Route macOS test-product CI helpers to owned lanes

.github/workflows/ci.yml

@@ -156,7 +156,7 @@ jobs:
                   ci_router_changed=true
                   ghosttykit_guard_only=false
                   ;;
-                scripts/ci/persistent_mac_route.py|scripts/ci/web_validation.py)
+                scripts/ci/app_host_test_products.py|scripts/ci/compile-app-host-test-product.sh|scripts/ci/product_input_identity.py|scripts/ci/restore-app-host-test-product.sh|scripts/ci/reuse_app_host_products.py|scripts/ci/sanitize-xcode-source-packages-cache.py|scripts/ci/persistent_mac_route.py|scripts/ci/web_validation.py)
                   # These have explicit owning lanes and names that cannot
                   # shadow Python stdlib imports used by the router.
                   ghosttykit_guard_only=false

scripts/ci/detect_ci_change_areas.py

@@ -62,6 +62,15 @@ def is_other_workflow_config(path: str) -> bool:
     "scripts/ci/web_validation.py",
 })
 
+CI_MACOS_TEST_PRODUCT_INPUTS = frozenset({
+    "scripts/ci/app_host_test_products.py",
+    "scripts/ci/compile-app-host-test-product.sh",
+    "scripts/ci/product_input_identity.py",
+    "scripts/ci/restore-app-host-test-product.sh",
+    "scripts/ci/reuse_app_host_products.py",
+    "scripts/ci/sanitize-xcode-source-packages-cache.py",
+})
+
 
 def forces_all_areas(path: str) -> bool:
     # Unknown direct CI implementation files remain fail-open. Narrow only
@@ -72,7 +81,11 @@ def forces_all_areas(path: str) -> bool:
         and path.endswith(".py")
         and "/" not in path[len("scripts/ci/") :]
     )
-    if direct_ci_python and path not in CI_CONTROL_PLANE_ONLY:
+    if (
+        direct_ci_python
+        and path not in CI_CONTROL_PLANE_ONLY
+        and path not in CI_MACOS_TEST_PRODUCT_INPUTS
+    ):
         return True
     return path in {
         CI_WORKFLOW_PATH,
@@ -338,6 +351,12 @@ def classify_files(paths: Iterable[str], *, ci_workflow_linux_only: bool = False
             agent_session_web = True
             release_build = True
             continue
+        if path in CI_MACOS_TEST_PRODUCT_INPUTS:
+            # These helpers own the reusable Debug/test product and its
+            # admission/restore contract. Exercise macOS admission/consumption,
+            # but they cannot affect the web deployment or Release app bytes.
+            macos = True
+            continue
         if path == WEB_WORKFLOW_PATH:
             # A reusable web workflow edit must exercise every job body it owns.
             web = True

scripts/ci/detect_linux_guard_changes.py

@@ -25,6 +25,12 @@
 # Exact inputs of the Cloud skill coverage check in workflow-guard-tests.
 # New tests and skill files retain the conservative fallback until mapped.
 WORKFLOW_TEST_INPUTS = {
+    "scripts/ci/app_host_test_products.py",
+    "scripts/ci/compile-app-host-test-product.sh",
+    "scripts/ci/product_input_identity.py",
+    "scripts/ci/restore-app-host-test-product.sh",
+    "scripts/ci/reuse_app_host_products.py",
+    "scripts/ci/sanitize-xcode-source-packages-cache.py",
     "scripts/ci/persistent_mac_route.py",
     "tests/test_ci_persistent_mac_compile.py",
     "tests/test_ci_self_hosted_guard.sh",

tests/test_ci_change_areas.py

@@ -249,6 +249,26 @@ def test_workflow_changes_run_everything() -> None:
     )
 
 
+def test_macos_test_product_ci_helpers_run_admission_without_web_or_release() -> None:
+    for path in (
+        "scripts/ci/app_host_test_products.py",
+        "scripts/ci/compile-app-host-test-product.sh",
+        "scripts/ci/product_input_identity.py",
+        "scripts/ci/restore-app-host-test-product.sh",
+        "scripts/ci/reuse_app_host_products.py",
+        "scripts/ci/sanitize-xcode-source-packages-cache.py",
+    ):
+        actual = module.classify_files([path])
+        assert actual.macos is True, (path, actual)
+        assert actual.web is False, (path, actual)
+        assert actual.agent_session_web is False, (path, actual)
+        assert actual.release_build is False, (path, actual)
+
+
+def test_unknown_ci_helper_still_fails_open_to_every_area() -> None:
+    assert module.classify_files(["scripts/ci/future_unknown_helper.py"]) == module.ChangeAreas.all()
+
+
 def test_guard_workflow_and_persistent_router_skip_product_areas() -> None:
     for path in (
         ".github/workflows/ci-guards.yml",
@@ -811,6 +831,20 @@ def test_owned_control_plane_helper_reaches_detector_instead_of_fail_open_guard(
     assert "CI router changed; running all CI areas." not in result.stdout
     assert outputs == ["macos=false", "web=false", "agent_session_web=false", "release_build=false"]
 
+    for path in (
+        "scripts/ci/app_host_test_products.py",
+        "scripts/ci/product_input_identity.py",
+        "scripts/ci/reuse_app_host_products.py",
+    ):
+        result, outputs = run_detect_step_for_paths([path])
+        assert "CI router changed; running all CI areas." not in result.stdout, path
+        assert outputs == [
+            "macos=true",
+            "web=false",
+            "agent_session_web=false",
+            "release_build=false",
+        ], path
+
 
 def test_workflow_diff_failure_runs_all_areas() -> None:
     script = detect_step_script()

tests/test_ci_linux_guard_routing.py

@@ -138,6 +138,27 @@ def test_persistent_mac_control_plane_runs_only_its_own_guard_lane(self):
             with self.subTest(path=path):
                 self.assertEqual(route([path]), expected)
 
+    def test_macos_test_product_helpers_run_only_workflow_guard_contracts(self):
+        expected = {
+            name: "true" if name == "linux_guard_tests" else "false" for name in JOBS
+        }
+        for path in (
+            "scripts/ci/app_host_test_products.py",
+            "scripts/ci/compile-app-host-test-product.sh",
+            "scripts/ci/product_input_identity.py",
+            "scripts/ci/restore-app-host-test-product.sh",
+            "scripts/ci/reuse_app_host_products.py",
+            "scripts/ci/sanitize-xcode-source-packages-cache.py",
+        ):
+            with self.subTest(path=path):
+                self.assertEqual(route([path]), expected)
+
+    def test_unknown_ci_helper_still_runs_every_guard(self):
+        self.assertEqual(
+            route(["scripts/ci/future_unknown_helper.py"]),
+            dict.fromkeys(JOBS, "true"),
+        )
+
     def test_web_edit_skips_native_history_cli_and_binary_download(self):
         outputs = route(["web/app/page.tsx"])
         self.assertEqual(outputs, {