harvest(install-graph): graduate local-LLM install primitive + Docker test matrix accelerator → main

.github/workflows/accelerator-local-llm-validate.yml

@@ -0,0 +1,81 @@
+# Accelerator — local-LLM entropy-lever validation (off-leash, accelerator branch).
+#
+# Proves the claim: a BARE runner + `install.sh` ⇒ working local-LLM substrate
+# (Aaron 2026-05-30 "install.sh is our biggest lever against entropy"). Runs the
+# real install graph, asserts the pinned model actually landed + serves, and runs
+# a REAL (not mocked) selection through the local model. This is the gate that
+# graduates the local-LLM core primitive from off-leash (accelerator) to main.
+#
+# Pushing this workflow / any local-LLM file to the accelerator branch triggers it.
+# Heavy (full install + ~400MB model pull); concurrency cancels superseded runs.
+
+name: accelerator-local-llm-validate
+
+on:
+  workflow_dispatch:
+  push:
+    branches: [accelerator/pr-less-git-monster]
+    paths:
+      - "tools/setup/manifests/local-llm"
+      - "tools/setup/common/local-llm.sh"
+      - "tools/setup/linux.sh"
+      - "tools/setup/macos.sh"
+      - "tools/setup/manifests/brew"
+      - "tools/accelerator/local-llm.ts"
+      - "tools/accelerator/validate-local-llm.ts"
+      - ".github/workflows/accelerator-local-llm-validate.yml"
+
+concurrency:
+  group: accelerator-local-llm-validate-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  validate-linux:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 25
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Setup bun
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
+
+      - name: Run install.sh (the entropy lever — bare runner → substrate)
+        env:
+          # Authenticated mise (per the mise.sh fix) so the toolchain install
+          # doesn't hit the unauthenticated GitHub rate limit.
+          MISE_GITHUB_TOKEN: ${{ github.token }}
+        run: ./tools/setup/install.sh
+
+      - name: Ensure ollama on PATH + daemon serving
+        run: |
+          echo "$HOME/.local/bin" >> "$GITHUB_PATH"
+          export PATH="$HOME/.local/bin:$PATH"
+          command -v ollama
+          if ! curl -fsS http://127.0.0.1:11434/api/version >/dev/null 2>&1; then
+            (ollama serve >/dev/null 2>&1 &)
+            for _ in $(seq 1 30); do
+              curl -fsS http://127.0.0.1:11434/api/version >/dev/null 2>&1 && break
+              sleep 1
+            done
+          fi
+          curl -fsS http://127.0.0.1:11434/api/version
+
+      - name: Assert the pinned model landed (declarative manifest)
+        run: |
+          export PATH="$HOME/.local/bin:$PATH"
+          MODEL=$(grep -E '^model' tools/setup/manifests/local-llm | awk '{print $2}')
+          echo "expected model: $MODEL"
+          ollama list
+          ollama list | awk 'NR>1 {print $1}' | grep -qx "$MODEL"
+
+      - name: Mock-backed primitive tests (logic; run anywhere)
+        run: bun test tools/accelerator/local-llm.test.ts
+
+      - name: REAL local-LLM validation (entropy-lever end-to-end)
+        run: |
+          export PATH="$HOME/.local/bin:$PATH"
+          bun tools/accelerator/validate-local-llm.ts --root "$PWD"

.github/workflows/docker-nixos-install-sh-test.yml

@@ -47,6 +47,12 @@ on:
   push:
     branches:
       - main
+      # Off-leash validation: install.sh changes are built on the accelerator
+      # branch (incl. the local-LLM step) BEFORE harvesting to main (Aaron's
+      # off-leash-first model). This test validates install.sh, so it must
+      # re-run when install.sh changes there too — otherwise the primary OS is
+      # only re-validated at harvest time.
+      - accelerator/pr-less-git-monster
     paths:
       - 'tools/setup/**'
       - '.mise.toml'

.github/workflows/docker-ubuntu-install-sh-test.yml

@@ -0,0 +1,59 @@
+# .github/workflows/docker-ubuntu-install-sh-test.yml
+#
+# Docker-based install.sh test on Ubuntu — sibling to docker-nixos-install-sh-test
+# (Aaron 2026-05-30: "center our docker tests around ubuntu and nixos and have
+# tests for both with install.sh"). The Dockerfile IS the test: it runs install.sh
+# on a bare ubuntu image and validates the core local-LLM primitive (ollama +
+# pinned model + real chooseIndex probe). A failing install.sh / assert fails the
+# build, which fails this job.
+#
+# Off-leash on the accelerator branch (Aaron: "accelerator is for off-leash
+# testing; once we get it right, main becomes off-leash too"). This is the gate
+# that guards graduating the local-LLM install primitive to main.
+#
+# FIRST CUT uses a direct `docker build` (vs the nixos TS driver) for simplicity.
+# FOLLOW-UP (Aaron's GHA-cache point): consolidate both OS tests onto a shared TS
+# driver + buildx `cache-from/to: type=gha` so the heavy install (1.2GB ollama +
+# toolchain) bakes once and iteration runs inside the cached image.
+#
+# Security: no github.event.* values interpolated into run: lines.
+
+name: docker-ubuntu-install-sh-test
+
+on:
+  workflow_dispatch:
+  push:
+    branches: [accelerator/pr-less-git-monster]
+    paths:
+      - "tools/ci/dockerfiles/ubuntu-install-sh-test/**"
+      - "tools/setup/**"
+      - "tools/accelerator/local-llm.ts"
+      - "tools/accelerator/validate-local-llm.ts"
+      - ".mise.toml"
+      - ".dockerignore"
+      - ".github/workflows/docker-ubuntu-install-sh-test.yml"
+
+concurrency:
+  group: docker-ubuntu-install-sh-test-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  docker-ubuntu-test:
+    name: docker-ubuntu-install-sh-test
+    runs-on: ubuntu-24.04
+    # Cold build: full install.sh (mise toolchain + lean + jars) + ollama 1.2GB +
+    # 398MB model pull. Generous bound for the first uncached run.
+    timeout-minutes: 40
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: docker build (the test — install.sh + local-LLM validation inside)
+        run: |
+          docker build \
+            -f tools/ci/dockerfiles/ubuntu-install-sh-test/Dockerfile \
+            -t zeta-ubuntu-install-sh-test \
+            .

docs/BACKLOG.md

@@ -889,6 +889,8 @@ are closed (status: closed in frontmatter)._
 - [ ] **[B-0934](backlog/P2/B-0934-backlog-index-integrity-required-or-advisory-decision-2026-05-29.md)** Decide whether backlog-index-integrity is required or explicitly advisory
 - [ ] **[B-0937](backlog/P2/B-0937-redundancy-checks-across-satellites-and-rules-mirror-beacon-rhyme-retirement-hub-over-budget-detector-2026-05-29.md)** Redundancy-checks across satellites + rules — duplicate-content audit, mirror→beacon rhyme-retirement, hub-over-budget detector
 - [ ] **[B-0939](backlog/P2/B-0939-self-propagating-markdown-compiler-rule-bootstrap-traveler-template-every-md-propagates-or-doesnt-compile-aaron-mika-2026-05-30.md)** Self-propagating-Markdown compiler-rule + bootstrap-traveler template (every .md is a self-propagating pattern through time or it doesn't compile)
+- [ ] **[B-0940](backlog/P2/B-0940-evaluate-ubuntu-support-value-nixos-primary-community-reach-aaron-2026-05-30.md)** Evaluate what Ubuntu support brings us — NixOS is primary; Ubuntu's value is community/contributor reach
+- [ ] **[B-0941](backlog/P2/B-0941-nixos-native-ollama-local-llm-hole-in-the-shield-test-passes-by-skipping-aaron-2026-05-30.md)** NixOS-native ollama for the local-LLM primitive — close the hole in the shield (NixOS test passes by SKIPPING, not validating)
 
 ## P3 — convenience / deferred