## Job Overview

| Job | Purpose | When it runs |

| -------------------------------- | -------------------------------------------------------------------------------------------- | ------------------------------------ |

| `preflight` | Detect docs-only changes, changed scopes, changed extensions, and build the CI manifest | Always on non-draft pushes and PRs |

| `security-scm-fast` | Private key detection and workflow audit via `zizmor` | Always on non-draft pushes and PRs |

| `security-dependency-audit` | Dependency-free production lockfile audit against npm advisories | Always on non-draft pushes and PRs |

| `security-fast` | Required aggregate for the fast security jobs | Always on non-draft pushes and PRs |

| `build-artifacts` | Build `dist/`, Control UI, built-artifact checks, and reusable downstream artifacts | Node-relevant changes |

| `checks-fast-core` | Fast Linux correctness lanes such as bundled/plugin-contract/protocol checks | Node-relevant changes |

| `checks-fast-contracts-channels` | Sharded channel contract checks with a stable aggregate check result | Node-relevant changes |

| `checks-node-extensions` | Full bundled-plugin test shards across the extension suite | Node-relevant changes |

| `checks-node-core-test` | Core Node test shards, excluding channel, bundled, contract, and extension lanes | Node-relevant changes |

| `check` | Sharded main local gate equivalent: prod types, lint, guards, test types, and strict smoke | Node-relevant changes |

| `check-additional` | Architecture, boundary, extension-surface guards, package-boundary, and gateway-watch shards | Node-relevant changes |

| `build-smoke` | Built-CLI smoke tests and startup-memory smoke | Node-relevant changes |

| `checks` | Verifier for built-artifact channel tests | Node-relevant changes |

| `checks-node-compat-node22` | Node 22 compatibility build and smoke lane | `main` pushes and manual CI dispatch |

| `check-docs` | Docs formatting, lint, and broken-link checks | Docs changed |

| `skills-python` | Ruff + pytest for Python-backed skills | Python-skill-relevant changes |

| `checks-windows` | Windows-specific test lanes | Windows-relevant changes |

| `macos-node` | macOS TypeScript test lane using the shared built artifacts | macOS-relevant changes |

| `macos-swift` | Swift lint, build, and tests for the macOS app | macOS-relevant changes |

| `android` | Android unit tests for both flavors plus one debug APK build | Android-relevant changes |

| `test-performance-agent` | Daily Codex slow-test optimization after trusted activity | Main CI success or manual dispatch |

| Job | Purpose | When it runs |

| -------------------------------- | -------------------------------------------------------------------------------------------- | ---------------------------------- |

| `preflight` | Detect docs-only changes, changed scopes, changed extensions, and build the CI manifest | Always on non-draft pushes and PRs |

| `security-scm-fast` | Private key detection and workflow audit via `zizmor` | Always on non-draft pushes and PRs |

| `security-dependency-audit` | Dependency-free production lockfile audit against npm advisories | Always on non-draft pushes and PRs |

| `security-fast` | Required aggregate for the fast security jobs | Always on non-draft pushes and PRs |

| `build-artifacts` | Build `dist/`, Control UI, built-artifact checks, and reusable downstream artifacts | Node-relevant changes |

| `checks-fast-core` | Fast Linux correctness lanes such as bundled/plugin-contract/protocol checks | Node-relevant changes |

| `checks-fast-contracts-channels` | Sharded channel contract checks with a stable aggregate check result | Node-relevant changes |

| `checks-node-extensions` | Full bundled-plugin test shards across the extension suite | Node-relevant changes |

| `checks-node-core-test` | Core Node test shards, excluding channel, bundled, contract, and extension lanes | Node-relevant changes |

| `check` | Sharded main local gate equivalent: prod types, lint, guards, test types, and strict smoke | Node-relevant changes |

| `check-additional` | Architecture, boundary, extension-surface guards, package-boundary, and gateway-watch shards | Node-relevant changes |

| `build-smoke` | Built-CLI smoke tests and startup-memory smoke | Node-relevant changes |

| `checks` | Verifier for built-artifact channel tests | Node-relevant changes |

| `checks-node-compat-node22` | Node 22 compatibility build and smoke lane | Manual CI dispatch for releases |

| `check-docs` | Docs formatting, lint, and broken-link checks | Docs changed |

| `skills-python` | Ruff + pytest for Python-backed skills | Python-skill-relevant changes |

| `checks-windows` | Windows-specific test lanes | Windows-relevant changes |

| `macos-node` | macOS TypeScript test lane using the shared built artifacts | macOS-relevant changes |

| `macos-swift` | Swift lint, build, and tests for the macOS app | macOS-relevant changes |

| `android` | Android unit tests for both flavors plus one debug APK build | Android-relevant changes |

| `test-performance-agent` | Daily Codex slow-test optimization after trusted activity | Main CI success or manual dispatch |

Manual CI dispatches run the same job graph as normal CI but force every

scoped lane on: Linux Node shards, bundled-plugin shards, channel contracts,

Local changed-lane logic lives in `scripts/changed-lanes.mjs` and is executed by `scripts/check-changed.mjs`. That local check gate is stricter about architecture boundaries than the broad CI platform scope: core production changes run core prod and core test typecheck plus core lint/guards, core test-only changes run only core test typecheck plus core lint, extension production changes run extension prod and extension test typecheck plus extension lint, and extension test-only changes run extension test typecheck plus extension lint. Public Plugin SDK or plugin-contract changes expand to extension typecheck because extensions depend on those core contracts, but Vitest extension sweeps are explicit test work. Release metadata-only version bumps run targeted version/config/root-dependency checks. Unknown root/config changes fail safe to all check lanes.

On pushes and manual dispatches, `checks-node-compat-node22` runs the Node 22 compatibility build/smoke lane. On pull requests, that lane is skipped and the matrix stays focused on the normal Node 24 test/channel lanes.

Manual CI dispatches run `checks-node-compat-node22` as release-candidate compatibility coverage. Normal pull requests and `main` pushes skip that lane and keep the matrix focused on the Node 24 test/channel lanes.

The slowest Node test families are split or balanced so each job stays small without over-reserving runners: channel contracts run as three weighted shards, bundled plugin tests balance across six extension workers, small core unit lanes are paired, auto-reply runs as four balanced workers with the reply subtree split into agent-runner, dispatch, and commands/state-routing shards, and agentic gateway/plugin configs are spread across the existing source-only agentic Node jobs instead of waiting on built artifacts. Broad browser, QA, media, and miscellaneous plugin tests use their dedicated Vitest configs instead of the shared plugin catch-all. Extension shard jobs run up to two plugin config groups at a time with one Vitest worker per group and a larger Node heap so import-heavy plugin batches do not create extra CI jobs. The broad agents lane uses the shared Vitest file-parallel scheduler because it is import/scheduling dominated rather than owned by a single slow test file. `runtime-config` runs with the infra core-runtime shard to keep the shared runtime shard from owning the tail. Include-pattern shards record timing entries using the CI shard name, so `.artifacts/vitest-shard-timings.json` can distinguish a whole config from a filtered shard. `check-additional` keeps package-boundary compile/canary work together and separates runtime topology architecture from gateway watch coverage; the boundary guard shard runs its small independent guards concurrently inside one job. Gateway watch, channel tests, and the core support-boundary shard run concurrently inside `build-artifacts` after `dist/` and `dist-runtime/` are already built, keeping their old check names as lightweight verifier jobs while avoiding two extra Blacksmith workers and a second artifact-consumer queue.

Android CI runs both `testPlayDebugUnitTest` and `testThirdPartyDebugUnitTest`, then builds the Play debug APK. The third-party flavor has no separate source set or manifest; its unit-test lane still compiles that flavor with the SMS/call-log BuildConfig flags, while avoiding a duplicate debug APK packaging job on every Android-relevant push.