FE-1266: Skip comparison oracles for non-runtime PRs

.changeset/afraid-weeks-knock.md

@@ -0,0 +1,2 @@
+---
+---

.github/workflows/test.yml

@@ -28,6 +28,14 @@ jobs:
           node-version: 24
           cache: npm
 
+      - name: Select test lanes
+        id: test-lanes
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          HEAD_SHA: ${{ github.sha }}
+        run: node scripts/ci-test-lanes.mjs
+
       - name: Configure git identity
         # The current slow tests in test:full create real repositories and commits.
         run: |
@@ -55,8 +63,12 @@ jobs:
       - name: Check (read-only lint + format + skills)
         run: npm run check
 
-      - name: Test (full suite incl. slow tests)
-        run: npm run test:full
+      - name: Test (default + non-comparison slow)
+        run: npm run test && npm run test:slow:core
+
+      - name: Test (expensive comparison oracles)
+        if: steps.test-lanes.outputs.comparison == 'true'
+        run: npm run test:comparison
 
       - name: Build
         run: npm run build

AGENTS.md

@@ -94,13 +94,13 @@ Frontier-item traceability, scope-card inheritance, and the verification-ownersh
 
 ## verification
 
-**Defaults are fast; the real full gate is CI.** `npm run test` and `npm run verify` deliberately exclude `*.slow.test.ts` so the everyday loop stays quick. A test earns the `.slow` marker only when its execution cost warrants exclusion from routine local verification — never merely because it is inconvenient or flaky. The `.github/workflows/test.yml` **Test** workflow runs the *full* suite (`test:full`, including slow tests) plus `check` and `build` on every PR and merge-queue entry — that is the authoritative gate, not the local pre-commit run. Run the `:full` variant locally only when you have a reason to (below).
+**Defaults are fast; the real full gate is CI.** `npm run test` and `npm run verify` deliberately exclude `*.slow.test.ts` so the everyday loop stays quick. A test earns the `.slow` marker only when its execution cost warrants exclusion from routine local verification — never merely because it is inconvenient or flaky. The `.github/workflows/test.yml` **Test** workflow always runs `check`, `build`, default tests, and non-comparison slow tests under one stable `Full gate` check. Expensive comparison oracles may be omitted only for a complete pull-request diff wholly inside the closed non-runtime allowlist; unknown evidence runs them, and merge-queue entries always run the full suite. CI remains the authoritative gate, not the local pre-commit run.
 
 **Inner loop** (run after every meaningful edit): `npm run fix` — lint:fix then format. Run focused tests with `npm test -- <test-path>` while iterating.
 
 **Checkpoint / pre-commit** (fast, the default): `npm run verify` — fix → default tests → build. The default suite excludes `*.slow.test.ts`. This is the routine local gate.
 
-**Full gate** (locally optional; CI always runs it): `npm run verify:full` — fix → all tests (incl. slow tests) → build. Run it locally when you have changed a slow test or the production seam it witnesses — currently host landing, slice integration, run promotion, or worktree behavior — otherwise let CI run it. `npm run test:slow` runs just the slow group when that is all you need.
+**Full gate** (locally optional; merge-queue CI always runs it): `npm run verify:full` — fix → all tests (incl. slow tests) → build. Run it locally when you have changed a slow test or the production seam it witnesses — currently host landing, slice integration, run promotion, worktree behavior, or comparison-controller behavior — otherwise let CI run it. `npm run test:slow` runs the core-slow and comparison lanes; use `test:slow:core` or `test:comparison` for one lane.
 
 **PR release intent** (required for ordinary PRs into `next`): before submit or update, run `npx changeset status --since=origin/next`. If the published package changes, run `npm run changeset`; otherwise record the no-release decision with `npm run changeset -- --empty`. Commit the generated `.changeset/*.md` file. The local verify commands do not cover this base-aware CI check.
 
@@ -115,9 +115,11 @@ Frontier-item traceability, scope-card inheritance, and the verification-ownersh
 | `npm run fix` | lint:fix → fmt | yes |
 | `npm run test` | all Vitest tests except `*.slow.test.ts` | no |
 | `npm run test:full` | all Vitest tests incl. slow tests | no |
-| `npm run test:slow` | just `*.slow.test.ts` | no |
+| `npm run test:slow` | core-slow → comparison | no |
+| `npm run test:slow:core` | slow tests except expensive comparison oracles | no |
+| `npm run test:comparison` | expensive full-stack comparison oracles | no |
 | `npm run verify` | fix → test → build (fast default) | yes (via fix) |
-| `npm run verify:full` | fix → test:full → build (full gate; CI runs this) | yes (via fix) |
+| `npm run verify:full` | fix → test:full → build (full local/merge-queue gate) | yes (via fix) |
 | `npm run check` | lint → fmt:check → check:markdown-links → check:skills → check:promoted-run-paths | no |
 | `npm run check:markdown-links` | remark-validate-links over Markdown files | no |
 | `npm run check:skills` | ln-* skill consistency | no |

CONTRIBUTING.md

@@ -66,12 +66,14 @@ Brunch stores local runtime state under the target workspace's `.brunch/` direct
 | `npm run dev` | Run the Brunch CLI directly from source. Defaults to `--mode tui`. |
 | `npm run dev-cli` | Select/create a temporary, named, existing, or seed-derived dev instance. |
 | `npm run test` | Run Vitest once (fast default; excludes `*.slow.test.ts`). |
-| `npm run test:slow` | Run only `*.slow.test.ts`. |
+| `npm run test:slow` | Run core-slow tests followed by expensive comparison oracles. |
+| `npm run test:slow:core` | Run slow tests except the expensive comparison oracles. |
+| `npm run test:comparison` | Run the expensive full-stack comparison oracles. |
 | `npm run test:full` | Run every Vitest test, including slow tests. |
 | `npm run fix` | Apply lint fixes, then format. |
 | `npm run check` | Read-only lint + format check. |
 | `npm run verify` | Fast local checkpoint: fix → test → build. Routine pre-commit run. |
-| `npm run verify:full` | Full gate: fix → test:full → build. CI runs this on every PR; run it locally only when you touch host landing, slice integration, run promotion, or worktree behavior. |
+| `npm run verify:full` | Full local gate: fix → test:full → build. Merge-queue CI always runs it; pull requests may omit only expensive comparison oracles for a closed non-runtime-only diff. |
 | `npm run build` | Build TypeScript, packaged Pi assets, and the web bundle. |
 | `npm run seed -- --workspace <dir> --seed <set>/<slug>` | Seed a workspace from `.fixtures/seeds`. |
 | `npm run db:generate` | Generate Drizzle migrations. |

memory/SPEC.md

@@ -318,6 +318,7 @@ The POC's purpose is to prove three things: (a) that pi's coding-agent harness c
 | D100-L | `project` is a distinct first-level live Specify-mode skill home for cross-plane derivation, not a `generate` sub-mode. `generate` fans out alternatives within a target plane from context; `project` starts from accepted upstream graph anchors and derives downstream plane candidates/drafts plus connecting edge intent. It uses the existing structured-exchange offer/terminal seams (`present_candidates`, `present_review_set`, and their declared `ask` continuations per D116-L) and hands exact graph expression back to `map` / review-set commitment; it adds no product tool, exchange schema family, or direct graph-write path. Depends on: D95-L, D96-L, D97-L, I51-L. | [`src/agents/skills/TOPOLOGY.md`](../src/agents/skills/TOPOLOGY.md), [`src/agents/subagents/TOPOLOGY.md`](../src/agents/subagents/TOPOLOGY.md)                                                                                                                                                                                                                   | active            |
 
 | D139-L | FE-1253 admits the prospect research workspace as a deterministic greenfield execution regression case, not a second end-to-end campaign profile. Its public contract fixes one npm repository with a React/TypeScript frontend, Node.js/TypeScript backend, SQLite persistence, `npm test` / `npm run build` / `npm start`, environment-addressed port/database/fixture paths, a health endpoint, accessible mechanical controls, package-registry-only install, and denied runtime network. Pi-compatible qualification and Clay-compatible research are server-side interfaces exercised through controller-owned deterministic local fixtures; live provider quality is not scored. The saved mission remains available for exploratory specification work, while a future crossed campaign requires a separate explicit study contract. Supersedes FE-1253's unexecuted 2×2 campaign expansion. Depends on: D70-L, FE-1230, FE-1241. | [`src/dev/TOPOLOGY.md`](../src/dev/TOPOLOGY.md); PLAN `prospect-research-workspace-regression`; `testing/comparisons/missions/prospect-research-workspace.md`; `testing/execution-comparisons/cases/prospect-research-workspace/` | active — deterministic full-stack oracle calibrated; campaign expansion retired |
+| D1-K | CI verification is event- and evidence-tiered: local `test:full` and every merge-group candidate run every retained test, while a pull-request event may omit only the expensive comparison-oracle lane and only when a closed non-runtime path allowlist proves the complete diff cannot affect shipped runtime, build/test infrastructure, or comparison-controller behavior. Missing, incomplete, unknown, or non-allowlisted diff evidence fails open to the comparison lane. Static checks, build, default tests, and non-comparison slow tests remain mandatory, and one stable `Full gate` status remains the branch-protection surface. No oracle, known-good fixture, or contrastive rival is deleted by this scheduling decision. Depends on: D68-L, D136-L, D139-L. | [`memory/cards/tooling--conditional-comparison-gate.md`](cards/tooling--conditional-comparison-gate.md); `.github/workflows/test.yml` | active — materialized 2026-07-24; outer CI witness pending |
 
 ### Critical Invariants
 
@@ -714,9 +715,11 @@ The verification harness is established (oxlint + oxfmt + vitest). Commands foll
 | 1    | Lint:fix + format (inner loop, writes)                  | `npm run fix`                                 |
 | 2    | Lint + format check (no writes; CI use)                 | `npm run check`                               |
 | 3    | Default tests (excludes `*.slow.test.ts`)              | `npm run test`                                |
-| 4    | Slow tests                                               | `npm run test:slow`                           |
-| 5    | All tests (incl. slow tests)                             | `npm run test:full`                           |
-| 6    | Build                                                   | `npm run build`                               |
+| 4    | Non-comparison slow tests                                | `npm run test:slow:core`                      |
+| 5    | Expensive comparison oracles                             | `npm run test:comparison`                     |
+| 6    | All slow tests                                           | `npm run test:slow`                           |
+| 7    | All tests (incl. slow tests)                             | `npm run test:full`                           |
+| 8    | Build                                                   | `npm run build`                               |
 | fast | Local checkpoint / pre-commit (writes via `fix`)        | `npm run verify` (= fix + test + build)       |
 | full | Full gate (writes via `fix`; CI runs this)              | `npm run verify:full` (= fix + all + build)   |
 | —    | Release-pack smoke (pre-publish only)                   | `npm run check:release-pack`                  |
@@ -729,7 +732,7 @@ The release-pack smoke is deliberately outside `verify` (it packs, asserts runti
 
 - **Inner loop:** run `npm run fix` after every meaningful edit and focused tests with `npm test -- <test-path>` while iterating. Tooling: oxlint (lint + type-aware + type-check via tsgolint), oxfmt (format), vitest (test). See AGENTS.md.
 - **Local checkpoint (fast default):** `npm run verify` runs every test except `*.slow.test.ts`, then builds. A test earns the `.slow` marker only when its execution cost warrants exclusion from routine local verification — never merely because it is inconvenient or flaky. The checkpoint shortens development feedback without weakening the authoritative gate, which is CI.
-- **Full gate:** the `.github/workflows/test.yml` **Test** workflow runs `npm run test:full` (all tests, incl. slow tests) plus `check` and `build` on every PR and merge-queue entry — this is the authoritative gate. Run `npm run verify:full` locally when you have changed a slow test or the production seam it witnesses (currently host landing, slice integration, run promotion, or worktree behavior); otherwise let CI run it. `npm run test:slow` runs just the slow group. Remaining failures must be fixed before proceeding. No override.
+- **Full gate authority:** `npm run test:full` continues to mean every retained test and runs unconditionally for merge-group candidates. Under D1-K, pull-request events keep `check`, `build`, default tests, and non-comparison slow tests mandatory; they may omit only the expensive comparison-oracle lane and only for a complete diff wholly inside a closed non-runtime allowlist. Unknown or incomplete evidence runs comparison tests. One stable `Full gate` check remains authoritative, and no failure may be overridden. Run `npm run verify:full` locally when you have changed a slow test or the production seam it witnesses; otherwise let CI own the full pre-merge run.
 - **Failure protocol:** stop on first failure; the failure becomes the must-fix task; re-run the stack from step 1; only proceed when all checks pass.
 - **Frontier completion:** manual smoke can prove presentation life, but any durable product claim must also have an artifact/query oracle, property/round-trip test, contract test, or fixture assertion tied to the canonical store or projection handler that owns the fact.
 - **Harness/probe JSONL architecture:** the POC uses Tier-1/Tier-2 faux harnesses plus JSONL-backed probe runs as the current verification artifact model. Committed probe evidence lives under `.fixtures/runs/<probe-id>/<run-id>/` with colocated `session.jsonl` and `report.json`; human-readable transcript rendering is a workspace-local `.brunch/debug/transcript.md` affordance for faux-harness/debug runs, not a default committed probe artifact. Brief-based golden fixtures are deferred; if they return, briefs are harness/probe inputs and the resulting JSONL-backed run is canonical. The debug transcript renderer uses Pi's canonical context construction, then keeps only user messages, assistant messages, and Brunch-owned custom tool results.