From 4435b538512f73bcfceb35da5a3e8f7b8c2e8922 Mon Sep 17 00:00:00 2001
From: BigSimmo <87357024+BigSimmo@users.noreply.github.com>
Date: Thu, 2 Jul 2026 17:21:44 +0800
Subject: [PATCH] ci: split Chromium smoke into parallel ui-smoke job for
 tiered PR gate

Split the serial ~6.5-minute verify job into two parallel PR jobs:
verify (static checks, unit tests, build; ~3 min) and ui-smoke
(Chromium Playwright smoke; ~4.5 min). PR wall-clock drops to the
slower job and a smoke rerun no longer repeats lint/type/tests/build.

The check names verify, ui-smoke, and Gitleaks are intended as
required status checks on main; documented in process-hardening.md
alongside the existing required-check debt.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 .github/workflows/ci.yml  | 30 ++++++++++++++++++++++++++++--
 docs/process-hardening.md |  7 +++++++
 2 files changed, 35 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 8a7a089db..0a469f77d 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -21,9 +21,11 @@ env:
   NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY: placeholder-ci-anon-key
 
 jobs:
+  # Fast deterministic merge gate: static checks, unit tests, and build.
+  # Intended as a required status check on main together with ui-smoke.
   verify:
     runs-on: ubuntu-latest
-    timeout-minutes: 40
+    timeout-minutes: 25
 
     steps:
       - name: Checkout
@@ -77,6 +79,30 @@ jobs:
           OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
         run: npm run check:deployment-readiness
 
+  # Chromium browser smoke in parallel with verify, so the slowest check no
+  # longer serializes behind lint/typecheck/tests/build and a flaky smoke
+  # rerun does not repeat them. The runner boots its own dev server, so no
+  # build step is needed here.
+  ui-smoke:
+    runs-on: ubuntu-latest
+    timeout-minutes: 25
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version-file: ".nvmrc"
+          cache: npm
+          cache-dependency-path: package-lock.json
+
+      - name: Install dependencies
+        run: npm ci
+
       - name: Restore Chromium browser cache
         uses: actions/cache@v4
         with:
@@ -102,7 +128,7 @@ jobs:
 
   release-browser-matrix:
     if: github.event_name == 'workflow_dispatch' || github.event_name == 'schedule' || github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/heads/release/')
-    needs: verify
+    needs: [verify, ui-smoke]
     runs-on: ubuntu-latest
     timeout-minutes: 70
 
diff --git a/docs/process-hardening.md b/docs/process-hardening.md
index d53cf1029..2bcaf737f 100644
--- a/docs/process-hardening.md
+++ b/docs/process-hardening.md
@@ -69,6 +69,13 @@ This document turns the current process review into phased, durable repo practic
   - Live migration history has duplicate-version churn (two each of `api_rate_limits`, `audit_logs`, `rag_queries_retention`, `audit_logs_service_role_policy`, `indexing_reliability_recovery`) from the same raw-apply habit. Do not rewrite history; treat as a caution for future applies.
   - Auth server is capped at 10 absolute DB connections (Supabase advisor); switch to percentage-based allocation in the dashboard before scaling instance size (not settable via SQL/MCP).
 
+## PR merge gate: tiered CI + required checks (2026-07-02)
+
+- CI is now two parallel PR jobs instead of one serial 6-7 minute job: `verify` (runtime alignment, edge typecheck, CI-safe production readiness, lint, typecheck, unit tests with coverage gate, build — ~3 min) and `ui-smoke` (Chromium Playwright smoke against its own dev server — ~4.5 min). Wall-clock PR feedback drops to the slower of the two, and a flaky smoke rerun no longer repeats lint/typecheck/tests/build.
+- The deployment boot smoke and full browser matrix remain gated to `main`, `release/*`, manual dispatch, and the weekly schedule — they are deliberately not PR gates.
+- **Required-check debt (the reason #131/#133 merged red): `main` has no branch protection.** The intended configuration is a ruleset/branch protection on `main` requiring `verify`, `ui-smoke`, and `Gitleaks`, with "require branches up to date" left OFF (strict up-to-dateness would force constant rebases across the many concurrent agent branches). Until that is applied in repo settings, CI remains advisory. Note: once applied, direct pushes to `main` are blocked; all work must land via PR.
+- If `ui-smoke` proves flaky as a required check, demote it to advisory (remove from required contexts) rather than tolerating red merges — the deterministic `verify` gate stays required regardless.
+
 ## CSS cascade layering (2026-07-02)
 
 - The custom component classes in `src/app/globals.css` predate cascade layers, so they sat unlayered and silently beat Tailwind v4 utilities (which live in `@layer utilities`) on the same element. This caused three shipped UI bugs: the header source ledger ignoring responsive `hidden`, the composer clear button covering typed text (`pr-*` defeated), and the standalone-home status chips sliding under the mode pill.