E2E on MiniMax: harness, selective workflow and concurrency control

[Trecek]

Summary

Adds the infrastructure for live end-to-end recipe runs on MiniMax and ships only the canary test, as scoped in #5230. Each recipe test is its own follow-up ticket.

• Catalog — scripts/e2e/catalog.json plus a stdlib validator (e2e_catalog.py): name, kind, peak sessions (≤ 8), timeout (job timeout derived, ≤ 360 min), trigger paths, and recipe/ingredients/expected PR state for recipe tests.
• Selector and gate — scripts/e2e/e2e_select.py, run on the runner's system python3:
  • eligible at ≥ 10 changed files or ≥ 300 changed lines, or with the e2e label;
  • sampled at p = 0.5, seeded by "{pr number}:{head sha}"; the label and workflow_dispatch bypass sampling;
  • picks the touched tests (up to 2), otherwise exactly one, ordered by a SHA-256 rank;
  • merge_group never selects, because the PR already decided;
  • gate passes only on the two healthy shapes (selected and passed, or not selected and skipped).
• Harness — scripts/e2e/e2e_harness.py runs inside the user image:
  • writes MiniMax into ~/.claude/settings.json env (mode 0600) and strips every ANTHROPIC_*, CLAUDE_CODE_OAUTH_TOKEN, MINIMAX_API_KEY and E2E_SANDBOX_TOKEN from child processes;
  • installs a user-layer config that disables the quota guard, enables fleet and fleet_headless_run, and routes every default Codex step to claude-code;
  • runs the canary, or gh auth login (token on stdin), clone, and fleet run … --disable-quota-guard --timeout-sec N with structural assertions on the envelope and the sandbox PR, then closes the PRs it opened;
  • gives every subprocess a timeout and always writes result.json.
• Redaction — e2e_harness.py redact, in a second container, copies out/ and the session logs world-readable with both secrets replaced, skips symlinks, and fails if a secret survives. Only that copy is uploaded.
• Workflow — .github/workflows/e2e.yml runs select, then run (one repository-wide queue: max group with max-parallel: 1; builds the user image from the PR's merge commit), then e2e-gate (if: always(), meant to be the only required check).
• Failure issue — CanaryIssueUpdater.append_to_issue plus a post-e2e-failure subcommand and scripts/e2e/post-e2e-failure.sh. One [E2E] <test> failure issue per test, append-only; it rotates to a linked successor before GitHub's 65,536-character body limit. It runs with only the workflow token, which the test container never sees.
• Docs — scripts/e2e/README.md covers maintainer and sandbox setup, the MiniMax route, why autoskillit install is skipped, the selection policy, concurrency, redaction, the catalog schema and local reproduction.

Departure from the issue

The issue asked to run autoskillit install unless it proves unnecessary. It is skipped. fleet run falls back to DirectInstall(plugin_dir=pkg_root()) and publishes the projection on demand. The food-truck installation errors fire only for Codex-style backends, and every step is routed to claude-code. The README records this derivation. The canary does not go through fleet run, so the first recipe test is what will confirm it live.

Verification

• task test-local-gate: 18,284 passed, 207 skipped, 12 xfailed. pre-commit run --all-files is clean, and the complexity ratchet against develop passes.
• New tests: tests/infra/test_e2e_select.py, test_e2e_select_cli.py, test_e2e_harness.py, test_e2e_workflow.py; extended tests/infra/test_probe_scripts.py and tests/execution/backends/test_probe_canary.py.
• Local live canary on the user image with the real MiniMax key:
  • result.json reports passed: true;
  • claude -p replied with the canary token, served by MiniMax-M3[1m];
  • redaction succeeded, and no key bytes were found under out/ or upload/.

Not yet verified: the canary run in GitHub Actions, which needs the e2e label on this PR or sampling to select it.

After merge

• Add e2e-gate to the required status checks of the "Develop change policy" ruleset. Do it only after e2e.yml is on develop, or merge-queue entries would wait for a check that never reports.
• Before the first recipe test: populate TalonT-Org/autoskillit-e2e-sandbox and add the E2E_SANDBOX_TOKEN repository secret (README, "Maintainer setup").

Closes #5230

🤖 Generated with Claude Code