ci: split required tests into parallel shards

.github/workflows/smoke-test.yml

@@ -8,7 +8,7 @@ on:
         default: '300'
         required: false
   workflow_run:
-    workflows: ["Tests"]
+    workflows: ["Deploy Dev"]
     branches: [main]
     types: [completed]
   # ADR-009 Phase 2: gate Tier 2 on PRs that touch deployment surfaces.
@@ -46,7 +46,7 @@ jobs:
     name: kind cluster smoke test
     runs-on: ubuntu-latest
     # Run on manual dispatch, on any PR that passed the path filter above,
-    # or on a successful Tests workflow_run on main.
+    # or after a successful Deploy Dev run on main.
     if: >
       github.event_name == 'workflow_dispatch' ||
       github.event_name == 'pull_request' ||

.github/workflows/tests.yml

@@ -2,7 +2,7 @@ name: Tests
 
 on:
   push:
-    branches: [ main, v1.0.x ]
+    branches: [ v1.0.x ]
   # No branches filter on pull_request: stacked PRs (base = another feature
   # branch) previously got ZERO test runs — every number on them was
   # single-sourced to the author's local sweep, and the 2026-08-22 threading
@@ -27,16 +27,15 @@ permissions:
   contents: read
 
 # The push fallback is github.sha, NOT github.ref. On a push event `github.ref`
-# is the *branch*, so every commit merged to main shared one concurrency group
-# and each merge cancelled the previous commit's still-running verification.
-# Measured across 39 Tests runs on main (2026-08-04 → 08-06): 18 cancelled.
+# is the branch, so concurrent commits would cancel each other. This caused
+# 18 of 39 Tests runs on main to be cancelled (2026-08-04 → 08-06).
 #
 # The loss is ordered by job depth, not random, which is what makes it worth
 # fixing rather than tolerating:
 #
 #   Chart Lint        no needs,  ~8s      survived 12 of 14
-#   Test & Coverage   no needs,  ~5.5min  survived  3 of 14
-#   Service Tests     needs:test, starts ~5.5min in   survived 0 of 14
+#   old Test & Coverage   no needs,  ~5.5min  survived  3 of 14
+#   Service Tests         formerly needs:test          survived 0 of 14
 #
 # Service Tests is the ADR-009 Tier 1 real-DB tier — the deepest job, and the
 # only one that never once completed in a cancelled run. So the tier main was
@@ -49,8 +48,127 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
-  test:
+  backend-tests:
+    name: Backend tests (${{ matrix.shard }}/3)
+    strategy:
+      fail-fast: false
+      matrix:
+        shard: [1, 2, 3]
+    runs-on: ubuntu-latest
+    env:
+      JWT_SECRET: test-jwt-secret
+      SENDGRID_API_KEY: fake-api-key
+      SENDGRID_FROM_EMAIL: test@example.com
+      FRONTEND_URL: http://localhost:3000
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+          cache: npm
+          cache-dependency-path: backend/package-lock.json
+      - run: cd backend && npm ci --include=dev
+      - name: Run backend tests (coverage on the nightly schedule only)
+        run: |
+          cd backend
+          if [ "${{ github.event_name }}" = "schedule" ]; then
+            npx jest --coverage --forceExit --shard=${{ matrix.shard }}/3
+          else
+            npx jest --forceExit --shard=${{ matrix.shard }}/3
+          fi
+      - uses: actions/upload-artifact@v4
+        if: github.event_name == 'schedule'
+        with:
+          name: backend-coverage-${{ matrix.shard }}
+          path: backend/coverage/
+
+  backend-checks:
+    name: Backend typecheck and lint
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+          cache: npm
+          cache-dependency-path: backend/package-lock.json
+      - run: cd backend && npm ci --include=dev
+      - run: cd backend && npm run tsc:check
+      - run: cd packages/types && ../../backend/node_modules/.bin/tsc --noEmit -p tsconfig.json
+      - run: cd backend && npm run lint:ts
+
+  frontend-tests:
+    name: Frontend tests
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+          cache: npm
+          cache-dependency-path: |
+            backend/package-lock.json
+            frontend/package-lock.json
+      # Frontend typecheck follows shared imports into backend TypeScript.
+      - run: cd backend && npm ci --include=dev
+      - run: cd frontend && npm install --legacy-peer-deps
+      - run: cd frontend && npm run typecheck
+      - name: Run frontend tests (coverage on the nightly schedule only)
+        run: |
+          cd frontend
+          if [ "${{ github.event_name }}" = "schedule" ]; then
+            npx jest --coverage --watchAll=false --forceExit
+          else
+            npx jest --watchAll=false --forceExit
+          fi
+      - run: cd frontend && node --test scripts/generate-seo-pages.test.mjs scripts/nginx-routing.test.mjs
+
+  tool-tests:
+    name: CLI, MCP and hosted runtime tests
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          submodules: recursive
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+          cache: npm
+          cache-dependency-path: |
+            package-lock.json
+            backend/package-lock.json
+            commonly-mcp/package-lock.json
+            cli/package-lock.json
+            workers/agent-runtime/package-lock.json
+      - run: npm ci --include=dev
+      # CLI tests load backend TypeScript through ts-node.
+      - run: cd backend && npm ci --include=dev
+      - run: cd commonly-mcp && npm ci --include=dev
+      - run: cd cli && npm ci --include=dev
+      - run: cd workers/agent-runtime && npm ci --include=dev
+      - run: npm run verify:moltbot-tools
+      - run: npm run verify:litellm-patch-runner
+      - run: cd commonly-mcp && npm test
+      - run: cd cli && npm run lint && npm test
+      - run: cd workers/agent-runtime && npm run typecheck && npm test
+
+  test-gate:
     name: Test & Coverage
+    if: always()
+    needs: [backend-tests, backend-checks, frontend-tests, tool-tests, service-test, chart-lint]
+    runs-on: ubuntu-latest
+    env:
+      NEEDS_JSON: ${{ toJSON(needs) }}
+    steps:
+      - name: Verify every check passed
+        run: |
+          echo "$NEEDS_JSON" | jq -e '
+            [.[].result] | all(. == "success")
+          '
+
+  legacy-test:
+    # Retire only after the new gate passes a real merge_group run.
+    name: Legacy test and coverage
     runs-on: ubuntu-latest
 
     env:
@@ -196,7 +314,6 @@ jobs:
   service-test:
     name: Service Tests (Tier 1 — real DBs)
     runs-on: ubuntu-latest
-    needs: test
 
     services:
       mongo:
@@ -238,6 +355,8 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
 
       - name: Set up Node.js
         uses: actions/setup-node@v4