[UncertaintyDeterminesYou4ndMe]

Run CI on pull requests and pushes to rust-preview, keep its compiled Rust cache warm for subsequent PRs, and include the actual workbench UI sources in just typecheck using fresh NSH and Host declarations.

• Both long-lived branches export/save compiled caches on pushes; PRs only restore them.
• Computer Use keeps its existing path filter and adds rust-preview PRs.
• The UI check uses the existing ui_types generator and repository TypeScript compiler.
• Refresh the source-bound notices snapshot and use the current nullable UI contracts.

Validation: the full just typecheck chain, notices regression test, workflow YAML/routing and permissions checks, and whitespace checks pass locally. Hosted checks also exercise the new PR triggers.

AI use

• Generative tooling made a substantive contribution

Claude Code authored the original change; OpenAI Codex synchronized it with the current base, removed redundant guards and validated it.

[Astro-Han]

Automated review notice: This comment was posted by an automated review agent. It is not an independent human review and does not replace one.

I reviewed all five changed files at 486711a8fa9309c9c4ec4fd3733235d5c6645ec5, plus the surrounding cache restore/save configuration, the just check dependency chain and the existing ui_types generator.

I found no confirmed P0–P2 in this scope. The CI workflow now selects main and rust-preview pull requests and pushes; Computer Use adds rust-preview pull requests while retaining its path filter. The cache key remains commit-specific with restore prefixes. I parsed both YAML files and evaluated the actual four changed cache/GC expressions across six controlled contexts: main/rust-preview pushes, another-branch push, a pull request, manual dispatch and an existing exact cache hit. Export/save remained limited to the intended pushes and were disabled on a hit; pull requests did not acquire cache-write behavior. Workflow permissions remain contents: read.

The added typecheck line uses a fresh external output directory and runs the current Rust generator before the repository TypeScript compiler, with && preserving failure propagation. Its shell syntax passed. I read the generator's actual App, conversation/composer and other UI entry points and its current NSH/Host declarations; I did not run the generator or TypeScript project locally. The two UI corrections normalize an absent Bot Session to null and avoid calling latestToolActivity with a null Turn. Both changed TSX files passed a syntax-only Biome 2.5.9 parse, which is not a substitute for the new typecheck.

The real merge-tree against rust-preview 2d679ea33f6d34de059625691d437cb1d17569dd and git diff --check passed. This PR has triggered CI run 41086005520 and Computer Use run 41086005838, so the new PR routing is observable; their overall results are not yet complete. That does not establish that the new typecheck or native tests pass.

I did not execute just check, Rust/NSH builds, Actions cache transfer, the full TypeScript check or native UI. The additional full CI run on every rust-preview push is an explicit operational cost of this change. There is no wire-protocol or database migration change.

---

Automated review notice: This comment was posted by an automated review agent operated by Astro-Han. It is not an independent human review and does not replace one.

[Astro-Han]

Automated review notice: This comment was posted by an automated review agent. It is not an independent human review and does not replace one.

CI follow-up for unchanged head 486711a8fa9309c9c4ec4fd3733235d5c6645ec5: CI 41086005520 finished with a failure in scripts/rust/notices.test.mjs:43, where the initial verifyNotices(root) rejects the source-bound notices snapshot. Its JavaScript test step reports 116 passes and 1 failure. The earlier newly added UI declaration generator and TypeScript check completed before that step. Computer Use 41086005838 succeeded on all three platforms. Neither result establishes a complete native test pass; the downstream NSH integration job was skipped.

I checked causality against the actual parent 2d679ea33f6d34de059625691d437cb1d17569dd. None of the five PR changes modifies the 2,771 recorded notices inputs, notices document or verifier. Executing the actual unchanged inputs() / verifyNotices() functions on snapshots reconstructed from each commit rejects both as stale. Both have exactly the same seven recorded hash mismatches: composer-view.ts, configurations.ts, contracts.ts, generated/methods.ts and generated/runtime.ts under packages/plugin-sdk/src, plus plugins/agent/conversations/package.ts and products/maka/bundle/src/installation.ts. This failure is therefore already present in the parent; I am not classifying it as a new defect introduced by this PR. The check remains red and the notices snapshot still needs regeneration and review. I did not regenerate notices, rerun Actions or execute the native suite locally.

---

Automated review notice: This comment was posted by an automated review agent operated by Astro-Han. It is not an independent human review and does not replace one.

[UncertaintyDeterminesYou4ndMe]

The notices failure was stale on rust-preview itself, as the review found. faab12f merges current rust-preview (a578d26) and regenerates products/maka/cli/notices.json. Only the recorded hashes of eight inputs change; no notice text changes. node --test scripts/rust/notices.test.mjs passes locally. Any later rust-preview commit that changes a recorded input without regenerating notices will turn this check red again, which is the point of running it on these PRs.