add github actions test workflow + branch protection prep (PR-3 fast loop)

.cursor/skills/plan-prompts/SKILL.md

@@ -59,7 +59,7 @@ Each PR prompt must include all of:
 
 ### Tests to run (iteration loop) — required subsection
 
-Per [`propose/TEST-SUITE-FAST-LOOP-PROPOSE.md`](../../../propose/TEST-SUITE-FAST-LOOP-PROPOSE.md) and [`plans/PLAN-TEST-SUITE-FAST-LOOP.md`](../../../plans/PLAN-TEST-SUITE-FAST-LOOP.md) PR-2:
+Per [`propose/completed/TEST-SUITE-FAST-LOOP-PROPOSE.md`](../../../propose/completed/TEST-SUITE-FAST-LOOP-PROPOSE.md) and [`plans/completed/PLAN-TEST-SUITE-FAST-LOOP.md`](../../../plans/completed/PLAN-TEST-SUITE-FAST-LOOP.md) PR-2:
 
 - Add a markdown section with the **exact heading** `## Tests to run (iteration loop)` inside the fenced **Prompt** block, **immediately after** `## Deliverables` and **before** `## Tests`.
 - Content: bullet list of `tests/test_*.py` paths, each with a **one-line rationale** tied to the PR’s code paths.

.github/workflows/test.yml

@@ -0,0 +1,25 @@
+name: test
+
+on:
+  pull_request:
+  push:
+    branches: [master]
+
+jobs:
+  test:
+    name: test
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install -r requirements.txt
+          pip install -e .
+      - name: Run tests
+        env:
+          JAVA_CODEBASE_RAG_RUN_HEAVY: "0"
+        run: pytest tests -v

automation/cursor_propose_only/README.md

@@ -109,7 +109,7 @@ use `autopilot.py`.
   --repo-root . \
   --proposal-dir propose \
   --output-dir reports/propose_automation_selected \
-  --proposal TEST-SUITE-FAST-LOOP-PROPOSE.md \
+  --proposal TIER2-INCREMENTAL-REBUILD-PROPOSE.md \
   --planning-rounds 2 \
   --planning-min-severity medium \
   --implementation-rounds 2 \

plans/PLAN-TEST-SUITE-FAST-LOOP.md → plans/completed/PLAN-TEST-SUITE-FAST-LOOP.md

@@ -1,7 +1,7 @@
 # Plan: test suite fast loop
 
-Status: **active (planning)**. This plan implements
-[`propose/TEST-SUITE-FAST-LOOP-PROPOSE.md`](../propose/TEST-SUITE-FAST-LOOP-PROPOSE.md).
+Status: **completed**. This plan implements
+[`propose/completed/TEST-SUITE-FAST-LOOP-PROPOSE.md`](../../propose/completed/TEST-SUITE-FAST-LOOP-PROPOSE.md).
 
 Depends on: **none** (first landing is CI so later fixture work is mechanically validated).
 
@@ -50,7 +50,7 @@ Depends on: **none** (first landing is CI so later fixture work is mechanically
 | `tests/_builders.py` | Thin wrappers importing **production** `build_ast_graph` passes — **no copied logic**. Several tests today run **pass5/6** (`pass5_imperative_edges`, `pass6_match_edges`); the shipped helper(s) must match each call site (appendix in propose shows pass1–4 + `write_kuzu` only — extend as needed for Tier-2 session builds and any Tier-3 caller that needs the full pipeline). |
 | Mixed files | **`test_ast_graph_build.py`**: most tests already use `kuzu_db_path`; two tests rebuild `route_extraction_smoke` into `tmp_path` — prefer **`kuzu_graph_route_extraction_smoke`** (session) if assertions are read-only, else Tier-3 helper. **`test_kuzu_queries.py`**: audit the `route_extraction_smoke` inline build (≈ line 403); same rule. |
 | **`test_call_edge_matching.py`** | Mostly pure `_match_call_edge` / `graph_enrich` source reads; `_build_tables` hits **`cross_service_smoke`** read-only — candidate for **Tier 2** session materialization or a **`build_graph_tables(root)`** helper (no Kuzu) per audit, even though propose listed it under Tier 3. **Audit outcome wins** over the propose table row. |
-| PR-2 delivery | **`plan-prompts`** and **`pr-review`** live under **`.cursor/skills/`** in git. **`tests/README.md` merged in PR-1** must already point at **[`propose/TEST-SUITE-FAST-LOOP-PROPOSE.md`](../propose/TEST-SUITE-FAST-LOOP-PROPOSE.md)** (and this plan) and link both skills so contributors find the canonical copies. |
+| PR-2 delivery | **`plan-prompts`** and **`pr-review`** live under **`.cursor/skills/`** in git. **`tests/README.md` merged in PR-1** must already point at **[`propose/completed/TEST-SUITE-FAST-LOOP-PROPOSE.md`](../../propose/completed/TEST-SUITE-FAST-LOOP-PROPOSE.md)** (and this plan) and link both skills so contributors find the canonical copies. |
 
 ---
 
@@ -147,7 +147,7 @@ Target modules from propose (verify no writes to fixture dirs / session DB):
 ### 6. `tests/README.md`
 
 - **Extend the same “CI merge gate” / testing doc section PR-3 started** — append, do not create a second competing “how tests work” chapter.
-- Document **three-tier model**, when to add a new session fixture, Tier-2 audit rule, **bank-chat consumer matrix** expectation for future edits, and the **iteration subset** convention with links to **[`propose/TEST-SUITE-FAST-LOOP-PROPOSE.md`](../propose/TEST-SUITE-FAST-LOOP-PROPOSE.md)** + this plan; link the repo **`plan-prompts`** and **`pr-review`** skills under `.cursor/skills/` (PR-2 aligns both; either may land before the other if text already matches).
+- Document **three-tier model**, when to add a new session fixture, Tier-2 audit rule, **bank-chat consumer matrix** expectation for future edits, and the **iteration subset** convention with links to **[`propose/completed/TEST-SUITE-FAST-LOOP-PROPOSE.md`](../../propose/completed/TEST-SUITE-FAST-LOOP-PROPOSE.md)** + this plan; link the repo **`plan-prompts`** and **`pr-review`** skills under `.cursor/skills/` (PR-2 aligns both; either may land before the other if text already matches).
 - Document **before/after** timing capture expectation for the PR-1 description (per propose §9 #10).
 
 ## Tests for PR-1
@@ -194,7 +194,7 @@ Representative high-signal modules to re-run locally during implementation (not
 
 ### In this repository (`plan-prompts`)
 
-1. **[`.cursor/skills/plan-prompts/`](../.cursor/skills/plan-prompts/)** — each generated **`plans/CURSOR-PROMPTS-*.md`** per-PR **Prompt** block includes **`## Tests to run (iteration loop)`** between **Deliverables** and **Tests**: bullet list of `tests/test_*.py` paths + one-line rationale; allow **empty / docs-only** pattern (UC15). Skill text, scaffold, and examples stay aligned with [`propose/TEST-SUITE-FAST-LOOP-PROPOSE.md`](../propose/TEST-SUITE-FAST-LOOP-PROPOSE.md) §5.
+1. **[`.cursor/skills/plan-prompts/`](../.cursor/skills/plan-prompts/)** — each generated **`plans/CURSOR-PROMPTS-*.md`** per-PR **Prompt** block includes **`## Tests to run (iteration loop)`** between **Deliverables** and **Tests**: bullet list of `tests/test_*.py` paths + one-line rationale; allow **empty / docs-only** pattern (UC15). Skill text, scaffold, and examples stay aligned with [`propose/completed/TEST-SUITE-FAST-LOOP-PROPOSE.md`](../../propose/completed/TEST-SUITE-FAST-LOOP-PROPOSE.md) §5.
 
 ### In this repository (`pr-review`)
 
@@ -249,6 +249,6 @@ Representative high-signal modules to re-run locally during implementation (not
 
 # Tracking
 
-- **PR-3 (CI + protection)**: _pending_
-- **PR-1 (fixtures)**: _pending_
-- **PR-2 (plan-prompts + pr-review)**: _pending_
+- **PR-1 (fixtures)**: merged in #100 (`d83cd30`)
+- **PR-2 (plan-prompts + pr-review)**: merged in #101 (`2738a84`)
+- **PR-3 (CI + protection)**: merged in #102 (`cursor/pr-3-ci-workflow` → `master`); branch protection on `master` requires the `test` status check, force-push disabled, `enforce_admins: false`. Landing order ended up PR-1 → PR-2 → PR-3 rather than the plan's stated PR-3 → PR-1 → PR-2; PR-3's green check closed the window.

propose/TEST-SUITE-FAST-LOOP-PROPOSE.md → propose/completed/TEST-SUITE-FAST-LOOP-PROPOSE.md

@@ -1,6 +1,6 @@
 # TEST-SUITE-FAST-LOOP — collapse repeated graph builds and ship per-PR test selection
 
-**Status**: under review
+**Status**: locked — implemented across PR-1 (#100), PR-2 (#101), and PR-3 (#102).
 **Author**: Dmitriy Teriaev + Computer
 **Date**: 2026-05-12 (v3)
 

tests/README.md

@@ -31,9 +31,9 @@ cd /path/to/java-codebase-rag
 
 ## CI merge gate and fixture tiers
 
-**Merge gate (mechanical):** GitHub Actions is intended to run the full default suite (`pytest tests` with `JAVA_CODEBASE_RAG_RUN_HEAVY` unset or `0`) on every pull request and on pushes to `master`. The workflow file is added under `.github/workflows/` as part of PR-3 in [`plans/PLAN-TEST-SUITE-FAST-LOOP.md`](../plans/PLAN-TEST-SUITE-FAST-LOOP.md); until that lands, running the full suite locally before merge remains the safety check.
+**Merge gate (mechanical):** [`.github/workflows/test.yml`](../.github/workflows/test.yml) runs `pytest tests` with `JAVA_CODEBASE_RAG_RUN_HEAVY=0` on every pull request and on every push to `master`. Branch protection on `master` requires the `test` status check to pass before merge and disables force-push. Break-glass policy: `enforce_admins: false` so the sole maintainer can bypass for emergency hotfixes — explain the bypass in the merge commit.
 
-**Iteration subset (convention):** During implementation, authors name a `pytest` file subset inside each per-PR execution prompt (for example in `plans/CURSOR-PROMPTS-*.md`). The repo **[`plan-prompts`](../.cursor/skills/plan-prompts/SKILL.md)** skill (`.cursor/skills/plan-prompts/`) requires a **`## Tests to run (iteration loop)`** section in that scaffold, placed **after Deliverables and before Tests**. Reviewers follow the repo **[`pr-review`](../.cursor/skills/pr-review/SKILL.md)** skill (`.cursor/skills/pr-review/`): pasted subset command + exit code, and a green full-suite CI link once the merge gate from [`plans/PLAN-TEST-SUITE-FAST-LOOP.md`](../plans/PLAN-TEST-SUITE-FAST-LOOP.md) PR-3 exists. Canonical skill sources live under `.cursor/skills/`; you may copy them into `~/.cursor/skills/` if your Cursor setup loads personal skills only. See [`propose/TEST-SUITE-FAST-LOOP-PROPOSE.md`](../propose/TEST-SUITE-FAST-LOOP-PROPOSE.md).
+**Iteration subset (convention):** During implementation, authors name a `pytest` file subset inside each per-PR execution prompt (for example in `plans/CURSOR-PROMPTS-*.md`). The repo **[`plan-prompts`](../.cursor/skills/plan-prompts/SKILL.md)** skill (`.cursor/skills/plan-prompts/`) requires a **`## Tests to run (iteration loop)`** section in that scaffold, placed **after Deliverables and before Tests**. Reviewers follow the repo **[`pr-review`](../.cursor/skills/pr-review/SKILL.md)** skill (`.cursor/skills/pr-review/`): pasted subset command + exit code, plus a green full-suite CI link from the now-real merge gate documented above. Canonical skill sources live under `.cursor/skills/`; you may copy them into `~/.cursor/skills/` if your Cursor setup loads personal skills only. See [`propose/completed/TEST-SUITE-FAST-LOOP-PROPOSE.md`](../propose/completed/TEST-SUITE-FAST-LOOP-PROPOSE.md) and [`plans/completed/PLAN-TEST-SUITE-FAST-LOOP.md`](../plans/completed/PLAN-TEST-SUITE-FAST-LOOP.md).
 
 **Fixture tiers (PR-1):**