perf(ci): add pub-substring fast path before Rust API regex scan

scripts/ci/audit_codeql_default_setup_rollout.py

@@ -269,6 +269,7 @@ def load_payload(path: Path | None, stdin: TextIO) -> list[dict[str, Any]]:
 
 
 def parse_args(argv: list[str] | None = None) -> argparse.Namespace:
+    """Parse CLI arguments for either the file-payload or live-collection mode."""
     parser = argparse.ArgumentParser(description=__doc__)
     parser.add_argument("snapshots_json", nargs="?", type=Path)
     parser.add_argument("--repository")
@@ -277,6 +278,7 @@ def parse_args(argv: list[str] | None = None) -> argparse.Namespace:
 
 
 def main(argv: list[str] | None = None) -> int:
+    """Audit CodeQL rollout state from file or live snapshots and print verdicts."""
     args = parse_args(argv)
     try:
         live_mode = args.repository is not None or args.pr is not None

scripts/ci/opencode_review_surfaces.py

@@ -218,6 +218,8 @@ def rust_api_symbols(source_root: Path | None, raw_paths: Sequence[str]) -> list
         if not candidate.is_file() or candidate.is_symlink():
             continue
         text = candidate.read_text(encoding="utf-8", errors="replace")
+        if "pub" not in text:
+            continue
         for match in PUB_ITEM_RE.finditer(text):
             name = match.group("name")
             if name not in seen:

tests/test_docs_only_pr_runner_admission.py

@@ -85,19 +85,67 @@ def _on_block(workflow: str) -> str:
     return match.group(1)
 
 
-def test_gate_job_is_byte_identical_across_the_five_workflows_apart_from_if():
-    """The `changed-scope` block must not drift between its five copies."""
+def _strip_if_condition(block: str) -> str:
+    """Drop the `if:` line and, for a folded/literal scalar, its continuation lines.
+
+    A workflow's `if:` condition can span multiple lines (``if: >-`` or ``if: |``
+    followed by more-indented continuation lines) rather than a single line.
+    Comparing gate copies must ignore the whole condition, not just its first
+    line, since each copy is allowed its own admission condition independent
+    of how many source lines that condition takes.
+    """
+    kept: list[str] = []
+    skip_indent: int | None = None
+    for line in block.splitlines():
+        if skip_indent is not None:
+            indent = len(line) - len(line.lstrip(" "))
+            if not line.strip() or indent > skip_indent:
+                continue
+            skip_indent = None
+        if line.strip().startswith("if:"):
+            skip_indent = len(line) - len(line.lstrip(" "))
+            continue
+        kept.append(line)
+    return "\n".join(kept)
+
+
+def test_gate_job_is_byte_identical_across_the_three_workflows_apart_from_if():
+    """The `changed-scope` block must not drift between its three copies."""
     normalized_blocks = set()
     for filename in GATE_WORKFLOWS:
         workflow = _read(filename)
         block = _top_level_job_block(workflow, "changed-scope")
-        normalized = "\n".join(
-            line for line in block.splitlines() if not line.strip().startswith("if:")
-        )
+        normalized = _strip_if_condition(block)
         normalized_blocks.add(normalized)
     assert len(normalized_blocks) == 1, (
         "changed-scope gate copies drifted; keep them byte-identical apart "
-        "from the single 'if:' line"
+        "from the 'if:' condition"
+    )
+
+
+def test_strip_if_condition_keeps_skipping_across_a_blank_continuation_line():
+    """A blank line inside a folded/literal `if:` scalar must not end the skip.
+
+    YAML's `if: >-`/`if: |` block scalars can carry a blank line as part of
+    the same condition; a blank line is not itself an "if:"-less, less-
+    indented line that should end the skip, and one falsely resetting
+    `skip_indent` would leave that scalar's later indented lines in the
+    normalized output, making an otherwise byte-identical body compare as
+    drifted.
+    """
+    block = (
+        "    steps:\n"
+        "      - name: example\n"
+        "        if: >-\n"
+        "          first line ||\n"
+        "\n"
+        "          second line after a blank\n"
+        "        runs-on: ubuntu-24.04\n"
+    )
+    assert _strip_if_condition(block) == (
+        "    steps:\n"
+        "      - name: example\n"
+        "        runs-on: ubuntu-24.04"
     )
 
 
@@ -208,7 +256,7 @@ def test_codeql_pr_gates_analyze_head_at_step_level_not_job_level():
 def test_each_gate_workflow_keeps_an_always_admitted_job():
     """A fully-skipped run must conclude `success`, never `skipped`.
 
-    Every one of the five workflows needs at least one job with no `needs:`
+    Every one of the three workflows needs at least one job with no `needs:`
     and no needs-output-dependent `if:` -- the `changed-scope` job itself
     qualifies -- so a doc-only PR's run still has a job that runs and
     succeeds instead of every job skipping and the run itself reporting

tests/test_github_hourly_conflict_repair.py

@@ -115,11 +115,11 @@ def test_reusable_scheduler_enables_policy_for_hourly_callers() -> None:
     assert "--resolve-unreviewed-conflicts" in workflow
 
 
-def test_central_repository_has_hourly_self_caller() -> None:
+def test_central_repository_has_daily_self_caller() -> None:
     """The central repository itself is scanned instead of relying on product callers."""
     workflow = _CALLER.read_text(encoding="utf-8")
 
-    assert 'cron: "21 * * * *"' in workflow
+    assert 'cron: "21 6 * * *"' in workflow
     assert "uses: ./.github/workflows/pr-review-fix-scheduler.yml" in workflow
     # The consolidated file resolves per-repository parameters through a
     # github.event.schedule lookup table rather than flat `key: value`

tests/test_hourly_review_repair_callers.py

@@ -50,7 +50,7 @@
 # and both are asserted separately as static `with:` values rather than
 # carried per-target.
 _EXPECTED_TARGETS: dict[str, list[dict[str, str]]] = {
-    "2 * * * *": [
+    "2 0 * * *": [
         {
             "name": "afipc",
             "target_repository": "ContextualWisdomLab/aFIPC",
@@ -59,7 +59,7 @@
             "concurrency_group": "afipc-hourly-review-repair",
         },
     ],
-    "4 * * * *": [
+    "4 1 * * *": [
         {
             "name": "lineageweave",
             "target_repository": "ContextualWisdomLab/LineageWeave",
@@ -68,7 +68,7 @@
             "concurrency_group": "lineageweave-hourly-review-repair",
         },
     ],
-    "9 * * * *": [
+    "9 2 * * *": [
         {
             "name": "psychometrics-commons",
             "target_repository": "ContextualWisdomLab/psychometrics-commons",
@@ -77,7 +77,7 @@
             "concurrency_group": "psychometrics-commons-hourly-review-repair",
         },
     ],
-    "10 * * * *": [
+    "10 3 * * *": [
         {
             "name": "originweave",
             "target_repository": "ContextualWisdomLab/OriginWeave",
@@ -86,7 +86,7 @@
             "concurrency_group": "originweave-hourly-review-repair",
         },
     ],
-    "14 * * * *": [
+    "14 4 * * *": [
         {
             "name": "quarantine-sandbox",
             "target_repository": "ContextualWisdomLab/quarantine-sandbox-runtime",
@@ -95,7 +95,7 @@
             "concurrency_group": "quarantine-sandbox-hourly-review-repair",
         },
     ],
-    "16 * * * *": [
+    "16 5 * * *": [
         {
             "name": "nonnest2",
             "target_repository": "ContextualWisdomLab/nonnest2",
@@ -104,7 +104,7 @@
             "concurrency_group": "nonnest2-hourly-review-repair",
         },
     ],
-    "21 * * * *": [
+    "21 6 * * *": [
         {
             "name": "github",
             "target_repository": "ContextualWisdomLab/.github",
@@ -113,7 +113,7 @@
             "concurrency_group": "github-hourly-review-repair",
         },
     ],
-    "23 * * * *": [
+    "23 7 * * *": [
         {
             "name": "clearfolio",
             "target_repository": "ContextualWisdomLab/clearfolio",
@@ -122,7 +122,7 @@
             "concurrency_group": "clearfolio-hourly-review-repair",
         },
     ],
-    "27 * * * *": [
+    "27 8 * * *": [
         {
             "name": "accounting-information-platform",
             "target_repository": "ContextualWisdomLab/accounting-information-platform",
@@ -131,7 +131,7 @@
             "concurrency_group": "accounting-information-platform-hourly-review-repair",
         },
     ],
-    "34 * * * *": [
+    "34 9 * * *": [
         {
             "name": "contextual-orchestrator",
             "target_repository": "ContextualWisdomLab/contextual-orchestrator",
@@ -140,7 +140,7 @@
             "concurrency_group": "contextual-orchestrator-hourly-review-repair",
         },
     ],
-    "37 * * * *": [
+    "37 10 * * *": [
         {
             "name": "disksage",
             "target_repository": "ContextualWisdomLab/disksage",
@@ -149,7 +149,7 @@
             "concurrency_group": "disksage-hourly-review-repair",
         },
     ],
-    "43 * * * *": [
+    "43 11 * * *": [
         {
             "name": "governance-risk-compliance",
             "target_repository": "ContextualWisdomLab/governance-risk-compliance",
@@ -162,9 +162,9 @@
     # independent files (fast-mlsirm, metering-billing-platform) had each
     # chosen minute 49 without knowing about the other. The consolidated
     # lookup makes that sharing explicit and still dispatches each
-    # repository exactly once per hour, via the matrix in
+    # repository exactly once per day, via the matrix in
     # dispatch-review-repair.
-    "49 * * * *": [
+    "49 12 * * *": [
         {
             "name": "fast-mlsirm",
             "target_repository": "ContextualWisdomLab/fast-mlsirm",
@@ -180,7 +180,7 @@
             "concurrency_group": "metering-billing-platform-hourly-review-repair",
         },
     ],
-    "53 * * * *": [
+    "53 13 * * *": [
         {
             "name": "bandscope",
             "target_repository": "ContextualWisdomLab/bandscope",
@@ -189,7 +189,7 @@
             "concurrency_group": "bandscope-hourly-review-repair",
         },
     ],
-    "56 * * * *": [
+    "56 14 * * *": [
         {
             "name": "inkspan",
             "target_repository": "ContextualWisdomLab/inkspan",
@@ -198,7 +198,7 @@
             "concurrency_group": "inkspan-hourly-review-repair",
         },
     ],
-    "58 * * * *": [
+    "58 15 * * *": [
         {
             "name": "orgmetra",
             "target_repository": "ContextualWisdomLab/Orgmetra",
@@ -207,7 +207,7 @@
             "concurrency_group": "orgmetra-hourly-review-repair",
         },
     ],
-    "59 * * * *": [
+    "59 16 * * *": [
         {
             "name": "semantic-data-portal",
             "target_repository": "ContextualWisdomLab/semantic-data-portal",

tests/test_noema_orchestrator_workflow_contract.py

@@ -36,7 +36,7 @@ def test_noema_close_cleanup_selects_only_the_closed_pr_across_shared_display_ti
     script = textwrap.dedent(
         workflow_step(
             workflow_text("noema-review.yml"),
-            "Cancel queued and running Noema reviews for the closed pull request",
+            "Cancel queued and running Noema reviews for the inactive pull request",
         ).split("        run: |\n", 1)[1].split("\n  noema-review:", 1)[0]
     )
     workflow_path = ".github/workflows/noema-review.yml"
@@ -100,6 +100,9 @@ def test_noema_close_cleanup_selects_only_the_closed_pr_across_shared_display_ti
   status="$(printf '%s' "$url" | sed -E 's/.*status=([a-z_]+)&.*/\\1/')"
   jq --arg status "$status" '{workflow_runs: [.workflow_runs[] | select(.status == $status)]}' \\
     "$FAKE_RUNS_FILE"
+elif [[ "$*" == "api repos/ContextualWisdomLab/demo/pulls/7" ]]; then
+  printf '%s\n' "$*" >>"$FAKE_CALLS_FILE"
+  printf '{"state": "closed", "draft": false, "head": {"sha": "%s"}}\n' "$(printf 'a%.0s' {1..40})"
 else
   printf '%s\n' "$*" >>"$FAKE_CALLS_FILE"
 fi
@@ -113,7 +116,9 @@ def test_noema_close_cleanup_selects_only_the_closed_pr_across_shared_display_ti
             **os.environ,
             "PATH": f"{tmp_path}{os.pathsep}{os.environ.get('PATH', '')}",
             "TARGET_REPOSITORY": "ContextualWisdomLab/demo",
-            "CLOSED_PR_NUMBER": "7",
+            "INACTIVE_PR_NUMBER": "7",
+            "INACTIVE_PR_HEAD_SHA": "a" * 40,
+            "PR_ACTION": "closed",
             "CURRENT_RUN_ID": "999",
             "FAKE_RUNS_FILE": str(runs_file),
             "FAKE_CALLS_FILE": str(calls_file),
@@ -244,8 +249,17 @@ def _run_stale_trigger_step(
         ).split("        run: |\n", 1)[1]
     )
     fake_gh = tmp_path / "gh"
+    calls_file = tmp_path / "calls.txt"
     fake_gh.write_text(
-        f"#!/usr/bin/env bash\nset -euo pipefail\nprintf '%s' '{live_head}'\n",
+        "#!/usr/bin/env bash\n"
+        "set -euo pipefail\n"
+        f"printf '%s\\n' \"$*\" >>'{calls_file}'\n"
+        "if [[ \"$*\" == 'api repos/ContextualWisdomLab/example/pulls/7 --jq .head.sha' ]]; then\n"
+        f"  printf '%s' '{live_head}'\n"
+        "else\n"
+        "  echo 'unexpected gh invocation' >&2\n"
+        "  exit 1\n"
+        "fi\n",
         encoding="utf-8",
     )
     fake_gh.chmod(0o755)

tests/test_opencode_review_surfaces.py

@@ -410,6 +410,26 @@ def test_rust_api_symbols_skip_missing_and_symlink_sources(tmp_path: Path) -> No
     )
 
 
+def test_rust_api_symbols_skips_regex_when_pub_absent(
+    monkeypatch: pytest.MonkeyPatch, tmp_path: Path
+) -> None:
+    """Files with no 'pub' substring take the fast path and skip regex scanning."""
+    source = tmp_path / "lib.rs"
+    source.write_text("fn private_helper() {}\n", encoding="utf-8")
+    call_count = 0
+    real_pattern = surfaces.PUB_ITEM_RE
+
+    class CountingPattern:
+        def finditer(self, text: str):
+            nonlocal call_count
+            call_count += 1
+            return real_pattern.finditer(text)
+
+    monkeypatch.setattr(surfaces, "PUB_ITEM_RE", CountingPattern())
+    assert surfaces.rust_api_symbols(tmp_path, ["lib.rs"]) == []
+    assert call_count == 0
+
+
 def test_rust_api_symbols_replace_invalid_utf8(tmp_path: Path) -> None:
     """A malformed Rust text blob cannot abort review-surface publication."""
     source = tmp_path / "lib.rs"

tests/test_pr_review_autofix_nvidia_nim_contract.py

@@ -29,6 +29,7 @@ def test_review_fix_caller_keeps_the_github_daily_recovery_slot() -> None:
     """Keep the GitHub review repair caller on its distributed daily slot."""
     caller = _workflow_text(HOURLY_CALLER_WORKFLOW)
     assert 'cron: "23 7 * * *"' in caller
+    assert 'cron: "23 */2 * * *"' not in caller
     assert 'cron: "23 * * * *"' not in caller
     assert "uses: ./.github/workflows/pr-review-fix-scheduler.yml" in caller
 

tests/test_strix_rerun_job_selection.py

@@ -38,6 +38,12 @@ def record_rerun(repo: str, job_id: str, *, dry_run: bool, action: str) -> None:
         reruns.append((repo, job_id, action))
 
     monkeypatch.setattr(sched, "rerun_actions_job", record_rerun)
+    # This test's own concern is job selection (the "strix" scan job, not its
+    # "publish-manual-pr-evidence-status" sibling) -- not the separate live
+    # head-freshness re-check `dispatch_strix_evidence` now performs before
+    # any rerun, which needs a real `gh` call and has its own dedicated
+    # coverage. Stub it to the happy path so this test stays focused.
+    monkeypatch.setattr(sched, "live_dispatch_head_matches", lambda repo, pr: True)
 
     assert (
         sched.dispatch_strix_evidence(