Skip to content
Merged
2 changes: 1 addition & 1 deletion docs/process-hardening.md
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ Playwright workers or revive the refuted cache/shard hacks listed there.
- `ci-change-scope.mjs` is the shared fail-closed classifier for local PR handoff and hosted CI. Only recognised documentation and workflow/policy paths take a light route; product code, tests, executable config, dependencies, database/container/RAG surfaces, mixed scope, and unknown non-document paths retain heavy verification.
- `verify:pr-local` no longer treats every handoff as lint + typecheck + full unit + RAG fixtures. It always checks runtime, installed-lock parity, and changed-file formatting, then selects documentation checks, focused workflow contracts, or the heavy executable plan. Its self-test makes those routing decisions a repository contract.
- `static-pr` remains required but step-routes the same signals. Workflow-only edits run focused workflow tests instead of full coverage and safety/RAG; documentation changes run documentation integrity checks; heavy/unknown changes retain lint, typecheck, coverage, safety/RAG, and all applicable build/UI/database/container jobs. `PR required` remains `if: always()` and requires every in-scope job, including `safety` whenever `static_heavy_changed` is true.
- Repeated low-yield provider work was removed from ordinary PRs: dependency audit runs when a lockfile/npm configuration can change the dependency tree (and on the scheduled full-run sentinel), eval-canary liveness moved to the daily Ops Digest cadence, and PR-body synchronization runs only when `PR_POLICY_BODY.md` exists.
- Repeated low-yield provider work was removed from ordinary PRs: dependency audit runs when a lockfile/npm configuration can change the dependency tree (and on the scheduled full-run sentinel), eval-canary liveness moved to the daily Ops Digest cadence, and PR-body synchronization runs only when the current PR's own diff changes `PR_POLICY_BODY.md`.
- The operating rule is incremental value, not a fixed command count: each added check must cover a distinct plausible failure path. Never rerun an unchanged pass, and do not stack broad gates when one suitable gate already covers the risk.

## Multi-worktree reconciliation hardening (2026-07-23)
Expand Down
2 changes: 1 addition & 1 deletion docs/testing.md
Original file line number Diff line number Diff line change
Expand Up @@ -270,7 +270,7 @@ PR CI uses the same fail-closed classifier as `verify:pr-local`. `static-pr` alw

UI scope runs a fail-fast `@critical` Chromium job on pull requests / merge queues, then required production Chromium journeys (`test:e2e:pr:shard`) across three **duration-aware explicit file groups** (`scripts/playwright-pr-shards.mjs`). Those later groups exclude `@critical`; main, scheduled, and ordinary manual runs skip the fail-fast job and retain the complete set. The dated per-file timing profile is the single source for membership and keeps both full and post-critical estimates within 30 seconds; filesystem/config parity tests fail closed on orphans, duplicates, or matcher drift. Cross-job webpack-cache transport is deliberately absent after the merged PR's final run moved a 1.09 GB artifact three times for no critical-path benefit. `.github/actions/setup-ui-e2e/**` is UI-scoped so changing the browser environment exercises its owner. `src/app/api/**` does not set `ui_changed` or `db_changed` — API handlers stay on unit/coverage (and offline RAG when retrieval-scoped). The `PR required` aggregate keeps `if: always()` and distinguishes `cancelled` from `failure` in its messages. `release-browser-matrix` runs on UI/performance/lockfile-relevant `main` pushes and on every release-branch, ordinary manual, and scheduled run; its Playwright wrapper owns the isolated production build, and successful in-run production Chromium leaves only Chromium mockups plus Firefox/WebKit. Missing prior Chromium proof falls back to the full matrix. The Lighthouse-baseline refresh dispatch is a focused measurement operation rather than a synthetic full run. Container scope calls the reusable Docker workflow and requires both app and worker image builds through the aggregate.

PR body synchronization is skipped unless the checked-out head actually contains `PR_POLICY_BODY.md`. The eval-canary liveness API probe runs once with the daily Ops Digest cadence rather than on every PR. These remove repeated provider-side work without weakening a required result.
PR body synchronization is skipped unless the current PR's own diff changes `PR_POLICY_BODY.md` — an inherited copy merely present on the checked-out head (e.g. from a `main` merge) no longer triggers it (`#230`). The eval-canary liveness API probe runs once with the daily Ops Digest cadence rather than on every PR. These remove repeated provider-side work without weakening a required result.

Two further jobs are advisory (deliberately outside `pr-required`): `visual-baseline` on UI scope
(soft-fail only the classified pixel-drift step) and `lighthouse-budget` on the narrower perf scope
Expand Down
Loading