promote: dev to main

.github/policies/ci-paths.yml

@@ -10,6 +10,10 @@ ci:
   - 'scripts/**'
   - 'gui/**'
   - 'integrations/replit-gateway/**'
+  - 'docker/**'
+  - 'Dockerfile'
+  - 'compose.yaml'
+  - '.dockerignore'
   - 'assets/**'
   - '.gitattributes'
   - '.npmignore'

.github/workflows/ci.yml

@@ -482,6 +482,7 @@ jobs:
         run: |
           bun x tsc --noEmit
           bun x tsc --noEmit -p tests/tsconfig.doctor-service-memory-contract.json
+          bun x tsc --ignoreConfig --noEmit --strict --target ESNext --module ESNext --moduleResolution bundler --types bun-types --skipLibCheck scripts/ci/docker-smoke.ts
 
       - name: Install replit-gateway companion
         run: cd integrations/replit-gateway && bun install --frozen-lockfile
@@ -531,23 +532,19 @@ jobs:
       - name: CLI help smoke
         run: bun run src/cli/index.ts help
 
-  # macOS is focused on dev pushes and relevant pull requests, while main,
-  # preview, and dispatch retain the full unsharded control. This keeps Darwin
-  # process coverage on the fast path without dropping the release control.
+  # Dev pushes and relevant pull requests keep a focused Darwin/process lane.
+  # Release refs and main-targeting changes use the timing-balanced full-suite
+  # matrix below; nightly-macos retains the unsharded scheduler/load control.
   platform-macos:
     name: macos
     needs: changes
     if: >-
-      (github.event_name != 'pull_request' && github.event_name != 'merge_group') ||
+      (github.event_name == 'push' && github.ref == 'refs/heads/dev') ||
       (github.event_name == 'pull_request' && github.base_ref == 'main') ||
       (github.event_name == 'merge_group' && github.event.merge_group.base_ref == 'refs/heads/main') ||
-      needs.changes.outputs.macos == 'true'
+      ((github.event_name == 'pull_request' || github.event_name == 'merge_group') && needs.changes.outputs.macos == 'true')
     runs-on: macos-latest
-    # The unsharded control for the sharded Linux lane: the only place the whole
-    # suite runs in one pool, so it is the place that catches what sharding
-    # hides. The flakes it keeps surfacing are timing, not logic, and the fix
-    # is the tests, not a fourth lane.
-    timeout-minutes: 30
+    timeout-minutes: 15
     steps:
       - name: Checkout
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
@@ -619,15 +616,84 @@ jobs:
             tests/storage/storage-worker-teardown-isolate.test.ts \
             tests/ci-workflows/test-runner.test.ts
 
-      - name: Full macOS suite
-        if: >-
-          github.event_name == 'workflow_dispatch' ||
-          (github.event_name == 'pull_request' && github.base_ref == 'main') ||
-          (github.event_name == 'merge_group' &&
-           github.event.merge_group.base_ref == 'refs/heads/main') ||
-          (github.event_name == 'push' &&
-           (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/preview'))
-        run: bash scripts/ci/run-bun-with-crash-retry.sh -- bun scripts/test.ts --timeout 60000
+      - name: CLI help smoke
+        run: bun run src/cli/index.ts help
+
+  # Full macOS coverage is split by measured file duration. Every test remains
+  # in exactly one platform lane; load-sensitive files run one per fresh Bun
+  # process, matching the full-suite planner. The daily nightly job deliberately
+  # stays unsharded so it can still expose whole-pool scheduling interactions.
+  platform-macos-full:
+    name: macos full ${{ matrix.shard }}/2
+    needs: changes
+    if: >-
+      github.event_name == 'workflow_dispatch' ||
+      (github.event_name == 'pull_request' && github.base_ref == 'main') ||
+      (github.event_name == 'merge_group' &&
+       github.event.merge_group.base_ref == 'refs/heads/main') ||
+      (github.event_name == 'push' &&
+       (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/preview'))
+    runs-on: macos-latest
+    timeout-minutes: 20
+    strategy:
+      fail-fast: false
+      matrix:
+        shard: [1, 2]
+    steps:
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false
+          fetch-tags: true
+
+      - name: Setup project Bun
+        uses: ./.github/actions/setup-project-bun
+
+      - name: Install dependencies
+        run: |
+          bun install --frozen-lockfile
+          cd gui
+          bun install --frozen-lockfile
+
+      - name: Build GUI
+        run: |
+          cd gui
+          bun run build
+
+      - name: Restore canonical test timings
+        uses: actions/cache/restore@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
+        with:
+          path: .bun-timings.json
+          key: ocx-test-timings-dev-${{ github.sha }}
+          restore-keys: |
+            ocx-test-timings-dev-
+
+      - name: Validate restored timing data
+        if: hashFiles('.bun-timings.json') != ''
+        run: bun scripts/ci/validate-timings.ts .bun-timings.json --discard-invalid
+
+      - name: Full macOS shard with isolated load-sensitive files
+        shell: bash
+        env:
+          TEST_SHARD: ${{ matrix.shard }}/2
+        run: |
+          set -euo pipefail
+          main_list="$(mktemp -t ocx-macos-main.XXXXXX)"
+          serial_list="$(mktemp -t ocx-macos-serial.XXXXXX)"
+          cleanup() { rm -f -- "$main_list" "$serial_list"; }
+          trap cleanup EXIT
+          bun scripts/ci/test-lanes.ts --lane platform-main --timings .bun-timings.json --shard "$TEST_SHARD" > "$main_list"
+          bun scripts/ci/test-lanes.ts --lane platform-serial --timings .bun-timings.json --shard "$TEST_SHARD" > "$serial_list"
+          main_files=()
+          while IFS= read -r file; do main_files+=("$file"); done < "$main_list"
+          test "${#main_files[@]}" -gt 0
+          bash scripts/ci/run-bun-with-crash-retry.sh -- bun scripts/test.ts --isolate --timeout 60000 "${main_files[@]}"
+          serial_files=()
+          while IFS= read -r file; do serial_files+=("$file"); done < "$serial_list"
+          test "${#serial_files[@]}" -gt 0
+          for file in "${serial_files[@]}"; do
+            bash scripts/ci/run-bun-with-crash-retry.sh -- bun scripts/test.ts --isolate --parallel=1 --timeout 60000 "$file"
+          done
 
       - name: CLI help smoke
         run: bun run src/cli/index.ts help
@@ -878,6 +944,28 @@ jobs:
             bun run scripts/keyring-smoke.ts
           '
 
+  # Exercise the source-build Compose contract, including real volume reuse.
+  # Host fixtures cannot prove image construction or container recreation.
+  docker-smoke:
+    name: docker smoke
+    needs: changes
+    if: >-
+      (github.event_name != 'pull_request' && github.event_name != 'merge_group') ||
+      needs.changes.outputs.ci == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false
+
+      - name: Setup project Bun
+        uses: ./.github/actions/setup-project-bun
+
+      - name: Build, start, and recreate the container
+        run: bun scripts/ci/docker-smoke.ts
+
   npm-global-smoke:
     name: npm-global ${{ matrix.os }}
     needs: changes
@@ -944,7 +1032,7 @@ jobs:
     name: ci
     if: always()
     # Every producer, including the ones that only feed other jobs.
-    needs: [changes, test, storage-policy, api-usage, serial-load-sensitive, publish-test-timings, gates, platform-macos, platform-windows, keyring-smoke, npm-global-smoke]
+    needs: [changes, test, storage-policy, api-usage, serial-load-sensitive, publish-test-timings, gates, platform-macos, platform-macos-full, platform-windows, keyring-smoke, docker-smoke, npm-global-smoke]
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:

.github/workflows/release.yml

@@ -443,6 +443,7 @@ jobs:
           }
 
       - name: Publish (or dry-run)
+        id: publication
         env:
           DRY_RUN: ${{ env.DISPATCH_DRY_RUN }}
           NPM_DIST_TAG: ${{ env.DISPATCH_TAG }}
@@ -461,39 +462,55 @@ jobs:
             npm pack --dry-run
           elif [ "$PUBLISH_NEEDED" != "true" ]; then
             echo "::notice::Exact npm version is already published from ${GITHUB_SHA}; resuming post-publish metadata only"
+            echo "published=true" >> "$GITHUB_OUTPUT"
           elif [ -z "$DISPATCH_CANDIDATE_RUN_ID" ]; then
             echo "::warning::transitional manual release is building locally; migrate this caller to candidate IDs"
             npm publish --tag "$NPM_DIST_TAG" --access public
+            echo "published=true" >> "$GITHUB_OUTPUT"
           elif [ "$DRY_RUN" = "true" ]; then
             echo "::notice::DRY RUN — validating exact candidate tarball, not publishing"
             npm publish "$package_file" --tag "$NPM_DIST_TAG" --access public --ignore-scripts --dry-run
           else
             npm publish "$package_file" --tag "$NPM_DIST_TAG" --access public --ignore-scripts
+            echo "published=true" >> "$GITHUB_OUTPUT"
           fi
 
-      # Confirm the registry actually has the new version (real publishes only).
+      # Publication is acknowledged before registry reads, which can lag or fail.
+      # Recover only observation failures in this run; never retry npm publish.
       - name: Post-publish registry smoke
-        if: ${{ env.DISPATCH_DRY_RUN != 'true' }}
+        id: registry-smoke
+        if: ${{ env.DISPATCH_DRY_RUN != 'true' && steps.publication.outputs.published == 'true' }}
         env:
           RELEASE_VERSION: ${{ env.DISPATCH_VERSION }}
+          PUBLISHED: ${{ steps.publication.outputs.published }}
         run: |
+          set -euo pipefail
+          test "$PUBLISHED" = "true" || {
+            echo "::error::No successful publication receipt; refusing registry recovery"
+            exit 1
+          }
           pkg_name="$(node -p "require('./package.json').name")"
-          for attempt in $(seq 1 30); do
-            if VERSION=$(npm view "${pkg_name}@${RELEASE_VERSION}" version 2>/dev/null); then
+          for attempt in $(seq 1 6); do
+            if VERSION=$(timeout --kill-after=2s 10s npm view "${pkg_name}@${RELEASE_VERSION}" version --fetch-retries=0 --fetch-timeout=8000 2>/dev/null); then
+              if [ "$VERSION" != "$RELEASE_VERSION" ]; then
+                echo "::error::Registry returned an unexpected version; refusing to create a release"
+                exit 1
+              fi
               echo "registry version=$VERSION"
-              test "$VERSION" = "$RELEASE_VERSION"
-              npm dist-tag ls "$pkg_name"
+              echo "verification=verified" >> "$GITHUB_OUTPUT"
+              echo "Registry verified ${pkg_name}@${RELEASE_VERSION}." >> "$GITHUB_STEP_SUMMARY"
+              timeout --kill-after=2s 10s npm dist-tag ls "$pkg_name" --fetch-retries=0 --fetch-timeout=8000 || echo "::warning::Could not read npm dist-tags; exact version was verified"
               exit 0
             fi
-            echo "::notice::${pkg_name}@${RELEASE_VERSION} not visible in npm registry yet (attempt $attempt/30)"
-            sleep 10
+            echo "::notice::Registry lookup not confirmed (attempt $attempt/6)"
+            if [ "$attempt" -lt 6 ]; then sleep 5; fi
           done
-          echo "::error::npm registry smoke failed after 30 attempts"
-          npm view "$pkg_name" versions dist-tags --json || true
-          exit 1
+          echo "verification=pending" >> "$GITHUB_OUTPUT"
+          echo "::warning::npm publish succeeded, but registry verification remains pending; continuing GitHub release creation without republishing"
+          echo "Publication acknowledged for ${pkg_name}@${RELEASE_VERSION}; registry verification pending after bounded reads. Inspect the registry before announcing availability. Do not republish this version." >> "$GITHUB_STEP_SUMMARY"
 
       - name: Create GitHub release
-        if: ${{ env.DISPATCH_DRY_RUN != 'true' }}
+        if: ${{ env.DISPATCH_DRY_RUN != 'true' && steps.publication.outputs.published == 'true' }}
         env:
           GH_TOKEN: ${{ github.token }}
           RELEASE_VERSION: ${{ env.DISPATCH_VERSION }}