Merge main into ci/main-push-concurrency for the release batch

Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>

.github/workflows/_lint.yml

@@ -3,13 +3,19 @@
 name: Lint & Security
 
 on:
-  workflow_call: {}
+  workflow_call:
+    inputs:
+      lanes:
+        description: 'PR lane selection (scripts/ci/select-lanes.sh JSON list); "all" = every job (dry run, release)'
+        type: string
+        default: all
 
 permissions:
   contents: read
 
 jobs:
   lint:
+    if: ${{ inputs.lanes == 'all' || contains(fromJSON(inputs.lanes), 'lint') }}
     # Pinned, not ubuntu-latest: the LLVM install below adds an
     # apt.llvm.org llvm-toolchain-NOBLE repo, which is 24.04 by name. When
     # GitHub moves ubuntu-latest to the next LTS this job breaks on a day
@@ -64,6 +70,7 @@ jobs:
   # provability (never suppressed — the NOLINT ban applies here too).
   # Vendored-tree diagnostics are path-filtered, mirroring .cppcheck.
   lint-mem:
+    if: ${{ inputs.lanes == 'all' || contains(fromJSON(inputs.lanes), 'lint-mem') }}
     # Pinned for the same reason as `lint`: llvm-toolchain-noble-21 below.
     runs-on: ubuntu-24.04
     timeout-minutes: 60

.github/workflows/_security.yml

@@ -4,7 +4,12 @@
 name: Security Gate
 
 on:
-  workflow_call: {}
+  workflow_call:
+    inputs:
+      lanes:
+        description: 'PR lane selection (scripts/ci/select-lanes.sh JSON list); "all" = every job (dry run, release)'
+        type: string
+        default: all
 
 permissions:
   contents: read
@@ -23,6 +28,7 @@ jobs:
         run: scripts/security-vendored.sh
 
   license-gate:
+    if: ${{ inputs.lanes == 'all' || contains(fromJSON(inputs.lanes), 'license-gate') }}
     runs-on: ubuntu-latest
     timeout-minutes: 240
     steps:
@@ -39,6 +45,7 @@ jobs:
         run: scripts/audit-license-provenance.py
 
   codeql-gate:
+    if: ${{ inputs.lanes == 'all' || contains(fromJSON(inputs.lanes), 'codeql-gate') }}
     runs-on: ubuntu-latest
     timeout-minutes: 240
     # Without security-events:read this job inherits the workflow's

.github/workflows/_test.yml

@@ -16,6 +16,18 @@ on:
         description: 'Split each C-suite leg across parallel shard jobs (ubuntu x3, windows x2); off = one job per leg, byte-identical to the pre-shard topology'
         type: boolean
         default: false
+      shard_profile:
+        description: 'Shard counts when shard_suites is on: standard = ubuntu x3, windows x2 (dry run, release); pr = ubuntu x86 x1, ubuntu arm64 x2, windows x1 (fewer jobs re-paying setup)'
+        type: string
+        default: standard
+      lanes:
+        description: 'PR lane selection (scripts/ci/select-lanes.sh JSON list): only those legs and jobs run; "all" = every one (dry run, release)'
+        type: string
+        default: all
+      test_selection:
+        description: 'PR test selection (smart CI): the artifact the select-tests job uploaded; the test-unix and test-windows legs run only its tests. Empty = every test (dry run, release, and any PR the selection does not narrow)'
+        type: string
+        default: ''
 
 permissions:
   contents: read
@@ -30,18 +42,26 @@ jobs:
     outputs:
       unix: ${{ steps.set.outputs.unix }}
       windows: ${{ steps.set.outputs.windows }}
+      tsan: ${{ steps.set.outputs.tsan }}
+      has_unix: ${{ steps.set.outputs.has_unix }}
+      has_windows: ${{ steps.set.outputs.has_windows }}
+      has_tsan: ${{ steps.set.outputs.has_tsan }}
     steps:
       - name: Compute matrices
         id: set
         env:
           BROAD: ${{ inputs.broad_platforms }}
           SHARDS: ${{ inputs.shard_suites }}
+          SHARD_PROFILE: ${{ inputs.shard_profile }}
+          LANES: ${{ inputs.lanes }}
         run: |
+          # Every CORE leg is tagged with the lane (scripts/ci/select-lanes.sh)
+          # it serves; the tag is what lane selection filters on below.
           CORE_UNIX='[
-            {"os":"ubuntu-latest","cc":"gcc","cxx":"g++"},
-            {"os":"ubuntu-24.04-arm","cc":"gcc","cxx":"g++"},
-            {"os":"macos-14","cc":"cc","cxx":"c++"},
-            {"os":"macos-15-intel","cc":"cc","cxx":"c++"}
+            {"os":"ubuntu-latest","cc":"gcc","cxx":"g++","lane":"unix-x86"},
+            {"os":"ubuntu-24.04-arm","cc":"gcc","cxx":"g++","lane":"unix-arm64"},
+            {"os":"macos-14","cc":"cc","cxx":"c++","lane":"unix-macos14"},
+            {"os":"macos-15-intel","cc":"cc","cxx":"c++","lane":"unix-macos-intel"}
           ]'
           # Broad matrix legs are REQUIRED gates (no optional/continue-on-error
           # escape hatches): the release dry run must be all-green, every platform.
@@ -59,7 +79,7 @@ jobs:
           # interception crashed (interception_win: unhandled instruction). With
           # the native ARM64 toolchain ASan instruments native ARM64 code, so it
           # is a real (non-optional) gate, not a tolerated emulated-flake.
-          CORE_WIN='[{"os":"windows-latest","msystem":"CLANG64","pkg":"x86_64"}]'
+          CORE_WIN='[{"os":"windows-latest","msystem":"CLANG64","pkg":"x86_64","lane":"windows"}]'
           BROAD_WIN='[{"os":"windows-2025","msystem":"CLANG64","pkg":"x86_64"},{"os":"windows-11-arm","msystem":"CLANGARM64","pkg":"aarch64"}]'
           if [ "$BROAD" = "true" ]; then
             UNIX=$(jq -cn --argjson a "$CORE_UNIX" --argjson b "$BROAD_UNIX" '$a + $b')
@@ -68,6 +88,30 @@ jobs:
             UNIX=$(jq -cn --argjson a "$CORE_UNIX" '$a')
             WIN=$(jq -cn --argjson a "$CORE_WIN" '$a')
           fi
+          # The ThreadSanitizer legs (test-tsan), tagged the same way.
+          TSAN='[
+            {"os":"ubuntu-latest","cc":"clang","cxx":"clang++","lane":"tsan-x86"},
+            {"os":"ubuntu-24.04-arm","cc":"clang","cxx":"clang++","lane":"tsan-arm"},
+            {"os":"macos-14","cc":"cc","cxx":"c++","lane":"tsan-mac"}
+          ]'
+          # Lane selection. "all" (dry run, release) keeps every leg and drops
+          # the tags, so those matrices -- and their job names -- stay exactly
+          # as before lane selection. A PR keeps only its selected legs, and
+          # the tag stays in the job name, where ci-ok reads it back. An
+          # untagged leg could never be selected: that is a configuration
+          # error here, never a leg silently dropped.
+          if [ "$LANES" = "all" ]; then
+            UNIX=$(jq -c 'map(del(.lane))' <<< "$UNIX")
+            WIN=$(jq -c 'map(del(.lane))' <<< "$WIN")
+            TSAN=$(jq -c 'map(del(.lane))' <<< "$TSAN")
+          else
+            for M in "$UNIX" "$WIN" "$TSAN"; do
+              jq -e 'all(.[]; has("lane"))' <<< "$M" > /dev/null || { echo "::error::untagged test leg in $M"; exit 1; }
+            done
+            UNIX=$(jq -c --argjson sel "$LANES" 'map(select(.lane | IN($sel[])))' <<< "$UNIX")
+            WIN=$(jq -c --argjson sel "$LANES" 'map(select(.lane | IN($sel[])))' <<< "$WIN")
+            TSAN=$(jq -c --argjson sel "$LANES" 'map(select(.lane | IN($sel[])))' <<< "$TSAN")
+          fi
           # Suite sharding (opt-in via the shard_suites input): each platform's
           # C-suite run is split across N runner jobs. CBM_TEST_SHARD="i/N"
           # slices deterministically inside run-tests-parallel.sh; each
@@ -78,20 +122,37 @@ jobs:
           # shards); Windows gets 2 (every extra shard re-pays ~5 min of
           # MSYS2 setup); macOS stays at 1 — mac legs are not the critical
           # path and mac runner concurrency ceilings are the tightest.
+          # The pr profile shards less: a PR runs few legs and every shard
+          # re-pays its setup, so x86 and Windows run whole and only arm64,
+          # the slowest leg (~72 min unsharded), splits in two.
+          case "$SHARD_PROFILE" in
+            standard) N_X86=3; N_ARM=3; N_WIN=2 ;;
+            pr) N_X86=1; N_ARM=2; N_WIN=1 ;;
+            *) echo "::error::unknown shard_profile '$SHARD_PROFILE'"; exit 1 ;;
+          esac
           if [ "$SHARDS" = "true" ]; then
-            UNIX=$(jq -c '[.[] | . as $e
-              | (if ($e.os | startswith("ubuntu")) then 3 else 1 end) as $n
+            UNIX=$(jq -c --argjson x86 "$N_X86" --argjson arm "$N_ARM" '[.[] | . as $e
+              | (if ($e.os | startswith("ubuntu")) then
+                   (if ($e.os | endswith("-arm")) then $arm else $x86 end)
+                 else 1 end) as $n
               | range(1; $n + 1) as $i
               | $e + {shard: "\($i)/\($n)"}]' <<< "$UNIX")
-            WIN=$(jq -c '[.[] | . as $e
-              | range(1; 3) as $i
-              | $e + {shard: "\($i)/2"}]' <<< "$WIN")
+            WIN=$(jq -c --argjson n "$N_WIN" '[.[] | . as $e
+              | range(1; $n + 1) as $i
+              | $e + {shard: "\($i)/\($n)"}]' <<< "$WIN")
           fi
           echo "unix={\"include\":$UNIX}" >> "$GITHUB_OUTPUT"
           echo "windows={\"include\":$WIN}" >> "$GITHUB_OUTPUT"
+          echo "tsan={\"include\":$TSAN}" >> "$GITHUB_OUTPUT"
+          # GitHub rejects an empty matrix, so a job whose legs were all
+          # deselected is skipped through these flags instead.
+          echo "has_unix=$(jq 'length > 0' <<< "$UNIX")" >> "$GITHUB_OUTPUT"
+          echo "has_windows=$(jq 'length > 0' <<< "$WIN")" >> "$GITHUB_OUTPUT"
+          echo "has_tsan=$(jq 'length > 0' <<< "$TSAN")" >> "$GITHUB_OUTPUT"
 
   test-unix:
     needs: setup-matrix
+    if: ${{ needs.setup-matrix.outputs.has_unix == 'true' }}
     strategy:
       fail-fast: false
       matrix: ${{ fromJSON(needs.setup-matrix.outputs.unix) }}
@@ -160,12 +221,20 @@ jobs:
             ccache-test-${{ matrix.os }}-${{ matrix.cc }}-${{ github.ref }}-
             ccache-test-${{ matrix.os }}-${{ matrix.cc }}-
 
+      - name: Fetch the test selection
+        if: ${{ inputs.test_selection != '' }}
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: ${{ inputs.test_selection }}
+          path: ${{ runner.temp }}/test-selection
+
       - name: Test
         run: scripts/test.sh CC=${{ matrix.cc }} CXX=${{ matrix.cxx }}
         env:
           CBM_TEST_SHARD: ${{ matrix.shard }}
           CBM_TEST_LEG: ${{ matrix.os }}-${{ matrix.cc }}
           CBM_SKIP_PERF: ${{ inputs.skip_perf && '1' || '' }}
+          CBM_TEST_SELECTION_DIR: ${{ inputs.test_selection != '' && format('{0}/test-selection', runner.temp) || '' }}
           CCACHE_DIR: ${{ github.workspace }}/.ccache
           CCACHE_MAXSIZE: 1500M
 
@@ -205,6 +274,7 @@ jobs:
   # inode/flock behavior and Windows handle/link behavior are each gating,
   # without adding Node/Go provisioning to every sanitizer/container leg.
   test-package-wrappers:
+    if: ${{ inputs.lanes == 'all' || contains(fromJSON(inputs.lanes), 'pkg-wrappers') }}
     strategy:
       fail-fast: false
       matrix:
@@ -245,6 +315,7 @@ jobs:
   # parallel suite — catches what an older compiler-rt can miss. Same
   # canonical scripts/test.sh wave as every other leg.
   test-diag:
+    if: ${{ inputs.lanes == 'all' || contains(fromJSON(inputs.lanes), 'diag') }}
     # Pinned for the same reason as the lint jobs: the pinned diagnostic
     # toolchain below installs from llvm-toolchain-noble-21.
     runs-on: ubuntu-24.04
@@ -310,6 +381,7 @@ jobs:
   # list both venues now share. Zero use-of-uninitialized-value findings were
   # reported across the lane on either architecture.
   test-msan:
+    if: ${{ inputs.lanes == 'all' || contains(fromJSON(inputs.lanes), 'msan') }}
     runs-on: ubuntu-latest
     timeout-minutes: 180
     steps:
@@ -334,6 +406,7 @@ jobs:
   # so this leg is the ordinary ASan suite built with that toolchain and run
   # with detect_leaks=1. Mirrors the local `make -f Makefile.cbm test-lsan`.
   test-lsan-macos:
+    if: ${{ inputs.lanes == 'all' || contains(fromJSON(inputs.lanes), 'lsan-macos') }}
     runs-on: macos-latest
     timeout-minutes: 120
     steps:
@@ -372,13 +445,11 @@ jobs:
           key: ccache-lsan-${{ github.ref }}-${{ github.sha }}
 
   test-tsan:
+    needs: setup-matrix
+    if: ${{ needs.setup-matrix.outputs.has_tsan == 'true' }}
     strategy:
       fail-fast: false
-      matrix:
-        include:
-          - { os: ubuntu-latest, cc: clang, cxx: clang++ }
-          - { os: ubuntu-24.04-arm, cc: clang, cxx: clang++ }
-          - { os: macos-14, cc: cc, cxx: c++ }
+      matrix: ${{ fromJSON(needs.setup-matrix.outputs.tsan) }}
     runs-on: ${{ matrix.os }}
     timeout-minutes: 120
     steps:
@@ -431,6 +502,7 @@ jobs:
 
   test-windows:
     needs: setup-matrix
+    if: ${{ needs.setup-matrix.outputs.has_windows == 'true' }}
     strategy:
       fail-fast: false
       matrix: ${{ fromJSON(needs.setup-matrix.outputs.windows) }}
@@ -481,6 +553,13 @@ jobs:
             ccache-test-${{ matrix.os }}-${{ matrix.msystem }}-${{ github.ref }}-
             ccache-test-${{ matrix.os }}-${{ matrix.msystem }}-
 
+      - name: Fetch the test selection
+        if: ${{ inputs.test_selection != '' }}
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: ${{ inputs.test_selection }}
+          path: ${{ runner.temp }}/test-selection
+
       - name: Test
         shell: msys2 {0}
         # AddressSanitizer is unavailable on native ARM64 Windows (LLVM ships no
@@ -508,6 +587,7 @@ jobs:
           CBM_TEST_SHARD: ${{ matrix.shard }}
           CBM_TEST_LEG: ${{ matrix.os }}-${{ matrix.msystem }}
           CBM_SKIP_PERF: ${{ inputs.skip_perf && '1' || '' }}
+          CBM_TEST_SELECTION_DIR: ${{ inputs.test_selection != '' && format('{0}/test-selection', runner.temp) || '' }}
           CCACHE_DIR: ${{ github.workspace }}/.ccache
           CCACHE_MAXSIZE: 1500M
 
@@ -564,8 +644,12 @@ jobs:
         with:
           pattern: shard-manifest-*
           path: manifests
+      # A PR with no test leg selected uploads no manifest; the script
+      # accepts that only when the selection really holds no leg.
       - name: Verify cross-shard union per leg
-        run: repo/scripts/ci/verify-shard-union.sh manifests
+        env:
+          LANES: ${{ inputs.lanes }}
+        run: repo/scripts/ci/verify-shard-union.sh manifests --lanes "$LANES"
 
   # Windows product-surface regression guards. Distinct from test-windows above
   # (the sanitizer C suite): these drive a real product binary + external UI pack
@@ -576,6 +660,7 @@ jobs:
   # CLI arguments being mangled by the narrow-argv main() (#423/#20, fixed by the
   # wide-argv entrypoint that reads GetCommandLineW).
   test-windows-guards:
+    if: ${{ inputs.lanes == 'all' || contains(fromJSON(inputs.lanes), 'windows-guards') }}
     runs-on: windows-latest
     timeout-minutes: 60
     steps:

.github/workflows/pr.yml

@@ -1,7 +1,10 @@
-# PR validation: security gates + lint + full test suite. Builds, smoke and
-# soak stay maintainer-driven via the dry-run workflow_dispatch. Branch
+# PR validation: security gates + lint + the test legs this PR's changes need.
+# `changes` runs scripts/ci/select-lanes.sh on the PR's file list; every lane
+# job below runs only when selected (unknown paths, workflows, the harness,
+# Makefile.cbm and vendored code select everything). Builds, smoke and soak at
+# full breadth stay maintainer-driven via the dry-run workflow_dispatch. Branch
 # protection requires `dco` + `ci-ok` — a single stable summary context that
-# fails unless every PR stage succeeded.
+# fails unless every PR stage succeeded and every selected lane ran green.
 name: PR
 
 on:
@@ -21,6 +24,7 @@ concurrency:
 
 jobs:
   security:
+    needs: [changes]
     uses: ./.github/workflows/_security.yml
     # The called job requests security-events:read to count code-scanning
     # alerts; a reusable workflow cannot request more than its caller grants,
@@ -30,33 +34,91 @@ jobs:
       security-events: read
       actions: read
     secrets: inherit
+    with:
+      lanes: ${{ needs.changes.outputs.lanes }}
 
   lint:
+    needs: [changes]
+    if: ${{ contains(fromJSON(needs.changes.outputs.lanes), 'lint') || contains(fromJSON(needs.changes.outputs.lanes), 'lint-mem') }}
     uses: ./.github/workflows/_lint.yml
+    with:
+      lanes: ${{ needs.changes.outputs.lanes }}
+
+  # ── Smart CI, PR CI only: run only the tests this change can reach.
+  #    Active only while the repository variable TEST_IMPACT_MODE is `gate`;
+  #    unset (shadow) every test runs and test-impact-shadow only reports.
+  #    test-impact-select.sh --gate narrows only on a well-formed answer: a
+  #    failure of this job, a run-all answer or a lane that selects nothing
+  #    leaves `test` without a selection, and every test runs. ci-ok does not
+  #    need this job: when it breaks, PRs cost more minutes, never coverage.
+  #    Dry runs and releases never pass a selection.
+  select-tests:
+    needs: [changes]
+    if: ${{ vars.TEST_IMPACT_MODE == 'gate' }}
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+    permissions:
+      contents: read
+      actions: read # the merge base's team-artifact bundle (test-impact-artifact.yml)
+    outputs:
+      selection: ${{ steps.select.outputs.selection }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          # The PR merge commit and its base parent: the change to select for.
+          fetch-depth: 2
+          persist-credentials: false
+      - name: Build this checkout's engine
+        run: |
+          sudo apt-get update && sudo apt-get install -y zlib1g-dev
+          scripts/build.sh CC=gcc CXX=g++
+      - name: Select the tests
+        id: select
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: scripts/ci/test-impact-select.sh --binary build/c/codebase-memory-mcp --out "$RUNNER_TEMP/test-impact" --gate "$RUNNER_TEMP/test-selection"
+      - name: Upload the selection
+        if: ${{ steps.select.outputs.selection == 'narrowed' }}
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: test-selection
+          path: ${{ runner.temp }}/test-selection
+          if-no-files-found: error
+          overwrite: true
 
   test:
-    needs: [lint]
+    needs: [changes, lint, select-tests]
     if: ${{ !cancelled() && needs.lint.result == 'success' }}
     uses: ./.github/workflows/_test.yml
     with:
+      lanes: ${{ needs.changes.outputs.lanes }}
+      # Smart CI: only a successful select-tests run that narrowed passes a
+      # selection; skipped (shadow), failed, run-all and nothing-selected
+      # answers all run every test.
+      test_selection: ${{ needs.select-tests.result == 'success' && needs.select-tests.outputs.selection == 'narrowed' && 'test-selection' || '' }}
       # Perf assertions are timing-sensitive on shared runners; they stay in
       # dry runs and releases where a flaky red does not block a merge.
       skip_perf: true
-      # Iteration speed: split each C-suite leg across parallel shard jobs
-      # (ubuntu x3, windows x2; coverage re-proven every run by the
-      # shard-completeness job). Dry runs and releases shard identically.
+      # Iteration speed: split C-suite legs across parallel shard jobs
+      # (coverage re-proven every run by the shard-completeness job). The PR
+      # profile shards only arm64 (x2); x86 and Windows run whole, since each
+      # shard re-pays its setup. Dry runs and releases keep x3 / x2.
       shard_suites: true
+      shard_profile: pr
 
-  # ── Which files changed? Gate the (heavier) build+smoke on product code so
-  #    docs / CI / test-only PRs stay fast. ──
+  # ── Which lanes does this PR need? The changed files go through
+  #    scripts/ci/select-lanes.sh (tier, lanes, full, reasons); docs / CI /
+  #    test-only PRs stay fast, anything it cannot place runs everything. ──
   changes:
     runs-on: ubuntu-latest
     timeout-minutes: 5
     outputs:
-      product: ${{ steps.f.outputs.product }}
+      tier: ${{ steps.select.outputs.tier }}
+      full: ${{ steps.select.outputs.full }}
+      lanes: ${{ steps.select.outputs.lanes }}
+      smoke: ${{ steps.select.outputs.smoke }}
     steps:
-      - name: Detect product-code changes
-        id: f
+      - name: List the changed files
         env:
           GH_TOKEN: ${{ github.token }}
           PR: ${{ github.event.pull_request.number }}
@@ -64,7 +126,9 @@ jobs:
         run: |
           # The full .diff endpoint rejects large-but-valid PRs at 20k lines.
           # The paginated files endpoint remains filename-only for this gate.
-          if FILES=$(gh api --paginate "repos/$REPO/pulls/$PR/files?per_page=100" --jq '.[].filename'); then
+          # A rename lists its old path too, as the fallback's --no-renames
+          # diff does: moving a file away is a change to where it was.
+          if FILES=$(gh api --paginate "repos/$REPO/pulls/$PR/files?per_page=100" --jq '.[] | .filename, (.previous_filename // empty)'); then
             echo "file list: pulls/files API"
           else
             # The files endpoint renders the diff server-side too, and answers
@@ -81,31 +145,45 @@ jobs:
               "https://github.com/$REPO" "refs/pull/$PR/merge"
             FILES=$(git --git-dir="$CHANGES_GIT" diff --name-only --no-renames FETCH_HEAD^1 FETCH_HEAD)
           fi
-          printf '%s\n' "$FILES"
-          # A here-string, not a pipe: under this shell's pipefail, grep -q
-          # exits on its first match, printf dies of SIGPIPE once the list
-          # outgrows the pipe buffer, and the MATCH is then reported as a
-          # failure -- product=false, smoke skipped, on the largest PRs.
-          if grep -qE '^(src/|internal/|install\.(sh|ps1)|scripts/build\.sh|scripts/smoke-test\.sh|scripts/smoke-local\.sh|scripts/smoke-fixture-server\.py|scripts/gen-third-party-notices\.sh|scripts/env\.sh|test-infrastructure/vm/(vm-smoke\.sh|windows-user-path-guard\.ps1)|Makefile\.cbm)' <<<"$FILES"; then
-            echo "product=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "product=false" >> "$GITHUB_OUTPUT"
-          fi
+          printf '%s\n' "$FILES" > "$RUNNER_TEMP/changed-files.txt"
+          cat "$RUNNER_TEMP/changed-files.txt"
+
+      # The selector is PR code: it runs in its own step, after the
+      # token-bearing one, from a checkout that keeps no credentials.
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      # The pulls/files API lists at most 3000 files: the PR's own count lets
+      # the selector notice a cut list and select everything instead.
+      - name: Select lanes
+        id: select
+        env:
+          CHANGED_FILES: ${{ github.event.pull_request.changed_files }}
+        run: |
+          scripts/ci/select-lanes.sh --format github-output --expect-files "$CHANGED_FILES" "$RUNNER_TEMP/changed-files.txt" > "$RUNNER_TEMP/selection.txt"
+          cat "$RUNNER_TEMP/selection.txt"
+          cat "$RUNNER_TEMP/selection.txt" >> "$GITHUB_OUTPUT"
+          # pr-smoke's legs, each tagged with its lane (kept in the job name,
+          # where ci-ok reads it back); the job gets the selected ones.
+          SMOKE='[{"os":"ubuntu-latest","lane":"smoke-ubuntu"},{"os":"macos-14","lane":"smoke-mac"},{"os":"windows-latest","lane":"smoke-win"}]'
+          LANES=$(sed -n 's/^lanes=//p' "$RUNNER_TEMP/selection.txt")
+          echo "smoke={\"include\":$(jq -c --argjson sel "$LANES" 'map(select(.lane | IN($sel[])))' <<< "$SMOKE")}" >> "$GITHUB_OUTPUT"
 
   # ── Light smoke: build the PRODUCTION binary and run the core smoke on the
   #    three RELIABLE NATIVE platforms. Catches built-binary regressions at PR
   #    time (e.g. the Windows CreateProcess argv-quoting class that previously
   #    only surfaced in the release dry run). The full broad/emulated smoke stays
-  #    in the dry run. Only product-code PRs pay this; every leg gates.
+  #    in the dry run. Only the selected legs run (ubuntu from the extraction
+  #    tier up, all three for platform/packaging changes); every leg gates.
   #    The maintained local wrappers add a race-free release fixture so the
   #    download/checksum/install/update phases run here as well. ──
   pr-smoke:
     needs: [changes]
-    if: ${{ !cancelled() && needs.changes.outputs.product == 'true' }}
+    if: ${{ !cancelled() && needs.changes.result == 'success' && (contains(fromJSON(needs.changes.outputs.lanes), 'smoke-ubuntu') || contains(fromJSON(needs.changes.outputs.lanes), 'smoke-mac') || contains(fromJSON(needs.changes.outputs.lanes), 'smoke-win')) }}
     strategy:
       fail-fast: false
-      matrix:
-        os: [ubuntu-latest, macos-14, windows-latest]
+      matrix: ${{ fromJSON(needs.changes.outputs.smoke) }}
     runs-on: ${{ matrix.os }}
     timeout-minutes: 30
     steps:
@@ -177,27 +255,115 @@ jobs:
   # ── Waste sanitizer, REPORT-ONLY: memory + CPU waste on this repository and
   #    the per-function scaling lane (Linux). Deliberately NOT in ci-ok's needs:
   #    it uploads evidence and prints the ratchet, it never blocks a merge. Only
-  #    product-code PRs pay for it. ──
+  #    PRs whose selection holds the memwaste lane (memory core, memwaste
+  #    tooling, full runs) pay for it. ──
   memwaste:
     needs: [changes]
-    if: ${{ !cancelled() && needs.changes.outputs.product == 'true' }}
+    if: ${{ !cancelled() && needs.changes.result == 'success' && contains(fromJSON(needs.changes.outputs.lanes), 'memwaste') }}
     uses: ./.github/workflows/_memwaste.yml
     with:
       mode: pr
 
+  # ── Test-impact SHADOW, REPORT-ONLY: predicts from the code graph which C
+  #    suites this change can affect (the latest released binary indexes the
+  #    PR checkout; detect_changes at depth 15 against the base, mapped to
+  #    suites, with the selector's run-all triggers) and uploads the
+  #    prediction, so graph-based selection can be judged against what really
+  #    failed before anything gates on it. continue-on-error and NOT in
+  #    ci-ok's needs: it can never block or pass a merge. ──
+  test-impact-shadow:
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    continue-on-error: true
+    permissions:
+      contents: read
+      actions: read # the merge base's team-artifact bundle (test-impact-artifact.yml)
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          # The PR merge commit and its base parent: the diff to predict for.
+          fetch-depth: 2
+          persist-credentials: false
+      - name: Fetch the latest released binary
+        id: release
+        continue-on-error: true
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: scripts/ci/test-impact-shadow.sh --fetch-release "$RUNNER_TEMP/cbm-bin"
+      - name: Build the binary from this checkout (download failed)
+        if: ${{ steps.release.outcome == 'failure' }}
+        run: |
+          sudo apt-get update && sudo apt-get install -y zlib1g-dev
+          scripts/build.sh CC=gcc CXX=g++
+          mkdir -p "$RUNNER_TEMP/cbm-bin"
+          cp build/c/codebase-memory-mcp "$RUNNER_TEMP/cbm-bin/"
+      - name: Predict the impacted suites
+        run: scripts/ci/test-impact-shadow.sh --binary "$RUNNER_TEMP/cbm-bin/codebase-memory-mcp" --out "$RUNNER_TEMP/test-impact"
+      # The engine (test-impact select) is this checkout's own code: the
+      # released binary predates it, so the checkout is built either way.
+      - name: Build this checkout's engine
+        if: ${{ steps.release.outcome != 'failure' }}
+        run: |
+          sudo apt-get update && sudo apt-get install -y zlib1g-dev
+          scripts/build.sh CC=gcc CXX=g++
+      - name: Select with the team artifact (engine shadow)
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: scripts/ci/test-impact-select.sh --binary build/c/codebase-memory-mcp --out "$RUNNER_TEMP/test-impact"
+      - name: Upload the prediction
+        if: ${{ always() }}
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: test-impact-prediction
+          path: |
+            ${{ runner.temp }}/test-impact/prediction.json
+            ${{ runner.temp }}/test-impact/selection.json
+            ${{ runner.temp }}/test-impact/changed-files.txt
+            ${{ runner.temp }}/test-impact/selection-engine.json
+            ${{ runner.temp }}/test-impact/summary-engine.md
+          if-no-files-found: warn
+
+  # ── Docs-only and non-product PRs (tiers T0a, T0b) run the static contract
+  #    steps of the canonical test leg on their own: they police docs
+  #    surfaces (language counts, version metadata), test-infrastructure/ and
+  #    lint config too. Every test leg runs the same steps. ──
+  contracts:
+    needs: [changes]
+    if: ${{ !cancelled() && needs.changes.result == 'success' && contains(fromJSON(needs.changes.outputs.lanes), 'contracts') }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Contract steps only
+        run: scripts/test.sh --contracts-only
+
   ci-ok:
     # The one required context (besides dco) — fails unless every PR stage
-    # succeeded, so matrix renames can never silently deadlock merges. `skipped`
-    # is OK: pr-smoke skips on docs/CI/test-only PRs (changes.product == false).
-    needs: [security, lint, test, changes, pr-smoke]
+    # succeeded, so matrix renames can never silently deadlock merges, and
+    # every lane the selector chose ran green: `skipped` is OK only for a lane
+    # nobody selected (a selected lane that skipped is a silent gate loss).
+    # memwaste and the test-impact shadow are report-only and not needed here.
+    needs: [changes, security, lint, test, pr-smoke, contracts]
     if: ${{ always() }}
     runs-on: ubuntu-latest
     timeout-minutes: 5
+    # actions:read lists this run's jobs, the lane-level truth behind `needs`.
+    permissions:
+      contents: read
+      actions: read
     steps:
       # Needs a checkout (unlike before): the gate logic lives in the canonical
       # scripts/ci entry, not inline YAML (venue-parity contract).
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: All PR stages must have succeeded
+      - name: List this run's jobs
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          gh api --paginate "repos/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID/jobs?filter=latest&per_page=100" \
+            --jq '.jobs[] | {name, status, conclusion}' > "$RUNNER_TEMP/jobs.jsonl"
+      - name: All PR stages and every selected lane must have succeeded
         env:
           RESULTS: ${{ toJSON(needs) }}
+          LANES: ${{ needs.changes.outputs.lanes }}
+          JOBS: ${{ runner.temp }}/jobs.jsonl
         run: scripts/ci/require-all-green.sh

.github/workflows/test-impact-artifact.yml

@@ -0,0 +1,85 @@
+# Team artifact for test selection (smart CI, report-only until the oracles
+# and the shadow comparison are green). Every push to main publishes the
+# commit's bundle — its frozen graph, built incrementally from the previous
+# bundle, and its per-test coverage map, re-run only for the suites the push
+# selects — as the Actions artifact test-impact-<sha>. A weekly run rebuilds
+# both from scratch and fails when the incremental graph differs from the full
+# one. PR selection fetches the bundle of its merge base
+# (scripts/ci/test-impact-bundle.sh) and never narrows on anything else.
+name: test-impact-artifact
+
+on:
+  push:
+    branches: [main]
+  schedule:
+    - cron: "23 3 * * 0" # weekly full refresh, Sunday 03:23 UTC
+  workflow_dispatch:
+    inputs:
+      mode:
+        description: incremental or full
+        type: choice
+        options: [incremental, full]
+        default: full
+
+permissions:
+  contents: read
+  actions: read # fetch the previous bundle
+
+concurrency:
+  # Bundles chain: each push builds on the previous one, so runs never overlap
+  # and are never cancelled half-way.
+  group: test-impact-artifact
+  cancel-in-progress: false
+
+jobs:
+  publish:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 120
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 2
+          persist-credentials: false
+
+      - name: Install build deps and LLVM 21 (coverage toolchain)
+        run: |
+          sudo apt-get update && sudo apt-get install -y zlib1g-dev
+          wget -qO- https://apt.llvm.org/llvm-snapshot.gpg.key | sudo tee /etc/apt/trusted.gpg.d/apt.llvm.org.asc
+          echo "deb http://apt.llvm.org/noble/ llvm-toolchain-noble-21 main" | sudo tee /etc/apt/sources.list.d/llvm-21.list
+          sudo apt-get update
+          sudo apt-get install -y clang-21 llvm-21 libclang-rt-21-dev
+
+      - name: Build the production binary and the coverage runner
+        run: |
+          scripts/build.sh CC=gcc CXX=g++
+          make -f Makefile.cbm test-runner-cov COV_LLVM_BIN=/usr/lib/llvm-21/bin -j"$(nproc)"
+
+      - name: Publish the bundle
+        env:
+          GH_TOKEN: ${{ github.token }}
+          EVENT: ${{ github.event_name }}
+          BEFORE: ${{ github.event.before }}
+          REQUESTED: ${{ inputs.mode }}
+          # The selection lane excludes @perf and PR CI skips perf, so their
+          # (slowest, longest under coverage) suites are neither mapped nor
+          # listed: the runner then neither lists nor runs them.
+          CBM_SKIP_PERF: "1"
+        run: |
+          mode=incremental
+          if [ "$EVENT" = schedule ] || [ "$REQUESTED" = full ]; then mode=full; fi
+          before="$(git rev-parse HEAD^1)"
+          if [ "$EVENT" = push ] && [ -n "$BEFORE" ] && [ "$BEFORE" != 0000000000000000000000000000000000000000 ]; then
+            before="$BEFORE"
+          fi
+          scripts/ci/test-impact-publish.sh --binary build/c/codebase-memory-mcp \
+            --runner build/cov/test-runner --llvm-bin /usr/lib/llvm-21/bin \
+            --out "$RUNNER_TEMP/bundle" --mode "$mode" --before "$before"
+
+      - name: Upload the bundle
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: test-impact-${{ github.sha }}
+          path: ${{ runner.temp }}/bundle
+          include-hidden-files: true # the graph lives in .codebase-memory/
+          retention-days: 30
+          if-no-files-found: error