ci: tiered PR checks — parallel ui-smoke job + required-check plan

.github/workflows/ci.yml

@@ -21,9 +21,11 @@ env:
  NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY: placeholder-ci-anon-key
 
 jobs:
+ # Fast deterministic merge gate: static checks, unit tests, and build.
+ # Intended as a required status check on main together with ui-smoke.
  verify:
  runs-on: ubuntu-latest
- timeout-minutes: 40
+ timeout-minutes: 25
 
  steps:
  - name: Checkout
@@ -77,6 +79,30 @@ jobs:
  OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
  run: npm run check:deployment-readiness
 
+ # Chromium browser smoke in parallel with verify, so the slowest check no
+ # longer serializes behind lint/typecheck/tests/build and a flaky smoke
+ # rerun does not repeat them. The runner boots its own dev server, so no
+ # build step is needed here.
+ ui-smoke:
+ runs-on: ubuntu-latest
+ timeout-minutes: 25
+
+ steps:
+ - name: Checkout
+ uses: actions/checkout@v4
+ with:
+ persist-credentials: false
+
+ - name: Setup Node.js
+ uses: actions/setup-node@v4
+ with:
+ node-version-file: ".nvmrc"
+ cache: npm
+ cache-dependency-path: package-lock.json
+
+ - name: Install dependencies
+ run: npm ci
+
  - name: Restore Chromium browser cache
  uses: actions/cache@v4
  with:
@@ -102,7 +128,7 @@ jobs:
 
  release-browser-matrix:
  if: github.event_name == 'workflow_dispatch' || github.event_name == 'schedule' || github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/heads/release/')
- needs: verify
+ needs: [verify, ui-smoke]
  runs-on: ubuntu-latest
  timeout-minutes: 70
 

docs/process-hardening.md

@@ -69,6 +69,13 @@ This document turns the current process review into phased, durable repo practic
  - Live migration history has duplicate-version churn (two each of `api_rate_limits`, `audit_logs`, `rag_queries_retention`, `audit_logs_service_role_policy`, `indexing_reliability_recovery`) from the same raw-apply habit. Do not rewrite history; treat as a caution for future applies.
  - Auth server is capped at 10 absolute DB connections (Supabase advisor); switch to percentage-based allocation in the dashboard before scaling instance size (not settable via SQL/MCP).
 
+## PR merge gate: tiered CI + required checks (2026-07-02)
+
+- CI is now two parallel PR jobs instead of one serial 6-7 minute job: `verify` (runtime alignment, edge typecheck, CI-safe production readiness, lint, typecheck, unit tests with coverage gate, build — ~3 min) and `ui-smoke` (Chromium Playwright smoke against its own dev server — ~4.5 min). Wall-clock PR feedback drops to the slower of the two, and a flaky smoke rerun no longer repeats lint/typecheck/tests/build.
+- The deployment boot smoke and full browser matrix remain gated to `main`, `release/*`, manual dispatch, and the weekly schedule — they are deliberately not PR gates.
+- **Required-check debt (the reason #131/#133 merged red): `main` has no branch protection.** The intended configuration is a ruleset/branch protection on `main` requiring `verify`, `ui-smoke`, and `Gitleaks`, with "require branches up to date" left OFF (strict up-to-dateness would force constant rebases across the many concurrent agent branches). Until that is applied in repo settings, CI remains advisory. Note: once applied, direct pushes to `main` are blocked; all work must land via PR.
+- If `ui-smoke` proves flaky as a required check, demote it to advisory (remove from required contexts) rather than tolerating red merges — the deterministic `verify` gate stays required regardless.
+
 ## CSS cascade layering (2026-07-02)
 
 - The custom component classes in `src/app/globals.css` predate cascade layers, so they sat unlayered and silently beat Tailwind v4 utilities (which live in `@layer utilities`) on the same element. This caused three shipped UI bugs: the header source ledger ignoring responsive `hidden`, the composer clear button covering typed text (`pr-*` defeated), and the standalone-home status chips sliding under the mode pill.