ci: let the SDK suite run where no model is reachable

[kjgbot]

Second defect in my #153, found once the suite actually ran far enough to hit it.

The problem

live-kernel.test.ts runs one case against the real Claude analyzer and fails by default when it cannot reach one. That default is deliberate and correct — from the test's own comment:

An unavailable analyzer is diagnostics, never acceptance, so this FAILS by default. Skipping is the opt-in, not the default: a reader who runs the suite without special knowledge must not get a green that proves nothing about gate 2.

A GitHub runner has no claude binary:

LIVE_ANALYZER_UNAVAILABLE: "/home/runner/work/flows/flows/testdata/preflight/analyze-story-claude-cli auth status"
exited 1: cannot run "claude": spawnSync claude ENOENT
— failing because gate-2 acceptance requires the real analyzer to execute.

So the step could never pass. #153 turned on the full suite without giving CI any way to run it — my defect, not the test's.

The fix

RELAYFLOWS_ALLOW_ANALYZER_SKIP=1, which is the escape hatch the test documents for "environments that knowingly cannot reach a model and are not counting this run as gate evidence."

Setting it is an explicit claim, not a convenience: this workflow is not gate-2 acceptance evidence. Gate-2 evidence has to come from a machine that can actually reach a model, and the skipped case prints exactly that in its own output. Every other case in the suite still runs and still gates.

I put the reasoning in the workflow rather than the commit alone, because the next person to see a skipped gate-2 case in a CI log deserves to find out why without archaeology.

Where this leaves the CI chain

Three of my own defects, in order:

1. ci: run the kernel and full SDK suites #153 enabled the suites but routed cargo through the sandbox wrapper → rustup could not choose a version of cargo. Fixed by ci: stop routing CI's cargo through the sandbox wrapper #154, merged.
2. P1: #137 made dispatch order to a capacity-1 worker nondeterministic (60/60 → ~15% failure) #155, a real pre-existing dispatch race the suites then caught. Fixed by fix(kernel): a dead leased attempt serves no retry delay #158 — confirmed on the runner: worker_capacity::default_capacity_one_... ok.
3. This one.

Also seen in that run, and not addressed here:

• SDK suite flake: ENOENT '.relayflow/backlog-picker-entry.json' under vitest parallelism #156 (ENOENT '.relayflow/backlog-picker-entry.json') fired again. Real flake, separate issue.
• agent::rung_c_sigkill_... hung for 30 min and was cancelled on two earlier runs, but passed on the rerun, so it looks flaky rather than deterministic. I had wrongly told feat(sdk): settle data and code gate contract #139 it was branch-specific; corrected there.

🤖 Generated with Claude Code

https://claude.ai/code/session_01FtQSAcGDta5VH9xiZFT4sR

[coderabbitai]

Warning

Review limit reached

Next included review available in 3 seconds.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Free

Run ID: 092c8488-bde1-46a8-aef1-19b6fed0d1de

📥 Commits

Reviewing files that changed from the base of the PR and between ee28397 and 217318f.

📒 Files selected for processing (1)

• .github/workflows/cloud-runtime-artifact.yml

---

Note

🎁 Summarized by CodeRabbit Free

Your organization is on the Free plan. CodeRabbit will generate a high-level summary and a walkthrough for each pull request. For a comprehensive line-by-line review, please upgrade your subscription to CodeRabbit Essentials by visiting https://app.coderabbit.ai/settings/billing.

_{Comment @coderabbitai help to get the list of available commands.}