ci: mobile light path-filter + backend perf/leak dispatch

[DeliciousBuding]

Summary

Post-residual CI hardening (closes #1341 blind spot + residual T5):

Mobile light (PR path-filtered)

• New changes.mobile paths: app/mobile-rn/**, shared hubClient* / hubEvents*, lockfile, checks.yml
• New job frontend-mobile-light: typecheck + unit tests only (≤15m)
• Full frontend-mobile (Expo export / Playwright / doctor) remains workflow_dispatch-only for cost control

Backend perf/leak (T5)

• New backend-perf-leak-gates job: verify-backend-perf-leak-gates.ps1 -Benchtime 100ms
• workflow_dispatch only — behavior/microbench, not capacity

Policy

• scripts/verify/verify-ci-gates.ps1 asserts both new jobs

Verify

• pwsh ./scripts/verify/verify-ci-gates.ps1 → ok
• pwsh ./scripts/verify/verify-doc-ssot.ps1 → ok

Docs

• MASTER session log + risk assessment T5 Done + roadmap P1 note

Summary by CodeRabbit

• CI Improvements

  • Added lightweight mobile checks for relevant changes, including typechecking and unit tests.
  • Added a manually triggered backend performance and leak verification gate.
  • Improved path-based workflow selection to reduce unnecessary checks.

• Documentation

  • Updated roadmap and progress documentation to reflect the new mobile and backend validation workflows.

• Validation

  • Expanded automated checks to verify mobile and backend workflow requirements and safeguards.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[coderabbitai]

Warning

Review limit reached

@DeliciousBuding, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 39 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 91c86a2b-fdad-4648-bd92-17bf50e2a6d1

📥 Commits

Reviewing files that changed from the base of the PR and between 38ffe0f and b44fab1.

📒 Files selected for processing (3)

• app/mobile-rn/src/theme/tokens.ts
• docs/roadmap.md
• hub-server/internal/middleware/middleware_test.go

📝 Walkthrough

Walkthrough

The workflow adds path-filtered mobile light CI for typechecking and unit tests, introduces a manually triggered backend perf/leak gate, and extends CI policy verification and project documentation for both paths.

Changes

CI gate coverage

Layer / File(s)	Summary
Mobile light CI path .github/workflows/checks.yml, docs/roadmap.md	Mobile-related paths now expose a mobile change output and trigger frontend-mobile-light for mobile typechecking and unit tests.
Backend perf/leak dispatch gate .github/workflows/checks.yml, docs/analysis/..., docs/progress/MASTER.md	A dispatch-only job sets up Go and runs the backend perf/leak verifier with -Benchtime 100ms; related risk and progress records mark the gate complete.
CI policy validation scripts/verify/verify-ci-gates.ps1	Assertions cover mobile filtering, job boundaries, required commands, timeouts, and backend dispatch-only execution.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant GitHubActions
  participant PathsFilter
  participant FrontendMobileLight
  GitHubActions->>PathsFilter: Evaluate mobile path rules
  PathsFilter->>FrontendMobileLight: Set mobile change output
  FrontendMobileLight->>FrontendMobileLight: Run typecheck and unit tests

Loading

sequenceDiagram
  participant GitHubActions
  participant GoSetup
  participant PerfLeakVerifier
  GitHubActions->>GoSetup: Set up Go and cached modules
  GoSetup->>PerfLeakVerifier: Run backend perf/leak verification
  PerfLeakVerifier-->>GitHubActions: Return gate result

Loading

Possibly related PRs

• TokenDanceLab/AgentHub#422: Establishes the dispatch-only policy for the full mobile workflow that this PR preserves and verifies.

Suggested reviewers: copilot

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (2 warnings)

Check name	Status	Explanation	Resolution
Linked Issues check	⚠️ Warning	The PR changes CI workflows and docs, but #1341 requires the mobile hubClient thin-wrapper refactor, boundary docs, and tests.	Implement the shared hubClient thin-wrapper refactor, boundary documentation, and the required typecheck/contract test coverage.
Out of Scope Changes check	⚠️ Warning	Most changes are CI/docs updates for mobile light and perf-leak gating, which are unrelated to the linked hubClient refactor objectives.	Limit the PR to #1341 work or split the CI/docs hardening into a separate change with its own issue.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: CI path-filtering for mobile light checks plus a backend perf/leak dispatch job.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/ci-mobile-light-perf

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

🧹 Nitpick comments (1)

.github/workflows/checks.yml (1)

1-1: 🔒 Security & Privacy | 🔵 Trivial | 💤 Low value

Set persist-credentials: false in checkout steps.

To follow security best practices and prevent potential credential persistence in the local git configuration (which could be exposed if artifacts were ever uploaded), it is recommended to disable credential persistence for the checkout action when not actively pushing to the repository.

• .github/workflows/checks.yml#L460-460: add with: persist-credentials: false to the actions/checkout@v4 step in frontend-mobile-light.
• .github/workflows/checks.yml#L654-654: add with: persist-credentials: false to the actions/checkout@v4 step in backend-perf-leak-gates.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/checks.yml at line 1, Update the actions/checkout@v4 steps
in the frontend-mobile-light and backend-perf-leak-gates jobs to include
with.persist-credentials set to false, preserving their existing checkout
configuration and indentation.

Source: Linters/SAST tools

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In @.github/workflows/checks.yml:
- Line 1: Update the actions/checkout@v4 steps in the frontend-mobile-light and
backend-perf-leak-gates jobs to include with.persist-credentials set to false,
preserving their existing checkout configuration and indentation.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: ec027608-8986-456a-9e12-b473c4d3b568

📥 Commits

Reviewing files that changed from the base of the PR and between 7437ef7 and 38ffe0f.

📒 Files selected for processing (5)

• .github/workflows/checks.yml
• docs/analysis/post-polish-risk-assessment.md
• docs/progress/MASTER.md
• docs/roadmap.md
• scripts/verify/verify-ci-gates.ps1