* feat(ci): toil-reduction sweep — registry determinism + codex auto-refresh + local CI dry-run (soc-k47k, soc-7qq9, soc-ws40)
Three compounding fixes filed during the 2026-05-07 retrospective on
CI/push-gate toil. See `.agents/learnings/2026-05-07-ci-push-gate-toil-pattern.md`
for the data: 9 push iterations across 4 PRs, ~45min wall-clock + thousands
of orchestrator tokens spent diagnosing identical-looking failures with
different root causes.
soc-k47k — registry-check determinism:
- scripts/generate-registry.sh build_knowledge_stores() now walks
`git ls-files .agents/` instead of filesystem `find`. CI's clean
checkout and a session-built local checkout produce identical output
because both consult the git index (deterministic).
- Removed the `[[ -d .agents ]] || return` early-exit so behavior is
uniform regardless of working-tree state.
- Eliminates the dominant single source of failed-push retries this
session (5 iterations across PRs #255 and #260 alone).
soc-7qq9 — PostToolUse codex auto-refresh:
- New hooks/postedit-codex-refresh.sh fires after Edit/Write of any
skills/<name>/SKILL.md, references/, scripts/, or schemas/ file.
Auto-runs `scripts/refresh-codex-artifacts.sh --scope head` so codex
hashes stay current; operator never sees the parity warning.
- Registered in hooks/hooks.json (matchers Edit + Write, 10s timeout).
- Embedded copy synced via `make sync-hooks`.
- Disable via AGENTOPS_HOOKS_DISABLED=1 or
AGENTOPS_CODEX_AUTOREFRESH_DISABLED=1.
- Best-effort: failures log to stderr but always exit 0.
soc-ws40 — local CI-equivalent dry-run:
- New scripts/test-ci-deterministic-gates.sh runs the 4 deterministic
CI gates that have historically surprised PRs at push time: registry-
check, skill-lint, heal-skill --strict, codex artifact metadata.
- Non-fail-fast: reports all failures together so you can fix them in
one diagnostic round instead of N push iterations.
- Currently runs in <30s on a clean tree (vs. ~5min for one CI canary
cycle).
Together these compound: with #1 + #2 + #3 wired, the CI surprises that
drove this session's toil should be catchable locally before push.
go test ./... → 11858 passed in 50 packages.
bash scripts/test-ci-deterministic-gates.sh → 4/4 pass.
* test(hooks): add coverage for postedit-codex-refresh
Required by scripts/check-test-fixture-parity.sh — every hooks/*.sh must
have at least one test reference. 4 smoke tests:
- non-skill path → silent exit 0
- AGENTOPS_HOOKS_DISABLED=1 short-circuits
- AGENTOPS_CODEX_AUTOREFRESH_DISABLED=1 short-circuits
- skill path outside any git repo → no-op
* fix(eval): bump hook-regression-suite Total count 222→226 for postedit-codex-refresh tests
Bo