fix(ci): run the unit tests when agent instruction files change

.github/workflows/ci-tests.yml

@@ -90,11 +90,15 @@ jobs:
         TESTABLE_CHANGES=$(echo "$CHANGED_FILES" | grep '\.py$' | grep -v '^plots/' || true)
 
         # Also run tests when the test configuration, a lock file or pinned runtime, a
-        # workflow or action, or a prompt changes: tests/unit/workflows parses every
-        # workflow YAML, tests/unit/prompts reads the prompt files, and
-        # tests/unit/core/test_version_sources.py checks that every version resolves
-        # from uv.lock, package-lock.json, Manifest.toml and .python-version.
-        CONFIG_CHANGES=$(echo "$CHANGED_FILES" | grep -E '^(pyproject\.toml|pytest\.ini|conftest\.py|uv\.lock|package\.json|package-lock\.json|Project\.toml|Manifest\.toml|\.python-version)$|^(\.github/workflows/|\.github/actions/|prompts/)' || true)
+        # workflow or action, a prompt, or an agent instruction file changes:
+        # tests/unit/workflows parses every workflow YAML, tests/unit/prompts reads the
+        # prompt files, tests/unit/core/test_version_sources.py checks that every version
+        # resolves from uv.lock, package-lock.json, Manifest.toml and .python-version, and
+        # tests/unit/test_agent_instructions.py and tests/unit/skills read CLAUDE.md,
+        # the Copilot instructions, .claude/guardrails.md, agentic/docs/project-guide.md,
+        # the skills and the commands (#12493 changed only those, skipped this job, and
+        # left main red).
+        CONFIG_CHANGES=$(echo "$CHANGED_FILES" | grep -E '^(pyproject\.toml|pytest\.ini|conftest\.py|uv\.lock|package\.json|package-lock\.json|Project\.toml|Manifest\.toml|\.python-version|CLAUDE\.md|AGENTS\.md|\.github/copilot-instructions\.md|\.claude/guardrails\.md|agentic/docs/project-guide\.md)$|^(\.github/workflows/|\.github/actions/|prompts/|\.claude/skills/|agentic/commands/)' || true)
 
         # Force run on workflow_dispatch with force_run=true
         if [[ "${{ github.event_name }}" == "workflow_dispatch" && "${{ inputs.force_run }}" == "true" ]]; then

changelog.d/guardrails-section-registry.md

@@ -0,0 +1,12 @@
+### Fixed
+
+- **The unit tests run when an agent instruction file changes, and main is green
+  again.** #12493 added the section "Long-running work reports progress
+  proactively" to `.claude/guardrails.md` but changed no Python, so "Run Tests"
+  skipped it and `test_every_companion_section_is_registered` failed on main.
+  The section and the classifier-denial rule are now registered with their
+  CLAUDE.md anchors, and `ci-tests.yml` also runs the tests for changes to
+  `CLAUDE.md`, `AGENTS.md`, `.github/copilot-instructions.md`,
+  `.claude/guardrails.md`, `agentic/docs/project-guide.md`, `.claude/skills/`
+  and `agentic/commands/`, which
+  `tests/unit/test_agent_instructions.py` and `tests/unit/skills` read. (#12494)

tests/unit/test_agent_instructions.py

@@ -425,7 +425,15 @@ def test_guardrails_split_stays_subordinate() -> None:
         "gemini pushes only its `gemini/*` branch and opens only draft prs",
         "never extract, copy, or proxy the agy login",
     ],
-    "External-system writes need explicit, named authorization": ["explicit, named authorization"],
+    "External-system writes need explicit, named authorization": [
+        "explicit, named authorization",
+        "permission-classifier denial anywhere in the session",
+    ],
+    "Long-running work reports progress proactively": [
+        "never let the user be the one to ask",
+        "no new commit and no message for about 30 minutes is a suspected stall",
+        "after every context compaction, re-check each delegate's real state",
+    ],
     "After every merge, check that the site renders": [
         "after every merge, check that the site renders",
         "`scripts/site-smoke.mjs`",