[masarray]

Problem measured on accepted #650 source SHA

Exact SHA 5a33fb10, CI run 39499030618: 12 concurrent workflows on one PR update, canonical Windows Build ARSAS ~477s and another Smart Discovery Field Capture Windows runner ~491s for a second packaged/smoke proof of the already sealed canonical artifact. Existing per-PR concurrency and exact SHA proof are correct; do not remove them.

Safe optimization (no app/engine changes)

1. Canonical Build ARSAS: add cheap Ubuntu pr-scope using read-only GitHub PR-file API with no checkout. Skip Windows only for positively identified README.md or docs/**/*.md documentation (excluding the physical IEC authority contract). Zero/ambiguous/>=3000 files/API errors/unknown/source/engine/CI/evidence => full Windows CI. Main push and manual dispatch always full. Same Windows job name, test evidence, native proofs and portable outputs when build is required.
2. Smart Discovery Field Capture Build: keep PR workflow/status, but schedule expensive second Windows job only for explicit PR label ci-field-capture, or workflow_dispatch. The label itself triggers a run (pull_request.types: labeled); preserve manual exact-SHA reusable regression, canonical sealed package validation, native CTest, field smoke and artifact workflow. Unlabeled source PRs still execute required canonical Windows Build, not this redundant optional package.
3. Add offline CI P0 fixture assertions and measured risk/savings handoff. No change to branch-checkpoint refs or build scripts, app source, ARIEC61850 engine, GOOSE, command safety or release authority.

Validation gates

• Exact-head Windows full CI green on this workflow-edit PR, CI P0 workflow integrity and budget green; confirm Field Capture job skipped when label absent but check has non-failing conclusion.
• Simulated and/or follow-on PR docs-only must show pr-scope emits false and skips Windows; code/CI changes must show true and run Windows. API fail/mixed changes must run full.
• Label ci-field-capture / manual dispatch path remains available for real specialist/release work.
• Required branch-protection check metadata unavailable to connector (403); no job identifiers removed or renamed. Verify settings before merge. This PR remains draft until proven; not public release.

Acceptance checkpoint: #651, SHA 5a33fb101026707caf6410ff097a569cfabf3939. See docs/audits/CI_P4_EFFICIENT_FAILCLOSED_PR_GATES_2026-10-21.md.

[masarray]

CI-P4 acceptance evidence without rerunning any source changes:

• Docs-only contract tested live: temporary PR #654 exact SHA 35032e867a5a22bfa54cf2fad364b151dbe87b38, Build ARSAS run #39505565357 completed success in about 8 seconds. pr-scope success, build-windows skipped. Temporary PR closed unmerged. No docs-only Windows artifact falsely claimed.
• Source/CI changes retain full gate: this PR CI P4: fail-closed docs-only fast gate and opt-in Field Capture Windows packaging #653 at SHA 779bbdef9865004317e8fcf1de282bc0aacdd23f has pr-scope=success followed by actual build-windows=in_progress (full WPF/ARSAS/engine/native/package path), as required.
• Redundant specialty work not queued: on CI P4: fail-closed docs-only fast gate and opt-in Field Capture Windows packaging #653, unlabelled Smart Discovery Field Capture Build workflow is skipped (both expensive & manual jobs skipped), while canonical Windows and other physical-authority checks continue. For future specialist field capture use PR label ci-field-capture or workflow_dispatch.
• CI-P0 guard success, all integrity regression fixtures/budget green.

Do not merge before the canonical full Windows proof and remaining physical/release-guard check runs complete; browser branch protection read is 403, so admin should also review required-check settings. This work does not modify accepted app baseline #651.

[masarray]

CI P4 exact-head gates — GREEN

Candidate source 779bbdef9865004317e8fcf1de282bc0aacdd23f, based on accepted app checkpoint 5a33fb10. 12 workflow conclusions: 11 success, 1 intentional skip, 0 failures, 0 pending.

• Canonical Build ARSAS run #39505356408 completed success, exact merged source Windows compilation, ARSAS/engine/native regression, sealed package and portable single EXE smoke. Source-changing workflow PR correctly ran full build (~469s).
• CI P0 Workflow Integrity run #39505356649 success, including new P4 fail-closed/opt-in regression fixtures and cost/topology budget.
• Field Capture run #39505356724 skipped by design because no ci-field-capture label: zero redundant specialist Windows job. The opt-in manual/label routes are intact but were not separately executed.
• Real docs-only classification tested with temporary PR #654 / run #39505565357: preflight success, Windows job skipped, whole workflow success in ~8s. Test PR closed unmerged.
• All remaining R10/IEC guards, installer, COMTRADE/native comparison and historical source-check workflows succeeded.

Scope: only .github/workflows/build.yml, .github/workflows/smart-discovery-capture-build.yml, scripts/test-ci-workflows.py, new CI audit doc. No app/engine/SCL/leaf code changed; #651 checkpoint SHA is unchanged. The unknown branch-protection settings (API 403) still need repository admin review before merging stacked PR #653. No physical/release acceptance implied by docs-only skip.

[masarray]

D19 implementation candidate completed on isolated RC-based branch, not cherry-picking or merging this old PR head.

• Candidate: ci/p4-failclosed-optimized-gates-d19-20261027 at exact 6065c6e8e36d67d1f5488153aa99a01183c3cf0d, parent protected RC P0: reconcile v1.6.42 shipped source + stable docs to main (physical R7/R10 gates pending) #729/817c3910e8223fa2ac531a4426ada5d2d4bbbe50. Four changed files only: .github/workflows/build.yml, .github/workflows/smart-discovery-capture-build.yml, scripts/test-ci-workflows.py, and D19 implementation audit doc.
• Fixed a fail-open weakness in historical CI P4: fail-closed docs-only fast gate and opt-in Field Capture Windows packaging #653: its former conditional needs.pr-scope.outputs.needs_windows == 'true' could skip Windows if the preflight job itself failed before producing an output. D19 uses needs.pr-scope.result != 'success' || needs.pr-scope.outputs.needs_windows != 'false' plus always(), so missing/failed classifier, push/manual and all non-doc PRs still run canonical Windows.
• API file-list validation rejects empty/3000-cap, deleted or renamed docs (including source->docs), protected SCL contract docs, mixed source, missing/error API. Narrow read-only Ubuntu preflight has no checkout and leaves exact source+engine SHA build, sealed Windows package and direct EXE upload untouched.
• Smart Discovery Field Capture secondary Windows build is opt-in only after ci-field-capture label on nondraft relevant PR, while manual dispatch still requires exact-SHA manual-regression. Existing trigger path filters and job names preserved.
• Two offline Python policy regression methods authored in existing scripts/test-ci-workflows.py (not runner-executed); 24 offline Node JS decision scenarios passed: classifier, error/failover, event and opt-in semantics. No Actions runs triggered or CI billed for this implementation branch; no PR opened. The GitHub App returned 403 reading main branch protection. Required check status verification and real GH-event CI must precede promotion.

Keep #653 OPEN pending scenario CI and explicit owner approval. Its historical branch diverges from RC, so do not naively merge or call this qualified for main. Detailed D19 notes.

[masarray]

D20 engineering checkpoint: one scoped draft qualification PR now opened, #757, base protected integrated RC release/arsas-integrated-rc0-20261024, HEAD e0c9724b203ac38f2a947d71795ac1173ca5ed5b; not main or stable and not merged. It implements safer CI-P4 on top of original #653, now with a new executable regression test that extracts actual GitHub-script JS and Windows/Field Capture conditions from checked-out workflow files and checks 26 fail-closed test cases using Node VM. It runs within the existing read-only CI P0 Workflow Integrity suite, no new workflow/runner introduced.

Actual GitHub run evidence for exact candidate: CI P0 Workflow Integrity #40407726690 is SUCCESS, with existing workflow test suite Ran 12 tests ... OK; Build ARSAS #40407726657 classifier job SUCCESS and real run log says Changed paths=4, Windows required=true. The canonical Windows job started (not yet certified). Smart Discovery Field Capture #40407726714 skipped both manual-regression and extra Windows build for a draft/unlabeled PR, as intended. CI P1 #40407726721 SUCCESS. Other source-impacting parallel workflows can still run on this PR and remain separate cost topics.

Scope and safety: Previous design would fail open on failed classifier; current build-windows uses always(), classifier result and only explicit needs_windows=false to skip. No WPF/C# runtime, engine lock, safety, Write/SG7/UI, stable or RC changes. Do not merge #757 until remaining CI is checked, required branch-protection checks manually confirmed (GitHub App read gives HTTP 403), docs-only and label/manual event proof independently evaluated, and measured billed Windows savings. Do not rerun passed CI or push no-op changes to trigger more runs. Legacy #653 remains OPEN as historical reference, not automatically merged or closed.

[masarray]

D21 qualification — real GitHub Actions evidence, exact SHAs; no reruns or source changes

Parent CI P4 draft #757 remains OPEN DRAFT, exact HEAD e0c9724b203ac38f2a947d71795ac1173ca5ed5b, base protected RC 817c3910e8223fa2ac531a4426ada5d2d4bbbe50, NOT main.

Source-impacting real PR wave (one attempt, 8 workflows, all finished):

• Build ARSAS #40407726657 SUCCESS; classifier log Changed paths=4, Windows required=true; canonical Windows job successful. Exact SHA produced ARSAS-test-evidence, ARSAS-windows-package-input (sealed) and direct ARSAS-1.6.42-win-x64-portable.exe Actions artifacts, plus source/native evidence. These are candidate CI artifacts, not stable release/physical acceptance.
• CI P0 Workflow Integrity #40407726690 SUCCESS, including the 26-case extracted workflow-expression regression inside the Python P0 suite and topology/budget checks.
• CI P1 Advisory #40407726721, COMTRADE #40407726689, IO #40407726707, SV #40407726693 each SUCCESS at exactly the same SHA.
• Smart Discovery Field Capture #40407726714 SKIPPED for draft/unlabeled PR, including its extra Windows job, as opt-in policy intends. Installer workflow #40407726656 also SKIPPED. No failure and no extra reruns.

Genuine documentation-only canary #758 was created from the candidate HEAD on a separate one-Markdown-file branch, targeted back to that candidate feature branch. Real Build ARSAS #40410571266 SUCCESS, pr-scope job SUCCESS (log Changed paths=1, Windows required=false), canonical Windows job SKIPPED, zero artifacts on canary SHA 00b0c519107e3d3cd7560428379a22500bb78b9a. Only one workflow triggered, demonstrating real docs-only CI saving without false package proof. Canary CLOSED UNMERGED after writing exact evidence. No commit added to #757 or the protected RC.

Qualification now supported: actual source PR Windows admission/build; actual docs-only Windows skip/no sealed artifact; actual Field Capture draft/unlabeled opt-out; P0 26-case policy regression. Still NOT supported: main branch-protection required-check topology (GitHub App GET 403), live nondraft labeled and manual Field Capture dispatch paths, real physical IEC 61850 FAT, or a robust measured cross-PR billable-minute savings baseline.

Disposition: retain #757 as DRAFT and #542 as OPEN, refrain from relabeling it ci-field-capture (would spend Windows runners) or pushing no-op changes. No release/engine pin/main/safety/Write/SG7/GUI modification.