From e301a82948c5058774fee21a951775721fb933a6 Mon Sep 17 00:00:00 2001
From: Waleed Latif <walif6@gmail.com>
Date: Fri, 9 Oct 2026 18:31:18 -0700
Subject: [PATCH 1/7] improvement(ci): halve the mobile job, narrow the desktop
 gate, skip proven checks on main, fix the top flake

- e2e (mobile): Chromium and WebKit run as two processes against one app instead of back to back
  (each seeds its own fixtures and writes its own report), and every e2e group restores its own
  Turbopack dev cache. The job was the PR critical path at ~19.5 min: Chromium's pass (718 s
  median) carried the cold compile and WebKit waited it out (310 s). `suite setup` failures are
  now logged instead of only reaching the uploaded report.
- dev-cache action: one mount shared by desktop-live and the e2e groups, keyed by app, event,
  fork, Next version and the hash of the file that sets the app's environment, so a cache is never
  read under NEXT_PUBLIC_* values it was not compiled with. http-e2e.sh stops apps with SIGINT so
  the cache write completes, drops a cache Turbopack reports as corrupt, and retries a startup it
  aborted once from an empty cache.
- desktop-live-changes.sh: run the live desktop suite when a pull request touches a path it
  exercises instead of skipping only docs-like paths. Every genuine desktop-live failure since the
  layout change was on a PR the new rule still runs; pushes always run it.
- ci.yml: a `proof` job lets a main push skip the checks when it is a merge whose tree is
  identical to its staging parent and a staging push run of that parent passed `checks / ci`;
  migrate gates on that proof instead. Any other shape or any error runs the full checks.
- codeql, helm, desktop-e2e skip the staging -> main release PR (main's push and schedule still
  run them); helm never cancels a push mid-publish; trigger-promote on 2 vCPU; attestations via
  actions/attest with artifact-metadata: write.
- stripe-sync-convergence: start each contender only after the parked transaction holds its locks,
  wait on a deadline rather than 200 polls, and release the transaction before failing, so a lost
  race no longer hangs the suite's teardown. It was the most frequent flake (9 red runs).
- Integration shard weights refreshed from a recent run; /ship runs the affected workspaces' suites
  instead of the full suite locally.
---
 .agents/skills/ship/SKILL.md                  |   2 +-
 .github/actions/dev-cache/action.yml          |  37 +++
 .github/scripts/desktop-live-changes.sh       |  32 +-
 .github/scripts/http-e2e.sh                   |  87 ++++-
 .github/scripts/staging-proof.sh              |  38 +++
 .github/workflows/checks.yml                  |  30 +-
 .github/workflows/ci.yml                      |  49 ++-
 .github/workflows/codeql.yml                  |   4 +-
 .github/workflows/desktop-e2e.yml             |   6 +-
 .github/workflows/helm.yml                    |  12 +-
 .../stripe-sync-convergence.integration.ts    |  18 +-
 apps/sim/scripts/test-mobile-e2e.ts           |   4 +-
 scripts/desktop-live-changes.test.ts          |  28 +-
 vitest.integration-durations.json             | 310 ++++++++++--------
 14 files changed, 454 insertions(+), 203 deletions(-)
 create mode 100644 .github/actions/dev-cache/action.yml
 create mode 100755 .github/scripts/staging-proof.sh

diff --git a/.agents/skills/ship/SKILL.md b/.agents/skills/ship/SKILL.md
index fa6e5433ee5..c9b5b5475c7 100644
--- a/.agents/skills/ship/SKILL.md
+++ b/.agents/skills/ship/SKILL.md
@@ -42,7 +42,7 @@ When the user runs `/ship`:
   - If the diff modifies UI code (any non-test `.tsx` file, or anything under `apps/sim/components/`, `apps/sim/hooks/`, or `apps/sim/stores/`), run `/cleanup`. It fans out the React/UI passes (effects, memo, callbacks, state, React Query, emcn, url-state), the comment pass, and the test-audit pass, and applies fixes so they land in this commit.
   - Otherwise, if the diff adds or changes tests (`*.test.ts(x)`, `*.integration.ts`, `**/e2e/**`, `apps/sim/scripts/test-*-e2e.ts`), run `/test-audit audit <changed test files>` on its own. Every new or changed test must pass the authoring gate; delete the ones that don't rather than shipping them.
   - Then run the test files the diff adds or changes, plus the existing tests beside changed source files, with `bun run --cwd <workspace> test <paths>` (`bun run --cwd apps/sim test <paths>` for the app; `*.integration.ts` needs the setup in `.claude/rules/sim-testing.md`). A failing test aborts ship.
-  - Then run root `bun run test` from the repo root. It chains `test:scripts` (the `scripts/*.test.ts` suite CI runs) before every workspace suite; workspace-scoped runs skip it, which is how a `scripts/check-*.test.ts` failure has reached CI. A failing test aborts ship.
+  - Then run `bun run test:scripts` (the `scripts/*.test.ts` suite CI runs; workspace-scoped runs skip it, which is how a `scripts/check-*.test.ts` failure has reached CI) and the suites of the workspaces the change reaches: `bunx turbo run test --filter='...[origin/staging]'` (each changed workspace plus every workspace that depends on it). CI runs every suite, sharded, on every push; the full local suite needs more memory than a laptop reliably has and catches nothing CI does not. When the diff touches root test or build config (`vitest.shared.ts`, `turbo.json`, the root `package.json`, `bun.lock`), the filter selects nothing that config reaches, so run the full root `bun run test` instead. A failing test aborts ship.
 5. **Run migration safety** — only if the diff touches `packages/db/migrations/**` or `packages/db/schema.ts`:
   - Run `/db-migrate` to review the migration for zero-downtime safety (expand/contract phasing, backward-compatibility with the deployed app version).
   - `(cd packages/db && bunx drizzle-kit generate && git status --porcelain ./migrations)` must print nothing (CI's schema/migration sync step).
diff --git a/.github/actions/dev-cache/action.yml b/.github/actions/dev-cache/action.yml
new file mode 100644
index 00000000000..bb36cda4ad5
--- /dev/null
+++ b/.github/actions/dev-cache/action.yml
@@ -0,0 +1,37 @@
+name: dev-cache
+description: Mount Turbopack's dev cache at apps/sim/.next/dev for one `next dev` app, keyed by app, event, fork, installed Next version and the app's environment.
+
+inputs:
+  provider:
+    description: The CI_PROVIDER repo variable, forwarded to the cache action.
+    required: false
+    default: ''
+  name:
+    description: The app the cache belongs to. Each app runs `next dev` under its own fixed NEXT_PUBLIC_* values, so each gets its own cache.
+    required: true
+  env-hash:
+    description: Hash of the file that sets the app's environment. Next inlines NEXT_PUBLIC_* values at compile time, so a changed environment must never restore a cache compiled under the old one.
+    required: true
+
+# The cache turns a route's cold compile into a restore. It is content-addressed, so changed modules
+# still recompile. The Next version in the key starts an upgrade from an empty cache, and the event
+# and fork segments keep untrusted runs off the cache trusted runs read. Needs dependencies installed
+# (it reads node_modules/next), and the app must be stopped with SIGINT so the last write completes.
+runs:
+  using: composite
+  steps:
+    - name: Resolve Turbopack dev cache key
+      id: key
+      shell: bash
+      env:
+        APP: ${{ inputs.name }}
+        FORK_SUFFIX: ${{ github.event.pull_request.head.repo.fork && '-fork' || '' }}
+        ENV_HASH: ${{ inputs.env-hash }}
+      run: echo "value=${GITHUB_REPOSITORY}-next-dev-${APP}-${GITHUB_EVENT_NAME}${FORK_SUFFIX}-$(jq -r .version node_modules/next/package.json)-${ENV_HASH:0:12}" >> "$GITHUB_OUTPUT"
+
+    - name: Mount Turbopack dev cache
+      uses: ./.github/actions/cache
+      with:
+        provider: ${{ inputs.provider }}
+        key: ${{ steps.key.outputs.value }}
+        path: ./apps/sim/.next/dev
diff --git a/.github/scripts/desktop-live-changes.sh b/.github/scripts/desktop-live-changes.sh
index d42cc2b2e70..102d52f6784 100755
--- a/.github/scripts/desktop-live-changes.sh
+++ b/.github/scripts/desktop-live-changes.sh
@@ -1,11 +1,30 @@
 #!/usr/bin/env bash
-# Prints `changed=false` only when every file a pull request changes is clearly unrelated to the
-# live desktop suite, and `changed=true` otherwise, including when the diff cannot be worked out.
+# Prints `changed=true` when a pull request touches a path the live desktop suite exercises, or when
+# the diff cannot be worked out, and `changed=false` otherwise.
+#
+# The suite (apps/desktop/e2e/desktop-tools-live-sim.spec.ts) drives the Electron app against a
+# local Sim, realtime and Redis through the desktop, mothership, copilot, upload and auth routes and
+# the chat page. A change that only breaks Sim boot or an unrelated route fails the build and e2e
+# jobs, and every staging and main push runs this suite regardless, so a path missing here can
+# delay a failure to the staging push but never lets it deploy.
 #
 # Usage: desktop-live-changes.sh <base-sha>
 set -u
 
-unrelated='^(apps/docs/|apps/pii/|apps/sim/content/|packages/(python-sdk|ts-sdk)/)|\.mdx?$|(^|/)LICENSE$'
+relevant='^(apps/desktop/|apps/realtime/'\
+'|packages/(desktop-bridge|browser-protocol|terminal-protocol|realtime-protocol|db|auth|emcn|utils|logger|security|platform-authz|runtime-secrets)/'\
+'|apps/sim/lib/(desktop|mothership|uploads|auth|terminal|browser-agent|api/(client|server))/'\
+'|apps/sim/lib/api/contracts/(chats|copilot|desktop-|mothership-|upload-sessions|workspace-file)'\
+'|apps/sim/app/api/(desktop|mothership|copilot|files|v2/uploads|auth|users/me)/'\
+'|apps/sim/app/api/workspaces/\[id\]/files/'\
+'|apps/sim/app/workspace/\[workspaceId\]/(home/|components/|layout\.tsx)'\
+'|apps/sim/app/(layout\.tsx|desktop/)'\
+'|apps/sim/stores/(chat|chat-panel|panel|mothership-[a-z-]+|tool-permission|terminal|copilot-terminal|browser-session)/'\
+'|apps/sim/hooks/(use-mothership|use-desktop|use-chat|queries/(mothership|desktop|copilot|chats))'\
+'|apps/sim/types/sim-desktop'\
+'|apps/sim/(proxy\.ts|next\.config\.ts|package\.json|instrumentation)'\
+'|bun\.lock$|package\.json$'\
+'|\.github/(workflows/(checks|ci)\.yml|scripts/desktop-live-changes\.sh|actions/))'
 
 base=${1:-}
 run() {
@@ -17,8 +36,7 @@ run() {
 git fetch --quiet --depth=1 origin "$base" || run "could not fetch $base"
 names=$(git diff --no-renames --name-only "$base" HEAD) || run "could not diff against $base"
 [ -n "$names" ] || run 'no changed files listed'
-if printf '%s\n' "$names" | grep -qvE "$unrelated"; then
-  run 'a change may affect it'
-fi
+printf 'Changed files:\n%s\n' "$names" >&2
+match=$(printf '%s\n' "$names" | grep -E -m 1 "$relevant") && run "a change touches a path it exercises: $match"
 echo "changed=false"
-echo 'Skipping the live desktop suite: every change is unrelated to it' >&2
+echo 'Skipping the live desktop suite: no change touches a path it exercises' >&2
diff --git a/.github/scripts/http-e2e.sh b/.github/scripts/http-e2e.sh
index ef9c500bd1d..faf797f93e7 100755
--- a/.github/scripts/http-e2e.sh
+++ b/.github/scripts/http-e2e.sh
@@ -10,11 +10,13 @@
 # the readiness deadline only has to catch a hung boot: an exited server fails immediately, and
 # either way the server log tail lands in the job log.
 #
-# Each app starts from an empty Turbopack dev cache: a cache written under other NEXT_PUBLIC_*
-# values, by a server that `next dev` SIGKILLs 100ms after SIGTERM, can panic Turbopack or wedge a
-# route compile on restore. It runs in its own session under an E2E_APP tag, and stop-session.sh
-# returns only once every process in that session or carrying that tag has exited (Next's
-# telemetry flush runs detached and still writes .next/dev).
+# Each group restores its own Turbopack dev cache (mounted by the dev-cache action, keyed by group
+# and by this file's hash, so a cache is only ever read under the NEXT_PUBLIC_* values it was
+# compiled with). The app is stopped with SIGINT so its last cache write completes: `next dev`
+# SIGKILLs its server 100ms after SIGTERM. A cache Turbopack reports as corrupt is dropped, and a
+# startup it aborted is retried once from an empty cache. The app runs in its own session under an
+# E2E_APP tag, and stop-session.sh returns only once every process in that session or carrying
+# that tag has exited (Next's telemetry flush runs detached and still writes .next/dev).
 set -euo pipefail
 
 group=${1:?usage: http-e2e.sh <scim|cli|stop-after|desktop-inbox|mobile>}
@@ -27,11 +29,35 @@ app_tag=''
 server_log=''
 status_log=''
 
+cache_broken() {
+  grep -qiE 'cache corruption|turbopack.*panic|panicked' "$server_log" 2>/dev/null
+}
+
+# The cache directory is a mount point: empty it rather than remove it.
+clear_cache() {
+  local cache="$GITHUB_WORKSPACE/apps/sim/.next/dev"
+  [ -d "$cache" ] || return 0
+  find "$cache" -mindepth 1 -maxdepth 1 -exec rm -rf {} +
+}
+
+# SIGINT is best-effort; the cleanup always runs, since workers and the detached telemetry flush
+# can outlive a server that has already exited.
+stop_app() {
+  if kill -INT "$server_pid" 2>/dev/null; then
+    for _ in $(seq 1 30); do kill -0 "$server_pid" 2>/dev/null || break; sleep 1; done
+  fi
+  bash "$GITHUB_WORKSPACE/.github/scripts/stop-session.sh" "$server_pid" "$app_tag"
+}
+
 finish() {
   local status=$?
   if [ -n "$server_pid" ]; then
-    bash "$GITHUB_WORKSPACE/.github/scripts/stop-session.sh" "$server_pid" "$app_tag" || status=1
+    stop_app || status=1
     wait "$server_pid" 2>/dev/null || true
+    if cache_broken; then
+      echo "::warning::Turbopack reported a broken dev cache; clearing it for the next run."
+      clear_cache
+    fi
     if [ -n "$status_log" ]; then
       awk '/^ (GET|POST|PUT|PATCH|DELETE|HEAD) \/api\// { print }' "$server_log" > "$status_log"
     fi
@@ -43,6 +69,13 @@ finish() {
 }
 trap finish EXIT
 
+# launch_app <port>
+launch_app() {
+  E2E_APP="$app_tag" setsid node ../../node_modules/next/dist/bin/next dev --hostname 127.0.0.1 \
+    --port "$1" > "$server_log" 2>&1 &
+  server_pid=$!
+}
+
 # start_app <name> <port> <label> [record-http-status]
 start_app() {
   local name=$1 port=$2 label=$3
@@ -54,14 +87,20 @@ start_app() {
   export NEXT_PUBLIC_APP_URL="http://127.0.0.1:$port"
   export BETTER_AUTH_URL="$NEXT_PUBLIC_APP_URL"
   export DISABLE_TELEMETRY=true NEXT_TELEMETRY_DISABLED=1
-  rm -rf .next/dev
-  E2E_APP="$app_tag" setsid node ../../node_modules/next/dist/bin/next dev --hostname 127.0.0.1 \
-    --port "$port" > "$server_log" 2>&1 &
-  server_pid=$!
+  launch_app "$port"
 
-  local started=$SECONDS
+  local started=$SECONDS retried=false
   until curl --fail --silent --max-time 10 "$NEXT_PUBLIC_APP_URL/api/health" > /dev/null; do
     if ! kill -0 "$server_pid" 2>/dev/null; then
+      if [ "$retried" = false ] && cache_broken; then
+        echo "::warning::Turbopack rejected the restored dev cache; restarting from an empty cache."
+        tail -n 50 "$server_log"
+        stop_app
+        clear_cache
+        retried=true
+        launch_app "$port"
+        continue
+      fi
       echo "::error::Local $label app exited during startup."
       exit 1
     fi
@@ -161,11 +200,27 @@ case "$group" in
     export NODE_OPTIONS="${NODE_OPTIONS:+$NODE_OPTIONS }--max-old-space-size=12288"
     bunx --no-install playwright install --with-deps chromium webkit
     start_app mobile 3024 'mobile browser' record-http-status
-    MOBILE_E2E_BASE_URL="$NEXT_PUBLIC_APP_URL" \
-    MOBILE_E2E_DATABASE_URL="$DATABASE_URL" \
-    MOBILE_E2E_AUTH_SECRET="$BETTER_AUTH_SECRET" \
-    MOBILE_E2E_REPORT_PATH="$report_dir/mobile-e2e-report.json" \
-      bun run test:mobile:e2e
+    # Chromium and WebKit run as two processes against the one app, so WebKit no longer waits out
+    # Chromium's pass. Each process seeds and removes its own fixtures under fresh ids and writes
+    # its own report, so they share nothing but the server.
+    browser_pids=()
+    for browser in chromium webkit; do
+      MOBILE_E2E_BROWSER="$browser" \
+      MOBILE_E2E_BASE_URL="$NEXT_PUBLIC_APP_URL" \
+      MOBILE_E2E_DATABASE_URL="$DATABASE_URL" \
+      MOBILE_E2E_AUTH_SECRET="$BETTER_AUTH_SECRET" \
+      MOBILE_E2E_REPORT_PATH="$report_dir/mobile-e2e-$browser-report.json" \
+        bun run test:mobile:e2e > "$report_dir/mobile-$browser.log" 2>&1 &
+      browser_pids+=("$!")
+    done
+    browsers_failed=0
+    for pid in "${browser_pids[@]}"; do wait "$pid" || browsers_failed=1; done
+    for browser in chromium webkit; do
+      echo "::group::Mobile checks: $browser"
+      cat "$report_dir/mobile-$browser.log"
+      echo "::endgroup::"
+    done
+    [ "$browsers_failed" = 0 ]
     ;;
 
   *)
diff --git a/.github/scripts/staging-proof.sh b/.github/scripts/staging-proof.sh
new file mode 100755
index 00000000000..7e15edadd5d
--- /dev/null
+++ b/.github/scripts/staging-proof.sh
@@ -0,0 +1,38 @@
+#!/usr/bin/env bash
+# Prints `proven=true` when the checked-out main commit is a merge whose tree is byte-identical to
+# its staging parent and a staging push run of that parent passed `checks / ci`; `proven=false`
+# otherwise, including on any error, so the caller falls back to running the full checks.
+#
+# A release lands on main as a merge of the staging head, and the merge's tree equals that head's
+# tree, so the staging push run already checked exactly this code with the same checks.yml.
+# Waits for a staging run that is still in progress, up to PROOF_WAIT_SECONDS.
+#
+# Usage: GH_TOKEN=... GITHUB_REPOSITORY=owner/repo staging-proof.sh   (needs fetch-depth: 2)
+set -u
+
+prove() {
+  echo "proven=$1"
+  echo "$2" >&2
+  exit 0
+}
+
+staging=$(git rev-parse -q --verify 'HEAD^2') || prove false 'Not a merge commit; running the checks.'
+[ "$(git rev-parse 'HEAD^{tree}')" = "$(git rev-parse "$staging^{tree}")" ] ||
+  prove false "The tree differs from staging parent $staging; running the checks."
+
+deadline=$((SECONDS + ${PROOF_WAIT_SECONDS:-2400}))
+while :; do
+  runs=$(gh api "repos/$GITHUB_REPOSITORY/actions/workflows/ci.yml/runs?head_sha=$staging&event=push&branch=staging&per_page=20" \
+    --jq '.workflow_runs[] | "\(.id) \(.status)"') || prove false 'Could not list staging runs; running the checks.'
+  [ -n "$runs" ] || prove false "No staging push run for $staging; running the checks."
+  pending=false
+  while read -r id status; do
+    gate=$(gh api "repos/$GITHUB_REPOSITORY/actions/runs/$id/jobs?per_page=100" \
+      --jq '[.jobs[] | select(.name == "checks / ci") | .conclusion] | first // ""') || gate=''
+    [ "$gate" = success ] && prove true "Staging run $id passed checks / ci on this exact tree ($staging); skipping the checks."
+    [ "$status" = completed ] || pending=true
+  done <<< "$runs"
+  [ "$pending" = true ] || prove false "No staging run for $staging passed checks / ci; running the checks."
+  [ "$SECONDS" -lt "$deadline" ] || prove false "Timed out waiting for the staging run of $staging; running the checks."
+  sleep 30
+done
diff --git a/.github/workflows/checks.yml b/.github/workflows/checks.yml
index 0865cdf99a8..3124937a2a8 100644
--- a/.github/workflows/checks.yml
+++ b/.github/workflows/checks.yml
@@ -201,6 +201,14 @@ jobs:
         working-directory: packages/db
         run: bun run db:migrate
 
+      # One cache per group: each group's app runs under its own fixed NEXT_PUBLIC_* values.
+      - name: Mount Turbopack dev cache
+        uses: ./.github/actions/dev-cache
+        with:
+          provider: ${{ vars.CI_PROVIDER }}
+          name: e2e-${{ matrix.group }}
+          env-hash: ${{ hashFiles('.github/scripts/http-e2e.sh') }}
+
       # No step timeout: the job's bound covers a hang without cutting a slow but healthy suite
       # short of writing its report.
       - name: Run end-to-end suites
@@ -216,9 +224,9 @@ jobs:
           if-no-files-found: ignore
           retention-days: 7
 
-  # Pull requests skip the live desktop suite only when every change is clearly unrelated to the
-  # app it drives (docs, other apps, published content). Anything else, and any failure to work
-  # out the diff, runs it: a pull request that skipped it wrongly would first fail on staging.
+  # Pull requests run the live desktop suite only when they touch a path it exercises (listed in
+  # desktop-live-changes.sh), or when the diff cannot be worked out. Pushes always run it, so a
+  # pull request that skipped it wrongly would first fail on staging, before anything deploys.
   desktop-changes:
     name: desktop-changes
     runs-on: &runner-2vcpu ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-2vcpu-ubuntu-2404' || 'ubuntu-latest' }}
@@ -293,21 +301,13 @@ jobs:
         run: bun run db:migrate
 
       # Turbopack's dev cache turns the spec's route warm-up from a cold compile (~4 min) into a
-      # restore. It is content-addressed, so a pull request's changed modules still recompile; the
-      # key carries the installed Next version so an upgrade starts from an empty cache, and the
-      # event and fork segments keep untrusted runs off the cache trusted runs read.
-      - name: Resolve Turbopack dev cache key
-        id: next-cache
-        run: echo "key=${GITHUB_REPOSITORY}-next-dev-desktop-live-${GITHUB_EVENT_NAME}${FORK_SUFFIX}-$(jq -r .version node_modules/next/package.json)" >> "$GITHUB_OUTPUT"
-        env:
-          FORK_SUFFIX: ${{ github.event.pull_request.head.repo.fork && '-fork' || '' }}
-
+      # restore.
       - name: Mount Turbopack dev cache
-        uses: ./.github/actions/cache
+        uses: ./.github/actions/dev-cache
         with:
           provider: ${{ vars.CI_PROVIDER }}
-          key: ${{ steps.next-cache.outputs.key }}
-          path: ./apps/sim/.next/dev
+          name: desktop-live
+          env-hash: ${{ hashFiles('.github/workflows/checks.yml') }}
 
       # Chat switches, Stop, sign-out, approval, the dormant-executor round trip, and background
       # runs across a chat switch and a network cut. The spec runs the recording proxy (the app's
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 3a4cf06f3ce..307dcecd459 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -32,9 +32,41 @@ permissions:
   contents: read
 
 jobs:
+  # A release lands on main as a merge whose tree is identical to the staging head it merges, and
+  # that staging push already ran the checks on exactly this code. When a staging run of the merged
+  # parent passed `checks / ci`, main skips its own checks and the deploy chain gates on this proof
+  # instead. Any other shape, any error, or no green staging run falls back to the full checks.
+  proof:
+    name: proof
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+    runs-on: &runner-2vcpu ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-2vcpu-ubuntu-2404' || 'ubuntu-latest' }}
+    # Waits for a staging run still in progress for at most 40 minutes.
+    timeout-minutes: 45
+    permissions:
+      contents: read
+      actions: read
+    outputs:
+      proven: ${{ steps.proof.outputs.proven }}
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
+        with:
+          fetch-depth: 2
+          persist-credentials: false
+
+      - name: Look for a green staging run of this tree
+        id: proof
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: bash .github/scripts/staging-proof.sh >> "$GITHUB_OUTPUT"
+
   checks:
     name: checks
-    if: github.ref != 'refs/heads/dev' || github.event_name == 'pull_request'
+    needs: [proof]
+    if: >-
+      !cancelled() &&
+      (github.ref != 'refs/heads/dev' || github.event_name == 'pull_request') &&
+      needs.proof.outputs.proven != 'true'
     uses: ./.github/workflows/checks.yml
 
   # Detect if this is a version release commit (e.g., "v0.5.24: ...")
@@ -42,7 +74,7 @@ jobs:
   # message, no checkout and no install.
   version:
     name: version
-    runs-on: &runner-2vcpu ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-2vcpu-ubuntu-2404' || 'ubuntu-latest' }}
+    runs-on: *runner-2vcpu
     timeout-minutes: 5
     if: github.event_name == 'push' && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/staging' || github.ref == 'refs/heads/dev')
     outputs:
@@ -114,14 +146,14 @@ jobs:
   # migration sidecar)
   migrate:
     name: migrate
-    needs: [checks]
+    needs: [proof, checks]
     # Explicit need results instead of the implicit success(): a skipped job
     # anywhere in the transitive needs chain silently fails implicit success()
     # and cascade-skips the deploy chain (migrate -> promote ->
     # CodeDeploy) — this bit us on 2026-07-23. State requirements explicitly.
     if: >-
       !cancelled() &&
-      needs.checks.result == 'success' &&
+      (needs.checks.result == 'success' || needs.proof.outputs.proven == 'true') &&
       github.event_name == 'push' &&
       (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/staging')
     uses: ./.github/workflows/migrate.yml
@@ -564,7 +596,8 @@ jobs:
       needs.promote.result == 'success' &&
       needs.trigger-upload.result == 'success' &&
       needs.promote.outputs.promoted == 'true'
-    runs-on: *runner-4vcpu
+    # Mostly waiting on the ECS cutover after a dependency install: the smallest runner is enough.
+    runs-on: *runner-2vcpu
     # Leave setup/promotion headroom above the 70-minute cutover poll.
     timeout-minutes: 90
     permissions:
@@ -992,6 +1025,8 @@ jobs:
       # Sigstore signs against the runner's OIDC identity; no key material is stored.
       id-token: write
       attestations: write
+      # Records each attestation against the image as an artifact storage record.
+      artifact-metadata: write
     strategy:
       fail-fast: false
       matrix:
@@ -1031,7 +1066,7 @@ jobs:
 
       - name: Attest SBOM
         if: matrix.platform != 'index'
-        uses: actions/attest-sbom@c604332985a26aa8cf1bdc465b92731239ec6b9e # v4.1.0
+        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
         with:
           subject-name: ${{ matrix.image }}
           subject-digest: ${{ matrix.digest }}
@@ -1041,7 +1076,7 @@ jobs:
           push-to-registry: true
 
       - name: Attest build provenance
-        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
+        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
         with:
           subject-name: ${{ matrix.image }}
           subject-digest: ${{ matrix.digest }}
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 9e7d3752c18..e3fe26b098c 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -85,7 +85,9 @@ jobs:
     # run, so 8 vCPU was 4x more machine than it ever used.
     runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && matrix.bs_runner || 'ubuntu-latest' }}
     timeout-minutes: 60
-    if: github.event.pull_request.draft != true
+    # Not on the staging -> main release pull request: every staging push re-syncs it with code the
+    # staging pull requests already ran this on, and main's push and schedule still run it.
+    if: github.event.pull_request.draft != true && github.head_ref != 'staging'
     permissions:
       security-events: write
       contents: read
diff --git a/.github/workflows/desktop-e2e.yml b/.github/workflows/desktop-e2e.yml
index a7509bbd68b..0ceb0d4af25 100644
--- a/.github/workflows/desktop-e2e.yml
+++ b/.github/workflows/desktop-e2e.yml
@@ -59,7 +59,9 @@ concurrency:
 jobs:
   e2e:
     name: e2e
-    if: github.event_name != 'schedule'
+    # Not on the staging -> main release pull request: every staging push re-syncs it with code the
+    # staging pull requests already ran this on, and main's push and schedule still run it.
+    if: github.event_name != 'schedule' && github.head_ref != 'staging'
     runs-on: macos-26
     timeout-minutes: 30
     steps:
@@ -180,7 +182,7 @@ jobs:
 
   package-smoke:
     name: package-smoke
-    if: github.event_name != 'schedule'
+    if: github.event_name != 'schedule' && github.head_ref != 'staging'
     runs-on: macos-26
     timeout-minutes: 20
     steps:
diff --git a/.github/workflows/helm.yml b/.github/workflows/helm.yml
index 1f61ba8c724..d0aaf5a1b0a 100644
--- a/.github/workflows/helm.yml
+++ b/.github/workflows/helm.yml
@@ -24,9 +24,11 @@ on:
       - 'scripts/generate-image-manifest.ts'
       - 'package.json'
 
+# Pull requests cancel a superseded run; pushes never do, so a newer push cannot cut off a chart
+# publish already in flight.
 concurrency:
   group: helm-${{ github.ref }}
-  cancel-in-progress: true
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 permissions:
   contents: read
@@ -34,6 +36,9 @@ permissions:
 jobs:
   chart:
     name: chart
+    # Not on the staging -> main release pull request: every staging push re-syncs it with code the
+    # staging pull requests already ran this on, and main's push and schedule still run it.
+    if: github.head_ref != 'staging'
     runs-on: &runner-2vcpu ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-2vcpu-ubuntu-2404' || 'ubuntu-latest' }}
     timeout-minutes: 15
     steps:
@@ -260,7 +265,8 @@ jobs:
       contents: read # Read the chart source.
       packages: write # Push the chart, its signature, and its attestations to GHCR.
       id-token: write # Sigstore signs against the runner's OIDC identity; no key material is stored.
-      attestations: write # Let actions/attest-build-provenance record the SLSA provenance.
+      attestations: write # Let actions/attest record the SLSA provenance.
+      artifact-metadata: write # And its artifact storage record.
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
         with:
@@ -388,7 +394,7 @@ jobs:
       # attestation with it, rather than only being retrievable from GitHub.
       - name: Attest build provenance
         if: steps.exists.outputs.already == 'false'
-        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
+        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
         with:
           subject-name: ${{ steps.package.outputs.repository }}
           subject-digest: ${{ steps.push.outputs.digest }}
diff --git a/apps/sim/lib/billing/webhooks/stripe-sync-convergence.integration.ts b/apps/sim/lib/billing/webhooks/stripe-sync-convergence.integration.ts
index d2f082ea461..72c7e371caf 100644
--- a/apps/sim/lib/billing/webhooks/stripe-sync-convergence.integration.ts
+++ b/apps/sim/lib/billing/webhooks/stripe-sync-convergence.integration.ts
@@ -15,6 +15,7 @@ import {
   type InMemoryStripe,
   stripeClientMock,
 } from '@sim/testing/mocks/stripe.mock'
+import { sleep } from '@sim/utils/helpers'
 import { generateId } from '@sim/utils/id'
 import { type BetterAuthOptions, betterAuth } from 'better-auth'
 import { createAuthMiddleware } from 'better-auth/api'
@@ -376,7 +377,11 @@ type TestTransaction = Parameters<Parameters<typeof testDatabase.transaction>[0]
 
 /**
  * Starts a transaction that takes its locks in `holdLocks`, then parks until released and runs
- * `finish`. `untilBlocking` resolves once another backend is waiting on one of its locks.
+ * `finish`. `locked` resolves once those locks are held: start the contending work after it, or the
+ * contender can take the lock first and nothing ever waits on the parked transaction.
+ * `untilBlocking` resolves once another backend is waiting on one of its locks; if none does within
+ * the deadline it releases the transaction before throwing, so a failure never leaves it holding
+ * locks that the suite's teardown then waits on.
  */
 function startParkedTransaction(
   holdLocks: (tx: TestTransaction) => Promise<void>,
@@ -399,16 +404,18 @@ function startParkedTransaction(
   })
   async function untilBlocking() {
     const pid = await holderPid
-    for (let attempt = 0; attempt < 200; attempt++) {
+    const deadline = Date.now() + 10_000
+    while (Date.now() < deadline) {
       const [row] = await connection<{ blocked: number }[]>`
         select count(*)::int as blocked from pg_stat_activity
         where ${pid}::int = any(pg_blocking_pids(pid))`
       if (row.blocked > 0) return
-      await new Promise<void>((resolve) => setImmediate(resolve))
+      await sleep(10)
     }
+    release()
     throw new Error('No transaction ever waited on the parked one')
   }
-  return { done, release, untilBlocking }
+  return { done, release, locked: holderPid.then(() => undefined), untilBlocking }
 }
 
 describe('cancel_at_period_end sync', () => {
@@ -1037,6 +1044,7 @@ describe('Team activation', () => {
         reason: 'admin-cancel-at-period-end',
       })
     })
+    await cancelling.locked
     const activating = testDatabase.transaction((tx) =>
       ensureTeamOrganizationForAcceptance({
         billingOwnerUserId: owner.id,
@@ -1088,6 +1096,7 @@ describe('operator retry', () => {
         })
       }
     )
+    await writing.locked
     const requeuing = requeueFromAdminApi(pauseSync)
     await writing.untilBlocking()
     writing.release()
@@ -1129,6 +1138,7 @@ describe('operator retry', () => {
         })
       }
     )
+    await writing.locked
     const retrying = requestDashboardSubscriptionCancellation({
       organizationId: org.organizationId,
       operationId,
diff --git a/apps/sim/scripts/test-mobile-e2e.ts b/apps/sim/scripts/test-mobile-e2e.ts
index 0277dbb05b1..8d326524b10 100644
--- a/apps/sim/scripts/test-mobile-e2e.ts
+++ b/apps/sim/scripts/test-mobile-e2e.ts
@@ -20,7 +20,8 @@ import postgres from 'postgres'
  * Real browser coverage against a running local app and disposable PostgreSQL.
  * Requires MOBILE_E2E_BASE_URL, MOBILE_E2E_DATABASE_URL, MOBILE_E2E_AUTH_SECRET,
  * and MOBILE_E2E_REPORT_PATH. Install Chromium and WebKit with Playwright first.
- * MOBILE_E2E_BROWSER and MOBILE_E2E_VIEWPORT narrow a diagnostic rerun.
+ * MOBILE_E2E_BROWSER runs one browser (CI runs one process per browser, against one app), and
+ * MOBILE_E2E_VIEWPORT narrows a diagnostic rerun.
  */
 const logger = createLogger('MobileE2E')
 const expect = browserExpect.configure({ timeout: 20_000 })
@@ -1066,6 +1067,7 @@ try {
     durationMs: 0,
     error: getErrorMessage(error),
   })
+  logger.error('FAIL suite setup', { error: getErrorMessage(error) })
 } finally {
   await check('fixtures are removed', undefined, async () => {
     await sql.begin(async (tx) => {
diff --git a/scripts/desktop-live-changes.test.ts b/scripts/desktop-live-changes.test.ts
index 611414a9bfa..fbcffa11917 100644
--- a/scripts/desktop-live-changes.test.ts
+++ b/scripts/desktop-live-changes.test.ts
@@ -19,7 +19,7 @@ function write(repo: string, file: string, content: string) {
   writeFileSync(join(repo, file), content)
 }
 
-/** Builds a clone whose base commit holds `apps/sim/x.ts` and whose origin is a local bare repo. */
+/** Builds a clone whose base commit holds `apps/desktop/x.ts` and whose origin is a local bare repo. */
 function fixture() {
   const root = mkdtempSync(join(tmpdir(), 'desktop-live-changes-'))
   fixtures.push(root)
@@ -31,7 +31,7 @@ function fixture() {
   git(repo, 'config', 'user.name', 'Test')
   git(repo, 'config', 'commit.gpgsign', 'false')
   git(repo, 'remote', 'add', 'origin', origin)
-  write(repo, 'apps/sim/x.ts', 'export const x = 1\n'.repeat(20))
+  write(repo, 'apps/desktop/x.ts', 'export const x = 1\n'.repeat(20))
   git(repo, 'add', '-A')
   git(repo, 'commit', '--quiet', '-m', 'base')
   const base = git(repo, 'rev-parse', 'HEAD')
@@ -51,7 +51,7 @@ describe('desktop live change gate', () => {
   it('runs the suite when a live file moves into a skipped path', () => {
     const { repo, base } = fixture()
     mkdirSync(join(repo, 'apps/docs'), { recursive: true })
-    git(repo, 'mv', 'apps/sim/x.ts', 'apps/docs/x.ts')
+    git(repo, 'mv', 'apps/desktop/x.ts', 'apps/docs/x.ts')
     git(repo, 'commit', '--quiet', '-m', 'move')
 
     const result = detect(repo, base)
@@ -70,6 +70,28 @@ describe('desktop live change gate', () => {
     expect(result.stdout.trim()).toBe('changed=false')
   })
 
+  it('skips the suite when an app change is outside every path it exercises', () => {
+    const { repo, base } = fixture()
+    write(repo, 'apps/sim/app/api/schedules/execute/route.ts', 'export const GET = () => null\n')
+    git(repo, 'add', '-A')
+    git(repo, 'commit', '--quiet', '-m', 'schedules')
+
+    const result = detect(repo, base)
+    expect(result.status, result.stderr).toBe(0)
+    expect(result.stdout.trim()).toBe('changed=false')
+  })
+
+  it('runs the suite when a change touches the chat page', () => {
+    const { repo, base } = fixture()
+    write(repo, 'apps/sim/app/workspace/[workspaceId]/home/page.tsx', 'export default null\n')
+    git(repo, 'add', '-A')
+    git(repo, 'commit', '--quiet', '-m', 'chat page')
+
+    const result = detect(repo, base)
+    expect(result.status, result.stderr).toBe(0)
+    expect(result.stdout.trim()).toBe('changed=true')
+  })
+
   it('runs the suite when the base commit cannot be fetched', () => {
     const { repo } = fixture()
     const result = detect(repo, '0'.repeat(40))
diff --git a/vitest.integration-durations.json b/vitest.integration-durations.json
index 27fb0e4bf46..678b6c76b1f 100644
--- a/vitest.integration-durations.json
+++ b/vitest.integration-durations.json
@@ -1,183 +1,207 @@
 {
-  "apps/sim/app/api/auth/oauth2/token/route.integration.ts": 3.9,
+  "apps/sim/app/api/auth/oauth2/token/route.integration.ts": 12.9,
   "apps/sim/app/api/billing/update-cost/route.integration.ts": 2.7,
-  "apps/sim/app/api/copilot/chat/stream/desktop-executor.integration.ts": 6.8,
-  "apps/sim/app/api/knowledge/connectors/member-sync/route.integration.ts": 1.8,
-  "apps/sim/app/api/v1/knowledge/route.integration.ts": 2.6,
-  "apps/sim/background/cleanup-table-row-ttl-predicate.integration.ts": 0.5,
-  "apps/sim/background/cleanup-table-row-ttl.integration.ts": 5.7,
-  "apps/sim/ee/access-requests/lib/application/flow.integration.ts": 1.1,
-  "apps/sim/ee/access-requests/lib/impact.integration.ts": 0.8,
+  "apps/sim/app/api/copilot/chat/stream/desktop-executor.integration.ts": 7.1,
+  "apps/sim/app/api/knowledge/connectors/member-sync/route.integration.ts": 1.5,
+  "apps/sim/app/api/v1/knowledge/route.integration.ts": 2.9,
+  "apps/sim/background/cleanup-soft-deletes.integration.ts": 2.8,
+  "apps/sim/background/cleanup-table-row-ttl-predicate.integration.ts": 0.4,
+  "apps/sim/background/cleanup-table-row-ttl.integration.ts": 5.3,
+  "apps/sim/ee/access-requests/lib/application/copilot-requests.integration.ts": 4,
+  "apps/sim/ee/access-requests/lib/application/flow.integration.ts": 1.3,
+  "apps/sim/ee/access-requests/lib/impact.integration.ts": 0.6,
   "apps/sim/ee/access-requests/lib/repository.integration.ts": 0.4,
-  "apps/sim/ee/scim/lib/managed-membership.integration.ts": 0.6,
-  "apps/sim/ee/workspace-forking/application/revision.integration.ts": 2,
-  "apps/sim/ee/workspace-forking/lib/lineage/fork-lock-order.integration.ts": 1.7,
-  "apps/sim/executor/handlers/agent/memory-harness.integration.ts": 6.9,
-  "apps/sim/lib/auth/oauth-provider-lifecycle.integration.ts": 3.1,
-  "apps/sim/lib/auth/oauth-token-family.integration.ts": 1,
-  "apps/sim/lib/auth/sim-auth-adapter.integration.ts": 0.7,
-  "apps/sim/lib/auth/sso/application/admit-sso-user.integration.ts": 0.5,
-  "apps/sim/lib/auth/sso/primary-provider.integration.ts": 1.8,
+  "apps/sim/ee/scim/lib/managed-membership.integration.ts": 0.7,
+  "apps/sim/ee/workspace-forking/application/revision.integration.ts": 2.3,
+  "apps/sim/ee/workspace-forking/lib/lineage/fork-lock-order.integration.ts": 1.9,
+  "apps/sim/executor/handlers/agent/memory-harness.integration.ts": 18.5,
+  "apps/sim/lib/audit-logs/export.integration.ts": 2.2,
+  "apps/sim/lib/audit-logs/query.integration.ts": 0.5,
+  "apps/sim/lib/auth/lifecycle-audit.integration.ts": 4,
+  "apps/sim/lib/auth/oauth-provider-lifecycle.integration.ts": 1.1,
+  "apps/sim/lib/auth/oauth-token-family.integration.ts": 0.8,
+  "apps/sim/lib/auth/sim-auth-adapter.integration.ts": 0.6,
+  "apps/sim/lib/auth/sso/application/admit-sso-user.integration.ts": 0.6,
+  "apps/sim/lib/auth/sso/application/provider-settings.integration.ts": 4.9,
+  "apps/sim/lib/auth/sso/primary-provider.integration.ts": 5.6,
+  "apps/sim/lib/auth/sso/provider-concurrency.integration.ts": 1.1,
+  "apps/sim/lib/billing/application/organization-billing/get-organization-plan-seats.integration.ts": 1.2,
   "apps/sim/lib/billing/calculations/usage-reservation.integration.ts": 0.3,
-  "apps/sim/lib/billing/core/organization-activity.integration.ts": 0.8,
-  "apps/sim/lib/billing/core/organization-usage-pagination.integration.ts": 0.6,
-  "apps/sim/lib/billing/core/plan.integration.ts": 0.5,
+  "apps/sim/lib/billing/core/ledger-read.integration.ts": 1.8,
+  "apps/sim/lib/billing/core/organization-activity.integration.ts": 0.6,
+  "apps/sim/lib/billing/core/organization-usage-pagination.integration.ts": 0.5,
+  "apps/sim/lib/billing/core/plan.integration.ts": 0.4,
   "apps/sim/lib/billing/core/reporting-usage-cache.integration.ts": 0.9,
-  "apps/sim/lib/billing/core/usage-analytics-queries.integration.ts": 0.6,
-  "apps/sim/lib/billing/core/usage-log.integration.ts": 15.7,
-  "apps/sim/lib/billing/core/usage-threshold-email.integration.ts": 0.5,
-  "apps/sim/lib/billing/organizations/member-limits.integration.ts": 0.9,
+  "apps/sim/lib/billing/core/usage-analytics-queries.integration.ts": 0.5,
+  "apps/sim/lib/billing/core/usage-log.integration.ts": 14.1,
+  "apps/sim/lib/billing/core/usage-threshold-email.integration.ts": 0.6,
+  "apps/sim/lib/billing/organizations/member-limits.integration.ts": 0.8,
+  "apps/sim/lib/billing/webhooks/enterprise-missing-organization.integration.ts": 2.6,
+  "apps/sim/lib/billing/webhooks/stripe-sync-convergence.integration.ts": 2.6,
+  "apps/sim/lib/changelog/repository.integration.ts": 0.4,
   "apps/sim/lib/core/async-jobs/backends/trigger-dev.integration.ts": 0.7,
-  "apps/sim/lib/core/outbox/retention.integration.ts": 0.5,
-  "apps/sim/lib/core/outbox/service.integration.ts": 7.2,
+  "apps/sim/lib/core/outbox/retention.integration.ts": 0.4,
+  "apps/sim/lib/core/outbox/service.integration.ts": 6.1,
   "apps/sim/lib/core/rate-limiter/provider-capacity.integration.ts": 0.8,
-  "apps/sim/lib/credential-groups/__integration__/hubspot-mcp.integration.ts": 2.4,
-  "apps/sim/lib/credential-groups/__integration__/organization-account-outbound.integration.ts": 1.4,
-  "apps/sim/lib/dashboards/repository.integration.ts": 0.4,
-  "apps/sim/lib/db/advisory-locks.integration.ts": 0.7,
+  "apps/sim/lib/credential-groups/__integration__/hubspot-mcp.integration.ts": 2.3,
+  "apps/sim/lib/credential-groups/__integration__/organization-account-outbound.integration.ts": 1.1,
+  "apps/sim/lib/credentials/__integration__/copilot-credential-members.integration.ts": 3.2,
+  "apps/sim/lib/credentials/application/credential-sharing.integration.ts": 1.3,
+  "apps/sim/lib/credentials/client-credential-accounts/vanta-token.integration.ts": 0.8,
+  "apps/sim/lib/dashboards/repository.integration.ts": 0.3,
+  "apps/sim/lib/data-drains/service.integration.ts": 8.4,
+  "apps/sim/lib/data-drains/sources/coverage.integration.ts": 0.5,
+  "apps/sim/lib/db/advisory-locks.integration.ts": 0.6,
   "apps/sim/lib/desktop/application/activity.integration.ts": 0.8,
-  "apps/sim/lib/desktop/application/executor.integration.ts": 1.8,
+  "apps/sim/lib/desktop/application/executor.integration.ts": 1.5,
   "apps/sim/lib/desktop/application/import.integration.ts": 0.9,
-  "apps/sim/lib/desktop/executor/bound-turn.integration.ts": 85.6,
-  "apps/sim/lib/desktop/executor/desktop-call-classifier.integration.ts": 0.5,
-  "apps/sim/lib/desktop/source-request.integration.ts": 1.7,
-  "apps/sim/lib/environment/execution-environment.integration.ts": 0.6,
-  "apps/sim/lib/execution/remote-sandbox/session-file-provenance.integration.ts": 0.6,
+  "apps/sim/lib/desktop/executor/bound-turn.integration.ts": 65.4,
+  "apps/sim/lib/desktop/executor/desktop-call-classifier.integration.ts": 0.4,
+  "apps/sim/lib/desktop/source-request.integration.ts": 1.6,
+  "apps/sim/lib/environment/execution-environment.integration.ts": 0.5,
+  "apps/sim/lib/execution/remote-sandbox/session-file-provenance.integration.ts": 0.5,
   "apps/sim/lib/execution/remote-sandbox/session-input-certification.integration.ts": 0.4,
-  "apps/sim/lib/knowledge/__integration__/application-acl.integration.ts": 3.9,
+  "apps/sim/lib/invitations/__integration__/copilot-workspace-invitations.integration.ts": 3,
+  "apps/sim/lib/knowledge/__integration__/application-acl.integration.ts": 5.1,
   "apps/sim/lib/knowledge/__integration__/coda-live.integration.ts": 0,
-  "apps/sim/lib/knowledge/__integration__/confluence-identity.integration.ts": 2.1,
+  "apps/sim/lib/knowledge/__integration__/confluence-identity.integration.ts": 2,
   "apps/sim/lib/knowledge/__integration__/confluence-live.integration.ts": 0,
-  "apps/sim/lib/knowledge/__integration__/connector-deferral.integration.ts": 1.9,
-  "apps/sim/lib/knowledge/__integration__/connector-lease-pages.integration.ts": 25.3,
-  "apps/sim/lib/knowledge/__integration__/connector-lifecycle-locks.integration.ts": 2,
-  "apps/sim/lib/knowledge/__integration__/connector-partition-work.integration.ts": 1.7,
-  "apps/sim/lib/knowledge/__integration__/connector-permissions.integration.ts": 0.5,
-  "apps/sim/lib/knowledge/__integration__/connector-persistence-regressions.integration.ts": 3.7,
-  "apps/sim/lib/knowledge/__integration__/connector-save-concurrency.integration.ts": 2.3,
-  "apps/sim/lib/knowledge/__integration__/connector-upload.integration.ts": 1.6,
-  "apps/sim/lib/knowledge/__integration__/directory-sync.integration.ts": 2.3,
-  "apps/sim/lib/knowledge/__integration__/dormant-processing-recovery.integration.ts": 1.3,
+  "apps/sim/lib/knowledge/__integration__/connector-deferral.integration.ts": 1.4,
+  "apps/sim/lib/knowledge/__integration__/connector-lease-pages.integration.ts": 22.4,
+  "apps/sim/lib/knowledge/__integration__/connector-lifecycle-locks.integration.ts": 1.7,
+  "apps/sim/lib/knowledge/__integration__/connector-partition-work.integration.ts": 1.4,
+  "apps/sim/lib/knowledge/__integration__/connector-permissions.integration.ts": 0.4,
+  "apps/sim/lib/knowledge/__integration__/connector-persistence-regressions.integration.ts": 3.1,
+  "apps/sim/lib/knowledge/__integration__/connector-save-concurrency.integration.ts": 4.3,
+  "apps/sim/lib/knowledge/__integration__/connector-upload.integration.ts": 1.4,
+  "apps/sim/lib/knowledge/__integration__/directory-sync.integration.ts": 2.4,
+  "apps/sim/lib/knowledge/__integration__/dormant-processing-recovery.integration.ts": 1.2,
   "apps/sim/lib/knowledge/__integration__/dormant-search-processing.integration.ts": 1.6,
-  "apps/sim/lib/knowledge/__integration__/embedding-insert-batches.integration.ts": 1.4,
-  "apps/sim/lib/knowledge/__integration__/embedding-processing-recovery.integration.ts": 3.2,
-  "apps/sim/lib/knowledge/__integration__/execution-archive-provenance.integration.ts": 4.1,
-  "apps/sim/lib/knowledge/__integration__/external-file-provenance.integration.ts": 2,
-  "apps/sim/lib/knowledge/__integration__/filtered-search.integration.ts": 1.9,
+  "apps/sim/lib/knowledge/__integration__/embedding-insert-batches.integration.ts": 1.3,
+  "apps/sim/lib/knowledge/__integration__/embedding-processing-recovery.integration.ts": 2.8,
+  "apps/sim/lib/knowledge/__integration__/execution-archive-provenance.integration.ts": 4,
+  "apps/sim/lib/knowledge/__integration__/external-file-provenance.integration.ts": 1.7,
+  "apps/sim/lib/knowledge/__integration__/filtered-search.integration.ts": 2.7,
   "apps/sim/lib/knowledge/__integration__/gitlab-federated.integration.ts": 0,
   "apps/sim/lib/knowledge/__integration__/gitlab-live.integration.ts": 0,
-  "apps/sim/lib/knowledge/__integration__/gitlab-workspace.integration.ts": 3.9,
+  "apps/sim/lib/knowledge/__integration__/gitlab-workspace.integration.ts": 3.1,
   "apps/sim/lib/knowledge/__integration__/google-drive-live.integration.ts": 0,
   "apps/sim/lib/knowledge/__integration__/google-drive-member-live.integration.ts": 0,
-  "apps/sim/lib/knowledge/__integration__/google-drive-shortcuts.integration.ts": 3,
+  "apps/sim/lib/knowledge/__integration__/google-drive-shortcuts.integration.ts": 2.4,
   "apps/sim/lib/knowledge/__integration__/kb-block-search.integration.ts": 0.9,
-  "apps/sim/lib/knowledge/__integration__/knowledge-base-deletion.integration.ts": 0.8,
-  "apps/sim/lib/knowledge/__integration__/knowledge-base-list.integration.ts": 2.6,
-  "apps/sim/lib/knowledge/__integration__/knowledge-projection.integration.ts": 0.9,
-  "apps/sim/lib/knowledge/__integration__/listing-continuation.integration.ts": 26.1,
-  "apps/sim/lib/knowledge/__integration__/member-document-lifecycle.integration.ts": 8.6,
-  "apps/sim/lib/knowledge/__integration__/member-scope-renewal.integration.ts": 1.6,
+  "apps/sim/lib/knowledge/__integration__/knowledge-base-deletion.integration.ts": 0.6,
+  "apps/sim/lib/knowledge/__integration__/knowledge-base-list.integration.ts": 3.8,
+  "apps/sim/lib/knowledge/__integration__/knowledge-projection.integration.ts": 0.8,
+  "apps/sim/lib/knowledge/__integration__/listing-continuation.integration.ts": 24.6,
+  "apps/sim/lib/knowledge/__integration__/member-document-lifecycle.integration.ts": 4.2,
+  "apps/sim/lib/knowledge/__integration__/member-scope-renewal.integration.ts": 1.4,
   "apps/sim/lib/knowledge/__integration__/ocr-input-failures.integration.ts": 1.7,
-  "apps/sim/lib/knowledge/__integration__/processing-lock-scope.integration.ts": 1.5,
-  "apps/sim/lib/knowledge/__integration__/provider-admission.integration.ts": 0.8,
-  "apps/sim/lib/knowledge/__integration__/provider-processing-recovery.integration.ts": 2.2,
+  "apps/sim/lib/knowledge/__integration__/processing-lock-scope.integration.ts": 1.7,
+  "apps/sim/lib/knowledge/__integration__/provider-admission.integration.ts": 0.6,
+  "apps/sim/lib/knowledge/__integration__/provider-processing-recovery.integration.ts": 1.7,
   "apps/sim/lib/knowledge/__integration__/providers-live.integration.ts": 0,
-  "apps/sim/lib/knowledge/__integration__/purged-detach-reservation.integration.ts": 5,
-  "apps/sim/lib/knowledge/__integration__/reranker-admission.integration.ts": 0.7,
+  "apps/sim/lib/knowledge/__integration__/purged-detach-reservation.integration.ts": 4.1,
+  "apps/sim/lib/knowledge/__integration__/reranker-admission.integration.ts": 0.6,
   "apps/sim/lib/knowledge/__integration__/scale.integration.ts": 0,
-  "apps/sim/lib/knowledge/__integration__/search-index-policy.integration.ts": 1.6,
+  "apps/sim/lib/knowledge/__integration__/search-index-policy.integration.ts": 1.7,
   "apps/sim/lib/knowledge/__integration__/search-latency.integration.ts": 0,
-  "apps/sim/lib/knowledge/__integration__/search-mcp-setup.integration.ts": 5.4,
+  "apps/sim/lib/knowledge/__integration__/search-mcp-setup.integration.ts": 10.8,
   "apps/sim/lib/knowledge/__integration__/search-reference-batching.integration.ts": 0.6,
-  "apps/sim/lib/knowledge/__integration__/search-source-pagination.integration.ts": 1.4,
-  "apps/sim/lib/knowledge/__integration__/search-source-progress.integration.ts": 3,
-  "apps/sim/lib/knowledge/__integration__/search-source-setup.integration.ts": 3,
-  "apps/sim/lib/knowledge/__integration__/slack-empty-threads.integration.ts": 2.1,
+  "apps/sim/lib/knowledge/__integration__/search-source-pagination.integration.ts": 1.2,
+  "apps/sim/lib/knowledge/__integration__/search-source-progress.integration.ts": 2.8,
+  "apps/sim/lib/knowledge/__integration__/search-source-setup.integration.ts": 2.9,
+  "apps/sim/lib/knowledge/__integration__/slack-empty-threads.integration.ts": 2.5,
   "apps/sim/lib/knowledge/__integration__/slack-live.integration.ts": 0,
-  "apps/sim/lib/knowledge/__integration__/slack-search-turns.integration.ts": 2.1,
-  "apps/sim/lib/knowledge/__integration__/storage-accounting.integration.ts": 3.1,
-  "apps/sim/lib/knowledge/__integration__/storage-cleanup.integration.ts": 1.6,
-  "apps/sim/lib/knowledge/__integration__/stored-document-recovery.integration.ts": 5.1,
+  "apps/sim/lib/knowledge/__integration__/slack-search-turns.integration.ts": 1,
+  "apps/sim/lib/knowledge/__integration__/storage-accounting.integration.ts": 2.4,
+  "apps/sim/lib/knowledge/__integration__/storage-cleanup.integration.ts": 1.2,
+  "apps/sim/lib/knowledge/__integration__/stored-document-recovery.integration.ts": 16.6,
   "apps/sim/lib/knowledge/__integration__/upload-read-provenance.integration.ts": 1.3,
   "apps/sim/lib/knowledge/__integration__/user-document-visibility.integration.ts": 0.5,
-  "apps/sim/lib/knowledge/__integration__/workspace-import.integration.ts": 1.8,
-  "apps/sim/lib/knowledge/__integration__/workspace-kb-document-access.integration.ts": 1.2,
-  "apps/sim/lib/knowledge/__integration__/workspace-lifecycle.integration.ts": 2.9,
+  "apps/sim/lib/knowledge/__integration__/workspace-import.integration.ts": 1.4,
+  "apps/sim/lib/knowledge/__integration__/workspace-kb-document-access.integration.ts": 0.9,
+  "apps/sim/lib/knowledge/__integration__/workspace-lifecycle.integration.ts": 3,
   "apps/sim/lib/knowledge/access/group-membership.integration.ts": 0.5,
-  "apps/sim/lib/knowledge/access/predicate.integration.ts": 16.5,
-  "apps/sim/lib/knowledge/application/github-installations.integration.ts": 0.8,
-  "apps/sim/lib/knowledge/application/search-index.integration.ts": 0.5,
+  "apps/sim/lib/knowledge/access/predicate.integration.ts": 1.1,
+  "apps/sim/lib/knowledge/application/github-installations.integration.ts": 0.7,
+  "apps/sim/lib/knowledge/application/search-index.integration.ts": 0.4,
   "apps/sim/lib/knowledge/application/slack-search/assistant.integration.ts": 0.8,
   "apps/sim/lib/knowledge/connectors/external-directory.integration.ts": 0.2,
-  "apps/sim/lib/knowledge/connectors/sync-content-pass.integration.ts": 1,
-  "apps/sim/lib/knowledge/connectors/sync-persistence.integration.ts": 0.6,
-  "apps/sim/lib/knowledge/search/history/history.integration.ts": 0.6,
-  "apps/sim/lib/knowledge/tags/date-tag-condition.integration.ts": 0.9,
-  "apps/sim/lib/logs/execution/completion-ledger-order.integration.ts": 2.6,
-  "apps/sim/lib/logs/execution/start-execution.integration.ts": 1.8,
-  "apps/sim/lib/memory/conversation-store.integration.ts": 2.8,
-  "apps/sim/lib/memory/message-provenance.integration.ts": 2.1,
-  "apps/sim/lib/memory/summary-store.integration.ts": 0.8,
-  "apps/sim/lib/mothership/agent-cli/workbench-file-provenance.integration.ts": 1.3,
-  "apps/sim/lib/mothership/async-runs/browser-download-claim.integration.ts": 0.6,
-  "apps/sim/lib/mothership/async-runs/orphaned-runs.integration.ts": 29.1,
-  "apps/sim/lib/mothership/async-runs/tool-identity.integration.ts": 3.2,
-  "apps/sim/lib/mothership/billing/service-store.integration.ts": 0.7,
-  "apps/sim/lib/mothership/chat/application/set-effort.integration.ts": 0.8,
-  "apps/sim/lib/mothership/chat/chat-mcp-servers.integration.ts": 0.6,
+  "apps/sim/lib/knowledge/connectors/sync-content-pass.integration.ts": 0.9,
+  "apps/sim/lib/knowledge/connectors/sync-persistence.integration.ts": 0.5,
+  "apps/sim/lib/knowledge/search/history/history.integration.ts": 0.7,
+  "apps/sim/lib/knowledge/tags/date-tag-condition.integration.ts": 0.8,
+  "apps/sim/lib/logs/execution/completion-ledger-order.integration.ts": 2.2,
+  "apps/sim/lib/logs/execution/start-execution.integration.ts": 1.6,
+  "apps/sim/lib/memory/conversation-store.integration.ts": 3.1,
+  "apps/sim/lib/memory/message-provenance.integration.ts": 1.7,
+  "apps/sim/lib/memory/summary-store.integration.ts": 0.7,
+  "apps/sim/lib/mothership/agent-cli/workbench-file-provenance.integration.ts": 2.2,
+  "apps/sim/lib/mothership/async-runs/browser-download-claim.integration.ts": 0.4,
+  "apps/sim/lib/mothership/async-runs/orphaned-runs.integration.ts": 14.8,
+  "apps/sim/lib/mothership/async-runs/tool-identity.integration.ts": 0.5,
+  "apps/sim/lib/mothership/billing/service-store.integration.ts": 0.6,
+  "apps/sim/lib/mothership/chat/application/set-effort.integration.ts": 0.7,
+  "apps/sim/lib/mothership/chat/chat-mcp-servers.integration.ts": 0.8,
   "apps/sim/lib/mothership/request/session/buffer-ttl.integration.ts": 12.3,
-  "apps/sim/lib/mothership/request/session/recovery-storm.integration.ts": 217.3,
-  "apps/sim/lib/mothership/request/session/replay-budget.integration.ts": 39,
-  "apps/sim/lib/mothership/request/session/replay-gap.integration.ts": 62.2,
-  "apps/sim/lib/mothership/request/session/stream-recovery.integration.ts": 6.9,
-  "apps/sim/lib/mothership/request/tools/workflow-client-settlement.integration.ts": 1,
-  "apps/sim/lib/mothership/tasks/application/prepare-wake.integration.ts": 12.3,
-  "apps/sim/lib/mothership/tools/client/desktop-tool-authorization.integration.ts": 6.8,
-  "apps/sim/lib/mothership/tools/client/desktop-tool-chat-view-lease.integration.ts": 6.9,
-  "apps/sim/lib/mothership/tools/client/desktop-tool-executor.integration.ts": 4.8,
-  "apps/sim/lib/mothership/tools/client/desktop-tool-pickup.integration.ts": 87.1,
-  "apps/sim/lib/projects/__integration__/foundation.integration.ts": 14.3,
-  "apps/sim/lib/selectors/__integration__/copilot-nested-selectors.integration.ts": 4.3,
-  "apps/sim/lib/sim-search/live/managed-mcp.integration.ts": 8.3,
-  "apps/sim/lib/sim-search/live/provider-discovery.integration.ts": 1.3,
-  "apps/sim/lib/table/analytics/postgres.integration.ts": 0.7,
-  "apps/sim/lib/table/row-changes.integration.ts": 0.8,
-  "apps/sim/lib/table/rows/row-writes.integration.ts": 12.5,
-  "apps/sim/lib/table/rows/secret-provenance.integration.ts": 1.9,
-  "apps/sim/lib/uploads/contexts/organization-logo/application.integration.ts": 0.8,
+  "apps/sim/lib/mothership/request/session/recovery-storm.integration.ts": 215.6,
+  "apps/sim/lib/mothership/request/session/replay-budget.integration.ts": 34,
+  "apps/sim/lib/mothership/request/session/replay-gap.integration.ts": 30.1,
+  "apps/sim/lib/mothership/request/session/stream-recovery.integration.ts": 6.7,
+  "apps/sim/lib/mothership/request/tools/workflow-client-settlement.integration.ts": 0.8,
+  "apps/sim/lib/mothership/tasks/application/prepare-wake.integration.ts": 10.6,
+  "apps/sim/lib/mothership/tools/client/desktop-tool-authorization.integration.ts": 11.9,
+  "apps/sim/lib/mothership/tools/client/desktop-tool-chat-view-lease.integration.ts": 7.8,
+  "apps/sim/lib/mothership/tools/client/desktop-tool-executor.integration.ts": 5.5,
+  "apps/sim/lib/mothership/tools/client/desktop-tool-pickup.integration.ts": 88.8,
+  "apps/sim/lib/oauth/shopify.integration.ts": 2,
+  "apps/sim/lib/organizations/application/domain-settings.integration.ts": 0.7,
+  "apps/sim/lib/permission-groups/__integration__/copilot-permission-config.integration.ts": 3.1,
+  "apps/sim/lib/projects/__integration__/foundation.integration.ts": 3.9,
+  "apps/sim/lib/selectors/__integration__/copilot-nested-selectors.integration.ts": 3.6,
+  "apps/sim/lib/sim-search/live/managed-mcp.integration.ts": 4.9,
+  "apps/sim/lib/sim-search/live/provider-discovery.integration.ts": 1.1,
+  "apps/sim/lib/table/analytics/postgres.integration.ts": 0.5,
+  "apps/sim/lib/table/application/row-audit.integration.ts": 1.2,
+  "apps/sim/lib/table/dispatcher.integration.ts": 0.6,
+  "apps/sim/lib/table/row-changes.integration.ts": 0.7,
+  "apps/sim/lib/table/rows/row-writes.integration.ts": 10.7,
+  "apps/sim/lib/table/rows/secret-provenance.integration.ts": 2.2,
+  "apps/sim/lib/uploads/contexts/organization-logo/application.integration.ts": 0.6,
   "apps/sim/lib/uploads/contexts/workspace/__integration__/file-names.integration.ts": 2.1,
-  "apps/sim/lib/uploads/contexts/workspace/__integration__/file-versions.integration.ts": 9.1,
-  "apps/sim/lib/uploads/upload-session/workspace-file-provenance.integration.ts": 0.6,
-  "apps/sim/lib/webhooks/registration-store.integration.ts": 0.9,
-  "apps/sim/lib/webhooks/trigger-block-deployment.integration.ts": 7.4,
-  "apps/sim/lib/workflows/application/compare-workflow-versions.integration.ts": 2.5,
-  "apps/sim/lib/workflows/application/read-workflow-version.integration.ts": 2.4,
-  "apps/sim/lib/workflows/custom-blocks/workspace-rows.integration.ts": 1.1,
+  "apps/sim/lib/uploads/contexts/workspace/__integration__/file-versions.integration.ts": 6.5,
+  "apps/sim/lib/uploads/upload-session/workspace-file-provenance.integration.ts": 0.4,
+  "apps/sim/lib/webhooks/registration-store.integration.ts": 0.7,
+  "apps/sim/lib/webhooks/trigger-block-deployment.integration.ts": 5.4,
+  "apps/sim/lib/workflows/application/compare-workflow-versions.integration.ts": 1.6,
+  "apps/sim/lib/workflows/application/read-workflow-version.integration.ts": 1.5,
+  "apps/sim/lib/workflows/custom-blocks/workspace-rows.integration.ts": 1.3,
   "apps/sim/lib/workflows/executor/pause-persistence.integration.ts": 5.9,
-  "apps/sim/lib/workflows/orchestration/create-workflow-with-state.integration.ts": 3.1,
-  "apps/sim/lib/workspace-files/search/chunks.integration.ts": 13.9,
-  "apps/sim/lib/workspace-files/search/dispatcher.integration.ts": 14.5,
-  "apps/sim/lib/workspace-files/search/index-plan.integration.ts": 0.2,
-  "apps/sim/lib/workspaces/__integration__/fork-sync.integration.ts": 25,
-  "apps/sim/lib/workspaces/__integration__/http-cli.integration.ts": 8.6,
-  "apps/sim/lib/workspaces/__integration__/mapped-import.integration.ts": 6,
-  "apps/sim/lib/workspaces/__integration__/pagination.integration.ts": 0.8,
-  "apps/sim/lib/workspaces/__integration__/receipts.integration.ts": 0.6,
-  "apps/sim/lib/workspaces/organization-workspaces.integration.ts": 0.8,
-  "apps/sim/tools/powerbi/powerbi.integration.ts": 8.4,
+  "apps/sim/lib/workflows/orchestration/create-workflow-with-state.integration.ts": 3,
+  "apps/sim/lib/workspace-files/__integration__/copilot-file-versions.integration.ts": 3.2,
+  "apps/sim/lib/workspace-files/search/chunks.integration.ts": 18,
+  "apps/sim/lib/workspace-files/search/dispatcher.integration.ts": 14.8,
+  "apps/sim/lib/workspace-files/search/index-plan.integration.ts": 0.1,
+  "apps/sim/lib/workspaces/__integration__/fork-sync.integration.ts": 17.7,
+  "apps/sim/lib/workspaces/__integration__/http-cli.integration.ts": 6.7,
+  "apps/sim/lib/workspaces/__integration__/mapped-import.integration.ts": 4.6,
+  "apps/sim/lib/workspaces/__integration__/pagination.integration.ts": 0.7,
+  "apps/sim/lib/workspaces/__integration__/receipts.integration.ts": 0.4,
+  "apps/sim/lib/workspaces/organization-workspaces.integration.ts": 1,
+  "apps/sim/tools/powerbi/powerbi.integration.ts": 7.4,
   "packages/db/embedding-width-migration.integration.ts": 0.4,
-  "packages/db/maintenance/search-retirement.integration.ts": 12,
+  "packages/db/maintenance/search-retirement.integration.ts": 9.9,
   "packages/db/member-sync-status-migration.integration.ts": 0,
-  "packages/db/organization-search-migration.integration.ts": 1.2,
+  "packages/db/organization-search-migration.integration.ts": 1,
   "packages/db/permission-access-requests-migration.integration.ts": 0.1,
-  "packages/db/script-migrations/0013_backfill_legacy_knowledge_base_workspaces.integration.ts": 6,
-  "packages/db/script-migrations/0014_require_knowledge_base_owner.integration.ts": 0.2,
-  "packages/db/script-migrations/0016_backfill_search_vectors.integration.ts": 8,
+  "packages/db/script-migrations/0013_backfill_legacy_knowledge_base_workspaces.integration.ts": 5.5,
+  "packages/db/script-migrations/0014_require_knowledge_base_owner.integration.ts": 0.1,
+  "packages/db/script-migrations/0016_backfill_search_vectors.integration.ts": 2.2,
   "packages/db/script-migrations/0018_repair_workspace_file_content_revision.integration.ts": 0.1,
   "packages/db/script-migrations/0021_embedding_search_connector.integration.ts": 0.2,
-  "packages/db/script-migrations/0030_retire_keyword_writers.integration.ts": 2.6,
+  "packages/db/script-migrations/0030_retire_keyword_writers.integration.ts": 2.3,
   "packages/db/scripts/connector-sync-schedule-precision.integration.ts": 0,
   "packages/db/scripts/database-failure-classification.integration.ts": 1.1,
-  "packages/db/scripts/push.integration.ts": 7,
-  "packages/db/scripts/retired-columns.integration.ts": 0.3
+  "packages/db/scripts/push.integration.ts": 5.4,
+  "packages/db/scripts/retired-columns.integration.ts": 0.1
 }

From 9ed17630f1d4cd97cc674d121c05876a2b730dd0 Mon Sep 17 00:00:00 2001
From: Waleed Latif <walif6@gmail.com>
Date: Fri, 9 Oct 2026 18:47:47 -0700
Subject: [PATCH 2/7] ci: include the chat page in the desktop gate, scope
 release-PR skips to this repository, give a cache-retry boot the full
 deadline

---
 .github/scripts/desktop-live-changes.sh | 2 +-
 .github/scripts/http-e2e.sh             | 1 +
 .github/workflows/codeql.yml            | 2 +-
 .github/workflows/desktop-e2e.yml       | 4 ++--
 .github/workflows/helm.yml              | 2 +-
 5 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/.github/scripts/desktop-live-changes.sh b/.github/scripts/desktop-live-changes.sh
index 102d52f6784..24bf83b9bd8 100755
--- a/.github/scripts/desktop-live-changes.sh
+++ b/.github/scripts/desktop-live-changes.sh
@@ -17,7 +17,7 @@ relevant='^(apps/desktop/|apps/realtime/'\
 '|apps/sim/lib/api/contracts/(chats|copilot|desktop-|mothership-|upload-sessions|workspace-file)'\
 '|apps/sim/app/api/(desktop|mothership|copilot|files|v2/uploads|auth|users/me)/'\
 '|apps/sim/app/api/workspaces/\[id\]/files/'\
-'|apps/sim/app/workspace/\[workspaceId\]/(home/|components/|layout\.tsx)'\
+'|apps/sim/app/workspace/\[workspaceId\]/(home/|chat/|components/|layout\.tsx)'\
 '|apps/sim/app/(layout\.tsx|desktop/)'\
 '|apps/sim/stores/(chat|chat-panel|panel|mothership-[a-z-]+|tool-permission|terminal|copilot-terminal|browser-session)/'\
 '|apps/sim/hooks/(use-mothership|use-desktop|use-chat|queries/(mothership|desktop|copilot|chats))'\
diff --git a/.github/scripts/http-e2e.sh b/.github/scripts/http-e2e.sh
index faf797f93e7..d452906ed5c 100755
--- a/.github/scripts/http-e2e.sh
+++ b/.github/scripts/http-e2e.sh
@@ -99,6 +99,7 @@ start_app() {
         clear_cache
         retried=true
         launch_app "$port"
+        started=$SECONDS
         continue
       fi
       echo "::error::Local $label app exited during startup."
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index e3fe26b098c..7e581dac799 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -87,7 +87,7 @@ jobs:
     timeout-minutes: 60
     # Not on the staging -> main release pull request: every staging push re-syncs it with code the
     # staging pull requests already ran this on, and main's push and schedule still run it.
-    if: github.event.pull_request.draft != true && github.head_ref != 'staging'
+    if: github.event.pull_request.draft != true && !(github.head_ref == 'staging' && github.event.pull_request.head.repo.full_name == github.repository)
     permissions:
       security-events: write
       contents: read
diff --git a/.github/workflows/desktop-e2e.yml b/.github/workflows/desktop-e2e.yml
index 0ceb0d4af25..24196523af4 100644
--- a/.github/workflows/desktop-e2e.yml
+++ b/.github/workflows/desktop-e2e.yml
@@ -61,7 +61,7 @@ jobs:
     name: e2e
     # Not on the staging -> main release pull request: every staging push re-syncs it with code the
     # staging pull requests already ran this on, and main's push and schedule still run it.
-    if: github.event_name != 'schedule' && github.head_ref != 'staging'
+    if: github.event_name != 'schedule' && !(github.head_ref == 'staging' && github.event.pull_request.head.repo.full_name == github.repository)
     runs-on: macos-26
     timeout-minutes: 30
     steps:
@@ -182,7 +182,7 @@ jobs:
 
   package-smoke:
     name: package-smoke
-    if: github.event_name != 'schedule' && github.head_ref != 'staging'
+    if: github.event_name != 'schedule' && !(github.head_ref == 'staging' && github.event.pull_request.head.repo.full_name == github.repository)
     runs-on: macos-26
     timeout-minutes: 20
     steps:
diff --git a/.github/workflows/helm.yml b/.github/workflows/helm.yml
index d0aaf5a1b0a..5aa49cadb78 100644
--- a/.github/workflows/helm.yml
+++ b/.github/workflows/helm.yml
@@ -38,7 +38,7 @@ jobs:
     name: chart
     # Not on the staging -> main release pull request: every staging push re-syncs it with code the
     # staging pull requests already ran this on, and main's push and schedule still run it.
-    if: github.head_ref != 'staging'
+    if: ${{ !(github.head_ref == 'staging' && github.event.pull_request.head.repo.full_name == github.repository) }}
     runs-on: &runner-2vcpu ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-2vcpu-ubuntu-2404' || 'ubuntu-latest' }}
     timeout-minutes: 15
     steps:

From 1d0a55b4361c71cab5bdc37e06e2c607aa7354e9 Mon Sep 17 00:00:00 2001
From: Waleed Latif <walif6@gmail.com>
Date: Fri, 9 Oct 2026 19:11:31 -0700
Subject: [PATCH 3/7] ci: keep the release PR's CodeQL scan, require the main
 base for release-PR skips, gate desktop-live on workspace permissions

---
 .github/scripts/desktop-live-changes.sh | 2 +-
 .github/workflows/codeql.yml            | 4 +---
 .github/workflows/desktop-e2e.yml       | 4 ++--
 .github/workflows/helm.yml              | 2 +-
 4 files changed, 5 insertions(+), 7 deletions(-)

diff --git a/.github/scripts/desktop-live-changes.sh b/.github/scripts/desktop-live-changes.sh
index 24bf83b9bd8..48f7e238a3b 100755
--- a/.github/scripts/desktop-live-changes.sh
+++ b/.github/scripts/desktop-live-changes.sh
@@ -13,7 +13,7 @@ set -u
 
 relevant='^(apps/desktop/|apps/realtime/'\
 '|packages/(desktop-bridge|browser-protocol|terminal-protocol|realtime-protocol|db|auth|emcn|utils|logger|security|platform-authz|runtime-secrets)/'\
-'|apps/sim/lib/(desktop|mothership|uploads|auth|terminal|browser-agent|api/(client|server))/'\
+'|apps/sim/lib/(desktop|mothership|uploads|auth|terminal|browser-agent|workspaces/permissions|api/(client|server))/'\
 '|apps/sim/lib/api/contracts/(chats|copilot|desktop-|mothership-|upload-sessions|workspace-file)'\
 '|apps/sim/app/api/(desktop|mothership|copilot|files|v2/uploads|auth|users/me)/'\
 '|apps/sim/app/api/workspaces/\[id\]/files/'\
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 7e581dac799..9e7d3752c18 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -85,9 +85,7 @@ jobs:
     # run, so 8 vCPU was 4x more machine than it ever used.
     runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && matrix.bs_runner || 'ubuntu-latest' }}
     timeout-minutes: 60
-    # Not on the staging -> main release pull request: every staging push re-syncs it with code the
-    # staging pull requests already ran this on, and main's push and schedule still run it.
-    if: github.event.pull_request.draft != true && !(github.head_ref == 'staging' && github.event.pull_request.head.repo.full_name == github.repository)
+    if: github.event.pull_request.draft != true
     permissions:
       security-events: write
       contents: read
diff --git a/.github/workflows/desktop-e2e.yml b/.github/workflows/desktop-e2e.yml
index 24196523af4..27e2a930614 100644
--- a/.github/workflows/desktop-e2e.yml
+++ b/.github/workflows/desktop-e2e.yml
@@ -61,7 +61,7 @@ jobs:
     name: e2e
     # Not on the staging -> main release pull request: every staging push re-syncs it with code the
     # staging pull requests already ran this on, and main's push and schedule still run it.
-    if: github.event_name != 'schedule' && !(github.head_ref == 'staging' && github.event.pull_request.head.repo.full_name == github.repository)
+    if: github.event_name != 'schedule' && !(github.head_ref == 'staging' && github.base_ref == 'main' && github.event.pull_request.head.repo.full_name == github.repository)
     runs-on: macos-26
     timeout-minutes: 30
     steps:
@@ -182,7 +182,7 @@ jobs:
 
   package-smoke:
     name: package-smoke
-    if: github.event_name != 'schedule' && !(github.head_ref == 'staging' && github.event.pull_request.head.repo.full_name == github.repository)
+    if: github.event_name != 'schedule' && !(github.head_ref == 'staging' && github.base_ref == 'main' && github.event.pull_request.head.repo.full_name == github.repository)
     runs-on: macos-26
     timeout-minutes: 20
     steps:
diff --git a/.github/workflows/helm.yml b/.github/workflows/helm.yml
index 5aa49cadb78..bb9e9ce9d4c 100644
--- a/.github/workflows/helm.yml
+++ b/.github/workflows/helm.yml
@@ -38,7 +38,7 @@ jobs:
     name: chart
     # Not on the staging -> main release pull request: every staging push re-syncs it with code the
     # staging pull requests already ran this on, and main's push and schedule still run it.
-    if: ${{ !(github.head_ref == 'staging' && github.event.pull_request.head.repo.full_name == github.repository) }}
+    if: ${{ !(github.head_ref == 'staging' && github.base_ref == 'main' && github.event.pull_request.head.repo.full_name == github.repository) }}
     runs-on: &runner-2vcpu ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-2vcpu-ubuntu-2404' || 'ubuntu-latest' }}
     timeout-minutes: 15
     steps:

From 4d73dd54eb1551ec0450d3abc05eae2c846a34e5 Mon Sep 17 00:00:00 2001
From: Waleed Latif <walif6@gmail.com>
Date: Fri, 9 Oct 2026 19:34:47 -0700
Subject: [PATCH 4/7] ci: keep the desktop live gate's skip-only-unrelated rule

---
 .github/scripts/desktop-live-changes.sh | 32 ++++++-------------------
 .github/workflows/checks.yml            |  6 ++---
 scripts/desktop-live-changes.test.ts    | 28 +++-------------------
 3 files changed, 13 insertions(+), 53 deletions(-)

diff --git a/.github/scripts/desktop-live-changes.sh b/.github/scripts/desktop-live-changes.sh
index 48f7e238a3b..d42cc2b2e70 100755
--- a/.github/scripts/desktop-live-changes.sh
+++ b/.github/scripts/desktop-live-changes.sh
@@ -1,30 +1,11 @@
 #!/usr/bin/env bash
-# Prints `changed=true` when a pull request touches a path the live desktop suite exercises, or when
-# the diff cannot be worked out, and `changed=false` otherwise.
-#
-# The suite (apps/desktop/e2e/desktop-tools-live-sim.spec.ts) drives the Electron app against a
-# local Sim, realtime and Redis through the desktop, mothership, copilot, upload and auth routes and
-# the chat page. A change that only breaks Sim boot or an unrelated route fails the build and e2e
-# jobs, and every staging and main push runs this suite regardless, so a path missing here can
-# delay a failure to the staging push but never lets it deploy.
+# Prints `changed=false` only when every file a pull request changes is clearly unrelated to the
+# live desktop suite, and `changed=true` otherwise, including when the diff cannot be worked out.
 #
 # Usage: desktop-live-changes.sh <base-sha>
 set -u
 
-relevant='^(apps/desktop/|apps/realtime/'\
-'|packages/(desktop-bridge|browser-protocol|terminal-protocol|realtime-protocol|db|auth|emcn|utils|logger|security|platform-authz|runtime-secrets)/'\
-'|apps/sim/lib/(desktop|mothership|uploads|auth|terminal|browser-agent|workspaces/permissions|api/(client|server))/'\
-'|apps/sim/lib/api/contracts/(chats|copilot|desktop-|mothership-|upload-sessions|workspace-file)'\
-'|apps/sim/app/api/(desktop|mothership|copilot|files|v2/uploads|auth|users/me)/'\
-'|apps/sim/app/api/workspaces/\[id\]/files/'\
-'|apps/sim/app/workspace/\[workspaceId\]/(home/|chat/|components/|layout\.tsx)'\
-'|apps/sim/app/(layout\.tsx|desktop/)'\
-'|apps/sim/stores/(chat|chat-panel|panel|mothership-[a-z-]+|tool-permission|terminal|copilot-terminal|browser-session)/'\
-'|apps/sim/hooks/(use-mothership|use-desktop|use-chat|queries/(mothership|desktop|copilot|chats))'\
-'|apps/sim/types/sim-desktop'\
-'|apps/sim/(proxy\.ts|next\.config\.ts|package\.json|instrumentation)'\
-'|bun\.lock$|package\.json$'\
-'|\.github/(workflows/(checks|ci)\.yml|scripts/desktop-live-changes\.sh|actions/))'
+unrelated='^(apps/docs/|apps/pii/|apps/sim/content/|packages/(python-sdk|ts-sdk)/)|\.mdx?$|(^|/)LICENSE$'
 
 base=${1:-}
 run() {
@@ -36,7 +17,8 @@ run() {
 git fetch --quiet --depth=1 origin "$base" || run "could not fetch $base"
 names=$(git diff --no-renames --name-only "$base" HEAD) || run "could not diff against $base"
 [ -n "$names" ] || run 'no changed files listed'
-printf 'Changed files:\n%s\n' "$names" >&2
-match=$(printf '%s\n' "$names" | grep -E -m 1 "$relevant") && run "a change touches a path it exercises: $match"
+if printf '%s\n' "$names" | grep -qvE "$unrelated"; then
+  run 'a change may affect it'
+fi
 echo "changed=false"
-echo 'Skipping the live desktop suite: no change touches a path it exercises' >&2
+echo 'Skipping the live desktop suite: every change is unrelated to it' >&2
diff --git a/.github/workflows/checks.yml b/.github/workflows/checks.yml
index 3124937a2a8..cb489f0262e 100644
--- a/.github/workflows/checks.yml
+++ b/.github/workflows/checks.yml
@@ -224,9 +224,9 @@ jobs:
           if-no-files-found: ignore
           retention-days: 7
 
-  # Pull requests run the live desktop suite only when they touch a path it exercises (listed in
-  # desktop-live-changes.sh), or when the diff cannot be worked out. Pushes always run it, so a
-  # pull request that skipped it wrongly would first fail on staging, before anything deploys.
+  # Pull requests skip the live desktop suite only when every change is clearly unrelated to the
+  # app it drives (docs, other apps, published content). Anything else, and any failure to work
+  # out the diff, runs it: a pull request that skipped it wrongly would first fail on staging.
   desktop-changes:
     name: desktop-changes
     runs-on: &runner-2vcpu ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-2vcpu-ubuntu-2404' || 'ubuntu-latest' }}
diff --git a/scripts/desktop-live-changes.test.ts b/scripts/desktop-live-changes.test.ts
index fbcffa11917..611414a9bfa 100644
--- a/scripts/desktop-live-changes.test.ts
+++ b/scripts/desktop-live-changes.test.ts
@@ -19,7 +19,7 @@ function write(repo: string, file: string, content: string) {
   writeFileSync(join(repo, file), content)
 }
 
-/** Builds a clone whose base commit holds `apps/desktop/x.ts` and whose origin is a local bare repo. */
+/** Builds a clone whose base commit holds `apps/sim/x.ts` and whose origin is a local bare repo. */
 function fixture() {
   const root = mkdtempSync(join(tmpdir(), 'desktop-live-changes-'))
   fixtures.push(root)
@@ -31,7 +31,7 @@ function fixture() {
   git(repo, 'config', 'user.name', 'Test')
   git(repo, 'config', 'commit.gpgsign', 'false')
   git(repo, 'remote', 'add', 'origin', origin)
-  write(repo, 'apps/desktop/x.ts', 'export const x = 1\n'.repeat(20))
+  write(repo, 'apps/sim/x.ts', 'export const x = 1\n'.repeat(20))
   git(repo, 'add', '-A')
   git(repo, 'commit', '--quiet', '-m', 'base')
   const base = git(repo, 'rev-parse', 'HEAD')
@@ -51,7 +51,7 @@ describe('desktop live change gate', () => {
   it('runs the suite when a live file moves into a skipped path', () => {
     const { repo, base } = fixture()
     mkdirSync(join(repo, 'apps/docs'), { recursive: true })
-    git(repo, 'mv', 'apps/desktop/x.ts', 'apps/docs/x.ts')
+    git(repo, 'mv', 'apps/sim/x.ts', 'apps/docs/x.ts')
     git(repo, 'commit', '--quiet', '-m', 'move')
 
     const result = detect(repo, base)
@@ -70,28 +70,6 @@ describe('desktop live change gate', () => {
     expect(result.stdout.trim()).toBe('changed=false')
   })
 
-  it('skips the suite when an app change is outside every path it exercises', () => {
-    const { repo, base } = fixture()
-    write(repo, 'apps/sim/app/api/schedules/execute/route.ts', 'export const GET = () => null\n')
-    git(repo, 'add', '-A')
-    git(repo, 'commit', '--quiet', '-m', 'schedules')
-
-    const result = detect(repo, base)
-    expect(result.status, result.stderr).toBe(0)
-    expect(result.stdout.trim()).toBe('changed=false')
-  })
-
-  it('runs the suite when a change touches the chat page', () => {
-    const { repo, base } = fixture()
-    write(repo, 'apps/sim/app/workspace/[workspaceId]/home/page.tsx', 'export default null\n')
-    git(repo, 'add', '-A')
-    git(repo, 'commit', '--quiet', '-m', 'chat page')
-
-    const result = detect(repo, base)
-    expect(result.status, result.stderr).toBe(0)
-    expect(result.stdout.trim()).toBe('changed=true')
-  })
-
   it('runs the suite when the base commit cannot be fetched', () => {
     const { repo } = fixture()
     const result = detect(repo, '0'.repeat(40))

From da3f759546150d463646dd324802f27619af428a Mon Sep 17 00:00:00 2001
From: Waleed Latif <walif6@gmail.com>
Date: Fri, 9 Oct 2026 19:59:15 -0700
Subject: [PATCH 5/7] ci: run the mobile browsers one after the other again

---
 .github/scripts/http-e2e.sh         | 26 +++++---------------------
 apps/sim/scripts/test-mobile-e2e.ts |  3 +--
 2 files changed, 6 insertions(+), 23 deletions(-)

diff --git a/.github/scripts/http-e2e.sh b/.github/scripts/http-e2e.sh
index d452906ed5c..1090575b7ab 100755
--- a/.github/scripts/http-e2e.sh
+++ b/.github/scripts/http-e2e.sh
@@ -201,27 +201,11 @@ case "$group" in
     export NODE_OPTIONS="${NODE_OPTIONS:+$NODE_OPTIONS }--max-old-space-size=12288"
     bunx --no-install playwright install --with-deps chromium webkit
     start_app mobile 3024 'mobile browser' record-http-status
-    # Chromium and WebKit run as two processes against the one app, so WebKit no longer waits out
-    # Chromium's pass. Each process seeds and removes its own fixtures under fresh ids and writes
-    # its own report, so they share nothing but the server.
-    browser_pids=()
-    for browser in chromium webkit; do
-      MOBILE_E2E_BROWSER="$browser" \
-      MOBILE_E2E_BASE_URL="$NEXT_PUBLIC_APP_URL" \
-      MOBILE_E2E_DATABASE_URL="$DATABASE_URL" \
-      MOBILE_E2E_AUTH_SECRET="$BETTER_AUTH_SECRET" \
-      MOBILE_E2E_REPORT_PATH="$report_dir/mobile-e2e-$browser-report.json" \
-        bun run test:mobile:e2e > "$report_dir/mobile-$browser.log" 2>&1 &
-      browser_pids+=("$!")
-    done
-    browsers_failed=0
-    for pid in "${browser_pids[@]}"; do wait "$pid" || browsers_failed=1; done
-    for browser in chromium webkit; do
-      echo "::group::Mobile checks: $browser"
-      cat "$report_dir/mobile-$browser.log"
-      echo "::endgroup::"
-    done
-    [ "$browsers_failed" = 0 ]
+    MOBILE_E2E_BASE_URL="$NEXT_PUBLIC_APP_URL" \
+    MOBILE_E2E_DATABASE_URL="$DATABASE_URL" \
+    MOBILE_E2E_AUTH_SECRET="$BETTER_AUTH_SECRET" \
+    MOBILE_E2E_REPORT_PATH="$report_dir/mobile-e2e-report.json" \
+      bun run test:mobile:e2e
     ;;
 
   *)
diff --git a/apps/sim/scripts/test-mobile-e2e.ts b/apps/sim/scripts/test-mobile-e2e.ts
index 8d326524b10..02b4666ca9d 100644
--- a/apps/sim/scripts/test-mobile-e2e.ts
+++ b/apps/sim/scripts/test-mobile-e2e.ts
@@ -20,8 +20,7 @@ import postgres from 'postgres'
  * Real browser coverage against a running local app and disposable PostgreSQL.
  * Requires MOBILE_E2E_BASE_URL, MOBILE_E2E_DATABASE_URL, MOBILE_E2E_AUTH_SECRET,
  * and MOBILE_E2E_REPORT_PATH. Install Chromium and WebKit with Playwright first.
- * MOBILE_E2E_BROWSER runs one browser (CI runs one process per browser, against one app), and
- * MOBILE_E2E_VIEWPORT narrows a diagnostic rerun.
+ * MOBILE_E2E_BROWSER and MOBILE_E2E_VIEWPORT narrow a diagnostic rerun.
  */
 const logger = createLogger('MobileE2E')
 const expect = browserExpect.configure({ timeout: 20_000 })

From 7a3472319eece723b03bba7e6306b5d75f13b040 Mon Sep 17 00:00:00 2001
From: Waleed Latif <walif6@gmail.com>
Date: Fri, 9 Oct 2026 20:35:57 -0700
Subject: [PATCH 6/7] ci: drop the e2e Turbopack dev cache and keep /ship's
 full test gate

---
 .agents/skills/ship/SKILL.md         |  2 +-
 .github/actions/dev-cache/action.yml | 37 -----------------
 .github/scripts/http-e2e.sh          | 62 +++++-----------------------
 .github/workflows/checks.yml         | 24 +++++------
 4 files changed, 24 insertions(+), 101 deletions(-)
 delete mode 100644 .github/actions/dev-cache/action.yml

diff --git a/.agents/skills/ship/SKILL.md b/.agents/skills/ship/SKILL.md
index c9b5b5475c7..fa6e5433ee5 100644
--- a/.agents/skills/ship/SKILL.md
+++ b/.agents/skills/ship/SKILL.md
@@ -42,7 +42,7 @@ When the user runs `/ship`:
   - If the diff modifies UI code (any non-test `.tsx` file, or anything under `apps/sim/components/`, `apps/sim/hooks/`, or `apps/sim/stores/`), run `/cleanup`. It fans out the React/UI passes (effects, memo, callbacks, state, React Query, emcn, url-state), the comment pass, and the test-audit pass, and applies fixes so they land in this commit.
   - Otherwise, if the diff adds or changes tests (`*.test.ts(x)`, `*.integration.ts`, `**/e2e/**`, `apps/sim/scripts/test-*-e2e.ts`), run `/test-audit audit <changed test files>` on its own. Every new or changed test must pass the authoring gate; delete the ones that don't rather than shipping them.
   - Then run the test files the diff adds or changes, plus the existing tests beside changed source files, with `bun run --cwd <workspace> test <paths>` (`bun run --cwd apps/sim test <paths>` for the app; `*.integration.ts` needs the setup in `.claude/rules/sim-testing.md`). A failing test aborts ship.
-  - Then run `bun run test:scripts` (the `scripts/*.test.ts` suite CI runs; workspace-scoped runs skip it, which is how a `scripts/check-*.test.ts` failure has reached CI) and the suites of the workspaces the change reaches: `bunx turbo run test --filter='...[origin/staging]'` (each changed workspace plus every workspace that depends on it). CI runs every suite, sharded, on every push; the full local suite needs more memory than a laptop reliably has and catches nothing CI does not. When the diff touches root test or build config (`vitest.shared.ts`, `turbo.json`, the root `package.json`, `bun.lock`), the filter selects nothing that config reaches, so run the full root `bun run test` instead. A failing test aborts ship.
+  - Then run root `bun run test` from the repo root. It chains `test:scripts` (the `scripts/*.test.ts` suite CI runs) before every workspace suite; workspace-scoped runs skip it, which is how a `scripts/check-*.test.ts` failure has reached CI. A failing test aborts ship.
 5. **Run migration safety** — only if the diff touches `packages/db/migrations/**` or `packages/db/schema.ts`:
   - Run `/db-migrate` to review the migration for zero-downtime safety (expand/contract phasing, backward-compatibility with the deployed app version).
   - `(cd packages/db && bunx drizzle-kit generate && git status --porcelain ./migrations)` must print nothing (CI's schema/migration sync step).
diff --git a/.github/actions/dev-cache/action.yml b/.github/actions/dev-cache/action.yml
deleted file mode 100644
index bb36cda4ad5..00000000000
--- a/.github/actions/dev-cache/action.yml
+++ /dev/null
@@ -1,37 +0,0 @@
-name: dev-cache
-description: Mount Turbopack's dev cache at apps/sim/.next/dev for one `next dev` app, keyed by app, event, fork, installed Next version and the app's environment.
-
-inputs:
-  provider:
-    description: The CI_PROVIDER repo variable, forwarded to the cache action.
-    required: false
-    default: ''
-  name:
-    description: The app the cache belongs to. Each app runs `next dev` under its own fixed NEXT_PUBLIC_* values, so each gets its own cache.
-    required: true
-  env-hash:
-    description: Hash of the file that sets the app's environment. Next inlines NEXT_PUBLIC_* values at compile time, so a changed environment must never restore a cache compiled under the old one.
-    required: true
-
-# The cache turns a route's cold compile into a restore. It is content-addressed, so changed modules
-# still recompile. The Next version in the key starts an upgrade from an empty cache, and the event
-# and fork segments keep untrusted runs off the cache trusted runs read. Needs dependencies installed
-# (it reads node_modules/next), and the app must be stopped with SIGINT so the last write completes.
-runs:
-  using: composite
-  steps:
-    - name: Resolve Turbopack dev cache key
-      id: key
-      shell: bash
-      env:
-        APP: ${{ inputs.name }}
-        FORK_SUFFIX: ${{ github.event.pull_request.head.repo.fork && '-fork' || '' }}
-        ENV_HASH: ${{ inputs.env-hash }}
-      run: echo "value=${GITHUB_REPOSITORY}-next-dev-${APP}-${GITHUB_EVENT_NAME}${FORK_SUFFIX}-$(jq -r .version node_modules/next/package.json)-${ENV_HASH:0:12}" >> "$GITHUB_OUTPUT"
-
-    - name: Mount Turbopack dev cache
-      uses: ./.github/actions/cache
-      with:
-        provider: ${{ inputs.provider }}
-        key: ${{ steps.key.outputs.value }}
-        path: ./apps/sim/.next/dev
diff --git a/.github/scripts/http-e2e.sh b/.github/scripts/http-e2e.sh
index 1090575b7ab..ef9c500bd1d 100755
--- a/.github/scripts/http-e2e.sh
+++ b/.github/scripts/http-e2e.sh
@@ -10,13 +10,11 @@
 # the readiness deadline only has to catch a hung boot: an exited server fails immediately, and
 # either way the server log tail lands in the job log.
 #
-# Each group restores its own Turbopack dev cache (mounted by the dev-cache action, keyed by group
-# and by this file's hash, so a cache is only ever read under the NEXT_PUBLIC_* values it was
-# compiled with). The app is stopped with SIGINT so its last cache write completes: `next dev`
-# SIGKILLs its server 100ms after SIGTERM. A cache Turbopack reports as corrupt is dropped, and a
-# startup it aborted is retried once from an empty cache. The app runs in its own session under an
-# E2E_APP tag, and stop-session.sh returns only once every process in that session or carrying
-# that tag has exited (Next's telemetry flush runs detached and still writes .next/dev).
+# Each app starts from an empty Turbopack dev cache: a cache written under other NEXT_PUBLIC_*
+# values, by a server that `next dev` SIGKILLs 100ms after SIGTERM, can panic Turbopack or wedge a
+# route compile on restore. It runs in its own session under an E2E_APP tag, and stop-session.sh
+# returns only once every process in that session or carrying that tag has exited (Next's
+# telemetry flush runs detached and still writes .next/dev).
 set -euo pipefail
 
 group=${1:?usage: http-e2e.sh <scim|cli|stop-after|desktop-inbox|mobile>}
@@ -29,35 +27,11 @@ app_tag=''
 server_log=''
 status_log=''
 
-cache_broken() {
-  grep -qiE 'cache corruption|turbopack.*panic|panicked' "$server_log" 2>/dev/null
-}
-
-# The cache directory is a mount point: empty it rather than remove it.
-clear_cache() {
-  local cache="$GITHUB_WORKSPACE/apps/sim/.next/dev"
-  [ -d "$cache" ] || return 0
-  find "$cache" -mindepth 1 -maxdepth 1 -exec rm -rf {} +
-}
-
-# SIGINT is best-effort; the cleanup always runs, since workers and the detached telemetry flush
-# can outlive a server that has already exited.
-stop_app() {
-  if kill -INT "$server_pid" 2>/dev/null; then
-    for _ in $(seq 1 30); do kill -0 "$server_pid" 2>/dev/null || break; sleep 1; done
-  fi
-  bash "$GITHUB_WORKSPACE/.github/scripts/stop-session.sh" "$server_pid" "$app_tag"
-}
-
 finish() {
   local status=$?
   if [ -n "$server_pid" ]; then
-    stop_app || status=1
+    bash "$GITHUB_WORKSPACE/.github/scripts/stop-session.sh" "$server_pid" "$app_tag" || status=1
     wait "$server_pid" 2>/dev/null || true
-    if cache_broken; then
-      echo "::warning::Turbopack reported a broken dev cache; clearing it for the next run."
-      clear_cache
-    fi
     if [ -n "$status_log" ]; then
       awk '/^ (GET|POST|PUT|PATCH|DELETE|HEAD) \/api\// { print }' "$server_log" > "$status_log"
     fi
@@ -69,13 +43,6 @@ finish() {
 }
 trap finish EXIT
 
-# launch_app <port>
-launch_app() {
-  E2E_APP="$app_tag" setsid node ../../node_modules/next/dist/bin/next dev --hostname 127.0.0.1 \
-    --port "$1" > "$server_log" 2>&1 &
-  server_pid=$!
-}
-
 # start_app <name> <port> <label> [record-http-status]
 start_app() {
   local name=$1 port=$2 label=$3
@@ -87,21 +54,14 @@ start_app() {
   export NEXT_PUBLIC_APP_URL="http://127.0.0.1:$port"
   export BETTER_AUTH_URL="$NEXT_PUBLIC_APP_URL"
   export DISABLE_TELEMETRY=true NEXT_TELEMETRY_DISABLED=1
-  launch_app "$port"
+  rm -rf .next/dev
+  E2E_APP="$app_tag" setsid node ../../node_modules/next/dist/bin/next dev --hostname 127.0.0.1 \
+    --port "$port" > "$server_log" 2>&1 &
+  server_pid=$!
 
-  local started=$SECONDS retried=false
+  local started=$SECONDS
   until curl --fail --silent --max-time 10 "$NEXT_PUBLIC_APP_URL/api/health" > /dev/null; do
     if ! kill -0 "$server_pid" 2>/dev/null; then
-      if [ "$retried" = false ] && cache_broken; then
-        echo "::warning::Turbopack rejected the restored dev cache; restarting from an empty cache."
-        tail -n 50 "$server_log"
-        stop_app
-        clear_cache
-        retried=true
-        launch_app "$port"
-        started=$SECONDS
-        continue
-      fi
       echo "::error::Local $label app exited during startup."
       exit 1
     fi
diff --git a/.github/workflows/checks.yml b/.github/workflows/checks.yml
index cb489f0262e..0865cdf99a8 100644
--- a/.github/workflows/checks.yml
+++ b/.github/workflows/checks.yml
@@ -201,14 +201,6 @@ jobs:
         working-directory: packages/db
         run: bun run db:migrate
 
-      # One cache per group: each group's app runs under its own fixed NEXT_PUBLIC_* values.
-      - name: Mount Turbopack dev cache
-        uses: ./.github/actions/dev-cache
-        with:
-          provider: ${{ vars.CI_PROVIDER }}
-          name: e2e-${{ matrix.group }}
-          env-hash: ${{ hashFiles('.github/scripts/http-e2e.sh') }}
-
       # No step timeout: the job's bound covers a hang without cutting a slow but healthy suite
       # short of writing its report.
       - name: Run end-to-end suites
@@ -301,13 +293,21 @@ jobs:
         run: bun run db:migrate
 
       # Turbopack's dev cache turns the spec's route warm-up from a cold compile (~4 min) into a
-      # restore.
+      # restore. It is content-addressed, so a pull request's changed modules still recompile; the
+      # key carries the installed Next version so an upgrade starts from an empty cache, and the
+      # event and fork segments keep untrusted runs off the cache trusted runs read.
+      - name: Resolve Turbopack dev cache key
+        id: next-cache
+        run: echo "key=${GITHUB_REPOSITORY}-next-dev-desktop-live-${GITHUB_EVENT_NAME}${FORK_SUFFIX}-$(jq -r .version node_modules/next/package.json)" >> "$GITHUB_OUTPUT"
+        env:
+          FORK_SUFFIX: ${{ github.event.pull_request.head.repo.fork && '-fork' || '' }}
+
       - name: Mount Turbopack dev cache
-        uses: ./.github/actions/dev-cache
+        uses: ./.github/actions/cache
         with:
           provider: ${{ vars.CI_PROVIDER }}
-          name: desktop-live
-          env-hash: ${{ hashFiles('.github/workflows/checks.yml') }}
+          key: ${{ steps.next-cache.outputs.key }}
+          path: ./apps/sim/.next/dev
 
       # Chat switches, Stop, sign-out, approval, the dormant-executor round trip, and background
       # runs across a chat switch and a network cut. The spec runs the recording proxy (the app's

From c63fce8d9124247ccbc941855da643ba79fb9b1a Mon Sep 17 00:00:00 2001
From: Waleed Latif <walif6@gmail.com>
Date: Fri, 9 Oct 2026 20:58:57 -0700
Subject: [PATCH 7/7] ci: drop the main proof job and the release-PR skips

---
 .github/scripts/staging-proof.sh  | 38 -----------------------------
 .github/workflows/ci.yml          | 40 ++++---------------------------
 .github/workflows/desktop-e2e.yml |  6 ++---
 .github/workflows/helm.yml        |  3 ---
 4 files changed, 6 insertions(+), 81 deletions(-)
 delete mode 100755 .github/scripts/staging-proof.sh

diff --git a/.github/scripts/staging-proof.sh b/.github/scripts/staging-proof.sh
deleted file mode 100755
index 7e15edadd5d..00000000000
--- a/.github/scripts/staging-proof.sh
+++ /dev/null
@@ -1,38 +0,0 @@
-#!/usr/bin/env bash
-# Prints `proven=true` when the checked-out main commit is a merge whose tree is byte-identical to
-# its staging parent and a staging push run of that parent passed `checks / ci`; `proven=false`
-# otherwise, including on any error, so the caller falls back to running the full checks.
-#
-# A release lands on main as a merge of the staging head, and the merge's tree equals that head's
-# tree, so the staging push run already checked exactly this code with the same checks.yml.
-# Waits for a staging run that is still in progress, up to PROOF_WAIT_SECONDS.
-#
-# Usage: GH_TOKEN=... GITHUB_REPOSITORY=owner/repo staging-proof.sh   (needs fetch-depth: 2)
-set -u
-
-prove() {
-  echo "proven=$1"
-  echo "$2" >&2
-  exit 0
-}
-
-staging=$(git rev-parse -q --verify 'HEAD^2') || prove false 'Not a merge commit; running the checks.'
-[ "$(git rev-parse 'HEAD^{tree}')" = "$(git rev-parse "$staging^{tree}")" ] ||
-  prove false "The tree differs from staging parent $staging; running the checks."
-
-deadline=$((SECONDS + ${PROOF_WAIT_SECONDS:-2400}))
-while :; do
-  runs=$(gh api "repos/$GITHUB_REPOSITORY/actions/workflows/ci.yml/runs?head_sha=$staging&event=push&branch=staging&per_page=20" \
-    --jq '.workflow_runs[] | "\(.id) \(.status)"') || prove false 'Could not list staging runs; running the checks.'
-  [ -n "$runs" ] || prove false "No staging push run for $staging; running the checks."
-  pending=false
-  while read -r id status; do
-    gate=$(gh api "repos/$GITHUB_REPOSITORY/actions/runs/$id/jobs?per_page=100" \
-      --jq '[.jobs[] | select(.name == "checks / ci") | .conclusion] | first // ""') || gate=''
-    [ "$gate" = success ] && prove true "Staging run $id passed checks / ci on this exact tree ($staging); skipping the checks."
-    [ "$status" = completed ] || pending=true
-  done <<< "$runs"
-  [ "$pending" = true ] || prove false "No staging run for $staging passed checks / ci; running the checks."
-  [ "$SECONDS" -lt "$deadline" ] || prove false "Timed out waiting for the staging run of $staging; running the checks."
-  sleep 30
-done
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 307dcecd459..3d94c3fd75f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -32,41 +32,9 @@ permissions:
   contents: read
 
 jobs:
-  # A release lands on main as a merge whose tree is identical to the staging head it merges, and
-  # that staging push already ran the checks on exactly this code. When a staging run of the merged
-  # parent passed `checks / ci`, main skips its own checks and the deploy chain gates on this proof
-  # instead. Any other shape, any error, or no green staging run falls back to the full checks.
-  proof:
-    name: proof
-    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
-    runs-on: &runner-2vcpu ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-2vcpu-ubuntu-2404' || 'ubuntu-latest' }}
-    # Waits for a staging run still in progress for at most 40 minutes.
-    timeout-minutes: 45
-    permissions:
-      contents: read
-      actions: read
-    outputs:
-      proven: ${{ steps.proof.outputs.proven }}
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
-        with:
-          fetch-depth: 2
-          persist-credentials: false
-
-      - name: Look for a green staging run of this tree
-        id: proof
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: bash .github/scripts/staging-proof.sh >> "$GITHUB_OUTPUT"
-
   checks:
     name: checks
-    needs: [proof]
-    if: >-
-      !cancelled() &&
-      (github.ref != 'refs/heads/dev' || github.event_name == 'pull_request') &&
-      needs.proof.outputs.proven != 'true'
+    if: github.ref != 'refs/heads/dev' || github.event_name == 'pull_request'
     uses: ./.github/workflows/checks.yml
 
   # Detect if this is a version release commit (e.g., "v0.5.24: ...")
@@ -74,7 +42,7 @@ jobs:
   # message, no checkout and no install.
   version:
     name: version
-    runs-on: *runner-2vcpu
+    runs-on: &runner-2vcpu ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-2vcpu-ubuntu-2404' || 'ubuntu-latest' }}
     timeout-minutes: 5
     if: github.event_name == 'push' && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/staging' || github.ref == 'refs/heads/dev')
     outputs:
@@ -146,14 +114,14 @@ jobs:
   # migration sidecar)
   migrate:
     name: migrate
-    needs: [proof, checks]
+    needs: [checks]
     # Explicit need results instead of the implicit success(): a skipped job
     # anywhere in the transitive needs chain silently fails implicit success()
     # and cascade-skips the deploy chain (migrate -> promote ->
     # CodeDeploy) — this bit us on 2026-07-23. State requirements explicitly.
     if: >-
       !cancelled() &&
-      (needs.checks.result == 'success' || needs.proof.outputs.proven == 'true') &&
+      needs.checks.result == 'success' &&
       github.event_name == 'push' &&
       (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/staging')
     uses: ./.github/workflows/migrate.yml
diff --git a/.github/workflows/desktop-e2e.yml b/.github/workflows/desktop-e2e.yml
index 27e2a930614..a7509bbd68b 100644
--- a/.github/workflows/desktop-e2e.yml
+++ b/.github/workflows/desktop-e2e.yml
@@ -59,9 +59,7 @@ concurrency:
 jobs:
   e2e:
     name: e2e
-    # Not on the staging -> main release pull request: every staging push re-syncs it with code the
-    # staging pull requests already ran this on, and main's push and schedule still run it.
-    if: github.event_name != 'schedule' && !(github.head_ref == 'staging' && github.base_ref == 'main' && github.event.pull_request.head.repo.full_name == github.repository)
+    if: github.event_name != 'schedule'
     runs-on: macos-26
     timeout-minutes: 30
     steps:
@@ -182,7 +180,7 @@ jobs:
 
   package-smoke:
     name: package-smoke
-    if: github.event_name != 'schedule' && !(github.head_ref == 'staging' && github.base_ref == 'main' && github.event.pull_request.head.repo.full_name == github.repository)
+    if: github.event_name != 'schedule'
     runs-on: macos-26
     timeout-minutes: 20
     steps:
diff --git a/.github/workflows/helm.yml b/.github/workflows/helm.yml
index bb9e9ce9d4c..c50bc7155e1 100644
--- a/.github/workflows/helm.yml
+++ b/.github/workflows/helm.yml
@@ -36,9 +36,6 @@ permissions:
 jobs:
   chart:
     name: chart
-    # Not on the staging -> main release pull request: every staging push re-syncs it with code the
-    # staging pull requests already ran this on, and main's push and schedule still run it.
-    if: ${{ !(github.head_ref == 'staging' && github.base_ref == 'main' && github.event.pull_request.head.repo.full_name == github.repository) }}
     runs-on: &runner-2vcpu ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-2vcpu-ubuntu-2404' || 'ubuntu-latest' }}
     timeout-minutes: 15
     steps: