ci: split Linux gates and isolate native Windows tests by Cuarroc · Pull Request #1560 · Cuarroc/ProjectA

Cuarroc · 2026-10-15T14:28:19Z

Die Linux-Prüfungen laufen auf zwei Bahnen, und die HQ-Tests erhalten dort das benötigte Gitleaks.
Der vollständige CI-Lauf ist grün und belegt alle 40 bisherigen Linux-Gates genau einmal.
Die unabhängige Nachprüfung steht noch aus; die gemessenen Windows-Zeiten zeigen keine Beschleunigung des gesamten Ablaufs.

Report

Change and scope

linux_1 runs 32 Rust, script and HQ gates with the existing full Linux bootstrap; linux_2 runs 8 frontend and browser gates with Node and Chromium. The complete local linux lane remains available.
Required check gates (linux) aggregates both legs and fails closed for failed, cancelled, skipped or missing results. Combined junit-linux artifacts, red-first routing and main-red coverage remain intact.
windows_native runs the existing native tests separately from the unchanged nextest partitions. Product code, native test implementation and Mergify settings are unchanged.
R1 moves only hq-test to linux_1 and adds a regression test requiring its Gitleaks bootstrap before the gate invocation. No new dependencies or tool installations were added by this fix.
Base: 4372a78dcdff0f190a968397bc73e5f55ecf39db; reviewed head: 6d7886c89b59404a6411943dcd38ca4d1e83bce4; candidate: f6b9051e92b1dd5e95ba0c6c501dd782b749eea4.
Whole PR: 275 changed lines across 7 files, below the 400-line fix-round limit and the original 300-line budget. R1 delta: 14 changed lines across 2 files. Existing history preserved; new commits af9fe040 (red regression) and f6b9051e (fix).

Evidence — 2026-10-15

Command / boundary	Result
`node --test scripts/ci/linux-split.test.mjs` before fix, on reviewed implementation	exit 1: new HQ prerequisite test failed because `linux_2` lacked setup-linux; both existing tests passed
Same command after fix	exit 0: 3/3; exact gate union, Gitleaks bootstrap ordering and all 25 aggregate result pairs
`bash scripts/test-gates.sh`	exit 0; Linux 40 = 32 + 8, existing lane contracts preserved
`bash scripts/ci/ci-shape.sh`	exit 0
`bash scripts/ci/red-first.sh` at candidate	exit 0; all 6 commit trailer references proved absent/red at merge base and green at head
`bash scripts/ci/secret-scan.sh` before each R1 commit	exit 0 each; regular precommit hooks also passed
`git diff --check`	exit 0
`bash scripts/ci/gates.sh lane prepush` at candidate, unpiped	exit 0; all 27 gates green in 487 s; 1,424 frontend tests and 2,273 Rust tests passed
`git push -u origin codex/ci-split-linux`	exit 0; regular full prepush hook passed again at candidate in 289 s
`git ls-remote origin codex/ci-split-linux`	exit 0; exact candidate SHA confirmed
`gh workflow run ci.yml --ref codex/ci-split-linux`	exit 0; run 38757771098
`gh run watch 38757771098 --exit-status --interval 30`	exit 0; complete workflow success
`gh run view 38757771098 --json headSha,status,conclusion,jobs,url,event,createdAt,updatedAt`	exit 0; completed/success, exact candidate SHA
`gh run view 38757771098 --log`	exit 0; gate evidence below

The regression was committed before the fix. Its exact trailer is Test-First: scripts/ci/linux-split.test.mjs::HQ tests run on a Linux leg with Gitleaks installed before gates.

Runtime gate coverage — R1560-B1

Successful run 38757771098, linux_1 job, linux_2 job.

Method: extract >>> Gate <id>: starts and <<< Gate <id>: gruen (<seconds>s) completions from the Gates steps of those two jobs. Compare both multisets against the 40 gate IDs whose lane list contains linux in git show 4372a78d:scripts/ci/gates.sh; require exactly one matching start and green completion per ID on the same leg. The assertion script exited 0: 40/40, no missing, duplicate or extra gates; linux_1 32/32, linux_2 8/8. Gate durations below come from the actual logs, not the static lane list.

Gate	Leg	Result	Duration
`no-masked`	`linux_1`	success (exit 0)	0 s
`wf-shell`	`linux_1`	success (exit 0)	1 s
`wf-pinned`	`linux_1`	success (exit 0)	0 s
`crlf`	`linux_1`	success (exit 0)	0 s
`eol`	`linux_1`	success (exit 0)	0 s
`shellcheck`	`linux_1`	success (exit 0)	7 s
`actionlint`	`linux_1`	success (exit 0)	0 s
`selftest-shell-lint`	`linux_1`	success (exit 0)	8 s
`ci-shape`	`linux_1`	success (exit 0)	0 s
`pr-secrets`	`linux_1`	success (exit 0)	0 s
`release-shape`	`linux_1`	success (exit 0)	0 s
`dev-build-shape`	`linux_1`	success (exit 0)	0 s
`selftest-gates`	`linux_1`	success (exit 0)	24 s
`selftest-red-first`	`linux_1`	success (exit 0)	28 s
`selftest-review`	`linux_1`	success (exit 0)	14 s
`selftest-lane-plan`	`linux_1`	success (exit 0)	7 s
`selftest-main-red`	`linux_1`	success (exit 0)	2 s
`script-modes`	`linux_1`	success (exit 0)	0 s
`selftest-script-modes`	`linux_1`	success (exit 0)	0 s
`hotspot-guard`	`linux_1`	success (exit 0)	0 s
`selftest-hotspot-guard`	`linux_1`	success (exit 0)	1 s
`selftest-win-signal`	`linux_1`	success (exit 0)	2 s
`crlf-source-compare`	`linux_1`	success (exit 0)	0 s
`architecture-drift`	`linux_1`	success (exit 0)	6 s
`ipc-names`	`linux_1`	success (exit 0)	1 s
`ratchet`	`linux_1`	success (exit 0)	1 s
`ignore-reasons`	`linux_1`	success (exit 0)	0 s
`fmt`	`linux_1`	success (exit 0)	3 s
`hq-test`	`linux_1`	success (exit 0)	22 s
`licenses`	`linux_1`	success (exit 0)	6 s
`clippy`	`linux_1`	success (exit 0)	40 s
`rust-suite`	`linux_1`	success (exit 0)	140 s
`diagrams-export`	`linux_2`	success (exit 0)	4 s
`typecheck`	`linux_2`	success (exit 0)	9 s
`lint`	`linux_2`	success (exit 0)	6 s
`fe-test`	`linux_2`	success (exit 0)	124 s
`denkraum`	`linux_2`	success (exit 0)	45 s
`hq-visual`	`linux_2`	success (exit 0)	24 s
`fe-build`	`linux_2`	success (exit 0)	13 s
`e2e`	`linux_2`	success (exit 0)	13 s

Measurement — R1560-C1

Sources: gh run view 38747628198 --json headSha,status,conclusion,jobs,url,event,createdAt,updatedAt and the candidate command above, both exit 0. Durations are job completedAt - startedAt; parenthesized numbers are the Gates step duration. Baseline 38747628198 is a successful pre-split pull-request run at e89a5325973d0eb6f67449e4032be85339354ad0; candidate is a successful manual run at the stated head.

Job	Before	Candidate	Candidate result
Linux full job / linux_1	633 s (541 s gates)	425 s (313 s gates)	success
linux_2	included above	277 s (239 s gates)	success
Linux aggregator	n/a	5 s	success
windows_1	358 s (270 s gates)	764 s (615 s gates)	success
windows_2	514 s (426 s gates)	318 s (252 s gates)	success
windows_native	included in windows_2	368 s (284 s gates)	success
Windows aggregator	5 s	6 s	success

In this sample the longest Linux execution leg is shorter, but the longest Windows leg is slower and the summed Windows execution-job time rises from 872 s to 1,450 s. No overall speedup is established. These runs differ in commit, event, runner and cache conditions; they are not controlled repeated measurements. The earlier failed run 38751545520 is superseded for coverage by this complete successful run.

Review disposition

Round-one source: Anthropic review of 6d7886c8, verdict REQUEST CHANGES. This worker implemented the requested fixes and did not perform the independent delta review.

ID	Severity	Disposition
R1560-A1	high	Accepted: `f6b9051e` moves HQ tests to the existing Gitleaks-equipped leg; regression in `af9fe040` failed before the fix. Run 38757771098 confirms `hq-test` success.
R1560-B1	medium	Accepted: run 38757771098 is green; the log-derived table proves 40/40 original Linux gates exactly once, including denkraum, hq-visual, fe-build and e2e.
R1560-C1	low	Addressed with observed before/after job and gate-step times above. Windows performance remains an explicit limitation; changing Windows caching or partitioning is outside this corrective delta.
R1560-D1	low	No code change: the reviewer explicitly accepted the focused YAML-text test. Its 25 actual shell verdict executions, ci-shape and the green integrated workflow remain the evidence; adding a YAML parser is unnecessary for this fix.

Review: ausstehend (Stufe B). Root owns non-OpenAI delta review, acceptance, readiness and Mergify integration. This worker sets no review-ok label and does not enqueue or merge the PR. The existing draft is retained for that handover.

NICHT ABGEDECKT

Local Linux checks do not compile or execute #[cfg(windows)] tests or Windows-only clippy branches. The manual workflow passed all three Windows execution legs; the merge queue must still validate the integrated candidate on Windows.
The workflow_dispatch event skips the PR-only red-first verdict; the full local red-first proof at the candidate passed.
Repeated-run performance, production external services and releases are not covered. No overall speedup claim is made.
All 40 Linux gates have runtime completion evidence, but their own intentional skips remain: local Rust nextest reports 7 skipped tests; a green gate does not imply execution of every platform-gated or ignored test.

Handover

FIX-PR1560-R1 is implemented, locally tested, pushed and evidenced in the manual workflow. Native worker goal was created and checked through the harness; its bounded acceptance is this checked handover. Independent review, Root acceptance and merge remain separate and pending. Start evidence lacked the optional usage file and the project-memory mirror; no provider-limit or exact-model observation is claimed.

Test-First: scripts/ci/linux-split.test.mjs::Linux sub-lanes run every Linux gate exactly once Test-First: scripts/ci/linux-split.test.mjs::Linux required check aggregates both legs and fails closed

Test-First: scripts/ci/linux-split.test.mjs::HQ tests run on a Linux leg with Gitleaks installed before gates

Cuarroc · 2026-10-15T15:27:20Z

Root disposition of the Kimi second review (moonshotai/kimi-k3, head f6b9051, review-openrouter/out/pr1560-kimi-f6b9051e.md):

ID	Sev	Finding	Disposition
R1560-K1	high	linux_2 runs e2e/fe-build without Rust/setup-linux	rejected: e2e is `playwright test` (package.json:22) against the Vite dev server (playwright.config.ts:24-27 `npm run dev -- --host 127.0.0.1`, url :1420); fe-build is `vite build` (package.json:18). Neither builds the Tauri binary, so no cargo/webkit deps are needed.
R1560-K2	medium	linux-split.test.mjs:18-26 checks tool prerequisites only for hq-test	accepted as follow-up (prerequisite map per gate), not blocking.
R1560-K3	medium	red-first needs only linux_1 (ci.yml:654)	open: to be confirmed against branch protection/.mergify.yml (required check stays the aggregate `gates (linux)`); decided with the Claude delta review.
R1560-K4/K5	low	artifact fan-in cost; lane_run aggregate	follow-up / informational (fail-closed confirmed by the reviewer).
Reviewer verdict REQUEST_CHANGES rests on K1, which is rejected with evidence.

Cuarroc · 2026-10-15T16:36:20Z

Root 2026-10-15 18:36:17, head f6b9051: R1560-K3 (Kimi, medium, red-first needs only linux_1, ci.yml:654) REJECTED with evidence: the steps 'red-first - plan' (ci.yml:248) and 'red-first - proof against merge base' (ci.yml:350) run inside job linux_1 (lines 160-374), so the verdict job needs exactly that leg; the required gate check remains the aggregate 'gates (linux)' (.mergify.yml:69-71, ci.yml:427). Reviews at f6b9051: Claude APPROVE (A1 high + B1 medium resolved, run 38757771098 success) + Kimi (K1 rejected, K2 follow-up, K3 rejected). Note for the user: public repo, so extra Windows minutes cost no money. Marking ready; review-ok only after ALL checks incl. CodeQL are green on this head.

chatgpt-codex-connector · 2026-10-15T16:36:30Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-15T16:40:43.945759Z	`f6b9051`	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: f6b9051e92

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-10-15T16:40:41Z

      - name: Gates (linux)
        if: steps.plan.outputs.run != 'false'
-        run: bash scripts/ci/gates.sh lane linux
+        run: bash scripts/ci/gates.sh lane linux_1


Restore the canonical Linux lane in CI

This workflow now invokes the new linux_1 lane here and linux_2 later, although the repository contract requires ci.yml to call the canonical linux lane exactly once. As a result, local lane linux and CI use separate orchestration paths, and every Linux gate must maintain duplicated membership in linux plus one shard—the configuration drift this invariant is intended to prevent. Keep the sharding behind the canonical lane interface rather than exposing additional workflow lanes.

AGENTS.md reference: AGENTS.md:L216-L218

Useful? React with 👍 / 👎.

Cuarroc · 2026-10-15T16:43:07Z

Root review gate 2026-10-15 18:43:05, bound to head f6b9051: Claude APPROVE + Kimi (K1 rejected, K2 follow-up, K3 rejected with evidence) at this head; all checks green incl. CodeQL (gh pr checks: no fail, no pending). Setting review-ok.

Cuarroc · 2026-10-15T16:43:28Z

Root auto-queue: head f6b9051 unchanged since review-ok, all checks green. @Mergifyio queue

mergify · 2026-10-15T16:56:26Z

Cuarroc added 4 commits October 15, 2026 16:06

test(ci): require complete Linux split and fail-closed aggregation

e982713

Test-First: scripts/ci/linux-split.test.mjs::Linux sub-lanes run every Linux gate exactly once Test-First: scripts/ci/linux-split.test.mjs::Linux required check aggregates both legs and fails closed

ci: split Linux gates and isolate native Windows tests

6d7886c

Test-First: scripts/ci/linux-split.test.mjs::Linux sub-lanes run every Linux gate exactly once Test-First: scripts/ci/linux-split.test.mjs::Linux required check aggregates both legs and fails closed

test(ci): require Gitleaks on the HQ test leg

af9fe04

Test-First: scripts/ci/linux-split.test.mjs::HQ tests run on a Linux leg with Gitleaks installed before gates

fix(ci): run HQ tests with the Gitleaks bootstrap

f6b9051

Test-First: scripts/ci/linux-split.test.mjs::HQ tests run on a Linux leg with Gitleaks installed before gates

Cuarroc mentioned this pull request Oct 15, 2026

feat(plan): shared model and freshness check (PLAN-AUTO-1) #1564

Merged

Cuarroc marked this pull request as ready for review October 15, 2026 16:36

chatgpt-codex-connector Bot reviewed Oct 15, 2026

View reviewed changes

Cuarroc added the review-ok Pipeline: review disposition complete, no open high finding label Oct 15, 2026

mergify Bot mentioned this pull request Oct 15, 2026

merge queue: checking #1560 on main (90d1a8c), stacked on #1564 #1577

Closed

30 of 46 tasks

mergify Bot added the queued label Oct 15, 2026

mergify Bot merged commit a8aef6d into main Oct 15, 2026
34 checks passed

mergify Bot deleted the codex/ci-split-linux branch October 15, 2026 16:56

mergify Bot removed the queued label Oct 15, 2026

This was referenced Oct 15, 2026

docs(plan): sync PLAN rows and snapshot to ded1eef5 #1587

Closed

fix(diagrams): preserve literal SVG comments in CDATA (FU-1015) #1835

Merged

Cuarroc mentioned this pull request Oct 22, 2026

fix(ci): accept equivalent step indentation and cover guards #1839

Merged

Navigation Menu

Repository navigation

ci: split Linux gates and isolate native Windows tests - #1560

ci: split Linux gates and isolate native Windows tests#1560
mergify[bot] merged 4 commits into
mainfrom
codex/ci-split-linux

Cuarroc commented Oct 15, 2026 •

edited

Loading

Uh oh!

Cuarroc commented Oct 15, 2026

Uh oh!

Cuarroc commented Oct 15, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 15, 2026 •

edited

Loading

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

chatgpt-codex-connector Bot Oct 15, 2026

Uh oh!

Cuarroc commented Oct 15, 2026

Uh oh!

Cuarroc commented Oct 15, 2026

Uh oh!

Uh oh!

mergify Bot commented Oct 15, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

Cuarroc commented Oct 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Report

Change and scope

Evidence — 2026-10-15

Runtime gate coverage — R1560-B1

Measurement — R1560-C1

Review disposition

NICHT ABGEDECKT

Handover

Uh oh!

Cuarroc commented Oct 15, 2026

Uh oh!

Cuarroc commented Oct 15, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Oct 15, 2026

Choose a reason for hiding this comment

Uh oh!

Cuarroc commented Oct 15, 2026

Uh oh!

Cuarroc commented Oct 15, 2026

Uh oh!

Uh oh!

mergify Bot commented Oct 15, 2026

Merge Queue Status

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Cuarroc commented Oct 15, 2026 •

edited

Loading

chatgpt-codex-connector Bot commented Oct 15, 2026 •

edited

Loading