fix(ci): unblock TypeScript E2E fan-out

[UnArbosFive]

Summary

PR #3035 exposed two serial barriers in TypeScript E2E CI:

• The shared-artifact selector stopped after 360 seconds, 21 seconds before Runtime Checks published the exact release artifact. TypeScript E2E then spent another 6m42s compiling the same Rust release binary locally.
• Fast-runtime E2E jobs depended on a combined build matrix, so they waited for the unrelated release build before fanning out.

This change:

• Tracks the exact build release node job from the matching Runtime Checks run, including transient API failures and replacement runs. It allows a bounded 60-second producer grace beyond the old cutoff, then falls back locally.
• Moves artifact polling to an ubuntu-latest coordinator so the wait does not reserve a self-hosted Rust runner.
• Splits fast and release build, state-test, and canonical-audit dependency lanes while preserving the existing required E2E check names.
• Adds behavioral tests for artifact provenance, delayed publication, terminal and nonterminal producer states, transient API failures, replacement runs, fallback ceilings, and matrix lane splitting.

Test Coverage

All new selector and lane-splitting paths have targeted behavioral coverage. This PR's own workflow run provides the integration check for the new Actions dependency graph and fan-out timing.

Pre-Landing Review

No issues found after testing, maintainability, security, performance, and adversarial review passes.

Plan Completion

No plan file detected.

Test plan

• Shared release artifact selector tests
• TypeScript E2E lane split tests
• TypeScript E2E classifier and workflow contract tests
• TypeScript E2E shard planner and configuration validation
• Rust CI path, artifact boundary, sccache configuration, and prewarm tests
• Workflow YAML parsing and whitespace validation

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
subtensor	Ready	Preview	Sep 16, 2026 11:20am UTC

[github-actions]

AI review — see the sticky summary comment for the verdict and the inline comments below for specific findings.

[github-actions]

[HIGH] [BOOTSTRAP] PR-controlled splitter executes in the trusted routing job

The base SHA does not contain this helper, so this PR necessarily takes the fallback and executes the head-controlled script inside changes, where the job has read access to repository contents and pull-request metadata. The script can also forge routing outputs consumed by later self-hosted jobs.

The workflow definition and intended helper should come from the trusted base; the PR-controlled inputs should be limited to the shard manifest and matrices. After this lands, the fallback becomes unreachable because the base checkout contains the helper, and any later reappearance would require its suspicious deletion or loss of executability. For this bootstrap run, fail closed instead of executing the proposed helper.

Suggested change

	if [[ ! -x "$splitter" ]]; then
	# One-time bootstrap. Future PRs execute the trusted base helper.
	splitter=.proposed-e2e-plan/.github/scripts/split-typescript-e2e-plan.sh
	if [[ ! -x "$splitter" ]]; then
	echo "trusted E2E lane splitter unavailable" >&2
	exit 1

[github-actions]

🛡️ AI Review — Skeptic (security review)

VERDICT: SAFE

VERY HIGH public-account scrutiny, tempered by admin status and substantive merged contributions; no Gittensor association found; fix/e2e-artifact-fanout → main.

Reviewed all seven changed files statically. No AI-review trust files changed. Passed git diff --check b1c709f4f785b820a8a5d8afe37e7e8287b1a117 HEAD and git diff --check; git status --short was clean. actionlint was unavailable. No PR code, builds, or tests were executed.

Findings

No findings.

Prior-comment reconciliation

• c4c7e0e3: addressed — The splitter and shard planner refuse PR-controlled bootstrap execution when trusted base helpers are absent; the updated routing test now requires that refusal.

Conclusion

Trusted routing helpers continue to fail closed, and artifact provenance checks remain intact. No new security vulnerabilities or evidence of malicious intent were found.

---

🔍 AI Review — Auditor (domain review)

VERDICT: 👎

Established contributor with repository admin access and substantive merged work; Gittensor association UNKNOWN.

The stale classifier assertion is fixed, but the trusted-helper bootstrap blocker remains. The PR therefore cannot yet provide its claimed E2E integration validation.

Validation: bash .github/scripts/test-classify-typescript-e2e-changes.sh passed. git cat-file -e confirmed the splitter is absent from base commit b1c709f4f785b820a8a5d8afe37e7e8287b1a117. git diff --check passed; git status --short was clean. actionlint was unavailable. No files were modified.

Findings

Sev	File	Finding
HIGH	.github/workflows/typescript-e2e.yml:188	[BOOTSTRAP] New base-only helper prevents this PR's E2E run	inline

Prior-comment reconciliation

• 9e490622: not addressed — The selected base still lacks the required splitter; routing still exits before E2E execution.
• 1423634a: addressed — The assertion now requires the trusted fail-closed path, and the classifier test passes.

Conclusion

Stage the splitter on main before activating this workflow dependency, then rerun E2E against the updated base.

---

📜 Previous run (superseded)

Sev	File	Finding	Status
HIGH	.github/workflows/typescript-e2e.yml:188	[BOOTSTRAP] New base-only helper prevents this PR's E2E run	➡️ Carried forward to current findings The selected base still lacks the required splitter; routing still exits before E2E execution.
MEDIUM	.github/scripts/test-classify-typescript-e2e-changes.sh:268	Remove the assertion requiring the deleted bootstrap fallback	✅ Addressed The assertion now requires the trusted fail-closed path, and the classifier test passes.

[github-actions]

🔄 AI review updated — Skeptic: VULNERABLE

[github-actions]

AI review — see the sticky summary comment for the verdict and the inline comments below for specific findings.

[github-actions]

[HIGH] [BOOTSTRAP] New base-only helper prevents this PR's E2E run

At .github/workflows/typescript-e2e.yml:185-188, the routing job requires the splitter from github.event.pull_request.base.sha. The selected base b1c709f4f785b820a8a5d8afe37e7e8287b1a117 does not contain this file—it is introduced by this PR. Consequently, changes always fails, dependent E2E jobs cannot run, and the EVM/Shield result checks fail. Preserve the fail-closed behavior: land the helper separately first, then rebase this workflow change onto that trusted base.

[github-actions]

[MEDIUM] Remove the assertion requiring the deleted bootstrap fallback

At .github/scripts/test-classify-typescript-e2e-changes.sh:268, this assertion still requires the proposed splitter execution path that the latest security fix removed. Running the test exits 1 at this exact command, so the validation workflow fails even after the base helper is available. Assert that the unsafe fallback is absent instead.

Suggested change

	grep -Fq '.proposed-e2e-plan/.github/scripts/split-typescript-e2e-plan.sh' "$workflow"
	if grep -Fq '.proposed-e2e-plan/.github/scripts/split-typescript-e2e-plan.sh' "$workflow"; then
	echo "E2E routing must not execute the proposed splitter." >&2
	exit 1
	fi

[github-actions]

🔄 AI review updated — Skeptic: SAFE Auditor: 👎

[github-actions]

AI review — see the sticky summary comment for the verdict and the inline comments below for specific findings.

[github-actions]

[HIGH] [BOOTSTRAP] New base-only helper prevents this PR's E2E run

.github/workflows/typescript-e2e.yml:185-188 requires the splitter from github.event.pull_request.base.sha, but that file is absent from the selected base commit b1c709f4f785b820a8a5d8afe37e7e8287b1a117. Every PR run therefore fails the changes job here, skips both build lanes, and fails the EVM/Shield result checks before integration coverage runs. Keep the fail-closed behavior; land the helper separately on main first and update this PR's base before enabling the dependency. Once the trusted base contains the helper, this bootstrap failure no longer applies.

[github-actions]

🔄 AI review updated — Skeptic: SAFE Auditor: 👎