perf(ci): reuse dependency checks in release builds

[t3dotgg]

Windows release builds repeat pnpm's lockfile checks after preflight already ran them. A recent Windows run spent 49 seconds on these checks alongside package installation.

Pass preflight's small verification file to the desktop builds. pnpm checks the current lockfile and policy before reusing it. If the artifact is unavailable, installation runs the checks again. Build order, package caches, signing, and release quality checks stay unchanged.

Validation

• Tested pnpm 11.10.0 with only the verification file copied to a new workspace. Missing files, changed lockfiles, and changed policies triggered verification again.
• Targeted format checks passed. Actionlint found no new diagnostics against main.
• Windows time savings are not measured. No release was triggered.

Implemented with GPT-5.6 Sol via Codex in T3 Code.

---

Note

Low Risk
CI-only workflow changes with graceful fallback when the artifact is absent; no application runtime or security logic changes.

Overview
Release desktop builds were redoing pnpm lockfile/policy checks after preflight had already run them (notably costly on Windows). This PR reuses only the small verification output instead of copying the full registry metadata cache.

Preflight now sets pnpm_config_cache_dir under the runner temp dir during install, then uploads lockfile-verified.jsonl as the release-dependency-verification artifact (continue-on-error: true). Matrix build jobs download that artifact into the same cache dir, set the same env on Install desktop dependencies and Build desktop artifact, so pnpm can skip redundant checks when the lockfile and policy still match. If the artifact is missing, install falls back to running verification again.

docs/internals/ci.md documents this handoff.

^{Reviewed by Cursor Bugbot for commit ee93f51. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Cache release preflight dependency checks for desktop build jobs

• The release preflight job uploads a release-dependency-verification artifact containing lockfile-verified.jsonl.
• Desktop dependency installation and artifact build jobs download this artifact into the pnpm metadata cache directory to reuse the verification data.
• Updates docs/internals/ci.md to document the lockfile verification sharing mechanism.
• Risk: Artifact upload and download steps are best-effort; failures do not fail the job and checks rerun normally.

^{Macroscope summarized ee93f51.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

ℹ️ The exact PR base did not have a successful artifact. Baseline uses the latest successful main measurement shown below.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.3 KiB	13.6 KiB	+289 B (+2.1%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	7.0 KiB	+128 B (+1.8%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.4 KiB	6.6 KiB	+161 B (+2.5%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	55.6 KiB	57.1 KiB	+1.5 KiB (+2.7%)	66.4 KiB	✅
Codex	Live turn messages	10	10	0 (0.0%)	21	✅
Claude	Total thread wire	13.2 KiB	13.6 KiB	+341 B (+2.5%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	7.0 KiB	+144 B (+2.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.3 KiB	6.5 KiB	+197 B (+3.0%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	56.3 KiB	57.8 KiB	+1.5 KiB (+2.7%)	66.4 KiB	✅
Claude	Live turn messages	8	9	+1 (+12.5%)	21	✅

Baseline: 6ff537f · PR result: ee93f51 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 113.8 KiB
• Claude decoded thread snapshot: 114.5 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[macroscopeapp]

Approvability

Verdict: Approved at ee93f51

Macroscope's review found this PR approvable — This is a narrowly scoped CI performance change that shares pnpm verification metadata between release jobs without changing application behavior or release targets. Artifact failures safely fall back to the existing dependency checks, and the accompanying documentation has no runtime impact.

^{You can add or adjust custom eligibility rules. Learn more.}

[t3dotgg]

Windows release builds repeat pnpm's lockfile checks after preflight already ran them. A recent Windows run spent 49 seconds on these checks alongside package installation.

Pass preflight's small verification file to the desktop builds. pnpm checks the current lockfile and policy before reusing it. If the artifact is unavailable, installation runs the checks again. Build order, package caches, signing, and release quality checks stay unchanged.

Validation

• Tested pnpm 11.10.0 with only the verification file copied to a new workspace. Missing files, changed lockfiles, and changed policies triggered verification again.
• Targeted format checks passed. Actionlint found no new diagnostics against main.
• Windows time savings are not measured. No release was triggered.

Implemented with GPT-5.6 Sol via Codex in T3 Code.

---

Note

Low Risk
CI-only workflow changes with graceful fallback when the artifact is absent; no application runtime or security logic changes.

Overview
Release desktop builds were redoing pnpm lockfile/policy checks after preflight had already run them (notably costly on Windows). This PR reuses only the small verification output instead of copying the full registry metadata cache.

Preflight now sets pnpm_config_cache_dir under the runner temp dir during install, then uploads lockfile-verified.jsonl as the release-dependency-verification artifact (continue-on-error: true). Matrix build jobs download that artifact into the same cache dir, set the same env on Install desktop dependencies and Build desktop artifact, so pnpm can skip redundant checks when the lockfile and policy still match. If the artifact is missing, install falls back to running verification again.

docs/internals/ci.md documents this handoff.

^{Reviewed by Cursor Bugbot for commit ee93f51. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Cache release preflight dependency checks for desktop build jobs

• The release preflight job uploads a release-dependency-verification artifact containing lockfile-verified.jsonl.
• Desktop dependency installation and artifact build jobs download this artifact into the pnpm metadata cache directory to reuse the verification data.
• Updates docs/internals/ci.md to document the lockfile verification sharing mechanism.
• Risk: Artifact upload and download steps are best-effort; failures do not fail the job and checks rerun normally.

^{Macroscope summarized ee93f51.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

ℹ️ The exact PR base did not have a successful artifact. Baseline uses the latest successful main measurement shown below.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.3 KiB	13.6 KiB	+289 B (+2.1%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	7.0 KiB	+128 B (+1.8%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.4 KiB	6.6 KiB	+161 B (+2.5%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	55.6 KiB	57.1 KiB	+1.5 KiB (+2.7%)	66.4 KiB	✅
Codex	Live turn messages	10	10	0 (0.0%)	21	✅
Claude	Total thread wire	13.2 KiB	13.6 KiB	+341 B (+2.5%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	7.0 KiB	+144 B (+2.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.3 KiB	6.5 KiB	+197 B (+3.0%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	56.3 KiB	57.8 KiB	+1.5 KiB (+2.7%)	66.4 KiB	✅
Claude	Live turn messages	8	9	+1 (+12.5%)	21	✅

Baseline: 6ff537f · PR result: ee93f51 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 113.8 KiB
• Claude decoded thread snapshot: 114.5 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[macroscopeapp]

Approvability

Verdict: Approved at ee93f51

Macroscope's review found this PR approvable — This is a narrowly scoped CI performance change that shares pnpm verification metadata between release jobs without changing application behavior or release targets. Artifact failures safely fall back to the existing dependency checks, and the accompanying documentation has no runtime impact.

^{You can add or adjust custom eligibility rules. Learn more.}

[t3dotgg]

Windows release builds repeat pnpm's lockfile checks after preflight already ran them. A recent Windows run spent 49 seconds on these checks alongside package installation.

Pass preflight's small verification file to the desktop builds. pnpm checks the current lockfile and policy before reusing it. If the artifact is unavailable, installation runs the checks again. Build order, package caches, signing, and release quality checks stay unchanged.

Validation

• Tested pnpm 11.10.0 with only the verification file copied to a new workspace. Missing files, changed lockfiles, and changed policies triggered verification again.
• Targeted format checks passed. Actionlint found no new diagnostics against main.
• Windows time savings are not measured. No release was triggered.

Implemented with GPT-5.6 Sol via Codex in T3 Code.

---

Note

Low Risk
CI-only workflow changes with graceful fallback when the artifact is absent; no application runtime or security logic changes.

Overview
Release desktop builds were redoing pnpm lockfile/policy checks after preflight had already run them (notably costly on Windows). This PR reuses only the small verification output instead of copying the full registry metadata cache.

Preflight now sets pnpm_config_cache_dir under the runner temp dir during install, then uploads lockfile-verified.jsonl as the release-dependency-verification artifact (continue-on-error: true). Matrix build jobs download that artifact into the same cache dir, set the same env on Install desktop dependencies and Build desktop artifact, so pnpm can skip redundant checks when the lockfile and policy still match. If the artifact is missing, install falls back to running verification again.

docs/internals/ci.md documents this handoff.

^{Reviewed by Cursor Bugbot for commit ee93f51. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Cache release preflight dependency checks for desktop build jobs

• The release preflight job uploads a release-dependency-verification artifact containing lockfile-verified.jsonl.
• Desktop dependency installation and artifact build jobs download this artifact into the pnpm metadata cache directory to reuse the verification data.
• Updates docs/internals/ci.md to document the lockfile verification sharing mechanism.
• Risk: Artifact upload and download steps are best-effort; failures do not fail the job and checks rerun normally.

^{Macroscope summarized ee93f51.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

ℹ️ The exact PR base did not have a successful artifact. Baseline uses the latest successful main measurement shown below.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.3 KiB	13.6 KiB	+289 B (+2.1%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	7.0 KiB	+128 B (+1.8%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.4 KiB	6.6 KiB	+161 B (+2.5%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	55.6 KiB	57.1 KiB	+1.5 KiB (+2.7%)	66.4 KiB	✅
Codex	Live turn messages	10	10	0 (0.0%)	21	✅
Claude	Total thread wire	13.2 KiB	13.6 KiB	+341 B (+2.5%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	7.0 KiB	+144 B (+2.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.3 KiB	6.5 KiB	+197 B (+3.0%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	56.3 KiB	57.8 KiB	+1.5 KiB (+2.7%)	66.4 KiB	✅
Claude	Live turn messages	8	9	+1 (+12.5%)	21	✅

Baseline: 6ff537f · PR result: ee93f51 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 113.8 KiB
• Claude decoded thread snapshot: 114.5 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[macroscopeapp]

Approvability

Verdict: Approved at ee93f51

Macroscope's review found this PR approvable — This is a narrowly scoped CI performance change that shares pnpm verification metadata between release jobs without changing application behavior or release targets. Artifact failures safely fall back to the existing dependency checks, and the accompanying documentation has no runtime impact.

^{You can add or adjust custom eligibility rules. Learn more.}

[t3dotgg]

Windows release builds repeat pnpm's lockfile checks after preflight already ran them. A recent Windows run spent 49 seconds on these checks alongside package installation.

Pass preflight's small verification file to the desktop builds. pnpm checks the current lockfile and policy before reusing it. If the artifact is unavailable, installation runs the checks again. Build order, package caches, signing, and release quality checks stay unchanged.

Validation

• Tested pnpm 11.10.0 with only the verification file copied to a new workspace. Missing files, changed lockfiles, and changed policies triggered verification again.
• Targeted format checks passed. Actionlint found no new diagnostics against main.
• Windows time savings are not measured. No release was triggered.

Implemented with GPT-5.6 Sol via Codex in T3 Code.

---

Note

Low Risk
CI-only workflow changes with graceful fallback when the artifact is absent; no application runtime or security logic changes.

Overview
Release desktop builds were redoing pnpm lockfile/policy checks after preflight had already run them (notably costly on Windows). This PR reuses only the small verification output instead of copying the full registry metadata cache.

Preflight now sets pnpm_config_cache_dir under the runner temp dir during install, then uploads lockfile-verified.jsonl as the release-dependency-verification artifact (continue-on-error: true). Matrix build jobs download that artifact into the same cache dir, set the same env on Install desktop dependencies and Build desktop artifact, so pnpm can skip redundant checks when the lockfile and policy still match. If the artifact is missing, install falls back to running verification again.

docs/internals/ci.md documents this handoff.

^{Reviewed by Cursor Bugbot for commit ee93f51. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Cache release preflight dependency checks for desktop build jobs

• The release preflight job uploads a release-dependency-verification artifact containing lockfile-verified.jsonl.
• Desktop dependency installation and artifact build jobs download this artifact into the pnpm metadata cache directory to reuse the verification data.
• Updates docs/internals/ci.md to document the lockfile verification sharing mechanism.
• Risk: Artifact upload and download steps are best-effort; failures do not fail the job and checks rerun normally.

^{Macroscope summarized ee93f51.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

ℹ️ The exact PR base did not have a successful artifact. Baseline uses the latest successful main measurement shown below.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.3 KiB	13.6 KiB	+289 B (+2.1%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	7.0 KiB	+128 B (+1.8%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.4 KiB	6.6 KiB	+161 B (+2.5%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	55.6 KiB	57.1 KiB	+1.5 KiB (+2.7%)	66.4 KiB	✅
Codex	Live turn messages	10	10	0 (0.0%)	21	✅
Claude	Total thread wire	13.2 KiB	13.6 KiB	+341 B (+2.5%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	7.0 KiB	+144 B (+2.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.3 KiB	6.5 KiB	+197 B (+3.0%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	56.3 KiB	57.8 KiB	+1.5 KiB (+2.7%)	66.4 KiB	✅
Claude	Live turn messages	8	9	+1 (+12.5%)	21	✅

Baseline: 6ff537f · PR result: ee93f51 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 113.8 KiB
• Claude decoded thread snapshot: 114.5 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[macroscopeapp]

Approvability

Verdict: Approved at ee93f51

Macroscope's review found this PR approvable — This is a narrowly scoped CI performance change that shares pnpm verification metadata between release jobs without changing application behavior or release targets. Artifact failures safely fall back to the existing dependency checks, and the accompanying documentation has no runtime impact.

^{You can add or adjust custom eligibility rules. Learn more.}

[t3dotgg]

Windows release builds repeat pnpm's lockfile checks after preflight already ran them. A recent Windows run spent 49 seconds on these checks alongside package installation.

Pass preflight's small verification file to the desktop builds. pnpm checks the current lockfile and policy before reusing it. If the artifact is unavailable, installation runs the checks again. Build order, package caches, signing, and release quality checks stay unchanged.

Validation

• Tested pnpm 11.10.0 with only the verification file copied to a new workspace. Missing files, changed lockfiles, and changed policies triggered verification again.
• Targeted format checks passed. Actionlint found no new diagnostics against main.
• Windows time savings are not measured. No release was triggered.

Implemented with GPT-5.6 Sol via Codex in T3 Code.

---

Note

Low Risk
CI-only workflow changes with graceful fallback when the artifact is absent; no application runtime or security logic changes.

Overview
Release desktop builds were redoing pnpm lockfile/policy checks after preflight had already run them (notably costly on Windows). This PR reuses only the small verification output instead of copying the full registry metadata cache.

Preflight now sets pnpm_config_cache_dir under the runner temp dir during install, then uploads lockfile-verified.jsonl as the release-dependency-verification artifact (continue-on-error: true). Matrix build jobs download that artifact into the same cache dir, set the same env on Install desktop dependencies and Build desktop artifact, so pnpm can skip redundant checks when the lockfile and policy still match. If the artifact is missing, install falls back to running verification again.

docs/internals/ci.md documents this handoff.

^{Reviewed by Cursor Bugbot for commit ee93f51. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Cache release preflight dependency checks for desktop build jobs

• The release preflight job uploads a release-dependency-verification artifact containing lockfile-verified.jsonl.
• Desktop dependency installation and artifact build jobs download this artifact into the pnpm metadata cache directory to reuse the verification data.
• Updates docs/internals/ci.md to document the lockfile verification sharing mechanism.
• Risk: Artifact upload and download steps are best-effort; failures do not fail the job and checks rerun normally.

^{Macroscope summarized ee93f51.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

ℹ️ The exact PR base did not have a successful artifact. Baseline uses the latest successful main measurement shown below.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.3 KiB	13.6 KiB	+289 B (+2.1%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	7.0 KiB	+128 B (+1.8%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.4 KiB	6.6 KiB	+161 B (+2.5%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	55.6 KiB	57.1 KiB	+1.5 KiB (+2.7%)	66.4 KiB	✅
Codex	Live turn messages	10	10	0 (0.0%)	21	✅
Claude	Total thread wire	13.2 KiB	13.6 KiB	+341 B (+2.5%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	7.0 KiB	+144 B (+2.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.3 KiB	6.5 KiB	+197 B (+3.0%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	56.3 KiB	57.8 KiB	+1.5 KiB (+2.7%)	66.4 KiB	✅
Claude	Live turn messages	8	9	+1 (+12.5%)	21	✅

Baseline: 6ff537f · PR result: ee93f51 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 113.8 KiB
• Claude decoded thread snapshot: 114.5 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[macroscopeapp]

Approvability

Verdict: Approved at ee93f51

Macroscope's review found this PR approvable — This is a narrowly scoped CI performance change that shares pnpm verification metadata between release jobs without changing application behavior or release targets. Artifact failures safely fall back to the existing dependency checks, and the accompanying documentation has no runtime impact.

^{You can add or adjust custom eligibility rules. Learn more.}

[t3dotgg]

Windows release builds repeat pnpm's lockfile checks after preflight already ran them. A recent Windows run spent 49 seconds on these checks alongside package installation.

Pass preflight's small verification file to the desktop builds. pnpm checks the current lockfile and policy before reusing it. If the artifact is unavailable, installation runs the checks again. Build order, package caches, signing, and release quality checks stay unchanged.

Validation

• Tested pnpm 11.10.0 with only the verification file copied to a new workspace. Missing files, changed lockfiles, and changed policies triggered verification again.
• Targeted format checks passed. Actionlint found no new diagnostics against main.
• Windows time savings are not measured. No release was triggered.

Implemented with GPT-5.6 Sol via Codex in T3 Code.

---

Note

Low Risk
CI-only workflow changes with graceful fallback when the artifact is absent; no application runtime or security logic changes.

Overview
Release desktop builds were redoing pnpm lockfile/policy checks after preflight had already run them (notably costly on Windows). This PR reuses only the small verification output instead of copying the full registry metadata cache.

Preflight now sets pnpm_config_cache_dir under the runner temp dir during install, then uploads lockfile-verified.jsonl as the release-dependency-verification artifact (continue-on-error: true). Matrix build jobs download that artifact into the same cache dir, set the same env on Install desktop dependencies and Build desktop artifact, so pnpm can skip redundant checks when the lockfile and policy still match. If the artifact is missing, install falls back to running verification again.

docs/internals/ci.md documents this handoff.

^{Reviewed by Cursor Bugbot for commit ee93f51. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Cache release preflight dependency checks for desktop build jobs

• The release preflight job uploads a release-dependency-verification artifact containing lockfile-verified.jsonl.
• Desktop dependency installation and artifact build jobs download this artifact into the pnpm metadata cache directory to reuse the verification data.
• Updates docs/internals/ci.md to document the lockfile verification sharing mechanism.
• Risk: Artifact upload and download steps are best-effort; failures do not fail the job and checks rerun normally.

^{Macroscope summarized ee93f51.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

ℹ️ The exact PR base did not have a successful artifact. Baseline uses the latest successful main measurement shown below.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.3 KiB	13.6 KiB	+289 B (+2.1%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	7.0 KiB	+128 B (+1.8%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.4 KiB	6.6 KiB	+161 B (+2.5%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	55.6 KiB	57.1 KiB	+1.5 KiB (+2.7%)	66.4 KiB	✅
Codex	Live turn messages	10	10	0 (0.0%)	21	✅
Claude	Total thread wire	13.2 KiB	13.6 KiB	+341 B (+2.5%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	7.0 KiB	+144 B (+2.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.3 KiB	6.5 KiB	+197 B (+3.0%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	56.3 KiB	57.8 KiB	+1.5 KiB (+2.7%)	66.4 KiB	✅
Claude	Live turn messages	8	9	+1 (+12.5%)	21	✅

Baseline: 6ff537f · PR result: ee93f51 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 113.8 KiB
• Claude decoded thread snapshot: 114.5 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[macroscopeapp]

Approvability

Verdict: Approved at ee93f51

Macroscope's review found this PR approvable — This is a narrowly scoped CI performance change that shares pnpm verification metadata between release jobs without changing application behavior or release targets. Artifact failures safely fall back to the existing dependency checks, and the accompanying documentation has no runtime impact.

^{You can add or adjust custom eligibility rules. Learn more.}

[t3dotgg]

Windows release builds repeat pnpm's lockfile checks after preflight already ran them. A recent Windows run spent 49 seconds on these checks alongside package installation.

Pass preflight's small verification file to the desktop builds. pnpm checks the current lockfile and policy before reusing it. If the artifact is unavailable, installation runs the checks again. Build order, package caches, signing, and release quality checks stay unchanged.

Validation

• Tested pnpm 11.10.0 with only the verification file copied to a new workspace. Missing files, changed lockfiles, and changed policies triggered verification again.
• Targeted format checks passed. Actionlint found no new diagnostics against main.
• Windows time savings are not measured. No release was triggered.

Implemented with GPT-5.6 Sol via Codex in T3 Code.

---

Note

Low Risk
CI-only workflow changes with graceful fallback when the artifact is absent; no application runtime or security logic changes.

Overview
Release desktop builds were redoing pnpm lockfile/policy checks after preflight had already run them (notably costly on Windows). This PR reuses only the small verification output instead of copying the full registry metadata cache.

Preflight now sets pnpm_config_cache_dir under the runner temp dir during install, then uploads lockfile-verified.jsonl as the release-dependency-verification artifact (continue-on-error: true). Matrix build jobs download that artifact into the same cache dir, set the same env on Install desktop dependencies and Build desktop artifact, so pnpm can skip redundant checks when the lockfile and policy still match. If the artifact is missing, install falls back to running verification again.

docs/internals/ci.md documents this handoff.

^{Reviewed by Cursor Bugbot for commit ee93f51. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Cache release preflight dependency checks for desktop build jobs

• The release preflight job uploads a release-dependency-verification artifact containing lockfile-verified.jsonl.
• Desktop dependency installation and artifact build jobs download this artifact into the pnpm metadata cache directory to reuse the verification data.
• Updates docs/internals/ci.md to document the lockfile verification sharing mechanism.
• Risk: Artifact upload and download steps are best-effort; failures do not fail the job and checks rerun normally.

^{Macroscope summarized ee93f51.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

ℹ️ The exact PR base did not have a successful artifact. Baseline uses the latest successful main measurement shown below.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.3 KiB	13.6 KiB	+289 B (+2.1%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	7.0 KiB	+128 B (+1.8%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.4 KiB	6.6 KiB	+161 B (+2.5%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	55.6 KiB	57.1 KiB	+1.5 KiB (+2.7%)	66.4 KiB	✅
Codex	Live turn messages	10	10	0 (0.0%)	21	✅
Claude	Total thread wire	13.2 KiB	13.6 KiB	+341 B (+2.5%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	7.0 KiB	+144 B (+2.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.3 KiB	6.5 KiB	+197 B (+3.0%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	56.3 KiB	57.8 KiB	+1.5 KiB (+2.7%)	66.4 KiB	✅
Claude	Live turn messages	8	9	+1 (+12.5%)	21	✅

Baseline: 6ff537f · PR result: ee93f51 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 113.8 KiB
• Claude decoded thread snapshot: 114.5 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[macroscopeapp]

Approvability

Verdict: Approved at ee93f51

Macroscope's review found this PR approvable — This is a narrowly scoped CI performance change that shares pnpm verification metadata between release jobs without changing application behavior or release targets. Artifact failures safely fall back to the existing dependency checks, and the accompanying documentation has no runtime impact.

^{You can add or adjust custom eligibility rules. Learn more.}

[t3dotgg]

Windows release builds repeat pnpm's lockfile checks after preflight already ran them. A recent Windows run spent 49 seconds on these checks alongside package installation.

Pass preflight's small verification file to the desktop builds. pnpm checks the current lockfile and policy before reusing it. If the artifact is unavailable, installation runs the checks again. Build order, package caches, signing, and release quality checks stay unchanged.

Validation

• Tested pnpm 11.10.0 with only the verification file copied to a new workspace. Missing files, changed lockfiles, and changed policies triggered verification again.
• Targeted format checks passed. Actionlint found no new diagnostics against main.
• Windows time savings are not measured. No release was triggered.

Implemented with GPT-5.6 Sol via Codex in T3 Code.

---

Note

Low Risk
CI-only workflow changes with graceful fallback when the artifact is absent; no application runtime or security logic changes.

Overview
Release desktop builds were redoing pnpm lockfile/policy checks after preflight had already run them (notably costly on Windows). This PR reuses only the small verification output instead of copying the full registry metadata cache.

Preflight now sets pnpm_config_cache_dir under the runner temp dir during install, then uploads lockfile-verified.jsonl as the release-dependency-verification artifact (continue-on-error: true). Matrix build jobs download that artifact into the same cache dir, set the same env on Install desktop dependencies and Build desktop artifact, so pnpm can skip redundant checks when the lockfile and policy still match. If the artifact is missing, install falls back to running verification again.

docs/internals/ci.md documents this handoff.

^{Reviewed by Cursor Bugbot for commit ee93f51. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Cache release preflight dependency checks for desktop build jobs

• The release preflight job uploads a release-dependency-verification artifact containing lockfile-verified.jsonl.
• Desktop dependency installation and artifact build jobs download this artifact into the pnpm metadata cache directory to reuse the verification data.
• Updates docs/internals/ci.md to document the lockfile verification sharing mechanism.
• Risk: Artifact upload and download steps are best-effort; failures do not fail the job and checks rerun normally.

^{Macroscope summarized ee93f51.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

ℹ️ The exact PR base did not have a successful artifact. Baseline uses the latest successful main measurement shown below.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.3 KiB	13.6 KiB	+289 B (+2.1%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	7.0 KiB	+128 B (+1.8%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.4 KiB	6.6 KiB	+161 B (+2.5%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	55.6 KiB	57.1 KiB	+1.5 KiB (+2.7%)	66.4 KiB	✅
Codex	Live turn messages	10	10	0 (0.0%)	21	✅
Claude	Total thread wire	13.2 KiB	13.6 KiB	+341 B (+2.5%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	7.0 KiB	+144 B (+2.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.3 KiB	6.5 KiB	+197 B (+3.0%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	56.3 KiB	57.8 KiB	+1.5 KiB (+2.7%)	66.4 KiB	✅
Claude	Live turn messages	8	9	+1 (+12.5%)	21	✅

Baseline: 6ff537f · PR result: ee93f51 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 113.8 KiB
• Claude decoded thread snapshot: 114.5 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[macroscopeapp]

Approvability

Verdict: Approved at ee93f51

Macroscope's review found this PR approvable — This is a narrowly scoped CI performance change that shares pnpm verification metadata between release jobs without changing application behavior or release targets. Artifact failures safely fall back to the existing dependency checks, and the accompanying documentation has no runtime impact.

^{You can add or adjust custom eligibility rules. Learn more.}