[fix.docs.sigma.D9+] keep runtime environments outside the architecture twin

Auto-discovery must absorb new first-party source without treating a 6.4 GB conda prefix as application architecture. Git now excludes classified external roots before capture, preventing 175k runtime paths from overflowing the watcher while preserving automatic discovery for new code roots.

Author: ivanicu

scripts/build_digital_twin.py

@@ -93,7 +93,14 @@ def layer_for(path: str) -> str:
 
 def discovered_files() -> list[pathlib.Path]:
     """Discover tracked and not-yet-tracked first-party files from one ownership policy."""
-    ok, raw = run(['git', 'ls-files', '--cached', '--others', '--exclude-standard', '-z'])
+    external_pathspecs = [pattern for root in SCOPE['external_roots']
+                          for pattern in (f':(exclude){root.rstrip("/")}',
+                                          f':(exclude){root.rstrip("/")}/**')]
+    # Reject external runtime trees during Git enumeration, not after capture.
+    # Otherwise a large untracked environment can overflow the subprocess buffer
+    # before the semantic ownership filter ever sees its paths.
+    ok, raw = run(['git', 'ls-files', '--cached', '--others', '--exclude-standard',
+                   '-z', '--', *external_pathspecs], timeout=30)
     if not ok:
         ok, raw = run(['rg', '--files', '-0'])
     if not ok:

scripts/digital_twin_scope.json

@@ -46,6 +46,7 @@
   ],
   "external_roots": [
     ".git", ".vscode", "_archive", "build", "data", "examples", "lib", "node_modules",
+    "openfe-runtime-v2",
     "src/apps.reference.viewer-demos.vendored-readonly",
     "src/cli.tools.command-line.vendored-readonly",
     "src/examples.reference.mini-demos.vendored-readonly",

scripts/extract_ts_digital_twin.mjs

@@ -9,13 +9,19 @@ const ROOT = path.resolve(import.meta.dirname, '..');
 const scope = JSON.parse(fs.readFileSync(path.join(ROOT, 'scripts/digital_twin_scope.json'), 'utf8'));
 const roots = scope.include_roots.map(x => x.replace(/\/$/, ''));
 const externalRoots = scope.external_roots.map(x => x.replace(/\/$/, ''));
+const externalPathspecs = externalRoots.flatMap(root => [
+    `:(exclude)${root}`,
+    `:(exclude)${root}/**`,
+]);
 const rootFiles = new Set(scope.include_root_files);
 const inScope = rel => (rootFiles.has(rel) || roots.some(root => rel === root || rel.startsWith(`${root}/`))
         || (scope.auto_include_code_extensions.includes(path.extname(rel))
             && !externalRoots.some(root => rel === root || rel.startsWith(`${root}/`))))
     && !scope.exclude_fragments.some(fragment => `/${rel}`.includes(fragment))
     && !scope.exclude_suffixes.some(suffix => rel.endsWith(suffix));
-const discovered = execFileSync('git', ['ls-files', '--cached', '--others', '--exclude-standard', '-z'],
+const discovered = execFileSync('git', [
+    'ls-files', '--cached', '--others', '--exclude-standard', '-z', '--', ...externalPathspecs,
+],
     { cwd: ROOT, encoding: 'utf8' }).split('\0').filter(Boolean);
 const files = discovered.filter(rel => inScope(rel) && /\.(?:tsx?|m?js)$/.test(rel) && !/\.d\.ts$/.test(rel))
     .map(rel => path.join(ROOT, rel)).filter(file => fs.existsSync(file));

scripts/watch_digital_twin.mjs

@@ -10,6 +10,10 @@ const scope = JSON.parse(fs.readFileSync(path.join(ROOT, 'scripts/digital_twin_s
 const rootFiles = new Set(scope.include_root_files);
 const roots = scope.include_roots.map(x => x.replace(/\/$/, ''));
 const externalRoots = scope.external_roots.map(x => x.replace(/\/$/, ''));
+const externalPathspecs = externalRoots.flatMap(root => [
+    `:(exclude)${root}`,
+    `:(exclude)${root}/**`,
+]);
 const outputs = new Set(scope.generated_outputs);
 let timer;
 let running = false;
@@ -60,7 +64,12 @@ function schedule(reason) {
 }
 
 function sourceFiles() {
-    const raw = execFileSync('git', ['ls-files', '--cached', '--others', '--exclude-standard', '-z'], {
+    // Exclude classified external roots inside Git itself. Filtering only after
+    // capture made a 6.4 GB conda runtime emit 175k paths and overflow maxBuffer
+    // before inScope() had a chance to reject a single one.
+    const raw = execFileSync('git', [
+        'ls-files', '--cached', '--others', '--exclude-standard', '-z', '--', ...externalPathspecs,
+    ], {
         cwd: ROOT, encoding: 'buffer', maxBuffer: 32 * 1024 * 1024,
     });
     return raw.toString().split('\0').filter(Boolean).map(normalized).filter(inScope).sort();
@@ -88,9 +97,10 @@ function changedFiles(previous, current) {
 
 if (process.argv.includes('--selftest')) {
     const probes = ['backend/new_module.py', 'src/app/new-view.ts', 'future-dir/new.py', 'bin/new-command',
-        'src/mol-plugin/state.ts', 'docs/architecture/dirac-digital-twin.json'];
+        'src/mol-plugin/state.ts', 'openfe-runtime-v2/pkgs/tool/run.py',
+        'docs/architecture/dirac-digital-twin.json'];
     const verdicts = probes.map(file => ({ file, watched: inScope(file) }));
-    const expected = [true, true, true, true, false, false];
+    const expected = [true, true, true, true, false, false, false];
     if (verdicts.some((item, i) => item.watched !== expected[i])) {
         process.stderr.write(`${JSON.stringify(verdicts)}\n`);
         process.exit(1);