[zpyoung]

ELI5

This fork ran a large stack of automated checks on every pull request, plus about 25 separate test workflows on schedules and pushes. Most of that guards upstream behavior the fork doesn't change. This PR cuts the PR checks down to the ones that catch real fork breakage, and turns off the standalone test workflows.

What Changed

PR Checks (.github/workflows/pr.yml)

Before, a code PR ran 15 jobs. After, it runs these 7:

• code_paths (change detection)
• fork_ownership_guard
• preflight
• test and unit_selection_evidence
• cross-version-wire
• verify (the required "PR checks passed" gate)

I removed these jobs: git_compatibility, codex_index_heal_contract, xterm_patch_sync, shell_contracts, mobile_web_app, managed_hook_node18, package, e2e, layout_oracle and terminal_ime_native. The orcad browser contract inside test (browser_contract) is gone too.

preflight now runs:

• checkout and dependency setup, plus Bun (the localization checks need it)
• Lint
• Typecheck, still split into the same waves by typecheck:ci
• the bundled skill guide, skill freshness manifest and localization catalog checks
• unit selection planning and its artifact upload, because test reads the plan

I dropped every ratchet and contract check from preflight. That covers the ones in the plan, plus the unnamed ones that went with them: process-host imports, main-sync-spawn, focus-read, layout-writer, deprecated runtime-owner, path-literal, worktree-id composer, e2e typecheck and legacy relay fence. It also covers the locked audit tools check (React Doctor's tooling) and the mobile dependency install that only the changed-code quality gate used.

verify now needs only the kept jobs, and its env block and check_job calls match. The fork_ownership_guard hard check is unchanged. I also removed the code_paths outputs that nothing reads anymore, along with the E2E spec filter step that produced them.

Dependencies I kept on purpose

• "Test Mobile CI tools and runtime routing" stays in preflight. When a PR only touches mobile CI tooling, test skips its shards (run_shards: mobile_ci_tools != 'true') and relies on this step. Without the step, those PRs would run no unit tests at all.
• Both guarded dependency installs stay as they were, since they're setup.

layout_oracle is gone. It wasn't in the keep list. It runs E2E specs through e2e.yml, which is now disabled.

Deleted upstream contract tests

Thirteen upstream config/scripts/*.test.mjs files assert the job graph and preflight steps this PR removes, and 54 of their tests failed against the trimmed pr.yml. I deleted them and declared each one in config/fork-ownership.json as a deleted permanent exception, so the next sync won't bring them back. The fork already does this for the tests of the removed Windows PR jobs.

check-node-runtime-pin ci-e2e-job-selection ci-unit-exclusion-coverage
localization-extraction-change-scope orcad-terminal-smoke-change-scope
pr-auxiliary-preflight-admission pr-code-change-scope pr-e2e-gate-contract
pr-e2e-route-contracts pr-preflight-gates pr-ready-check-reuse pr-workflow-parallelism
linux-package-fixture-cache

Two fork-owned tests also read the removed jobs, so I edited them in place. run-sandboxed-test-shards.test.mjs now checks the sandbox shell lane's own spec list instead of comparing it with pr.yml's shell_contracts job. In ci-dependency-download-cache.test.mjs I dropped the one test that matched release-cut's cache against the removed package job.

Two of these files carried fork seams, so I removed those seams and their residual budgets from the manifest. I also deleted fork-ownership-guard/pr-workflow-contract.mjs, because pr-ready-check-reuse.test.mjs was the only file that imported it.

This drops some assertions that still passed, most of them pr-code-change-scope's classifier tests. It also means 27 unit files that the sharded run excludes now run in no gating job: the shell contract, Git compatibility and Codex contract suites. ci-unit-exclusion-coverage was the test that flagged this.

Disabled standalone workflows

These 27 are disabled through gh workflow disable. No files were edited or deleted, so the next upstream sync won't put anything back.

computer-e2e mobile macos-updater-tests skill-update-roundtrip ssh-hostile-hosts
ssh-windows-hosts win-orcad-serve-switch-e2e win-update-e2e win-update-survival-e2e
pi-owner-runtime pi-provider-runtime performance-contracts pr-test-loc
release-javascript-benchmark git-command-termination-runtime preflight-cli-platforms
ci-pnpm-verification-pilot cloud-verify node-next-compat cloud-power-relay-staging
cloud-monitor-relay-clock-skew daemon-relocation-spike e2e packaged-browser-e2e
terminal-ime-e2e ci-closed-pr-caches

terminal-perf was already disabled before this change.

ci-closed-pr-caches ("Clean obsolete PR work") isn't a test. It cancels a PR's superseded runs. It asks for a Blacksmith runner the fork doesn't have, so every run since 2026-10-19 19:02Z sat queued as a pending clean check. I cancelled the 7 queued runs.

Still enabled: node-server-tests.yml. release-cut.yml and the daily, hourly and adhoc mac build workflows call it as a reusable workflow. GitHub's docs don't say whether disabling a workflow blocks workflow_call, so I didn't risk breaking releases.

To re-enable everything:

for f in computer-e2e mobile macos-updater-tests skill-update-roundtrip ssh-hostile-hosts ssh-windows-hosts win-orcad-serve-switch-e2e win-update-e2e win-update-survival-e2e pi-owner-runtime pi-provider-runtime performance-contracts pr-test-loc release-javascript-benchmark git-command-termination-runtime preflight-cli-platforms ci-pnpm-verification-pilot cloud-verify node-next-compat cloud-power-relay-staging cloud-monitor-relay-clock-skew daemon-relocation-spike e2e packaged-browser-e2e terminal-ime-e2e ci-closed-pr-caches; do gh workflow enable "$f.yml" --repo zpyoung/orca; done

Why

Most of the removed jobs exercise upstream subsystems: real Git versions, pinned Codex binaries, xterm patches, Linux packaging, E2E. The fork rarely touches any of them, and they cost runner time and red-check noise on every PR. Lint, typecheck, unit tests, the wire-compat journeys and the ownership guard still catch the breakage fork changes actually cause.

I edited pr.yml directly because it's already a permanent fork exception in config/fork-ownership.json, so the next sync keeps these changes. The only manifest change covers the deleted contract tests. For the standalone workflows I used gh workflow disable instead of editing them, because they're upstream-owned and a sync would restore any edit or deletion. Disabling also reverses with one command.

Linked Issue

N/A, fork maintenance.

Visual Proof

N/A. This is a CI workflow change with no app behavior change.

Testing

• Parsed the trimmed pr.yml with python3 (actionlint isn't installed here). Every needs.X reference resolves to a remaining job, every wait: names a remaining step, and every remaining code_paths output has a reader (except reused_run_id, which had none before this change either).

• Ran all 32 test files that read pr.yml on the remote test sandbox. The 12 deleted files account for every failure caused by this change. required-pr-check-name also failed there, but only because Bun's postinstall didn't run in the sandbox.

• node .github/scripts/check-fork-ownership.mjs origin/main HEAD passes.

• This PR runs the trimmed pr.yml itself, so its own checks exercise the new graph.

• I manually tested these changes locally

• Automated tests added/updated, or explained why not below

The change is workflow-only. Several upstream config/scripts/*.test.mjs suites parse pr.yml, and this PR's test job runs them.

AI Disclosure

Claude (claude-opus-5-5) via Claude Code.

Review

Agent skill upstream boundary

• Not applicable, or this change copies or mechanically translates no upstream skill-installer source, tests, fixtures, registry entries, path tables, comments, or documentation.

Notes

No app runtime change. That covers security, cross-platform, SSH, mobile and backwards compatibility. Coverage on those paths is lower now: Windows, SSH and packaging regressions will surface later, in release builds or user reports.

Other open PRs still run main's old pr.yml until this merges, and its layout_oracle job calls the now-disabled e2e.yml. If GitHub won't run a disabled workflow when another workflow calls it, those PRs' verify will fail until they pick up this change.

Checklist

• This PR is small and focused
• I explained what changed and why (ELI5, the user-facing before/after, the mechanism, and why over the alternatives)
• Before/after screenshots or videos attached for UI changes, or N/A with reason
• Self-reviewed for correctness, security, and performance
• Cross-platform, SSH/remote, and path/shortcut impact considered (or N/A)
• pnpm lint, pnpm typecheck, pnpm test, and pnpm build pass (or CI will cover; local preferred)

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[greptile-apps]

Your trial has ended. Reactivate Greptile to resume code reviews.