Run every Pi adapter suite in required pull-request CI
Severity: high | Confidence: 0.99 | Effort: S
Where:
- .github/workflows/ci.yml:259-325
- .github/scripts/test_pi_security.py:175-204
- .github/scripts/test_pi_platform_contract.py:36-64
- plugins/ca-pi/tools/test/policy.test.ts:1-237
- plugins/ca-pi/tools/test/plan-mode.test.ts:1-265
Evidence: The required ca-pi-tools matrix invokes six named Vitest files, test_pi_security.py adds seven unique named files, and the platform aggregate adds process-tree.test.ts, covering only 13 of the 23 committed *.test.ts files. No required CI command runs npm test without a file filter. The omitted set is activity, background-jobs, dispatch, doctor, footer, notices, plan-mode, policy, runtime-resolver, and windows-supervisor. A bounded local run of exactly those ten omitted files passed 222 tests, proving they are runnable but excluded from the merge gate; only the later pi-promotion workflow runs the complete suite.
Impact: A pull request can regress Pi permission asks, read-only plan enforcement, child dispatch, background-job lifecycle, footer/status behavior, runtime resolution, diagnostics, notices, or Windows supervision while every required merge-readiness job remains green. Promotion may detect the defect after it has already merged, and ordinary Pi changes are not guaranteed to pass through that scheduled/manual workflow before users consume the branch.
Recommendation: Make the supported-version ca-pi-tools matrix execute the complete Vitest suite, or maintain a machine-checked partition that proves every committed test file belongs to one required shard. Keep process-heavy suites isolated in fresh Vitest processes, but make the partition exhaustive and fail when a new test file is unassigned.
Acceptance criteria:
- For a ca-pi-touching pull request, every committed plugins/ca-pi/tools/test/*.test.ts file is executed by a required merge-readiness job on each intended supported-version/platform lane, or an explicitly documented reduced matrix with equivalent required coverage.
- A contract test fails when a new Pi test file is not assigned to any required shard.
- Deliberately failing each of policy.test.ts, plan-mode.test.ts, background-jobs.test.ts, dispatch.test.ts, and windows-supervisor.test.ts makes the required ca-pi merge gate fail.
Run every Pi adapter suite in required pull-request CI
Severity: high | Confidence: 0.99 | Effort: S
Where:
Evidence: The required ca-pi-tools matrix invokes six named Vitest files, test_pi_security.py adds seven unique named files, and the platform aggregate adds process-tree.test.ts, covering only 13 of the 23 committed *.test.ts files. No required CI command runs npm test without a file filter. The omitted set is activity, background-jobs, dispatch, doctor, footer, notices, plan-mode, policy, runtime-resolver, and windows-supervisor. A bounded local run of exactly those ten omitted files passed 222 tests, proving they are runnable but excluded from the merge gate; only the later pi-promotion workflow runs the complete suite.
Impact: A pull request can regress Pi permission asks, read-only plan enforcement, child dispatch, background-job lifecycle, footer/status behavior, runtime resolution, diagnostics, notices, or Windows supervision while every required merge-readiness job remains green. Promotion may detect the defect after it has already merged, and ordinary Pi changes are not guaranteed to pass through that scheduled/manual workflow before users consume the branch.
Recommendation: Make the supported-version ca-pi-tools matrix execute the complete Vitest suite, or maintain a machine-checked partition that proves every committed test file belongs to one required shard. Keep process-heavy suites isolated in fresh Vitest processes, but make the partition exhaustive and fail when a new test file is unassigned.
Acceptance criteria: