CI-17: Add a fail-closed Linux-only private-cutover rehearsal across all workflows

[Chris0Jeky]

Wave: Smart CI Fabric / private-repository cutover. Trackers: CI-00 #2324 and CI-13 #2337. Related runner boundary: CI-04 #2328.

Context

The settled v0.3 posture has a $0 GitHub Actions hard ceiling. After the development repository becomes private and before any self-hosted runner is associated, the cutover must prove private-mode behaviour without consuming private hosted Windows minutes.

The existing release plan excluded the Windows release archive job, but required CI still invokes Windows work through ci-required.yml and called/reusable workflows, including the worktree-helper, backend-unit, frontend-unit, and API-integration Windows lanes. A post-privacy R0/R2/R4 rehearsal would therefore violate the budget and runner ordering unless the entire workflow graph has a trusted Linux-only rehearsal mode.

This is a release-control mechanism, not a permanent reduction in Windows coverage. Full Windows evidence resumes on the already-proven isolated runner classes after association, or after an explicit maintainer budget re-ruling.

Scope

• Add one explicit, trusted private-cutover rehearsal mode that is evaluated from protected-base workflow code and cannot be enabled or altered by untrusted PR-head code.
• Thread that mode through ci-required.yml and every called/reusable workflow that can schedule Windows work.
• Suppress every private hosted Windows job in rehearsal mode, including current Windows worktree-helper, backend-unit, frontend-unit, API-integration, and release jobs.
• Preserve the intended Linux, control-plane, security, governance, and receipt evidence. A Linux-only rehearsal must not turn required checks into vacuous skipped-success contexts.
• Fail closed when the mode is absent where required, malformed, inconsistent across the workflow graph, bypassed, or when a Windows job would still be schedulable.
• Add a workflow-contract inventory/test that discovers Windows runner selectors and fails when a new or existing Windows job is not covered by the rehearsal guard.
• Emit an auditable summary/receipt listing the mode, trusted source, selected jobs, suppressed Windows jobs, commit, policy/config identity, and final result.
• Exercise the post-privacy, pre-association matrix owned by CI-13 [HUMAN GATE]: Private-repository cutover — prove private-mode CI, budgets, runner trust; maintainer flips visibility for v0.3.0 #2337: R0/R2/R4 PRs, a normal merge, nightly dispatch, and a no-publish release rehearsal.
• Update the private-cutover checklist, release readiness material, and CI testing guide with activation, verification, abort, and rollback instructions.

Security and trust constraints

• Ordinary pull requests cannot self-select the trusted rehearsal mode.
• No self-hosted runner is associated while this rehearsal executes.
• No release credential is exposed to ordinary hosted or persistent CI runners.
• The mode must not weaken normal public CI, later hybrid CI, weekly full Windows coverage, or exact-tag Windows qualification.
• The cutover stops if any private hosted Windows job is scheduled or if expected Linux/control/security evidence is missing.

Acceptance

• Contract tests enumerate the full workflow graph and fail when any Windows job lacks the trusted rehearsal guard.
• Negative fixtures prove malformed, untrusted, inconsistent, and bypassed mode inputs fail closed.
• A public-mode dry run proves the same selection logic before the visibility change.
• The private post-flip rehearsal schedules zero hosted Windows jobs while producing all expected Linux/control/security checks and evidence.
• R0/R2/R4, normal-merge, nightly, and no-publish release scenarios are recorded against exact commits and workflow/config identities.
• The mechanism is documented in docs/ci/PRIVATE_REPO_CUTOVER_CHECKLIST.md, docs/releases/V0_3_0_READINESS.md, and docs/TESTING_GUIDE.md or their current authoritative successors.
• CI-13 [HUMAN GATE]: Private-repository cutover — prove private-mode CI, budgets, runner trust; maintainer flips visibility for v0.3.0 #2337 records the maintainer-reviewed evidence before runner association.

Non-goals

• This issue does not authorize the repository visibility flip, runner registration, branch-protection mutation, storage deletion, release publication, or a change to the $0 budget ruling.
• This issue does not replace the full Windows weekly/release contract or the isolated exact-tag Windows build.

Blocks the private cutover and final v0.3.0 tag until completed or explicitly re-ruled.

[Chris0Jeky]

[Lane claim: CI-17 inventory prerequisite]

Starting a bounded, non-activating slice from main 307c3b8b50bec1cb0bfaea3e570a942bcb1d4451. Current PR and branch searches show no implementation claim for this issue. Owned paths: new scripts/ci/smart-ci/workflow-runner-inventory* module/tests/fixture and one dated docs/analysis/ note. No existing workflows, rehearsal activation, runner association, repository settings, canonical checklist/readiness/status files, or human acceptance boxes are changed.

Deliverable: conservatively enumerate runner-bearing jobs and local reusable-workflow call edges across the supplied workflow set, retaining raw dynamic selectors/matrix/conditions rather than pretending to evaluate Actions expressions. Unsupported/ambiguous source or incomplete call graphs must be reported as incomplete, never as zero-Windows proof. Pin the current Windows-capable/dynamic inventory and its callers, with mutations for new selectors, nested calls, unresolved selectors, missing callees and unsupported structural shapes.

This prerequisite does not implement the trusted rehearsal guard or satisfy private-mode scheduling/receipt acceptance. The issue stays open. #3295/#3296 remain owned by the active concurrent pass; this work will use a separate branch/PR and preserve their files.

[Chris0Jeky]

Inventory prerequisite published in draft PR #3297, exact head 5cfa0eb481a2fe38732f1d71e1d6a4866fb1698f.

Measured protected-main source (307c3b8b50bec1cb0bfaea3e570a942bcb1d4451): 36 workflow files, 50 runner-bearing jobs, 41 reusable-workflow call jobs. Five Windows/opaque sites are pinned with their caller controls: desktop backend archive, reusable API matrix (both Linux and Windows caller jobs retained), backend-unit matrix, Windows worktree helper, and frontend-unit matrix. Unsupported/ambiguous mapping structure, incomplete/external call graphs, cycles and resource-limit violations report incomplete discovery. Dynamic selectors remain visible, never guessed away.

Verification: all 47 focused and 601 complete Smart CI tests passed locally and the full 601 passed in a clean local worktree. Current-head hosted Self-Test also passed all 601 on Ubuntu 24.04.5 / Node24.13.1, testing merge 22957820aeb51e0811a1afd6f04dfeeafb0e84fe. Extended CI passed; Required CI is still in progress at this read. Fresh Codex review requested; no approval inferred.

Issue remains open and all rehearsal acceptance boxes remain unchecked. This adds discovery/drift tests only. The trusted protected-base mode, guarded scheduling, authenticated receipts, non-vacuous Linux/security evidence, public/private rehearsal matrix and maintainer-reviewed #2337 cutover evidence remain to implement/prove. No workflows, CI suppression, settings, runner association, visibility, budget or canonical human decisions changed. Future work should extend this inventory rather than duplicate the five-site matrix by hand.

[Chris0Jeky]

Programme and authority clarification

PR #3353 makes the CI-17 dependency boundary explicit across the live readiness, programme, strategy, tracker, and agent-routing documents.

PR #3297 is the current non-activating prerequisite: it inventories Windows-capable jobs and reusable-workflow call edges. It does not yet provide trusted protected-base mode derivation, transitive propagation, authorization, Windows suppression, non-vacuous Linux/control/security evidence, an auditable receipt, or the post-privacy rehearsal.

This issue remains responsible for that actual fail-closed control and its R0/R2/R4, normal-merge, nightly, and no-publish release proof before any runner association. The cutover must stop if coverage is incomplete, the mode is bypassable, any private hosted Windows job is scheduled, or expected evidence is absent.

No workflow or runner-routing behavior is changed by #3353.