ci: skip the Mac wrapper and remote-daemon lanes for ci.yml routing edits

.github/workflows/ci.yml

@@ -145,13 +145,20 @@ jobs:
             fi
             # Keep both sides of renames visible to path-based guard routing.
             # A guarded file moved into docs/ must still run its owning checks.
+            rm -f /tmp/cmux-ci-base-workflow.yml
             if ! git diff --no-renames --name-only "$BASE_SHA" "$MERGE_SHA" > /tmp/cmux-ci-changed-files.txt; then
               # Absence means unavailable; an existing empty file means a known empty diff.
               rm -f /tmp/cmux-ci-changed-files.txt
               echo "Could not compute PR diff; running all CI areas." >&2
               emit_all_areas
               exit 0
             fi
+            # The standalone route compares ci.yml job by job with this base.
+            # Absence means unavailable, and that step then fails open.
+            if grep -Fxq '.github/workflows/ci.yml' /tmp/cmux-ci-changed-files.txt; then
+              git show "$BASE_SHA:.github/workflows/ci.yml" > /tmp/cmux-ci-base-workflow.yml \
+                || rm -f /tmp/cmux-ci-base-workflow.yml
+            fi
             # The changed lines of cmuxTests/, so choose_ci_suite.py can tell
             # which declarations a test edit touched. Absent reads as "every
             # line of each changed file".
@@ -426,15 +433,15 @@ jobs:
           browser=false
           remote_daemon=false
           remote_daemon_native=false
+          ci_workflow_changed=false
           if [ -f /tmp/cmux-ci-changed-files.txt ]; then
             while IFS= read -r path; do
               case "$path" in
                 .github/workflows/ci.yml)
-                  claude_wrapper=true
-                  # The caller owns both reusable jobs' conditions and targets.
+                  # The caller owns the browser job's condition and target;
+                  # that lane runs on Linux. The Mac lanes are judged below.
                   browser=true
-                  remote_daemon=true
-                  remote_daemon_native=true
+                  ci_workflow_changed=true
                   ;;
                 Resources/bin/cmux-claude-wrapper|tests/test_claude_wrapper_hooks.py|tests/node_runtime.py|scripts/ci/run_python_test_lane.py|scripts/ci/test_execution_registry.py)
                   # Not tests/test-execution.toml: every new test registers
@@ -461,6 +468,65 @@ jobs:
             remote_daemon=true
             remote_daemon_native=true
           fi
+          # ci.yml runs the wrapper lane inline and calls remote-daemon.yml with
+          # its native_tests input. Only an edit to that job, or to the
+          # triggers, env and permissions before `jobs:`, changes what a Mac
+          # lane runs. Edits to the routing, status and Linux jobs decide only
+          # whether it runs, which the Linux guard tests already check. A
+          # missing or unreadable base, a duplicate job, or a YAML alias in the
+          # lane's job selects both lanes.
+          if [ "$ci_workflow_changed" = true ]; then
+            if python3 - /tmp/cmux-ci-base-workflow.yml .github/workflows/ci.yml \
+              > /tmp/cmux-ci-standalone-callers.txt <<'PY'
+          import re
+          import sys
+
+          def jobs(path: str) -> tuple[str, dict[str, str]]:
+              text = open(path, encoding="utf-8").read()
+              preamble, marker, body = text.partition("\njobs:\n")
+              if not marker:
+                  raise SystemExit(1)
+              blocks: dict[str, str] = {}
+              for block in re.split(r"(?m)^  (?=[A-Za-z0-9_-]+:\s*$)", body):
+                  name = block.partition(":")[0]
+                  if not block.strip():
+                      continue
+                  if name in blocks:
+                      raise SystemExit(1)
+                  blocks[name] = block
+              return preamble, blocks
+
+          (base_preamble, base_jobs), (head_preamble, head_jobs) = jobs(sys.argv[1]), jobs(sys.argv[2])
+          alias = re.compile(r"(?m)(?:<<:|[:-])\s*\*[A-Za-z0-9_.-]+\s*$")
+          for job in ("claude-wrapper", "remote-daemon"):
+              base_block, head_block = base_jobs.get(job, ""), head_jobs.get(job, "")
+              if (
+                  base_preamble != head_preamble
+                  or base_block != head_block
+                  or alias.search(base_block)
+                  or alias.search(head_block)
+              ):
+                  print(job)
+          PY
+            then
+              callers="$(tr '\n' ' ' < /tmp/cmux-ci-standalone-callers.txt)"
+              echo "ci.yml changed; Mac lane callers that differ: ${callers:-none}"
+              case " $callers " in
+                *" claude-wrapper "*) claude_wrapper=true ;;
+              esac
+              case " $callers " in
+                *" remote-daemon "*)
+                  remote_daemon=true
+                  remote_daemon_native=true
+                  ;;
+              esac
+            else
+              echo "Could not compare ci.yml with its base; running the Mac standalone lanes."
+              claude_wrapper=true
+              remote_daemon=true
+              remote_daemon_native=true
+            fi
+          fi
           {
             echo "claude_wrapper=$claude_wrapper"
             echo "browser=$browser"

tests/test_ci_change_areas.py

@@ -2146,15 +2146,22 @@ def run_detect_step_for_paths(
     *,
     base_files: dict[str, str] | None = None,
     head_files: dict[str, str] | None = None,
+    standalone: bool = False,
 ) -> tuple[subprocess.CompletedProcess[str], list[str]]:
+    """Run the changes job's detect step; with `standalone`, then its standalone route."""
     script = detect_step_script(workflow_path)
+    route = (
+        workflow_job_step_script("changes", "Route standalone project workflows", workflow_path)
+        if standalone else ""
+    )
     with tempfile.TemporaryDirectory() as temp_dir:
         repo = Path(temp_dir)
         git_env = os.environ.copy()
         for name in ("GIT_DIR", "GIT_WORK_TREE", "GIT_INDEX_FILE"):
             git_env.pop(name, None)
         # Parallel local checkouts must not share the workflow's fixed /tmp files.
         script = script.replace("/tmp/cmux-ci-", str(repo / "cmux-ci-"))
+        route = route.replace("/tmp/cmux-ci-", str(repo / "cmux-ci-"))
         subprocess.run(["git", "init", "-q"], cwd=repo, env=git_env, check=True)
         subprocess.run(["git", "config", "user.email", "ci@example.test"], cwd=repo, env=git_env, check=True)
         subprocess.run(["git", "config", "user.name", "CI Test"], cwd=repo, env=git_env, check=True)
@@ -2218,6 +2225,10 @@ def run_detect_step_for_paths(
             stderr=subprocess.PIPE,
             check=True,
         )
+        if standalone:
+            # The job's next step, reading what the detect step left behind.
+            subprocess.run(["bash", "-c", route], cwd=repo, env=env, text=True,
+                           capture_output=True, check=True)
         return result, output_path.read_text(encoding="utf-8").splitlines()
 
 
@@ -2668,6 +2679,97 @@ def test_workflow_only_pr_uses_trusted_base_without_product_work() -> None:
     ]
 
 
+# PR #14141's diff: the detector, its tests, and the detect step of ci.yml's
+# `changes` job. Run 35956687867 queued `Claude wrapper regressions` and
+# `remote-daemon-macos-tests` on the Mac pool for it.
+ROUTING_POLICY_PATHS = [
+    ".github/workflows/ci.yml",
+    "scripts/ci/detect_ci_change_areas.py",
+    "tests/test_ci_change_areas.py",
+]
+MAC_STANDALONE_OUTPUTS = ("claude_wrapper", "remote_daemon", "remote_daemon_native", "cli")
+
+
+def route_ci_workflow_edit(
+    head_workflow: str, extra_paths: tuple[str, ...] = (),
+) -> dict[str, str]:
+    """Every `changes` output for a diff that edits ci.yml to `head_workflow`."""
+    head_files = {
+        ".github/workflows/ci.yml": head_workflow,
+        "scripts/ci/detect_ci_change_areas.py": HELPER.read_text(encoding="utf-8") + "# edited\n",
+        "tests/test_ci_change_areas.py": "# edited\n",
+    }
+    _, outputs = run_detect_step_for_paths(
+        [*ROUTING_POLICY_PATHS, *extra_paths], head_files=head_files, standalone=True,
+    )
+    values = dict(line.split("=", 1) for line in outputs)
+    assert set(MAC_STANDALONE_OUTPUTS) <= values.keys(), outputs
+    return values
+
+
+def test_routing_policy_edits_skip_the_mac_standalone_lanes() -> None:
+    real = CI_WORKFLOW.read_text(encoding="utf-8")
+    for job in ("changes", "ci-status", "guards", "tests", "linux-preflight", "macos-admission-gate"):
+        values = route_ci_workflow_edit(edit_job(real, job))
+        for name in MAC_STANDALONE_OUTPUTS:
+            assert values[name] == "false", (job, name, values)
+        # The Linux-only browser lane keeps running for every ci.yml edit.
+        assert values["browser"] == "true", (job, values)
+        assert values["macos"] == "false", (job, values)
+
+
+def test_ci_workflow_edits_to_a_mac_lane_caller_still_select_it() -> None:
+    real = CI_WORKFLOW.read_text(encoding="utf-8")
+    wrapper = route_ci_workflow_edit(edit_job(real, "claude-wrapper"))
+    assert wrapper["claude_wrapper"] == "true", wrapper
+    assert wrapper["remote_daemon"] == "false", wrapper
+
+    daemon = route_ci_workflow_edit(edit_job(real, "remote-daemon"))
+    assert daemon["remote_daemon"] == "true", daemon
+    assert daemon["remote_daemon_native"] == "true", daemon
+    assert daemon["claude_wrapper"] == "false", daemon
+
+    cli = route_ci_workflow_edit(edit_job(real, "cli"))
+    assert cli["cli"] == "true", cli
+    assert cli["claude_wrapper"] == "false", cli
+
+    # Triggers, env, permissions and concurrency reach every job.
+    preamble = route_ci_workflow_edit(real.replace("\njobs:\n", "\n# edited\njobs:\n", 1))
+    for name in MAC_STANDALONE_OUTPUTS:
+        assert preamble[name] == "true", (name, preamble)
+
+
+def test_mac_standalone_lane_inputs_still_select_their_lanes_beside_routing_edits() -> None:
+    real = CI_WORKFLOW.read_text(encoding="utf-8")
+    edited = edit_job(real, "changes")
+    wrapper = route_ci_workflow_edit(edited, ("Resources/bin/cmux-claude-wrapper",))
+    assert wrapper["claude_wrapper"] == "true", wrapper
+    daemon = route_ci_workflow_edit(edited, (".github/workflows/remote-daemon.yml",))
+    assert daemon["remote_daemon"] == "true", daemon
+    assert daemon["remote_daemon_native"] == "true", daemon
+
+
+def test_standalone_route_fails_open_without_a_readable_ci_workflow_base() -> None:
+    script = workflow_job_step_script("changes", "Route standalone project workflows")
+    real = CI_WORKFLOW.read_text(encoding="utf-8")
+    for base in (None, "not a workflow\n"):
+        with tempfile.TemporaryDirectory() as directory:
+            root = Path(directory)
+            routed = script.replace("/tmp/cmux-ci-", str(root / "cmux-ci-"))
+            (root / "cmux-ci-changed-files.txt").write_text(".github/workflows/ci.yml\n")
+            if base is not None:
+                (root / "cmux-ci-base-workflow.yml").write_text(base)
+            workflow = root / ".github" / "workflows" / "ci.yml"
+            workflow.parent.mkdir(parents=True)
+            workflow.write_text(edit_job(real, "changes"))
+            output = root / "output.txt"
+            subprocess.run(["bash", "-c", routed], cwd=root, check=True, capture_output=True,
+                           env={**os.environ, "GITHUB_OUTPUT": str(output)})
+            assert output.read_text().splitlines() == [
+                "claude_wrapper=true", "browser=true", "remote_daemon=true", "remote_daemon_native=true",
+            ], base
+
+
 CI_DIFF_BASE_WITH_CLI_LANE = """name: CI
 on:
   pull_request: