Split the remaining quality guard critical path

[teamleaderleo]

Summary

Replace the single quality group inside workflow-guard-tests with three independent groups:

• quality-sharding: cmuxTests sharding + compilation-cache seeding;
• quality-runtime: bundled-resource incremental outputs + virtual-display lock;
• quality-determinism: determinism and shell/shortcut policy checks.

The outer reusable-workflow job remains workflow-guard-tests, so guard-status still receives one fail-closed aggregate.

Measured current matrix wall times show quality is the slowest remaining mixed-guard group at ~92s (app-host ~79s, release ~57s). Historical step timings put the biggest quality costs at ~19s sharding, ~19s determinism, ~12s bundled resources, and ~9s virtual display. These checks are independent, so splitting them removes serialization without reducing coverage.

The structural assertion lives in a Linux-owned guard contract file rather than the router self-test, avoiding the accidental all-area fanout found while validating #13496/#13497.

Related: #13095, #13325, #13439, #13496, #13497.

---

Summary by cubic

Splits the single quality guard group in workflow-guard-tests into three independent groups (quality-sharding, quality-runtime, quality-determinism) so their checks run in parallel instead of serially. The outer reusable-workflow job is unchanged, so guard-status still sees one fail-closed aggregate. Adds a structural test that pins each quality check to its group and rejects the old quality group from reappearing.

^{Written for commit 8b39b9c. Summary will update on new commits.}

[coderabbitai]

Warning

Review limit reached

Next included review available in 13 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used all 10 included reviews currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Repository: manaflow-ai/cmux/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 56b27732-d671-4b33-999c-78e328c466ec

📥 Commits

Reviewing files that changed from the base of the PR and between 288265f and 8b39b9c.

📒 Files selected for processing (2)

• .github/workflows/ci-guards.yml
• tests/test_ci_quality_guard_structure.py

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}