Automatic canonical hybrid first attempts count every selected hosted row in preflight. HYBRID_HOSTED_BASE_ROW_LIMIT = 40 admits at most five optional rows within HYBRID_HOSTED_ROW_LIMIT = 45: security, three Control UI unit rows, and only browser-extension E2E. Above 40 base rows, retain their Blacksmith routes; an eligible base above 45 warns with counts and retains the complete base manifest. The budget limits optional admission, not coverage. Record base/total rows and compare the actual workflow expansion in guards. This never expands test coverage or workers; Control UI E2E shards, QA, real-Gateway, Android, and compiler-heavy jobs retain their existing routes. Frozen/manual targets, retries, untrusted authors and fully hosted fallback manifests remain outside this first-attempt limit, including existing >45-row fallbacks. Do not change the backend variable or existing caps to enable it.

Current fast plugin/channel contract families each share one checkout/setup. Their two weighted process envelopes run sequentially with unchanged include lists and package commands; channel invocations retain four project slots and one worker per project. Any nonzero exit stops admission of the next envelope. Frozen targets retain their original separate rows.

CI matrix caps: fast/check lanes at 12, Node test shards at 96, Windows at 5, and Android at 2. Every compact profile has an enforced 90-row budget, plugin fallback has a 50-row budget, and the final Node matrix enforces 70 push or 130 PR rows, including precise plans. Preflight reserves actual appended plugin Node rows in compact admission so existing hosted tooling compaction can meet that tighter budget; dist rows remain outside the Node budget and inside the compact cap. Excess inventory fails preflight.

Windows consumes the complete two package-script inventories and balances whole files into up to five rows. Current measured inputs need five to keep the longest prediction below 420 seconds (four predict 489, five predict 412). Each row retains serial projects and shared file fixtures. Self-hosted Windows uses four Vitest workers; hosted fallback uses one. Selected files enable file parallelism while single-file project budgets remain unchanged. Group by canonical project metadata; keep runtime consumers in one preparation row. Elapsed file costs include imports/hooks instead of concurrent case sums. Frozen targets without the planner retain their original two rows. Native runner capacity must be measured; a max-parallel setting is not capacity proof. Budget three additional non-Node registrations: the conservative full-tier envelope becomes 4 × 153 + 21 × 213 = 5,085, with 915 below the historical 6,000 target. Earlier 5,010 calculations below describe the two-row inventory; do not spend PR proof savings or raise the 90/70/130 Node caps.

PRs and exact-head PR fallback dispatches omit Docker seed, QA smoke, real-Gateway UI, named built-process verifiers, and the explicit complete-file process-proof inventory. Main/ordinary manual CI retains that proof, including Full Release Validation's exact-target normal_ci child. PR unit/boundary and mocked-Gateway owners stay selected; no blanket E2E suffix filter is permitted.

macOS Swift regular PR/main and PR release_gate CI runs complete app tests plus lint/schema guards in tests, alongside independent OpenClawKit trait, OpenClawKit test, and Swabble test graphs in packages. Ordinary full-scope manual validation adds independent release compilation, moves the guards to release, and retains health renders in tests. All phases use Xcode 27 on GitHub-hosted xcode-27 (preview macOS 27), max-parallel: 2, and the existing 30-minute budget. The toolchain rollout changes no hosted/Blacksmith placement, job counts, coverage, or Swift 6.3 source-language minimum. Require complete native proof and old/new job timings. The existing package split adds one hosted job and no Blacksmith registrations; measure complete hosted timing including duplicated setup. Packages do not restore or save app build products. Build caches stay phase-owned; the sole eligible shared SwiftPM cache writer is regular tests or full-validation release. Debug test/package builds disable indexing and use Swift line-table debug information, retaining coverage and source-line backtraces. Test build caches use the v7 profile; Release flags and v6 caches remain unchanged. Local debug builds retain full debugger metadata.

Android regular CI uses four test/lint rows, including benchmark compilation in the Kotlin-lint row when benchmark/build/dependency inputs change or the changed-path manifest is unusable. Full manual validation retains all six rows and memory-bounded phone/Wear/benchmark builds without duplicate lint. The cap stays at two; frozen task contracts and npm native deferral are unchanged.

iOS regular PR/main and PR release_gate CI runs one required Debug build and Swift lint smoke. Ordinary full-scope manual validation retains Release and Debug/native-test phases, both screenshot shards, and the evidence reducer. Frozen full-manual targets keep their Debug-only contract without screenshots; npm qualification still defers native jobs. All iOS build phases and screenshot shards use Xcode 27 on GitHub-hosted xcode-27 from the first attempt. All four Periphery scans use the same toolchain and retain the checksum-pinned 3.8.0 release pending native compatibility proof for both app scans and both shared consumers. Preserve zero findings and exact-USR intersection; selecting the new runner is not compatibility proof. The conservative full-tier non-Node inventory, including Control UI performance, is 87 rows, or 88 for historical UI targets. Excluding those four hosted rows plus all three macOS Swift phases and the always-hosted aggregate gate leaves at most 80 potentially eligible jobs. The enforced Node caps therefore give 150 registrations per main run and 210 per PR: 4 × 150 + 21 × 210 = 5,010 in the retained peak arrival envelope. The old 19-arrival estimate is obsolete. The remaining 990 below the 6,000 reference target must cover adjacent repositories, releases and carryover; the bounded 2026-09-02 census did not prove that upper bound. Treat a single PR concurrency trial separately from a global rollout. A shared-token quota response does not establish organization-wide usage. Budget all six npm qualification jobs and the actual full-release children; ordinary manual check rows can still use Blacksmith outside hybrid mode.

Canonical PR Node tests use one precise changed-target job when possible; broad, deleted or unknown changes fall back to the compact full-suite plan plus affected plugin coverage. Current PR planner errors fail preflight. Targeted plans retain the full built-artifact boundary gate. main uses compact integration; manual and release runs use full named shards.

RELEASE_ONLY_TOOLING_SHARDS in the Node planner owns the complete core-tooling family: ordinary tooling stripes plus the isolated/Docker catalogs. Matching non-E2E/non-live maintainer leaves in mixed fast configs join the same tier. Preserve their ordinary, isolated or fake-timer config, process pins and product neighbors; reduced groups need subset timing identities. The five test/scripts/*.e2e.test.ts product integration gates stay outside this tier. Product-only canonical PRs omit the family in precise and compact fallback plans. Tooling tests or owners select the full family: scripts/**, src/scripts/**, test/**, .github/**, config/**, root package/pnpm inputs, tooling configs, and other tooling facts owned by scripts/test-projects.test-support.mts, including Docker, agent/Crabbox, app script/Fastlane and extension script/package inputs. Directly changed tooling tests therefore retain PR coverage. Keep each config's complete inventory, exclusions, process metadata, timing floors and runner policy. Every CI manual dispatch includes the family; Full Release Validation's frozen-candidate normal_ci child executes it before regular publication admission. An independent duplicate release test is not required: these same tests supply that proof. Fork repositories retain full tooling because they do not use canonical targeting. Main already omitted named tooling shards; it now also omits maintainer leaves formerly retained by fast configs, including on tooling-owner changes. A regression introduced by a later main merge is invisible to main CI until an affected PR or full validation runs it. Existing ci-gate aggregates selected jobs, without requiring tooling proof against a later main revision. Report historical file-seconds, emitted rows, runner-class counts and predicted longest jobs separately; fewer test-seconds do not prove a workflow wall-time saving. CI's plugin flag stays false even on dispatch because Plugin Prerelease owns that separate sweep. Plugin-sensitive PR changes override that exclusion in both precise and fallback plans, including bundled metadata coverage. Do not infer release inclusion from a shard name or conflate regular full-campaign publication with approved preflight-only beta exceptions. Product security, migration, storage, protocol, SDK and update-correctness tests are outside this move.

The combined Node matrix admits compact and plugin descriptors by estimated duration within the same cap. Catch-all, QA and provider configs use the existing 90-file envelope budget with native Vitest sharding; retain complete config discovery, exclusions and process isolation. Count every appended plugin row, including the five added QA/provider rows, in the burst envelope.

Precise and fallback plugin groups retain separate child processes, including process-bounded configs. Compatible envelopes, including repeated configs, run one at a time within 300 predicted seconds without a pair-count limit; expanded serial compact jobs use 210. The rebased 124-envelope inventory emits 50 extension rows and 125/119/130 PR Node rows on Blacksmith/hybrid/GitHub; push Node rows are 57/46/55 and compact PR rows are 77/71/82. These fit the landed 130/70/90 PR/push/compact caps without another increase. Runtime preparation stays separate. Each original envelope retains its file/process bounds, native shard arguments and worker limits. The complete supplemental boundary list runs in one job with four concurrent checks and one full-root focused-rule scan.

Measured Blacksmith chat/session, Gateway core-3 and infrastructure storage/state outliers reuse the existing file splitter. Preserve serial execution, worker pins and complete timing-history floors; no blanket increase in sharding.

Blacksmith and hybrid compact bins with multiple ordinary groups request the existing 32-vCPU class and two child slots with a 360s aggregate budget. Compatible two-slot bins use the time budget without the ten-group cutoff; serial bins retain that cutoff. Blacksmith serial bins retain 200/276s, hybrid serial bins retain 210s, exclusive bins retain 150s by default, and groups above their serial cap stay alone. Complete ordinary hybrid bins containing only non-build CLI groups may use 250s and co-locate split siblings, provided each original child still fits 150s. Keep file splits, workers, process isolation and other profiles unchanged. Initial packing separates runtime consumers from ordinary groups. Complete hybrid main and PR runtime-placement observations apply only after file splitting; precise changed-file templates retain their original capacity and floors. Typed observations preserve configs, environment, complete files and build mode. Prefer an exact measurement; otherwise use the maximum compatible contained workload as an advisory floor, never sum overlaps or treat globs as whole files. Whole pinned runtime groups may move to existing compatible ordinary jobs under a 440s budget including the existing 100s build reserve. Keep runner anchors, test partitions, invocation counts and worker limits. An ordinary recipient becomes serial, explicitly retaining its old parallel groups' two-worker budget while preserving their prepared timing identities and complete parent generations. The CI executor applies the smaller of the supplied job ceiling and group cap. This may add one runtime preparation while reducing requested process slots; measure the tradeoff without adding jobs or registrations. Equal maximum estimates prefer more recipient headroom. Reapply shared family, group-count and budget admission to both replacements; never suppress coverage or count a runtime subset as a complete parent. An unfit optimization retains the runnable plan and its truthful estimate. Compare recipients with the donor job's fixed anchor, not only its group class. Exclusive, private-QA, dist and hosted policies stay unchanged. Affordable generated CLI runtime children may share one preparation in an exclusive serial bin within the same 150s budget; fixed stripe families remain separate. Other hybrid exclusive/dist sharing is unchanged. Complete inventories remain intact. The canonical shard executor admits two CI children only with at least eight available CPUs and 24 GiB actual memory; otherwise it admits one. Inner project parallelism stays one and each overlapping child keeps two Vitest workers. The measured Gateway server-isolated/database-worker family uses at most eight workers only in a serial, non-frozen self-hosted job with at least eight actual CPUs and 28 GiB memory. Its 20.70 GiB observed aggregate RSS leaves the existing 25% reserve at that floor. Preserve its two-worker fallback, other groups' pins, hosted planning, complete inventory, and old timing generations until refit. The primary GitHub profile remains serial at 210s. Failed-job-only hybrid retries retain the original wider matrix on hosted Ubuntu, clamp to one child, and keep two workers per child; they can exceed the eight-minute normal-run objective without changing existing deadlines. Fewer jobs must retain native elapsed-time, actual memory and cleanup proof; requested labels are not capacity.

The whole Blacksmith agent-support group requests blacksmith-32vcpu-ubuntu-2404. Its file inventory and resource-derived worker policy remain unchanged.

Numbered Blacksmith tooling bins request the same 32-vCPU class after packing. Keep their logical classes, names, file inventories, serial project execution and two-worker pins. Tooling files use the shared worker scheduler; price their current file costs by effective workers without dividing the longest file. Docker helper fixtures retain their separate serial config. This does not promote hosted or hybrid tooling; capacity alone is not a measured speedup.

Numbered tooling measurements are collected in toolingFileSeconds ahead of planner activation, which remains blocked on hosted/hybrid row capacity. The daily refit samples the newest five successful PR CI runs because main-push plans omit this family. Those measurements describe the PR merge-ref and update only tooling files; main compact and release sampling retain their existing provenance. Preserve independent-run medians, runner profiles and partial-plan history. An explicit --tooling-run <id> seed records its source and may use one successful run. Verbose-only case sums are conservative packing costs when cases overlap, not measured file walls. Do not discount them to make row caps pass.

The Docker seed job requests blacksmith-16vcpu-ubuntu-2404; its weighted scheduler and serial declaration compiler policy stay unchanged. Canonical main uses resolveChangedDockerSeedLanes owner-path selection; unknown paths retain the published survivor. Canonical manual CI selects survivor when the target declares the Docker seed capability, retaining legacy-operator-state with auto-auth. Full Release Validation reaches this exact proof through normal_ci; expanded Package Acceptance scenarios alone do not replace its restart mode. PRs and exact-head PR fallbacks do not run Docker seed. Main selection uses only the triggering push's diff, without accumulating coalesced/cancelled pushes. A skipped proof waits for a later non-cancelled main run that selects its lane or applicable manual/release validation; the next main run alone does not guarantee coverage. Ordinary manual CI and normal_ci select the published-upgrade survivor independently of changed paths.

run_control_ui_performance selects production UI, plugin browser, workspace package, dependency/build/policy inputs and their relative import graph, including tooling. Workspace package aliases require conservative package ownership. Test-only files and unrelated runtime changes omit this lane; manual runs, unknown paths and older planners retain coverage. Preserve the target's existing performance-script capability checks.

Eligible Control UI E2E rows request the 16-vCPU class with unchanged live backend/event/contributor routing and two/one-worker project limits. Every fresh plan for a target with the named-project contract uses twelve Control UI shards plus one browser-extension row, across backend profiles, attempts and frozen targets. Historical targets without that contract retain four total rows on Blacksmith or fourteen on GitHub/hybrid. Failed-job-only retries retain their previously emitted matrix, including older six-shard Control UI plans; PR and hybrid push retries use hosted Ubuntu. The 25-minute timeout, max-parallel 14 and conservative registration ceiling stay unchanged. The browser-extension row stays on 8 unless the bounded hybrid plan admits it to hosted Ubuntu. The twelve-row 4:38 result in historical run 33695337496 used the 32-class with eight reported CPUs; it does not prove timing on the current 16-class route or refresh stale timing weights.

Eligible real-Gateway jobs request the existing 32-class for the private artifact build's two canonical SDK cache misses. Overlap requires at least two available CPUs and 25.5 GiB of observed remaining memory for unchanged 12-GiB heaps plus 768 MiB native headroom each. Unknown finite-cgroup usage or insufficient capacity keeps compilation serial. Keep browser workers, inventory, build/read ordering, routing, deadlines and all caps unchanged. This adds zero jobs or registrations. Compiler-only AWS evidence does not prove CI timing; validate the complete job through exact-head native CI before claiming an improvement.

Current-target build-artifacts uses the existing 16-class after a complete four-CPU/15.42-GiB compute proof, including the unchanged parallel verifier wave. The SDK memory owner keeps declarations serial when two heaps do not fit. Eligible frozen or unclassified targets also request 16-class; hosted fallbacks, job counts, concurrency and deadlines stay unchanged. Measured compute fit does not prove queue savings; observe the next exact-head CI cycle.

Normal canonical hybrid first attempts use the existing four-part QA smoke plan, removing two repeated checkouts, setups and private runtime builds. Blacksmith profiles retain four parts; GitHub profiles and fresh hybrid retry/manual plans retain six. Failed-job-only retries retain their original matrix. Keep the complete scenario inventory, separate Matrix run, worker limits, stagger, cleanup and deadlines. Measure the four-part jobs natively; summed build intervals are not a wall-time saving estimate. Main selection uses the existing QA/channel/packaging/orchestration owners. Manual and Full Release Validation retain the full profile; unknown paths or older selectors retain supported coverage. Integration detection outside these owners now waits for manual/release validation. The burden analysis projects about 1,526 Blacksmith vCPU-minutes/hour saved across Docker and QA; zero failures in 20 Docker and 80 QA main jobs is limited evidence, not a measured post-change saving. Keep backend settings, caps, budgets and timeouts unchanged, and verify actual emitted rows and timings.

Current GitHub/hybrid test types use five canonical core stripe jobs plus the central extensions/scripts/root tail. Eligible core-change PRs keep the same rows: each validates the complete graph boundary and intersects selected consumers with its original stripe. Empty intersections stay empty; ambiguous selection falls back to every canonical graph across those same stripes. Frozen targets retain two paired rows for stripes 1+2 and 3+4 sequentially, with stripe 5 in the central row. Keep at most two compiler children per stripe and one builder per child. A failing stripe stops its row; other matrix rows keep running. Pure Blacksmith and targets without stripe support retain the central path. Keep row caps and deadlines unchanged; measure actual hosted completion rather than inferring wall-time savings from partitioning.

CPU-heavy test-type, core test-type stripe, and runtime-topology jobs in ci.yml request blacksmith-16vcpu-ubuntu-2404. The separate openclaw-npm-preflight.yml jobs retain blacksmith-32vcpu-ubuntu-2404. The 2026-09-01 x64 probe run 33538827388 measured requested 8/16/32 labels delivering 2/4/8 CPUs respectively. Treat larger requests as a measured capacity workaround, never as worker counts. Keep existing routing, fanout, and resource-based worker limits; reassess sizing after provider allocation changes. See docs/ci.md for the full table.

lower-weight Node/check shards on blacksmith-4vcpu-ubuntu-2404.

heavy retained Linux/Android shards on blacksmith-8vcpu-ubuntu-2404.

CodeQL Critical Quality on ubuntu-24.04 with no blacksmith- labels.

OPENCLAW_CI_RUNNER_BACKEND=github routes every configurable ci.yml job to its existing GitHub-hosted fallback label. Unset or blacksmith preserves the normal Blacksmith-first route.

Vitest transform and Node compile caches are restore-only in CI and use immutable Actions caches; the main-push/daily/dispatch warmer is their sole writer. Build, QA and test orchestration consume its shared Node compile seed. PRs create no runtime-cache archives.