RigelBuild · mattwilkinsonn · Aug 26, 2026 · Aug 25, 2026
@@ -103,6 +103,15 @@ projects:
   # so its typecheck + unit test run in the moon-driven CI sweep — unregistered,
   # moon never discovers it and the mint's pure core ships untested.
   forge-linear-token: 'tools/forge-linear-token'
+  # The CI concern-matrix generator (RIG-2700): translates moon's affected
+  # closure + every project's `ci-group.*` tag into the per-group matrix the
+  # `moon` battery fans out over, plus the four special-leg affected flags.
+  # Registered so its own typecheck + unit tests ride the moon-driven CI sweep,
+  # AND — since moon discovers projects only from this explicit map — so the
+  # generator can see itself: its own `ci-group.bun` tag must appear in `moon
+  # query projects`, or the generator's zero-untagged assertion never covers the
+  # very tool that enforces it.
+  ci-matrix: 'tools/ci-matrix'
   # Vendored upstream fork subtrees (forks/<name>, SEA-1512). Each carries its
   # own nix-driven build as functional CI — so a fork-only change is gated by
   # the fork's own suite — while its tree stays exempt from the style gates

@@ -20,6 +20,7 @@
 # build resolves already build through nix in this same gate.
 layer: 'application'
 language: 'nix'
+tags: ['ci-group.nix']
 
 workspace:
   inheritedTasks:

@@ -12,6 +12,7 @@
 # input changes, unconditional on main + nightly.
 layer: 'application'
 language: 'nix'
+tags: ['ci-group.nix']
 
 workspace:
   inheritedTasks:

@@ -9,7 +9,7 @@
 # Access gate, no PostHog analytics.
 layer: 'application'
 language: 'typescript'
-tags: ['bun', 'oss']
+tags: ['bun', 'oss', 'ci-group.bun']
 
 tasks:
   # Mirror the monorepo's reviewed markdown into the gitignored

@@ -4,7 +4,7 @@
 # (@compass/client -> compass.v1); compass-proto:drift gates its freshness.
 layer: 'application'
 language: 'typescript'
-tags: ['bun', 'oss']
+tags: ['bun', 'oss', 'ci-group.bun']
 dependsOn: ['compass-client']
 
 tasks:

@@ -82,20 +82,22 @@ check-name attribution plus special-infra alignment:
 
 ### Concern groups — declared by an explicit `ci-group` tag, never by project id in ci.yml
 
-Each project declares exactly one `ci-group:<name>` tag in its `moon.yml`, so
+Each project declares exactly one `ci-group.<name>` tag in its `moon.yml`, so
 group membership is data on the project itself — colocated with the project
 registration the vendored-fork incident showed can otherwise drift — never a
-filter expression in the workflow. Membership as of `main@fc835ca6` (live
+filter expression in the workflow. moon 2.5.3 tag ids forbid a colon (only
+alnum / `-` / `_` / `/` / `.` are allowed), so the group delimiter is a DOT,
+not the colon this record first drafted. Membership as of `main@fc835ca6` (live
 `moon query projects` this session):
 
 | Group | Tag (declared per project) | Members today |
 | --- | --- | --- |
-| `go` | `ci-group:go` | `compass-go`, `compass-proto` |
-| `bun` | `ci-group:bun` | 13 first-party projects (plus `root`; see below, for 14 total): `compass-agent`, `compass-client`, `compass-ui`, `compass-eng-docs`, the gate tools (`toolchain-parity`, `stamp-gate`, `design-ledger-gate`, `orion-ref-gate`, `cx-token-gate`, `agent-image-env-gate`), `renovate`, `renovate-preflight`, `forge-linear-token` |
-| `nix` | `ci-group:nix` | `compass-agent-image`, `compass-guest-image`, `compass-app-bundle` — the heavy nix builds (agent-image/moon.yml:45, guest-image/moon.yml:46, app-bundle/moon.yml:32) |
-| `forks` | `ci-group:forks` | **Transient** (see below) — `oh-my-pi-fork` (workspace.yml:117; TypeScript but deliberately not `bun`-tagged — its ci is upstream's own check, forks/oh-my-pi/moon.yml:52–92) |
+| `go` | `ci-group.go` | `compass-go`, `compass-proto` |
+| `bun` | `ci-group.bun` | 13 first-party projects (plus `root`; see below, for 14 total): `compass-agent`, `compass-client`, `compass-ui`, `compass-eng-docs`, the gate tools (`toolchain-parity`, `stamp-gate`, `design-ledger-gate`, `orion-ref-gate`, `cx-token-gate`, `agent-image-env-gate`), `renovate`, `renovate-preflight`, `forge-linear-token` |
+| `nix` | `ci-group.nix` | `compass-agent-image`, `compass-guest-image`, `compass-app-bundle` — the heavy nix builds (agent-image/moon.yml:45, guest-image/moon.yml:46, app-bundle/moon.yml:32) |
+| `forks` | `ci-group.forks` | **Transient** (see below) — `oh-my-pi-fork` (workspace.yml:117; TypeScript but deliberately not `bun`-tagged — its ci is upstream's own check, forks/oh-my-pi/moon.yml:52–92) |
 
-Plus `root` (workspace.yml:16, the lint/format sweeps): tagged `ci-group:bun`
+Plus `root` (workspace.yml:16, the lint/format sweeps): tagged `ci-group.bun`
 (it owns the single bun install the bun projects' `install` no-op depends on,
 workspace.yml:11–15).
 
@@ -106,7 +108,7 @@ cost" the ci.yml header names (ci.yml:26–27) and the worst case the `gates`
 job's `timeout-minutes: 90` was sized for (ci.yml:118–120). The frozen forks
 reversal (`docs/designs/platform/compass-forks-reversal/design.md`) removes
 all three vendored forks; when `oh-my-pi-fork` is deleted, its
-`ci-group:forks` tag vanishes with its `moon.yml`, and the group empties
+`ci-group.forks` tag vanishes with its `moon.yml`, and the group empties
 cleanly — no untagged project is left behind, so the zero-untagged and
 coverage assertions still pass over the remaining groups — while the
 dominant-cost worst case departs with it. Nothing in this design is premised
@@ -443,7 +445,7 @@ tasks T1–T4, which land value even before T5.
 ## Global Constraints
 
 - **No project id may appear in ci.yml.** Grouping is declared as exactly one
-  explicit `ci-group:<name>` tag per project in its moon.yml; membership is
+  explicit `ci-group.<name>` tag per project in its moon.yml; membership is
   computed at run time. The setup generator MUST fail loud — naming the
   offending project id in one line — on any coverage gap, double membership,
   or untagged project.
@@ -579,9 +581,9 @@ and Retrospect.
 
 ### T5 — the moon-owned concern matrix; dissolve `gates`; gate every leg
 
-Tag every project: add exactly one `ci-group:<name>` tag to each project's
+Tag every project: add exactly one `ci-group.<name>` tag to each project's
 moon.yml (go/bun/nix/forks per the membership table above; `root` gets
-`ci-group:bun`).
+`ci-group.bun`).
 
 Add a `setup` job (fetch-depth-0 checkout, nix install, phase-one
 bootstrap, `edited` guard) running the generator — a bun-run TypeScript

@@ -34,7 +34,7 @@
 # scope decision, not an import detail.
 layer: 'application'
 language: 'typescript'
-tags: ['oss']
+tags: ['oss', 'ci-group.forks']
 
 workspace:
   inheritedTasks:

@@ -13,7 +13,7 @@
 # on PATH.
 layer: 'library'
 language: 'go'
-tags: ['oss']
+tags: ['oss', 'ci-group.go']
 
 workspace:
   inheritedTasks:

@@ -19,6 +19,7 @@
 # realises.
 layer: 'application'
 language: 'nix'
+tags: ['ci-group.nix']
 
 workspace:
   inheritedTasks:

@@ -16,6 +16,8 @@
 layer: 'library'
 language: 'typescript'
 
+tags: ['ci-group.bun']
+
 workspace:
   inheritedTasks:
     exclude: ['install', 'lint', 'format']

@@ -8,7 +8,7 @@
 # mapping is the package's own testable surface (no Runner-side translator).
 layer: 'library'
 language: 'typescript'
-tags: ['bun', 'oss']
+tags: ['bun', 'oss', 'ci-group.bun']
 
 tasks:
   typecheck:

@@ -4,7 +4,7 @@
 # generated client (src/gen); compass-proto:drift gates its freshness.
 layer: 'library'
 language: 'typescript'
-tags: ['bun', 'oss']
+tags: ['bun', 'oss', 'ci-group.bun']
 dependsOn: ['compass-proto']
 
 tasks:

@@ -14,7 +14,7 @@
 # from.
 layer: 'library'
 language: 'bash'
-tags: ['oss']
+tags: ['oss', 'ci-group.go']
 
 workspace:
   inheritedTasks:

@@ -21,7 +21,7 @@
 # `moon run :ci`), so the `ci` aggregate below is swept automatically.
 layer: 'tool'
 language: 'typescript'
-tags: ['bun']
+tags: ['bun', 'ci-group.bun']
 
 tasks:
   typecheck:

@@ -0,0 +1,3 @@
+{
+	"extends": "//"
+}