timeout-minutes: 60

strategy:

fail-fast: false

matrix: ${{ fromJson(needs.preflight.outputs.checks_fast_core_matrix) }}

steps:

- name: Checkout

timeout-minutes: 60

strategy:

fail-fast: false

matrix: ${{ fromJson(needs.preflight.outputs.plugin_contracts_matrix) }}

steps:

- name: Checkout

timeout-minutes: 60

strategy:

fail-fast: false

matrix: ${{ fromJson(needs.preflight.outputs.channel_contracts_matrix) }}

steps:

- name: Checkout

strategy:

fail-fast: false

# The canonical main path waits for the admission debounce above, so

matrix: ${{ fromJson(needs.preflight.outputs.checks_node_core_nondist_matrix) }}

steps:

- name: Checkout

timeout-minutes: 20

strategy:

fail-fast: false

matrix:

include:

- check_name: check-guards

timeout-minutes: 20

strategy:

fail-fast: false

matrix:

include:

- check_name: check-additional-boundaries-a

The slowest Node test families are split or balanced so each job stays small without over-reserving runners: plugin contracts and channel contracts each run as two weighted Blacksmith-backed shards with the standard GitHub runner fallback, core unit fast/support lanes run separately, core runtime infra is split between state, process/config, shared, and three cron domain shards, auto-reply runs as balanced workers (with the reply subtree split into agent-runner, dispatch, and commands/state-routing shards), and agentic gateway/server configs are split across chat/auth/model/http-plugin/runtime/startup lanes instead of waiting on built artifacts. Normal CI then packs only isolated infra include-pattern shards into deterministic bundles of at most 64 test files, reducing the Node matrix without merging non-isolated command/cron, stateful agents-core, or gateway/server suites; heavy fixed suites stay on 8 vCPU while the bundled and lower-weight lanes use 4 vCPU. Pull requests on the canonical repository use an additional compact admission plan: the same per-config groups run in isolated subprocesses inside the current 34-job Linux Node plan, so a single PR does not register the full 70-plus-job Node matrix. `main` pushes, manual dispatches, and release gates retain the full matrix. Broad browser, QA, media, and miscellaneous plugin tests use their dedicated Vitest configs instead of the shared plugin catch-all. Include-pattern shards record timing entries using the CI shard name, so `.artifacts/vitest-shard-timings.json` can distinguish a whole config from a filtered shard. `check-additional-*` keeps package-boundary compile/canary work together and separates runtime topology architecture from gateway watch coverage; the boundary guard list is striped into one prompt-heavy shard and one combined shard for the remaining guard stripes, each running selected independent guards concurrently and printing per-check timings. The expensive Codex happy-path prompt snapshot drift check runs as its own additional job for manual CI and for prompt-affecting changes only, so normal unrelated Node changes do not wait behind cold prompt snapshot generation and the boundary shards stay balanced while prompt drift is still pinned to the PR that caused it; the same flag skips prompt snapshot Vitest generation inside the built-artifact core support-boundary shard. Gateway watch, channel tests, and the core support-boundary shard run concurrently inside `build-artifacts` after `dist/` and `dist-runtime/` are already built.

The compact PR plan emits 18 Node jobs for the current suite: whole-config

groups are batched in isolated subprocesses with a 120-minute batch timeout,

Treat Blacksmith labels as the scarce resource for burst control. Jobs that

only route, notify, summarize, select shards, or run short CodeQL scans should

stay on GitHub-hosted runners unless they have measured Blacksmith-specific

needs. Any new Blacksmith matrix, larger `max-parallel`, or high-frequency

workflow must show its worst-case registration count and keep the org-level

repositories and retried jobs.

Canonical-repo CI keeps Blacksmith as the default runner path for normal push and pull-request runs. `workflow_dispatch` and non-canonical repository runs use GitHub-hosted runners, but normal canonical runs do not currently probe Blacksmith queue health or automatically fall back to GitHub-hosted labels when Blacksmith is unavailable.

expect(workflow.concurrency["cancel-in-progress"]).toContain(

"github.event_name == 'pull_request'",

);

expect(workflow.jobs["checks-windows"].strategy["max-parallel"]).toBe(2);

expect(workflow.jobs.android.strategy["max-parallel"]).toBe(2);

});