ci(mg-reuse): merge_group skips workspace-test-shard on identical-tree green PR run (PMAT-5884)

.github/workflows/ci.yml

@@ -139,6 +139,43 @@ jobs:
           printf '%s\n' "$out"
           printf '%s\n' "$out" | grep -E '^(x86|det|cite|pr_head)=' >> "$GITHUB_OUTPUT"
 
+  # T43b (#5884, Noah 16:28Z #3, extends mg-reuse): on merge_group, workspace-test-shard is skipped ONLY when the queue
+  # entry's tree sha == the tree sha of a green PR run's head (K1-K5: queue head has one parent, the base; the base
+  # has one parent; the base is an ancestor of the head; M^{tree} == H^{tree}; the head's newest ci.yml pull_request
+  # run is complete and every job is that run's) AND that run's `workspace-test` verdict succeeded. Any difference
+  # (changed main, another tree, a lookup that failed) leaves wt=0 and the full shards run. x86-main and determinism
+  # are NOT read here: they stay un-reused on the queue (20X r2), so x86-main still never waits for this job.
+  mg-reuse-wt:
+    if: github.event_name == 'merge_group'
+    # same lane as the shards it gates (mq on a queue entry); the job only runs on merge_group, the clean-room arm just names the pool for the label guard
+    runs-on: ${{ github.event_name == 'merge_group' && fromJSON('["self-hosted","Linux","X64","mq"]') || fromJSON('["self-hosted","Linux","X64","clean-room"]') }}
+    timeout-minutes: 5
+    permissions:
+      contents: read
+      actions: read
+      pull-requests: read
+    outputs:
+      wt: ${{ steps.key.outputs.wt }}
+      wt_cite: ${{ steps.key.outputs.wt_cite }}
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          # full history: K3 (merge-base --is-ancestor) walks the PR head back to the base; the mq runner keeps a warm clone
+          fetch-depth: 0
+      - name: Read the workspace-test reuse key for this queue entry (3 API calls)
+        id: key
+        env:
+          GH_TOKEN: ${{ github.token }}
+          QREF: ${{ github.event.merge_group.head_ref }}
+          QHEAD: ${{ github.event.merge_group.head_sha }}
+          QBASE: ${{ github.event.merge_group.base_sha }}
+          REPO: ${{ github.repository }}
+        run: |
+          set -euo pipefail
+          out=$(bash scripts/ci_mg_reuse.sh resolve --event merge_group --ref "$QREF" --queue-head "$QHEAD" --base "$QBASE" --repo "$REPO")
+          printf '%s\n' "$out"
+          printf '%s\n' "$out" | grep -E '^(wt|wt_cite)=' >> "$GITHUB_OUTPUT"
+
   # The same case table on every event, so a change that breaks the key is RED on
   # its own PR, not first in the queue. gate requires it.
   mg-reuse-self-test:
@@ -475,8 +512,22 @@ jobs:
   # The workspace tests, one shard per job (nextest hash partition N/12 plus the
   # explicit runner's round-robin N/12), in parallel on the X64 clean-room pool.
   # The section body is ci/sections.yml `workspace-test-shard`, unchanged.
+  # mg-reuse-wt may cite a PR run only if that run really tested the tree. A receipt-reuse run (#5850, tier=reuse)
+  # runs no test step, so its shards are green over zero tests. This marker needs the shards and runs only after
+  # they SUCCEEDED, so a run whose shards were skipped or failed never has it; ci_mg_reuse.sh refuses wt=1 unless it
+  # succeeded (R:k6-wt-ran). Once #5850's receipt-judge job exists, ci_mg_reuse.sh --self-test
+  # (mgshape) is RED until this job needs it and keys its if on receipt-judge.outputs.ok.
+  workspace-test-ran:
+    needs: [workspace-test-shard]
+    if: ${{ !cancelled() && needs.workspace-test-shard.result == 'success' && github.event_name == 'pull_request' && github.event.pull_request.draft != true }}
+    runs-on: [self-hosted, Linux, clean-room]
+    timeout-minutes: 5
+    steps:
+      - run: echo "this run owes and runs the test suite"
   workspace-test-shard:
-    if: ${{ github.event.pull_request.draft != true }}
+    # T43b: a merge_group entry whose tree equals a green PR run's skips the shards (mg-reuse-wt); anything else runs them
+    needs: [mg-reuse-wt]
+    if: ${{ !cancelled() && needs.mg-reuse-wt.outputs.wt != '1' && github.event.pull_request.draft != true }}
     # same lanes as x86-main: clean-room for pull_request/push, mq for a merge_group entry
     runs-on: ${{ github.event_name == 'merge_group' && fromJSON('["self-hosted","Linux","X64","mq"]') || fromJSON('["self-hosted","Linux","X64","clean-room"]') }}
     timeout-minutes: 180
@@ -528,22 +579,31 @@ jobs:
   workspace-test:
     runs-on: [self-hosted, Linux, clean-room]
     timeout-minutes: 10
-    needs: [workspace-test-shard]
+    needs: [workspace-test-shard, mg-reuse-wt]
     if: always()
     steps:
-      - name: Every shard passed
+      - name: Every shard passed (or the whole set was reused from an identical-tree green PR run)
         env:
           SHARD_RESULT: ${{ needs.workspace-test-shard.result }}
+          WT_REUSE: ${{ needs.mg-reuse-wt.outputs.wt }}
+          WT_CITE: ${{ needs.mg-reuse-wt.outputs.wt_cite }}
           DRAFT: ${{ github.event.pull_request.draft }}
         run: |
           set -euo pipefail
           [ "${DRAFT:-}" != true ] || { echo "draft PR: the shards are not owed until ready_for_review"; exit 0; }
-          echo "workspace-test-shard matrix result: $SHARD_RESULT"
+          echo "workspace-test-shard matrix result: $SHARD_RESULT (reuse key wt='${WT_REUSE:-}')"
+          if [ "${WT_REUSE:-}" = 1 ]; then
+            # T43b: the shards are skipped ONLY under the key; a shard that ran anyway is a contradiction, never a pass
+            [ "$SHARD_RESULT" = skipped ] || { echo "::error::workspace-test: reuse key wt=1 but the shard matrix result is '$SHARD_RESULT'"; exit 1; }
+            [ -n "${WT_CITE:-}" ] || { echo "::error::workspace-test: reuse key wt=1 without a citation"; exit 1; }
+            echo "workspace-test reused: merge-group tree == tree of a green PR run (${WT_CITE})"
+            exit 0
+          fi
           [ "$SHARD_RESULT" = success ] || { echo "::error::workspace-test: shard matrix result is '$SHARD_RESULT' (a cancelled or skipped shard is not a pass)"; exit 1; }
       - uses: actions/checkout@v7
         if: ${{ github.event.pull_request.draft != true }}
       - uses: actions/download-artifact@v4
-        if: ${{ github.event.pull_request.draft != true }}
+        if: ${{ needs.mg-reuse-wt.outputs.wt != '1' && github.event.pull_request.draft != true }}
         with:
           pattern: sigma-shard-*
           path: ${{ runner.temp }}/sigma
@@ -552,7 +612,7 @@ jobs:
       # ids is compared with the universe shard 1 listed. A shard whose ids did
       # not arrive is RED, never a smaller universe.
       - name: "Σ-executed: the union of the shards is exactly the owed set (#4433)"
-        if: ${{ github.event.pull_request.draft != true }}
+        if: ${{ needs.mg-reuse-wt.outputs.wt != '1' && github.event.pull_request.draft != true }}
         run: |
           set -euo pipefail
           d="$RUNNER_TEMP/sigma"

crates/aprender-core/tests/monorepo_invariants.rs

@@ -1152,7 +1152,10 @@ fn draft_gate_canon() -> Vec<(&'static str, String)> {
         ("x86-main", format!("${{{{ !cancelled() && needs.mg-reuse.outputs.x86 != '1' && {DF} }}}}")),
         ("x86-main-advisories", format!("${{{{ !cancelled() && needs.mg-reuse.outputs.x86 == '1' && {DF} }}}}")),
         ("determinism", "${{ !cancelled() && needs.mg-reuse.outputs.det != '1' && github.event_name != 'pull_request' }}".into()),
-        ("workspace-test-shard", format!("${{{{ {DF} }}}}")),
+        // merge_group-only: a draft never reaches the queue, so there is nothing to skip.
+        ("mg-reuse-wt", "github.event_name == 'merge_group'".into()),
+        ("workspace-test-shard", format!("${{{{ !cancelled() && needs.mg-reuse-wt.outputs.wt != '1' && {DF} }}}}")),
+        ("workspace-test-ran", format!("${{{{ !cancelled() && needs.workspace-test-shard.result == 'success' && github.event_name == 'pull_request' && {DF} }}}}")),
         ("workspace-test", "always()".into()),
         ("ci-gate", "always()".into()),
         ("gate", "always()".into()),

docs/roadmaps/entries/PMAT-5884.yaml

@@ -0,0 +1,20 @@
+- id: PMAT-5884
+  github_issue: 5884
+  item_type: task
+  title: 'mg-reuse: merge_group skips workspace-test-shard when its tree == a green PR run''s tree (Noah 16:28Z #3)'
+  status: planned
+  priority: high
+  assigned_to: null
+  created: 2026-10-21T17:05:00Z
+  updated: 2026-10-21T17:05:00Z
+  spec: null
+  acceptance_criteria:
+  - 'merge_group skips workspace-test-shard only when K1-K5 hold and the PR head run workspace-test succeeded; any difference runs the full shards'
+  - 'ci_mg_reuse.sh --self-test falsifier: changed main/tree -> wt=0, identical tree -> wt=1, override carries wt only when exactly 1'
+  phases: []
+  subtasks: []
+  estimated_effort: null
+  labels:
+  - kind:code
+  notes: null
+  epic: 5510

docs/roadmaps/roadmap.yaml

@@ -25436,6 +25436,26 @@ Not done, pending the ruling: moving the 31 fixture files to an obviously synthe
   - kind:code
   notes: null
   epic: 5510
+- id: PMAT-5884
+  github_issue: 5884
+  item_type: task
+  title: 'mg-reuse: merge_group skips workspace-test-shard when its tree == a green PR run''s tree (Noah 16:28Z #3)'
+  status: planned
+  priority: high
+  assigned_to: null
+  created: 2026-10-21T17:05:00Z
+  updated: 2026-10-21T17:05:00Z
+  spec: null
+  acceptance_criteria:
+  - 'merge_group skips workspace-test-shard only when K1-K5 hold and the PR head run workspace-test succeeded; any difference runs the full shards'
+  - 'ci_mg_reuse.sh --self-test falsifier: changed main/tree -> wt=0, identical tree -> wt=1, override carries wt only when exactly 1'
+  phases: []
+  subtasks: []
+  estimated_effort: null
+  labels:
+  - kind:code
+  notes: null
+  epic: 5510
 - id: PMAT-5888
   github_issue: 5888
   item_type: task

scripts/check_ci_draft_skip.sh

@@ -48,7 +48,7 @@ check() { # FILE -> prints one FAIL line per violated condition; rc 1 when any
         fi
     done
     blk="$(job_block "$f" workspace-test)"
-    if [ "$(printf '%s\n' "$blk" | /usr/bin/grep -c 'if: ${{ github.event.pull_request.draft != true }}')" -lt 3 ]; then
+    if [ "$(printf '%s\n' "$blk" | /usr/bin/grep -c -E 'if: [$][{][{] (needs[.]mg-reuse-wt[.]outputs[.]wt != .1. && )?github[.]event[.]pull_request[.]draft != true [}][}]')" -lt 3 ]; then
         echo "FAIL  workspace-test: checkout, download-artifact and sigma steps are not all skipped on a draft"; bad=1
     fi
     return "$bad"

scripts/check_ci_push_reuse.sh

@@ -137,10 +137,14 @@ OTHER=2222222222222222222222222222222222222222
 QUEUE=gh-readonly-queue/main/pr-4700-0000000000000000000000000000000000000000
 suite() { printf '{"id":%s,"head_branch":"%s","app":{"slug":"%s"}}' "$1" "$2" "${3:-github-actions}"; }
 crun()  { printf '{"status":"%s","conclusion":%s,"head_sha":"%s","completed_at":"%s","check_suite":{"id":%s},"details_url":"https://github.com/o/r/actions/runs/%s/job/9"}' "$1" "$2" "$3" "$4" "$5" "$6"; }
+sjobs() { # sjobs <n>... -> a jobs body whose workspace-test-shard (n, 4) jobs all succeeded (the queue run really tested)
+  local n; { for n in "$@"; do printf '{"name":"workspace-test-shard (%s, 4)","conclusion":"success"}\n' "$n"; done; printf '{"name":"gate","conclusion":"success"}\n'; } | jq -s '{jobs: .}'
+}
 canned() { # canned <suites-json-list> <runs-json-list>
-  rm -f "${T:?}/canned/suites.FAIL" "${T:?}/canned/runs.FAIL" "${T:?}/canned/calls"
+  rm -f "${T:?}/canned/suites.FAIL" "${T:?}/canned/runs.FAIL" "${T:?}/canned/mgjobs.FAIL" "${T:?}/canned/calls"
   printf '{"check_suites":[%s]}' "$1" >"$T/canned/suites.json"
   printf '{"check_runs":[%s]}' "$2" >"$T/canned/runs.json"
+  sjobs 1 2 3 4 >"$T/canned/mgjobs.json"
 }
 look() { OUT="$(bash "$LOOKUP" o/r "${1:-$SHA}" 2>"$T/err")"; RC=$?; ERR="$(cat "$T/err")"; }
 flat() { tr '\n' ' ' <<<"$1" | sed 's/ $//'; }
@@ -154,7 +158,7 @@ look
 want "L1 a merge-queue workspace-test success on the sha -> found, exit 0" 0 "$RC"
 want "L1 prints the run, the sha the API reports, the conclusion (the push suite's later failure is not the queue's)" \
      "--mg-run 7001 --mg-sha $SHA --mg-conclusion success" "$(flat "$OUT")"
-want "L1 costs exactly 2 API calls" 2 "$(wc -l <"$T/canned/calls" | tr -d ' ')"
+want "L1 costs exactly 3 API calls (suites, check-runs, the run's jobs)" 3 "$(wc -l <"$T/canned/calls" | tr -d ' ')"
 
 canned "$(suite 50 "$QUEUE")" "$(crun completed '"failure"' $SHA 2026-10-04T10:00:00Z 50 7003)"
 look
@@ -213,6 +217,36 @@ canned "$(suite 50 "$QUEUE")" "$(crun completed '"success"' abc 2026-10-04T10:00
 look
 want "L13 the check run reports a head_sha that is not a sha -> nothing, exit 1" "1:" "$RC:$OUT"
 
+# L14-L18: a queue run whose green `workspace-test` did not run its own shards is a citation, not a measurement (finding: transitive reuse)
+canned "$(suite 50 "$QUEUE")" "$(crun completed '"success"' $SHA 2026-10-04T10:00:00Z 50 7015)"
+sjobs 1 2 | jq '.jobs += [{"name":"workspace-test-shard (3, 4)","conclusion":"skipped"},{"name":"workspace-test-shard (4, 4)","conclusion":"skipped"}]' >"$T/canned/mgjobs.json"
+look
+want "L14 the queue run skipped its shards (it cited a PR run) -> nothing, exit 1" "1:" "$RC:$OUT"
+has "L14 says why" "did not run and pass its own workspace-test shards" "$ERR"
+
+canned "$(suite 50 "$QUEUE")" "$(crun completed '"success"' $SHA 2026-10-04T10:00:00Z 50 7016)"
+sjobs 1 2 3 | jq '.jobs += [{"name":"workspace-test-shard (4, 4)","conclusion":"failure"}]' >"$T/canned/mgjobs.json"
+look
+want "L15 one shard failed under a green verdict -> nothing, exit 1" "1:" "$RC:$OUT"
+
+canned "$(suite 50 "$QUEUE")" "$(crun completed '"success"' $SHA 2026-10-04T10:00:00Z 50 7017)"
+sjobs >"$T/canned/mgjobs.json"
+look
+want "L16 the queue run has no shard job at all -> nothing, exit 1" "1:" "$RC:$OUT"
+
+canned "$(suite 50 "$QUEUE")" "$(crun completed '"success"' $SHA 2026-10-04T10:00:00Z 50 7018)"
+: >"$T/canned/mgjobs.FAIL"
+look
+want "L17 the jobs call fails -> nothing, exit 1" "1:" "$RC:$OUT"
+has "L17 names the failed call" "jobs lookup failed" "$ERR"
+
+canned "$(suite 50 "$QUEUE")" "$(crun completed '"failure"' $SHA 2026-10-04T10:00:00Z 50 7019)"
+sjobs >"$T/canned/mgjobs.json"
+look
+want "L18 a failed verdict is still printed without a jobs call (only a success is checked for citation)" \
+     "--mg-run 7019 --mg-sha $SHA --mg-conclusion failure" "$(flat "$OUT")"
+want "L18 and it cost 2 API calls" 2 "$(wc -l <"$T/canned/calls" | tr -d ' ')"
+
 # -- D: the decision -------------------------------------------------------------------------------
 mkrepo() { # mkrepo <dir> -> a two-commit repo whose push diff is docs-only (today's tier: none, no cargo)
   git init -q -b main "$1"