From c2ae7de68211a35f149e7d5323737b84faafe862 Mon Sep 17 00:00:00 2001
From: Xinyuan Tong <xinyuantong.cs@gmail.com>
Date: Fri, 14 Aug 2026 15:37:48 +0000
Subject: [PATCH 1/2] ci: path-gate Rust workspace tests

---
 .github/workflows/lint.yml | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 8cbfe904b2b5..fcecd1aae490 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -13,6 +13,16 @@ jobs:
         with:
           fetch-depth: 0
 
+      - name: Detect Rust workspace changes
+        id: paths
+        uses: dorny/paths-filter@v3
+        with:
+          filters: |
+            rust_workspace:
+              - 'rust/**'
+              - 'proto/sglang/runtime/v1/sglang.proto'
+              - '.github/workflows/lint.yml'
+
       # Fail-fast gate: docs_new/ was renamed to docs/ (#32123). git's rename
       # detection silently re-adds NEW files under docs_new/ on merge without a
       # conflict, which would resurrect the directory. We check the checked-out
@@ -54,6 +64,7 @@ jobs:
       # and a test script is not a build input. Tests take ~1s; the timeout is
       # for a cold cache, which codegens the dependency graph first.
       - name: Run rust/ workspace tests
+        if: steps.paths.outputs.rust_workspace == 'true'
         run: cd rust && timeout 900 cargo test --workspace
 
       - name: Run lychee docs checks (offline references)

From 6dbba7fb99280abed042fed30a66192fe7a519bd Mon Sep 17 00:00:00 2001
From: Xinyuan Tong <xinyuantong.cs@gmail.com>
Date: Fri, 14 Aug 2026 16:24:39 +0000
Subject: [PATCH 2/2] ci: path-gate static ratchet scans in lint

---
 .github/workflows/lint.yml | 24 ++++++++++++++++++++++--
 1 file changed, 22 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index fcecd1aae490..95b45a5b201c 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -13,7 +13,7 @@ jobs:
         with:
           fetch-depth: 0
 
-      - name: Detect Rust workspace changes
+      - name: Detect Rust workspace and ratchet changes
         id: paths
         uses: dorny/paths-filter@v3
         with:
@@ -22,6 +22,18 @@ jobs:
               - 'rust/**'
               - 'proto/sglang/runtime/v1/sglang.proto'
               - '.github/workflows/lint.yml'
+            ratchet:
+              - 'python/sglang/**'
+              - 'scripts/lint/check_static_ratchets.py'
+              - 'scripts/lint/check_decode_bookkeeping_ownership.py'
+              - 'scripts/lint/check_global_config_read_ratchet.py'
+              - 'scripts/lint/check_legacy_global_ratchet.py'
+              - 'scripts/lint/check_module_state_ratchet.py'
+              - 'scripts/lint/check_parallel_adoption_ratchet.py'
+              - 'scripts/lint/check_server_args_mutation_ratchet.py'
+              - 'scripts/lint/test_check_*.py'
+              - '.pre-commit-config.yaml'
+              - '.github/workflows/lint.yml'
 
       # Fail-fast gate: docs_new/ was renamed to docs/ (#32123). git's rename
       # detection silently re-adds NEW files under docs_new/ on merge without a
@@ -57,8 +69,16 @@ jobs:
           workspaces: rust
           shared-key: "rust-workspace-lint"
 
+      # Ratchet gate: any output other than 'false' (including unclassified
+      # events) keeps check-static-ratchets — fail open like rust_workspace.
       - name: Run pre-commit checks
-        run: SKIP=no-commit-to-branch pre-commit run --all-files --show-diff-on-failure
+        run: |
+          skip="no-commit-to-branch"
+          if [ "${{ steps.paths.outputs.ratchet }}" = "false" ]; then
+            skip="$skip,check-static-ratchets"
+          fi
+          echo "ratchet changes: ${{ steps.paths.outputs.ratchet }}; SKIP=$skip"
+          SKIP="$skip" pre-commit run --all-files --show-diff-on-failure
 
       # Not in the rust-ext build job: its cache key covers the built .so files,
       # and a test script is not a build input. Tests take ~1s; the timeout is