@opengsd/gsd-core 1.13.0 → 1.14.0

package/scripts/ci-next-health.cjs

@@ -0,0 +1,271 @@
+#!/usr/bin/env node
+'use strict';
+
+// ci-next-health.cjs — #4422 base-branch health gate.
+//
+// Risk asymmetry drives this design, same shape as scripts/ci-pr-mergeability.cjs
+// but pointed the other direction: on 2026-09-06 three unrelated PRs merged on
+// top of an already-broken `next` before anyone noticed, because nothing checked
+// the base branch's OWN health before letting a PR land on it. A false positive
+// here (a healthy `next` wrongly reported RED) blocks every PR merge in the repo
+// until a human notices and applies the `fix-next` bypass label — annoying, but
+// loud and immediately actionable. A false negative (a broken `next` reported
+// healthy) reproduces the #4422 incident exactly. So, unlike the mergeability
+// preflight, this gate does NOT fail open on a definite red signal — it fails
+// open only when the signal itself is unavailable or inapplicable (wrong event,
+// no resolvable base ref, an API read that throws). Once GitHub actually answers
+// with a non-success conclusion for the base branch's last push-triggered Tests
+// run, that is treated as authoritative and blocks — with one explicit, visible,
+// human-operated escape hatch (the `fix-next` label) for the PR that is itself
+// the fix-forward.
+//
+// Every non-success conclusion (`failure`, `cancelled`, `timed_out`,
+// `action_required`, ...) is treated as RED, not just `failure` — a cancelled or
+// timed-out run on the base branch is not evidence the branch is healthy, it is
+// evidence nobody knows yet.
+
+const { ExitError, runMain } = require('./lib/cli-exit.cjs');
+
+const VERDICT = Object.freeze({
+  CLEAN: 'CLEAN',
+  RED: 'RED',
+  BYPASSED: 'BYPASSED',
+  SKIPPED_NOT_APPLICABLE: 'SKIPPED_NOT_APPLICABLE',
+  INDETERMINATE: 'INDETERMINATE',
+});
+
+const APPLICABLE_EVENTS = new Set(['pull_request', 'merge_group']);
+const BYPASS_LABEL = 'fix-next';
+const TESTS_WORKFLOW_FILE = 'test.yml';
+
+/**
+ * Pure, total classifier: the GitHub "list workflow runs" response payload ->
+ * CLEAN | RED | INDETERMINATE. Never throws.
+ *
+ * - Not an object, or `workflow_runs` isn't an array -> INDETERMINATE: the
+ *   shape we depend on is not present, so nothing can be concluded.
+ * - No completed push runs found yet (e.g. a brand-new `release/**`/`hotfix/**`
+ *   branch with no Tests history) -> CLEAN: absence of evidence of red is not
+ *   evidence of red, and a brand-new branch must not be permanently unmergeable.
+ * - The most recent run's `conclusion === 'success'` -> CLEAN.
+ * - Anything else (failure, cancelled, timed_out, action_required, ...) -> RED.
+ */
+function classifyRunConclusion(payload) {
+  if (payload === null || typeof payload !== 'object') return VERDICT.INDETERMINATE;
+  if (!Array.isArray(payload.workflow_runs)) return VERDICT.INDETERMINATE;
+  if (payload.workflow_runs.length === 0) return VERDICT.CLEAN;
+  const [latest] = payload.workflow_runs;
+  if (latest && latest.conclusion === 'success') return VERDICT.CLEAN;
+  return VERDICT.RED;
+}
+
+/**
+ * Dependency-injected orchestrator. `fetchLatestRun` is an async function
+ * taking the resolved base branch name and returning the parsed API payload
+ * (or throwing) — injected so tests never touch the network.
+ *
+ * @returns {Promise<{verdict:string, payload:*, reason:string}>}
+ */
+async function resolveNextHealth({ fetchLatestRun, eventName, baseRef, labels } = {}) {
+  if (!APPLICABLE_EVENTS.has(eventName)) {
+    return { verdict: VERDICT.SKIPPED_NOT_APPLICABLE, payload: null, reason: 'not-applicable-event' };
+  }
+
+  if (typeof baseRef !== 'string' || baseRef.trim() === '') {
+    return { verdict: VERDICT.INDETERMINATE, payload: null, reason: 'no-base-ref' };
+  }
+
+  let payload = null;
+  try {
+    payload = await fetchLatestRun(baseRef);
+  } catch (err) {
+    return { verdict: VERDICT.INDETERMINATE, payload: null, reason: `fetch-failed: ${err.message}` };
+  }
+
+  const classified = classifyRunConclusion(payload);
+  if (classified !== VERDICT.RED) {
+    return { verdict: classified, payload, reason: 'resolved' };
+  }
+
+  // Escape hatch. `labels` is empty/absent for merge_group — that event has no
+  // label surface today, which means a queued merge-group commit cannot use
+  // this bypass. Known gap, not solved here: a maintainer must land the
+  // fix-forward as a direct pull_request merge (where the label IS readable)
+  // rather than through the merge queue, until GitHub exposes an equivalent
+  // signal for merge_group.
+  const labelList = Array.isArray(labels) ? labels : [];
+  if (labelList.includes(BYPASS_LABEL)) {
+    return { verdict: VERDICT.BYPASSED, payload, reason: 'bypass-label' };
+  }
+
+  return { verdict: VERDICT.RED, payload, reason: 'red' };
+}
+
+function usage() {
+  return [
+    'Usage:',
+    '  node scripts/ci-next-health.cjs',
+    '',
+    'CI-only gate: checks whether the PR/merge-group\'s base branch\'s own last',
+    'push-triggered Tests run is red, and fails the job (exit 1) when it is —',
+    'unless the PR carries the "fix-next" bypass label. Every other case',
+    '(wrong event, no resolvable base ref, an unreadable API read) fails open',
+    '(exit 0).',
+    '',
+    'Environment variables read:',
+    '  GITHUB_EVENT_NAME     workflow trigger event; only "pull_request" and',
+    '                        "merge_group" are checked',
+    '  GITHUB_REPOSITORY     owner/repo',
+    '  GITHUB_TOKEN          optional bearer token for the API read',
+    '  GITHUB_BASE_REF       PR base branch name (pull_request events; set',
+    '                        automatically by GitHub Actions)',
+    '  MERGE_GROUP_BASE_REF  merge-group base ref (merge_group events; the',
+    '                        caller workflow must populate this from',
+    '                        github.event.merge_group.base_ref — a leading',
+    '                        "refs/heads/" prefix is stripped if present)',
+    '  GITHUB_API_URL        GitHub API base URL (default: https://api.github.com)',
+    '  PR_LABELS             comma-separated PR label names (pull_request events;',
+    '                        the caller workflow must populate this from',
+    '                        github.event.pull_request.labels.*.name); checked',
+    '                        for the literal "fix-next" bypass label',
+    '  GITHUB_OUTPUT         path to append verdict= step output to',
+    '  GITHUB_STEP_SUMMARY   path to append a human-readable summary to',
+  ].join('\n');
+}
+
+function parseArgs(argv) {
+  for (const arg of argv) {
+    if (arg === '--help' || arg === '-h') {
+      process.stdout.write(`${usage()}\n`);
+      throw new ExitError(0);
+    }
+    throw new Error(`unknown argument: ${arg}`);
+  }
+}
+
+function writeOutput(lines) {
+  const outputPath = process.env.GITHUB_OUTPUT;
+  if (typeof outputPath !== 'string' || outputPath === '') return;
+  try {
+    const fs = require('node:fs');
+    fs.appendFileSync(outputPath, `${lines.join('\n')}\n`);
+  } catch (err) {
+    // A failure while REPORTING the verdict must never invert the gate.
+    process.stderr.write(`::warning::failed to write GITHUB_OUTPUT: ${err.message}\n`);
+  }
+}
+
+function writeSummary(text) {
+  const summaryPath = process.env.GITHUB_STEP_SUMMARY;
+  if (typeof summaryPath !== 'string' || summaryPath === '') return;
+  try {
+    const fs = require('node:fs');
+    fs.appendFileSync(summaryPath, `${text}\n`);
+  } catch (err) {
+    process.stderr.write(`::warning::failed to write GITHUB_STEP_SUMMARY: ${err.message}\n`);
+  }
+}
+
+function resolveBaseRef(eventName) {
+  if (eventName === 'pull_request') {
+    return process.env.GITHUB_BASE_REF || '';
+  }
+  if (eventName === 'merge_group') {
+    const raw = process.env.MERGE_GROUP_BASE_REF || '';
+    return raw.startsWith('refs/heads/') ? raw.slice('refs/heads/'.length) : raw;
+  }
+  return '';
+}
+
+function parseLabels(raw) {
+  if (typeof raw !== 'string' || raw.trim() === '') return [];
+  return raw.split(',').map((s) => s.trim()).filter((s) => s !== '');
+}
+
+function runUrlOf(payload) {
+  const run = payload && Array.isArray(payload.workflow_runs) ? payload.workflow_runs[0] : undefined;
+  return run && typeof run.html_url === 'string' ? run.html_url : '(unknown run URL)';
+}
+
+// `argv` defaults to real CLI argv but is a parameter so tests can call
+// main() in-process (e.g. main([])) without inheriting the test runner's own
+// argv, which would otherwise trip parseArgs's "unknown argument" branch.
+async function main(argv = process.argv.slice(2)) {
+  parseArgs(argv);
+
+  const eventName = process.env.GITHUB_EVENT_NAME;
+  const repo = process.env.GITHUB_REPOSITORY || '';
+  const token = process.env.GITHUB_TOKEN || '';
+  const apiBase = process.env.GITHUB_API_URL || 'https://api.github.com';
+  const baseRef = resolveBaseRef(eventName);
+  const labels = parseLabels(process.env.PR_LABELS);
+
+  const fetchLatestRun = async (branch) => {
+    const url = `${apiBase}/repos/${repo}/actions/workflows/${TESTS_WORKFLOW_FILE}/runs`
+      + `?branch=${encodeURIComponent(branch)}&event=push&status=completed&per_page=1`;
+    const headers = {
+      accept: 'application/vnd.github+json',
+      'x-github-api-version': '2022-11-28',
+      'user-agent': 'gsd-core-ci-next-health',
+    };
+    if (token) headers.authorization = `Bearer ${token}`;
+    const response = await fetch(url, { headers, signal: AbortSignal.timeout(10000) });
+    if (!response.ok) {
+      throw new Error(`GitHub API responded ${response.status}`);
+    }
+    const text = await response.text();
+    try {
+      return JSON.parse(text);
+    } catch {
+      return null;
+    }
+  };
+
+  const result = await resolveNextHealth({ fetchLatestRun, eventName, baseRef, labels });
+
+  writeOutput([`verdict=${result.verdict}`]);
+  writeSummary(`Base branch health: ${result.verdict}`);
+
+  if (result.verdict === VERDICT.RED) {
+    const runUrl = runUrlOf(result.payload);
+    process.stderr.write(
+      `::error::the base branch "${baseRef}"'s own last Tests run is red: ${runUrl} — `
+      + 'wait for a fix-forward merge, or if THIS pull request is the fix, ask a '
+      + `maintainer to apply the "${BYPASS_LABEL}" label to explicitly override this gate.\n`,
+    );
+    return 1;
+  }
+
+  if (result.verdict === VERDICT.BYPASSED) {
+    const runUrl = runUrlOf(result.payload);
+    process.stderr.write(
+      `::warning::the base branch "${baseRef}"'s own last Tests run is red: ${runUrl} — `
+      + `a human applied the "${BYPASS_LABEL}" label to explicitly override this gate.\n`,
+    );
+    return 0;
+  }
+
+  if (result.verdict === VERDICT.INDETERMINATE) {
+    process.stderr.write(
+      `::warning::could not determine "${baseRef || '(no base ref)'}"'s Tests health (${result.reason}); `
+      + 'proceeding (fail-open).\n',
+    );
+    return 0;
+  }
+
+  process.stdout.write(`Base branch health: ${result.verdict}\n`);
+  return 0;
+}
+
+if (require.main === module) {
+  runMain(main);
+}
+
+module.exports = {
+  VERDICT,
+  BYPASS_LABEL,
+  TESTS_WORKFLOW_FILE,
+  classifyRunConclusion,
+  resolveNextHealth,
+  main,
+};

package/scripts/ci-prepare-test-scope.cjs

@@ -4,9 +4,9 @@
 // Shell-agnostic: invoked as `node scripts/ci-prepare-test-scope.cjs` from any shell.
 //
 // Required environment variables (set by the workflow step's `env:` block):
-//   TEST_SCOPE       — "windows" | "targeted"
+//   TEST_SCOPE       — "targeted" (the `windows` scope was retired by #4641:
+//                      test-conformance is now the sole Windows selector)
 //   TARGETED_TESTS   — space-separated test file list (from ci-test-scope.cjs output)
-//   WINDOWS_TESTS    — space-separated test file list for the windows lane
 //
 // Writes: .ci-selected-tests.txt (one file per line, no blanks)
 // Exit 0 = success; exit 1 = unknown scope.
@@ -46,13 +46,14 @@ function isResolvable(entry, root) {
 
 // Resolve the scoped test selection for the lane. Pure (no I/O beyond the
 // existence probe under `root`) so it can be unit-tested directly.
-function resolveSelection({ scope, targeted, windows, root }) {
+function resolveSelection({ scope, targeted, root }) {
   let selected;
-  if (scope === 'windows') {
-    selected = windows;
-  } else if (scope === 'targeted') {
+  if (scope === 'targeted') {
     selected = targeted;
   } else {
+    // #4641: the `windows` scope was retired (test-conformance is now the
+    // sole Windows selector) — an unknown/retired scope must fail loudly
+    // rather than silently selecting nothing.
     throw new ExitError(1, `::error::Unknown test scope: ${scope}`);
   }
 
@@ -75,7 +76,6 @@ function main() {
   const lines = resolveSelection({
     scope: process.env.TEST_SCOPE || '',
     targeted: process.env.TARGETED_TESTS || '',
-    windows: process.env.WINDOWS_TESTS || '',
     root,
   });
 

package/scripts/ci-test-scope.cjs

@@ -3,9 +3,10 @@
 
 const path = require('path');
 const { execFileSync } = require('child_process');
-const { existsSync, readdirSync, appendFileSync } = require('fs');
+const { existsSync, readdirSync, appendFileSync, readFileSync } = require('fs');
 
 const { ExitError, runMain } = require('./lib/cli-exit.cjs');
+const { classifyContent, NOISY_FOR_SOURCE_REACHABILITY } = require('./gen-platform-conformance-tier.cjs');
 
 // Workflow files that are purely administrative / policy bots. Changes to these
 // files do NOT require the cross-platform test matrix — only a lightweight
@@ -484,12 +485,68 @@ function addAll(set, values) {
 // fullMatrix=true, so the full Windows lane already runs when those paths
 // change. The old six-hint list pulled 102 of ~633 test files into the scoped
 // windows lane, turning it into a ~10-minute job on every PR.
+// #4641: the scoped windows lane itself is gone. These hints now drive
+// full_matrix instead — a matched RULE whose tests[] includes a
+// windows-hint filename AND that hinted file is itself in the conformance
+// tier (per reachesConformanceTierOrSeam) escalates straight to full_matrix
+// (routed to test-conformance, the sole Windows selector) rather than
+// feeding a side lane. Tier-backed on purpose: full_matrix only ever runs
+// CONFORMANCE_TIER_FILES, so a hint on a non-tier file would cost 4 CI jobs
+// with zero Windows coverage of that file. See
+// docs/adr/4641-windows-selector-consolidation.md.
 const WINDOWS_HINTS = ['windows', 'win32', 'shell', 'path'];
 const isWindowsHint = s => WINDOWS_HINTS.some(k => s.toLowerCase().includes(k));
 
-function classify(files) {
+// A change to the classification mechanism itself cannot be presumed safe by
+// the very mechanism being changed (#4592).
+const CLASSIFIER_DEFINITION_FILES = new Set([
+  'scripts/gen-platform-conformance-tier.cjs',
+  'scripts/lib/platform-conformance-tier.generated.cjs',
+  'scripts/lib/suite-detection.cjs',
+]);
+
+/**
+ * Does `file`'s blast radius reach (a) Phase 2's conformance-tier test-file
+ * list or (b) a live platform-conditional signal in src/? Fail-safe: any
+ * thrown error (a require failure, a readFileSync failure, a malformed
+ * generated module, etc.) is treated as uncertainty and returns true — per
+ * #4592's explicit "fail-safe to full_matrix=true on any reachability-
+ * computation error or uncertainty" requirement.
+ * `loadConformanceTier` is injectable (defaults to the real generated module)
+ * solely so tests can simulate a load failure without touching the real,
+ * committed generated file.
+ * @param {string} file
+ * @param {{loadConformanceTier?: () => {CONFORMANCE_TIER_FILES: string[]}}} [deps]
+ * @returns {boolean}
+ */
+function reachesConformanceTierOrSeam(file, deps = {}) {
+  const loadConformanceTier =
+    deps.loadConformanceTier || (() => require('./lib/platform-conformance-tier.generated.cjs'));
+  try {
+    if (file.startsWith('tests/') && file.endsWith('.test.cjs')) {
+      const { CONFORMANCE_TIER_FILES } = loadConformanceTier();
+      return CONFORMANCE_TIER_FILES.includes(file);
+    }
+
+    if (file.startsWith('src/')) {
+      const content = readFileSync(file, 'utf8');
+      const { signals } = classifyContent(content);
+      const narrowSignals = signals.filter(signal => !NOISY_FOR_SOURCE_REACHABILITY.has(signal));
+      return narrowSignals.length > 0;
+    }
+
+    return false;
+  } catch {
+    return true;
+  }
+}
+
+// `reachabilityDeps` is injectable (defaults to {}, which makes
+// reachesConformanceTierOrSeam use the real generated module) solely so
+// tests can simulate a reachability-computation failure without touching
+// the real, committed generated file.
+function classify(files, reachabilityDeps = {}) {
   const targeted = new Set();
-  const windows = new Set();
   const reasons = [];
   let productOrPipelineChanged = false; // product/pipeline code (excludes docs)
   let inertCiChanged = false;           // inert workflow files
@@ -526,15 +583,35 @@ function classify(files) {
 
     if (file.startsWith('tests/') && file.endsWith('.test.cjs')) {
       targeted.add(file);
-      // #494 invariant, narrowed: a changed test must still be exercised on
-      // the divergent OS before merge, but at per-file cost — it ALWAYS joins
-      // the scoped windows lane instead of triggering the three full parity
-      // lanes. (full_matrix fired on 15/15 sampled PRs because test-driven
-      // PRs always touch tests/, costing ~25 runner-minutes each.) Changed
-      // tests already run on the two ubuntu-24 lanes via targeted_tests; the
-      // residual macOS / windows cross-product is covered by the full
-      // matrix on every push to next.
-      windows.add(file);
+      // #494 originally narrowed this to skip full_matrix for changed test
+      // files, on the theory that ubuntu targeted_tests + the scoped windows
+      // lane already covered them. Rescinded per #4421: PR #4384 landed a
+      // macOS-only regression on 2026-09-06 that stayed invisible pre-merge
+      // precisely because this carve-out suppressed the only macOS signal.
+      // #4592: the blanket rule is replaced with a reachability check — only
+      // a changed test file that actually reaches Phase 2's conformance-tier
+      // list (or is the classification mechanism itself) forces full_matrix.
+      if (reachesConformanceTierOrSeam(file, reachabilityDeps)) {
+        fullMatrix = true;
+        reasons.push(`${file}: conformance-tier reachability`);
+      }
+    }
+
+    // #4592: a src/-only diff (no test file touched) must still be able to
+    // set full_matrix=true when it carries a live platform-conditional
+    // signal — this is independent of the tests/ branch above.
+    if (file.startsWith('src/') && reachesConformanceTierOrSeam(file, reachabilityDeps)) {
+      fullMatrix = true;
+      reasons.push(`${file}: platform seam reachability`);
+    }
+
+    // #4592: a changed file that IS the classification mechanism itself
+    // (neither under tests/ nor src/, so neither branch above reaches it)
+    // must also force full_matrix — a change to the mechanism cannot be
+    // presumed safe by the very mechanism being changed.
+    if (CLASSIFIER_DEFINITION_FILES.has(file)) {
+      fullMatrix = true;
+      reasons.push(`${file}: reachability classifier definition changed`);
     }
 
     for (const rule of RULES) {
@@ -542,6 +619,32 @@ function classify(files) {
         addAll(targeted, rule.tests);
         reasons.push(`${file}: ${rule.name}`);
         if (rule.fullMatrix) fullMatrix = true;
+        // #4641: a rule that pulls in a test file matching a Windows-sensitive
+        // filename hint is the one non-redundant residue of the deleted
+        // scoped windows lane — escalate to full_matrix (test-conformance)
+        // instead of feeding a side lane. TIER-BACKED (measured): full_matrix
+        // routes to test-conformance, which runs ONLY CONFORMANCE_TIER_FILES —
+        // escalating on the filename hint alone can fire on a hinted test that
+        // isn't in that tier, costing 4 CI jobs while never actually running it
+        // on Windows. The predicate below requires BOTH the hint AND tier
+        // membership (via reachesConformanceTierOrSeam, the same fail-safe
+        // reachability helper used elsewhere in this file, so error/uncertainty
+        // behavior stays identical). Measured: over the 16 RULES entries this
+        // narrowed form fires on the same rules as the un-narrowed form today
+        // (no behavior change now, correct-by-construction going forward). The
+        // broader alternative — escalate on ANY tier member a rule pulls in,
+        // ignoring the filename hint — was measured and rejected: it fires on
+        // 14 of 16 rules, newly escalating most ordinary product-code PRs
+        // (src/, agents/, commands/, hooks/, skills/, config paths). Only one
+        // rule's escalation is live today: 'portability lint rules (ADR-1703)'.
+        // Four others already had fullMatrix: true (no-op here), and 'inert
+        // CI''s escalation is overridden downstream by the inert-CI reset.
+        // Distinct, greppable reason so the conformance-lane coverage for it
+        // is traceable per rule.
+        if (rule.tests.some(t => isWindowsHint(t) && reachesConformanceTierOrSeam(t, reachabilityDeps))) {
+          fullMatrix = true;
+          reasons.push(`${file}: ${rule.name} (windows-hint rule test, #4641)`);
+        }
       }
     }
   }
@@ -555,7 +658,7 @@ function classify(files) {
     // covered by .github/workflows/install-smoke.yml
     'tests/release-tarball-smoke.install.test.cjs',
   ]);
-  for (const f of SCOPED_LANE_EXCLUDE) { targeted.delete(f); windows.delete(f); }
+  for (const f of SCOPED_LANE_EXCLUDE) { targeted.delete(f); }
 
   // code_changed: true when product/pipeline OR inert CI changed.
   // Docs-only PRs (neither flag set) get code_changed=false → full matrix skip.
@@ -569,8 +672,6 @@ function classify(files) {
     targetedTests.push('unit');
   }
 
-  const windowsTests = existingTests([...new Set([...windows, ...targetedTests.filter(isWindowsHint)])].sort());
-
   // Inert-CI-only: full_matrix must be false (override any RULES that fired).
   if (inertCiChanged && !productOrPipelineChanged) {
     fullMatrix = false;
@@ -579,12 +680,11 @@ function classify(files) {
   // Normalize: when code_changed is false, the output must be self-consistent.
   // A docs file can coincidentally match a coarse content RULE (e.g. docs/installer-migrations.md
   // matches the installer rule via path.includes('install')), leaving full_matrix=true and
-  // non-empty targeted_tests/windows_tests. The workflow skips correctly (gated on code_changed)
+  // non-empty targeted_tests. The workflow skips correctly (gated on code_changed)
   // but the output object would be self-contradictory. Force a clean "nothing to run" result.
   if (!codeChanged) {
     fullMatrix = false;
     targetedTests.length = 0;
-    windowsTests.length = 0;
   }
 
   return {
@@ -592,7 +692,6 @@ function classify(files) {
     product_changed: productOrPipelineChanged,
     full_matrix: fullMatrix,
     targeted_tests: targetedTests,
-    windows_tests: windowsTests,
     reasons: [...new Set(reasons)].sort(),
   };
 }
@@ -604,7 +703,6 @@ function writeOutputs(result) {
     `product_changed=${result.product_changed}`,
     `full_matrix=${result.full_matrix}`,
     `targeted_tests=${result.targeted_tests.join(' ')}`,
-    `windows_tests=${result.windows_tests.join(' ')}`,
   ];
   appendFileSync(process.env.GITHUB_OUTPUT, `${lines.join('\n')}\n`);
 }
@@ -630,4 +728,12 @@ if (require.main === module) {
   runMain(main);
 }
 
-module.exports = { RULES, missingRuleTestFiles, PROTECTED_WORKFLOWS, INERT_WORKFLOWS, missingProtectedWorkflows };
+module.exports = {
+  RULES,
+  missingRuleTestFiles,
+  PROTECTED_WORKFLOWS,
+  INERT_WORKFLOWS,
+  missingProtectedWorkflows,
+  classify,
+  reachesConformanceTierOrSeam,
+};

package/scripts/ci-timeout-report.cjs

@@ -33,8 +33,8 @@ const WORKFLOWS_DIR = path.join(__dirname, '..', '.github', 'workflows');
 const JOB_RULES = [
   { workflowFile: 'test.yml', jobKey: 'test-inert', test: (name) => name === 'test (inert CI)' },
   { workflowFile: 'test.yml', jobKey: 'test', test: (name) => name.startsWith('test (') && name !== 'test (inert CI)' },
-  { workflowFile: 'test.yml', jobKey: 'test-full', test: (name) => name.startsWith('full test (') },
   { workflowFile: 'test.yml', jobKey: 'coverage-gate', test: (name) => name === 'Coverage gate (merged shards)' },
+  { workflowFile: 'test.yml', jobKey: 'test-conformance', test: (name) => name.startsWith('conformance test (') },
   { workflowFile: 'install-smoke.yml', jobKey: 'smoke', test: (name) => name.startsWith('smoke (') },
 ];
 

package/scripts/diff-touches-shipped-paths.cjs

@@ -72,7 +72,7 @@ function isShipped(diffPath, shipPrefixes) {
   // forward slashes, but a developer running this locally on a different
   // tool's output shouldn't get a false negative).
   const p = diffPath.replace(/\\/g, '/');
-  return shipPrefixes.some((s) => p === s || p.startsWith(s + '/'));
+  return shipPrefixes.some((s) => p === s || p.startsWith(s + '/')); // allow-handrolled-containment: shipped-path filtering for a CI check, not a safety decision
 }
 
 // #2980: commits that touch `.github/workflows/*` cannot be cherry-picked

package/scripts/docs-guard-registry.cjs

@@ -9,8 +9,12 @@
  *
  * A prior version of this PR added a `docs guards` RULE to `RULES` in
  * scripts/ci-test-scope.cjs, on the theory that classify()'s `!codeChanged`
- * normalization (which zeroes fullMatrix/targeted_tests/windows_tests for
- * docs-only diffs) made the RULE inert to classify()'s scope decision.
+ * normalization (which at the time zeroed fullMatrix/targeted_tests/
+ * windows_tests for docs-only diffs) made the RULE inert to classify()'s
+ * scope decision. (#4641 later removed `windows_tests` from classify()'s
+ * output entirely; the normalization today only zeroes fullMatrix and
+ * targeted_tests. This paragraph is historical narration of a rejected
+ * design, not a description of current behaviour.)
  *
  * That is true for docs-ONLY diffs and FALSE for MIXED docs+code diffs:
  * `codeChanged` is true whenever ANY changed file is product/pipeline code,
@@ -193,6 +197,7 @@ const DOCS_GUARD_TESTS = {
   // (commit-files-pathspec.test.cjs:1618) — cannot be resolved to specific
   // files without re-deriving the scan's own file-discovery logic.
   'tests/commit-files-pathspec.test.cjs': ['*'],
+  'tests/compact-content-4139.test.cjs': ['docs/CONFIGURATION.md'],
   'tests/config-field-docs.test.cjs': ['docs/CONFIGURATION.md'],
   'tests/config.test.cjs': ['docs/CONFIGURATION.md'],
   'tests/context-index-sync.test.cjs': ['docs/CONTEXT-INDEX.json'],

package/scripts/gen-adr-index.cjs

@@ -31,6 +31,7 @@ const path = require('node:path');
 
 const { ExitError, runMain } = require('./lib/cli-exit.cjs');
 const { escapeRegex: escapeRegExp } = require('../gsd-core/bin/lib/pattern.cjs');
+const { isContainedIn } = require('../gsd-core/bin/lib/security.cjs');
 
 const ROOT = path.resolve(__dirname, '..');
 const ADR_DIR = path.join(ROOT, 'docs', 'adr');
@@ -176,10 +177,15 @@ const ADR_FILENAME_RE = /^[0-9]+-[a-z0-9-]+\.md$/;
  * segment merely BEGINS with two dots (`..hidden.md`), and a false "escapes
  * the repository" on a valid path is a worse failure than a miss — hence the
  * whole-segment `rel === '..' || rel.startsWith('..' + sep)` form.
+ *
+ * Delegates to the shared `isContainedIn` (ADR-4650): every call site here
+ * already resolved both operands itself (either lexically, before any
+ * filesystem call, or via realpathSync after a symlink) and needs only this
+ * comparison step — the exact already-resolved-caller case `isContainedIn`
+ * documents.
  */
 function escapesRoot(abs, root) {
-  const rel = path.relative(root, abs);
-  return rel === '..' || rel.startsWith(`..${path.sep}`) || path.isAbsolute(rel);
+  return !isContainedIn(abs, root);
 }
 
 /**

package/scripts/gen-inventory-manifest.cjs

@@ -91,6 +91,18 @@ const NESTED_FAMILIES = [
     subdir: 'steps',
     filter: (f) => f.endsWith('.md'),
   },
+  {
+    name: 'workflow_detail',
+    root: path.join(ROOT, 'gsd-core', 'workflows'),
+    subdir: 'detail',
+    filter: (f) => f.endsWith('.md'),
+  },
+  {
+    name: 'workflow_templates',
+    root: path.join(ROOT, 'gsd-core', 'workflows'),
+    subdir: 'templates',
+    filter: (f) => f.endsWith('.md'),
+  },
 ];
 
 /**