test(ci): define fail-closed docs-only partition contract

.github/workflows/ci.yml

@@ -2,7 +2,7 @@ name: CI
 
 on:
   pull_request:
-    types: [opened, synchronize, reopened, ready_for_review, converted_to_draft, closed]
+    types: [opened, synchronize, reopened, ready_for_review]
   push:
     branches: [main]
 
@@ -14,9 +14,63 @@ concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
+  scope:
+    if: ${{ github.event_name != 'pull_request' || github.event.pull_request.draft == false }}
+    name: Classify CI scope
+    runs-on: ubuntu-24.04
+    outputs:
+      documentation_only: ${{ steps.scope.outputs.documentation_only }}
+      rust_required: ${{ steps.scope.outputs.rust_required }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+          persist-credentials: false
+          fetch-depth: 1
+      - name: Classify exact changed objects
+        id: scope
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          if [ "${GITHUB_EVENT_NAME}" != "pull_request" ]; then
+            printf 'documentation_only=false\nrust_required=true\n' >> "${GITHUB_OUTPUT}"
+            exit 0
+          fi
+          test -n "${BASE_SHA}"
+          test -n "${HEAD_SHA}"
+          git fetch --no-tags --depth=1 origin "${BASE_SHA}"
+          if ! git cat-file -e "${BASE_SHA}:scripts/ci/classify_ci_change_scope.py"; then
+            # The protected base does not yet contain the trusted classifier.
+            printf 'documentation_only=false\nrust_required=true\n' >> "${GITHUB_OUTPUT}"
+            exit 0
+          fi
+          trusted_classifier="${RUNNER_TEMP}/classify_ci_change_scope.py"
+          git show "${BASE_SHA}:scripts/ci/classify_ci_change_scope.py" > "${trusted_classifier}"
+          git diff --raw -z --no-abbrev "${BASE_SHA}" "${HEAD_SHA}" |
+            python3 "${trusted_classifier}" >> "${GITHUB_OUTPUT}"
+
+  contracts:
+    if: ${{ github.event_name != 'pull_request' || github.event.pull_request.draft == false }}
+    name: Repository and documentation contracts
+    needs: scope
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+          persist-credentials: false
+      - name: Check Python repository contracts
+        run: |
+          python3 -m compileall -q scripts tests
+          python3 -m unittest discover -s tests -p 'test_*.py'
+
   rust:
-    if: ${{ github.event_name != 'pull_request' || (github.event.action != 'closed' && github.event.pull_request.draft == false) }}
     name: Rust contracts
+    needs: [scope, contracts]
+    if: ${{ (github.event_name != 'pull_request' || github.event.pull_request.draft == false) && needs.scope.outputs.rust_required == 'true' }}
     runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -27,10 +81,6 @@ jobs:
         with:
           toolchain: 1.97.1
           components: clippy,rustfmt
-      - name: Check Python repository contracts
-        run: |
-          python3 -m compileall -q scripts tests
-          python3 -m unittest discover -s tests -p 'test_*.py'
       - name: Check formatting
         id: formatting
         run: cargo fmt --all --check
@@ -64,8 +114,9 @@ jobs:
         run: cargo doc --locked --workspace --no-deps
 
   coverage:
-    if: ${{ github.event_name != 'pull_request' || (github.event.action != 'closed' && github.event.pull_request.draft == false) }}
     name: Production coverage
+    needs: [scope, contracts]
+    if: ${{ (github.event_name != 'pull_request' || github.event.pull_request.draft == false) && needs.scope.outputs.rust_required == 'true' }}
     runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

CHANGELOG.md

@@ -4,6 +4,10 @@ All notable changes to OriginWeave are documented in this file. The format follo
 
 ## [Unreleased]
 
+- Execute the documentation-only CI classifier from the protected base revision; the bootstrap PR fails closed to full Rust verification when that trusted classifier is not yet present.
+- Require complete SHA-1 or SHA-256 object identities before exact-head Git raw-diff evidence may authorize lightweight documentation CI.
+- Bind Git rename/copy similarity to blob identity so perfect scores require equal objects and lower scores require distinct objects.
+
 - Refreshed the product-gap queue to 126 open pull requests (54 ready, 72 draft) after #190, #188, #185, #192, #182, #184, #115, #181, #116, #117, #118, #183, #114, #127, #112, #109, #186, #110, #108, #111, #174, and #113 were merged into their immediate stacked prerequisites. PRs #147, #146, #145, #144, #143, #142, #141, #139, #136, #132, #129, and #128 moved to ready after exact-head checks and thread review; these are queue-consolidation results, not protected-main shipment.
 
 ### Added
@@ -102,4 +106,4 @@ All notable changes to OriginWeave are documented in this file. The format follo
 - The hourly product agent has no Git metadata or repository authority. A separate post-verification publisher opens one PR and cannot approve or merge it.
 - The unprivileged OpenCode user is restricted to loopback egress during model execution, preventing runner-wide allow-listed endpoints from becoming direct source-exfiltration channels.
 
-[Unreleased]: https://github.com/ContextualWisdomLab/OriginWeave/compare/main...HEAD
+[Unreleased]: https://github.com/ContextualWisdomLab/OriginWeave/compare/main...HEAD