ci: push-to-main runs the full gate (== local full gate), not only nightly

Smell-audited: 2: ADR-0107 revision. CI mirrored the local batched-full-gate
cadence too literally — fast CORE (no e2e) on push-to-main, the full e2e suite
only on the nightly schedule. So a shared-code change that broke an e2e step
other than the changed step's own smoke sat on main until the next nightly: the
D-316 def-meta case failed four nightlies before it surfaced, making CI the
late detector and leaving "the local full gate" and "CI" inconsistent. Now
every event except pull_request sets CLJW_CI_FULL=1 (the full e2e gate =
test/run_all.sh --serial-e2e, exactly the local full gate); PR stays fast CORE
for iteration, and its merge fires a push event that runs the full gate before
it lands. The heavier tree_walk parity sweep (a second ReleaseSafe rebuild, not
part of the local full gate) split onto its own CLJW_CI_PARITY flag,
nightly/dispatch-only, so it is an extra backstop rather than push-vs-local
drift. concurrency: cancel-in-progress bounds a rapid push burst to one
completing full run. Devil's-advocate not forked: this reduces (never expands)
the CI trust gap and introduces no new F-NNN-touching surface.

Author: chaploud

.dev/decisions/0107_pipeline_gate_smoke_authorized.md

@@ -186,3 +186,30 @@ background machinery. Adopted.
 the two-tier policy is required for consistency but is **permission-blocked for
 the autonomous loop**. Surfaced to the user. The scripts + this ADR carry the
 enforceable policy in the meantime.
+
+## Revision history
+
+### 2026-07-21 — CI runs the full gate on push-to-main (not just nightly)
+
+The batched-full-gate cadence above is a *local* discipline. CI had mirrored it
+too literally: `.github/workflows/ci.yml` ran the fast CORE tier (`--smoke`, **no
+e2e**) on both PR *and* push-to-main, and the full e2e suite only on the nightly
+schedule. So a shared-code change that broke an e2e step (not the changed step's
+own smoke) passed the push CI and sat on `main` until the next nightly failed —
+observed as the D-316 `def`-meta change breaking `phase14_var_metadata.sh`, which
+failed four consecutive nightlies (2026-07-18..21) before being caught. That
+made CI the *late* detector and left "the local full gate" and "CI" inconsistent.
+
+Fix: **push-to-main now runs the FULL gate** (`CLJW_CI_FULL=1` for every event
+except `pull_request`), so every landed commit is e2e-verified by exactly the
+local full gate (`test/run_all.sh --serial-e2e`). PR stays fast CORE for
+iteration (its merge fires a push event that runs the full gate before it
+lands). The heavier non-default-backend (tree_walk) parity sweep — a second
+ReleaseSafe rebuild, **not** part of the local full gate — moved to its own
+`CLJW_CI_PARITY` flag and stays nightly/dispatch-only, so it is an extra backstop
+rather than a source of push-vs-local drift. `concurrency: cancel-in-progress`
+already collapses a rapid push burst to one completing full run, so the added
+per-push cost is bounded.
+
+Affected: `.github/workflows/ci.yml` (event→flag mapping), `scripts/ci_gate.sh`
+(the parity sweep split onto `CLJW_CI_PARITY`).

.github/workflows/ci.yml

@@ -7,11 +7,13 @@
 # (preinstalled on GitHub runners); `zig build -Dwasm` fetches the embedded
 # zwasm engine + the zlinter dev-dep from git over the network.
 #
-# Two-tier, matching the local ADR-0107 (smoke per commit, full batched) +
-# ADR-0049 (the Linux full gate is batched, not per-commit) disciplines so CI is
-# not wasteful:
-#   push to main / PR → fast CORE (units + F-012 diff oracle, no e2e shell suite).
-#   nightly schedule / manual dispatch → FULL gate (+ every e2e step).
+# Tiered (ADR-0107, revised 2026-07-21) so CI verifies exactly what the local
+# full gate does on every landed commit — the fast tier is PR-only:
+#   PR → fast CORE (units + F-012 diff oracle, no e2e shell suite) for iteration.
+#   push to main → FULL gate (+ every e2e step) == the local full gate, so an
+#     e2e regression from a shared-code change fails on the push, not a day later.
+#   nightly schedule / manual dispatch → FULL gate + the non-default-backend
+#     (tree_walk) sweep (an extra backstop that is not part of the local gate).
 # The Zig toolchain, the fetched deps (zwasm/zlinter), and the build cache are
 # all preserved across runs (actions/cache), so a warm run rebuilds only what
 # changed instead of three cold ReleaseSafe builds — the dominant cost.
@@ -149,6 +151,14 @@ jobs:
       - name: ci_gate.sh
         shell: bash
         env:
-          # nightly schedule + manual dispatch → full gate; push/PR → fast core.
-          CLJW_CI_FULL: ${{ (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch') && '1' || '0' }}
+          # push-to-main + nightly + dispatch → FULL gate (== the local full
+          # gate: every e2e step), so a shared-code change that breaks an e2e
+          # step fails on the push, not a day later on the nightly (ADR-0107
+          # revision 2026-07-21). PR → fast core (its merge fires a push event
+          # that runs the full gate before it lands).
+          CLJW_CI_FULL: ${{ github.event_name != 'pull_request' && '1' || '0' }}
+          # The heavier non-default-backend (tree_walk) sweep — a second
+          # ReleaseSafe rebuild, NOT part of the local full gate — stays
+          # nightly/dispatch-only as an extra backstop.
+          CLJW_CI_PARITY: ${{ (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch') && '1' || '0' }}
         run: bash scripts/ci_gate.sh

scripts/ci_gate.sh

@@ -5,15 +5,26 @@
 # per-host gate. It checks the CURRENT host only; multi-host fan-out is the
 # caller's job (the CI matrix / scripts/run_remote_ubuntu.sh's SSH leg).
 #
-# Two tiers, mirroring the local ADR-0107 discipline (smoke per commit, full
-# batched) so CI is not wasteful on routine events:
-#   CLJW_CI_FULL=1  → FULL gate: `zig build test` x2 (the F-012 dual-backend diff
-#                     oracle + every unit), zlinter, a ReleaseSafe build_cljw,
-#                     zone_check, corpus_regression, AND every e2e step
-#                     (test/run_all.sh --serial-e2e). Set on nightly schedule + dispatch.
+# Tiers, mirroring the local ADR-0107 discipline (smoke per commit locally, the
+# full gate as the authoritative landing gate) so CI verifies what the
+# maintainer's full gate does — never LESS:
+#   CLJW_CI_FULL=1  → FULL gate == the LOCAL full gate: `zig build test` x2 (the
+#                     F-012 dual-backend diff oracle + every unit), zlinter, a
+#                     ReleaseSafe build_cljw, zone_check, corpus_regression, AND
+#                     every e2e step (test/run_all.sh --serial-e2e). Set on
+#                     push-to-main + nightly schedule + dispatch — every landed
+#                     commit is fully e2e-verified, so a shared-code change that
+#                     breaks an e2e step surfaces on the push, not a day later on
+#                     the nightly (ADR-0107 revision 2026-07-21).
 #   CLJW_CI_FULL=0  → fast CORE: the same correctness core WITHOUT the ~248 e2e
-#                     shell steps (test/run_all.sh --smoke). Set on push-to-main / PR.
-# Both tiers run `zig fmt --check src/` first.
+#                     shell steps (test/run_all.sh --smoke). Set on PR only, for
+#                     fast iteration feedback; the PR's merge fires a push-to-main
+#                     event that runs the FULL gate before it lands.
+#   CLJW_CI_PARITY=1 → additionally the non-default-backend (tree_walk) sweep
+#                     below. Heavier (a second ReleaseSafe rebuild), NOT part of
+#                     the local full gate, so it stays nightly/dispatch-only — an
+#                     EXTRA backstop, not a source of push-vs-local drift.
+# Every tier runs `zig fmt --check src/` first.
 #
 # --serial-e2e (not the -P8 parallel default) is deliberate: the parallel path
 # can flake the D-418/D-258 agent send/await load-race under scheduler pressure,
@@ -27,8 +38,9 @@
 # warm run rebuilds only what changed rather than three cold ReleaseSafe builds.
 #
 # Usage:
-#   bash scripts/ci_gate.sh                 # fast core (CLJW_CI_FULL unset → 0)
-#   CLJW_CI_FULL=1 bash scripts/ci_gate.sh  # full gate
+#   bash scripts/ci_gate.sh                                    # fast core (PR)
+#   CLJW_CI_FULL=1 bash scripts/ci_gate.sh                     # full gate (push)
+#   CLJW_CI_FULL=1 CLJW_CI_PARITY=1 bash scripts/ci_gate.sh    # full + backend sweep (nightly)
 set -euo pipefail
 cd "$(dirname "$0")/.."
 
@@ -38,18 +50,22 @@ echo "[ci_gate] (1/2) zig fmt --check src/"
 zig fmt --check src/
 
 if [ "${CLJW_CI_FULL:-0}" = "1" ]; then
-    echo "[ci_gate] (2/3) FULL gate: test/run_all.sh --serial-e2e"
+    echo "[ci_gate] FULL gate: test/run_all.sh --serial-e2e"
     bash test/run_all.sh --serial-e2e
-    # D-555: the NON-default-backend sweep — corpus + every e2e on the
-    # tree_walk (F-012 oracle) build, so an oracle-only regression (GC
-    # rooting, backend-divergent eval defects) cannot hide behind the
-    # vm-default gate. Nightly/dispatch-only: it rebuilds the binary twice
-    # (tree_walk, then the default restore) — too heavy per-push.
-    echo "[ci_gate] (3/3) non-default-backend sweep: scripts/check_vm_parity.sh"
-    bash scripts/check_vm_parity.sh
 else
-    echo "[ci_gate] (2/2) fast CORE: test/run_all.sh --smoke"
+    echo "[ci_gate] fast CORE: test/run_all.sh --smoke"
     bash test/run_all.sh --smoke
 fi
 
+# D-555: the NON-default-backend sweep — corpus + every e2e on the tree_walk
+# (F-012 oracle) build, so an oracle-only regression (GC rooting,
+# backend-divergent eval defects) cannot hide behind the vm-default gate. It
+# rebuilds the binary twice (tree_walk, then the default restore) and is NOT
+# part of the local full gate, so it stays nightly/dispatch-only (CLJW_CI_PARITY)
+# — an extra backstop, not a per-push cost.
+if [ "${CLJW_CI_PARITY:-0}" = "1" ]; then
+    echo "[ci_gate] non-default-backend sweep: scripts/check_vm_parity.sh"
+    bash scripts/check_vm_parity.sh
+fi
+
 echo "[ci_gate] OK ($(uname -s), full=${CLJW_CI_FULL:-0})"