fix(ci): unblock TypeScript E2E fan-out

[UnArbosFive]

Summary

PR #3035 exposed two serial barriers in TypeScript E2E CI:

• The shared-artifact selector stopped after 360 seconds, 21 seconds before Runtime Checks published the exact release artifact. TypeScript E2E then spent another 6m42s compiling the same Rust release binary locally.
• Fast-runtime E2E jobs depended on a combined build matrix, so they waited for the unrelated release build before fanning out.

This change:

• Tracks the exact build release node job from the matching Runtime Checks run, including transient API failures and replacement runs. It allows a bounded 60-second producer grace beyond the old cutoff, then falls back locally.
• Moves artifact polling to an ubuntu-latest coordinator so the wait does not reserve a self-hosted Rust runner.
• Splits fast and release build, state-test, and canonical-audit dependency lanes while preserving the existing required E2E check names.
• Adds behavioral tests for artifact provenance, delayed publication, terminal and nonterminal producer states, transient API failures, replacement runs, fallback ceilings, and matrix lane splitting.

Test Coverage

All new selector and lane-splitting paths have targeted behavioral coverage. This PR's own workflow run provides the integration check for the new Actions dependency graph and fan-out timing.

Pre-Landing Review

No issues found after testing, maintainability, security, performance, and adversarial review passes.

Plan Completion

No plan file detected.

Test plan

• Shared release artifact selector tests
• TypeScript E2E lane split tests
• TypeScript E2E classifier and workflow contract tests
• TypeScript E2E shard planner and configuration validation
• Rust CI path, artifact boundary, sccache configuration, and prewarm tests
• Workflow YAML parsing and whitespace validation

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
subtensor	Ready	Preview	Aug 4, 2026 12:05pm

[github-actions]

AI review — see the sticky summary comment for the verdict and the inline comments below for specific findings.

[github-actions]

[HIGH] [BOOTSTRAP] PR-controlled splitter executes in the trusted routing job

The base SHA does not contain this helper, so this PR necessarily takes the fallback and executes the head-controlled script inside changes, where the job has read access to repository contents and pull-request metadata. The script can also forge routing outputs consumed by later self-hosted jobs.

The workflow definition and intended helper should come from the trusted base; the PR-controlled inputs should be limited to the shard manifest and matrices. After this lands, the fallback becomes unreachable because the base checkout contains the helper, and any later reappearance would require its suspicious deletion or loss of executability. For this bootstrap run, fail closed instead of executing the proposed helper.

Suggested change

	if [[ ! -x "$splitter" ]]; then
	# One-time bootstrap. Future PRs execute the trusted base helper.
	splitter=.proposed-e2e-plan/.github/scripts/split-typescript-e2e-plan.sh
	if [[ ! -x "$splitter" ]]; then
	echo "trusted E2E lane splitter unavailable" >&2
	exit 1

[github-actions]

🛡️ AI Review — Skeptic (security review)

VERDICT: VULNERABLE

VERY HIGH account-age/public-repo tier, tempered by repository admin status; no Gittensor association found; branch fix/e2e-artifact-fanout -> main.

Findings

Sev	File	Finding
HIGH	.github/workflows/typescript-e2e.yml:189	[BOOTSTRAP] PR-controlled splitter executes in the trusted routing job	inline

Conclusion

The change appears legitimate, but its bootstrap path executes PR-controlled code in a privileged routing job. Remove that fallback and fail closed until the helper exists on the trusted base.

---

# 🔍 AI Review — Auditor (domain review) has not yet run on this PR.

[github-actions]

🔄 AI review updated — Skeptic: VULNERABLE