Consolidation integration: CI repairs for gpu-only builds, checksum guard, and dogfood lane

.github/workflows/action-e2e.yml

@@ -46,7 +46,7 @@ jobs:
   action-contract:
     name: Action contract and mirror lock
     runs-on: ubuntu-24.04
-    timeout-minutes: 30
+    timeout-minutes: 75
     permissions:
       contents: read
     steps:

.github/workflows/ci.yml

@@ -313,7 +313,7 @@ jobs:
   integration-cli:
     name: Integration (CLI)
     runs-on: ubuntu-24.04
-    timeout-minutes: 60
+    timeout-minutes: 105
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:

.keyhogignore

@@ -38,6 +38,7 @@ path:docs/assets/keyhog-banner.svg; reason="reviewed docs banner asset; not scan
 
 # --- Documentation that quotes findings --------------------------------------
 path:CHANGELOG.md; reason="release notes quote example credentials verbatim; documentation about findings, not live material"; approved_by="keyhog-maintainers"
+path:docs/src/workflows/github-action.md; reason="the file documents exact Action version pins of this public repository; generic entropy reads a pinned release tag as a credential-shaped token"; approved_by="keyhog-maintainers"
 
 # --- Test, fixture, and demo trees -------------------------------------------
 # These trees carry exact positive and negative credential examples by design.

crates/cli/CHANGELOG.md

@@ -2,6 +2,18 @@
 
 ## 0.5.81 - 2026-08-20
 
+- fix(cli): the guard watcher applies `[scan].exclude` changes when `.keyhog.toml` is modified. The reload branch that re-reads exclusions sat inside a filename check that only admitted `.keyhogignore` and `.gitignore`, so an exclusion edit left the old matcher active until the daemon restarted.
+- fix(cli): guard watching and `keyhog watch` no longer drop events under `.cargo`. The directory skip policy listed it as a watch-only extra while the scanner's default excludes prune no `.cargo` component, so edits to a repository's `credentials.toml` or cargo config never reached the guard even though scans read them.
+- test(cli): the Row 141 watcher suite pins scanner-truth parity for `.cargo/credentials.toml` and default media-extension filtering, the Row 146 feed test pins ignore-on-overflow for stale-policy roots, and the Row 144 missing-pack case asserts fail-closed exit 13 with the unscanned-batch report instead of the retired embedded-detector fallback.
+- test(cli): Rows 144, 145, and 158 calibrate each cloned cache home through the bounded ci-lean autoroute fixture before scanning, because auto-routed scans and hooks fail closed without a persisted backend decision even when execution packs are installed.
+- test(cli): restored regression suites assert the shipped report schema and coverage contract. The config-path baseline pins `evidence_score` (the `confidence` report field was renamed in the evidence-tier change), full-prune exclude globs expect fail-closed exit 13 with `[]` on stdout, the high severity floor test accounts for the non-blocking review-tier entropy fallback, and the staged-renames guard test registers with `--no-hook` because the installed hook requires `keyhog` on PATH.
+- test(cli): the overnight reliability matrix pins the documented exit contract against the current evidence tiers. The exit-contract fixture uses a checksum-confirmed PAT instead of a contextless AWS key that now reports at review tier, the format-determinism comparison normalizes per-scan volatile fields (`scan_id`, wall-clock stamps, `duration_ms`), baseline creation uses the real `--create-baseline` flag, and Merkle index writes enable `--incremental`.
+- test(cli): Row 130 install suites select the bounded autoroute fixture under `ci-lean` and pin the shipped uninstalled-scan fail-closed message (`autoroute calibration required` with the calibrated-install remedy), so the newly wired step neither measures the production ladder four times per run nor asserts retired error wording.
+- fix(cli): `compile-execution-packs` completes on Windows. The staging directory fsync opened the directory in read mode, and `FlushFileBuffers` on a read-mode directory handle fails with "Access is denied" (os error 5).
+- fix(cli): the Excluded coverage-gap reason and summary warning no longer claim `.keyhogignore` removals are never counted. A `--git-staged` scan records staged paths matched by the repository's `.keyhogignore` under that counter, so the text now says so instead of attributing them to the default exclusion policy.
+- test(cli): concurrent daemon telemetry isolation runs at the daemon's guaranteed eight-connection admission floor, so low-core CI runners exercise isolation without turning the contract into an overload-refusal test.
+- test(cli): Row 135 artifact invalidation tests use the authenticated bounded autoroute fixture under `ci-lean`; their staleness and regeneration assertions no longer spend minutes per case measuring the production calibration ladder.
+- test(cli): the empty-directory e2e contract now asserts fail-closed exit 13 instead of the obsolete clean exit, and daemon lifecycle tests serialize real daemon starts with an explicit CPU diagnostic route instead of depending on missing autoroute calibration or competing detector compiles.
 - fix(daemon): the detector rules identity is derived from the rule set, not from the route that loaded it. `detector_rules_digest` is the single owner for the client, the daemon handshake, the staleness check and the scan request, so a warm daemon and the CLI that started it no longer disagree about their own rules and re-route to an in-process scan.
 - fix(cli): an Action receipt certifies a fail-closed scan. `validate_semantics` accepted only `partial` on exit 11 and 13, so a total source failure, which reports `failed`, was rejected as contradictory semantics and the receipt bailed on the scan it exists to record.
 - fix(cli): `--autoroute` calibration state that is missing, stale, invalid, incomplete, or quarantined exits 2 on a normal automatic scan, with `[]` on stdout and the state plus its repair on stderr. `docs/src/reference/exit-codes.md` documents that, and the scan never benchmarks at scan time or substitutes scalar execution.

crates/cli/data/path_skip_dirs.toml

@@ -9,7 +9,7 @@
 # not skip `.git` because it is looking for repository roots.
 
 [skip_dirs]
-base = [".cargo"]
+base = []
 
 watch_extra = [
   ".svn", ".hg", ".turbo",

crates/cli/src/daemon/guard_watcher.rs

@@ -247,14 +247,16 @@ impl WatchedRoot {
         false
     }
 
-    #[allow(dead_code)]
     fn maybe_reload_ignore_matcher(&self, root: &std::path::Path, path: &std::path::Path) {
         if let Some(file_name) = path.file_name().and_then(|n| n.to_str()) {
-            if file_name == ".keyhogignore" || file_name == ".gitignore" {
-                if file_name == ".keyhog.toml" {
-                    let (new_ignore_paths, _) = resolve_root_exclusions(root);
-                    *self.ignore_paths.write() = new_ignore_paths;
-                }
+            if file_name == ".keyhog.toml" {
+                let (new_ignore_paths, _) = resolve_root_exclusions(root);
+                *self.ignore_paths.write() = new_ignore_paths;
+            }
+            if file_name == ".keyhogignore"
+                || file_name == ".gitignore"
+                || file_name == ".keyhog.toml"
+            {
                 let ignore_paths = self.ignore_paths.read();
                 *self.ignore_matcher.write() = build_root_ignore_matcher(root, &ignore_paths);
             }

crates/cli/src/reporting.rs

@@ -999,7 +999,7 @@ impl CoverageGapKind {
             }
             Self::Binary => "binary (extension or content sniff)",
             Self::Excluded => {
-                "default exclusion policy (lock files, minified/bundled assets, vendored and build-output trees). User `.keyhogignore` / --exclude-paths removals are not counted here"
+                "exclusion policy (default excludes such as lock files, minified/bundled assets, vendored and build-output trees; --git-staged also counts repository `.keyhogignore` matches here)"
             }
             Self::NonBinaryUnreadable => "unreadable (permission denied or I/O error)",
             Self::GitObjectUnreadable => {
@@ -1141,12 +1141,12 @@ impl CoverageGapKind {
                  scanned as text."
             ),
             Self::Excluded => format!(
-                "{n} path(s) skipped by the DEFAULT exclusion policy (lock files, \
-                 minified/bundled assets, vendored and build-output trees). \
+                "{n} path(s) skipped by the exclusion policy (default excludes such as lock \
+                 files, minified/bundled assets, vendored and build-output trees). \
                  Default-excluded directories are pruned during discovery and counted \
                  once each; nested files under them are not enumerated. Pass \
-                 `--no-default-excludes` to scan them. Files removed by your own \
-                 `.keyhogignore` or `--exclude-paths` are not counted in this number."
+                 `--no-default-excludes` to scan them. A `--git-staged` scan also counts \
+                 staged paths removed by the repository's `.keyhogignore` here."
             ),
             Self::NonBinaryUnreadable => format!(
                 "{n} file(s) NOT scanned: unreadable (permission denied or I/O error). These \

crates/cli/src/skip_dirs.rs

@@ -110,7 +110,7 @@ impl SkipDirPolicy {
     }
 
     fn from_section(section: SkipDirSection) -> std::result::Result<Self, String> {
-        validate_list("base", &section.base)?;
+        validate_optional_list("base", &section.base)?;
         validate_list("watch_extra", &section.watch_extra)?;
         validate_list("git_discovery_extra", &section.git_discovery_extra)?;
 

crates/cli/src/subcommands/compile_execution_packs.rs

@@ -514,9 +514,23 @@ fn write_sync(path: &Path, bytes: &[u8]) -> Result<()> {
 }
 
 fn sync_directory(path: &Path) -> Result<()> {
-    File::open(path)
-        .with_context(|| format!("opening directory {} for sync", path.display()))?
-        .sync_all()
+    #[cfg(target_os = "windows")]
+    use std::os::windows::fs::OpenOptionsExt;
+    // FlushFileBuffers requires GENERIC_WRITE on the handle, and Windows only
+    // grants a directory handle that access when it is opened with
+    // FILE_FLAG_BACKUP_SEMANTICS. Read mode alone fails sync_all with
+    // "Access is denied" (os error 5).
+    #[cfg(target_os = "windows")]
+    let file = std::fs::OpenOptions::new()
+        .read(true)
+        .write(true)
+        .custom_flags(0x0200_0000)
+        .open(path)
+        .with_context(|| format!("opening directory {} for sync", path.display()))?;
+    #[cfg(not(target_os = "windows"))]
+    let file = File::open(path)
+        .with_context(|| format!("opening directory {} for sync", path.display()))?;
+    file.sync_all()
         .with_context(|| format!("syncing directory {}", path.display()))
 }
 

crates/cli/tests/e2e/mod.rs

@@ -47,6 +47,7 @@ pub mod scan_dogfood_dedupes_example_suppression_events;
 pub mod scan_dogfood_static_recovery_rejections;
 pub mod scan_dogfood_suppressed_example;
 pub mod scan_effective_config;
+pub mod scan_empty_dir_fails_closed;
 pub mod scan_exclude_paths_with_git_staged;
 pub mod scan_fast_flag_git_staged_clean;
 pub mod scan_fast_mode_clean_exit_zero;

crates/cli/tests/e2e/scan_empty_dir_fails_closed.rs

@@ -0,0 +1,24 @@
+//! E2E: an empty directory provides no coverage and fails closed.
+
+use crate::e2e::support::scan_path;
+use keyhog::exit_codes::EXIT_SOURCE_FAILED;
+use tempfile::TempDir;
+
+/// WHY: zero-byte input cannot prove that a target is clean. Empty,
+/// fully-excluded, and wrong-target scans must not report success.
+#[test]
+fn scan_empty_dir_fails_closed() {
+    let dir = TempDir::new().expect("tempdir");
+    let output = scan_path(dir.path(), &[]);
+    assert_eq!(
+        output.status.code(),
+        Some(EXIT_SOURCE_FAILED as i32),
+        "empty dir must fail closed; stderr={}",
+        String::from_utf8_lossy(&output.stderr)
+    );
+    let stderr = String::from_utf8_lossy(&output.stderr);
+    assert!(
+        stderr.contains("ZERO bytes") && stderr.contains("Nothing was examined"),
+        "empty-dir failure must state the missing coverage and corrective context: {stderr}"
+    );
+}

crates/cli/tests/lane10_daemon_e2e_lifecycle.rs

@@ -16,6 +16,7 @@ use std::path::{Path, PathBuf};
 use std::process::{Child, Command};
 use std::time::{Duration, Instant};
 use tempfile::TempDir;
+static DAEMON_TEST_LOCK: std::sync::Mutex<()> = std::sync::Mutex::new(());
 
 fn binary() -> PathBuf {
     PathBuf::from(env!("CARGO_BIN_EXE_keyhog"))
@@ -42,7 +43,7 @@ fn start_daemon(dir: &Path, extra_args: &[&str]) -> (Child, PathBuf) {
         .args(extra_args)
         .stdout(std::process::Stdio::null())
         .stderr(std::process::Stdio::null());
-    let child = cmd.spawn().expect("spawn daemon");
+    let mut child = cmd.spawn().expect("spawn daemon");
     // Wait for a real listener (connect succeeds), not just file existence.
     let deadline = Instant::now() + Duration::from_secs(30);
     while Instant::now() < deadline {
@@ -51,6 +52,8 @@ fn start_daemon(dir: &Path, extra_args: &[&str]) -> (Child, PathBuf) {
         }
         std::thread::sleep(Duration::from_millis(100));
     }
+    let _ = child.kill();
+    let _ = child.wait();
     panic!("daemon did not become ready within 30s");
 }
 
@@ -66,8 +69,9 @@ fn stop_daemon(socket: &Path) -> Option<i32> {
 
 #[test]
 fn daemon_start_status_stop_lifecycle_and_socket_hygiene() {
+    let _daemon_guard = DAEMON_TEST_LOCK.lock().unwrap_or_else(|e| e.into_inner());
     let dir = TempDir::new().unwrap();
-    let (mut child, socket) = start_daemon(dir.path(), &[]);
+    let (mut child, socket) = start_daemon(dir.path(), &["--backend", "cpu"]);
 
     // Socket mode is one defense-in-depth access control. The production
     // status and scan clients exercised below additionally authenticate the
@@ -134,6 +138,7 @@ fn daemon_start_status_stop_lifecycle_and_socket_hygiene() {
 #[cfg(target_os = "linux")]
 #[test]
 fn explicit_host_daemons_do_not_load_gpu_runtime_libraries() {
+    let _daemon_guard = DAEMON_TEST_LOCK.lock().unwrap_or_else(|e| e.into_inner());
     let host_backends: Vec<_> = BACKEND_OVERRIDE_VALUES
         .iter()
         .copied()
@@ -184,10 +189,14 @@ fn host_only_identities_do_not_load_gpu_runtime_libraries() {
 
 #[test]
 fn daemon_reclaims_stuck_half_frame_connection() {
+    let _daemon_guard = DAEMON_TEST_LOCK.lock().unwrap_or_else(|e| e.into_inner());
     let dir = TempDir::new().unwrap();
     // 1-second request timeout so the test is fast. A real client does one
     // round-trip; a connection idle past this is stuck and must be reclaimed.
-    let (mut child, socket) = start_daemon(dir.path(), &["--request-timeout-secs", "1"]);
+    let (mut child, socket) = start_daemon(
+        dir.path(),
+        &["--backend", "cpu", "--request-timeout-secs", "1"],
+    );
 
     // Open a connection, announce a frame length, then send NOTHING, the
     // classic half-frame / slowloris stall that would otherwise hold a
@@ -246,8 +255,9 @@ fn daemon_reclaims_stuck_half_frame_connection() {
 
 #[test]
 fn daemon_rejects_oversized_frame_length_prefix() {
+    let _daemon_guard = DAEMON_TEST_LOCK.lock().unwrap_or_else(|e| e.into_inner());
     let dir = TempDir::new().unwrap();
-    let (mut child, socket) = start_daemon(dir.path(), &[]);
+    let (mut child, socket) = start_daemon(dir.path(), &["--backend", "cpu"]);
 
     // MAX_FRAME_BYTES is 64 MiB; announce one byte more. The server must refuse
     // to allocate the recv buffer (it drops the connection) rather than OOM.
@@ -308,6 +318,7 @@ fn daemon_rejects_oversized_frame_length_prefix() {
 #[cfg(unix)]
 #[test]
 fn daemon_socket_flag_wires_scan_to_a_fixed_location_daemon() {
+    let _daemon_guard = DAEMON_TEST_LOCK.lock().unwrap_or_else(|e| e.into_inner());
     use std::process::Stdio;
 
     let dir = TempDir::new().unwrap();

crates/cli/tests/regression_cli_config_path.rs

@@ -117,8 +117,8 @@ fn explicit_config_min_confidence_suppresses_below_threshold() {
         "baseline stdout must carry the github-classic-pat finding.\n--- stdout ---\n{stdout}"
     );
     assert!(
-        stdout.contains("\"confidence\":0.9"),
-        "baseline finding confidence must be exactly 0.9.\n--- stdout ---\n{stdout}"
+        stdout.contains("\"evidence_score\":0.9"),
+        "baseline finding evidence score must be exactly 0.9.\n--- stdout ---\n{stdout}"
     );
 
     // A `tool.toml` at min_confidence = 0.95 sits ABOVE the 0.9 finding, so the

crates/cli/tests/regression_cli_exclude_glob.rs

@@ -62,6 +62,7 @@ const SEVERITY: &str = "critical";
 const EXIT_SUCCESS: i32 = 0;
 const EXIT_FINDINGS: i32 = 1;
 const EXIT_USER_ERROR: i32 = 2;
+const EXIT_SOURCE_FAILED: i32 = 13;
 
 fn binary() -> PathBuf {
     PathBuf::from(env!("CARGO_BIN_EXE_keyhog"))
@@ -292,15 +293,17 @@ fn exclude_nonmatching_glob_keeps_both() {
 }
 
 /// A slash-less basename glob (`*.env`) matches at ANY depth (gitignore
-/// semantics), so BOTH the root `a.env` and the nested `skip/b.env` are pruned:
-/// an HONEST empty result (exit 0 and the literal `[]` bytes).
+/// semantics), so BOTH the root `a.env` and the nested `skip/b.env` are pruned.
+/// Pruning every candidate leaves ZERO bytes to scan, and the fail-closed
+/// coverage contract refuses an empty report presented as clean: exit
+/// EXIT_SOURCE_FAILED while stdout stays the literal `[]` bytes.
 #[test]
 fn exclude_star_env_matches_any_depth_empties_result() {
     let dir = plant_skip_tree();
     let (code, findings, stdout, stderr) = run_json(dir.path(), &["--exclude-paths", "*.env"]);
     assert_eq!(
-        code, EXIT_SUCCESS,
-        "every .env excluded -> exit 0; stderr:\n{stderr}"
+        code, EXIT_SOURCE_FAILED,
+        "every .env excluded -> zero-byte coverage -> exit 13; stderr:\n{stderr}"
     );
     assert_eq!(findings.len(), 0, "*.env prunes a.env AND skip/b.env");
     assert_eq!(
@@ -309,13 +312,13 @@ fn exclude_star_env_matches_any_depth_empties_result() {
     );
 }
 
-/// The explicit recursive glob `**/*.env` also strips every `.env` at any depth
-/// same empty, exit-0 result as the bare `*.env` form.
+/// The explicit recursive glob `**/*.env` also strips every `.env` at any depth;
+/// like every full-prune it ends at zero scanned bytes -> EXIT_SOURCE_FAILED.
 #[test]
 fn exclude_recursive_env_glob_empties_result() {
     let dir = plant_skip_tree();
     let (code, findings, stdout, _stderr) = run_json(dir.path(), &["--exclude-paths", "**/*.env"]);
-    assert_eq!(code, EXIT_SUCCESS, "no .env survives -> exit 0");
+    assert_eq!(code, EXIT_SOURCE_FAILED, "no .env survives -> exit 13");
     assert_eq!(findings.len(), 0);
     assert_eq!(stdout, b"[]");
 }
@@ -334,15 +337,16 @@ fn exclude_anchored_relative_path_drops_one() {
 }
 
 /// Multiple `--exclude-paths` operands COMPOSE: excluding both the root file and
-/// the whole skip subtree prunes everything -> exit 0 and `[]`.
+/// the whole skip subtree prunes everything -> zero scanned bytes ->
+/// EXIT_SOURCE_FAILED with `[]` on stdout.
 #[test]
 fn multiple_excludes_compose_to_empty() {
     let dir = plant_skip_tree();
     let (code, findings, stdout, stderr) =
         run_json(dir.path(), &["--exclude-paths", "a.env", "**/skip/**"]);
     assert_eq!(
-        code, EXIT_SUCCESS,
-        "both operands prune everything -> exit 0; stderr:\n{stderr}"
+        code, EXIT_SOURCE_FAILED,
+        "both operands prune everything -> zero-byte coverage -> exit 13; stderr:\n{stderr}"
     );
     assert_eq!(findings.len(), 0, "a.env and skip/** both excluded");
     assert_eq!(stdout, b"[]");