feat(flows): core lane on PRs and a feature map built around relay init

Merged
KJ
9d ago
+1571-75

Replaces the Flows on PRs with checks of what relay init actually installs, and rebuilds the feature map around it. None of the 67 old Flows cases referenced the core, and the map named neither relay init nor crates/probe.

New core lane

tests/relayflows/core/ drives the built CLI, the real core and the local Relaycast server in a sandboxed home, through public surfaces only, so it should survive desktop's core replacing crates/probe.

  • init-parity: for each of the 7 tools, relay init --tools <tool> turns on that tool's route, writes what the tool reads, keeps the person's settings, leaves other tools alone, and --uninstall undoes it.
  • cursor-delivery: a DM reaches a running Cursor CLI session as the stop hook's followup_message, which wakes it.
  • grok-join: a session joins on its own through a leader the core proves from the kernel, and receives session/prompt. With no leader it stays off Relay.

A session here is a process that meets the contract the core discovers. No trust check is relaxed. The harness refuses to run outside a fresh temp home, builds its environment from nothing, seeds the analytics opt-out, and fails if the workspace isn't loopback or the core log names a hosted service.

Selection

  • The workflow runs on PRs again and picks from the new map. Everything runtime reaches the core lane, in one shard.
  • The core builds from source only when crates/probe changes; otherwise relay init installs the pinned release. Rust is set up only then.
  • All old lanes are manualOnly, reached with a manual dispatch through the manual-smoke profile. No old case was ported.
  • CI_LINUX_RUNNER now applies to these jobs.

Core-only PRs

detect-changes.yml, e2e-tests.yml, relayflow-pr-proof-broker.yml and rust-fmt-fix.yml skip broker and npm work when only crates/probe changed. protocol.rs still selects Node, because probe-core.test.ts reads it.

Feature map (v2.0)

  • New first categories: init, core, core-delivery.
  • broker, local-agents, local-workflows and node are status: legacy, and tier 2 now means local Relay from relay init. Fleet stays current at standard criticality, but its lane is manual.
  • The existing CLI and MCP entries are kept and re-ranked rather than retyped. 14 commands and tools it had missed are added, including agent rotate, observer and upload_file.
  • procedures.md, critical-paths.md, the verify skill, the guardian's tier label and the contract test are updated. Critical paths are renumbered.

Audit fixes

scripts/audit-feature-manifest.mjs couldn't finish (it walked into mounted products). It now skips those, and confirms a command is gone with --help before calling it stale. On this branch it reports MANIFEST_CLEAN.

Verified

  • Linux CI: the lane ran green on this PR, 2m35s from trigger to finish with the pinned core, and 3m38s with the core built from source (measured with a temporary touch of crates/probe, since reverted). Both include selection.
  • macOS arm64: all 11 scenarios pass against a source-built core and the pinned 15.0.7 release, the latter in 63s.
  • Mutations: three deliberate breaks each failed the right scenario: session unregistered before the send, leader not recording, wrong hook expected.
  • Other: targeted-feature-verification.test.ts, guardian tests and verify:cleanroom:validate pass, and the audit reports MANIFEST_CLEAN.

Linux CI found two things macOS hid. Codex needs its app-server to trust the hook, so RELAY_DESKTOP_CODEX points at a small stub that answers hooks/list from the real hooks.json. The runner is root, and the core refuses a Grok binding owned by root, so that scenario reruns as an ordinary user.

Not covered

  • Delivery to Claude Code, Codex, OpenCode, Pi and Devin, and waking an idle Cursor editor window. The core requires a signature or install location a stub can't honestly meet, or these need more of the tool than relay init does, so they stay on cargo test in crates/probe and live checks.
  • --hosted, --interactive and attaching to a real desktop core.
  • Cleanroom runs use the pinned core, not a source build.
  • This lane isn't a required check. Whether it should block merges depends on how reliable it proves.

No changelog entry: this is CI and test tooling.

🤖 Generated with Claude Code

Agent Relay sessions

  • claude session a994d8be · opened via gh pr create · last active 2026-11-02