perf(ci): select only the suites a change runs or reads

docs/ci-runner-routing.md

@@ -116,10 +116,11 @@ four (four on the whole tree or an UNMAPPED file), and, per leg, whether its
 slice needs the animation wheels, the inventory's parser packages or the DuckDB
 CLI. A leg installs only those; the shfmt and DuckDB downloads are cached.
 
-The selector's rule R8 covers the gap a full main run used to cover: a change
-anywhere under `plugins/<p>/` also selects every shell suite under that plugin,
-because suites that scan their own plugin directory never name the file that
-changed.
+A suite that scans a directory never names the file that changed, so it
+declares what it reads in a `# test-scope:` header, and the selector's rule R8
+selects it for any changed file matching the glob. The rules, and the
+`--replay` mode that shows a selector change's effect on recent main commits,
+are in the header of `scripts/affected-tests.sh`.
 
 ## Contract-only `ci-status`
 

plugins/actionlint/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "actionlint",
-  "version": "0.12.1",
+  "version": "0.12.2",
   "description": "Lint GitHub Actions workflow files on edit via actionlint, surfacing findings as advisory context.",
   "author": {
     "name": "Melodic Software",

plugins/actionlint/CHANGELOG.md

@@ -3,6 +3,12 @@
 All notable changes to the `actionlint` plugin are documented here. Format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning.
 
+## [0.12.2] - 2026-10-03
+
+### Changed
+
+- `hooks/actionlint-check.test.sh` declares the files it reads without naming them in a `# test-scope:` header, so CI's test selection runs it when one of them changes. Nothing the plugin runs changed.
+
 ## [0.12.1] - 2026-10-03
 
 ### Changed

plugins/actionlint/hooks/actionlint-check.test.sh

@@ -12,6 +12,7 @@
 # the caller's working directory would surface (the tool is file-anchored, so a
 # correct hook needs no cd). actionlint is required to drive the violation
 # assertions; without it the suite skips (the hook itself no-ops silently).
+# test-scope: plugins/actionlint/hooks/* plugins/actionlint/.claude-plugin/plugin.json
 
 set -uo pipefail
 

plugins/animation/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "animation",
-  "version": "0.4.1",
+  "version": "0.4.2",
   "description": "Hand-drawn-style 2D animation as code, rendered in headless Chromium by an ink brush engine. rotoscope copies a reference clip drawing by drawing: trace to vector paths, render, measure against the source (XOR, SSIM), and fit per-shot brush overrides. learn-style measures a clip into a style pack (ships woodcut-ink) and checks films against it. produce turns a brief into approved boards, a shot list, frames, and a delivered file. setup checks ffmpeg, Node, Chromium, and Python.",
   "author": {
     "name": "Melodic Software",

plugins/animation/CHANGELOG.md

@@ -3,6 +3,12 @@
 All notable changes to the `animation` plugin are documented here. Format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning.
 
+## [0.4.2] - 2026-10-03
+
+### Changed
+
+- `scripts/animation.test.sh` declares the files it reads without naming them in a `# test-scope:` header, so CI's test selection runs it when one of them changes. Nothing the plugin runs changed.
+
 ## [0.4.1] - 2026-10-03
 
 ### Changed

plugins/animation/scripts/animation.test.sh

@@ -5,6 +5,7 @@
 # ../requirements.txt hash-locks them) and skip without them, so ANIMATION_REQUIRE_DEPS=1 fails the run
 # instead: a lane that provisions the pinned requirements sets it, and missing dependencies then read as a
 # broken environment, not as passing coverage.
+# test-scope: plugins/animation/skills/*/SKILL.md plugins/animation/skills/*/scripts/* plugins/animation/hooks/*.sh
 set -uo pipefail
 
 cd "$(dirname "${BASH_SOURCE[0]}")" || exit 1

plugins/autonomy/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "autonomy",
-  "version": "0.26.1",
+  "version": "0.26.2",
   "description": "Contracts for governed autonomous agent operation: role topology, binding seam, telemetry, return accounting, trigger dispatch, a per-work-class guardrail matrix, a standing-routine catalog, and a runner charter. A guided setup skill writes an org's binding, wires OTLP telemetry (file default), human-attested return capture, and signal adapters behind one governed dispatch entrypoint, binds the guardrail matrix to isolation substrates after a live probe, and schedules routines.",
   "author": {
     "name": "Melodic Software",

plugins/autonomy/CHANGELOG.md

@@ -3,6 +3,12 @@
 All notable changes to the `autonomy` plugin are documented here. Format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning.
 
+## [0.26.2] - 2026-10-03
+
+### Changed
+
+- `skills/setup/scripts/check-prerequisite-resolution-slice.test.sh`, `skills/setup/scripts/check-security-binding.fixtures.test.sh`, `skills/setup/scripts/generate-identity-prerequisites.test.sh`, and `skills/setup/scripts/resolve-prerequisites.fixtures.test.sh` declare the files they read without naming them in `# test-scope:` headers, so CI's test selection runs them when one of those files changes. Nothing the plugin runs changed.
+
 ## [0.26.1] - 2026-10-03
 
 ### Changed

plugins/autonomy/skills/setup/scripts/check-prerequisite-resolution-slice.test.sh

@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
 # Tests for the prerequisite-resolution setup slice wrappers.
+# test-scope: plugins/autonomy/skills/setup/scripts/fixtures/prerequisite-resolution/*
 set -uo pipefail
 
 SELF_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"

plugins/autonomy/skills/setup/scripts/check-security-binding.fixtures.test.sh

@@ -1,6 +1,7 @@
 #!/usr/bin/env bash
 # Discovery wrapper: scripts/run-plugin-tests.sh finds plugins/**/*.test.sh, so
 # this hands off to the Node suite. SKIPs (exit 0) when Node is unavailable.
+# test-scope: plugins/autonomy/skills/setup/evals/fixtures/security-binding/*
 set -uo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"

plugins/autonomy/skills/setup/scripts/generate-identity-prerequisites.test.sh

@@ -2,6 +2,7 @@
 # Unit tests for generate-identity-prerequisites.mjs. Cases are named in the
 # co-located manifest; this harness builds throwaway trees where needed and
 # drives generate / --check / drift / leaf↔emission parity.
+# test-scope: plugins/autonomy/reference/routines/*.md
 set -uo pipefail
 
 SELF_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"

plugins/autonomy/skills/setup/scripts/resolve-prerequisites.fixtures.test.sh

@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
 # Discovery wrapper: scripts/run-plugin-tests.sh finds plugins/**/*.test.sh.
+# test-scope: plugins/autonomy/skills/setup/scripts/fixtures/prerequisite-resolution/* plugins/autonomy/generated/*
 set -uo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"

plugins/code-metrics/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "code-metrics",
-  "version": "0.5.3",
+  "version": "0.5.4",
   "description": "Read-only code measures for a change, with cited references and no verdict: lines per file (audit-size), cyclomatic, cognitive, and Halstead complexity (audit-complexity), duplication (audit-duplication), per-function coverage and CRAP from existing lcov, Cobertura, coverage.py, or Go artifacts (audit-coverage), TypeScript and Python type debt (audit-type-debt), metric literacy (principles), and setup. Uses only collectors already installed; never installs or runs tests.",
   "author": {
     "name": "Melodic Software",

plugins/code-metrics/CHANGELOG.md

@@ -3,6 +3,12 @@
 All notable changes to the `code-metrics` plugin are documented here. Format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning.
 
+## [0.5.4] - 2026-10-03
+
+### Changed
+
+- `scripts/dispatch.test.sh`, `scripts/tool-free-path.test.sh`, `skills/audit-complexity/scripts/audit-complexity.test.sh`, `skills/audit-coverage/scripts/audit-coverage.test.sh`, `skills/audit-duplication/scripts/audit-duplication.test.sh`, `skills/audit-size/scripts/audit-size.test.sh`, `skills/audit-type-debt/scripts/audit-type-debt.test.sh`, and `skills/setup/scripts/setup-check.test.sh` declare the files they read without naming them in `# test-scope:` headers, so CI's test selection runs them when one of those files changes. Nothing the plugin runs changed.
+
 ## [0.5.3] - 2026-10-03
 
 ### Fixed

plugins/code-metrics/scripts/dispatch.test.sh

@@ -4,6 +4,7 @@
 # carries a fake `scc` that replays fixtures/tool-output/scc.json (design T13;
 # nothing executable is committed). The adapters themselves (scc.py,
 # line-counter.py) and report.py are exercised through the dispatcher.
+# test-scope: plugins/code-metrics/scripts/collectors/*.py plugins/code-metrics/scripts/fixtures/*
 set -uo pipefail
 unset GIT_DIR GIT_WORK_TREE GIT_CONFIG
 

plugins/code-metrics/scripts/tool-free-path.test.sh

@@ -2,6 +2,7 @@
 # Regression tests for tool-free-path.sh: the excluded set is derived from
 # the collector ladder, the filled directory keeps those collectors off PATH,
 # and the resolvable-collector check fails when one is put back.
+# test-scope: plugins/code-metrics/scripts/collectors/*.py
 set -uo pipefail
 unset GIT_DIR GIT_WORK_TREE GIT_CONFIG
 

plugins/code-metrics/skills/audit-complexity/scripts/audit-complexity.test.sh

@@ -6,6 +6,7 @@
 # PATH carries fake `lizard`, `radon`, `multimetric`, `gocognit` and
 # `shellmetrics` replaying the committed captures under
 # fixtures/tool-output/ (design T13; nothing executable is committed).
+# test-scope: plugins/code-metrics/scripts/collectors/*.py plugins/code-metrics/scripts/fixtures/*
 set -uo pipefail
 unset GIT_DIR GIT_WORK_TREE GIT_CONFIG
 

plugins/code-metrics/skills/audit-coverage/scripts/audit-coverage.test.sh

@@ -16,6 +16,7 @@
 # only, which is what makes Bash CRAP not-applicable). Nothing executable is
 # committed (design T13). No test command is ever run: this skill reads
 # artifacts.
+# test-scope: plugins/code-metrics/scripts/collectors/*.py plugins/code-metrics/scripts/parsers/*.py plugins/code-metrics/scripts/fixtures/*
 set -uo pipefail
 unset GIT_DIR GIT_WORK_TREE GIT_CONFIG
 

plugins/code-metrics/skills/audit-duplication/scripts/audit-duplication.test.sh

@@ -20,6 +20,7 @@
 # scripts/cross-plugin-source-registry.txt. It runs only when a real `jscpd`
 # already resolves on PATH, which this plugin never installs, and otherwise
 # prints a visible SKIP line.
+# test-scope: plugins/code-metrics/scripts/collectors/*.py plugins/code-metrics/scripts/fixtures/*
 set -uo pipefail
 unset GIT_DIR GIT_WORK_TREE GIT_CONFIG
 

plugins/code-metrics/skills/audit-size/scripts/audit-size.test.sh

@@ -1,6 +1,7 @@
 #!/usr/bin/env bash
 # Regression tests for the audit-size entry point (audit-size.sh): option parsing,
 # JSON versus markdown output, and exit-code passthrough from dispatch.sh.
+# test-scope: plugins/code-metrics/scripts/collectors/*.py plugins/code-metrics/scripts/fixtures/*
 set -uo pipefail
 unset GIT_DIR GIT_WORK_TREE GIT_CONFIG
 

plugins/code-metrics/skills/audit-type-debt/scripts/audit-type-debt.test.sh

@@ -13,6 +13,7 @@
 # repository-relative path and passed relative, as the dispatcher passes a
 # scope in a real run, because the type-coverage capture names its file by
 # that relative path and a file row matches a scope file on the path.
+# test-scope: plugins/code-metrics/scripts/collectors/*.py plugins/code-metrics/scripts/fixtures/*
 set -uo pipefail
 unset GIT_DIR GIT_WORK_TREE GIT_CONFIG
 

plugins/code-metrics/skills/setup/scripts/setup-check.test.sh

@@ -1,6 +1,7 @@
 #!/usr/bin/env bash
 # Regression tests for setup-check.sh: the layer rows, the tracked-file guard,
 # the resolved references, and one row per collector adapter.
+# test-scope: plugins/code-metrics/scripts/collectors/*.py
 set -uo pipefail
 unset GIT_DIR GIT_WORK_TREE GIT_CONFIG
 

plugins/code-tidying/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "code-tidying",
-  "version": "0.28.2",
+  "version": "0.28.3",
   "description": "Code tidying and comment hygiene. tidy hunts a rotated lane for Beck-style tidyings and ships one PR. batch-simplify sweeps a branch, time window, or repo in dependency-ordered waves. dissolve-comments deletes zero-information comments and moves the rest into names (safe, aggressive, strip modes). audit-comment-residue flags history, plan, conversational, and ticket residue. audit-dead-code finds dead code with knip, vulture, gopls, and grep. setup scaffolds tidy lanes.",
   "author": {
     "name": "Melodic Software",

plugins/code-tidying/CHANGELOG.md

@@ -3,6 +3,12 @@
 All notable changes to the `code-tidying` plugin are documented here. Format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning.
 
+## [0.28.3] - 2026-10-03
+
+### Changed
+
+- `scripts/allowed-tools-pairing.test.sh` and `scripts/evals-fixtures.test.sh` declare the files they read without naming them in `# test-scope:` headers, so CI's test selection runs them when one of those files changes. Nothing the plugin runs changed.
+
 ## [0.28.2] - 2026-10-03
 
 ### Changed

plugins/code-tidying/scripts/allowed-tools-pairing.test.sh

@@ -31,6 +31,7 @@
 # fixed string searched for VERBATIM in markdown and frontmatter, where those
 # placeholders are substituted by Claude Code at load time. Letting the shell
 # expand any of them would make this gate silently match nothing.
+# test-scope: plugins/code-tidying/skills/*.md plugins/code-tidying/skills/*/scripts/*
 # shellcheck disable=SC2016
 set -uo pipefail
 

plugins/code-tidying/scripts/evals-fixtures.test.sh

@@ -5,6 +5,7 @@
 # When tree-sitter (or its grammar) is absent the self-certify checks skip
 # visibly, matching test_change_shape.py. CI sets
 # CODE_TIDYING_REQUIRE_TREE_SITTER=1 so a missing dependency fails there.
+# test-scope: plugins/code-tidying/evals/*
 set -euo pipefail
 
 here="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"

plugins/context-guard/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "context-guard",
-  "version": "0.10.1",
+  "version": "0.10.2",
   "description": "Per-session context-window observability. A statusline wrapper writes each session's context_window fields to a snapshot file; a resolver classifies usage into smart, acceptable, and dumb zones from zones.json. Hooks report each move into a worse zone once: the continuation menu to the operator, and only the zone to the model, noting a zone is not a decay signal. Optional blocking mode gates new mutating work in the dumb zone, except handoffs. A PostCompact hook leaves a marker.",
   "author": {
     "name": "Melodic Software",

plugins/context-guard/CHANGELOG.md

@@ -5,6 +5,12 @@ All notable changes to the `context-guard` plugin.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project
 adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.10.2] - 2026-10-03
+
+### Changed
+
+- `hooks/zone-crossing-inject.test.sh` declares the files it reads without naming them in a `# test-scope:` header, so CI's test selection runs it when one of them changes. Nothing the plugin runs changed.
+
 ## [0.10.1] - 2026-10-03
 
 ### Changed

plugins/context-guard/hooks/zone-crossing-inject.test.sh

@@ -9,6 +9,7 @@
 #
 # Self-contained: defines its own assertion helpers — installed plugins are
 # cache-isolated with no shared test lib.
+# test-scope: plugins/context-guard/hooks/*
 
 set -uo pipefail
 

plugins/discovery/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "discovery",
-  "version": "0.28.1",
+  "version": "0.28.2",
   "description": "Discovery before changes: explore the local codebase, run multi-source external research, and reconstruct why a past decision was made from evidence outside the code. Each dispatches a subagent by default so the reading stays out of the main thread, with source tiers, falsification, recency gates and a coverage ledger, and persists EXPLORE.md / RESEARCH.md / INTENT.md handoff artifacts. A research sweep workflow (/discovery:research-sweep) backs deep research with adversarial claim verification.",
   "author": {
     "name": "Melodic Software",

plugins/discovery/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog: discovery plugin
 
+## [0.28.2] - 2026-10-03
+
+### Changed
+
+- `agents/tool-honesty.test.sh` and `scripts/contract.test.sh` declare the files they read without naming them in `# test-scope:` headers, so CI's test selection runs them when one of those files changes. Nothing the plugin runs changed.
+
 ## [0.28.1] - 2026-10-03
 
 ### Fixed

plugins/discovery/agents/tool-honesty.test.sh

@@ -16,6 +16,7 @@
 # Scoped to plugins/discovery/agents/*.md on purpose. A sweep over every
 # plugin's agents would fail this plugin's test on another plugin's drift, which
 # reports the defect in the wrong place and blocks the wrong change.
+# test-scope: plugins/discovery/agents/*.md
 set -uo pipefail
 
 cd "$(dirname "${BASH_SOURCE[0]}")" || exit 1

plugins/discovery/scripts/contract.test.sh

@@ -19,6 +19,7 @@
 #
 # SC2016 is disabled file-wide on purpose. Single-quoted `$ARGUMENTS` strings in
 # assertion labels and grep patterns are literal prose/regex under test.
+# test-scope: plugins/discovery/*.md plugins/discovery/*.json
 # shellcheck disable=SC2016
 set -uo pipefail
 

plugins/disk-hygiene/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "disk-hygiene",
-  "version": "0.43.0",
+  "version": "0.43.1",
   "description": "Context-aware disk hygiene for arbitrary directory trees: inventories orphaned and temporary artifacts, classifies evidence into review tiers, and offers exact-path cleanup only after a fresh safety preview and explicit per-tier approval. The target is read-only by default; OS-managed paths, links and mount points, VCS-tracked content without the complete checkout evidence bundle, changed entries, and live-handle uncertainty fail closed.",
   "author": {
     "name": "Melodic Software",

plugins/disk-hygiene/CHANGELOG.md

@@ -3,6 +3,12 @@
 All notable changes to the `disk-hygiene` plugin are documented here. Format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this plugin uses semantic versioning.
 
+## [0.43.1] - 2026-10-03
+
+### Changed
+
+- `skills/clean/scripts/hygiene.test.sh`, `skills/clean/scripts/owner_registry.test.sh`, `skills/clean/scripts/test_hygiene.py`, and `skills/setup/scripts/kill_switch_probe.test.sh` declare the files they read without naming them in `# test-scope:` headers, so CI's test selection runs them when one of those files changes. Nothing the plugin runs changed.
+
 ## [0.43.0] - 2026-10-03
 
 ### Added

plugins/disk-hygiene/skills/clean/scripts/hygiene.test.sh

@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
 # Cross-platform contract wrapper for the stdlib Python test suite.
+# test-scope: plugins/disk-hygiene/skills/clean/SKILL.md plugins/disk-hygiene/skills/clean/reference/*.json plugins/disk-hygiene/hooks/*
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"

plugins/disk-hygiene/skills/clean/scripts/owner_registry.test.sh

@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
 # Cross-platform contract wrapper for the owner-registry test suite.
+# test-scope: plugins/disk-hygiene/*.py plugins/disk-hygiene/*.sh plugins/disk-hygiene/*.mjs plugins/disk-hygiene/*.json
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"

plugins/disk-hygiene/skills/clean/scripts/test_hygiene.py

@@ -1,4 +1,5 @@
 #!/usr/bin/env python3
+# test-scope: plugins/disk-hygiene/skills/clean/SKILL.md
 """Behavioral tests for the disk-hygiene safety engine and scoped guard."""
 
 from __future__ import annotations

plugins/disk-hygiene/skills/setup/scripts/kill_switch_probe.test.sh

@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
 # Cross-platform contract wrapper for the kill-switch probe test suite.
+# test-scope: plugins/disk-hygiene/*.py plugins/disk-hygiene/*.sh plugins/disk-hygiene/*.mjs plugins/disk-hygiene/*.json
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"

plugins/docs-hygiene/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "docs-hygiene",
-  "version": "0.26.2",
+  "version": "0.26.3",
   "description": "Documentation-hygiene toolkit: compress (trim markdown with a semantic-diff check), audit-noise (classify markdown noise), extract-ssot (deduplicate into a single source of truth), audit-encapsulation (citations into skill-private files), rename-references (stale references after renames), audit-derivability (does a doc earn its existence), audit-progressive-disclosure (load tiers), write-for-agents and write-for-humans (authoring). Setup checks markdownlint-cli2.",
   "author": {
     "name": "Melodic Software",

plugins/docs-hygiene/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog: docs-hygiene plugin
 
+## [0.26.3] - 2026-10-03
+
+### Changed
+
+- `scripts/allowed-tools-pairing.test.sh` and `skills/compress/scripts/detect-caveman.test.sh` declare the files they read without naming them in `# test-scope:` headers, so CI's test selection runs them when one of those files changes. Nothing the plugin runs changed.
+
 ## [0.26.2] - 2026-10-03
 
 ### Changed

plugins/docs-hygiene/scripts/allowed-tools-pairing.test.sh

@@ -27,6 +27,7 @@
 # fixed string searched for VERBATIM in markdown and frontmatter, where those
 # placeholders are substituted by Claude Code at load time. Letting the shell
 # expand any of them would make this gate silently match nothing.
+# test-scope: plugins/docs-hygiene/skills/*.md plugins/docs-hygiene/skills/*/scripts/*
 # shellcheck disable=SC2016
 set -uo pipefail
 

plugins/docs-hygiene/skills/compress/scripts/detect-caveman.test.sh

@@ -4,6 +4,7 @@
 # Self-contained: no shared assertion lib; resolves the script under test
 # relative to this file. Asserts the always-exit-0 contract, both output
 # labels, and graceful degradation to "unknown" when claude/jq are absent.
+# test-scope: .claude/settings.json
 set -uo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"