code-foundry 1.25.3 → 1.28.2

package/.github/workflows/cloudflare-delivery.yml

@@ -36,6 +36,11 @@ on:
         required: false
         type: string
         default: '.'
+      turbo-filter:
+        description: 'Optional Turbo package name override; auto detects it from working-directory by default.'
+        required: false
+        type: string
+        default: auto
       build-script:
         required: false
         type: string
@@ -115,16 +120,143 @@ concurrency:
   cancel-in-progress: false
 
 jobs:
-  candidate:
+  affected:
+    name: Check Turbo delivery impact
     if: >-
+      inputs['turbo-filter'] != '' &&
+      (github.event_name == 'pull_request' || github.event_name == 'push') &&
       vars.CI_BILLING_PAUSED != 'true' &&
       (inputs['draft-protection'] != true || github.event_name != 'pull_request' || github.event.pull_request.draft == false) &&
+      (github.event_name != 'pull_request' || inputs.mode != 'preview' || !startsWith(github.event.pull_request.head.ref, 'release-please--branches--main')) &&
       github.event_name != 'pull_request_target' &&
       (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)
     runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+    outputs:
+      should_deploy: ${{ steps.check.outputs.should_deploy || steps.resolve.outputs.should_deploy }}
+    steps:
+      - name: Checkout full history
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+          fetch-depth: 0
+          persist-credentials: false
+      - name: Resolve Turbo package
+        id: resolve
+        working-directory: ${{ inputs.install-working-directory }}
+        env:
+          TURBO_FILTER: ${{ inputs.turbo-filter }}
+          WORKSPACE: ${{ github.workspace }}
+          WORKING_DIRECTORY: ${{ inputs.working-directory }}
+        run: |
+          node --input-type=module <<'NODE'
+          import { appendFileSync, existsSync, readFileSync } from 'node:fs'
+          import { isAbsolute, relative, resolve, sep } from 'node:path'
+          const output = (name, value) => appendFileSync(process.env.GITHUB_OUTPUT, `${name}=${value}\n`)
+          const conservative = (reason) => {
+            console.log(`${reason}; deploying conservatively.`)
+            output('turbo_enabled', 'false')
+            output('should_deploy', 'true')
+          }
+          const filter = process.env.TURBO_FILTER
+          if (!filter || /[\r\n\0]/.test(filter)) throw new Error('Invalid turbo-filter')
+          const workspace = process.env.WORKSPACE
+          const appDirectory = resolve(workspace, process.env.WORKING_DIRECTORY)
+          const workspaceRelative = relative(workspace, appDirectory)
+          const outsideWorkspace =
+            isAbsolute(workspaceRelative) ||
+            workspaceRelative === '..' ||
+            workspaceRelative.startsWith(`..${sep}`)
+          if (!existsSync('turbo.json') && !existsSync('turbo.jsonc')) {
+            conservative('Turbo config not found')
+          } else if (outsideWorkspace) {
+            conservative('working-directory is outside the workspace')
+          } else if (filter !== 'auto') {
+            output('turbo_package', filter)
+            output('turbo_enabled', 'true')
+          } else {
+            const manifest = resolve(appDirectory, 'package.json')
+            let packageName = ''
+            try {
+              packageName = JSON.parse(readFileSync(manifest, 'utf8')).name ?? ''
+            } catch {
+              packageName = ''
+            }
+            if (typeof packageName !== 'string' || !packageName || /[\s\r\n\0]/.test(packageName)) {
+              conservative('Application package name could not be resolved')
+            } else {
+              console.log(`Resolved Turbo package: ${packageName}`)
+              output('turbo_package', packageName)
+              output('turbo_enabled', 'true')
+            }
+          }
+          NODE
+      - name: Set up Bun
+        if: steps.resolve.outputs.turbo_enabled == 'true'
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+        with:
+          bun-version: ${{ inputs.bun-version }}
+      - name: Install dependencies for Turbo
+        if: steps.resolve.outputs.turbo_enabled == 'true'
+        working-directory: ${{ inputs.install-working-directory }}
+        run: bun install --frozen-lockfile --ignore-scripts
+      - name: Check affected build task
+        if: steps.resolve.outputs.turbo_enabled == 'true'
+        id: check
+        working-directory: ${{ inputs.install-working-directory }}
+        env:
+          TURBO_PACKAGE: ${{ steps.resolve.outputs.turbo_package }}
+          TURBO_BASE_SHA: ${{ github.event.pull_request.base.sha || github.event.before }}
+          TURBO_HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
+        run: |
+          set -euo pipefail
+          [[ "$TURBO_PACKAGE" != *$'\n'* && "$TURBO_PACKAGE" != *$'\r'* && "$TURBO_PACKAGE" != *$'\0'* ]]
+          [[ "$TURBO_HEAD_SHA" =~ ^[0-9a-fA-F]{40}$ ]]
+          if [[ ! "$TURBO_BASE_SHA" =~ ^[0-9a-fA-F]{40}$ || "$TURBO_BASE_SHA" =~ ^0+$ ]]; then
+            echo 'No comparable base commit; deploying conservatively.'
+            echo 'should_deploy=true' >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          bunx --bun --no-install turbo query affected \
+            --packages \
+            --base="$TURBO_BASE_SHA" \
+            --head="$TURBO_HEAD_SHA" \
+            --no-update-notifier > "$RUNNER_TEMP/turbo-affected.json"
+          node --input-type=module <<'NODE'
+          import { appendFileSync, readFileSync } from 'node:fs'
+          const result = JSON.parse(readFileSync(process.env.RUNNER_TEMP + '/turbo-affected.json', 'utf8'))
+          const items = result?.data?.affectedPackages?.items ?? result?.data?.affectedTasks?.items
+          if (!Array.isArray(items)) throw new Error('Turbo affected query returned no package/task items')
+          const packageName = process.env.TURBO_PACKAGE
+          const affected = items.some((item) => item?.name === packageName || item?.package?.name === packageName || item?.fullName?.startsWith(`${packageName}#`))
+          console.log(`${packageName}: ${affected ? 'affected' : 'unaffected'}`)
+          appendFileSync(process.env.GITHUB_OUTPUT, `should_deploy=${affected}\n`)
+          NODE
+
+  candidate:
+    needs: affected
+    if: >-
+      always() &&
+      vars.CI_BILLING_PAUSED != 'true' &&
+      (inputs['draft-protection'] != true || github.event_name != 'pull_request' || github.event.pull_request.draft == false) &&
+      (github.event_name != 'pull_request' || inputs.mode != 'preview' || !startsWith(github.event.pull_request.head.ref, 'release-please--branches--main')) &&
+      github.event_name != 'pull_request_target' &&
+      (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) &&
+      (
+        inputs['turbo-filter'] == '' ||
+        needs.affected.result == 'skipped' ||
+        needs.affected.outputs.should_deploy == 'true'
+      )
+    runs-on: ubuntu-latest
     timeout-minutes: 30
+    # The explicit deployment record below is the sole GitHub deployment record.
+    # Keep the environment for approvals, secrets, and branch protection without
+    # creating a second, competing PR timeline entry.
     environment:
       name: Preview
+      deployment: false
       url: ${{ steps.upload.outputs.url }}
     defaults:
       run:
@@ -251,6 +383,7 @@ jobs:
     timeout-minutes: 30
     environment:
       name: Production
+      deployment: false
       url: ${{ inputs.production-url }}
     defaults:
       run:

package/.github/workflows/cloudflare-deploy.yml

@@ -21,6 +21,11 @@ on:
         required: false
         type: string
         default: '.'
+      turbo-filter:
+        description: 'Optional Turbo package name override; auto detects it from working-directory by default.'
+        required: false
+        type: string
+        default: auto
       build-script:
         required: false
         type: string
@@ -69,17 +74,144 @@ concurrency:
   cancel-in-progress: false
 
 jobs:
+  affected:
+    name: Check Turbo deployment impact
+    if: >-
+      inputs['turbo-filter'] != '' &&
+      (github.event_name == 'pull_request' || github.event_name == 'push') &&
+      vars.CI_BILLING_PAUSED != 'true' &&
+      (inputs['draft-protection'] != true || github.event_name != 'pull_request' || github.event.pull_request.draft == false) &&
+      (github.event_name != 'pull_request' || inputs.mode != 'preview' || !startsWith(github.event.pull_request.head.ref, 'release-please--branches--main')) &&
+      github.event_name != 'pull_request_target' &&
+      (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)
+    runs-on: ${{ inputs.runner }}
+    timeout-minutes: 10
+    permissions:
+      contents: read
+    outputs:
+      should_deploy: ${{ steps.check.outputs.should_deploy || steps.resolve.outputs.should_deploy }}
+    steps:
+      - name: Checkout full history
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+          fetch-depth: 0
+          persist-credentials: false
+      - name: Resolve Turbo package
+        id: resolve
+        working-directory: ${{ inputs.install-working-directory }}
+        env:
+          TURBO_FILTER: ${{ inputs.turbo-filter }}
+          WORKSPACE: ${{ github.workspace }}
+          WORKING_DIRECTORY: ${{ inputs.working-directory }}
+        run: |
+          node --input-type=module <<'NODE'
+          import { appendFileSync, existsSync, readFileSync } from 'node:fs'
+          import { isAbsolute, relative, resolve, sep } from 'node:path'
+          const output = (name, value) => appendFileSync(process.env.GITHUB_OUTPUT, `${name}=${value}\n`)
+          const conservative = (reason) => {
+            console.log(`${reason}; deploying conservatively.`)
+            output('turbo_enabled', 'false')
+            output('should_deploy', 'true')
+          }
+          const filter = process.env.TURBO_FILTER
+          if (!filter || /[\r\n\0]/.test(filter)) throw new Error('Invalid turbo-filter')
+          const workspace = process.env.WORKSPACE
+          const appDirectory = resolve(workspace, process.env.WORKING_DIRECTORY)
+          const workspaceRelative = relative(workspace, appDirectory)
+          const outsideWorkspace =
+            isAbsolute(workspaceRelative) ||
+            workspaceRelative === '..' ||
+            workspaceRelative.startsWith(`..${sep}`)
+          if (!existsSync('turbo.json') && !existsSync('turbo.jsonc')) {
+            conservative('Turbo config not found')
+          } else if (outsideWorkspace) {
+            conservative('working-directory is outside the workspace')
+          } else if (filter !== 'auto') {
+            output('turbo_package', filter)
+            output('turbo_enabled', 'true')
+          } else {
+            const manifest = resolve(appDirectory, 'package.json')
+            let packageName = ''
+            try {
+              packageName = JSON.parse(readFileSync(manifest, 'utf8')).name ?? ''
+            } catch {
+              packageName = ''
+            }
+            if (typeof packageName !== 'string' || !packageName || /[\s\r\n\0]/.test(packageName)) {
+              conservative('Application package name could not be resolved')
+            } else {
+              console.log(`Resolved Turbo package: ${packageName}`)
+              output('turbo_package', packageName)
+              output('turbo_enabled', 'true')
+            }
+          }
+          NODE
+      - name: Set up Bun
+        if: steps.resolve.outputs.turbo_enabled == 'true'
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+        with:
+          bun-version: ${{ inputs.bun-version }}
+      - name: Install dependencies for Turbo
+        if: steps.resolve.outputs.turbo_enabled == 'true'
+        working-directory: ${{ inputs.install-working-directory }}
+        run: bun install --frozen-lockfile --ignore-scripts
+      - name: Check affected build task
+        if: steps.resolve.outputs.turbo_enabled == 'true'
+        id: check
+        working-directory: ${{ inputs.install-working-directory }}
+        env:
+          TURBO_PACKAGE: ${{ steps.resolve.outputs.turbo_package }}
+          TURBO_BASE_SHA: ${{ github.event.pull_request.base.sha || github.event.before }}
+          TURBO_HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
+        run: |
+          set -euo pipefail
+          [[ "$TURBO_PACKAGE" != *$'\n'* && "$TURBO_PACKAGE" != *$'\r'* && "$TURBO_PACKAGE" != *$'\0'* ]]
+          [[ "$TURBO_HEAD_SHA" =~ ^[0-9a-fA-F]{40}$ ]]
+          if [[ ! "$TURBO_BASE_SHA" =~ ^[0-9a-fA-F]{40}$ || "$TURBO_BASE_SHA" =~ ^0+$ ]]; then
+            echo 'No comparable base commit; deploying conservatively.'
+            echo 'should_deploy=true' >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          bunx --bun --no-install turbo query affected \
+            --packages \
+            --base="$TURBO_BASE_SHA" \
+            --head="$TURBO_HEAD_SHA" \
+            --no-update-notifier > "$RUNNER_TEMP/turbo-affected.json"
+          node --input-type=module <<'NODE'
+          import { appendFileSync, readFileSync } from 'node:fs'
+          const result = JSON.parse(readFileSync(process.env.RUNNER_TEMP + '/turbo-affected.json', 'utf8'))
+          const items = result?.data?.affectedPackages?.items ?? result?.data?.affectedTasks?.items
+          if (!Array.isArray(items)) throw new Error('Turbo affected query returned no package/task items')
+          const packageName = process.env.TURBO_PACKAGE
+          const affected = items.some((item) => item?.name === packageName || item?.package?.name === packageName || item?.fullName?.startsWith(`${packageName}#`))
+          console.log(`${packageName}: ${affected ? 'affected' : 'unaffected'}`)
+          appendFileSync(process.env.GITHUB_OUTPUT, `should_deploy=${affected}\n`)
+          NODE
+
   deploy:
     name: Cloudflare Deploy / ${{ inputs.mode }}
+    needs: affected
     if: >-
+      always() &&
       vars.CI_BILLING_PAUSED != 'true' &&
       (inputs['draft-protection'] != true || github.event_name != 'pull_request' || github.event.pull_request.draft == false) &&
+      (github.event_name != 'pull_request' || inputs.mode != 'preview' || !startsWith(github.event.pull_request.head.ref, 'release-please--branches--main')) &&
       github.event_name != 'pull_request_target' &&
-      (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)
+      (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) &&
+      (
+        inputs['turbo-filter'] == '' ||
+        needs.affected.result == 'skipped' ||
+        needs.affected.outputs.should_deploy == 'true'
+      )
     runs-on: ${{ inputs.runner }}
     timeout-minutes: 20
+    # The explicit deployment record below is the sole GitHub deployment record.
+    # Keep the environment for approvals, secrets, and branch protection without
+    # creating a second, competing PR timeline entry.
     environment:
       name: ${{ inputs.environment || (inputs.mode == 'production' && 'Production' || 'Preview') }}
+      deployment: false
       url: ${{ steps.deploy.outputs.url }}
     outputs:
       url: ${{ steps.deploy.outputs.url }}
@@ -182,10 +314,17 @@ jobs:
           DEPLOYMENT_ID: ${{ steps.start.outputs.id }}
           DEPLOY_URL: ${{ steps.deploy.outputs.url }}
           JOB_STATUS: ${{ job.status }}
+          MODE: ${{ inputs.mode }}
         run: |
           set -euo pipefail
           state=failure
           if [ "$JOB_STATUS" = success ]; then state=success; fi
           args=(-f "state=$state" -F auto_inactive=false)
+          # Preview environments are persistent per application. Once a new
+          # preview succeeds, retire the previous successful preview record;
+          # failed previews must not take a working preview offline.
+          if [ "$MODE" = preview ] && [ "$state" = success ]; then
+            args+=(-F auto_inactive=true)
+          fi
           if [ -n "$DEPLOY_URL" ]; then args+=(-f "environment_url=$DEPLOY_URL"); fi
           gh api -X POST "repos/$GITHUB_REPOSITORY/deployments/$DEPLOYMENT_ID/statuses" "${args[@]}" --silent

package/.github/workflows/consumer-qualification.yml

@@ -76,7 +76,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        node: ['20', '22', '24']
+        node: ['24', '26']
     env:
       PACKAGE: ${{ needs.pack.outputs.filename }}
       SOURCE_SHA: ${{ needs.pack.outputs.source-sha }}
@@ -162,7 +162,7 @@ jobs:
           gh run download "$GITHUB_RUN_ID" --repo "$GITHUB_REPOSITORY" \
             --name "qualification-candidate-$GITHUB_RUN_ID-$GITHUB_RUN_ATTEMPT" \
             --dir "$RUNNER_TEMP/candidate"
-          for node in 20 22 24; do
+          for node in 24 26; do
             gh run download "$GITHUB_RUN_ID" --repo "$GITHUB_REPOSITORY" \
               --name "consumer-qualification-$GITHUB_RUN_ATTEMPT-node-$node" \
               --dir "$RUNNER_TEMP/reports/$node"
@@ -182,7 +182,7 @@ jobs:
             sourceSha: env.SOURCE_SHA, asset: env.PACKAGE,
             directory: join(env.RUNNER_TEMP, 'candidate'),
           }
-          const result = qualifyArchive(candidate, ['20', '22', '24'].map(node => join(env.RUNNER_TEMP, 'reports', node, 'report.json')))
+          const result = qualifyArchive(candidate, ['24', '26'].map(node => join(env.RUNNER_TEMP, 'reports', node, 'report.json')))
           assert.equal(result.digest, `sha256:${env.CANDIDATE_SHA256}`)
           const artifact = `qualification-candidate-${env.GITHUB_RUN_ID}-${env.GITHUB_RUN_ATTEMPT}`
           writeFileSync(join(env.RUNNER_TEMP, 'qualification.json'), JSON.stringify({ ...result, run_id: env.GITHUB_RUN_ID, run_attempt: env.GITHUB_RUN_ATTEMPT }, null, 2) + '\n')

package/.github/workflows/qualified-foundry-publish.yml

@@ -33,7 +33,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        node: ['20', '22', '24']
+        node: ['24', '26']
     steps:
       - name: Checkout trusted qualification runtime
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
@@ -113,7 +113,7 @@ jobs:
           GH_TOKEN: ${{ github.token }}
         run: |
           set -euo pipefail
-          for node in 20 22 24; do
+          for node in 24 26; do
             gh run download "$GITHUB_RUN_ID" --repo "$GITHUB_REPOSITORY" \
               --name "qualified-$GITHUB_RUN_ATTEMPT-node-$node" \
               --dir "$RUNNER_TEMP/reports/$node"
@@ -130,9 +130,8 @@ jobs:
           node src/commands/qualified-publication.mjs publish \
             "$GITHUB_REPOSITORY" "$RELEASE_TAG" "$GITHUB_SHA" "$RELEASE_ASSET" \
             "$RUNNER_TEMP/candidate" \
-            "$RUNNER_TEMP/reports/20/report.json" \
-            "$RUNNER_TEMP/reports/22/report.json" \
-            "$RUNNER_TEMP/reports/24/report.json" > "$RUNNER_TEMP/publication.json"
+            "$RUNNER_TEMP/reports/24/report.json" \
+            "$RUNNER_TEMP/reports/26/report.json" > "$RUNNER_TEMP/publication.json"
       - name: Retain publication identity
         if: always()
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7

package/.github/workflows/release_self-ci.yml

@@ -22,7 +22,13 @@ concurrency:
 jobs:
   qualification:
     name: Qualify consumers
-    if: github.ref == 'refs/heads/main' && (vars.CI_BILLING_PAUSED != 'true' || (github.event_name == 'workflow_dispatch' && inputs['release-while-paused'] == true))
+    # Qualification feeds staging and publication, so it runs only when this
+    # push created a release or recovery found a stuck one. Feature merges
+    # only pay for the cheap release-please and recovery probes below; the
+    # content they merge was already audited on its pull request, and the
+    # release merge re-qualifies the exact tree it publishes.
+    needs: [release, recovery]
+    if: github.ref == 'refs/heads/main' && (vars.CI_BILLING_PAUSED != 'true' || (github.event_name == 'workflow_dispatch' && inputs['release-while-paused'] == true)) && (needs.release.outputs.release_created == 'true' || needs.recovery.outputs.found == 'true')
     uses: ./.github/workflows/consumer-qualification.yml
     with:
       billing-pause-bypass: ${{ github.event_name == 'workflow_dispatch' && inputs['release-while-paused'] == true }}
@@ -65,7 +71,11 @@ jobs:
 
   release:
     name: Release
-    needs: [qualification, preflight]
+    # Release Please consumes no qualification outputs; it runs first so the
+    # qualification below only executes when a release (or a stuck draft) needs
+    # it. Version pull requests keep flowing even when the candidate is broken;
+    # publication stays gated on qualification success in the stage job.
+    needs: [preflight]
     if: github.ref == 'refs/heads/main' && (vars.CI_BILLING_PAUSED != 'true' || (github.event_name == 'workflow_dispatch' && inputs['release-while-paused'] == true))
     uses: ./.github/workflows/release.yml
     with:
@@ -87,8 +97,8 @@ jobs:
 
   recovery:
     name: Recover qualified draft identity
-    needs: [qualification, release]
-    if: (vars.CI_BILLING_PAUSED != 'true' || (github.event_name == 'workflow_dispatch' && inputs['release-while-paused'] == true)) && needs.qualification.result == 'success' && needs.release.result == 'success'
+    needs: [release]
+    if: (vars.CI_BILLING_PAUSED != 'true' || (github.event_name == 'workflow_dispatch' && inputs['release-while-paused'] == true)) && needs.release.result == 'success'
     runs-on: ubuntu-24.04
     timeout-minutes: 5
     permissions:
@@ -99,7 +109,9 @@ jobs:
       sha: ${{ steps.recover.outputs.sha }}
     env:
       RELEASE_CREATED: ${{ needs.release.outputs.release_created }}
-      SOURCE_SHA: ${{ needs.qualification.outputs.source-sha }}
+      # The qualification source SHA is git rev-parse HEAD of the push, so
+      # recovery computes it directly instead of depending on qualification.
+      SOURCE_SHA: ${{ github.sha }}
     steps:
       - name: Checkout trusted recovery runtime
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
@@ -156,7 +168,10 @@ jobs:
   stage:
     name: Stage qualified release
     needs: [qualification, release, recovery]
-    if: (vars.CI_BILLING_PAUSED != 'true' || (github.event_name == 'workflow_dispatch' && inputs['release-while-paused'] == true)) && github.ref == 'refs/heads/main' && (needs.release.outputs.release_created == 'true' || needs.recovery.outputs.found == 'true')
+    # Qualification only runs when this push created a release or recovery
+    # found a stuck one; staging additionally requires its success so an
+    # unqualified tree can never reach publication.
+    if: (vars.CI_BILLING_PAUSED != 'true' || (github.event_name == 'workflow_dispatch' && inputs['release-while-paused'] == true)) && github.ref == 'refs/heads/main' && needs.qualification.result == 'success' && (needs.release.outputs.release_created == 'true' || needs.recovery.outputs.found == 'true')
     runs-on: ubuntu-24.04
     timeout-minutes: 15
     permissions:
@@ -203,7 +218,7 @@ jobs:
           gh run download "$GITHUB_RUN_ID" --repo "$GITHUB_REPOSITORY" \
             --name "$CANDIDATE_ARTIFACT" --dir "$RUNNER_TEMP/candidate"
           test "$(sha256sum "$RUNNER_TEMP/candidate/$PACKAGE" | cut -d' ' -f1)" = "$CANDIDATE_SHA256"
-          for node in 20 22 24; do
+          for node in 24 26; do
             gh run download "$GITHUB_RUN_ID" --repo "$GITHUB_REPOSITORY" \
               --name "consumer-qualification-$GITHUB_RUN_ATTEMPT-node-$node" \
               --dir "$RUNNER_TEMP/reports/$node"
@@ -216,9 +231,8 @@ jobs:
           node src/commands/qualified-publication.mjs stage \
             "$GITHUB_REPOSITORY" "$RELEASE_TAG" "$SOURCE_SHA" "$PACKAGE" \
             "$RUNNER_TEMP/candidate" \
-            "$RUNNER_TEMP/reports/20/report.json" \
-            "$RUNNER_TEMP/reports/22/report.json" \
-            "$RUNNER_TEMP/reports/24/report.json" > "$RUNNER_TEMP/staging.json"
+            "$RUNNER_TEMP/reports/24/report.json" \
+            "$RUNNER_TEMP/reports/26/report.json" > "$RUNNER_TEMP/staging.json"
       - name: Retain staging identity
         if: always()
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7

package/.github/workflows/validation_self-ci.yml

@@ -64,7 +64,12 @@ jobs:
   validation:
     name: Validation
     needs: mode
-    if: vars.CI_BILLING_PAUSED != 'true' && github.event_name == 'pull_request' && github.event.pull_request.draft == false
+    # Bot-authored pull requests (Dependabot and friends) validate only on an
+    # explicit ready transition: dependency pushes never allocate validation
+    # runners by themselves. A human pushing to a bot branch also runs, since
+    # the sender is no longer a bot. Release Please heads are managed by the
+    # release workflow and always validate.
+    if: vars.CI_BILLING_PAUSED != 'true' && github.event_name == 'pull_request' && github.event.pull_request.draft == false && (github.event.pull_request.user.type != 'Bot' || github.event.sender.type != 'Bot' || startsWith(github.event.pull_request.head.ref, 'release-please--branches--main'))
     # Reusable workflows can only maintain or reduce the caller job's scopes.
     # The audit tier needs security-events: write for CodeQL uploads.
     permissions:

package/AGENTS.md

@@ -17,6 +17,15 @@ They complement `CONTRIBUTING.md`. More specific instructions in nested `AGENTS.
 
 This repository may contain TypeScript, Rust, Python, or any combination of them. Detect the active stack from the files present; do not assume every check applies.
 
+## Contributing back
+
+Consumers are encouraged to help improve this open-source project. Open a small,
+focused pull request for bug fixes, performance improvements, documentation, or
+other narrowly scoped changes. For larger feature requests or architectural
+changes, create an issue first so the proposal can be discussed and scoped.
+Contributions should help make the tool as performant, reliable, and helpful as
+possible for everyone.
+
 ## Read before acting
 
 Before editing:

package/CHANGELOG.md

@@ -1,5 +1,40 @@
 # Changelog
 
+## [1.28.2](https://github.com/0xPlayerOne/code-foundry/compare/v1.28.1...v1.28.2) (2026-09-10)
+
+
+### Bug Fixes
+
+* **release:** pass one qualification report per required node ([#597](https://github.com/0xPlayerOne/code-foundry/issues/597)) ([5ceb92c](https://github.com/0xPlayerOne/code-foundry/commit/5ceb92cab3afc97145ef068e6b5e33399d99b9e5))
+
+## [1.28.1](https://github.com/0xPlayerOne/code-foundry/compare/v1.28.0...v1.28.1) (2026-09-10)
+
+
+### Bug Fixes
+
+* **cloudflare:** remove duplicate deployment records ([#595](https://github.com/0xPlayerOne/code-foundry/issues/595)) ([d9a2a4b](https://github.com/0xPlayerOne/code-foundry/commit/d9a2a4b0363bb9a9ded91d3368bdb7b9b580330f))
+
+## [1.28.0](https://github.com/0xPlayerOne/code-foundry/compare/v1.27.0...v1.28.0) (2026-09-10)
+
+
+### Features
+
+* **release:** qualify only when a release or a stuck draft needs it ([#591](https://github.com/0xPlayerOne/code-foundry/issues/591)) ([4cce045](https://github.com/0xPlayerOne/code-foundry/commit/4cce045228648e6e705ad1e89c59eaf20a72a538))
+
+## [1.27.0](https://github.com/0xPlayerOne/code-foundry/compare/v1.26.0...v1.27.0) (2026-09-10)
+
+
+### Features
+
+* **validation:** downgrade docs-only PRs to fast and gate bot pushes ([#590](https://github.com/0xPlayerOne/code-foundry/issues/590)) ([df774f5](https://github.com/0xPlayerOne/code-foundry/commit/df774f5d1e4a8a6c5f174219eb2b24ef012f6fd3))
+
+## [1.26.0](https://github.com/0xPlayerOne/code-foundry/compare/v1.25.3...v1.26.0) (2026-09-10)
+
+
+### Features
+
+* **node:** support Node 24 and 26, drop 20 and 22 ([#589](https://github.com/0xPlayerOne/code-foundry/issues/589)) ([ee3e294](https://github.com/0xPlayerOne/code-foundry/commit/ee3e2943889ffd06a8d4cd4ccb75a3f36c46c0fd))
+
 ## [1.25.3](https://github.com/0xPlayerOne/code-foundry/compare/v1.25.2...v1.25.3) (2026-09-10)
 
 

package/README.md

@@ -135,7 +135,7 @@ is merged; npm publication is opt-in through `npm_publish: true` and supports
 npm trusted publishing or an `NPM_TOKEN` fallback.
 
 Code Foundry's own release caller is stricter: it qualifies the package across
-Node 20, 22, and 24, stages the exact qualified archive, publishes the
+Node 24 and 26, stages the exact qualified archive, publishes the
 immutable GitHub Release, and publishes that archive through the verified
 publisher. See
 [Consumer qualification](docs/consumer-qualification.md) and [Qualified

package/docs/PUBLISHING.md

@@ -37,7 +37,7 @@ registry version and its provenance link before treating the setup as complete.
 The self-hosted package follows a stricter contract than generated consumer
 callers:
 
-1. Pack the candidate once and qualify that archive across Node 20, 22, and 24.
+1. Pack the candidate once and qualify that archive across Node 24 and 26.
 2. Create a draft GitHub Release and attach the exact qualified archive plus its
    qualification receipt.
 3. Publish the immutable GitHub Release after verifying the tag, source commit,
@@ -50,6 +50,11 @@ the bytes selected from the same workflow run and attempt. See [Consumer
 qualification](consumer-qualification.md) and [Qualified publication](qualified-publication.md)
 for the complete contract, retries, and recovery rules.
 
+The main-push pipeline runs Release Please first, then qualifies only when the
+push created a release or recovery found a stuck draft. Feature merges pay for
+the cheap release-please and recovery probes; the runner-heavy matrix runs on
+release merges, which re-qualify the exact tree they publish.
+
 ## GitHub Releases and GitHub Packages
 
 A GitHub Release is metadata attached to a Git tag. It is independent of npm and

package/docs/WORKFLOWS.md

@@ -31,6 +31,21 @@ pull request starts it again for the current head. Audit-mode runs additionally
 execute the eval lane (`Validation / Eval`) for repositories that ship an eval
 harness; see [Evals](EVALS.md).
 
+Two waste-avoidance rules keep validation minutes honest without weakening
+confidence:
+
+- **Docs-only pull requests run the fast tier.** When an audit-classified pull
+  request changes only markdown, `docs/`, and license roots, the mode
+  classifier downgrades it to fast. Any code, lockfile, workflow,
+  configuration, or packaging change — or any diff that cannot be computed
+  deterministically — keeps the audit tier. Scheduled and manual audits always
+  run the full tier.
+- **Bot-authored pull requests validate only on ready transitions.**
+  Dependabot and other bot pushes never allocate validation runners; a
+  maintainer marks the (Guard-drafted) pull request ready — or pushes to its
+  branch, which changes the sender — to run validation. Release Please heads
+  are exempt because the release workflow merges them through its own lane.
+
 The separate `validation-audit.yml` caller is pinned to the configured released
 runtime and handles scheduled and manual audits:
 

package/docs/cloudflare-delivery.md

@@ -37,7 +37,18 @@ jobs:
 ```
 
 `artifact-path` is relative to `working-directory`; `install-working-directory`
-selects the lockfile root. The selected output tree is hashed before and after
+selects the lockfile root. For Turbo monorepos, filtering is automatic when
+`working-directory` points to the application package and the lockfile root
+contains `turbo.json` or `turbo.jsonc`. The workflow resolves the package name,
+then compares pull-request base/head commits or push before/after commits with
+`turbo query affected --packages`; shared-package changes therefore retain
+dependent app deployments. Unaffected app calls skip the build and Cloudflare
+deployment. Set `turbo-filter` only to override the detected package name; set
+it to an empty string to disable filtering. Full history is fetched for the
+comparison. Manual dispatches deploy conservatively because they do not provide
+a reliable comparison range.
+
+The selected output tree is hashed before and after
 upload; changes during upload fail. Include all built code/assets in that tree
 and disable duplicate custom build steps. This digest identifies the declared
 local build tree, not a Cloudflare-signed digest of every uploaded configuration
@@ -71,12 +82,16 @@ not sufficient.
 ## Approvals, ordering, and evidence
 
 Create and protect the fixed `Preview` and `Production` GitHub environments
-before adoption. The workflow references them at the **job** level; naming an
-environment does not itself configure reviewers or branch restrictions. Configure
-required reviewers and branch restrictions on `Production` separately. Production
-execution requires the current default-branch commit and
-rechecks freshness after approval and before final promotion. Fork PRs and
-`pull_request_target` execution are excluded.
+before adoption. The workflow references them at the **job** level and disables
+GitHub's implicit deployment record; the explicit application record is the sole
+entry in deployment history. Required reviewers, wait timers, and branch
+restrictions still apply. GitHub custom deployment protection rules are not
+compatible with `deployment: false`; use the explicit record without that rule or
+keep automatic deployment records enabled. Configure required reviewers and
+branch restrictions on `Production` separately. Production execution requires the
+current default-branch commit and rechecks freshness after approval and before
+final promotion. Fork PRs, release-please PRs, and `pull_request_target` execution
+are excluded from preview delivery.
 
 Per-repository/Worker/mode concurrency never cancels a running promotion. GitHub
 concurrency is not a FIFO queue; stale-source rejection is still necessary.
@@ -88,14 +103,15 @@ and new production workflows active.
 
 Outputs include preview URL, exact version ID, source SHA, declared build-tree
 SHA-256 digest, Cloudflare deployment ID, and GitHub application deployment ID.
-Explicit application deployment records receive in-progress and success/failure
-statuses, in addition to GitHub's environment-job records. For pull requests,
-the deployment record is associated with `github.event.pull_request.head.sha`,
-not GitHub Actions' merge commit, so GitHub can display the preview in the PR's
-Deployments section. Direct pushes use `github.sha`. Sanitized candidate and
-production JSON evidence is uploaded even on failure. Binding values, API bodies,
-and credentials are not copied into those reports. Forced runner termination may
-prevent final status steps; the GitHub job still reflects cancellation/failure.
+The workflows disable GitHub's automatic environment deployment object and use
+one explicit application deployment record, which receives in-progress and
+success/failure statuses. For pull requests, that record is associated with
+`github.event.pull_request.head.sha`, not GitHub Actions' merge commit, so GitHub
+can display the preview in the PR's Deployments section. Direct pushes use
+`github.sha`. Sanitized candidate and production JSON evidence is uploaded even
+on failure. Binding values, API bodies, and credentials are not copied into those
+reports. Forced runner termination may prevent final status steps; the GitHub job
+still reflects cancellation/failure.
 
 ## Stateful resources and isolation
 
@@ -171,18 +187,24 @@ the deployment API intentionally changes version routing only.
 
 ## Legacy workflow hardening
 
-`cloudflare-deploy.yml` uses real job environments, non-cancelling concurrency,
-structured Wrangler output, exact/local Wrangler selection, reusable outputs, and
-in-progress/failure deployment records. Its preview deployment records use the
-pull request head SHA when called from a PR, so completed previews appear in that
-PR's Deployments section; direct pushes use the workflow SHA. Its compatibility
+`cloudflare-deploy.yml` uses real job environments with automatic deployment
+history disabled, non-cancelling concurrency, structured Wrangler output,
+exact/local Wrangler selection, reusable outputs, and one explicit
+in-progress/failure deployment record. Preview records use the pull request head
+SHA when called from a PR, so completed previews appear in that PR's Deployments
+section; direct pushes use `github.sha`. Preview delivery skips release-please PRs,
+which are merged and closed by release automation rather than being application
+previews. Its compatibility
 default remains `latest`; callers should prefer `local` or an exact version for
 reproducibility. A production URL can be supplied with `deployment-url` when API
-output contains only route patterns. It is still a **direct, unverified deployment**;
-adopt `cloudflare-delivery.yml` for candidate verification and
-guarded promotion. Consumers pinned to an older Code Foundry release must update
-their reusable workflow reference; existing deployments are not retroactively
-re-associated with the PR head commit.
+output contains only route patterns. Turbo filtering also applies to production
+pushes, which use the previous and current commit to skip unaffected
+applications. It is still a **direct, unverified
+deployment**; adopt `cloudflare-delivery.yml` for candidate verification and
+guarded promotion.
+Consumers pinned to an older Code Foundry release must update their reusable
+workflow reference; existing deployments are not retroactively re-associated
+with the PR head commit.
 
 ## References and testing
 

package/docs/consumer-qualification.md

@@ -6,7 +6,7 @@ Release-candidate compatibility checks against the distributable package.
 **Scope:** Package installation, CLI initialization/synchronization, generated workflow contracts.
 
 `consumer-qualification.yml` packs the checked-out candidate once, shares that
-archive across Node 20, 22, and 24 using an artifact scoped to the same workflow
+archive across Node 24 and 26 using an artifact scoped to the same workflow
 run **and attempt**, and installs it offline with lifecycle scripts disabled,
 and executes its public CLI from the installed package. The harness does not
 import the source checkout's initializer as a substitute for package testing.

package/docs/fleet-release-eligibility.md

@@ -16,11 +16,7 @@ guard, and `--force` cannot bypass source identity or qualification.
   "repository": "owner/code-foundry",
   "workflow": ".github/workflows/release_self-ci.yml",
   "branch": "main",
-  "required_jobs": [
-    "Qualify consumers / Node 20",
-    "Qualify consumers / Node 22",
-    "Qualify consumers / Node 24"
-  ]
+  "required_jobs": ["Qualify consumers / Node 24", "Qualify consumers / Node 26"]
 }
 ```
 

package/docs/qualified-publication.md

@@ -9,7 +9,7 @@ consumer release callers keep the ordinary `release.yml` behavior.
 The self-release pipeline is intentionally staged:
 
 1. `consumer-qualification.yml` packs the candidate once and qualifies it across
-   Node 20, 22, and 24.
+   Node 24 and 26.
 2. Release Please creates a draft release for the qualified source.
 3. The staging job attaches the exact archive and a digest-bound qualification
    receipt, publishes the immutable GitHub Release, and verifies its identity.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "1.25.3",
+  "version": "1.28.2",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "homepage": "https://github.com/0xPlayerOne/code-foundry#readme",
   "bugs": {
@@ -42,7 +42,7 @@
     "build": "node --check src/cli.mjs",
     "format:check": "oxfmt --check .",
     "fmt": "oxfmt .",
-    "lint": "oxlint",
+    "lint": "oxlint --deny-warnings",
     "performance:check": "node scripts/performance-check.mjs",
     "test": "node --test",
     "test:unit": "node --test",
@@ -57,7 +57,7 @@
     "typescript": "^7.0.2"
   },
   "engines": {
-    "node": ">=20"
+    "node": ">=24"
   },
   "packageManager": "bun@1.4.0"
 }

package/src/commands/doctor.mjs

@@ -9,6 +9,11 @@ import { packageManagerForLockfile } from '../lib/lockfiles.mjs'
 import { doctorGithub } from '../lib/github-doctor.mjs'
 import { isGeneratedEventCaller } from './sync.mjs'
 
+/** @param {string} message */
+function warn(message) {
+  console.warn(`WARN: ${message}`)
+}
+
 /** @param {string} root @param {{ github?: boolean }} [options] */
 export function doctor(root, options = {}) {
   const target = resolve(root)
@@ -21,8 +26,6 @@ export function doctor(root, options = {}) {
     console.error(`ERROR: ${message}`)
     errors += 1
   }
-  /** @param {string} message */
-  const warn = (message) => console.warn(`WARN: ${message}`)
 
   const toolchain = config.toolchain ?? 'auto'
   if (!['auto', 'native', 'mise'].includes(toolchain)) error(`unsupported toolchain: ${toolchain}`)

package/src/commands/fleet-core.mjs

@@ -33,7 +33,7 @@ export function discoverRepositories(root) {
       gitWorkflow: config.git_workflow ?? 'direct',
     })
   }
-  return result.sort((a, b) => a.path.localeCompare(b.path))
+  return result.toSorted((a, b) => a.path.localeCompare(b.path))
 }
 
 /** @param {string} root @param {string} source @param {{ createPr?: boolean, dryRun?: boolean, force?: boolean, version: string, exclude?: string[] }} options */

package/src/commands/qualified-publication.mjs

@@ -16,7 +16,7 @@ import { join, resolve } from 'node:path'
 import { pathToFileURL } from 'node:url'
 import { tmpdir } from 'node:os'
 
-export const REQUIRED_NODES = ['20', '22', '24']
+export const REQUIRED_NODES = ['24', '26']
 export const REQUIRED_FIXTURES = [
   'npm-direct',
   'pnpm-direct',
@@ -256,7 +256,7 @@ export async function publishQualifiedArchive(candidate, reports, adapters = {})
  */
 async function waitForPublishedRelease(candidate, adapters = {}) {
   const runTolerant = adapters.runTolerant ?? defaultRunTolerant
-  const delay = adapters.delay ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)))
+  const delay = adapters.delay ?? ((ms) => new Promise((done) => setTimeout(done, ms)))
   const attempts = adapters.attempts ?? 15
   for (let attempt = 1; attempt <= attempts; attempt += 1) {
     const result = runTolerant('gh', [
@@ -408,7 +408,7 @@ export async function stageQualifiedRelease(candidate, reports, adapters = {}) {
         break
       } catch (error) {
         if (attempt >= 10) throw error
-        await (adapters.delay ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms))))(5_000)
+        await (adapters.delay ?? ((ms) => new Promise((done) => setTimeout(done, ms))))(5_000)
       }
     }
     ensure(

package/src/commands/sync.mjs

@@ -354,7 +354,7 @@ function synchronize(options) {
     const mergedManifest = {}
     for (const directory of [
       ...new Set([...Object.keys(releaseManifest), ...Object.keys(existingManifest)]),
-    ].sort()) {
+    ].toSorted()) {
       mergedManifest[directory] = existingManifest[directory] ?? releaseManifest[directory]
     }
     const content = `${JSON.stringify(mergedManifest, null, 2)}\n`
@@ -652,7 +652,7 @@ function renderWorkflow(content, config, repository, ref, rustCodeql, file, self
     // self-only jobs whose outputs and environments do not exist for them.
     for (const job of ['qualification', 'preflight', 'recovery', 'stage', 'publish'])
       rendered = removeWorkflowBlock(rendered, job)
-    rendered = rendered.replace(/^    needs: \[qualification, preflight\]\n/m, '')
+    rendered = rendered.replace(/^    needs: \[preflight\]\n/m, '')
     rendered = rendered.replace(/^      config-file: \.github\/release-please-foundry\.json\n/m, '')
     rendered = rendered.replace(/^      defer-publication: true\n/m, '')
     rendered = rendered.replace(

package/src/lib/docs-only.mjs

@@ -0,0 +1,39 @@
+// @ts-check
+
+import { execFileSync } from 'node:child_process'
+
+/** Docs-only allowlist: markdown, docs/, and license roots. Code, lockfiles,
+ * workflows, configuration, and packaging always keep the audit tier. */
+const DOCS_ONLY_PATTERNS = [/\.md$/i, /^docs\//, /^LICENSE/i]
+
+/** @param {string} path */
+export function isDocsOnlyPath(path) {
+  return DOCS_ONLY_PATTERNS.some((pattern) => pattern.test(path))
+}
+
+/**
+ * Report whether a pull request changes docs only. Fail-closed: any git
+ * failure, unresolvable base, or non-docs path keeps the audit tier.
+ * @param {string} root
+ * @param {string} baseRef
+ */
+export function docsOnlyPullRequest(root, baseRef) {
+  try {
+    execFileSync('git', ['fetch', '--no-tags', '--depth=100', 'origin', baseRef], {
+      cwd: root,
+      stdio: 'pipe',
+    })
+    const output = execFileSync('git', ['diff', '--name-only', 'FETCH_HEAD...HEAD'], {
+      cwd: root,
+      encoding: 'utf8',
+      stdio: ['ignore', 'pipe', 'pipe'],
+    })
+    const paths = output
+      .split('\n')
+      .map((line) => line.trim())
+      .filter((line) => line.length > 0)
+    return paths.length > 0 && paths.every(isDocsOnlyPath)
+  } catch {
+    return false
+  }
+}

package/src/lib/fleet-manifest.mjs

@@ -277,16 +277,20 @@ export function verifiedPullRequest(pr, required) {
     return false
   const checks = pr.statusCheckRollup
   if (!Array.isArray(checks) || !checks.length) return false
-  /** @param {any} check */
-  const state = (check) =>
-    check.status === 'COMPLETED' ? check.conclusion : (check.state ?? check.status)
-  if (checks.some((check) => !['SUCCESS', 'NEUTRAL', 'SKIPPED'].includes(state(check))))
+  if (checks.some((check) => !['SUCCESS', 'NEUTRAL', 'SKIPPED'].includes(checkState(check))))
     return false
   return required.every((name) =>
-    checks.some((check) => (check.name ?? check.context) === name && state(check) === 'SUCCESS')
+    checks.some(
+      (check) => (check.name ?? check.context) === name && checkState(check) === 'SUCCESS'
+    )
   )
 }
 
+/** @param {any} check */
+function checkState(check) {
+  return check.status === 'COMPLETED' ? check.conclusion : (check.state ?? check.status)
+}
+
 /** @param {string} text */
 function scalarConfig(text) {
   return Object.fromEntries(

package/src/lib/overlay.mjs

@@ -16,7 +16,7 @@ export function customWorkflowFiles(root, standardFiles) {
     .filter((file) => file.endsWith('.yml') || file.endsWith('.yaml'))
     .map((file) => `.github/workflows/${file}`)
     .filter((file) => !isManagedPath(standardFiles, file))
-    .sort()
+    .toSorted()
 }
 
 /** @param {string} root @param {Record<string, string>} config */

package/src/lib/release-manifest.mjs

@@ -61,7 +61,7 @@ export function detectReleasePackages(root) {
       })
     }
   })
-  return packages.sort((a, b) => a.directory.localeCompare(b.directory))
+  return packages.toSorted((a, b) => a.directory.localeCompare(b.directory))
 }
 
 /**

package/src/lib/release-policy.mjs

@@ -295,8 +295,8 @@ export function buildReleaseRecoveryPlan(input) {
   const orphanGitHubReleases = releaseTags.filter(
     (tag) => !tagSet.has(tag) && !tagSet.has(tag.replace(/^v/, ''))
   )
-  const latestTag = [...tags].sort(compareVersions).at(-1) ?? ''
-  const latestPackageVersion = [...input.packageVersions].sort(compareVersions).at(-1) ?? ''
+  const latestTag = [...tags].toSorted(compareVersions).at(-1) ?? ''
+  const latestPackageVersion = [...input.packageVersions].toSorted(compareVersions).at(-1) ?? ''
   return {
     latestTag,
     latestPackageVersion,

package/src/runtime-core.mjs

@@ -7,6 +7,7 @@ import { spawnSync } from 'node:child_process'
 import { detectPackageManager, resolveProfile } from './lib/profile.mjs'
 import { configured, readConfig } from './lib/config.mjs'
 import { classifyTestFiles } from './lib/test-discovery.mjs'
+import { docsOnlyPullRequest } from './lib/docs-only.mjs'
 import { classifyValidationMode, evaluateValidationGate } from './lib/validation-policy.mjs'
 import { readReleaseConfig, validateGeneratedReleaseDiff } from './lib/release-policy.mjs'
 import { runNodePackagePerformance } from './lib/node-package-performance.mjs'
@@ -237,7 +238,8 @@ function runEval() {
       report = JSON.parse(readFileSync(reportFile, 'utf8'))
     } catch (error) {
       throw new Error(
-        `Eval report is not valid JSON: ${error instanceof Error ? error.message : String(error)}`
+        `Eval report is not valid JSON: ${error instanceof Error ? error.message : String(error)}`,
+        { cause: error }
       )
     }
     const envelope = validateEvalReport(report)
@@ -315,17 +317,37 @@ function runPerformance() {
   }
 }
 
+/**
+ * Audit-mode pull requests whose diff is docs-only run the fast tier instead.
+ * Scheduled and manual audits always keep the full tier; release pull requests
+ * are classified separately and always run their lane.
+ * @param {string} mode
+ */
+function downgradeDocsOnlyPullRequest(mode) {
+  if (mode !== 'audit') return mode
+  if ((process.env.FOUNDRY_EVENT_NAME ?? '') !== 'pull_request') return mode
+  const baseRef = process.env.FOUNDRY_BASE_REF ?? ''
+  if (!baseRef) return mode
+  try {
+    return docsOnlyPullRequest(root, baseRef) ? 'fast' : mode
+  } catch {
+    return mode
+  }
+}
+
 /** @param {string} task */
 function validation(task) {
   if (task === 'mode') {
     writeOutput(
       'mode',
-      classifyValidationMode({
-        eventName: process.env.FOUNDRY_EVENT_NAME ?? '',
-        baseRef: process.env.FOUNDRY_BASE_REF ?? '',
-        headRef: process.env.FOUNDRY_HEAD_REF ?? '',
-        stagingMode: config.staging_validation_mode,
-      })
+      downgradeDocsOnlyPullRequest(
+        classifyValidationMode({
+          eventName: process.env.FOUNDRY_EVENT_NAME ?? '',
+          baseRef: process.env.FOUNDRY_BASE_REF ?? '',
+          headRef: process.env.FOUNDRY_HEAD_REF ?? '',
+          stagingMode: config.staging_validation_mode,
+        })
+      )
     )
     return
   }
@@ -692,10 +714,11 @@ function ci(task) {
       hasRootJavascriptProject() &&
       hasOxlintSetup()
     ) {
-      // Oxlint is the baseline's linter. Repositories that use a different
-      // linter keep full control through their own `lint` script, which the
-      // runScript fallback above already honors.
-      runTool('oxlint', [])
+      // Oxlint is the baseline's linter. Warnings are denied so lint debt
+      // never accumulates silently. Repositories that use a different linter
+      // keep full control through their own `lint` script, which the runScript
+      // fallback above already honors.
+      runTool('oxlint', ['--deny-warnings'])
     }
     if (hasLanguage('python') && hasRootPythonProject()) runTool('ruff', ['check', '.'])
     if (hasLanguage('rust') && hasRootRustProject())