feat(ci): add global hash skip planning (#7185)

* feat(ci): add global hash skip planning

* refactor(ci): remove superseded hash skip cache

* refactor(ci): keep scope trust in planner

* fix(ci): run scope goldens for planner changes

Generated-By: looper 0.11.2 (runner=fixer, agent=codex)

* fix(ci): publish hash state after successful validation

Generated-By: looper 0.11.2 (runner=fixer, agent=codex)

---------

Co-authored-by: Looper <looper@noreply.github.com>

Author: PerishCode

.github/AGENTS.md

@@ -11,8 +11,9 @@ Before changing GitHub automation, read the current versions of:
 - `.github/workflows/autofix.atom.yml`
 - `.github/workflows/report.atom.yml`
 - `.github/scripts/handoff.py`
-- `scripts/scopes.ts`
-- `specs/current/ci.md` when changing scope rules, confidence tiers, or guards
+- `.github/config/runners.json`, `.github/config/scopes.json`, and `.github/config/hash.json`
+- `.github/scripts/runners.py`, `.github/scripts/scopes.py`, and `.github/scripts/hash.py`
+- `specs/current/ci.md` when changing scope rules, confidence tiers, or planner invariants
 - `e2e/tests/packaged-smoke-workflow.test.ts`
 - `scripts/approve-fork-pr-workflows.ts` and `e2e/tests/scripts/approve-fork-pr-workflows.test.ts` when touching fork PR approval behavior
 
@@ -26,7 +27,7 @@ Business layer:
 
 - Business workflows decide what happened and what should be requested next.
 - `ci.yml` is the main low-privilege PR, merge-queue, and manual validation gate (application merge bar only).
-- `ci.yml` should run validation, decide scopes, and produce typed handoff artifacts.
+- `ci.yml` should resolve runners, compose scope and hash decisions in its Linux `plan` job, run validation, and produce typed handoff artifacts.
 - Packaging checks are standalone and outside the merge gate: `nix.yml` (flake check) and `docker-image.yml` (image validate + publish). Do not re-attach them to `Validate workspace`.
 - Business workflows should not perform trusted writes to PR comments or branches when a capability workflow can do it.
 
@@ -51,6 +52,21 @@ Default rule: do not add a new domain-specific follow-on workflow such as `foo.c
 
 New workflow-owned helpers should usually live under `.github/scripts/`. Prefer TypeScript for project-owned scripts in general, but Python is acceptable for small GitHub runner glue when stdlib portability and low setup cost matter. Keep such exceptions narrow and covered by `pnpm guard` policy.
 
+The CI control plane is deliberately Linux-only and stdlib-only. Runner classes,
+scope rules, and hash declarations live in `.github/config/`; their Python
+entrypoints initialize metadata before workload runners start. A Windows job
+must never invoke these scripts. Keep the four layers independent: runner
+placement, changed-file scopes, input hashes, and fine-grained commands inside
+a workload.
+
+`hash.py` is a static comparison register, not a success cache. It reads the
+previous identity-to-hash map restored by Actions cache, computes the current
+map from Git inputs, and replaces the local state immediately. The plan carries
+that pending map to `validate`, which publishes it only after the gate succeeds;
+a failed run therefore cannot authorize identical-input skips on a fresh retry.
+Only a workload's YAML `if` gives the comparison skip semantics; cache loss or
+corruption starts cold.
+
 ## Handoff contract
 
 Use `.github/scripts/handoff.py` for all CI follow-on artifact names and paths. The canonical layout is:
@@ -125,13 +141,14 @@ Keep `.github/workflows/ci.yml` as the only approved workflow path unless a main
    - Same-repo patch: produce `handoff/autofix` and let `autofix.atom.yml` consume it.
    - Rich/generated comment: produce `handoff/report` and let `report.atom.yml` materialize and upsert it.
    - New naming, paths, or metadata: update `.github/scripts/handoff.py`.
-2. Update scope routing in `scripts/scopes.ts` when a workflow/script should trigger a validation lane.
-3. Update topology coverage in `e2e/tests/packaged-smoke-workflow.test.ts` or the relevant script test.
-4. Run the focused checks:
+2. Update scope routing in `.github/config/scopes.json`, then run `python3 .github/scripts/scopes.py validate`.
+3. Declare workload input closure in `.github/config/hash.json`; use `"*"` until a narrower set has high-confidence evidence.
+4. Update topology coverage in `e2e/tests/packaged-smoke-workflow.test.ts` or the relevant script test.
+5. Run the focused checks:
    - `python3 .github/scripts/handoff.py self-check`
    - `actionlint -color`
    - `pnpm --filter @open-design/e2e test tests/packaged-smoke-workflow.test.ts`
-5. Run repo-level checks before handing off:
+6. Run repo-level checks before handing off:
    - `pnpm guard`
    - `pnpm typecheck`
 

.github/actions/hash-skip/action.yml

@@ -0,0 +1,41 @@
+{
+  "schema": { "version": 1 },
+  "suites": {
+    "ci-control": [
+      ".github/config/hash.json",
+      ".github/config/scopes.json",
+      ".github/scripts/hash.py",
+      ".github/scripts/scopes.py",
+      ".github/scripts/lib/",
+      ".github/workflows/ci.yml"
+    ],
+    "web": [
+      "apps/web/", "packages/components/", "packages/contracts/", "packages/host/",
+      "packages/platform/", "packages/release/", "packages/sidecar/", "packages/sidecar-proto/",
+      "package.json", "pnpm-lock.yaml", "pnpm-workspace.yaml"
+    ],
+    "tools-pack": [
+      "tools/pack/", "apps/packaged/", "apps/desktop/", "packages/components/", "packages/host/",
+      "packages/platform/", "packages/release/", "packages/sidecar/", "packages/sidecar-proto/",
+      "package.json", "pnpm-lock.yaml", "pnpm-workspace.yaml"
+    ],
+    "ui": [
+      "suite://web", "apps/daemon/", "e2e/", ".github/actions/setup-playwright/",
+      ".github/actions/setup-workspace/"
+    ]
+  },
+  "workflows": {
+    "ci": {
+      "static_gate": ["*"],
+      "preflight": ["*"],
+      "workspace_unit_tests": ["*"],
+      "daemon_unit_tests": ["*"],
+      "windows_tools_pack_payload_tests": ["*"],
+      "web_workspace_tests": ["*"],
+      "e2e_vitest": ["*"],
+      "playwright_critical": ["*"],
+      "ui_p0": ["*"],
+      "playwright_visual": ["*"]
+    }
+  }
+}

.github/config/hash.json

@@ -0,0 +1,50 @@
+{
+  "schema": { "version": 1 },
+  "defaultMode": "default",
+  "aliases": { "performance": "default" },
+  "profiles": {
+    "github.ubuntu": ["ubuntu-24.04"],
+    "github.windows": ["windows-latest"],
+    "blacksmith.small": ["blacksmith-4vcpu-ubuntu-2404"],
+    "blacksmith.large": ["blacksmith-8vcpu-ubuntu-2404"],
+    "nexu.small": ["nexu-runners-small"],
+    "nexu.medium": ["nexu-runners-medium"],
+    "nexu.large": ["nexu-runners-large"],
+    "nexu.xlarge": ["nexu-runners-xlarge"]
+  },
+  "modes": {
+    "default": {
+      "control": "nexu.small",
+      "general_medium": "nexu.medium",
+      "workspace_unit": "nexu.medium",
+      "windows_tools": "github.windows",
+      "js_hot": "nexu.medium",
+      "ui_hot": "nexu.large",
+      "ui_p0": "nexu.medium",
+      "ui_p0_heavy": "nexu.xlarge",
+      "visual_hot": "nexu.large"
+    },
+    "economic": {
+      "control": "github.ubuntu",
+      "general_medium": "github.ubuntu",
+      "workspace_unit": "github.ubuntu",
+      "windows_tools": "github.windows",
+      "js_hot": "github.ubuntu",
+      "ui_hot": "github.ubuntu",
+      "ui_p0": "github.ubuntu",
+      "ui_p0_heavy": "github.ubuntu",
+      "visual_hot": "github.ubuntu"
+    },
+    "blacksmith": {
+      "control": "blacksmith.small",
+      "general_medium": "blacksmith.small",
+      "workspace_unit": "blacksmith.small",
+      "windows_tools": "github.windows",
+      "js_hot": "blacksmith.small",
+      "ui_hot": "blacksmith.large",
+      "ui_p0": "blacksmith.large",
+      "ui_p0_heavy": "blacksmith.large",
+      "visual_hot": "blacksmith.large"
+    }
+  }
+}

.github/config/runners.json

@@ -0,0 +1,199 @@
+{
+  "schema": { "version": 1 },
+  "effects": [
+    "daemon_tests_required",
+    "web_tests_required",
+    "tools_dev_tests_required",
+    "tools_pack_tests_required",
+    "ui_critical_validation_required",
+    "ui_p0_validation_required",
+    "visual_validation_required",
+    "workspace_validation_required"
+  ],
+  "matches": {
+    "daemon-runtime-definition": {
+      "prefixes": ["apps/daemon/src/runtimes/defs/"],
+      "exact": [
+        "apps/daemon/src/runtimes/capabilities.ts",
+        "apps/daemon/src/runtimes/local-profiles.ts",
+        "apps/daemon/src/runtimes/metadata.ts",
+        "apps/daemon/src/runtimes/registry.ts",
+        "apps/daemon/tests/runtimes/agent-args.test.ts",
+        "apps/daemon/tests/runtimes/antigravity-model-lock.test.ts",
+        "apps/daemon/tests/runtimes/atomcode.test.ts",
+        "apps/daemon/tests/runtimes/byok-opencode.test.ts",
+        "apps/daemon/tests/runtimes/chat-run-inactivity-timeout.test.ts",
+        "apps/daemon/tests/runtimes/claude-resume-args.test.ts",
+        "apps/daemon/tests/runtimes/codebuddy.test.ts",
+        "apps/daemon/tests/runtimes/codex-resume-args.test.ts",
+        "apps/daemon/tests/runtimes/detection-resilience.test.ts",
+        "apps/daemon/tests/runtimes/opencode-resume-args.test.ts",
+        "apps/daemon/tests/runtimes/registry-and-args.test.ts",
+        "apps/daemon/tests/runtimes/trae-cli.test.ts"
+      ]
+    },
+    "certain-exempt": {
+      "prefixes": [".vscode/", ".idea/", "docs/", "apps/landing-page/", ".github/ISSUE_TEMPLATE/"],
+      "exact": ["LICENSE", ".github/CODEOWNERS"],
+      "exclude": ["match://daemon-doc"]
+    },
+    "daemon-doc": { "exact": ["docs/agent-adapters.md"] },
+    "packaged-leaf": {
+      "prefixes": [
+        "apps/desktop/src/", "apps/desktop/tests/", "apps/packaged/src/", "apps/packaged/tests/",
+        "tools/pack/src/", "tools/pack/tests/", "tools/pack/resources/"
+      ]
+    },
+    "daemon-core": {
+      "prefixes": ["apps/daemon/src/", "apps/daemon/tests/"],
+      "exact": ["docs/agent-adapters.md"],
+      "exclude": ["match://daemon-runtime-definition", "prefix://apps/daemon/src/sidecar/"]
+    },
+    "medium-exempt": {
+      "prefixes": ["nix/"],
+      "exact": [
+        ".gitignore", ".editorconfig", "flake.nix", "flake.lock",
+        ".github/workflows/landing-page-ci.yml", ".github/workflows/landing-page-staging.yml",
+        ".github/workflows/landing-page-production.yml", ".github/workflows/blog-indexing-on-deploy.yml",
+        ".github/workflows/autofix.atom.yml", ".github/workflows/comment.atom.yml",
+        ".github/workflows/report.atom.yml", ".github/workflows/docker-image.yml", ".github/workflows/nix.yml"
+      ],
+      "regexes": ["\\.(?:md|mdx|txt)$"],
+      "exclude": ["match://certain-surface"]
+    },
+    "certain-surface": {
+      "include": ["match://certain-exempt", "match://packaged-leaf", "match://daemon-core"]
+    },
+    "workspace-exempt": {
+      "include": ["match://certain-exempt", "match://medium-exempt", "match://packaged-leaf", "match://daemon-core"]
+    },
+    "ui-critical-exempt": {
+      "include": ["match://certain-exempt", "match://medium-exempt", "match://daemon-core"],
+      "prefixes": ["apps/desktop/", "apps/packaged/", "tools/pack/"]
+    }
+  },
+  "rules": [
+    {
+      "id": "certain-exempt-surface", "match": { "include": ["match://certain-exempt"] },
+      "effects": [], "confidence": "certain"
+    },
+    {
+      "id": "exempt-surface", "match": { "include": ["match://medium-exempt"] },
+      "effects": [], "confidence": "medium"
+    },
+    {
+      "id": "certain-daemon-core", "match": { "include": ["match://daemon-core"] },
+      "effects": ["daemon_tests_required", "ui_critical_validation_required", "ui_p0_validation_required", "workspace_validation_required"],
+      "confidence": "certain"
+    },
+    {
+      "id": "daemon-sources",
+      "match": {
+        "prefixes": ["apps/daemon/", "packages/release/", "packages/contracts/", "packages/platform/", "packages/sidecar/", "packages/sidecar-proto/"],
+        "exclude": ["match://daemon-core"]
+      },
+      "effects": ["daemon_tests_required"], "confidence": "medium"
+    },
+    {
+      "id": "web-sources",
+      "match": { "prefixes": ["apps/web/", "packages/release/", "packages/components/", "packages/contracts/", "packages/host/", "packages/platform/", "packages/sidecar/", "packages/sidecar-proto/"] },
+      "effects": ["web_tests_required"], "confidence": "medium"
+    },
+    {
+      "id": "runtime-content",
+      "match": { "prefixes": ["scripts/", "assets/", "skills/", "prompt-templates/", "design-systems/", "design-templates/", "craft/"] },
+      "effects": ["daemon_tests_required", "web_tests_required"], "confidence": "medium"
+    },
+    {
+      "id": "script-contract-tests", "match": { "prefixes": ["e2e/tests/scripts/"] },
+      "effects": ["daemon_tests_required", "web_tests_required"], "confidence": "medium"
+    },
+    {
+      "id": "tools-dev-sources",
+      "match": { "prefixes": ["tools/dev/", "packages/platform/", "packages/sidecar/", "packages/sidecar-proto/"] },
+      "effects": ["tools_dev_tests_required"], "confidence": "medium"
+    },
+    {
+      "id": "certain-packaged-leaf-sources", "match": { "include": ["match://packaged-leaf"] },
+      "effects": ["tools_dev_tests_required", "tools_pack_tests_required", "workspace_validation_required"],
+      "confidence": "certain"
+    },
+    {
+      "id": "tools-pack-sources",
+      "match": {
+        "prefixes": ["tools/pack/", "apps/packaged/", "apps/desktop/", "packages/release/", "packages/components/", "packages/host/", "packages/platform/", "packages/sidecar/", "packages/sidecar-proto/"],
+        "exclude": ["match://packaged-leaf"]
+      },
+      "effects": ["tools_pack_tests_required"], "confidence": "medium"
+    },
+    {
+      "id": "workspace-manifests-and-ci",
+      "match": {
+        "exact": ["package.json", "pnpm-lock.yaml", "pnpm-workspace.yaml", ".github/workflows/ci.yml", "e2e/package.json"],
+        "regexes": ["^apps/[^/]+/package\\.json$", "^packages/[^/]+/package\\.json$", "^tools/[^/]+/package\\.json$"]
+      },
+      "effects": ["daemon_tests_required", "web_tests_required", "tools_dev_tests_required", "tools_pack_tests_required"],
+      "confidence": "medium"
+    },
+    {
+      "id": "ui-p0-surface",
+      "match": {
+        "prefixes": ["apps/web/", "apps/daemon/", "packages/release/", "packages/components/", "packages/contracts/", "packages/host/", "packages/platform/", "packages/sidecar/", "packages/sidecar-proto/", "e2e/ui/", "e2e/lib/", "e2e/resources/", "e2e/scripts/", ".github/actions/setup-playwright/", ".github/actions/setup-workspace/"],
+        "exact": ["e2e/package.json", "e2e/playwright.config.ts", "package.json", "pnpm-lock.yaml", "pnpm-workspace.yaml", ".github/workflows/ci.yml", ".github/workflows/ui-extended-main.yml"],
+        "exclude": ["match://daemon-core"]
+      },
+      "effects": ["ui_p0_validation_required"], "confidence": "medium"
+    },
+    {
+      "id": "visual-surface",
+      "match": {
+        "prefixes": ["apps/web/", "e2e/lib/playwright/", ".github/actions/setup-playwright/", ".github/actions/setup-workspace/"],
+        "exact": ["e2e/package.json", "e2e/playwright.visual.config.ts", "e2e/scripts/playwright.ts", "e2e/scripts/visual-report.ts", "pnpm-lock.yaml", ".github/scripts/handoff.py", ".github/workflows/ci.yml", ".github/workflows/comment.atom.yml", ".github/workflows/report.atom.yml", ".github/workflows/visual-baseline.yml"],
+        "regexes": ["^e2e/ui/visual-[^/]+\\.test\\.ts$"]
+      },
+      "effects": ["visual_validation_required"], "confidence": "medium"
+    },
+    {
+      "id": "ci-control-plane",
+      "match": {
+        "prefixes": [".github/config/"],
+        "exact": [
+          ".github/scripts/scopes.py", ".github/scripts/hash.py", ".github/scripts/runners.py",
+          ".github/scripts/lib/config.py", ".github/scripts/lib/github.py"
+        ]
+      },
+      "effects": ["web_tests_required", "workspace_validation_required"], "confidence": "medium"
+    },
+    {
+      "id": "ci-rerun-infra-cancel-surface",
+      "match": { "exact": [".github/workflows/rerun.atom.yml", ".github/scripts/rerun_infra_cancel.py", "e2e/tests/packaged-smoke-workflow.test.ts"] },
+      "effects": ["web_tests_required", "workspace_validation_required"], "confidence": "medium"
+    },
+    {
+      "id": "workspace-fallback", "match": { "exclude": ["match://workspace-exempt"] },
+      "effects": ["workspace_validation_required"], "confidence": "medium"
+    },
+    {
+      "id": "ui-critical-fallback", "match": { "exclude": ["match://ui-critical-exempt"] },
+      "effects": ["ui_critical_validation_required"], "confidence": "medium"
+    }
+  ],
+  "matrices": {
+    "ui_p0": [
+      { "name": "entry-settings", "shard": "entry-settings" },
+      { "name": "project-workspace", "shard": "project-workspace" },
+      { "name": "project-workspace-editor", "shard": "project-workspace-editor" },
+      { "name": "project-collab", "shard": "project-collab" },
+      { "name": "project-runtime", "shard": "project-runtime" },
+      { "name": "workspace-restoration", "shard": "workspace-restoration" }
+    ],
+    "visual": [
+      { "name": "entry-navigation", "files": "ui/visual-entry.test.ts ui/visual-navigation.test.ts" },
+      { "name": "settings-workspace", "files": "ui/visual-settings.test.ts ui/visual-workspace.test.ts" }
+    ]
+  },
+  "uiP0Shadow": {
+    "match": "daemon-runtime-definition",
+    "matrixNames": ["entry-settings", "project-workspace", "project-collab", "project-runtime"]
+  }
+}