ci: improve test gates, browser auth and assembled coverage

.github/workflows/apple-validation.yml

@@ -15,7 +15,23 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
+  changes:
+    name: Select Apple validation
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    outputs:
+      selected: ${{ steps.plan.outputs.selected }}
+      run: ${{ steps.plan.outputs.run }}
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+      - id: plan
+        run: node scripts/ci/validation-gates.mjs select-apple
+
   contracts:
+    needs: changes
+    if: needs.changes.outputs.run == 'true'
     name: Apple source, scripts, and Swift protocol
     runs-on: xcode-27
     timeout-minutes: 30
@@ -42,6 +58,8 @@ jobs:
           test -z "$(git ls-files --others --exclude-standard apple/InlineKit/Sources/InlineProtocol)"
 
   swift-main:
+    needs: changes
+    if: needs.changes.outputs.run == 'true'
     name: Swift packages (main)
     runs-on: xcode-27
     timeout-minutes: 75
@@ -65,6 +83,8 @@ jobs:
           retention-days: 7
 
   swift-utilities:
+    needs: changes
+    if: needs.changes.outputs.run == 'true'
     name: Swift packages (utilities)
     runs-on: xcode-27
     timeout-minutes: 75
@@ -90,6 +110,8 @@ jobs:
           retention-days: 7
 
   macos-app:
+    needs: changes
+    if: needs.changes.outputs.run == 'true'
     name: macOS app Debug and Release
     runs-on: xcode-27
     timeout-minutes: 75
@@ -108,6 +130,8 @@ jobs:
           retention-days: 7
 
   ios-app:
+    needs: changes
+    if: needs.changes.outputs.run == 'true'
     name: iOS device app Debug and Release
     runs-on: xcode-27
     timeout-minutes: 75
@@ -124,3 +148,17 @@ jobs:
           name: ios-app-build-logs
           path: ${{ runner.temp }}/ios-app-reports/
           retention-days: 7
+
+  required:
+    name: Apple validation required
+    if: ${{ always() }}
+    needs: [changes, contracts, swift-main, swift-utilities, macos-app, ios-app]
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v6
+      - name: Require every selected job to pass
+        env:
+          RESULTS_JSON: ${{ toJSON(needs) }}
+          SELECTED_JOBS: ${{ needs.changes.outputs.selected }}
+        run: node scripts/ci/validation-gates.mjs apple

.github/workflows/cli-check.yml

@@ -65,7 +65,7 @@ jobs:
         run: bash scripts/ci/ensure-public-workspaces.sh
 
       - name: Setup Rust
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@1.96.0
 
       - name: Install Linux musl Toolchain
         working-directory: cli
@@ -84,11 +84,7 @@ jobs:
         uses: Swatinem/rust-cache@v2
         with:
           workspaces: |
-            cli -> target
-
-      - name: Build
-        working-directory: cli
-        run: cargo build --locked
+            . -> target
 
       - name: Build Linux musl
         working-directory: cli
@@ -102,6 +98,7 @@ jobs:
       - name: Test installer with Debian sh
         run: python3 scripts/ci/test-cli-installer.py
 
-      - name: Test
+      - name: Test native ARM64 CLI
+        if: matrix.target == 'aarch64-unknown-linux-musl'
         working-directory: cli
         run: cargo test --locked --profile ci-test

.github/workflows/integrations.yml

@@ -9,10 +9,15 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  group: integrations-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   landing:
     name: Landing and browser client
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -37,10 +42,28 @@ jobs:
           bun run --cwd landing lint
           bun run --cwd landing test
           bun run --cwd landing/packages/client test
+          for package in auth ids log protocol; do
+            bun run --cwd "landing/packages/$package" test
+          done
+      - name: Install Chromium for browser acceptance
+        working-directory: landing
+        run: bun x playwright install --with-deps chromium
+      - name: Test built browser login and persisted session
+        run: bun run --cwd landing test:e2e
+      - name: Upload browser report and failure traces
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: browser-e2e-report
+          path: |
+            landing/playwright-report/
+            landing/test-results/
+          retention-days: 7
 
   codex-plugin:
     name: Codex plugin
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -56,35 +79,10 @@ jobs:
       - name: Check plugin bundle
         run: bun run check:codex-plugin
 
-  cli:
-    name: CLI
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Setup Rust
-        uses: dtolnay/rust-toolchain@1.96.0
-        with:
-          components: clippy, rustfmt
-
-      - name: Setup Bun
-        uses: oven-sh/setup-bun@v2
-        with:
-          bun-version: 1.4.0
-
-      - name: Install protoc
-        run: sudo apt-get update && sudo apt-get install -y protobuf-compiler systemd
-
-      - name: Install dependencies
-        run: bun install --frozen-lockfile
-
-      - name: Check CLI, including generated systemd units
-        run: bun run --cwd cli ci
-
   mcp:
     name: MCP
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -112,15 +110,26 @@ jobs:
       - name: Lint MCP
         run: bun run --cwd packages/mcp lint
 
-      - name: Test MCP
-        run: bun run --cwd packages/mcp test
+      - name: Test MCP and report coverage (threshold gate pending)
+        env:
+          MCP_COVERAGE_REPORT_ONLY: '1'
+        run: bun run --cwd packages/mcp test --coverage
+
+      - name: Upload MCP coverage
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: mcp-coverage
+          path: packages/mcp/coverage/
+          retention-days: 7
 
       - name: Initialize compiled MCP app with local OAuth introspection
         run: bun --no-env-file scripts/ci/check-mcp-assembled.mjs
 
   openclaw:
     name: OpenClaw (${{ matrix.host }})
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     continue-on-error: ${{ matrix.host == 'latest' }}
     strategy:
       fail-fast: false
@@ -165,6 +174,7 @@ jobs:
   openclaw-source:
     name: OpenClaw source, tests, and bundle
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     steps:
       - uses: actions/checkout@v6
       - uses: oven-sh/setup-bun@v2
@@ -200,6 +210,7 @@ jobs:
   chat-sdk:
     name: Vercel Chat SDK adapter
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -271,6 +282,7 @@ jobs:
   workflow-and-release-contracts:
     name: Workflow and release contracts
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     steps:
       - uses: actions/checkout@v6
       - uses: oven-sh/setup-bun@v2
@@ -280,7 +292,7 @@ jobs:
       - name: Validate active workflows
         run: |
           go run github.com/rhysd/actionlint/cmd/actionlint@v1.7.10 -color
-          bun test scripts/ci/workflow-policy.test.ts scripts/ci/ios-early-testers.test.ts
+          cd scripts && bun --no-env-file test ci && cd ..
           python3 -m unittest discover -s scripts/ci -p 'test_nightly_tip_gate.py'
       - name: Check CI shell scripts
         run: |
@@ -453,10 +465,37 @@ jobs:
         env:
           GH_TOKEN: ${{ github.token }}
         run: bash scripts/ci/install-hermes-host.sh "$RUNNER_TEMP/hermes-host" latest
+      - name: Build compiled MCP app for real transport checks
+        run: |
+          for package in protocol oauth-core sdk mcp; do
+            bun run --cwd "packages/$package" build
+          done
       - name: Run packed adapters and Hermes against source server
         env:
           TEST_DATABASE_URL: postgres://postgres:postgres@127.0.0.1:5432/test_db
           INLINE_TEST_REDIS_URL: redis://127.0.0.1:6379
           HERMES_BIN: ${{ steps.hermes-host.outputs.hermes-bin }}
           HERMES_PYTHON_BIN: ${{ steps.hermes-host.outputs.python-bin }}
         run: bun --no-env-file scripts/ci/local-bot-flow.mjs "$RUNNER_TEMP/inline-packages"
+      - name: Upload scenario receipts
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: local-integration-receipts
+          path: |
+            ${{ runner.temp }}/inline-packages/*receipt.json
+            ${{ runner.temp }}/inline-packages/manifest.json
+          retention-days: 7
+
+  required:
+    name: Integrations required
+    if: ${{ always() }}
+    needs: [landing, codex-plugin, mcp, openclaw, openclaw-source, hermes, chat-sdk, shared-packages, rust-workspace, workflow-and-release-contracts, candidate-packages, packed-consumers, openclaw-admission, hermes-admission, local-integration]
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v6
+      - name: Require every selected job to pass
+        env:
+          RESULTS_JSON: ${{ toJSON(needs) }}
+        run: node scripts/ci/validation-gates.mjs integrations

.github/workflows/openclaw-compatibility.yml

@@ -0,0 +1,34 @@
+name: OpenClaw stable compatibility
+
+on:
+  schedule:
+    - cron: '43 */6 * * *'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: openclaw-stable-compatibility
+  cancel-in-progress: false
+
+jobs:
+  stable:
+    name: npm latest / OpenClaw latest
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '26'
+      - name: Resolve published plugin and its SDK dependencies
+        run: node scripts/ci/pack-published-openclaw.mjs "$RUNNER_TEMP/published-inline"
+      - name: Test published package through current real OpenClaw CLI
+        run: node scripts/ci/check-openclaw-admission.mjs "$RUNNER_TEMP/published-inline" latest
+      - uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: published-openclaw-manifest
+          path: ${{ runner.temp }}/published-inline/manifest.json
+          retention-days: 7

.github/workflows/server-test.yml

@@ -254,3 +254,16 @@ jobs:
           include-hidden-files: true
           if-no-files-found: ignore
           retention-days: 14
+
+  required:
+    name: Server validation required
+    if: ${{ always() }}
+    needs: [container, test]
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v6
+      - name: Require every selected job to pass
+        env:
+          RESULTS_JSON: ${{ toJSON(needs) }}
+        run: node scripts/ci/validation-gates.mjs server

.gitignore

@@ -174,6 +174,8 @@ docs/superpowers
 .running
 
 # Consolidated tooling outputs and local coordination
+landing/playwright-report/
+landing/test-results/
 target/
 **/__pycache__/
 *.py[cod]

apple/Inline.xcodeproj/xcshareddata/xcschemes/Inline (iOS).xcscheme

@@ -30,39 +30,6 @@
       shouldUseLaunchSchemeArgsEnv = "YES"
       shouldAutocreateTestPlan = "YES">
       <Testables>
-         <TestableReference
-            skipped = "NO"
-            parallelizable = "YES">
-            <BuildableReference
-               BuildableIdentifier = "primary"
-               BlueprintIdentifier = "C38A28452CA5AB9200D3DFB8"
-               BuildableName = "InlineIOSTests.xctest"
-               BlueprintName = "InlineIOSTests"
-               ReferencedContainer = "container:Inline.xcodeproj">
-            </BuildableReference>
-         </TestableReference>
-         <TestableReference
-            skipped = "NO"
-            parallelizable = "YES">
-            <BuildableReference
-               BuildableIdentifier = "primary"
-               BlueprintIdentifier = "C38A284F2CA5AB9200D3DFB8"
-               BuildableName = "InlineIOSUITests.xctest"
-               BlueprintName = "InlineIOSUITests"
-               ReferencedContainer = "container:Inline.xcodeproj">
-            </BuildableReference>
-         </TestableReference>
-         <TestableReference
-            skipped = "NO"
-            parallelizable = "YES">
-            <BuildableReference
-               BuildableIdentifier = "primary"
-               BlueprintIdentifier = "B7C067192DB7CC8F00EAADA4"
-               BuildableName = "iMessageUITests.xctest"
-               BlueprintName = "iMessageUITests"
-               ReferencedContainer = "container:Inline.xcodeproj">
-            </BuildableReference>
-         </TestableReference>
       </Testables>
    </TestAction>
    <LaunchAction