Stability remainder: browser automation limits, provider usage, single-instance arbitration, CI release pipeline

.github/workflows/ci-macos-compat.yml

@@ -153,12 +153,19 @@ jobs:
           xcrun --sdk macosx --show-sdk-path
           sw_vers
 
+      - name: Resolve Ghostty revision
+        id: ghostty-revision
+        run: |
+          set -euo pipefail
+          revision="$(./scripts/ghostty_cache_revision.sh)"
+          printf 'revision=%s\n' "$revision" >> "$GITHUB_OUTPUT"
+
       - name: Cache GhosttyKit.xcframework
         id: cache-ghosttykit
         uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4
         with:
           path: GhosttyKit.xcframework
-          key: ghosttykit-v2-${{ hashFiles('.gitmodules', 'ghostty') }}
+          key: ghosttykit-v3-${{ steps.ghostty-revision.outputs.revision }}
 
       - name: Set up Zig 0.16.0
         run: |

.github/workflows/ci.yml

@@ -4,29 +4,6 @@ on:
   push:
     branches:
       - main
-    paths:
-      - ".github/workflows/ci.yml"
-      - ".github/workflows/ci-macos-compat.yml"
-      - ".github/workflows/build-ghosttykit.yml"
-      - "Sources/**"
-      - "CLI/**"
-      - "CLI-MCP/**"
-      - "daemon/**"
-      - "programaTests/**"
-      - "tests/**"
-      - "tests_v2/**"
-      - "vendor/**"
-      - "scripts/**"
-      - "GhosttyTabs.xcodeproj/**"
-      # Both forms are required: "ghostty/**" matches file changes when the
-      # submodule content is diffed, but a submodule POINTER bump records the
-      # bare gitlink path "ghostty", which "ghostty/**" does not match --
-      # without the exact entry, fork-bump commits skip CI (and therefore
-      # never auto-ship).
-      - "ghostty"
-      - "ghostty/**"
-      - "vendor/bonsplit/**"
-      - ".gitmodules"
   pull_request:
     paths:
       - "Sources/**"
@@ -36,14 +13,22 @@ on:
       - "programaTests/**"
       - "tests/**"
       - "tests_v2/**"
+      - "Resources/**"
+      - "Assets.xcassets/**"
       - "vendor/**"
       - "scripts/**"
       - ".github/workflows/ci.yml"
       - ".github/workflows/ci-macos-compat.yml"
       - ".github/workflows/build-ghosttykit.yml"
+      - ".github/workflows/release.yml"
       - "GhosttyTabs.xcodeproj/**"
-      # Same as the push filter: the bare "ghostty" entry catches submodule
-      # pointer bumps, which "ghostty/**" alone misses.
+      - "programa.entitlements"
+      - "programa-Bridging-Header.h"
+      - "ghostty.h"
+      - "session_escrow_shim.c"
+      - "session_escrow_shim.h"
+      # The bare "ghostty" entry catches submodule pointer bumps, which
+      # "ghostty/**" alone misses.
       - "ghostty"
       - "ghostty/**"
       - ".gitmodules"
@@ -106,51 +91,42 @@ jobs:
           HEAD_SHA="${{ github.event.pull_request.head.sha }}"
           git fetch --no-tags origin "${BASE_SHA}" "${HEAD_SHA}"
           CHANGED_FILES="$(git diff --name-only "${BASE_SHA}...${HEAD_SHA}")"
-          RUN_APP_JOBS=false
-          RUN_REMOTE_DAEMON_JOBS=false
-          if [[ -z "${CHANGED_FILES}" ]]; then
-            RUN_APP_JOBS=true
-            RUN_REMOTE_DAEMON_JOBS=true
+          CLASSIFICATION="$(printf '%s' "$CHANGED_FILES" | ./scripts/classify_ci_changes.sh)"
+          APP_OUTPUT="${CLASSIFICATION%%$'\n'*}"
+          REMOTE_OUTPUT="${CLASSIFICATION#*$'\n'}"
+
+          if [[ "$APP_OUTPUT" == "$CLASSIFICATION" || "$REMOTE_OUTPUT" == *$'\n'* ]]; then
+            echo "CI change classifier returned an invalid output shape" >&2
+            exit 1
           fi
 
-          while IFS= read -r path; do
-            [[ -z "$path" ]] && continue
-
-            case "$path" in
-              # Documentation and prose
-              *.md|docs/*|plans/*|AGENTS.md|CHANGELOG.md|PROJECTS.md|TODO.md|README.md|LICENSE*|THIRD_PARTY_LICENSES.md|.editorconfig|.gitattributes|.gitignore|*.png|*.jpg|*.jpeg|*.gif|*.webp|*.svg)
-                continue
-                ;;
-              # Repository metadata / workflow-only edits are not app/runtime changes
-              .github/*)
-                continue
-                ;;
-              # Localization-only resource edits are scoped out per request
-              Resources/*.xcstrings|Resources/*/*.xcstrings|Resources/*.strings|Resources/*/*.strings)
-                continue
-                ;;
-              # Explicitly skip doc-only translation assets
-              Resources/*.lproj/*)
-                continue
-                ;;
-              daemon/**)
-                RUN_REMOTE_DAEMON_JOBS=true
-                ;;
-              *)
-                RUN_APP_JOBS=true
-                break
-                ;;
-            esac
-          done <<< "$CHANGED_FILES"
+          case "$APP_OUTPUT" in
+            run_app_jobs=true) RUN_APP_JOBS=true ;;
+            run_app_jobs=false) RUN_APP_JOBS=false ;;
+            *)
+              echo "CI change classifier returned an invalid app result" >&2
+              exit 1
+              ;;
+          esac
+
+          case "$REMOTE_OUTPUT" in
+            run_remote_daemon_jobs=true) RUN_REMOTE_DAEMON_JOBS=true ;;
+            run_remote_daemon_jobs=false) RUN_REMOTE_DAEMON_JOBS=false ;;
+            *)
+              echo "CI change classifier returned an invalid daemon result" >&2
+              exit 1
+              ;;
+          esac
 
-          echo "run_app_jobs=${RUN_APP_JOBS}" >> "$GITHUB_OUTPUT"
-          echo "run_remote_daemon_jobs=${RUN_REMOTE_DAEMON_JOBS}" >> "$GITHUB_OUTPUT"
+          printf '%s\n' "$CLASSIFICATION" >> "$GITHUB_OUTPUT"
           {
             echo "### CI scope decision"
             if [[ "$RUN_APP_JOBS" == "true" ]]; then
               echo "Changed file set contains app-relevant changes; running full macOS jobs."
+            elif [[ "$RUN_REMOTE_DAEMON_JOBS" == "true" ]]; then
+              echo "Changed file set contains daemon-only changes; running remote daemon jobs."
             else
-              echo "Pull request appears docs/localization-only; skipping heavy app/daemon jobs."
+              echo "Pull request appears docs/workflow/localization-only; skipping heavy app/daemon jobs."
             fi
             echo ""
             echo "Changed files:"
@@ -181,6 +157,24 @@ jobs:
       - name: Validate release artifact architecture checks
         run: ./tests/test_ci_universal_release_settings.sh
 
+      - name: Validate rolling release publication
+        run: ./tests/test_rolling_release_publication.sh
+
+      - name: Validate rolling release state transitions
+        run: node --test scripts/rolling_release_state.test.js
+
+      - name: Validate release build identity
+        run: node --test scripts/release_build_identity.test.js
+
+      - name: Validate milestone payload handoff
+        run: node --test scripts/milestone_payload.test.js
+
+      - name: Validate milestone release publication
+        run: ./tests/test_milestone_release_publication.sh
+
+      - name: Validate Sparkle monotonic release guard
+        run: node --test scripts/sparkle_monotonic_guard.test.js
+
       - name: Validate release asset guard
         run: node scripts/release_asset_guard.test.js
 
@@ -243,15 +237,28 @@ jobs:
       - name: Validate Release reload artifact discovery
         run: ./tests/test_reloadp_programa_artifact.sh
 
+      - name: Validate Ghostty cache revision
+        run: ./tests/test_ghostty_cache_revision.sh
+
+      - name: Validate CI change classification
+        run: ./tests/test_ci_change_classification.sh
+
       - name: Validate reload entrypoint artifacts and dependency preparation
         run: ./tests/test_reload_entrypoints_artifacts.sh
 
+      - name: Resolve Ghostty revision
+        id: ghostty-revision
+        run: |
+          set -euo pipefail
+          revision="$(./scripts/ghostty_cache_revision.sh)"
+          printf 'revision=%s\n' "$revision" >> "$GITHUB_OUTPUT"
+
       - name: Cache GhosttyKit.xcframework
         id: cache-ghosttykit
         uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4
         with:
           path: GhosttyKit.xcframework
-          key: ghosttykit-v2-${{ hashFiles('.gitmodules', 'ghostty') }}
+          key: ghosttykit-v3-${{ steps.ghostty-revision.outputs.revision }}
 
       - name: Download pre-built GhosttyKit.xcframework
         if: steps.cache-ghosttykit.outputs.cache-hit != 'true'
@@ -453,12 +460,19 @@ jobs:
           sudo xcode-select -s "$XCODE_DIR" || true
           xcodebuild -version
 
+      - name: Resolve Ghostty revision
+        id: ghostty-revision
+        run: |
+          set -euo pipefail
+          revision="$(./scripts/ghostty_cache_revision.sh)"
+          printf 'revision=%s\n' "$revision" >> "$GITHUB_OUTPUT"
+
       - name: Cache GhosttyKit.xcframework
         id: cache-ghosttykit-tests-v2
         uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4
         with:
           path: GhosttyKit.xcframework
-          key: ghosttykit-v2-${{ hashFiles('.gitmodules', 'ghostty') }}
+          key: ghosttykit-v3-${{ steps.ghostty-revision.outputs.revision }}
 
       - name: Download pre-built GhosttyKit.xcframework
         if: steps.cache-ghosttykit-tests-v2.outputs.cache-hit != 'true'
@@ -595,12 +609,19 @@ jobs:
           sudo xcode-select -s "$XCODE_DIR" || true
           xcodebuild -version
 
+      - name: Resolve Ghostty revision
+        id: ghostty-revision
+        run: |
+          set -euo pipefail
+          revision="$(./scripts/ghostty_cache_revision.sh)"
+          printf 'revision=%s\n' "$revision" >> "$GITHUB_OUTPUT"
+
       - name: Cache GhosttyKit.xcframework
         id: cache-ghosttykit-lag
         uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4
         with:
           path: GhosttyKit.xcframework
-          key: ghosttykit-v2-${{ hashFiles('.gitmodules', 'ghostty') }}
+          key: ghosttykit-v3-${{ steps.ghostty-revision.outputs.revision }}
 
       - name: Download pre-built GhosttyKit.xcframework
         if: steps.cache-ghosttykit-lag.outputs.cache-hit != 'true'