ci(ci): move mutation to a release gate on main

[systemfsoftware-maker]

Lake 1, U3 (Evaluator) — stacked on #33.

Operator approval: Kiro, 2026-10-05 (GATE1).

• pnpm check:ci no longer runs pnpm mutation; mutation never runs in the PR gate (R66).
• New .github/workflows/release-gate.yml on push to main only (no manual dispatch), concurrency queued and never cancelled:
  • plan (fleet small) runs scripts/mutation-shards.ts, which lists every workspace package whose package.json declares a mutation script and fails on an empty set.
  • mutation (fleet large, one job per package, fail-fast: false, 75 min) restores the package's reports/stryker-incremental.json from the Actions cache and runs turbo run mutation --filter=<pkg> at break: 100, uploading the reports.
• packages/starter/stryker.config.ts drops prioritizePerformanceOverAccuracy (removed in stryker-js 15, optional in 13) ahead of U4.

#51 adds the production deploy job to this workflow.

QA

$ deno check --config=scripts/deno.json scripts/mutation-shards.ts
Check scripts/mutation-shards.ts
$ ./scripts/mutation-shards.ts
mutation-shards: packages=["@TODO/starter"]
packages=["@TODO/starter"]
exit=0
$ ./scripts/mutation-shards.ts --root <tmp workspace whose only package has no mutation script>
mutation-shards: no workspace package declares a `mutation` script; the release gate refuses an empty set
exit=1
$ nix run nixpkgs#actionlint -- .github/workflows/*.yml
actionlint exit=0
$ pnpm check:ci        # now excludes mutation by definition
exit=0

Stryker was not run locally. The first release-gate run on main after merge is the proof of the shard job.

Review fixes (Kiro rulings, Lake 1 bottom review)

• docs(global): align strategy and readme with endgame architecture #9, empty mutate set (3f6961a).
  • Each package declares its Stryker globs once, as stryker.mutate in package.json; its Stryker config reads them. The shard planner (scripts/mutation-shards.ts) expands them.
  • At plan time, the planner fails red naming the package, its directory and its globs when they match no file. A package with no declared globs fails the same way.
  • Tests: scripts/mutation-shards.test.ts, 4 cases. They're ordinary tests: the turbo root task test:scripts runs them through the dev shell's deno (nix develop --command deno test). Both pnpm test and check:ci (through gate:tasks) run that task, so the existing test leg runs them and a local check:ci covers the planner exactly as CI does. There is no separate CI leg.
  • Red with the check disabled (=== 0 → < 0): pnpm test exits 1 and pnpm gate:tasks exits 1, both failing //#test:scripts with FAILED | 1 passed | 3 failed. Green: ok | 4 passed, and check:ci exits 0.
  • The engine-side refusal is requested in systemfsoftware/stryker-js-effect#190.
• ci(release): keep the release pipeline off the template placeholder #5, unsandboxed mutation job: merge hold. The sandbox launcher U11b uses can't move down the stack yet: its prerequisites, feat(nix): distribute workspace packages through Nix and sandbox dependency code pnpm-release-management#5 and build(repo): ship the workspace and gritlint through the flake, not npm systemfsoftware#606, are still open. Per the ruling, this layer and every layer above it don't merge until U11b is merged into them. main never carries a mutation job that runs dependency code outside the sandbox.

No decisions to mutate (Kiro ruling, 2026-10-06, GATE1)

• A decision is a *.workflow.ts file, the suffix the dmmf presets key their complexity-1 and purity rules on. The planner counts them in every workspace package, skipping node_modules and .stryker-tmp.
• None: it prints a No decisions to mutate notice annotation (::notice title=Release gate::…), emits packages=[] and exits 0. The mutation job skips an empty plan (an empty matrix is an Actions error), and feat(repo): preview every pull request and deploy production after the release gate #51's production deploy accepts a skipped mutation job.
• Some, but no package declares a mutation script: it still refuses the empty set, naming how many decisions went unmutated.
• Some, and a package's stryker.mutate matches no file: still refused by name and globs, as before.
• At this layer packages/starter (the hello seed) has no *.workflow.ts, so main no longer mutates it. From refactor(repo): delete the hello seed package #43 to feat(repo): call the site worker through effect rpc #62 the gate passes with the notice instead of refusing, so those layers no longer have to merge together with the example feature. feat(repo): give the site worker one d1 database, emulated locally under pnpm dev #63 adds the first decision (apps/site/src/api/check-health.workflow.ts), so from feat(repo): give the site worker one d1 database, emulated locally under pnpm dev #63 on the planner plans @endgame/site.
• CONST-E9 / CONST-W3 declaration: this change to the instrument that grades the stack is written by the stack's maker, to Kiro's specification; Kiro owns the rule and reviews it.

$ deno test scripts/mutation-shards.test.ts
ok | 6 passed | 0 failed        # 2 new cases: no decisions → no shards and no refusal; decisions without a mutation script → refused
# sabotage, restored: drop the no-decisions return → "a workspace without a single *.workflow.ts file …" FAILED (5 passed, 1 failed)
# sabotage, restored: count *.decision.ts instead → 5 of 6 FAILED
$ ./scripts/mutation-shards.ts          # this layer's tree: no *.workflow.ts; packages/starter declares mutation
::notice title=Release gate::No decisions to mutate: no workspace package has a *.workflow.ts file.
packages=[]                             # exit 0
$ ./scripts/mutation-shards.ts          # #63's tree as of cycle 35 (9d4a3a4)
mutation-shards: packages=["@endgame/site"]
$ ./scripts/mutation-shards.ts          # #63's tree before cycle 35, plus one untracked apps/site/src/probe.workflow.ts
mutation-shards: 1 *.workflow.ts file(s) but no workspace package declares a `mutation` script; the release gate refuses an empty set
                                        # exit 1
$ actionlint                            # release-gate.yml as it stands at #35…#49, #52…#50 and #51…#63
exit=0
$ pnpm check:ci                         # at #63, after the restack
checkci=1                               # only check:sfs-sources (#52's blocker); 8/8 turbo tasks incl. test:scripts, build, sandbox proofs pass

Not exercised: a release-gate run on GitHub. The workflow runs only on push to main.

Cycle 35 (Kiro rulings on starter-verify's review)

• F10 (6b3c059): release-gate.yml drops workflow_dispatch:. Mutation runs on push to main only.
• F13 (6b3c059): the README describes what the code has. It no longer claims Cell workflows, a single Cell.provide at the root, tenant-bound store ports or compile-time phase markers, and no longer tells readers to run pnpm mutation locally; the FAQ says mutation runs only in the release gate on main.
• Gate at 6b3c059, clean worktree: pnpm check:ci exit 0.

Linux only (Kiro, cycle 52)

Ryan's standing rule: no macOS anywhere in our repos.

• 95bbb06 merges main with chore: drop macOS from CI (hosted larger-runner quota) #67, which dropped the macOS CI leg.
• 29d1b80: the flake builds x86_64-linux and aarch64-linux only; nix/dprint.nix pins only the two Linux release archives; the comment-checker sandbox loses its sandbox-exec branch and keeps bubblewrap; AGENTS.md says every job runs on ubuntu-latest and CI is Linux only.

Gate at 29d1b80, clean worktree, Linux:

$ pnpm install --frozen-lockfile    # exit 0
$ pnpm check:ci                     # exit 0: 6/6 turbo tasks, dist 1/1

CI run 37573302092 on 29d1b80: all 5 jobs pass (format, lint, typecheck, test, dist).

[kiro-systemf]

Conductor verdict: 7/7 checks green on b23a8e2, 0 unresolved threads, no unchecked boxes, two starter-verify reviews with no findings on this layer, hunt grep clean.