ci-workflows: wire Claude-powered e2e verification lane into CI (1→2 residue)

[kyle-sexton]

Problem

The fleet's e2e verification is local-only (playwright skill drives a live browser from a
session); no CI lane runs end-to-end verification, so the self-verification loop the 1→2
transition depends on stops at tests + build + lint in CI.

Boris's step-2 guardrail names this verbatim: "Claude powered end-to-end verification (eg.
using the Claude Chrome extension or iOS/Android simulator MCP)".

Fix shape

Wire an e2e lane into ci-workflows (reusable workflow), consumed by repos that declare an e2e
surface; keep the local playwright path as the interactive instance of the same discipline.
Scope, runner class, and cost posture per the existing runner-policy component.

Source

1→2 residue item from the AI-adoption-ladder gap map; #239 directed "file via /work-items" —
this files it.

---

Reference: Boris Cherny, "Steps of AI Adoption" (Google Doc)

[kyle-sexton]

Delivered (2026-07-20)

The Claude-powered e2e verification lane is merged in ci-workflows as the reusable workflow claude-e2e-verify.yml (melodic-software/ci-workflows#159, merge 8005f02), with its dogfood self-caller + fixture app proving the lane on its own CI:

• Consumer contract: caller passes app-start-command + app-url + e2e-spec; the lane provisions a pinned Playwright/Chromium toolchain (drift-watched by tool-version-drift-check), health-polls the served app, and a Claude session drives the caller's journeys and posts advisory findings.
• Security model mirrors the claude-review lane (pull_request-only + privileged-trigger tripwire, fork PRs skipped by design, one named secret, least-privilege permissions), with the elevated executes-PR-code salience and accepted credential posture documented in the header; per-head-SHA freshness guard prevents stale-run publishes.
• Advisory with a recorded earned-flip promotion trigger (selector-coupled required gate once precision is proven) — consistent with ADR 0002's default-on-advisory posture in this repo.
• The local playwright skill remains the interactive instance of the same discipline, per this issue's framing.

Fleet repos that declare an e2e surface consume it with a thin caller pinned at the merge SHA; no fleet repo ships a web app surface today, so the first app repo wires it on arrival (the dogfood caller stands as the reference consumer).