37 · Fast pipeline and paused checks

While development moves fast, every push and pull request into testing and main runs the same short set of checks, and production deploys right after them, the way testing always has. The slower suites are paused, not deleted: they live unchanged in .github/workflows/full-checks.yml and run by hand. This page lists what runs, what is paused and how to bring each back.

What runs now

The fast checks are one composite action, .github/actions/fast-checks, used by ci.yml (job Typecheck and unit tests) and test-web.yml (job Web testing checks): pnpm version:check, pnpm db:generate, typechecks of shared-types, hub-api (with its tests), hub-web and the CLI, the CLI channel-isolation tests, focused board, page, comment, morning-brief and session-cookie web tests, the in-memory morning-brief migration/scheduler and signup regressions, page-board, cookie-namespace and production-guard API tests, agent sessions filed in the Claude app's Code tab and the ChatGPT app's sidebar, a deleted project's Codex projects leaving that sidebar and Codex, the testing deploy guard, the release-script tests and the route inventory.

Typecheck and unit tests is the only required status check: on main (branch protection) and on the production branch (ruleset production: only commits that passed CI).

The fast action also runs active-place admission/release/replacement, account isolation and key exemption, field-level save merges/conflicts and the Hub chooser/dialog. API fixtures run serially against in-memory PGlite.

The fast checks also export the public documentation and test its page links, literal extracts, explicit misses and read-only hosted MCP authentication (40). That check does not publish a docs site or change DNS.

Hosted MCP OAuth and named catalog checks run in the same fast action: browser/session/origin/CSRF consent, PKCE and client/resource binding, single-use codes, refresh narrowing and replay, family revocation, a real MCP SDK handshake, legacy tool compatibility, the web consent form, provider returns and Grok Build's native MCP setup command. These use local/in-memory fixtures and no paid model calls (Context Bridge).

Paused

Actions → full-checks → Run workflow runs all of these on any branch.

What this risks: a regression in those areas reaches production unnoticed; a Hub build error shows during deploy.yml, after the API has moved; a sandbox or platform break shows only on a release tag or in use. Run full-checks by hand before a risky change, and the locally runnable suites from AGENTS.md.

Bringing them back

1. Automatic again. Move a job from full-checks.yml back under jobs: in ci.yml (it keeps its name). For the desktop: move desktop-seatbelt back into desktop.yml as seatbelt with its if: ${{ !inputs.recovery_source_run && !inputs.recovery_intel_run }}, and add pull_request: { branches-ignore: [testing] } to its triggers. Rename Full typecheck and all unit tests back to Typecheck and unit tests if it replaces the fast job, or keep both.

2. Required again. Add each job's name on both protections. On main:

   gh api -X PATCH repos/ensemblework/ensemble/branches/main/protection/required_status_checks \
     -F strict=false -f 'contexts[]=Typecheck and unit tests' -f 'contexts[]=hub-api tests (Postgres + Redis)' \
     -f 'contexts[]=CLI tests and package smoke' -f 'contexts[]=agent-runtime tests' \
     -f 'contexts[]=Production builds (Hub and landing)' -f 'contexts[]=Sandbox escapes (macOS Seatbelt)' \
     -f 'contexts[]=Sandbox escapes (Linux Landlock)' -f 'contexts[]=Sandbox escapes (Linux bubblewrap)' \
     -f 'contexts[]=Sandbox escapes (Windows sandbox account)'
   

   On production: Settings → Rules → production: only commits that passed CI → Require status checks to pass, the same names. A name that is required but no longer reported blocks every merge and every deploy, so change the workflow and the protections together.