Merge remote-tracking branch 'origin/main' into capy/merge-train-workflow-side

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

# Conflicts:
#	CHANGELOG.md
#	scripts/harness-version.json

.github/workflows/free-durations-record.yml

@@ -161,7 +161,7 @@ jobs:
           - Files that failed while recording (durations kept; this PR's own free checks decide): $failed_line
           - Seed growth ratchet (60 s ceiling, shrink-only allowlist): $ratchet_line
 
-          Data only. Stamp and merge per docs/ship-policy.md; the stamp push runs the full PR checks.
+          Data only. This run dispatched Free Tests (the required free-tests check), Windows Free Tests and Quality gate on this branch; those are this PR's checks. The pull_request runs wait as "action required" because a token-opened PR never starts them without approval. Stamp and merge per docs/ship-policy.md; the stamp push runs the full PR checks.
           EOF
           if [ -n "$number" ]; then
             gh pr edit "$number" --body-file pr-body.md
@@ -170,3 +170,4 @@ jobs:
           fi
           gh workflow run free-tests.yml --repo "$GITHUB_REPOSITORY" --ref "$branch"
           gh workflow run windows-free-tests.yml --repo "$GITHUB_REPOSITORY" --ref "$branch"
+          gh workflow run quality-gate.yml --repo "$GITHUB_REPOSITORY" --ref "$branch"

CHANGELOG.md

@@ -14,6 +14,21 @@
 ### Changed
 - **Gate integrity (train block only):** under a `train` block, PR pushes no longer start paid slices; trains, screens and the backstop gate instead. Train and bisect runs never reuse a verdict and never bind one for reuse. No threshold, trial count, case kind or selection changed.
 - **Gate integrity (always, GSTA-48 P3-1):** when the readiness job blocks a PR head, a new `readiness-comment` job replaces an existing `## E2E Evals` comment with "NOT RUN on <head>", so an earlier PASS no longer stands beside a head that never ran. It posts nothing when no such comment exists. A slice killed before its upload step counts as incomplete.
+## [1.91.148.0] - 2026-10-19
+
+**Weekly seed PRs now get the credential scan as well as the free suites.** A pull request the recorder opens with the workflow token never starts its own `pull_request` checks. GitHub holds them as "action required". So the recorder dispatches its checks on the bot branch instead.
+
+### Changed
+- **`free-durations-record.yml` also dispatches Quality gate** on `bot/free-duration-seeds`, next to Free Tests (the required `free-tests` check) and Windows Free Tests.
+- **The seed PR body says the dispatched runs are its checks** and explains why its pull_request runs wait for approval.
+
+## [1.91.147.0] - 2026-10-19
+
+**The free-suite duration seeds are current again.** This is the first refresh from the weekly recorder. It adds 14 Linux and 6 Windows test files that the shard packers had been placing at the 99th-percentile estimate.
+
+### Changed
+- **Seed allowlist:** `test/brain-sync.test.ts` (89 s) and `test/setup-codex-scope.test.ts` (64 s) are allowlisted with the existing split todo. `test/host-renders-prune.test.ts` (now 57 s) leaves the allowlist.
+- **Editing the seed allowlist no longer selects paid evals.** Only the free seed ratchet reads `scripts/free-test-seed-allowlist.json`, but an edit to it used to pull in all 246 dependent gate cases. It is now classified free-only, like the two seeds.
 
 ## [1.91.146.0] - 2026-10-19
 

TODOS.md

@@ -5471,10 +5471,11 @@ Garry for each; revisit 2026-10-29 unless a date says otherwise.
   16-worker duration recording on 2026-10-15 the event had not landed
   (`['paste', 'enter', 'end_turn']`). Wait for the CLI's own write instead of a
   timer (docs/TESTING_INTERNALS.md#flake-ledger). **Effort:** S. **Priority:** P2.
-- **Split the free files the 2026-10-15 seed put over 60 s** —
-  `test/setup-install-registry.test.ts` (82 s), `test/host-renders-prune.test.ts`
-  (64 s) and `test/setup-codex-scope.test.ts` (60.4 s) are allowlisted with this
-  todo in `scripts/free-test-seed-allowlist.json`; `test/brain-sync.test.ts`
-  (57 s) and `test/setup-codex-scope-namespaces.test.ts` (57 s) are next. Split
+- **Split the free files the weekly seed puts over 60 s** —
+  `test/setup-install-registry.test.ts` (84 s), `test/brain-sync.test.ts` (89 s)
+  and `test/setup-codex-scope.test.ts` (64 s) are allowlisted with this todo in
+  `scripts/free-test-seed-allowlist.json` (2026-10-19 recording);
+  `test/host-renders-prune.test.ts` (57 s) and
+  `test/setup-codex-scope-namespaces.test.ts` are next. Split
   each by describe block, rerun `bun run test:ubicloud --record-durations` and
   delete the entries. **Effort:** S each. **Priority:** P2.

VERSION

@@ -1 +1 @@
-1.91.146.0
+1.91.148.0

agents-digest/gstack-AGENTS.md

@@ -1,4 +1,4 @@
-# gstack digest v1.91.146.0 — regenerate/re-copy after upgrading gstack
+# gstack digest v1.91.148.0 — regenerate/re-copy after upgrading gstack
 
 Behavioral rules from gstack (https://github.com/garrytan/gstack), compressed
 for agent hosts without a full skill install. The full skills add workflows,

docs/TESTING_INTERNALS.md

@@ -1379,7 +1379,10 @@ refresh to a maintainer.
   `windows-free-tests.yml`'s `record_durations` path. When either recording adds
   or drops a test file, it force-updates the `bot/free-duration-seeds` branch,
   opens or refreshes one seed PR whose body states the ratchet result, and
-  dispatches the free lanes on it. A file that fails while recording turns its
+  dispatches Free Tests, Windows Free Tests and Quality gate on it. Those
+  dispatched runs are the seed PR's checks, and Free Tests supplies the required
+  `free-tests` check. GitHub holds the pull_request runs of a token-opened PR as
+  "action required" until someone approves them. A file that fails while recording turns its
   job red but keeps its duration, and the PR body names it; the seed PR's own
   free checks decide whether the tree is healthy. An interrupted recording
   uploads no seed, and more than 5 red files on either OS proposes nothing. The

package.json

@@ -1,6 +1,6 @@
 {
   "name": "gstack",
-  "version": "1.91.146",
+  "version": "1.91.148",
   "description": "Garry's Stack — Claude Code skills + fast headless browser. One repo, one install, entire AI engineering workflow.",
   "license": "MIT",
   "type": "module",

scripts/free-test-seed-allowlist.json

@@ -3,6 +3,7 @@
     {"file": "test/host-conformance.test.ts", "reason": "real ./setup per host and layout; the time is setup's own skill-linking loop, not fixture copies (shared fixture landed in W6c)"},
     {"file": "test/shared-libs-stage-actor.test.ts", "reason": "re-runs the paid shared-libs runner body against git fixture repos per test; owned by the paid-harness value-bar review"},
     {"file": "test/setup-install-registry.test.ts", "reason": "82s in the 2026-10-15 recording (58s on 2026-10-04): 11 cases each run the real ./setup, gstack-relink, gstack-config and gstack-uninstall against throwaway checkouts", "todo": "split by describe block so the packer can balance it, then rerun bun run test:ubicloud --record-durations (TODOS.md, fix wave 2 follow-ups)"},
-    {"file": "test/host-renders-prune.test.ts", "reason": "64s in the 2026-10-15 recording (unseeded before): every case runs a real ./setup or the gstack-upgrade migration over host render dirs", "todo": "split by describe block so the packer can balance it, then rerun bun run test:ubicloud --record-durations (TODOS.md, fix wave 2 follow-ups)"}
+    {"file": "test/brain-sync.test.ts", "reason": "89s in the 2026-10-19 weekly recording (58s on 2026-10-15): #3254 added the case-collision suite, and every case drains a real gstack-brain-sync against a local bare remote", "todo": "split by describe block so the packer can balance it, then rerun bun run test:ubicloud --record-durations (TODOS.md, fix wave 2 follow-ups)"},
+    {"file": "test/setup-codex-scope.test.ts", "reason": "64s in the 2026-10-19 weekly recording (59s on 2026-10-15): each case runs the real ./setup twice against a Codex install fixture", "todo": "split by describe block so the packer can balance it, then rerun bun run test:ubicloud --record-durations (TODOS.md, fix wave 2 follow-ups)"}
   ]
 }

scripts/harness-version.json

@@ -16,7 +16,7 @@
     "scripts/lib/published-text.ts": {"blob":"3f2e4d616b5dd0204035710c66b64d49055c5714","since":6},
     "scripts/lib/shard-engine.ts": {"blob":"3cd0b1aaa84018b00bf9ea0ce48093f3c8492f66","since":6},
     "scripts/test-paid-shards.ts": {"blob":"8ddee5f11ed7856876135520dd8025ab989e2db9","since":6},
-    "scripts/test-pr-profile.ts": {"blob":"c03f3298a51ac04a182dc6a3bbaf286644ab59fd","since":6,"nonBehavioral":"classify the new evals-main-backstop.yml workflow as free-lane only: it dispatches evals.yml on main and runs inside no case, so no case's selection on a PR, input or verdict changes"},
+    "scripts/test-pr-profile.ts": {"blob":"d334195b0d0393622e2c380dc3e2feebe099b6e6","since":6,"nonBehavioral":"classify the new evals-main-backstop.yml workflow as free-lane only: it dispatches evals.yml on main and runs inside no case, so no case's selection on a PR, input or verdict changes"},
     "scripts/test-strict-output.ts": {"blob":"01185d20dc9761b04b9b2f751ec98664fe0eaf93","since":6},
     "test/helpers/agent-sdk-runner.ts": {"blob":"210bba92d241a90df578b2c7fc943ac5755d0025","since":6},
     "test/helpers/auq-substance-panel.ts": {"blob":"4881260ef793668e4963a062db6d06a5e1f7a40f","since":6},

scripts/test-pr-profile.ts

@@ -231,6 +231,7 @@ export const FREE_ONLY_PR_FILES = [
   'test/helpers/auq-parallel-worker.ts',
   'test/helpers/stored-zip.ts', // Read only by the free test-health report tests.
   'scripts/free-test-durations.json',
+  'scripts/free-test-seed-allowlist.json', // Read only by the free seed ratchet (test/free-seed-ratchet.test.ts).
   'scripts/paid-test-durations.json',
   'scripts/ubicloud/**',
   'capy/skill/**', // The vendored Capy skill (Drive bootstrapper): run by Capy agents, read by no paid case; test/capy-skill-wrapper.test.ts covers it.

test/free-durations-record-workflow.test.ts

@@ -81,7 +81,11 @@ test('the propose step touches only the two seeds, never the allowlist, on one b
   expect(script).not.toContain('free-test-seed-allowlist.json');
   expect(script).toContain('branch=bot/free-duration-seeds');
   expect(script).toContain('bun test test/free-seed-ratchet.test.ts');
-  expect(script).toContain('gh workflow run free-tests.yml');
+  for (const workflow of ['free-tests.yml', 'windows-free-tests.yml', 'quality-gate.yml']) {
+    expect(script).toContain(`gh workflow run ${workflow} --repo "$GITHUB_REPOSITORY" --ref "$branch"`);
+    expect(load(workflow).on).toHaveProperty('workflow_dispatch');
+  }
+  expect(script).toContain('those are this PR\'s checks');
   expect(proposeStep.env.OPEN_PR).toBe("${{ github.ref == 'refs/heads/main' && (github.event_name == 'schedule' || inputs.open_pr) }}");
   expect(script.indexOf('if [ "$OPEN_PR" != true ]')).toBeLessThan(script.indexOf('git push'));
   expect(recorder.on.workflow_dispatch.inputs.open_pr).toMatchObject({ type: 'boolean', default: true });

test/free-fixtures.test.ts

@@ -107,6 +107,16 @@ describe('PR selection over the W1a single-file fallbacks', () => {
     }
   });
 
+  test('seed data and the seed allowlist select no paid case; a derived paid-surface file still selects its dependents (#3289)', () => {
+    // #3289: the allowlist edit derived 246 gate cases, though only test/free-seed-ratchet.test.ts reads it.
+    const seed = select(['scripts/free-test-seed-allowlist.json', 'scripts/free-test-durations.json', 'scripts/free-test-durations-windows.json']);
+    expect({ mode: seed.mode, unknown: seed.unknownFiles, derived: seed.derivedFiles, e2e: seed.e2e, judges: seed.judges })
+      .toEqual({ mode: 'pr', unknown: [], derived: [], e2e: [], judges: [] });
+    const paid = select(['design/src/evolve.ts']);
+    expect(paid.derivedFiles.map(entry => entry.file)).toEqual(['design/src/evolve.ts']);
+    expect(paid.e2e.length).toBeGreaterThan(0);
+  });
+
   test('the paid workflow itself still restores the full gate (36493452542)', () => {
     const result = select(['.github/workflows/evals.yml']);
     expect(result.mode).toBe('full-fallback');