fix(ares): integrate reviewed repair composition and native CI gates

.github/actions/detect-changes/action.yml

@@ -51,6 +51,12 @@ outputs:
   rust:
     description: Run `cargo test` for the Tauri bootstrap installer.
     value: ${{ steps.classify.outputs.rust }}
+  context_continuity:
+    description: Run exact paired native owner and Governor qualification.
+    value: ${{ steps.classify.outputs.context_continuity }}
+  current_owner_integration:
+    description: Run canonical owner to Ares consumer qualification.
+    value: ${{ steps.classify.outputs.current_owner_integration }}
   mcp_catalog:
     description: Require MCP catalog security review label.
     value: ${{ steps.classify.outputs.mcp_catalog }}
@@ -105,7 +111,7 @@ runs:
             if CHANGED="$(gh api \
               --paginate \
               "repos/${REPO}/compare/${BASE_SHA}...${HEAD_SHA}" \
-              --jq '.files[]?.filename')"; then
+              --jq '.files[]? | .filename, (.previous_filename // empty)')"; then
               break
             fi
             if [ "$i" = 3 ]; then
@@ -118,6 +124,15 @@ runs:
           done
         fi
 
+        # A capped compare cannot prove either native qualification irrelevant.
+        # Renames emit both paths, so this threshold may also conservatively
+        # run all lanes before the 300-file API limit is reached.
+        if [ "$EVENT_NAME" = "pull_request" ] && [ -n "$CHANGED" ] && \
+            [ "$(printf '%s\n' "$CHANGED" | wc -l)" -ge 300 ]; then
+          echo "::warning::compare may be capped — failing open (all lanes run)"
+          CHANGED=""
+        fi
+
         echo "Changed files:"
         printf '%s\n' "${CHANGED:-(none)}"
         printf '%s\n' "${CHANGED:-}" | python3 scripts/ci/classify_changes.py

.github/workflows/ci.yaml

@@ -58,6 +58,8 @@ jobs:
       mcp_catalog: ${{ steps.classify.outputs.mcp_catalog }}
       ci_review: ${{ steps.classify.outputs.ci_review }}
       ci_review_files: ${{ steps.classify.outputs.ci_review_files }}
+      context_continuity: ${{ steps.classify.outputs.context_continuity }}
+      current_owner_integration: ${{ steps.classify.outputs.current_owner_integration }}
       event_name: ${{ github.event_name }}
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -118,6 +120,24 @@ jobs:
     if: needs.detect.outputs.rust == 'true'
     uses: ./.github/workflows/rust-tests.yml
 
+  # Preserve the existing native owners and exact pairing. PR-controlled
+  # qualification receives only read access, without inherited secrets.
+  context-continuity:
+    name: Context continuity qualification
+    needs: detect
+    if: needs.detect.outputs.context_continuity == 'true'
+    permissions:
+      contents: read
+    uses: ./.github/workflows/context-continuity-qualification.yml
+
+  current-owner-integration:
+    name: Current owner integration
+    needs: detect
+    if: needs.detect.outputs.current_owner_integration == 'true'
+    permissions:
+      contents: read
+    uses: ./.github/workflows/current-owner-integration.yml
+
   e2e-desktop:
     name: Desktop E2E
     needs: detect
@@ -234,6 +254,8 @@ jobs:
       - js-tests
       - installer-tests
       - rust-tests
+      - context-continuity
+      - current-owner-integration
       - e2e-desktop
       - docs-site
       - history-check
@@ -290,9 +312,13 @@ jobs:
 
       - name: Lint GitHub Actions workflows
         # The disabled Desktop lane is an explicit CI-01 applicability exception.
-        # Lint the planner workflow enforced by this aggregate. Other workflows
-        # own their existing shellcheck debt and are outside this bounded gate.
-        run: ./actionlint -ignore 'constant expression "false" in condition' .github/workflows/ci.yaml
+        # Lint the planner and native qualifications enforced by this aggregate.
+        # Other workflows retain their existing independent lint ownership.
+        run: >-
+          ./actionlint -ignore 'constant expression "false" in condition'
+          .github/workflows/ci.yaml
+          .github/workflows/context-continuity-qualification.yml
+          .github/workflows/current-owner-integration.yml
 
       - name: Evaluate job results
         id: evaluate

.github/workflows/context-continuity-qualification.yml

@@ -1,118 +1,16 @@
 name: Context continuity qualification
 
 on:
+  workflow_call:
+    outputs:
+      native_external_owner_result:
+        description: Result of the exact paired native owner qualification.
+        value: ${{ jobs.native-external-owner.outputs.qualification_result }}
+      focused_tests_result:
+        description: Result of the pinned Governor and focused Ares qualification.
+        value: ${{ jobs.focused-tests.outputs.qualification_result }}
   push:
-    branches: [main, feat/context-continuity-v4-20260923]
-  pull_request:
-    paths:
-      - '.github/workflows/context-continuity-qualification.yml'
-      - 'ares_runtime/continuity/**'
-      - 'tests/ares_runtime/test_continuity*'
-      - 'tests/ares_runtime/test_context_rebase_state.py'
-      - 'tests/ares_runtime/test_context_controller_credentials.py'
-      - 'tests/ares_runtime/test_context_authority_binding.py'
-      - 'tests/ares_runtime/test_context_native*.py'
-      - 'hermes_state_context_authority.py'
-      - 'hermes_cli/context_authority.py'
-      - 'tests/ares_runtime/test_managed_calls.py'
-      - 'tests/hermes_cli/test_goals.py'
-      - 'tests/hermes_cli/test_goal_lifecycle_contract.py'
-      - 'tests/test_model_tools.py'
-      - 'tests/tools/test_code_execution.py'
-      - 'tests/run_agent/test_message_sequence_repair.py'
-      - 'tests/run_agent/test_tool_executor_contextvar_propagation.py'
-      - 'tests/hermes_cli/test_heartbeat.py'
-      - 'tests/hermes_cli/test_loops.py'
-      - 'tests/test_run_checkpoint_import_boundaries.py'
-      - 'tests/test_run_checkpoint*.py'
-      - 'tests/test_run_task_custody.py'
-      - 'tests/test_run_custody_cold_recovery.py'
-      - 'tests/test_run_custody_ready_recovery.py'
-      - 'tests/test_run_custody_obligations.py'
-      - 'tests/gateway/test_context_input.py'
-      - 'tests/gateway/test_context_input_recovery.py'
-      - 'tests/ares_runtime/test_context_input_lifetime.py'
-      - 'tests/cli/test_quick_commands.py'
-      - 'tests/test_estop.py'
-      - 'tests/ares_runtime/test_permit_readback.py'
-      - 'tests/test_ares_collaboration.py'
-      - 'ares_runtime/collaboration.py'
-      - 'tests/gateway/test_pre_gateway_dispatch.py'
-      - 'tests/gateway/test_restart_resume_pending.py'
-      - 'tests/gateway/test_multiplex_session_db_profile_scope.py'
-      - 'tests/gateway/test_multiplex_adapter_registry.py'
-      - 'tests/gateway/test_adapter_startup_secret_scope.py'
-      - 'tests/gateway/test_startup_connect_parallel.py'
-      - 'tests/gateway/test_run_progress_topics.py'
-      - 'tests/gateway/test_42039_duplicate_user_message.py'
-      - 'tests/gateway/test_internal_event_never_interrupts_busy_session.py'
-      - 'tests/gateway/test_multiplex_busy_input_mode.py'
-      - 'tests/gateway/test_platform_base.py'
-      - 'tests/gateway/test_base_topic_sessions.py'
-      - 'tests/gateway/test_profile_routing.py'
-      - 'tests/gateway/test_busy_session_auth_bypass.py'
-      - 'tests/gateway/test_busy_session_ack.py'
-      - 'gateway/context_input.py'
-      - 'gateway/context_input_recovery.py'
-      - 'gateway/turn_context.py'
-      - 'gateway/platforms/base.py'
-      - 'gateway/run.py'
-      - 'tests/state/test_message_copy_mapping.py'
-      - 'tests/state/test_message_row_publication.py'
-      - 'tests/test_compression_watermark_commit.py'
-      - 'tests/state/test_todo_compaction.py'
-      - 'tests/run_agent/test_in_place_compaction.py'
-      - 'tests/agent/test_micro_compaction.py'
-      - 'tests/hermes_state/test_append_messages_batch.py'
-      - 'tests/tui_gateway/test_run_checkpoint_claim_rpc.py'
-      - 'tests/tui_gateway/test_goal_command.py'
-      - 'tests/test_turn_run_custody.py'
-      - 'tests/tui_gateway/test_inline_rpc_gil_starvation.py'
-      - 'tests/tui_gateway/test_kanban_notify_poller.py'
-      - 'tests/test_tui_gateway_server.py'
-      - 'tests/cli/test_cli_goal_interrupt.py'
-      - 'tests/cli/test_cli_async_delegation_delivery.py'
-      - 'tests/gateway/test_goal_resume_restart.py'
-      - 'tests/agent/test_synthetic_turn_display_kind.py'
-      - 'tests/agent/test_turn_context.py'
-      - 'tests/run_agent/test_run_agent.py'
-      - 'tests/run_agent/test_1630_context_overflow_loop.py'
-      - 'tests/run_agent/test_compression_lock_defer.py'
-      - 'agent/agent_init.py'
-      - 'agent/agent_runtime_helpers.py'
-      - 'agent/tool_executor.py'
-      - 'model_tools.py'
-      - 'agent/conversation_loop.py'
-      - 'agent/chat_completion_helpers.py'
-      - 'agent/codex_runtime.py'
-      - 'agent/run_checkpoint_custody.py'
-      - 'agent/turn_context.py'
-      - 'agent/context_input.py'
-      - 'cli.py'
-      - 'hermes_cli/goals.py'
-      - 'hermes_cli/heartbeat.py'
-      - 'hermes_cli/loops.py'
-      - 'hermes_state.py'
-      - 'hermes_state_common.py'
-      - 'hermes_state_continuity.py'
-      - 'hermes_state_inbox.py'
-      - 'hermes_state_input_turns.py'
-      - 'agent/turn_finalizer.py'
-      - 'hermes_state_runs.py'
-      - 'plugins/context_engine/_context_governor/**'
-      - 'scripts/run_checkpoint_context.py'
-      - 'scripts/run_checkpoint_claim.py'
-      - 'scripts/run_checkpoint_resume.py'
-      - 'tui_gateway/run_checkpoint_rpc.py'
-      - 'scripts/run_tests.sh'
-      - 'tests/run_agent/test_streaming.py'
-      - 'tests/run_agent/test_run_agent_codex_responses.py'
-      - 'tests/run_agent/test_codex_sdk_transform_bypass.py'
-      - 'tests/plugins/test_context_governor*.py'
-      - 'tui_gateway/server.py'
-      - 'tui_gateway/methods_prompt.py'
-      - 'tui_gateway/compute_host.py'
-      - 'docs/context-continuity/**'
+    branches: [feat/context-continuity-v4-20260923]
 
 permissions:
   contents: read
@@ -123,6 +21,8 @@ concurrency:
 
 jobs:
   native-external-owner:
+    outputs:
+      qualification_result: ${{ job.status }}
     name: Native external owner paired source
     runs-on: ubuntu-latest
     timeout-minutes: 45
@@ -209,6 +109,8 @@ jobs:
             HERMES_PYTHON="$PWD/.venv/bin/python" HERMES_TEST_WORKERS=1 HERMES_TEST_FILE_RETRIES=0 \
             scripts/run_tests.sh tests/ares_runtime/test_context_native_paired.py -- -q
   focused-tests:
+    outputs:
+      qualification_result: ${{ job.status }}
     runs-on: ubuntu-latest
     timeout-minutes: 20
     steps:

.github/workflows/current-owner-integration.yml

@@ -1,37 +1,19 @@
 name: Current owner integration
 
 on:
-  push:
-    branches: [main]
-    paths:
-      - '.github/workflows/current-owner-integration.yml'
-      - 'ares_runtime/collaboration.py'
-      - 'ares_runtime/governed_context.py'
-      - 'ares_runtime/__init__.py'
-      - 'tests/owner_integration/**'
-      - 'tests/test_ares_collaboration.py'
-      - 'tests/ares_runtime/test_governed_context_materialization.py'
-      - 'tests/ares_runtime/test_memory_witness_v2.py'
-      - 'tests/ares_runtime/test_policy_basis_v2.py'
-      - 'tests/ares_runtime/fixtures/profile_runtime_v2_owner.json'
-  pull_request:
-    paths:
-      - '.github/workflows/current-owner-integration.yml'
-      - 'ares_runtime/collaboration.py'
-      - 'ares_runtime/governed_context.py'
-      - 'ares_runtime/__init__.py'
-      - 'tests/owner_integration/**'
-      - 'tests/test_ares_collaboration.py'
-      - 'tests/ares_runtime/test_governed_context_materialization.py'
-      - 'tests/ares_runtime/test_memory_witness_v2.py'
-      - 'tests/ares_runtime/test_policy_basis_v2.py'
-      - 'tests/ares_runtime/fixtures/profile_runtime_v2_owner.json'
+  workflow_call:
+    outputs:
+      profile_runtime_consumer_result:
+        description: Result of the canonical owner to Ares consumer qualification.
+        value: ${{ jobs.profile-runtime-consumer.outputs.qualification_result }}
 
 permissions:
   contents: read
 
 jobs:
   profile-runtime-consumer:
+    outputs:
+      qualification_result: ${{ job.status }}
     name: Current profile-runtime owner to Ares
     runs-on: ubuntu-latest
     timeout-minutes: 25

agent/agent_init.py

@@ -2106,6 +2106,8 @@ def init_agent(
     _agent_section = _agent_cfg.get("agent", {})
     if not isinstance(_agent_section, dict):
         _agent_section = {}
+    from agent.transports.ri_llm import configure_ri_pipeline
+    configure_ri_pipeline(agent, _agent_cfg)
     agent._tool_use_enforcement = _agent_section.get("tool_use_enforcement", "auto")
 
     # Execution-discipline guidance gate: "auto" (default — matches
@@ -2821,7 +2823,16 @@ def _parse_prune_int(raw, default):
     except Exception:
         pass
 
-    if _engine_name != "compressor":
+    if _engine_name == "ri-context-governor":
+        # Ares explicitly selects a certified, receipt-preserving engine.
+        # Readiness failure must not select Hermes' LLM compressor instead.
+        from plugins.context_engine import (
+            ContextEngineActivationError,
+            load_context_engine_strict,
+        )
+
+        _selected_engine = load_context_engine_strict(_engine_name)
+    elif _engine_name != "compressor":
         # Try loading from plugins/context_engine/<name>/
         try:
             from plugins.context_engine import load_context_engine
@@ -2905,6 +2916,7 @@ def _parse_prune_int(raw, default):
             api_key=getattr(agent, "api_key", ""),
             provider=agent.provider,
             api_mode=agent.api_mode,
+            max_tokens=agent.max_tokens,
             threshold_percent=compression_threshold,
         )
         if not agent.quiet_mode:
@@ -2937,8 +2949,12 @@ def _parse_prune_int(raw, default):
     if callable(_bind_session_state):
         try:
             _bind_session_state(session_db=session_db, session_id=agent.session_id)
-        except Exception:
-            pass
+        except Exception as _ce_bind_err:
+            if _engine_name == "ri-context-governor":
+                raise ContextEngineActivationError(
+                    f"configured context engine '{_engine_name}' failed its "
+                    f"session binding: {_ce_bind_err}"
+                ) from _ce_bind_err
     agent.compression_enabled = compression_enabled
     agent.compression_in_place = compression_in_place
     agent.context_rebase_enabled = compression_context_rebase
@@ -3045,6 +3061,7 @@ def _parse_prune_int(raw, default):
             agent.enabled_toolsets is None
             or "context_engine" in agent.enabled_toolsets
         )
+        and "context_engine" not in (agent.disabled_toolsets or [])
     ):
         _existing_tool_names = {
             t.get("function", {}).get("name")
@@ -3075,6 +3092,11 @@ def _parse_prune_int(raw, default):
 
     # Notify context engine of session start
     if hasattr(agent, "context_compressor") and agent.context_compressor:
+        _session_start_context = (
+            {"session_db": session_db}
+            if _engine_name == "ri-context-governor"
+            else {}
+        )
         try:
             agent.context_compressor.on_session_start(
                 agent.session_id,
@@ -3083,8 +3105,14 @@ def _parse_prune_int(raw, default):
                 model=agent.model,
                 context_length=getattr(agent.context_compressor, "context_length", 0),
                 conversation_id=getattr(agent, "_gateway_session_key", None),
+                **_session_start_context,
             )
         except Exception as _ce_err:
+            if _engine_name == "ri-context-governor":
+                raise ContextEngineActivationError(
+                    f"configured context engine '{_engine_name}' failed its "
+                    f"session start: {_ce_err}"
+                ) from _ce_err
             _ra().logger.debug("Context engine on_session_start: %s", _ce_err)
 
     agent._subdirectory_hints = SubdirectoryHintTracker(