fix(ci): hash the embedded organization views into the app build

The build task excluded all of platform/ on the claim that the main app imports
nothing from it, but app/o bundles platform/embedded and platform/design-system.
An edit to either kept the same Turbo hash, so a cached .next could ship a stale
UI. Exclude only zone-only paths by name, and do the same in ci:shared so a
zone-only edit stops selecting every job.

Author: waleedlatif1

.github/CI.md

@@ -40,6 +40,8 @@ WebKit acceptance on Blacksmith uses the matching, digest-pinned Playwright brow
 
 HTTP and docs browser installation first asks the pinned Playwright driver to simulate its OS dependency installation. When the simulation requires no package changes, the runner avoids an apt update; missing dependencies, proposed upgrades, or an unsuccessful simulation use the normal dependency installer. Browser selection and downloads still use the pinned driver, including full native Chromium for extension acceptance.
 
+`app/o` bundles `platform/embedded` and `platform/design-system`, so both are build and `ci:shared` inputs: an edit to either changes the build hash and selects every boundary. The Platform zone (`platform/{app,lib,fixtures,checks,docs,preview,public}` and its own configs) is a separate Next app that the embedded tree may not import, reached only through the `/org` rewrite, and is excluded by name so that a new `platform/` folder stays an input until it is declared zone-only. A zone-only edit selects `platform-design.yml` and the app's unit tests, and no main-app build or acceptance job.
+
 Every HTTP and browser group consumes the same production build in an isolated job/database. Electron also uses that build and skips its development-route warm-up. Local HTTP and Electron development runs retain their dev-server behavior. Build inputs exclude test-only files so a harness edit can reuse an unchanged production build.
 
 Desktop inbox protocol, assistant actions UI, and organization search UI run as three parallel HTTP jobs with isolated databases, apps, and reports. Each harness owns its acceptance task, so an edit selects its own job. The inbox protocol task depends on server and realtime code; the browser tasks also depend on workspace UI. Desktop inbox needs no browser. The UI jobs and browser extension install Chromium while their app starts, waiting for both before executing assertions; browser-install failures still fail the job and preserve the install log. No acceptance assertions are removed by the split.

apps/sim/turbo.json

@@ -3,8 +3,26 @@
   "tasks": {
     "ci:shared": {
       "dependsOn": ["^ci:runtime"],
+      // The Platform zone is a separate Next app with its own workflow (platform-design.yml), so an
+      // edit that touches only the zone selects no main-app job. `platform/embedded` and
+      // `platform/design-system` ship inside `app/o`, so they stay inputs. Each zone path is named so
+      // that a new `platform/` folder is an input until someone decides otherwise.
       "inputs": [
         "$TURBO_DEFAULT$",
+        "!platform/app/**",
+        "!platform/lib/**",
+        "!platform/fixtures/**",
+        "!platform/checks/**",
+        "!platform/docs/**",
+        "!platform/preview/**",
+        "!platform/public/**",
+        "!platform/next.config.ts",
+        "!platform/proxy.ts",
+        "!platform/postcss.config.mjs",
+        "!platform/package.json",
+        "!platform/tsconfig.json",
+        "!platform/README.md",
+        "!scripts/platform-live-*",
         "!app/workspace/**",
         "!app/(landing)/**",
         "!app/api/**",
@@ -214,13 +232,28 @@
       ]
     },
     "build": {
-      // next.config bakes the Platform rewrite from SIM_PLATFORM_ORIGIN, and the main app imports
-      // nothing from its separate `platform/` zone or the seed of its live checks.
+      // next.config bakes the Platform rewrite from SIM_PLATFORM_ORIGIN. `app/o` bundles
+      // `platform/embedded` and `platform/design-system`, so those are inputs: leaving them out would
+      // restore a stale `.next` and ship an old UI. The zone paths below are its own Next app, reached
+      // only through that rewrite, and the embedded tree imports none of them
+      // (check:platform-design rule `zone-embedded`, check:boundaries).
       "env": ["NEXT_BUILD_SKIP_TYPE_CHECK", "SIM_PLATFORM_ORIGIN"],
       "inputs": [
         "$TURBO_DEFAULT$",
         ".env*",
-        "!platform/**",
+        "!platform/app/**",
+        "!platform/lib/**",
+        "!platform/fixtures/**",
+        "!platform/checks/**",
+        "!platform/docs/**",
+        "!platform/preview/**",
+        "!platform/public/**",
+        "!platform/next.config.ts",
+        "!platform/proxy.ts",
+        "!platform/postcss.config.mjs",
+        "!platform/package.json",
+        "!platform/tsconfig.json",
+        "!platform/README.md",
         "!scripts/platform-live-*",
         "!**/*.test.*",
         "!**/*.spec.*",

scripts/ci-changes.test.ts

@@ -165,6 +165,23 @@ function classifyFiles(files: string[]): Plan {
   git(repo, 'commit', '--quiet', '-m', 'change')
   return classify(repo, base)
 }
+/** The app build's real Turbo task hash, the key Docker and CI restore `.next` by. */
+function buildHash(repo: string) {
+  const result = spawnSync('turbo', ['run', 'build', '--filter=@sim/app', '--dry=json'], {
+    cwd: repo,
+    encoding: 'utf8',
+    env: {
+      ...process.env,
+      PATH: `${resolve(root, 'node_modules/.bin')}:${process.env.PATH}`,
+      TURBO_TELEMETRY_DISABLED: '1',
+    },
+  })
+  expect(result.status, result.stderr).toBe(0)
+  const { tasks }: { tasks: { taskId: string; hash: string }[] } = JSON.parse(result.stdout)
+  const hash = tasks.find((task) => task.taskId === '@sim/app#build')?.hash
+  if (!hash) throw new Error('turbo planned no @sim/app#build task')
+  return hash
+}
 function groups(plan: Plan) {
   return [...new Set([...plan.http, ...plan.production].map((suite) => suite.group))].sort()
 }
@@ -385,6 +402,66 @@ describe('CI task attribution through real Turborepo', () => {
     expect(plan.flags).toMatchObject({ docs: true, docs_site: false, docs_platform: true })
     expect(plan.docsGroups).toEqual(['platform'])
   })
+  it.each([
+    'apps/sim/platform/embedded/app/(shell)/home/home-view.tsx',
+    'apps/sim/platform/embedded/lib/data/home-model.ts',
+    'apps/sim/platform/design-system/components/button/button.tsx',
+    'apps/sim/platform/design-system/components/button/button.module.css',
+    'apps/sim/platform/design-system/styles/tokens.css',
+    'apps/sim/app/o/[organizationId]/page.tsx',
+  ])('changes the build hash and selects every boundary for code app/o ships: %s', (file) => {
+    const { repo } = fixture()
+    write(repo, file, 'base\n')
+    git(repo, 'add', '-A')
+    git(repo, 'commit', '--quiet', '-m', 'seed')
+    const base = git(repo, 'rev-parse', 'HEAD')
+    const before = buildHash(repo)
+    write(repo, file, 'changed\n')
+    git(repo, 'commit', '--quiet', '-am', 'edit')
+    expect(buildHash(repo)).not.toBe(before)
+    const plan = classify(repo, base)
+    expect(plan.fallback).toBeUndefined()
+    expect(groups(plan)).toContain('org-redesign')
+    expect(plan.flags).toMatchObject({ build: true, e2e_build: true, integration: true })
+  })
+  it.each([
+    'apps/sim/platform/app/(shell)/home/page.tsx',
+    'apps/sim/platform/lib/data/home.ts',
+    'apps/sim/platform/fixtures/index.ts',
+    'apps/sim/platform/checks/live/home.spec.ts',
+    'apps/sim/platform/docs/parity-ledger.md',
+    'apps/sim/platform/preview/gallery.tsx',
+    'apps/sim/platform/public/tooltips/one.svg',
+    'apps/sim/platform/next.config.ts',
+    'apps/sim/scripts/platform-live-seed.ts',
+  ])('keeps a zone-only edit out of the main app build and its jobs: %s', (file) => {
+    const { repo } = fixture()
+    write(repo, file, 'base\n')
+    git(repo, 'add', '-A')
+    git(repo, 'commit', '--quiet', '-m', 'seed')
+    const base = git(repo, 'rev-parse', 'HEAD')
+    const before = buildHash(repo)
+    write(repo, file, 'changed\n')
+    git(repo, 'commit', '--quiet', '-am', 'edit')
+    expect(buildHash(repo)).toBe(before)
+    const plan = classify(repo, base)
+    expect(plan.fallback).toBeUndefined()
+    expect(groups(plan)).toEqual([])
+    expect(plan.flags).toMatchObject({
+      build: false,
+      e2e_build: false,
+      integration: false,
+      desktop_live: false,
+    })
+  })
+  it('keeps a new platform folder an input until it is declared zone-only', () => {
+    const { repo } = fixture()
+    const before = buildHash(repo)
+    write(repo, 'apps/sim/platform/new-shared/thing.ts', 'export const thing = 1\n')
+    git(repo, 'add', '-A')
+    git(repo, 'commit', '--quiet', '-m', 'new folder')
+    expect(buildHash(repo)).not.toBe(before)
+  })
   it('keeps desktop smoke weights out of live runtime attribution', () => {
     const plan = classifyFiles(['apps/desktop/e2e-durations.json'])
     expect(plan.fallback).toBeUndefined()