[codex] Add auto-qa CI tiers

.github/workflows/auto-qa-fork.yml

@@ -0,0 +1,80 @@
+name: auto-qa fork
+
+on:
+  workflow_dispatch:
+    inputs:
+      fork_url:
+        description: 'Override Gnosis fork RPC URL'
+        required: false
+        default: ''
+  schedule:
+    - cron: '37 4 * * 2'
+
+jobs:
+  fork:
+    name: Forked-chain auto-qa
+    runs-on: ubuntu-latest
+    timeout-minutes: 25
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+          cache: 'npm'
+          cache-dependency-path: |
+            package-lock.json
+            auto-qa/harness/package-lock.json
+
+      - name: Install app dependencies
+        run: npm ci
+
+      - name: Install harness dependencies
+        working-directory: auto-qa/harness
+        run: npm ci
+
+      - name: Install Foundry
+        uses: foundry-rs/foundry-toolchain@v1
+        with:
+          version: stable
+
+      - name: Cache Playwright browsers
+        id: playwright-cache
+        uses: actions/cache@v4
+        with:
+          path: ~/.cache/ms-playwright
+          key: ${{ runner.os }}-playwright-${{ hashFiles('auto-qa/harness/package-lock.json') }}
+
+      - name: Install Chromium
+        if: steps.playwright-cache.outputs.cache-hit != 'true'
+        working-directory: auto-qa/harness
+        run: npx playwright install --with-deps chromium
+
+      - name: Install Chromium system dependencies
+        if: steps.playwright-cache.outputs.cache-hit == 'true'
+        working-directory: auto-qa/harness
+        run: npx playwright install-deps chromium
+
+      - name: Run fork tier
+        env:
+          FORK_URL_INPUT: ${{ github.event.inputs.fork_url || '' }}
+          FORK_URL_SECRET: ${{ secrets.GNOSIS_FORK_URL }}
+          HARNESS_ANVIL_LOG: '1'
+        run: |
+          export FORK_URL="${FORK_URL_INPUT:-${FORK_URL_SECRET:-https://rpc.gnosis.gateway.fm}}"
+          npm run auto-qa:harness:fork
+
+      - name: Upload fork artifacts on failure
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: fork-auto-qa-results-${{ github.run_attempt }}
+          path: |
+            auto-qa/harness/playwright-report/
+            auto-qa/harness/test-results/
+            /tmp/anvil-harness.log
+          retention-days: 14
+          if-no-files-found: ignore

.github/workflows/auto-qa-interactions.yml

@@ -0,0 +1,85 @@
+name: auto-qa interactions
+
+on:
+  pull_request:
+    paths:
+      - '.github/workflows/auto-qa-interactions.yml'
+      - 'auto-qa/harness/**'
+      - 'app/**'
+      - 'src/**'
+      - 'public/**'
+      - 'package.json'
+      - 'package-lock.json'
+      - 'next.config.mjs'
+      - 'tailwind.config.js'
+  push:
+    branches:
+      - main
+    paths:
+      - '.github/workflows/auto-qa-interactions.yml'
+      - 'auto-qa/harness/**'
+      - 'app/**'
+      - 'src/**'
+      - 'public/**'
+      - 'package.json'
+      - 'package-lock.json'
+      - 'next.config.mjs'
+      - 'tailwind.config.js'
+  workflow_dispatch:
+
+jobs:
+  interaction:
+    name: Browser interaction auto-qa
+    runs-on: ubuntu-latest
+    timeout-minutes: 12
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+          cache: 'npm'
+          cache-dependency-path: |
+            package-lock.json
+            auto-qa/harness/package-lock.json
+
+      - name: Install app dependencies
+        run: npm ci
+
+      - name: Install harness dependencies
+        working-directory: auto-qa/harness
+        run: npm ci
+
+      - name: Cache Playwright browsers
+        id: playwright-cache
+        uses: actions/cache@v4
+        with:
+          path: ~/.cache/ms-playwright
+          key: ${{ runner.os }}-playwright-${{ hashFiles('auto-qa/harness/package-lock.json') }}
+
+      - name: Install Chromium
+        if: steps.playwright-cache.outputs.cache-hit != 'true'
+        working-directory: auto-qa/harness
+        run: npx playwright install --with-deps chromium
+
+      - name: Install Chromium system dependencies
+        if: steps.playwright-cache.outputs.cache-hit == 'true'
+        working-directory: auto-qa/harness
+        run: npx playwright install-deps chromium
+
+      - name: Run browser interaction tier
+        run: npm run auto-qa:harness:interaction
+
+      - name: Upload Playwright artifacts on failure
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: playwright-interaction-results-${{ github.run_attempt }}
+          path: |
+            auto-qa/harness/playwright-report/
+            auto-qa/harness/test-results/
+          retention-days: 14
+          if-no-files-found: ignore

.github/workflows/auto-qa.yml

@@ -5,6 +5,8 @@ on:
     paths:
       - '.github/workflows/auto-qa.yml'
       - '.github/workflows/auto-qa-live.yml'
+      - '.github/workflows/auto-qa-interactions.yml'
+      - '.github/workflows/auto-qa-fork.yml'
       - 'auto-qa/**'
       - 'package.json'
       - 'src/utils/proposalLifecycle.js'
@@ -14,6 +16,8 @@ on:
     paths:
       - '.github/workflows/auto-qa.yml'
       - '.github/workflows/auto-qa-live.yml'
+      - '.github/workflows/auto-qa-interactions.yml'
+      - '.github/workflows/auto-qa-fork.yml'
       - 'auto-qa/**'
       - 'package.json'
       - 'src/utils/proposalLifecycle.js'
@@ -23,7 +27,7 @@ jobs:
   unit:
     name: Deterministic auto-qa
     runs-on: ubuntu-latest
-    timeout-minutes: 5
+    timeout-minutes: 8
 
     steps:
       - name: Checkout
@@ -33,6 +37,15 @@ jobs:
         uses: actions/setup-node@v4
         with:
           node-version: '22'
+          cache: 'npm'
+          cache-dependency-path: auto-qa/harness/package-lock.json
+
+      - name: Install harness dependencies
+        working-directory: auto-qa/harness
+        run: npm ci
 
       - name: Run deterministic auto-qa tests
         run: npm run auto-qa:test:unit
+
+      - name: Run deterministic harness checks
+        run: npm run auto-qa:harness:unit

auto-qa/README.md

@@ -1,19 +1,41 @@
 # Auto-QA
 
-This directory is split into CI tiers by flakiness and external dependencies.
+This directory is split into explicit CI tiers so each check has a clear
+runtime and dependency profile.
 
 ## Deterministic Unit Tier
 
 Run:
 
 ```sh
 npm run auto-qa:test:unit
+npm run auto-qa:harness:unit
 ```
 
-Files live under `auto-qa/tests/`. These tests must not call live services,
-start browsers, start an Anvil fork, or submit transactions. They are allowed
-to inspect local source files and run local Node helper scripts. This tier is
-safe for pull-request CI and is also what `npm run auto-qa:test` runs.
+Files live under `auto-qa/tests/` and `auto-qa/harness/tests/`. These tests must
+not call live services, start browsers, start an Anvil fork, or submit
+transactions. They inspect local source files, local fixtures, and generated
+catalogs only.
+
+GitHub runs this tier on pull requests and pushes to `main` in
+`.github/workflows/auto-qa.yml`.
+
+## Browser Interaction Tier
+
+Run:
+
+```sh
+npm run auto-qa:harness:interaction
+```
+
+This tier runs Playwright against the local Next app with mocked network data
+and the wallet stub. It is for real browser interactions such as keyboard
+navigation, focus handling, and modal behavior. It does not start Anvil and does
+not submit transactions.
+
+Scenarios opt into this tier with `ciTiers: ['interaction']`. GitHub runs it on
+pull requests and pushes to `main` in
+`.github/workflows/auto-qa-interactions.yml`.
 
 ## Live Network Tier
 
@@ -24,14 +46,40 @@ npm run auto-qa:test:live
 ```
 
 Files live under `auto-qa/live/`. These tests may call public Futarchy
-endpoints and should skip when the network is unavailable. They are useful for
-catching endpoint drift, but they are intentionally excluded from pull-request
-CI. GitHub runs them only by manual dispatch or on the nightly schedule in
-`.github/workflows/auto-qa-live.yml`.
+endpoints and should skip when the network is unavailable. They catch endpoint
+drift, but they are intentionally excluded from pull-request CI.
+
+GitHub runs this tier only by manual dispatch or on the weekly Monday schedule
+in `.github/workflows/auto-qa-live.yml`.
+
+## Forked-Chain Tier
 
-## Forked Browser Harness
+Run:
+
+```sh
+npm run auto-qa:harness:fork
+```
+
+This tier runs Playwright scenarios against a local Anvil fork. It may submit
+transactions to that local fork, but it must not submit real network writes.
+Scenarios join this tier with `ciTiers: ['fork']` and must also declare
+`requiresAnvil` or `useAnvilRpcProxy`.
+
+GitHub runs this tier only by manual dispatch or on the weekly Tuesday schedule
+in `.github/workflows/auto-qa-fork.yml`. The workflow uses `FORK_URL` from the
+manual input, `GNOSIS_FORK_URL`, or the public Gnosis RPC fallback.
+
+## Promoting Scenarios
+
+New scenarios should start unassigned unless they are intentionally part of a
+CI tier. Before promotion, run:
+
+```sh
+npm run auto-qa:harness:scenarios:by-tier
+npm run auto-qa:harness:scenarios:catalog
+```
 
-The larger Playwright and Anvil replay harness from the experimental
-`auto-qa` branch is not part of this tier. Forked-chain reads, writes, browser
-scenarios, and catalog drift checks need their own explicit workflow once they
-are cleaned up and separated from live-write tests.
+Promote stable browser-only scenarios with `ciTiers: ['interaction']`. Promote
+stable forked scenarios with both `ciTiers: ['fork']` and an Anvil requirement
+on the scenario itself. Keep live endpoint checks in `auto-qa/live/`; they
+remain weekly/manual unless we explicitly decide to make a live check blocking.

auto-qa/harness/.gitignore

@@ -0,0 +1,29 @@
+# Local node deps (we keep harness deps separate from the interface repo deps)
+node_modules/
+
+# Playwright artifacts
+.playwright/
+playwright-report/
+playwright-prod-report/
+test-results/
+*.video
+*.trace.zip
+*.har
+
+# Browser binaries (Playwright pulls them on install)
+.browsers/
+
+# Local Next.js dev server state when run from harness
+.next-harness/
+
+# Local wallet keys for the harness (anvil dev keys; never real)
+.wallet-state/
+
+# Step 7: cross-process channel for the active anvil snapshot ID
+# (globalSetup writes; per-scenario beforeEach reads + rewrites).
+# Ephemeral; regenerated on every test run.
+.fork-snapshot-id
+
+# Editor / OS
+.DS_Store
+*.log