paths.toml", "scripts/ci_changes.py", "tests/test_ci_changes.py", "tests/test_ci_pipeline.py",
   "tests/conftest.py", "tests/**/conftest.py", "tests/fixtures/**", "integrations/capabilities.toml",
   "integrations/langchain/pyproject.toml", "integrations/langgraph/pyproject.toml",
   "integrations/opendal/pyproject.toml",
@@ -13,6 +14,8 @@ full = [
 ignore = [
   "AGENTS.md", "REVIEW.md", "CONTRIBUTING.md", "GOVERNANCE.md", "LICENSE", "LICENSES/**",
   ".github/ISSUE_TEMPLATE/**", ".github/pull_request_template.md", ".github/CODEOWNERS",
+  ".github/dependabot.yml", ".github/workflows/license-check.yml", ".licenserc.yaml",
+  "scripts/ci_queue_report.py",
 ]
 
 [suites]
@@ -33,7 +36,9 @@ database = [
   "tests/e2e/*native_code*", "tests/e2e/test_recall_sufficiency_gate.py",
   "tests/e2e/test_context_text_assembly.py", "tests/e2e/test_scope_search_migration.py",
   "scripts/run_atomic_memory_clean_migration.py",
-  "scripts/check_atomic_memory_migration_shards.py",
+  ".github/workflows/e2e-harness.yml", ".github/actions/setup-upgrade-oceanbase/**",
+  "tests/native/test_oceanbase_engine_recovery.py",
+  "tests/*migration*.py", "scripts/check_atomic_memory_migration_shards.py",
 ]
 dify = ["integrations/dify/**", "tests/*dify*"]
 hermes = ["integrations/hermes/**", "tests/*hermes*"]
@@ -58,6 +63,7 @@ docs_tests = ["docs/**", "README*.md"]
 native = ["tests/native/**", "tests/test_service*.py", "tests/test_cursor_secret.py", "tests/test_server.py"]
 harness = [
   "e2e/**", "integrations/bub/**", "scripts/scan_e2e_evidence.sh", "tests/test_e2e_workflow_contract.py",
+  ".github/workflows/e2e-harness.yml",
   "tests/e2e/test_atomic_memory_search_authorization_snapshot.py", "tests/e2e/test_atomic_memory_read_snapshot.py",
   "tests/e2e/test_runtime_server.py",
 ]
@@ -66,12 +72,112 @@ zcode = [
   "integrations/zcode/**", "evaluation/zcode_guidance/**", "tests/*zcode*", "integrations/pi/**",
   "tests/e2e/test_cross_host_work_continuity.py", "tests/e2e/cross_host_work_continuity/**",
 ]
-kimi = ["integrations/kimi-code/**", "tests/*kimi*"]
+kimi = ["integrations/kimi-code/**", "tests/*kimi*", ".github/workflows/kimi-code-acceptance.yml"]
+upgrade = [
+  "release/**", "scripts/upgrade_*.py", "scripts/ci_legacy_upgrade_rejection.py",
+  "scripts/ci_release_smoke.py", "scripts/ci_ops_bundle_smoke.py", "scripts/capture_release_schema.py",
+  "tests/release_upgrades/**", "tests/test_upgrade*.py", "tests/test_registered_source_maintenance_cli.py",
+  "tests/test_managed_*maintenance.py", "tests/e2e/*migration*", "tests/e2e/*managed_startup*",
+  "tests/test_managed_startup*.py", "tests/builtin/persistence/**", "tests/*migration*.py",
+  ".github/workflows/upgrade-release.yml", ".github/workflows/release.yml",
+  ".github/actions/setup-upgrade-oceanbase/**",
+]
+observability = [
+  "tests/*observability*", "tests/*logging*", "tests/*tracing*", "tests/e2e/*worker*",
+  "tests/e2e/*observability*", "tests/builtin/runtime/*worker*", "tests/builtin/runtime/*model_usage*",
+]
+packaging = [
+  "tests/test_installation.py", "tests/test_upgrade_publication.py", "scripts/ci_role_smoke.py", "release/**",
+  ".github/workflows/release.yml", ".github/workflows/build-artifacts.yml",
+  ".github/workflows/build-docker.yml", "docker/**",
+]
+desktop = [
+  "desktop/**", "tests/test_desktop_fixture_qualification.py", "website/assets/**",
+  ".github/workflows/desktop.yml",
+]
+candidate_replay = [
+  "src/powercontext/builtin/persistence/**", "src/powercontext/builtin/artifacts/**", "pyproject.toml", "uv.lock",
+  "tests/builtin/persistence/**", "scripts/replay_candidate_migration.py",
+  ".github/workflows/candidate-schema-replay.yml", ".github/actions/setup-upgrade-oceanbase/**",
+]
+release_schema = [
+  "scripts/capture_release_schema.py", "scripts/upgrade_database_probe.py", "scripts/upgrade_process.py",
+  "tests/release_upgrades/test_full_server.py", ".github/workflows/capture-release-schema.yml",
+  ".github/actions/setup-upgrade-oceanbase/**",
+]
+seekdb_lock = ["scripts/probe_seekdb_migration_lock.py", ".github/workflows/seekdb-lock-probe.yml", ".github/workflows/seekdb-lock-observation.yml"]
+skill_guidance = [
+  "evaluation/skills/skill-up/**",
+  "integrations/claude-code/plugins/powercontext/skills/powercontext-project-context/**",
+  ".github/workflows/skill-guidance.yml",
+]
 
 # Packaged guidance and its generators are inputs to the native host tests.
-[shared]
+[shared.guidance]
 patterns = [
   "scripts/integration_guidance*", "scripts/evaluate_integration_guidance.py", "scripts/guidance_templates/**",
   "tests/test_integration_guidance*", "tests/test_guidance*", "tests/test_setup_rollback.py",
 ]
 suites = ["tests", "dify", "hermes", "dsh", "pi", "opencode", "openclaw", "zcode", "kimi"]
+
+# Shared Python changes still exercise all runtime consumers. Diagnostic source
+# capture and lock probes have their own inputs rather than joining every build.
+[shared.runtime]
+patterns = ["src/**", "openapi/**", "pyproject.toml", "uv.lock"]
+suites = [
+  "tests", "evaluation", "database", "dify", "hermes", "dsh", "cindy", "pi", "opencode", "openclaw", "opendal",
+  "website", "native", "harness", "zcode", "kimi", "upgrade", "observability", "packaging", "desktop",
+]
+
+[shared.openapi_guidance]
+patterns = ["openapi/powercontext.yaml"]
+suites = ["skill_guidance"]
+
+[shared.native]
+patterns = [".github/workflows/native-service.yml"]
+suites = ["native"]
+
+[shared.zcode]
+patterns = [".github/workflows/zcode-acceptance.yml"]
+suites = ["zcode"]
+
+[shared.node_cache]
+patterns = [".github/actions/cache-pnpm/**"]
+suites = ["desktop", "website", "dsh", "pi", "opencode", "openclaw"]
+
+[shared.docs_deploy]
+patterns = [".github/workflows/deploy-docs.yml"]
+suites = ["website"]
+
+[shared.release_verify]
+patterns = [".github/workflows/release-verify.yml"]
+suites = ["upgrade", "packaging"]
+
+# A selected scope must produce successful root jobs, not silent skips.
+# Main's result gate consumes this contract; reusable workflows own their children.
+[checks]
+tests = ["tests", "windows-unit-portability"]
+evaluation = ["evaluation-tests"]
+database = ["oceanbase-engine-recovery", "code-seekdb", "atomic-memory-clean-seekdb", "harness-validation"]
+dify = ["dify-tools"]
+hermes = ["hermes-skills"]
+dsh = ["dsh-package"]
+cindy = ["cindy-package"]
+pi = ["pi-package"]
+opencode = ["opencode-package"]
+openclaw = ["openclaw-package"]
+opendal = ["opendal-package"]
+website = ["check-website", "website-link-validation-windows"]
+docs_tests = ["docs-tests"]
+native = ["native-service"]
+harness = ["harness-validation"]
+zcode = ["zcode-acceptance"]
+kimi = ["kimi-acceptance"]
+upgrade = ["seekdb-managed-startup", "upgrade-acceptance"]
+observability = ["worker-observability"]
+packaging = ["isolated-installations"]
+desktop = ["desktop-validation"]
+candidate_replay = ["candidate-replay"]
+release_schema = ["release-schema"]
+seekdb_lock = ["seekdb-lock"]
+skill_guidance = ["skill-guidance"]

.github/workflows/candidate-schema-replay.yml

@@ -1,33 +1,37 @@
 name: Candidate schema replay
 
 on:
-  pull_request:
-    paths:
-      - src/powercontext/builtin/persistence/**
-      - src/powercontext/builtin/artifacts/**
-      - tests/builtin/persistence/**
-      - scripts/replay_candidate_migration.py
-      - .github/workflows/candidate-schema-replay.yml
-      - .github/actions/setup-upgrade-oceanbase/**
-      - pyproject.toml
-      - uv.lock
-  push:
-    branches: [master]
+  workflow_call:
+    inputs:
+      suites:
+        description: Scope already selected by the Main orchestrator
+        required: true
+        type: string
   workflow_dispatch:
 
 permissions:
+  actions: read
   contents: read
 
 concurrency:
-  group: candidate-replay-${{ github.event.pull_request.number || github.ref }}
+  group: candidate-replay-${{ github.event.pull_request.number || github.ref }}-${{ github.event_name }}
   cancel-in-progress: true
 
 jobs:
+  changes:
+    if: ${{ inputs.suites == '' }}
+    uses: ./.github/workflows/ci-changes.yml
+    with:
+      baseline-workflow: candidate-schema-replay.yml
+
   replay:
+    needs: changes
+    if: ${{ !cancelled() && ((inputs.suites == '' && needs.changes.result != 'success') || fromJSON(inputs.suites || needs.changes.outputs.suites || '{}').candidate_replay) }}
     name: Candidate replay (${{ matrix.backend }})
     runs-on: ubuntu-24.04
     timeout-minutes: 30
     strategy:
+      max-parallel: 2
       fail-fast: false
       matrix:
         backend: [sqlite, seekdb, oceanbase]

.github/workflows/capture-release-schema.yml

@@ -1,29 +1,37 @@
 name: Capture released Server schema
 
 on:
-  pull_request:
-    paths:
-      - scripts/capture_release_schema.py
-      - scripts/upgrade_database_probe.py
-      - scripts/upgrade_process.py
-      - tests/release_upgrades/test_full_server.py
-      - .github/workflows/capture-release-schema.yml
-      - .github/actions/setup-upgrade-oceanbase/**
+  workflow_call:
+    inputs:
+      suites:
+        description: Scope already selected by the Main orchestrator
+        required: true
+        type: string
   workflow_dispatch:
 
 permissions:
+  actions: read
   contents: read
 
 concurrency:
-  group: release-schema-${{ github.event.pull_request.number || github.ref }}
+  group: release-schema-${{ github.event.pull_request.number || github.ref }}-${{ github.event_name }}
   cancel-in-progress: true
 
 jobs:
+  changes:
+    if: ${{ inputs.suites == '' }}
+    uses: ./.github/workflows/ci-changes.yml
+    with:
+      baseline-workflow: capture-release-schema.yml
+
   capture:
+    needs: changes
+    if: ${{ !cancelled() && ((inputs.suites == '' && needs.changes.result != 'success') || fromJSON(inputs.suites || needs.changes.outputs.suites || '{}').release_schema) }}
     name: Capture 1.4.0 (${{ matrix.backend }}, ${{ matrix.configuration }})
     runs-on: ubuntu-24.04
     timeout-minutes: 45
     strategy:
+      max-parallel: 2
       fail-fast: false
       matrix:
         backend: [sqlite, seekdb, oceanbase]

.github/workflows/ci-changes.yml

@@ -2,12 +2,24 @@ name: Detect CI scope
 
 on:
   workflow_call:
+    inputs:
+      baseline-workflow:
+        description: Calling workflow filename used to retain changes from cancelled pushes
+        required: true
+        type: string
     outputs:
       suites:
         description: JSON object of suites selected for this event
         value: ${{ jobs.detect.outputs.suites }}
+      required-jobs:
+        description: Selected root jobs that must succeed
+        value: ${{ jobs.detect.outputs.required-jobs }}
+      test-matrix:
+        description: Python and suite combinations for this validation profile
+        value: ${{ jobs.detect.outputs.test-matrix }}
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
@@ -16,8 +28,10 @@ jobs:
     timeout-minutes: 5
     outputs:
       suites: ${{ steps.select.outputs.suites }}
+      test-matrix: ${{ steps.select.outputs.test-matrix }}
+      required-jobs: ${{ steps.select.outputs.required-jobs }}
     steps:
-      - name: Check out the complete PR history
+      - name: Check out the complete branch history
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           fetch-depth: 0
@@ -27,4 +41,7 @@ jobs:
         env:
           PR_BASE_SHA: ${{ github.event.pull_request.base.sha }}
           PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+          CI_BASELINE_WORKFLOW: ${{ inputs.baseline-workflow }}
+          CI_FULL_VALIDATION: ${{ contains(github.event.pull_request.labels.*.name, 'ci:full') }}
+          GH_TOKEN: ${{ github.token }}
         run: python3 scripts/ci_changes.py

.github/workflows/desktop.yml

@@ -1,11 +1,17 @@
 name: Desktop validation
 
 on:
-  pull_request:
-    paths: ['desktop/**', 'src/powercontext/**', 'pyproject.toml', 'uv.lock', 'openapi/powercontext.yaml', 'tests/fixtures/transport_loopback_vectors.json', 'tests/test_desktop_fixture_qualification.py', 'website/assets/**', '.github/workflows/desktop.yml']
+  workflow_call:
+    inputs:
+      suites:
+        description: Scope already selected by the Main orchestrator
+        required: true
+        type: string
+      installer_run:
+        type: string
+        default: ''
   push:
-    branches: [master, codex/desktop-preview]
-    paths: ['desktop/**', 'src/powercontext/**', 'pyproject.toml', 'uv.lock', 'openapi/powercontext.yaml', 'tests/fixtures/transport_loopback_vectors.json', 'tests/test_desktop_fixture_qualification.py', 'website/assets/**', '.github/workflows/desktop.yml']
+    branches: [codex/desktop-preview]
   workflow_dispatch:
     inputs:
       installer_run:
@@ -15,15 +21,25 @@ on:
         default: ''
 
 permissions:
+  actions: read
   contents: read
 
 concurrency:
-  group: desktop-${{ github.event.pull_request.number || github.ref }}-${{ inputs.installer_run || 'build' }}
+  group: desktop-${{ github.event.pull_request.number || github.ref }}-${{ inputs.installer_run || 'build' }}-${{ github.event_name }}
   cancel-in-progress: true
 
 jobs:
+  changes:
+    if: ${{ inputs.suites == '' }}
+    uses: ./.github/workflows/ci-changes.yml
+    with:
+      baseline-workflow: desktop.yml
+
   windows:
-    if: ${{ github.event_name != 'workflow_dispatch' || inputs.installer_run == '' }}
+    needs: changes
+    if: >-
+      ${{ !cancelled() && (github.event_name != 'workflow_dispatch' || inputs.installer_run == '') &&
+          ((inputs.suites == '' && needs.changes.result != 'success') || fromJSON(inputs.suites || needs.changes.outputs.suites || '{}').desktop) }}
     runs-on: windows-2025
     timeout-minutes: 40
     defaults:
@@ -73,9 +89,12 @@ jobs:
       - name: Verify Windows vault across processes
         run: cargo run --locked --manifest-path src-tauri/Cargo.toml --example credential_probe
       - name: Set up Python fixture tooling
+        timeout-minutes: 5
         uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
         with:
           version: "0.10.12"
+          # Use the release source directly; a stalled mirror download can exhaust the job budget.
+          download-from-astral-mirror: false
           enable-cache: true
           cache-suffix: desktop-${{ github.job }}-py3.12
           cache-dependency-glob: |
@@ -148,7 +167,10 @@ jobs:
           if-no-files-found: ${{ job.status == 'success' && 'error' || 'warn' }}
 
   macos:
-    if: ${{ github.event_name != 'workflow_dispatch' || inputs.installer_run == '' }}
+    needs: changes
+    if: >-
+      ${{ !cancelled() && (github.event_name != 'workflow_dispatch' || inputs.installer_run == '') &&
+          ((inputs.suites == '' && needs.changes.result != 'success') || fromJSON(inputs.suites || needs.changes.outputs.suites || '{}').desktop) }}
     strategy:
       fail-fast: false
       matrix:
@@ -202,7 +224,10 @@ jobs:
           if-no-files-found: error
 
   linux:
-    if: ${{ github.event_name != 'workflow_dispatch' || inputs.installer_run == '' }}
+    needs: changes
+    if: >-
+      ${{ !cancelled() && (github.event_name != 'workflow_dispatch' || inputs.installer_run == '') &&
+          ((inputs.suites == '' && needs.changes.result != 'success') || fromJSON(inputs.suites || needs.changes.outputs.suites || '{}').desktop) }}
     runs-on: ubuntu-24.04
     timeout-minutes: 40
     defaults: