checks-manifest.yaml

# Single source of truth for deterministic, diff-scoped, stdlib-or-repo-only checks.
# Values use JSON scalars/lists within this stdlib-parsed YAML subset.
# Add new checks here with both local and ci lanes; never hardcode them in workflow YAML.
# Checks that consume PR metadata declare `requires_pr_body: true`; post-merge
# push runs exclude only that category because no authoritative PR body is available.
checks:
  - id: go-device-sdk-tests
    command: ["go", "-C", "sdks/device/go", "test", "-race", "./..."]
    triggers: ["sdks/device/go/**"]
    lanes: ["local", "ci"]
    platforms: ["linux", "macos"]
    reason: "Parakeet readiness is written by the WebSocket reader and read by PCM submission; execute the in-memory handshake with the race detector"
  - id: dev-harness-unit-tests
    command: ["bash", "scripts/dev-harness/run-tests.sh"]
    triggers: ["Makefile", "scripts/dev-harness/**", "desktop/macos/scripts/omi-fault-inject.sh", ".github/checks-manifest.yaml"]
    lanes: ["local", "ci"]
    reason: "the hermetic dev-harness stack backs local desktop tests; the Jul 22 2026 Typesense runtime must stay behaviorally covered"
  - id: windows-update-feed-probe-tests
    command: ["python3", ".github/scripts/test_probe_windows_update_feed.py"]
    triggers: [".github/scripts/probe_windows_update_feed.py", ".github/scripts/test_probe_windows_update_feed.py", ".github/workflows/desktop_windows_release.yml", ".github/checks-manifest.yaml"]
    lanes: ["local", "ci"]
    reason: "Windows releases must not tag while production is missing /v2/desktop/update-feed/windows; the probe's trust-boundary validation is the release-lane guard"
  - id: pre-push-final-pr-diff
    command: ["bash", "scripts/test-pre-push-diff-base.sh"]
    triggers: ["scripts/pre-push", "scripts/pre-push-diff-base", "scripts/test-pre-push-diff-base.sh", ".github/checks-manifest.yaml"]
    lanes: ["local", "ci"]
    reason: "pre-push check selection must use the final PR diff rather than a stale remote feature tip"
  - id: pre-push-firmware-formatter-prerequisite
    command: ["bash", "scripts/test-pre-push-firmware-format-prerequisite.sh"]
    triggers: ["scripts/pre-push", "scripts/test-pre-push-firmware-format-prerequisite.sh", ".github/checks-manifest.yaml"]
    lanes: ["local", "ci"]
    reason: "PR #12993 found that firmware formatting can fail only after a hosted run because pre-push silently skipped clang-format when it was absent; selected firmware sources now require the same formatter locally"
  - id: pre-commit-pinned-toolchains
    command: ["bash", "scripts/test-pre-commit-pinned-toolchains.sh"]
    triggers: ["scripts/pre-commit", "scripts/test-pre-commit-pinned-toolchains.sh", ".github/checks-manifest.yaml"]
    lanes: ["local", "ci"]
    reason: "#11304: the hook's floating prettier fallback (prettier 3 against web/frontend's pinned ^2.8.8) rewrote getPlatformLink in web/frontend/src/app/apps/[id]/page.tsx into a CI-rejected shape and polluted four PRs in one day; an unpinned formatter must refuse, never silently rewrite"
  - id: backend-python-format-contract
    command: ["bash", "scripts/test-backend-python-format.sh"]
    triggers: ["scripts/backend-python-format", "scripts/test-backend-python-format.sh", "scripts/pre-commit", "scripts/pre-push", ".github/workflows/repo-checks.yml", ".github/checks-manifest.yaml"]
    lanes: ["local", "ci"]
    reason: "PR #11454 reached CI with two backend Python files that the pinned formatter rejected; local auto-format, pre-push, and CI must converge through one cached formatter primitive"
  - id: pre-push-backend-test-cap
    command: ["bash", "scripts/test-pre-push-backend-test-cap.sh"]
    triggers: ["scripts/pre-push", "scripts/test-pre-push-backend-test-cap.sh", ".github/checks-manifest.yaml"]
    lanes: ["local", "ci"]
    reason: "#11018: the over-broad-selection fallback swapped in the diff's own changed backend test files without re-applying PRE_PUSH_MAX_BACKEND_UNIT_TEST_FILES, so a diff changing more than the cap ran unbounded while printing 'cap is 40'; the bounded push gate must never run more than the cap it advertises"
  - id: pre-push-ci-prediction-tests
    command: ["python3", ".github/scripts/test_pre_push_ci_prediction.py"]
    triggers: ["scripts/pre-push", "scripts/pre_push_ci_prediction.py", ".github/scripts/test_pre_push_ci_prediction.py", "desktop/macos/scripts/desktop-flow-lint.py", "desktop/macos/scripts/desktop_flow_contract.py", ".github/checks-manifest.yaml"]
    lanes: ["local", "ci"]
    reason: "#9440: local CI prediction must select only bounded Flutter generator, desktop-flow, and Windows KG-worker checks for the final PR diff"
  - id: workflow-apt-network-bounds
    command: ["bash", "scripts/run-workflow-apt-network-bounds.sh"]
    triggers: [".github/workflows/**", ".github/actions/**", ".github/scripts/check_workflow_apt_network_bounds.py", ".github/scripts/test_check_workflow_apt_network_bounds.py", "scripts/run-workflow-apt-network-bounds.sh", ".github/checks-manifest.yaml"]
    lanes: ["local", "ci"]
    reason: "apt has no built-in timeout; a stalled Azure mirror burns the job ceiling and reports an opaque cancellation. #11872 bounded two workflows by hand and still left an install line unbounded under a comment claiming otherwise. #12194 proposes moving a bounded install into a composite action, so the guard follows apt into .github/actions/** and enforces the step ceiling at each caller, where timeout-minutes is a valid key"
  - id: pre-push-hatch-disclosure
    command: ["python3", ".github/scripts/check_pre_push_hatch_disclosure.py"]
    triggers: ["scripts/pre-push", ".github/scripts/check_pre_push_hatch_disclosure.py", ".github/checks-manifest.yaml"]
    lanes: ["local", "ci"]
    reason: "make setup provisions no app toolchain; selector-only routing changes must not wake Flutter generation, while real generator and workflow inputs still disclose PRE_PUSH_SKIP_FLUTTER_GENERATED; actionlint's branch had the same omission, and a hatch nobody can find is not a hatch"
  - id: setup-pre-push-prerequisites
    command: ["bash", "scripts/test-make-setup.sh"]
    triggers: ["Makefile", "backend/scripts/sync-python-deps.sh", "scripts/pre-push", "scripts/repair-git-primary-worktree.sh", "scripts/setup-refresh-main.sh", "scripts/test-make-setup.sh", ".cursor/worktrees.json", ".github/checks-manifest.yaml"]
    lanes: ["local", "ci"]
    reason: "make setup must provision the minimal, rerunnable backend environment required by selected pre-push checks"
  - id: pre-push-worktree-fallback
    command: ["bash", "scripts/test-pre-push-worktree-fallback.sh"]
    triggers: ["scripts/pre-push", "scripts/pre-push-singleflight", "scripts/pr-preflight", ".github/scripts/preflight_runner.py", ".github/scripts/pr_preflight.py", "scripts/test-pre-push-worktree-fallback.sh", ".github/workflows/windows-preflight-portability.yml", ".github/checks-manifest.yaml"]
    lanes: ["local", "ci"]
    platforms: ["windows"]
    reason: "#10293: the pre-push hook chain must resolve the repo root in linked worktrees where git rev-parse --show-toplevel exits 128, not abort into a --no-verify push"
  - id: preflight-runner-portability
    command: ["python3", ".github/scripts/test_preflight_runner.py"]
    triggers: [".github/scripts/preflight_runner.py", ".github/scripts/pr_preflight.py", ".github/scripts/test_preflight_runner.py", ".github/scripts/run_checks.py", ".github/scripts/test_run_checks.py", "scripts/pre-push-singleflight", "scripts/pre-push", "scripts/pr-preflight", ".github/workflows/windows-preflight-portability.yml", ".github/checks-manifest.yaml"]
    lanes: ["local", "ci"]
    reason: "the single-flight pre-push gate must manage child processes and launch Bash checks on native Windows and POSIX hosts"
  - id: context-for-claude-build-identity
    command: ["bash", "desktop/context-for-claude/scripts/test-build-identity.sh"]
    triggers: ["desktop/context-for-claude/scripts/**", "desktop/context-for-claude/Resources/Info.plist", ".github/checks-manifest.yaml"]
    lanes: ["local", "ci"]
    reason: "#11641: a self-signed developer build carrying the production bundle id wrote certificate-pinned TCC records that no re-grant could clear, breaking Screen Recording and Microphone on a user's Mac for days; a build not signed for release must never claim the production identifiers"
  - id: desktop-release-process-guards
    command: ["bash", "scripts/run-release-process-guards.sh"]
    triggers: ["codemagic.yaml", ".github/workflows/desktop_promote_beta.yml", ".github/scripts/check-release-process-guards.py", ".github/scripts/git_bash.py", "scripts/dev-harness/_resolve_python.sh", "scripts/run-release-process-guards.sh", "backend/tests/unit/test_desktop_release_scripts.py", ".github/checks-manifest.yaml"]
    lanes: ["local", "ci"]
    reason: "normal Beta promotion must stay on Codemagic signed-smoke evidence and must not reintroduce a qualification-completion trigger"
  - id: desktop-release-process-guard-tests
    command: ["bash", "scripts/run-release-process-guard-tests.sh"]
    triggers: [".github/scripts/check-release-process-guards.py", ".github/scripts/test_check_release_process_guards.py", ".github/scripts/git_bash.py", "codemagic.yaml", ".github/scripts/fixtures/codemagic_workflow_contract/**", "scripts/run-release-process-guard-tests.sh", ".github/checks-manifest.yaml"]
    lanes: ["local", "ci"]
    reason: "#10351: the 94-test self-suite behind the release-process guard ran in no lane, so guard regressions accumulated silently until the suite itself was red on main"
  - id: failure-class-retirement-author
    command: ["python3", ".github/scripts/test_failure_class_retirement.py"]
    triggers: [".github/scripts/failure_class_retirement.py", ".github/scripts/test_failure_class_retirement.py", ".github/workflows/repo-hygiene.yml", "scripts/failure-class", ".github/checks-manifest.yaml"]
    lanes: ["local", "ci"]
    reason: "the weekly retirement author must refuse a truncated event feed; a short feed reports every class as instance-free, so the job would stay green while retiring nothing"
  - id: check-manifest-contract
    command: ["python3", ".github/scripts/test_run_checks.py"]
    triggers: ["all"]
    lanes: ["local", "ci"]
    reason: "manifest validity and workflow drift guard"
  - id: backend-production-release-vector-guards
    command: ["python3", ".github/scripts/check_release_rings.py"]
    triggers: [".github/workflows/gcp_backend.yml", ".github/actions/deploy-backend-stack/**", ".github/scripts/check_release_rings.py", ".github/scripts/workflow_composite_contract.py", ".github/checks-manifest.yaml"]
    lanes: ["local", "ci"]
    reason: "the canonical production backend deploy remains the only release authority"
  - id: backend-production-release-vector-guard-tests
    command: ["python3", ".github/scripts/test_check_release_rings.py"]
    triggers: [".github/scripts/check_release_rings.py", ".github/scripts/test_check_release_rings.py", ".github/workflows/gcp_backend.yml", ".github/actions/deploy-backend-stack/**", ".github/scripts/workflow_composite_contract.py", ".github/checks-manifest.yaml"]
    lanes: ["local", "ci"]
    reason: "the one-action production backend release contract must reject legacy release planes"
  - id: product-file-line-count-ratchet
    command: ["python3", ".github/scripts/check_product_file_line_count_ratchet.py", "--changed-files", "{changed_files}", "--base", "{target_base}", "--head", "{head}", "--pr-body-file", "{pr_body_file}"]
    triggers: ["backend/**/*.py", "desktop/macos/**/*.swift", "desktop/macos/**/*.rs", ".github/scripts/check_product_file_line_count_ratchet.py"]
    lanes: ["local", "ci"]
    requires_pr_body: true
    reason: "#9838 freezes oversized product files against the target branch without a shared metadata ledger; exact PR-body exceptions preserve reviewability without unrelated merge conflicts"
  - id: product-file-line-count-ratchet-tests
    command: ["python3", ".github/scripts/test_check_product_file_line_count_ratchet.py"]
    triggers: [".github/scripts/check_product_file_line_count_ratchet.py", ".github/scripts/test_check_product_file_line_count_ratchet.py", ".github/checks-manifest.yaml"]
    lanes: ["local", "ci"]
    reason: "base-derived oversized-file checks must reject growth and stale approvals while ratcheting reductions down automatically"
  - id: desktop-release-manifest-v1
    command: ["python3", ".github/scripts/test_desktop_release_manifest.py"]
    triggers: [".github/schemas/desktop-release-manifest-v1.schema.json", ".github/scripts/desktop_release_manifest.py", ".github/scripts/test_desktop_release_manifest.py", ".github/scripts/fixtures/desktop_release_manifest/**"]
    lanes: ["local", "ci"]
    reason: "immutable desktop app/backend release-unit contract"
  - id: desktop-release-manifest-schema-v1
    command: ["python3", ".github/scripts/test_desktop_release_manifest_schema.py"]
    triggers: [".github/schemas/desktop-release-manifest-v1.schema.json", ".github/scripts/test_desktop_release_manifest_schema.py", ".github/checks-manifest.yaml"]
    lanes: ["local", "ci"]
    reason: "the Stable manifest schema must keep admitting exactly one app artifact pair; a beta_zip_url re-entering it is how a beta build becomes describable as Stable"
  - id: desktop-proactive-delivery-health
    command: ["python3", ".github/scripts/test_desktop_proactive_delivery_health.py"]
    triggers: [".github/scripts/desktop_proactive_delivery_health.py", ".github/scripts/test_desktop_proactive_delivery_health.py", ".github/workflows/desktop_release_doctor.yml", "desktop/macos/docs/release-health-metrics.md", ".github/checks-manifest.yaml"]
    lanes: ["local", "ci"]
    reason: "PT24H Advice Generated users over macOS DAU must alarm on exact zero without treating low samples or broken collection as healthy"
  - id: desktop-beta-freshness-tests
    command: ["python3", ".github/scripts/test_check_desktop_beta_freshness.py"]
    triggers: [".github/scripts/check-desktop-beta-freshness.py", ".github/scripts/test_check_desktop_beta_freshness.py", ".github/scripts/plan-desktop-release.py", ".github/workflows/desktop_auto_release.yml", ".github/workflows/desktop_release_doctor.yml", ".github/checks-manifest.yaml"]
    lanes: ["local", "ci"]
    reason: "issue #11936: hourly freshness must age the oldest unshipped macOS update so continuous merges cannot reset and auto-close the alarm"

  - id: desktop-beta-admission-firestore-contention
    command: ["bash", "backend/testing/desktop_beta_admission/run.sh"]
    triggers: ["backend/database/desktop_update_channels.py", "backend/testing/desktop_beta_admission/**", "package.json", "package-lock.json", ".github/checks-manifest.yaml"]
    lanes: ["local", "ci"]
    platforms: ["macos"]
    reason: "real Firestore transaction serialization must fence stale qualified Beta admissions after reservation, pause, and generation transitions"
  - id: desktop-beta-admission-supervisor
    command: ["node", "--test", "backend/testing/desktop_beta_admission/test_supervise.mjs"]
    triggers: ["backend/testing/desktop_beta_admission/**", ".github/checks-manifest.yaml"]
    lanes: ["local", "ci"]
    platforms: ["macos"]
    reason: "SCA-52: the admission emulator must own and drain only its process group, including Firestore JVM grandchildren, on every exit path"
  - id: desktop-changelog-io-tests
    command: ["python3", ".github/scripts/test_desktop_changelog.py"]
    triggers: [".github/scripts/check-desktop-changelog.py", ".github/scripts/desktop-changelog.py", ".github/scripts/test_desktop_changelog.py", ".github/checks-manifest.yaml"]
    lanes: ["local", "ci"]
    reason: "#9717: changelog tooling must preserve UTF-8 I/O and exempt only internal desktop release controls"
  - id: agents-md-lean
    command: ["python3", ".github/scripts/check_agents_md_lean.py"]
    triggers: ["AGENTS.md", "**/AGENTS.md", ".github/scripts/check_agents_md_lean.py"]
    lanes: ["local", "ci"]
    reason: "every AGENTS.md is loaded into agent context; budgets ratchet down, never up"
  - id: agent-doc-references
    command: ["python3", ".github/scripts/check_agent_doc_references.py"]
    triggers: ["AGENTS.md", "**/AGENTS.md", "CLAUDE.md", "PRODUCT.md", ".github/agent-docs/**", ".github/scripts/check_agent_doc_references.py"]
    lanes: ["local", "ci"]
    reason: "agents cannot tell a stale pointer from a live one; CLAUDE.md and the desktop/app guides had shipped dead paths"
  - id: agent-doc-claims
    command: ["python3", ".github/scripts/check_agent_doc_claims.py"]
    triggers: [".cursor/cloud-agent-environment.md", "backend/test.sh", "backend/docs/test_isolation.md", ".github/scripts/check_agent_doc_claims.py", ".github/checks-manifest.yaml"]
    lanes: ["local", "ci"]
    reason: "a valid pointer proves nothing about the claim around it; .cursor/cloud-agent-environment.md described test.sh halting at the first failure long after it became an aggregating worker pool, and an agent read that and proposed replacing the per-file isolation the suite depends on"
  - id: diff-hygiene
    command: ["python3", ".github/scripts/check_diff_hygiene.py", "--changed-files", "{changed_files}", "--base", "{base}", "--head", "{head}"]
    triggers: ["all"]
    lanes: ["local", "ci"]
    reason: "all changes must be free of whitespace errors and conflict markers"
  - id: git-author-identity
    command: ["python3", ".github/scripts/check_git_author_identity.py", "--base", "{base}", "--head", "{head}"]
    triggers: ["all"]
    lanes: ["local", "ci"]
    reason: "PR #11525's commits were minted as Ratchet Test because a leftover repo-local user.email overrode the global identity; GitHub then showed a generic avatar"
  - id: git-author-identity-tests
    command: ["python3", ".github/scripts/test_check_git_author_identity.py"]
    triggers: [".github/scripts/check_git_author_identity.py", ".github/scripts/test_check_git_author_identity.py", ".github/checks-manifest.yaml"]
    lanes: ["local", "ci"]
    reason: "the author-identity guard must reject a clone-local fixture override and a fixture-authored commit range"
  - id: package-architecture-map-guardrail-tests
    command: ["python3", ".github/scripts/test_check_package_architecture_maps.py"]
    triggers: [".github/scripts/check_package_architecture_maps.py", ".github/scripts/test_check_package_architecture_maps.py", ".github/scripts/package_architecture_baseline.json", ".github/checks-manifest.yaml"]
    lanes: ["local", "ci"]
    reason: "the package-map ratchet is only a ratchet while its own baseline behavior stays covered"
  - id: architecture-guardrails
    command: ["python3", ".github/scripts/check_arch_guardrails.py", "--changed-files", "{changed_files}", "--base", "{base}"]
    triggers: ["all"]
    lanes: ["local", "ci"]
    reason: "advisory size checks plus oversized package-map baseline ratchet"
  - id: product-invariant-checker-tests
    command: ["python3", ".github/scripts/test_check_product_invariants.py"]
    triggers: [".github/scripts/check_product_invariants.py", ".github/scripts/test_check_product_invariants.py", "product/invariants/**", ".github/checks-manifest.yaml"]
    lanes: ["local", "ci"]
    reason: "locked invariant citation enforcement must keep rejecting an uncited path match"
  - id: pr-preflight-contract-tests
    command: ["python3", ".github/scripts/test_pr_preflight.py"]
    triggers: [".github/scripts/preflight_runner.py", ".github/scripts/pr_preflight.py", ".github/scripts/test_pr_preflight.py", ".github/scripts/pr_metadata.py", "desktop/macos/scripts/check-e2e-flow-coverage.py", "scripts/pre-push-singleflight", "scripts/pr-preflight", ".github/checks-manifest.yaml", ".github/workflows/**", ".github/actions/**"]
    lanes: ["local", "ci"]
    reason: "preflight resolves the check selection every PR depends on"
  - id: product-invariants
    command: ["python3", ".github/scripts/check_product_invariants.py", "--changed-files", "{changed_files}", "--pr-body-file", "{pr_body_file}"]
    triggers: ["all"]
    lanes: ["local", "ci"]
    requires_pr_body: true
    reason: "changed paths determine required invariant citations"
  - id: failure-class-protocol
    command: ["python3", "scripts/failure-class", "validate", "--base", "{base}", "--head", "{head}", "--pr-body-file", "{pr_body_file}"]
    triggers: ["all"]
    lanes: ["local", "ci"]
    requires_pr_body: true
    reason: "fix commits declare a validated semantic failure class"
  - id: failure-class-guard-artifact-ratchet
    command: ["python3", ".github/scripts/check_failure_class_guard_ratchet.py", "--pr-body-file", "{pr_body_file}"]
    triggers: ["all"]
    lanes: ["local", "ci"]
    requires_pr_body: true
    reason: "FC-split-mutation-authority was declared on 30 first-parent integration changes in the 90 days to Jul 24 2026 while its definition still listed evidence_prs [9365, 9597] and named no guard artifact; a recurring class must produce a reusable guard surface, not more paperwork"
  - id: failure-class-guard-artifact-ratchet-tests
    command: ["python3", ".github/scripts/test_check_failure_class_guard_ratchet.py"]
    triggers: [".github/scripts/check_failure_class_guard_ratchet.py", ".github/scripts/test_check_failure_class_guard_ratchet.py", ".github/scripts/failure_class_guard_ratchet_allowlist.json", ".github/checks-manifest.yaml"]
    lanes: ["local", "ci"]
    reason: "the guard-artifact ratchet's counting window, threshold, allowlist shrink rule, and shallow-history skip must stay behaviorally covered"
  - id: failure-class-cli-tests
    command: ["python3", "scripts/test_failure_class.py"]
    triggers: ["scripts/failure-class", "scripts/test_failure_class.py", ".github/failure-classes/**", ".github/checks-manifest.yaml"]
    lanes: ["local", "ci"]
    reason: "the failure-class CLI is the registry's only schema authority; its hermetic tests had no blocking lane and had silently gone stale"
  - id: desktop-changelog-data
    command: ["python3", ".github/scripts/desktop-changelog.py", "validate"]
    triggers: ["all"]
    lanes: ["local", "ci"]
    reason: "repository-wide desktop changelog schema contract"
  - id: desktop-changelog-entry
    command: ["python3", ".github/scripts/check-desktop-changelog.py", "--base", "{base}", "--head", "{head}", "{skip_changelog}"]
    triggers: ["desktop/macos/**"]
    lanes: ["local", "ci"]
    reason: "desktop files changed"
  - id: omi-macos-dev-cli
    command: ["bash", "desktop/macos/tests/test-omi-macos-dev.sh"]
    triggers: ["desktop/macos/scripts/omi-macos-dev", "desktop/macos/scripts/cleanup-omi-tcc.sh", "desktop/macos/tests/test-omi-macos-dev.sh", "desktop/macos/tests/test-cleanup-omi-tcc.sh"]
    lanes: ["local", "ci"]
    reason: "agent-facing macOS development hygiene CLI remains safe and deterministic"
  - id: desktop-e2e-flow-coverage
    command: ["python3", "desktop/macos/scripts/check-e2e-flow-coverage.py", "--strict", "--base", "{base}"]
    triggers: ["desktop/macos/Desktop/Sources/**/*.swift", "desktop/macos/scripts/check-e2e-flow-coverage.py"]
    lanes: ["local", "ci"]
    platforms: ["macos"]
    reason: "desktop Swift sources changed; compare against the pinned macOS formatter before requiring a flow cover"
  - id: desktop-flow-contract-tests
    command: ["python3", "desktop/macos/tests/test_desktop_flow_contract.py"]
    triggers: ["desktop/macos/scripts/desktop_flow_contract.py", "desktop/macos/tests/test_desktop_flow_contract.py", "desktop/macos/Desktop/Sources/DesktopAutomationBridge.swift", ".github/checks-manifest.yaml"]
    lanes: ["local", "ci"]
    reason: "bridge actions moved into DesktopAutomationBridge+Notifications.swift while the action-source list still named only the base file, so desktop-flow-lint called their flows unknown and failed the push gate on every branch"
  - id: desktop-grdb-insert-idiom-tests
    command: ["python3", "desktop/macos/tests/test_check_grdb_insert_idiom.py"]
    triggers: ["desktop/macos/scripts/check-grdb-insert-idiom.py", "desktop/macos/tests/test_check_grdb_insert_idiom.py", ".github/checks-manifest.yaml"]
    lanes: ["local", "ci"]
    reason: "the insert-idiom checker must keep flagging the two merged rowid-drop instances (#11208, #11216) without flagging the Set and Array insert shapes that are live in Desktop/Sources"
  - id: desktop-grdb-insert-idiom
    command: ["python3", "desktop/macos/scripts/check-grdb-insert-idiom.py"]
    triggers: ["desktop/macos/Desktop/Sources/**/*.swift", "desktop/macos/scripts/check-grdb-insert-idiom.py", ".github/checks-manifest.yaml"]
    lanes: ["local", "ci"]
    reason: "#11204: a mutating didInsert never witnesses PersistableRecord's non-mutating insert, so a direct record.insert(db) drops the rowid silently onto an optional field; two shipped instances went undetected until unrelated work tripped over them"
  - id: desktop-single-chat-shell-self-test
    command: ["python3", "desktop/macos/scripts/check-single-chat-shell.py", "--self-test"]
    triggers: ["desktop/macos/scripts/check-single-chat-shell.py", ".github/checks-manifest.yaml"]
    lanes: ["local", "ci"]
    reason: "the tripwire must keep failing on each shape it was written for, and keep passing on prose that merely names one"
  - id: desktop-single-chat-shell
    command: ["python3", "desktop/macos/scripts/check-single-chat-shell.py"]
    triggers: ["desktop/macos/Desktop/Sources/**/*.swift", "desktop/macos/scripts/check-single-chat-shell.py", ".github/checks-manifest.yaml"]
    lanes: ["local", "ci"]
    reason: "#12598: the app mounted one of two shells behind a preference, and six content-block kinds rendered as controls on one and as nothing on the other; both grow back one symbol at a time"
  - id: brand-ui-ratchet-tests
    command: ["python3", ".github/scripts/test_check_brand_ui.py"]
    triggers: [".github/scripts/check_brand_ui.py", ".github/scripts/test_check_brand_ui.py", ".github/checks-manifest.yaml"]
    lanes: ["local", "ci"]
    reason: "INV-UI-1 is a no-increase ratchet; its counting behavior must stay covered"
  - id: brand-ui
    command: ["python3", ".github/scripts/check_brand_ui.py", "--changed-files", "{changed_files}", "--base", "{base}"]
    triggers: ["desktop/macos/Desktop/Sources/**/*.swift", "app/lib/**/*.dart", "web/**/*.ts", "web/**/*.tsx", "web/**/*.js", "web/**/*.jsx", "web/**/*.css"]
    lanes: ["local", "ci"]
    reason: "INV-UI-1 applies to changed UI sources"
  - id: rayban-dat-plugin-boundary
    command: ["ruby", "app/ios/test/rayban_dat_plugin_boundary_test.rb"]
    triggers: ["app/ios/Podfile", "app/ios/Podfile.lock", "app/ios/rayban_dat_plugin_boundary.rb", "app/ios/test/rayban_dat_plugin_boundary_test.rb", ".github/checks-manifest.yaml"]
    lanes: ["local", "ci"]
    platforms: ["linux", "macos"]
    reason: "Ray-Ban DAT launch collision requires the Meta and mcumgr SwiftProtobuf copies to remain in mutually exclusive iOS pod graphs"
  - id: rayban-dat-xcode-graph
    command: ["ruby", "app/ios/test/rayban_dat_xcode_graph_test.rb"]
    triggers: ["app/ios/Podfile", "app/ios/Flutter/raybanDat*.xcconfig", "app/ios/Runner.xcodeproj/project.pbxproj", "app/ios/Runner.xcodeproj/xcshareddata/xcschemes/raybanDat.xcscheme", "app/ios/Runner.xcodeproj/project.xcworkspace/xcshareddata/swiftpm/Package.resolved", "app/ios/test/rayban_dat_xcode_graph_test.rb", ".github/checks-manifest.yaml"]
    lanes: ["local", "ci"]
    platforms: ["linux", "macos"]
    reason: "Ray-Ban DAT must link Meta 0.8.0 only in its dedicated signed iOS target while the default Runner remains audio-only"
  - id: rayban-dat-build-wrapper
    command: ["ruby", "app/ios/test/rayban_dat_build_wrapper_test.rb"]
    triggers: ["app/scripts/rayban_dat.sh", "app/ios/Podfile", "app/ios/rayban_dat_plugin_boundary.rb", "app/ios/test/rayban_dat_build_wrapper_test.rb", ".github/checks-manifest.yaml"]
    lanes: ["local", "ci"]
    platforms: ["linux", "macos"]
    reason: "Ray-Ban DAT builds must strip mcumgr before CocoaPods and restore the exact default graph even after interruption"
  - id: watch-recording-presentation
    command: ["ruby", "app/ios/test/watch_recording_presentation_test.rb"]
    triggers: ["app/ios/omiWatchApp/ContentView.swift", "app/ios/omiWatchApp/Localizable.xcstrings", "app/ios/omiWatchApp/RecordingPresentation.swift", "app/ios/omiWatchApp/WatchAudioRecorderViewModel.swift", "app/ios/omiWatchApp/WatchRecorderControlling.swift", "app/ios/omiWatchApp/omiwatchApp.swift", "app/ios/Runner.xcodeproj/project.pbxproj", "app/ios/test/watch_recording_presentation_test.rb", ".github/checks-manifest.yaml"]
    lanes: ["local", "ci"]
    platforms: ["macos"]
    reason: "SCA-273: the real watch presentation contract must stop its ripple after five seconds, preserve elapsed time, and localize accessibility labels for every native locale"
  - id: ios-speech-deadline
    command: ["ruby", "app/ios/test/speech_deadline_test.rb"]
    triggers: ["app/ios/Runner/SpeechDeadline.swift", "app/ios/Runner/AppDelegate.swift", "app/ios/Runner.xcodeproj/project.pbxproj", "app/ios/test/speech_deadline_test.rb", ".github/checks-manifest.yaml"]
    lanes: ["local", "ci"]
    platforms: ["macos"]
    reason: "PR 12935: speech availability must return on deadline without awaiting shared downloads, and recognition cleanup must precede retry"
  - id: ios-flutter-launch-engine-guard
    command: ["ruby", "app/ios/test/flutter_launch_engine_guard_test.rb"]
    triggers: ["app/ios/Runner/FlutterLaunchEngineGuard.swift", "app/ios/Runner/AppDelegate.swift", "app/ios/test/flutter_launch_engine_guard_test.rb", ".github/checks-manifest.yaml"]
    lanes: ["local", "ci"]
    platforms: ["macos"]
    reason: "a debug build opened without Flutter tooling has no engine; AppDelegate must skip plugin registration instead of handing plugins a nil registrar (launch crash in SwiftAwesomeNotificationsPlugin.register)"
  - id: ios-ble-energy-policy
    command: ["ruby", "app/ios/test/omi_ble_energy_policy_test.rb"]
    triggers: ["app/ios/Runner/Ble/OmiBleEnergyPolicy.swift", "app/ios/Runner/Ble/OmiBleManager.swift", "app/ios/Runner/Ble/BleHostApiImpl.swift", "app/ios/Runner.xcodeproj/project.pbxproj", "app/ios/test/omi_ble_energy_policy_test.rb", ".github/checks-manifest.yaml"]
    lanes: ["local", "ci"]
    platforms: ["macos"]
    reason: "iOS BLE diagnostics must not poll RSSI while closed, and frequent battery notifications must not rewrite the complete history on every packet"
  - id: ios-batch-audio-energy
    command: ["ruby", "app/ios/test/batch_audio_energy_test.rb"]
    triggers: ["app/ios/Runner/Batch/BaseBatchAudioWriter.swift", "app/ios/Runner/Batch/BatchAudioWriter.swift", "app/ios/Runner/PhoneMic/PhoneMicBatchAudioWriter.swift", "app/ios/test/batch_audio_energy_test.*", ".github/checks-manifest.yaml"]
    lanes: ["local", "ci"]
    platforms: ["macos"]
    reason: "c04b703719 writes each native batch frame in two calls; 370b1045a0 rereads saved phone location each append; exercise those production writers while preserving frame durability and metadata freshness"
  - id: deferred-work-markers
    command: ["python3", ".github/scripts/deferred-work-marker-count.py", "--changed-files", "{changed_files}", "--base", "{base}", "--check-new"]
    triggers: ["all"]
    lanes: ["local", "ci"]
    reason: "new deferred-work markers must cite a tracking issue"
  - id: deployment-secret-boundary
    command: ["python3", ".github/scripts/check_deployment_secret_boundary.py", "--base", "{base}"]
    triggers: [".github/workflows/**/*.yml", ".github/workflows/**/*.yaml", ".github/scripts/check_deployment_secret_boundary.py", ".github/scripts/test_check_deployment_secret_boundary.py", "backend/charts/*/*_values.yaml", "backend/deploy/runtime_env.yaml", "config/deployment-setting-classification.json"]
    lanes: ["local", "ci"]
    reason: "new or changed deployment bindings must use a checked-in secret, config, or public-build classification"
  - id: deployment-secret-boundary-fixtures
    command: ["python3", ".github/scripts/test_check_deployment_secret_boundary.py"]
    triggers: [".github/scripts/check_deployment_secret_boundary.py", ".github/scripts/test_check_deployment_secret_boundary.py"]
    lanes: ["local", "ci"]
    reason: "deployment secret-boundary fake-name fixtures must remain executable"
  - id: github-runner-cost-policy
    command: ["python3", ".github/scripts/check_runner_cost_policy.py"]
    triggers: [".github/workflows/**/*.yml", ".github/workflows/**/*.yaml", ".github/actionlint.yaml", ".github/scripts/check_runner_cost_policy.py", ".github/scripts/test_check_runner_cost_policy.py", ".github/checks-manifest.yaml"]
    lanes: ["local", "ci"]
    reason: "SCA-196: public-repository standard runners are free while the larger ubuntu-latest-m label caused recurring Linux 4-core charges"
  - id: github-runner-cost-policy-fixtures
    command: ["python3", ".github/scripts/test_check_runner_cost_policy.py"]
    triggers: [".github/scripts/check_runner_cost_policy.py", ".github/scripts/test_check_runner_cost_policy.py"]
    lanes: ["local", "ci"]
    reason: "runner cost-policy fixtures must keep rejecting the paid larger-runner label"
  - id: windows-sync-pr-retirement-contract
    command: ["python3", ".github/scripts/test_retire_superseded_sync_prs.py"]
    triggers: [".github/workflows/desktop_windows_release.yml", ".github/scripts/retire_superseded_sync_prs.py", ".github/scripts/test_retire_superseded_sync_prs.py"]
    lanes: ["local", "ci"]
    reason: "#10727: the Windows release sync-PR cleanup must retain the current PR, only close same-repo release/windows-v* heads, and never block the release"
  - id: telegram-deployment-notifier
    command: ["bash", ".github/actions/deployment-notifier/test-check-configuration.sh"]
    triggers: [".github/actions/deployment-notifier/**", ".github/checks-manifest.yaml"]
    lanes: ["local", "ci"]
    reason: "optional Telegram deployment notifications must not fail deploy workflows when credentials are absent"
  - id: opentofu-foundation-boundary
    command: ["python3", ".github/scripts/check_opentofu_foundation.py"]
    triggers: ["infrastructure/opentofu/**", ".github/scripts/check_opentofu_foundation.py", ".github/workflows/opentofu-foundation-validate.yml"]
    lanes: ["local", "ci"]
    reason: "OpenTofu remains limited to durable foundation resources and cannot carry secret values"
  - id: opentofu-foundation-boundary-fixtures
    command: ["python3", ".github/scripts/test_check_opentofu_foundation.py"]
    triggers: ["infrastructure/opentofu/**", ".github/scripts/check_opentofu_foundation.py", ".github/scripts/test_check_opentofu_foundation.py", ".github/workflows/opentofu-foundation-validate.yml"]
    lanes: ["local", "ci"]
    reason: "OpenTofu foundation boundary fixtures must reject release and secret-value ownership"
  - id: opentofu-development-wif-pilot
    command: ["python3", ".github/scripts/check_opentofu_development_wif_pilot.py"]
    triggers: ["infrastructure/opentofu/pilots/development-wif-plan/**", "infrastructure/opentofu/probes/development-project-read/**", ".github/scripts/check_opentofu_development_wif_pilot.py", ".github/workflows/opentofu-development-wif-pilot.yml", ".github/workflows/opentofu-development-wif-pilot-validate.yml"]
    lanes: ["local", "ci"]
    reason: "development WIF pilot stays read-only, GitHub-main-scoped, and outside release ownership"
  - id: opentofu-development-wif-pilot-fixtures
    command: ["python3", ".github/scripts/test_check_opentofu_development_wif_pilot.py"]
    triggers: ["infrastructure/opentofu/pilots/development-wif-plan/**", "infrastructure/opentofu/probes/development-project-read/**", ".github/scripts/check_opentofu_development_wif_pilot.py", ".github/scripts/test_check_opentofu_development_wif_pilot.py", ".github/workflows/opentofu-development-wif-pilot.yml", ".github/workflows/opentofu-development-wif-pilot-validate.yml"]
    lanes: ["local", "ci"]
    reason: "development WIF pilot fixtures must reject secret access, apply, and scope expansion"
  - id: public-build-contract
    command: ["python3", ".github/scripts/check_public_build_contract.py"]
    triggers: [".github/actions/deploy-public-build/**", ".github/actions/prepare-public-build/**", ".github/actions/public-build-candidate-promotion/**", ".github/workflows/gcp_admin.yml", ".github/workflows/gcp_app.yml", ".github/workflows/gcp_frontend.yml", ".github/workflows/gcp_personas.yml", ".github/workflows/public-build-config-preflight.yml", ".github/scripts/check_public_build_contract.py", ".github/scripts/preflight_public_build_config.py", ".github/scripts/preflight_public_build_runtime.py", ".github/scripts/smoke_public_build_browser.py", ".github/scripts/public_build_acceptance_route.py", ".github/scripts/test_check_public_build_contract.py", "config/public-build-contract.json", "config/public-build-values.json", "config/deployment-setting-classification.json", "web/admin/Dockerfile", "web/app/Dockerfile", "web/frontend/Dockerfile", "web/personas-open-source/Dockerfile", "web/admin/components/public-build-canary.tsx", "web/app/src/components/public-build-canary.tsx", "web/frontend/src/components/public-build-canary.tsx", "web/personas-open-source/src/components/public-build-canary.tsx", "web/personas-open-source/src/app/api/social-profile/route.ts"]
    lanes: ["local", "ci"]
    reason: "reviewed public inputs, Docker guards, client canaries, no-traffic candidates, and promotion wiring must match one contract"
  - id: public-build-contract-fixtures
    command: ["python3", ".github/scripts/test_check_public_build_contract.py"]
    triggers: [".github/scripts/check_public_build_contract.py", ".github/scripts/preflight_public_build_config.py", ".github/scripts/preflight_public_build_runtime.py", ".github/scripts/smoke_public_build_browser.py", ".github/scripts/public_build_acceptance_route.py", ".github/scripts/test_check_public_build_contract.py", "web/personas-open-source/src/app/api/social-profile/route.ts"]
    lanes: ["local", "ci"]
    reason: "public-build contract and GitHub variable scope fixtures must remain executable"
  - id: web-app-checks
    command: ["bash", "web/app/test.sh"]
    triggers: ["web/app/src/**", "web/app/package.json", "web/app/bun.lock", "web/app/tsconfig.json", "web/app/vitest.config.mts", "web/app/vitest.setup.ts", "web/app/scripts/moonshine-smoke.test.ts", "web/app/test.sh", ".github/checks-manifest.yaml"]
    lanes: ["local", "ci"]
    reason: "web/app shipped with no typecheck or test lane at all, so desktop-parity work there had no runnable Definition-of-Done gate"
  - id: admin-deploy-scope
    command: ["python3", ".github/scripts/check_admin_deploy_scope_admission.py"]
    triggers: [".github/workflows/gcp_admin.yml", ".github/scripts/check_admin_deploy_scope.py", ".github/scripts/check_admin_deploy_scope_admission.py", ".github/scripts/test_check_admin_deploy_scope.py", ".github/checks-manifest.yaml"]
    lanes: ["local", "ci"]
    reason: "admin Cloud Run deploys must decide scope before taking the shared prod environment slot"
  - id: admin-deploy-scope-fixtures
    command: ["python3", ".github/scripts/test_check_admin_deploy_scope.py"]
    triggers: [".github/workflows/gcp_admin.yml", ".github/scripts/check_admin_deploy_scope.py", ".github/scripts/check_admin_deploy_scope_admission.py", ".github/scripts/test_check_admin_deploy_scope.py", "web/admin/grafana/dashboards/omi-tv.json", "web/admin/grafana/apply_omi_tv_dashboard.py", ".github/checks-manifest.yaml"]
    lanes: ["local", "ci"]
    reason: "generated-client-only diffs must skip admin deploy; real admin runtime diffs and workflow_dispatch must still deploy"
  - id: grafana-dashboard-build
    command: ["python3", "web/admin/grafana/test_build_dashboards.py"]
    triggers: ["web/admin/grafana/**", ".github/checks-manifest.yaml"]
    lanes: ["local", "ci"]
    reason: "platform boards must stay honest per-platform and every day-grain column must render on its NYC calendar day (bare UTC dates hid the latest day)"
  - id: web-llm-gateway-only
    command: ["python3", ".github/scripts/check_web_llm_gateway_only.py"]
    triggers: ["web/**/*.js", "web/**/*.jsx", "web/**/*.mjs", "web/**/*.ts", "web/**/*.tsx", "web/**/package.json", ".github/scripts/check_web_llm_gateway_only.py", ".github/checks-manifest.yaml"]
    lanes: ["local", "ci"]
    reason: "SCA-118: production web LLM traffic must not regain direct provider SDKs, URLs, or credentials"
  - id: web-frontend-tests
    command: ["bash", "scripts/run-web-frontend-tests.sh"]
    triggers: ["web/frontend/**", "scripts/run-web-frontend-tests.sh", "config/public-build-contract.json", ".github/actions/deploy-public-build/action.yml", ".github/workflows/gcp_frontend.yml", ".github/checks-manifest.yaml", "app/android/app/src/main/AndroidManifest.xml"]
    lanes: ["local", "ci"]
    reason: "web/frontend's node --test suite had no lane, so its guards never ran in CI and a deleted frontend test had to be re-homed into a backend pytest to keep running"
  - id: web-llm-gateway-only-tests
    command: ["python3", ".github/scripts/test_check_web_llm_gateway_only.py"]
    triggers: [".github/scripts/check_web_llm_gateway_only.py", ".github/scripts/test_check_web_llm_gateway_only.py", ".github/checks-manifest.yaml"]
    lanes: ["local", "ci"]
    reason: "the gateway-only source guard must reject provider regressions without flagging its own fixtures"
  - id: backend-async-blockers
    command: ["python3", "backend/scripts/scan_async_blockers.py", "--dirs", "backend/routers", "backend/utils", "backend/dependencies.py", "--diff-base", "{base}", "--fail-on", "high_network_io,async_helpers_with_blocking,time_sleep,mixed_await_sync_db,no_await_should_be_def,unmanaged_thread_offload"]
    triggers: ["backend/**/*.py", "backend/scripts/scan_async_blockers.py"]
    lanes: ["local", "ci"]
    reason: "backend Python changed"
  - id: legacy-memory-surface-ratchet
    command: ["python3", "backend/scripts/legacy_memory_surface_inventory.py", "--check-ratchet", "--base-ref", "{base}"]
    triggers: ["backend/scripts/legacy_memory_surface_inventory.py", "backend/scripts/legacy_memory_surface_baseline.json", "backend/tests/unit/test_legacy_memory_surface_inventory.py", "backend/utils/conversations/process_conversation.py", "backend/utils/conversations/merge_conversations.py", "backend/utils/sync/pipeline.py", "backend/utils/memory/*.py", "backend/jobs/short_term_lifecycle_worker.py", "backend/modal/memory_maintenance_job.py", "backend/routers/conversations.py", "backend/routers/developer.py", "backend/routers/listen/conversations.py", "backend/routers/mcp.py", "backend/routers/mcp_sse.py", "backend/routers/memory_admin.py", "backend/routers/users.py", "backend/database/product_memory_items.py", "backend/database/users.py", "backend/runtime_images.json", "backend/utils/llm/ai_user_profile.py", "backend/deploy/runtime_env/*.yaml", "backend/scripts/memory-continuity-gauntlet.py", "backend/scripts/validate_memory_maintenance_scheduler.py", "desktop/macos/Desktop/Sources/ProactiveAssistants/**/*.swift", "desktop/macos/Desktop/Sources/Providers/ChatProvider.swift", "desktop/macos/Desktop/Sources/Rewind/Core/RewindDatabase.swift", "desktop/windows/src/main/assistants/**/*.ts", "desktop/windows/src/main/agentKernel/desktopChatPrompt.ts", "desktop/windows/src/main/ipc/mainChatPersonalization.ts", "desktop/windows/src/main/ipc/db.ts", ".github/workflows/gcp_memory_maintenance_job*.yml"]
    lanes: ["local", "ci"]
    reason: "Gate F legacy memory surfaces may shrink during the JIT-processing migration but must not gain new source or deployment references"
  - id: backend-datetime-sort-sentinel-ratchet
    command: ["python3", "backend/scripts/check_datetime_sort_sentinel_ratchet.py"]
    triggers: ["backend/**/*.py", "backend/scripts/check_datetime_sort_sentinel_ratchet.py"]
    lanes: ["local", "ci"]
    reason: "#9571/#9600 reject naive datetime min/max fallbacks in backend sort keys"
  - id: backend-route-policy-baseline
    command: ["python3", "backend/scripts/check_route_policy_baseline.py", "--base-ref", "{base}"]
    triggers: ["backend/**/*.py", "backend/route_policy_manifest.yaml", "backend/route_policy_legacy_missing_routes.txt", "backend/scripts/check_route_policy_baseline.py"]
    lanes: ["local", "ci"]
    reason: "new backend routes must declare reviewed policy instead of growing the legacy baseline"
  - id: plan-catalog-contract
    command: ["python3", "backend/scripts/generate_plan_catalog.py", "--check", "--base-ref", "{base}"]
    triggers: ["**/*.arb", "**/*.cjs", "**/*.dart", "**/*.env", "**/*.ini", "**/*.js", "**/*.json", "**/*.jsx", "**/*.mjs", "**/*.plist", "**/*.properties", "**/*.py", "**/*.sh", "**/*.swift", "**/*.tf", "**/*.toml", "**/*.tpl", "**/*.ts", "**/*.tsx", "**/*.xml", "**/*.yaml", "**/*.yml", "**/Dockerfile*", ".github/checks-manifest.yaml"]
    lanes: ["local", "ci"]
    reason: "the plan catalog must remain valid, generated exactly, append-only for billed identities, and exhaustive for committed production Stripe object IDs; this would have prevented the f30245338-to-2e71145ab Neo revert incident"
  - id: firestore-index-manifest
    command: ["python3", "backend/scripts/generate_firestore_indexes.py"]
    triggers: ["firestore.indexes.json", "backend/database/firestore_index_registry.py", "backend/scripts/generate_firestore_indexes.py"]
    lanes: ["local", "ci"]
    reason: "Firebase composite-index manifest must be generated from the registered requirements"
  - id: firestore-query-coverage
    command: ["python3", "backend/scripts/firestore_query_coverage.py", "--check-ratchet"]
    triggers: ["backend/**/*.py", "backend/scripts/firestore_query_coverage_baseline.json", "backend/scripts/firestore_query_coverage_waivers.json"]
    lanes: ["local", "ci"]
    reason: "serving Firestore compound queries cannot add unregistered or unsupported debt"
  - id: firestore-model-read-boundary
    command: ["python3", ".github/scripts/check_firestore_model_read_boundary.py"]
    triggers: ["backend/database/**/*.py", ".github/scripts/check_firestore_model_read_boundary.py", ".github/scripts/firestore_model_read_boundary_baseline.json"]
    lanes: ["local", "ci"]
    reason: "#9494 -> #9696 malformed Firestore documents must use the shared read boundary"
  - id: lifecycle-header-checker-tests
    command: ["python3", ".github/scripts/test_check_lifecycle_headers.py"]
    triggers: [".github/scripts/check_lifecycle_headers.py", ".github/scripts/test_check_lifecycle_headers.py", ".github/checks-manifest.yaml"]
    lanes: ["local", "ci"]
    reason: "one-time rollout scaffolding must keep requiring a DELETE-AFTER reference"
  - id: lifecycle-headers
    command: ["python3", ".github/scripts/check_lifecycle_headers.py", "--changed-files", "{changed_files}"]
    triggers: ["all"]
    lanes: ["local", "ci"]
    reason: "rollout scaffolding may require lifecycle headers"
  - id: version-prefixed-filename-tests
    command: ["python3", ".github/scripts/test_check_version_prefixed_filenames.py"]
    triggers: [".github/scripts/check_version_prefixed_filenames.py", ".github/scripts/test_check_version_prefixed_filenames.py", ".github/checks-manifest.yaml"]
    lanes: ["local", "ci"]
    reason: "the repository-wide filename contract must keep rejecting a version-prefixed path"
  - id: version-prefixed-filenames
    command: ["python3", ".github/scripts/check_version_prefixed_filenames.py"]
    triggers: ["all"]
    lanes: ["local", "ci"]
    reason: "repository-wide version-prefixed filename contract"
  - id: backend-import-purity
    command: ["python3", "backend/scripts/scan_import_time_side_effects.py", "--files", "{changed_files}", "--check-allowlist-monotonic", "{base}"]
    triggers: ["backend/**/*.py"]
    lanes: ["local", "ci"]
    reason: "backend production Python changes must retain import-time purity"
  - id: backend-runtime-image-source-closure
    command: ["python3", "backend/scripts/runtime_image_contracts.py", "check"]
    triggers: ["backend/**/*.py", "backend/**/Dockerfile*", "backend/runtime_images.json", "backend/scripts/runtime_image_contracts.py", ".github/workflows/runtime_image_contracts.yml", ".github/workflows/desktop_backend_auto_dev.yml", ".github/workflows/gcp_backend*.yml", ".github/workflows/gcp_diarizer.yml", ".github/workflows/gcp_models.yml", ".github/workflows/gcp_parakeet.yml", ".github/workflows/gcp_nllb_translation.yml", ".github/workflows/gcp_memory_maintenance_job*.yml", ".github/workflows/gcp_notifications_job.yml", ".github/workflows/gcp_plugins.yml", "plugins/**/*.py", "plugins/Dockerfile"]
    lanes: ["local", "ci"]
    reason: "#9857: deployable Python images must contain the transitive first-party imports of their runtime entrypoints"
  - id: backend-module-isolation
    command: ["python3", "backend/scripts/check_module_stub_pollution.py", "--files", "{changed_files}", "--check-allowlist-monotonic", "{base}"]
    triggers: ["backend/tests/**/*.py", "backend/testing/**/*.py", "backend/tests/.module_stub_legacy_allowlist", "backend/scripts/check_module_stub_pollution.py"]
    lanes: ["local", "ci"]
    reason: "backend tests or their isolation allowlist changed"
  - id: backend-runtime-env-compose
    command: ["bash", "backend/scripts/check_runtime_env_compose.sh"]
    triggers: ["backend/deploy/runtime_env/_base.yaml", "backend/deploy/runtime_env/dev.overlay.yaml", "backend/deploy/runtime_env/prod.overlay.yaml", "backend/deploy/compose_runtime_env.py", "backend/deploy/_generate_runtime_env_sources.py", "backend/deploy/runtime_env.yaml", "backend/scripts/check_runtime_env_compose.sh", ".github/checks-manifest.yaml"]
    lanes: ["local", "ci"]
    reason: "composed runtime_env.yaml must match its declarative base and overlay sources"
  - id: pusher-runtime-capability-admission-dev
    command: ["python3", "backend/scripts/validate-backend-runtime-env.py", "--env", "dev"]
    triggers: ["backend/deploy/runtime_env/**", "backend/charts/pusher/**", "backend/config/memory_rollout.py", "backend/pusher/main.py", "backend/scripts/runtime_env_capability_contracts.py", "backend/scripts/runtime_env_validation/**", "backend/scripts/validate-backend-runtime-env.py", ".github/workflows/gcp_backend_pusher.yml", ".github/workflows/gcp_backend_pusher_auto_deploy.yml", ".github/checks-manifest.yaml"]
    lanes: ["local", "ci"]
    reason: "2026-08-30 Pusher outage: every explicit conversation-finalization host must satisfy its semantic memory-mutation capability before deployment"
  - id: pusher-runtime-capability-admission-prod
    command: ["python3", "backend/scripts/validate-backend-runtime-env.py", "--env", "prod"]
    triggers: ["backend/deploy/runtime_env/**", "backend/charts/pusher/**", "backend/config/memory_rollout.py", "backend/pusher/main.py", "backend/scripts/runtime_env_capability_contracts.py", "backend/scripts/runtime_env_validation/**", "backend/scripts/validate-backend-runtime-env.py", ".github/workflows/gcp_backend_pusher.yml", ".github/workflows/gcp_backend_pusher_auto_deploy.yml", ".github/checks-manifest.yaml"]
    lanes: ["local", "ci"]
    reason: "2026-08-30 Pusher outage: production admission must reject an omitted host or missing, disabled, or invalid memory fence"
  - id: backend-workflow-contracts
    command: ["python3", "backend/scripts/check_workflow_contracts.py", "--changed-files", "{changed_files}"]
    triggers: ["backend/**/*.py", "backend/testing/workflow_contracts.json", ".github/workflows/**/*.yml", ".github/actions/detect-changes/**", "scripts/pre-push", "scripts/changed-files"]
    lanes: ["local", "ci"]
    reason: "workflow boundary sources changed"
  - id: pusher-rollout-readiness-budget
    command: ["python3", "backend/scripts/verify_pusher_rollout_budget.py"]
    triggers: ["backend/charts/pusher/**", ".github/workflows/gcp_backend_pusher.yml", ".github/workflows/gcp_backend_pusher_auto_deploy.yml", "backend/scripts/verify_pusher_rollout_budget.py", "backend/tests/unit/test_verify_pusher_rollout_budget.py", ".github/checks-manifest.yaml"]
    lanes: ["local", "ci"]
    reason: "#9988: Pusher's Kubernetes deadline and workflow wait must cover chart-derived availability at the HPA ceiling"
  - id: pusher-rollout-quality-gate
    command: ["python3", "backend/scripts/verify_pusher_rollout_gate.py"]
    triggers: ["backend/charts/pusher/**", "backend/utils/metrics.py", "backend/routers/pusher.py", "backend/utils/readiness.py", ".github/workflows/gcp_backend_pusher.yml", ".github/workflows/gcp_backend_pusher_auto_deploy.yml", "backend/scripts/verify_pusher_rollout_gate.py", "backend/scripts/verify_pusher_source_closure.py", "backend/pusher/Dockerfile", "backend/tests/unit/test_verify_pusher_rollout_gate.py", "backend/tests/unit/test_pusher_deployment_control_workflow.py", ".github/checks-manifest.yaml"]
    lanes: ["local", "ci"]
    reason: "SCA-39: static preflight that fails closed when a pusher rollout cannot be verified safe (capacity, image identity, readiness/health split, telemetry)"
  - id: pusher-dev-bake-observability
    command: ["python3", "backend/scripts/verify_pusher_dev_observability.py"]
    triggers: ["backend/charts/pusher/dev_omi_pusher_values.yaml", "backend/charts/monitoring/kube-prometheus-stack/dev_omi_monitoring_values.yaml", "backend/charts/monitoring/dashboards/gke/pusher.json", "backend/utils/metrics.py", "backend/scripts/verify_pusher_dev_observability.py", "backend/tests/unit/test_verify_pusher_dev_observability.py", ".github/checks-manifest.yaml"]
    lanes: ["local", "ci"]
    reason: "SCA-115: dev Pusher bake must retain isolated scrape plus connection, drain, and reconnect-circuit visibility"
  - id: shared-config-migration-preflight
    command: ["python3", "backend/scripts/verify_shared_config_migration.py", "preflight"]
    triggers: ["backend/charts/pusher/**", "backend/scripts/verify_shared_config_migration.py", "backend/tests/unit/test_verify_shared_config_migration.py", ".github/checks-manifest.yaml"]
    lanes: ["local", "ci"]
    reason: "SCA-39: static preflight that fails closed when pusher chart env/envFrom config references are structurally invalid (the 2026-07-22 REDIS_DB_HOST outage class)"
  - id: pusher-cohost-env-diff
    command: ["python3", "backend/scripts/verify_pusher_cohost_env_diff.py"]
    triggers: ["backend/charts/pusher/**", "backend/charts/backend-listen/**", "backend/scripts/verify_pusher_cohost_env_diff.py", "backend/tests/unit/test_verify_pusher_cohost_env_diff.py", ".github/workflows/gcp_backend_pusher.yml", ".github/workflows/gcp_backend_pusher_auto_deploy.yml", ".github/checks-manifest.yaml"]
    lanes: ["local", "ci"]
    reason: "2026-08-30 pusher finalization outage: unexplained pusher vs backend-listen env divergence must fail the deploy path (decision 4 co-host env-diff)"
  - id: conversation-lifecycle-write-guard
    command: ["python3", "backend/scripts/check_conversation_lifecycle_writes.py"]
    triggers: ["backend/**/*.py", "backend/scripts/check_conversation_lifecycle_writes.py"]
    lanes: ["local", "ci"]
    reason: "conversation lifecycle has one mutation owner"
  - id: desktop-swift-ci-contract
    command: ["python3", ".github/scripts/test_desktop_swift_ci_contract.py"]
    triggers: [".github/workflows/desktop-swift-ci.yml", "scripts/pre_push_ci_prediction.py", ".github/scripts/test_desktop_swift_ci_contract.py"]
    lanes: ["local", "ci"]
    reason: "#9843 Rung-0: desktop Swift CI must pin its toolchain and cache on Package.resolved"
  - id: desktop-windows-ci-contract
    command: ["python3", ".github/scripts/test_desktop_windows_ci_contract.py"]
    triggers: [".github/workflows/desktop-windows-ci.yml", ".github/scripts/test_desktop_windows_ci_contract.py", ".github/checks-manifest.yaml"]
    lanes: ["local", "ci"]
    reason: "PR #11447: Linux Electron package smoke retries transient postinstall downloads without masking persistent failures"
  - id: resolve-desktop-changelog-sync-fixtures
    command: ["python3", ".github/scripts/test_resolve_desktop_changelog_sync.py"]
    triggers: [".github/scripts/resolve-desktop-changelog-sync.py", ".github/scripts/test_resolve_desktop_changelog_sync.py", ".github/workflows/desktop_auto_release.yml", ".github/checks-manifest.yaml"]
    lanes: ["local", "ci"]
    reason: "issue #11936: squash/orphan changelog recovery must not hard-fail every hourly retry or scan main history O(n)"
  - id: desktop-candidate-source-gate
    command: ["python3", ".github/scripts/test_plan_desktop_release.py"]
    triggers: [".github/scripts/plan-desktop-release.py", ".github/scripts/test_plan_desktop_release.py", ".github/workflows/desktop_auto_release.yml", ".github/checks-manifest.yaml"]
    lanes: ["local", "ci"]
    reason: "the hourly workflow bypasses queued GitHub compile checks when tag-bound Codemagic owns admission, while the candidate clock still limits tags to one per hour"
  - id: desktop-candidate-source-identity
    command: ["python3", ".github/scripts/test_desktop_release_source_identity.py"]
    triggers: [".github/scripts/desktop-release-source-identity.py", ".github/scripts/test_desktop_release_source_identity.py", ".github/workflows/desktop_auto_release.yml", ".github/checks-manifest.yaml"]
    lanes: ["local", "ci"]
    reason: "issue #11936: a candidate stays on the exact release source (or changelog-only child) while later desktop merges queue for the next train"
  - id: desktop-candidate-tag-transaction
    command: ["python3", ".github/scripts/test_publish_desktop_candidate_tag.py"]
    triggers: [".github/scripts/publish-desktop-candidate-tag.py", ".github/scripts/test_publish_desktop_candidate_tag.py", ".github/workflows/desktop_auto_release.yml", ".github/checks-manifest.yaml"]
    lanes: ["local", "ci"]
    reason: "issue #11936: authoritative GitHub ancestry plus timestamped create-only publication admits an exact source after main advances"
  - id: desktop-codemagic-tag-build-observer
    command: ["python3", ".github/scripts/test_observe_codemagic_tag_build.py"]
    triggers: [".github/scripts/observe-codemagic-tag-build.py", ".github/scripts/test_observe_codemagic_tag_build.py", ".github/workflows/desktop_auto_release.yml", ".github/checks-manifest.yaml"]
    lanes: ["local", "ci"]
    reason: "SCA-155 requires exactly one exact-tag Codemagic build; missing, duplicate, and unobservable candidates fail closed with durable evidence"
  - id: desktop-codemagic-preview-build-observer
    command: ["python3", ".github/scripts/test_observe_codemagic_preview_build.py"]
    triggers: [".github/scripts/observe-codemagic-preview-build.py", ".github/scripts/test_observe_codemagic_preview_build.py", ".github/workflows/desktop_publish_preview.yml", ".github/checks-manifest.yaml"]
    lanes: ["local", "ci"]
    reason: "#10145 requires the preview dispatcher to poll Codemagic to a terminal status; silent green after dispatch is not proof the preview published"
  - id: desktop-codemagic-tag-intake-cli
    command: ["python3", ".github/scripts/check-codemagic-tag-intake.py", "--help"]
    triggers: [".github/scripts/check-codemagic-tag-intake.py", ".github/workflows/desktop_auto_release.yml", ".github/checks-manifest.yaml"]
    lanes: ["local", "ci"]
    reason: "SCA-179 keeps the direct Codemagic intake controller executable in every candidate-control revision"
  - id: desktop-codemagic-tag-intake-fixtures
    command: ["python3", ".github/scripts/test_check_codemagic_tag_intake.py"]
    triggers: [".github/scripts/check-codemagic-tag-intake.py", ".github/scripts/test_check_codemagic_tag_intake.py", ".github/workflows/desktop_auto_release.yml", "codemagic.yaml", ".github/checks-manifest.yaml"]
    lanes: ["local", "ci"]
    reason: "SCA-179 requires exact-tag evidence that direct Codemagic dispatch selected the release workflow and immutable source"
  - id: desktop-codemagic-failure-recovery
    command: ["python3", ".github/scripts/test_desktop_codemagic_failure_recovery.py"]
    triggers: [".github/scripts/desktop-codemagic-failure-recovery.py", ".github/scripts/desktop-codemagic-recovery-profiles.json", ".github/scripts/test_desktop_codemagic_failure_recovery.py", ".github/workflows/desktop_codemagic_failure_recovery.yml", "desktop/macos/scripts/rehearse-desktop-release.sh", "desktop/macos/scripts/smoke-signed-desktop-artifact.sh", "desktop/macos/scripts/agent-runtime-payload.sh", "desktop/macos/tests/test-signed-artifact-smoke.sh", ".github/checks-manifest.yaml"]
    lanes: ["local", "ci"]
    reason: "failed desktop Codemagic builds must emit a credential-safe exact-build recovery capsule and prescribe a manual rehearsal only for locally reproducible gates"
  - id: desktop-release-rehearsal-contract
    command: ["bash", "desktop/macos/tests/test-desktop-release-rehearsal.sh"]
    triggers: ["desktop/macos/scripts/rehearse-desktop-release.sh", "desktop/macos/tests/test-desktop-release-rehearsal.sh", ".github/checks-manifest.yaml"]
    lanes: ["local", "ci"]
    reason: "the local desktop release rehearsal must remain manual, exact-failed-build-bound, credential-safe, and incapable of publishing or changing a release channel"
  - id: mobile-internal-build-cadence
    command: ["python3", ".github/scripts/test_dispatch_mobile_internal_builds.py"]
    triggers: [".github/scripts/dispatch_mobile_internal_builds.py", ".github/scripts/test_dispatch_mobile_internal_builds.py", ".github/workflows/mobile_internal_build.yml", "codemagic.yaml", ".github/checks-manifest.yaml"]
    lanes: ["local", "ci"]
    reason: "internal mobile builds are dispatched on a cadence, so who gets an instant build and when the batch fires must stay pinned rather than drift back to build-per-merge"
  - id: desktop-manifest-routes
    command: ["python3", ".github/scripts/test_desktop_manifest_routes.py"]
    triggers: [".github/workflows/desktop-swift-ci.yml", ".github/checks-manifest.yaml", ".github/scripts/run_checks.py", "scripts/pre_push_ci_prediction.py", ".github/scripts/test_desktop_manifest_routes.py"]
    lanes: ["local", "ci"]
    reason: "#9843 Ticket 02: macOS-only manifest checks must have an executable CI route"
  - id: desktop-app-icon-bundle
    command: ["bash", "desktop/macos/tests/test-app-icon-bundle.sh"]
    triggers: ["desktop/macos/run.sh", "desktop/macos/omi_icon.icns", "desktop/macos/tests/test-app-icon-bundle.sh", ".github/checks-manifest.yaml"]
    lanes: ["local", "ci"]
    platforms: ["macos"]
    reason: "named bundles must keep copying the canonical app icon, and the regression test must remain an executable deterministic check"
  - id: desktop-local-dev-entitlements
    command: ["bash", "desktop/macos/tests/test-prepare-local-dev-entitlements.sh"]
    triggers: ["desktop/macos/run.sh", "desktop/macos/scripts/prepare-local-dev-entitlements.sh", "desktop/macos/tests/test-prepare-local-dev-entitlements.sh", ".github/checks-manifest.yaml"]
    lanes: ["local", "ci"]
    platforms: ["macos"]
    reason: "local dev signing granted disable-library-validation only for the literal `-` identity, so the documented self-signed 'Omi Local Dev Signing' identity (TeamIdentifier=not set) built bundles dyld refused to launch while `codesign --verify` passed and `open -a` exited 0; this suite had no runner, so nothing caught it"
  - id: desktop-swift-format-wrapper
    command: ["bash", "desktop/macos/tests/test-swift-format-wrapper.sh"]
    triggers: ["desktop/macos/scripts/swift-format-wrapper.sh", "desktop/macos/tests/test-swift-format-wrapper.sh"]
    lanes: ["local", "ci"]
    reason: "#9843 Ticket 02: pinned swift-format bootstrap wrapper provenance contract"
  - id: desktop-launch-env-forwarding
    command: ["bash", "desktop/macos/tests/test-launch-env-forwarding.sh"]
    triggers: ["desktop/macos/run.sh", "desktop/macos/tests/test-launch-env-forwarding.sh"]
    lanes: ["local", "ci"]
    reason: "`open` launches from launchd, so a documented run.sh env override that is not passed with `open --env` silently does nothing; caught OMI_FORCE_CANONICAL_MEMORY_ATLAS being documented but never forwarded"
  - id: desktop-settings-seed
    command: ["bash", "desktop/macos/tests/test-settings-seed.sh"]
    triggers: ["desktop/macos/run.sh", "desktop/macos/scripts/omi-settings-seed.sh", "desktop/macos/tests/test-settings-seed.sh", ".github/checks-manifest.yaml"]
    lanes: ["local", "ci"]
    platforms: ["macos"]
    reason: "the Swift-only fast bundle path bypassed Omi Dev preference seeding, while overlay semantics retained target hotkeys absent from the source; exact domain mirroring plus common prelaunch wiring must stay guarded"
  - id: desktop-auth-seed-acl
    command: ["bash", "desktop/macos/tests/test-omi-auth-seed-acl.sh"]
    triggers: ["desktop/macos/run.sh", "desktop/macos/scripts/omi-auth-dump.sh", "desktop/macos/scripts/omi-auth-seed.sh", "desktop/macos/tests/test-omi-auth-seed-acl.sh", ".github/checks-manifest.yaml"]
    lanes: ["local", "ci"]
    platforms: ["macos"]
    reason: "auth seeding now resolves a dumpable source with a production fallback and an env override; it must keep passing APP_PATH into the seed and never CLI-write Keychain tokens"
  - id: desktop-agent-runtime-payload
    command: ["bash", "desktop/macos/tests/test-fast-dev-bundle.sh"]
    triggers: ["desktop/macos/run.sh", "desktop/macos/scripts/fast-dev-bundle.sh", "desktop/macos/scripts/agent-runtime-payload.sh", "desktop/macos/tests/test-fast-dev-bundle.sh", ".github/checks-manifest.yaml"]
    lanes: ["local", "ci"]
    reason: "a bundle built without Contents/Resources/pi-mono-extension accepted every chat turn and failed all of them (pi-mono exited 1 on `Unknown provider \"omi\"`); the fast lane reused it because the source fingerprint still matched, so packaging must verify the installed payload and not just its inputs"
  - id: desktop-signed-artifact-smoke
    command: ["bash", "desktop/macos/tests/test-signed-artifact-smoke.sh"]
    triggers: ["desktop/macos/scripts/smoke-signed-desktop-artifact.sh", "desktop/macos/scripts/agent-runtime-payload.sh", "desktop/macos/tests/test-signed-artifact-smoke.sh", ".github/checks-manifest.yaml"]
    lanes: ["local", "ci"]
    platforms: ["macos"]
    reason: "the release lane shared the dev lane's blind spot: a present-but-empty pi-mono-extension satisfied its directory-exists check and still shipped an artifact that failed every chat turn"
  - id: desktop-release-artifact-helpers
    command: ["bash", "desktop/macos/tests/test-desktop-release-artifact-helpers.sh"]
    triggers: ["codemagic.yaml", "desktop/macos/scripts/create-desktop-dmgs.sh", "desktop/macos/scripts/create-omi-beta-variant.sh", "desktop/macos/scripts/notarize-desktop-artifacts.sh", "desktop/macos/tests/test-desktop-release-artifact-helpers.sh", ".github/checks-manifest.yaml"]
    lanes: ["local", "ci"]
    platforms: ["macos"]
    reason: "stable and Beta packaging must overlap independent work while waiting for every identity and refusing to staple a partial notarization batch"
  - id: desktop-main-actor-xctest-hooks
    command: ["python3", "desktop/macos/scripts/check-main-actor-xctest-hooks.py"]
    triggers: ["desktop/macos/Desktop/Tests/**/*.swift", "desktop/macos/scripts/check-main-actor-xctest-hooks.py"]
    lanes: ["local", "ci"]
    reason: "Xcode 16.4 rejects non-Sendable XCTestCase transfers from @MainActor async lifecycle hooks; fail before the full Swift test build"
  - id: desktop-main-actor-xctest-hooks-fixtures
    command: ["python3", ".github/scripts/test_check_main_actor_xctest_hooks.py"]
    triggers: ["desktop/macos/scripts/check-main-actor-xctest-hooks.py", ".github/scripts/test_check_main_actor_xctest_hooks.py"]
    lanes: ["local", "ci"]
    reason: "adversarial fixtures for the @MainActor XCTest lifecycle compiler-failure tripwire"
  - id: desktop-swift-format-lint
    command: ["bash", "desktop/macos/scripts/swift-format-wrapper.sh", "lint-scope"]
    triggers: ["desktop/macos/Desktop/Sources/**/*.swift", "desktop/macos/Desktop/Tests/**/*.swift", "desktop/macos/Desktop/.swift-format", "desktop/macos/scripts/swift-format-wrapper.sh"]
    lanes: ["local", "ci"]
    platforms: ["macos"]
    reason: "#9843 Ticket 05: enforce pinned swift-format lint on all first-party Swift"
  - id: desktop-swiftlint-config
    command: ["python3", ".github/scripts/test_swiftlint_config.py"]
    triggers: ["desktop/macos/Desktop/.swiftlint.yml", "desktop/macos/Desktop/Package.swift", "desktop/macos/Desktop/.swiftlint-baseline.json", "desktop/macos/scripts/prepare-swiftlint-baseline.py", "desktop/macos/scripts/swiftlint-wrapper.sh", ".github/scripts/git_bash.py", ".github/scripts/test_swiftlint_config.py"]
    lanes: ["local", "ci"]
    reason: "#9843 Ticket 06: SwiftLint safety config, plugin attachment, and baseline contract"
  - id: desktop-swiftlint
    command: ["bash", "desktop/macos/scripts/swiftlint-wrapper.sh", "lint"]
    triggers: ["desktop/macos/Desktop/.swiftlint.yml", "desktop/macos/Desktop/.swiftlint-baseline.json", "desktop/macos/Desktop/Sources/**/*.swift", "desktop/macos/Desktop/Tests/**/*.swift", "desktop/macos/scripts/prepare-swiftlint-baseline.py", "desktop/macos/scripts/swiftlint-wrapper.sh"]
    lanes: ["local", "ci"]
    platforms: ["macos"]
    reason: "#9843 Ticket 06: pinned SwiftLint must reject new safety violations outside the committed baseline"
  - id: desktop-swiftlint-baseline
    command: ["python3", "desktop/macos/scripts/check-swiftlint-baseline.py", "--base", "{base}"]
    triggers: ["desktop/macos/Desktop/.swiftlint-baseline.json", "desktop/macos/Desktop/Sources/**/*.swift", "desktop/macos/Desktop/Tests/**/*.swift", "desktop/macos/scripts/check-swiftlint-baseline.py"]
    lanes: ["local", "ci"]
    reason: "#9843 Ticket 07: SwiftLint baseline is down-only; swiftlint:disable requires named rule + reason"
  - id: desktop-swiftlint-baseline-fixtures
    command: ["python3", ".github/scripts/test_swiftlint_baseline_guard.py"]
    triggers: ["desktop/macos/scripts/check-swiftlint-baseline.py", ".github/scripts/test_swiftlint_baseline_guard.py"]
    lanes: ["local", "ci"]
    reason: "#9843 Ticket 07: adversarial fixtures for baseline guard and disable policy"
  - id: desktop-feature-sentinels
    command: ["bash", "desktop/macos/tests/test-feature-sentinel-negative-control.sh"]
    triggers: ["desktop/macos/Desktop/Package.swift", "desktop/macos/Desktop/Tests/SemanticFeatureSentinels/**/*.swift", "desktop/macos/tests/test-feature-sentinel-negative-control.sh"]
    lanes: ["local", "ci"]
    platforms: ["macos"]
    reason: "#9843 Ticket 09: semantic feature sentinels prove flags are active; negative control proves silent-acceptance trap"
  - id: desktop-hub-controller-ratchet
    command: ["python3", "desktop/macos/scripts/check-hub-controller-ratchet.py"]
    triggers: ["desktop/macos/Desktop/Sources/FloatingControlBar/RealtimeHubController.swift", "desktop/macos/scripts/check-hub-controller-ratchet.py"]
    lanes: ["local", "ci"]
    reason: "realtime hub extracted-type ownership anti-regrowth ratchet"
  - id: task-capture-authority
    command: ["python3", ".github/scripts/check_task_capture_authority.py"]
    triggers: ["backend/utils/task_intelligence/**", "backend/utils/conversations/process_conversation.py", "backend/config/task_intelligence_sources_v1.json", "desktop/macos/Desktop/Sources/ProactiveAssistants/Assistants/TaskExtraction/**", ".github/scripts/check_task_capture_authority.py"]
    lanes: ["local", "ci"]
    reason: "INV-TASK-2: automatic capture proposes; four shipped paths wrote tasks the user never asked for"
  - id: task-capture-authority-tests
    command: ["python3", ".github/scripts/test_check_task_capture_authority.py"]
    triggers: [".github/scripts/check_task_capture_authority.py", ".github/scripts/test_check_task_capture_authority.py", ".github/checks-manifest.yaml"]
    lanes: ["local", "ci"]
    reason: "the guard must still fail on each shape it was written for"
  - id: desktop-auth-session-ratchet
    command: ["python3", ".github/scripts/check_desktop_auth_session.py"]
    triggers: ["desktop/macos/Desktop/Sources/APIClient.swift", "desktop/macos/Desktop/Sources/AuthService.swift", "desktop/macos/Desktop/Sources/AuthSessionCoordinator.swift", "desktop/macos/Desktop/Sources/DesktopKeychainStore.swift", "desktop/macos/Desktop/Sources/OmiApp.swift", "desktop/macos/Desktop/Sources/Auth/**/*.swift", ".github/scripts/check_desktop_auth_session.py"]
    lanes: ["local", "ci"]
    reason: "INV-AUTH-1 desktop session surfaces changed"
  - id: desktop-test-quality
    command: ["python3", "desktop/macos/scripts/check_desktop_test_quality.py"]
    triggers: ["desktop/macos/Desktop/Sources/**/*.swift", "desktop/macos/Desktop/Tests/**/*.swift", "desktop/macos/scripts/check_desktop_test_quality.py", "desktop/macos/scripts/swift-test-suites.sh"]
    lanes: ["local", "ci"]
    reason: "desktop Swift production or test structure changed"
  - id: desktop-chat-selection-boundary
    command: ["python3", ".github/scripts/check_chat_selection_boundary.py"]
    triggers: ["desktop/macos/Desktop/Sources/MainWindow/Components/ChatBubble.swift", "desktop/macos/Desktop/Sources/MainWindow/Components/ChatMessagesView.swift", "desktop/macos/Desktop/Sources/MainWindow/Components/OmiMarkdown.swift", ".github/scripts/check_chat_selection_boundary.py", ".github/failure-classes/FC-selection-overlay-layout-loop.json", ".github/checks-manifest.yaml"]
    lanes: ["local", "ci"]
    reason: "PR #10834 reopened FC-selection-overlay-layout-loop in Omi Beta 0.12.146; SwiftUI has no type-level way to exclude SelectionOverlay from the live transcript, so this narrow boundary protects the three authoritative render files"
  - id: desktop-chat-selection-boundary-fixtures
    command: ["python3", ".github/scripts/test_check_chat_selection_boundary.py"]
    triggers: [".github/scripts/check_chat_selection_boundary.py", ".github/scripts/test_check_chat_selection_boundary.py", ".github/checks-manifest.yaml"]
    lanes: ["local", "ci"]
    reason: "adversarial fixtures prove the live-chat selection boundary rejects enabled modifiers, escape hatches, missing protection, and missing explicit disablement"
  - id: desktop-agent-runtime-convergence-ratchet
    command: ["python3", "desktop/macos/scripts/check-agent-runtime-convergence-ratchet.py"]
    triggers: ["desktop/macos/Desktop/Sources/Providers/ChatProvider.swift", "desktop/macos/Desktop/Sources/Chat/AgentRuntimeProcess.swift", "desktop/macos/Desktop/Sources/Chat/AgentRuntimeBridgeLifecycle.swift", "desktop/macos/scripts/check-agent-runtime-convergence-ratchet.py", "desktop/macos/scripts/agent-runtime-convergence-ratchet.json"]
    lanes: ["local", "ci"]
    reason: "#9688 keeps bridge lifecycle/context decisions extracted and both historic coordinator files bounded"
  - id: desktop-agent-runtime-contract-conformance
    command: ["bash", "desktop/macos/scripts/test-tool-surfaces.sh"]
    triggers: ["desktop/macos/agent/contracts/**", "desktop/macos/agent/src/adapters/**/*.ts", "desktop/macos/agent/src/runtime/control-tools.ts", "desktop/macos/agent/src/runtime/contract-schema.ts", "desktop/macos/agent/src/runtime/relay-tool-result.ts", "desktop/macos/agent/src/runtime/tool-result-envelope.ts", "desktop/macos/agent/tests/agent-runtime-contract-fixtures.test.ts", "desktop/macos/agent/tests/control-tools.test.ts", "desktop/macos/agent/tests/relay-tool-result.test.ts", "desktop/macos/agent/tests/runtime-adapter-contract-conformance.test.ts", "desktop/macos/scripts/test-tool-surfaces.sh", "desktop/macos/scripts/agent-logic-harness.sh", "desktop/macos/scripts/check-spawn-receipt-fixtures.sh"]
    lanes: ["local", "ci"]
    reason: "#9688 gates adapter lifecycle fixtures and artifact-backed bounded tool-result delivery"
  - id: desktop-spawn-receipt-fixtures-v1
    command: ["bash", "desktop/macos/scripts/check-spawn-receipt-fixtures.sh"]
    triggers: ["desktop/macos/agent/src/runtime/agent-spawn-journal.ts", "desktop/macos/agent/fixtures/spawn-receipt/**", "desktop/macos/agent/tests/spawn-receipt-fixtures.test.ts", "desktop/macos/scripts/check-spawn-receipt-fixtures.sh", "desktop/macos/Desktop/Sources/FloatingControlBar/RealtimeSpawnReceipt.swift", "desktop/macos/Desktop/Tests/RealtimeHubSpawnAgentTests.swift"]
    lanes: ["local", "ci"]
    reason: "cross-language realtime spawn receipt producer/consumer contract"
  - id: release-eligibility-contract
    command: ["python3", ".github/scripts/check_release_eligibility.py"]
    triggers: [".github/workflows/release-eligibility.yml", ".github/actions/release-eligibility/**", ".github/scripts/verify_release_eligibility.py", ".github/scripts/check_release_eligibility.py", ".github/scripts/test_check_release_eligibility.py", ".github/checks-manifest.yaml"]
    lanes: ["local", "ci"]
    reason: "#9989 keeps the automatic release proof main-scoped, SHA-bound, and routed through the canonical deterministic CI runner"
  - id: release-eligibility-contract-fixtures
    command: ["python3", ".github/scripts/test_check_release_eligibility.py"]
    triggers: [".github/workflows/release-eligibility.yml", ".github/actions/release-eligibility/**", ".github/scripts/verify_release_eligibility.py", ".github/scripts/check_release_eligibility.py", ".github/scripts/test_check_release_eligibility.py", ".github/checks-manifest.yaml"]
    lanes: ["local", "ci"]
    reason: "#9989 exercises non-main, ambiguous SHA, mismatched checkout, and workflow-contract rejection cases"
  - id: backend-deploy-source-admission
    command: ["python3", ".github/scripts/check_backend_deploy_source_admission.py"]
    triggers: [".github/workflows/gcp_backend.yml", ".github/workflows/gcp_backend_auto_dev.yml", ".github/actions/deploy-backend-stack/**", ".github/scripts/verify_backend_release_admission.py", ".github/scripts/verify_auto_backend_release_admission.py", ".github/scripts/check_backend_deploy_source_admission.py", ".github/scripts/test_check_backend_deploy_source_admission.py", ".github/scripts/test_verify_auto_backend_release_admission.py", ".github/scripts/workflow_composite_contract.py", ".github/checks-manifest.yaml"]
    lanes: ["local", "ci"]
    reason: "#9991 keeps backend deploy source selection bound to one successful main Release Eligibility proof"
  - id: backend-deploy-source-admission-fixtures
    command: ["python3", ".github/scripts/test_check_backend_deploy_source_admission.py"]
    triggers: [".github/workflows/gcp_backend.yml", ".github/workflows/gcp_backend_auto_dev.yml", ".github/actions/deploy-backend-stack/**", ".github/scripts/verify_backend_release_admission.py", ".github/scripts/verify_auto_backend_release_admission.py", ".github/scripts/check_backend_deploy_source_admission.py", ".github/scripts/test_check_backend_deploy_source_admission.py", ".github/scripts/test_verify_auto_backend_release_admission.py", ".github/scripts/workflow_composite_contract.py", ".github/checks-manifest.yaml"]
    lanes: ["local", "ci"]
    reason: "#9991 mutation-tests workflow-run event, result, branch, SHA, repository, and manual proof drift"
  - id: automatic-backend-release-admission
    command: ["python3", ".github/scripts/test_verify_auto_backend_release_admission.py"]
    triggers: [".github/workflows/gcp_backend.yml", ".github/workflows/gcp_backend_auto_dev.yml", ".github/actions/deploy-backend-stack/**", ".github/scripts/verify_backend_release_admission.py", ".github/scripts/verify_auto_backend_release_admission.py", ".github/scripts/check_backend_deploy_source_admission.py", ".github/scripts/test_check_backend_deploy_source_admission.py", ".github/scripts/test_verify_auto_backend_release_admission.py", ".github/scripts/workflow_composite_contract.py", ".github/checks-manifest.yaml"]
    lanes: ["local", "ci"]
    reason: "#11979 keeps automatic development admission on merged-into-main ancestry, not main-tip equality"
  - id: gcp-backend-production-boundary
    command: ["python3", ".github/scripts/check-gcp-backend-production-boundary.py"]
    triggers: [".github/workflows/gcp_backend.yml", ".github/actions/deploy-backend-stack/**", "backend/scripts/firebase_release_probe_token.py", "backend/scripts/transcription_capability_probe.py", ".github/scripts/check-gcp-backend-production-boundary.py", ".github/scripts/test_check_gcp_backend_production_boundary.py", ".github/scripts/workflow_composite_contract.py", ".github/checks-manifest.yaml"]
    lanes: ["local", "ci"]
    reason: "the canonical production deploy is rollback-first and Cloud Run-only"
  - id: gcp-backend-production-boundary-fixtures
    command: ["python3", ".github/scripts/test_check_gcp_backend_production_boundary.py"]
    triggers: [".github/workflows/gcp_backend.yml", ".github/actions/deploy-backend-stack/**", ".github/scripts/check-gcp-backend-production-boundary.py", ".github/scripts/test_check_gcp_backend_production_boundary.py", ".github/scripts/workflow_composite_contract.py", ".github/checks-manifest.yaml"]
    lanes: ["local", "ci"]
    reason: "mutation-tests prod/all admission, serving smoke order, token handling, and rollback coverage"
  - id: direct-backend-production-admission
    command: ["python3", ".github/scripts/check-direct-backend-production-admission.py"]
    triggers: [".github/workflows/gcp_backend_listen_helm.yml", ".github/workflows/gcp_backend_pusher.yml", ".github/workflows/gcp_llm_gateway.yml", ".github/scripts/check-direct-backend-production-admission.py", ".github/scripts/test_check_direct_backend_production_admission.py", ".github/checks-manifest.yaml"]
    lanes: ["local", "ci"]
    reason: "#10163 prevents direct production writers from deploying caller refs or mislabeling checked-out source"
  - id: direct-backend-production-admission-fixtures
    command: ["python3", ".github/scripts/test_check_direct_backend_production_admission.py"]
    triggers: [".github/workflows/gcp_backend_listen_helm.yml", ".github/workflows/gcp_backend_pusher.yml", ".github/workflows/gcp_llm_gateway.yml", ".github/scripts/check-direct-backend-production-admission.py", ".github/scripts/test_check_direct_backend_production_admission.py", ".github/checks-manifest.yaml"]
    lanes: ["local", "ci"]
    reason: "#10163 mutation-tests branch bypass and GITHUB_SHA image mislabeling"
  - id: production-data-plane-routing
    command: ["python3", ".github/scripts/test_check_mobile_production_routing.py"]
    triggers: ["codemagic.yaml", "app/lib/env/dev_env.dart", "app/lib/env/prod_env.dart", "app/lib/main.dart", "app/lib/utils/environment_detector.dart", "desktop/macos/Desktop/Sources/AppBuild.swift", "desktop/macos/Desktop/Sources/DesktopBackendEnvironment.swift", "desktop/macos/Desktop/Sources/GoogleService-Info*.plist", "backend/charts/**", ".github/workflows/**", "backend/docs/runbooks/desktop-backend-cloud-run-ownership.md", ".github/scripts/check-mobile-production-routing.py", ".github/scripts/test_check_mobile_production_routing.py", ".github/checks-manifest.yaml"]
    lanes: ["local", "ci"]
    reason: "INV-DATA-1 mutation-tests every production-family mobile and desktop routing authority and rejects retired GKE desktop-backend ownership"
  - id: desktop-backend-release-boundary
    command: ["python3", ".github/scripts/check-desktop-backend-release-policy.py"]
    triggers: [".github/workflows/desktop_backend_auto_dev.yml", ".github/workflows/desktop_backend_prod.yml", ".github/workflows/desktop_backend_recover_prod.yml", ".github/workflows/desktop_promote_prod.yml", ".github/scripts/desktop_backend_candidate_probe.py", ".github/scripts/verify_desktop_backend_image_lineage.py", ".github/scripts/check-desktop-backend-release-policy.py", "backend/Dockerfile.desktop_backend", "backend/**/*.py", "backend/pylock.runtime.toml", "desktop/macos/pi-mono-extension/index.ts", ".github/checks-manifest.yaml"]
    lanes: ["local", "ci"]
    reason: "desktop-backend candidates must prove immutable OCI-index-to-linux/amd64 lineage, authenticated streamed chat with terminal usage, and managed voice-provider paths before any Cloud Run traffic shift"
  - id: desktop-backend-release-boundary-fixtures
    command: ["python3", ".github/scripts/test_check_desktop_backend_release_policy.py"]
    triggers: [".github/workflows/desktop_backend_auto_dev.yml", ".github/workflows/desktop_backend_prod.yml", ".github/workflows/desktop_backend_recover_prod.yml", ".github/workflows/desktop_promote_prod.yml", ".github/scripts/verify_desktop_backend_image_lineage.py", ".github/scripts/check-desktop-backend-release-policy.py", ".github/scripts/test_check_desktop_backend_release_policy.py", "backend/Dockerfile.desktop_backend", "backend/**/*.py", "backend/pylock.runtime.toml", "desktop/macos/pi-mono-extension/index.ts", ".github/checks-manifest.yaml"]
    lanes: ["local", "ci"]
    reason: "mutation fixtures reject traffic-before-proof, missing reconciler actAs preflight, mutable/stale/wrong-platform images, automatic production deploys, baked runtime credentials, and chat-contract drift"
  - id: desktop-backend-traffic-lineage-fixtures
    command: ["python3", ".github/scripts/test_check_desktop_backend_traffic_regression.py"]
    triggers: [".github/workflows/desktop_backend_auto_dev.yml", ".github/scripts/check_desktop_backend_traffic_regression.py", ".github/scripts/test_check_desktop_backend_traffic_regression.py", ".github/checks-manifest.yaml"]
    lanes: ["local", "ci"]
    reason: "a traffic promotion gate must refuse only backwards promotions; refusing on branch recency discards candidates whose build and acceptance are already paid for"
  - id: desktop-backend-candidate-probe-fixtures
    command: ["python3", ".github/scripts/test_desktop_backend_candidate_probe.py"]
    triggers: [".github/scripts/desktop_backend_candidate_probe.py", ".github/scripts/test_desktop_backend_candidate_probe.py", "backend/**/*.py", "backend/pylock.runtime.toml", ".github/checks-manifest.yaml"]
    lanes: ["local", "ci"]
    reason: "candidate evidence must require two authenticated streamed chat turns with terminal usage, bounded streaming, Firestore readiness, and secure token handling"
  - id: stable-pointer-precondition-cli
    command: ["python3", ".github/scripts/check_stable_pointer_precondition.py", "--help"]
    triggers: [".github/workflows/desktop_promote_prod.yml", ".github/scripts/check_stable_pointer_precondition.py", ".github/scripts/verify_stable_appcast.py", ".github/scripts/test_stable_promotion_verifiers.py", ".github/checks-manifest.yaml"]
    lanes: ["local", "ci"]
    reason: "#10163 keeps Stable retry acknowledgement and appcast verification executable"
  - id: stable-pointer-precondition-fixtures
    command: ["python3", ".github/scripts/test_stable_promotion_verifiers.py"]
    triggers: [".github/workflows/desktop_promote_prod.yml", ".github/scripts/check_stable_pointer_precondition.py", ".github/scripts/verify_stable_appcast.py", ".github/scripts/test_stable_promotion_verifiers.py", ".github/checks-manifest.yaml"]
    lanes: ["local", "ci"]
    reason: "#10163 mutation-sensitive Stable retry and default-channel feed fixtures"
  - id: desktop-backend-drift-cli
    command: ["python3", ".github/scripts/check_desktop_backend_drift.py", "--self-test"]
    triggers: [".github/workflows/desktop_promote_prod.yml", ".github/scripts/check_desktop_backend_drift.py", ".github/scripts/test_check_desktop_backend_drift.py", ".github/checks-manifest.yaml"]
    lanes: ["local", "ci"]
    reason: "stable promotion must show serving-backend drift against main without inventing SHAs or failing the pointer transition"
  - id: desktop-backend-drift-fixtures
    command: ["python3", ".github/scripts/test_check_desktop_backend_drift.py"]
    triggers: [".github/workflows/desktop_promote_prod.yml", ".github/scripts/check_desktop_backend_drift.py", ".github/scripts/test_check_desktop_backend_drift.py", ".github/checks-manifest.yaml"]
    lanes: ["local", "ci"]
    reason: "drift script must treat missing health SHAs as unknown and keep --strict off the promotion path"
  - id: guardrail-pulse-tests
    command: ["python3", ".github/scripts/test_guardrail_pulse.py"]
    triggers: [".github/scripts/guardrail_pulse.py", ".github/scripts/test_guardrail_pulse.py", ".github/workflows/guardrail-baseline-pulse.yml", ".github/guardrail-pulse-history.jsonl", ".github/checks-manifest.yaml"]
    lanes: ["local", "ci"]
    reason: "#9454 weekly baseline health pulse parsing, JSONL record, and 30-day staleness detection"
  - id: dead-code-ratchet
    command: ["python3", ".github/scripts/check_dead_code.py"]
    triggers: ["app/lib/**", "app/pubspec.yaml", "backend/**/*.py", "desktop/macos/agent/**", "desktop/windows/src/**", ".github/scripts/check_dead_code.py", ".github/scripts/dead_code/**", ".github/checks-manifest.yaml"]
    lanes: ["local", "ci"]
    reason: "57 unreachable Flutter files accumulated until a June 2026 security fix landed on unreachable code; import-graph reachability (flutter from main.dart, agent, windows entries, incl. dynamic import(), string-spawned .js/.mjs siblings, and the @renderer alias) plus zero-importer backend buckets now fail NEW dead code with a delete-or-allowlist-with-reason fix, and the committed baseline only shrinks. Backend triggers are all of backend/**/*.py because scan_backend reads every non-test backend .py as an import source and mention text — the older five-lib-prefix list let routers/scripts/main.py edits create dead code without tripping the ratchet"
  - id: dead-code-ratchet-tests
    command: ["python3", ".github/scripts/test_check_dead_code.py"]
    triggers: [".github/scripts/check_dead_code.py", ".github/scripts/test_check_dead_code.py", ".github/scripts/dead_code/**", ".github/checks-manifest.yaml"]
    lanes: ["local", "ci"]
    reason: "the four area scanners, their trap edges (package-submodule imports, __main__ guards, mention demotion, dynamic import, spawned siblings, alias resolution), baseline round-trip, and allowlist schema must stay behaviorally covered"
  - id: duplicate-route-ratchet
    command: ["python3", ".github/scripts/check_duplicate_routes.py"]
    triggers: ["backend/routers/**", "backend/main.py", "backend/desktop_backend.py", "backend/pusher/**", ".github/scripts/check_duplicate_routes.py", ".github/checks-manifest.yaml"]
    lanes: ["local", "ci"]
    reason: "FC-shadowed-route-handler: DELETE /v1/conversations/{id}/action-items was registered in two routers and FastAPI first-match silently shadowed the richer handler (and its vector cleanup) while that handler's tests stayed green; this check diffs every (app, method, path) mounted by the three service entrypoints and fails on any duplicate registration"
  - id: duplicate-route-ratchet-tests
    command: ["python3", ".github/scripts/test_check_duplicate_routes.py"]
    triggers: [".github/scripts/check_duplicate_routes.py", ".github/scripts/test_check_duplicate_routes.py", ".github/checks-manifest.yaml"]
    lanes: ["local", "ci"]
    reason: "hermetic fixture coverage for the duplicate-route scanner: shadowed duplicate fails with the colliding path, unique routes pass, same path on different apps is not a duplicate, api_route methods expand"

exempt:
  - path: ".github/scripts/check-desktop-beta-freshness.py"
    reason: "hourly doctor job hits the public beta appcast; behavioral coverage is desktop-beta-freshness-tests"
  - path: ".github/scripts/guardrail_pulse.py"
    reason: "informational weekly baseline health pulse (#9454); unit tests gate via guardrail-pulse-tests, schedule owns --record"
  - path: ".github/scripts/check-desktop-prod-promotion-policy.py"
    reason: "release-policy full-tree check, not diff-scoped"
  - path: ".github/scripts/check-deployment-concurrency.py"
    reason: "deployment concurrency policy full-tree check, not diff-scoped"
  - path: ".github/scripts/check_admin_deploy_scope.py"
    reason: "runtime classifier invoked by gcp_admin.yml; contract and fixtures are admin-deploy-scope*"
  - path: ".github/scripts/check_desktop_backend_traffic_regression.py"
    reason: "runtime promotion gate invoked by desktop_backend_auto_dev.yml; contract and fixtures are desktop-backend-traffic-lineage-fixtures"
  - path: ".github/scripts/check_desktop_backend_drift.py"
    reason: "runtime promotion reporter invoked by desktop_promote_prod.yml; contract and fixtures are desktop-backend-drift-*"
  - path: ".github/scripts/check_isinstance_return_ratchet.py"
    reason: "typed error flow-control ratchet uses a committed baseline, not diff-scoped triggers"
  - path: "backend/scripts/check_app_client_openapi_compatibility.py"
    reason: "OpenAPI generation contract has component dependencies"