fix(ci): select suites for the files they read (#8410)

[kyle-sexton]

Closes #8410

Summary

The selection audit (run 39240292374, shard 4/7) found six suites reading 28 files whose one-file diff did not select them. Each suite now declares those files in its # test-scope: header, so a change to any of them runs the suite.

Fix

• Each suite reaches these files in a way the selector cannot read from text: test_session.py loads schemas by name through schema.load("event", SCHEMA_DIR) and globs fixtures/*.json; set-dimensions.test.sh runs the GitHub adapter through the tracker seam; the ruff and biome hook suites launch through the exec-bash.mjs command that hooks.json registers; index-check.test.sh reads its plugin's plugin.json, a manifest that a mention does not select. R8 (# test-scope:) is the selector's existing mechanism for this, so the fix adds no new rule.
• test_session.py declares the two planning schema directories and its fixtures as globs, matching how it reads them. The other five suites list exact paths.
• scripts/affected-tests-live.sh gains one live case per (suite, file) pair.
• Bump-none changelog fragments for the six fragment-mode plugins whose suites changed. Nothing a plugin ships changes.

Verification

• scripts/affected-tests-live.sh: before the declarations, PASS=13 FAIL=28 (all 28 new cases failed). After, PASS=41 FAIL=0.
• Selection only widened: for each of the 28 files, the selection at the base commit bfd13a35a is a subset of the new one. Each file adds exactly its declared suite and drops none.
• The six changed suites pass: set-dimensions 17 cases, ruff-format 40, biome-format end-of-turn 9, audit-complexity 27, index-check 22, test_session.py 586 tests. affected-tests.test.sh PASS=132, selection-audit.test.sh PASS=19. shellcheck is clean on the changed shell files. check-changelog-fragments.sh --check and --check-required origin/main pass.
• Left out: no re-run of the shard-4 audit workflow on this branch. It traces against main, so it can run after merge.

Related

• #8409 and #8381 changed the code behind the planning and work-items rows.
• #6457 is the earlier per-suite declaration pass.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-19T11:43:28.072972Z	97a5715	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

claude-security-review reviewed 97a571550eb534df1b2134cb43e5c9245150bff8: 0 finding(s), 0 as inline comments.

No security issues found in PR #8411 at head 97a5715.

I read the full diff. It does four things:

• It adds # test-scope: comment headers to six test suites.
• It adds six .changes fragments with bump: none.
• It adds a loop to scripts/affected-tests-live.sh that checks scripts/affected-tests.sh selects each suite when one of the files that suite reads changes.
• It touches no shipped runtime code, workflow, permission, hook block list or standing instruction.

In the new loop, $pair, $suite and $file come from a hard-coded array and a fixed fixture-name list. They are not user-controlled, and the bash call that runs on them is quoted. No injection, trust-boundary or credential path exists, and no instruction-surface deletion applies.

[github-actions]

claude-review reviewed 97a571550eb534df1b2134cb43e5c9245150bff8: 0 finding(s), 0 as inline comments.

No findings. I read the full diff and the PR context, and read scope_declarations and select_scoped in scripts/affected-tests.sh (lines 587-600 and 1142-1150). I did not run the test suites or affected-tests-live.sh. The pass counts in the PR body are author-claimed and unverified by me.

What I checked

• Header scanning: the selector reads # test-scope: lines only in the leading comment block, up to the first line that is neither a comment nor blank. The new header is the first line of test_session.py, before the docstring. In set-dimensions.test.sh it follows the usage comment and precedes set -uo pipefail. Both fall inside that block. test_session.py matches the selector's suite pattern test_*.py.
• Globs: the selector's * also matches /. fixtures/*.json and schema/*.schema.json therefore cover every file the issue lists. There is no stale-glob risk, because each glob matches existing files.
• Fixture count: the live test lists 12 fixture names while the issue text says 14, but the issue's own arithmetic is inconsistent. The PR's 28 total matches 12 fixtures, and the fixtures/*.json glob covers all of them either way.
• Live test: the helpers it uses (has_line, ok, fail, REPO_ROOT) are all defined in scripts/affected-tests-live.sh.
• Changelog fragments: six bump-none fragments, one per touched plugin.
• Closing issue ci: affected-tests selection misses 28 files read by 6 suites (selection audit shard 4) #8410: it states no explicit acceptance criteria. Its Fix section asks that each suite depend on the files it reads, and the headers plus the 28 live cases do that. Re-running the shard-4 audit is left until after merge, and the PR body says so.
• Rules and standards: no .claude/rules/ glob matches the changed files except .claude/rules/ruff-pin.md, which covers **/*.py and is about invoking ruff, not about this comment-only edit. I did not resolve the standards index for paved paths. No embedded instructions appear in the PR context.