code-foundry 1.48.8 → 1.50.1

package/.github/workflows/test.yml

@@ -38,6 +38,11 @@ on:
         required: false
         type: string
         default: task-result
+      integration-total-shards:
+        description: Integration partitions (1 or 2); sharded scripts must honor INTEGRATION_SHARD_INDEX and INTEGRATION_TOTAL_SHARDS.
+        required: false
+        type: string
+        default: '1'
       e2e-shard-list:
         description: Comma-separated E2E shard indices, for example "1,2". A single index runs one unsharded job.
         required: false
@@ -255,10 +260,14 @@ jobs:
 
   integration:
     name: Integration
-    if: vars.CI_BILLING_PAUSED != 'true' && inputs.unit-only != true
+    if: vars.CI_BILLING_PAUSED != 'true' && inputs.unit-only != true && inputs.integration-total-shards != '2'
     runs-on: ${{ inputs.runner }}
     timeout-minutes: 30
     steps:
+      - name: Validate integration shard count
+        env:
+          SHARDS: ${{ inputs.integration-total-shards }}
+        run: test "$SHARDS" = 1
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
@@ -326,6 +335,86 @@ jobs:
       - name: Save Vite+ task cache
         uses: ./.github/actions/vite-plus-cache-save
 
+  integration-sharded:
+    name: Integration shard
+    if: vars.CI_BILLING_PAUSED != 'true' && inputs.unit-only != true && inputs.integration-total-shards == '2'
+    runs-on: ${{ inputs.runner }}
+    timeout-minutes: 30
+    strategy:
+      fail-fast: false
+      matrix:
+        shard: [1, 2]
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+          fetch-depth: 2
+      - name: Runtime
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+          repository: ${{ inputs.runtime-repository }}
+          ref: ${{ inputs.runtime-ref }}
+          path: .github/.code-foundry
+          sparse-checkout: |
+            .github/actions
+            src/lib
+            src/runtime-core.mjs
+            src/runtime.mjs
+      - name: Install runtime
+        run: |
+          mkdir -p .github/actions
+          mv .github/.code-foundry "$RUNNER_TEMP/code-foundry"
+          cp -R "$RUNNER_TEMP/code-foundry/.github/actions/." .github/actions/
+      - name: Detect
+        id: applicability
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          BASE_REF: ${{ github.event.pull_request.base.ref }}
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
+          BEFORE_SHA: ${{ github.event.before }}
+        run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" ci task_profile integration >> "$GITHUB_OUTPUT"
+      - name: Setup
+        if: steps.applicability.outputs.applicable == 'true' && steps.applicability.outputs.affected != 'false'
+        uses: ./.github/actions/setup
+        with:
+          install: true
+          install-javascript: ${{ steps.applicability.outputs.javascript == 'true' }}
+          install-python: ${{ steps.applicability.outputs.python == 'true' }}
+          install-rust: ${{ steps.applicability.outputs.rust == 'true' }}
+          cache-build: ${{ steps.applicability.outputs.rust == 'true' }}
+          cache-environment: false
+          cache-save: ${{ github.event_name == 'push' }}
+          task: integration
+          task-javascript: ${{ steps.applicability.outputs.javascript }}
+          task-python: ${{ steps.applicability.outputs.python }}
+          task-rust: ${{ steps.applicability.outputs.rust }}
+      - name: Integration
+        id: execute
+        if: steps.applicability.outputs.applicable == 'true' && steps.applicability.outputs.affected != 'false'
+        env:
+          INTEGRATION_SHARD_INDEX: ${{ matrix.shard }}
+          INTEGRATION_TOTAL_SHARDS: ${{ inputs.integration-total-shards }}
+        run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" ci integration
+      - name: Retain task receipt
+        if: >-
+          always() &&
+          (steps.execute.outcome == 'success' || steps.execute.outcome == 'failure' ||
+          steps.applicability.outputs.applicable == 'false' || steps.applicability.outputs.affected == 'false') &&
+          hashFiles('.code-foundry/results/integration.json') != ''
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: ${{ inputs.artifact-prefix }}-${{ github.run_id }}-${{ github.run_attempt }}-integration-s${{ matrix.shard }}
+          path: .code-foundry/results/integration.json
+          include-hidden-files: true
+          if-no-files-found: error
+          retention-days: 14
+
+      - name: Save Vite+ task cache
+        uses: ./.github/actions/vite-plus-cache-save
+
   e2e:
     name: E2E
     if: vars.CI_BILLING_PAUSED != 'true' && inputs.unit-only != true

package/.github/workflows/validation-billing.yml

@@ -25,6 +25,11 @@ on:
         description: Validation tier (fast, audit, or release).
         required: true
         type: string
+      release-qualification-receipts:
+        description: Reuse a recent exact-tree audit receipt for Release Please PRs.
+        required: false
+        type: boolean
+        default: false
       codeql:
         description: Run the CodeQL lane (the consumer's canonical codeql config).
         required: false
@@ -95,6 +100,11 @@ on:
         required: false
         type: string
         default: task-result
+      integration-total-shards:
+        description: Integration partitions (1 or 2); sharded scripts must honor INTEGRATION_SHARD_INDEX and INTEGRATION_TOTAL_SHARDS.
+        required: false
+        type: string
+        default: '1'
       e2e-shard-list:
         description: Comma-separated E2E shard indices passed to the test lane's matrix, e.g. "1,2".
         required: false
@@ -118,6 +128,7 @@ permissions:
   actions: read
   contents: read
   packages: read
+  pull-requests: read
   security-events: write
 
 env:
@@ -141,16 +152,41 @@ concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
-  # Merged low-cost lanes. Each block below is a step-for-step mirror of the
-  # corresponding lane job in ci.yml, test.yml, or eval.yml; only the step ids
-  # are prefixed and subsequent lanes add !cancelled() so one lane's failure
-  # never hides another lane's result.
+  qualification:
+    name: Qualification
+    if: >-
+      vars.CI_BILLING_PAUSED != 'true' &&
+      inputs.release-qualification-receipts == true && inputs.mode == 'release'
+    permissions:
+      actions: read
+      contents: read
+      pull-requests: read
+    uses: ./.github/workflows/qualification-receipt.yml
+    with:
+      phase: verify
+      mode: ${{ inputs.mode }}
+      enabled: ${{ inputs.release-qualification-receipts }}
+      codeql-enabled: ${{ inputs.codeql }}
+      runtime-repository: ${{ inputs.runtime-repository }}
+      runtime-ref: ${{ inputs.runtime-ref }}
+      required-job-names-json: '["Validation / Gate"]'
+
   fast-lanes:
     name: Fast lanes
-    if: vars.CI_BILLING_PAUSED != 'true'
+    needs: qualification
+    if: >-
+      !cancelled() && vars.CI_BILLING_PAUSED != 'true'
+    permissions:
+      actions: read
+      contents: read
+      packages: read
     runs-on: ${{ inputs.ci-runner }}
     timeout-minutes: 45
     steps:
+      - name: Validate integration shard count
+        env:
+          SHARDS: ${{ inputs.integration-total-shards }}
+        run: test "$SHARDS" = 1
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
@@ -165,6 +201,7 @@ jobs:
           path: .github/.code-foundry
           sparse-checkout: |
             .github/actions
+            src/commands/qualification-receipt.mjs
             src/lib
             src/runtime-core.mjs
             src/runtime.mjs
@@ -173,9 +210,15 @@ jobs:
           mkdir -p .github/actions
           mv .github/.code-foundry "$RUNNER_TEMP/code-foundry"
           cp -R "$RUNNER_TEMP/code-foundry/.github/actions/." .github/actions/
+      - name: Set up Node.js 24.18.0 for package inspection
+        if: ${{ inputs.mode == 'release' && needs.qualification.outputs.reuse == 'true' }}
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 24.18.0
       # --- Format lane (mirror of ci.yml format) ---
       - name: Detect format
         id: format_applicability
+        if: ${{ !(inputs.mode == 'release' && needs.qualification.outputs.reuse == 'true') }}
         env:
           EVENT_NAME: ${{ github.event_name }}
           BASE_REF: ${{ github.event.pull_request.base.ref }}
@@ -194,6 +237,11 @@ jobs:
           HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
           BEFORE_SHA: ${{ github.event.before }}
         run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" ci should_run build >> "$GITHUB_OUTPUT"
+      - name: Verify versioned package build contract
+        if: ${{ inputs.mode == 'release' && needs.qualification.outputs.reuse == 'true' }}
+        env:
+          FOUNDRY_BUILD_TASK_APPLICABLE: ${{ steps.build_applicability.outputs.applicable }}
+        run: node "$RUNNER_TEMP/code-foundry/src/commands/qualification-receipt.mjs" package-contract
       # --- Performance lane (mirror of test.yml performance; audit tier only) ---
       - name: Detect performance
         id: performance_applicability
@@ -239,7 +287,10 @@ jobs:
           BEFORE_SHA: ${{ github.event.before }}
         run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" ci task_profile integration >> "$GITHUB_OUTPUT"
       - name: Setup format
-        if: steps.format_applicability.outputs.applicable == 'true' && steps.format_applicability.outputs.affected != 'false'
+        if: >-
+          ${{ !(inputs.mode == 'release' && needs.qualification.outputs.reuse == 'true') &&
+          steps.format_applicability.outputs.applicable == 'true' &&
+          steps.format_applicability.outputs.affected != 'false' }}
         uses: ./.github/actions/setup
         with:
           # Repository format scripts normally call a project-local formatter
@@ -251,7 +302,10 @@ jobs:
           cache-build: 'false'
           task: format
       - name: Setup build
-        if: ${{ !cancelled() && steps.build_applicability.outputs.applicable == 'true' && steps.build_applicability.outputs.affected != 'false' }}
+        if: >-
+          ${{ !cancelled() && steps.build_applicability.outputs.applicable == 'true' &&
+          ((inputs.mode == 'release' && needs.qualification.outputs.reuse == 'true') ||
+          steps.build_applicability.outputs.affected != 'false') }}
         uses: ./.github/actions/setup
         with:
           install: 'true'
@@ -323,12 +377,18 @@ jobs:
           # --- Format execute ---
           - name: Format
             id: format_execute
-            if: steps.format_applicability.outputs.applicable == 'true' && steps.format_applicability.outputs.affected != 'false'
+            if: >-
+              ${{ !(inputs.mode == 'release' && needs.qualification.outputs.reuse == 'true') &&
+              steps.format_applicability.outputs.applicable == 'true' &&
+              steps.format_applicability.outputs.affected != 'false' }}
             run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" ci format
           # --- Build execute ---
           - name: Build
             id: build_execute
-            if: ${{ !cancelled() && steps.build_applicability.outputs.applicable == 'true' && steps.build_applicability.outputs.affected != 'false' }}
+            if: >-
+              ${{ !cancelled() && steps.build_applicability.outputs.applicable == 'true' &&
+              ((inputs.mode == 'release' && needs.qualification.outputs.reuse == 'true') ||
+              steps.build_applicability.outputs.affected != 'false') }}
             env:
               NEXTAUTH_SECRET: ${{ secrets.NEXTAUTH_SECRET || 'code-foundry-ci-placeholder-0123456789' }}
             run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" ci build
@@ -352,6 +412,21 @@ jobs:
             id: integration_execute
             if: ${{ !cancelled() && inputs.mode == 'audit' && steps.integration_applicability.outputs.applicable == 'true' && steps.integration_applicability.outputs.affected != 'false' }}
             run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" ci integration
+      - name: Inspect versioned npm package contents
+        if: ${{ inputs.mode == 'release' && needs.qualification.outputs.reuse == 'true' && hashFiles('package.json') != '' }}
+        run: |
+          npm pack --dry-run --ignore-scripts --json > "$RUNNER_TEMP/foundry-package-inspection.json"
+          node --input-type=module -e '
+            import { readFileSync } from "node:fs";
+            import { join } from "node:path";
+            import { pathToFileURL } from "node:url";
+
+            const runtime = join(process.env.RUNNER_TEMP, "code-foundry", "src/lib/node-package-performance.mjs");
+            const { verifyNpmPackPackage } = await import(pathToFileURL(runtime).href);
+            const manifest = JSON.parse(readFileSync("package.json", "utf8"));
+            const report = JSON.parse(readFileSync(process.argv[1], "utf8"));
+            verifyNpmPackPackage(report, manifest);
+          ' "$RUNNER_TEMP/foundry-package-inspection.json"
       # Upload only after execution joins, and keep uploads sequential: the
       # runner rewrites GITHUB_EVENT_PATH for each action, racing the event
       # JSON read in upload-artifact's context initialization (runner#4641).
@@ -473,7 +548,14 @@ jobs:
 
   lint:
     name: Lint
-    if: vars.CI_BILLING_PAUSED != 'true'
+    needs: qualification
+    if: >-
+      !cancelled() && vars.CI_BILLING_PAUSED != 'true' &&
+      !(inputs.mode == 'release' && needs.qualification.outputs.reuse == 'true')
+    permissions:
+      actions: read
+      contents: read
+      packages: read
     runs-on: ${{ inputs.ci-runner }}
     timeout-minutes: 30
     steps:
@@ -537,7 +619,10 @@ jobs:
 
   type-check:
     name: Type-Check
-    if: vars.CI_BILLING_PAUSED != 'true'
+    needs: qualification
+    if: >-
+      !cancelled() && vars.CI_BILLING_PAUSED != 'true' &&
+      !(inputs.mode == 'release' && needs.qualification.outputs.reuse == 'true')
     permissions:
       contents: read
       issues: read
@@ -606,7 +691,14 @@ jobs:
 
   unit:
     name: Unit
-    if: vars.CI_BILLING_PAUSED != 'true'
+    needs: qualification
+    if: >-
+      !cancelled() && vars.CI_BILLING_PAUSED != 'true' &&
+      !(inputs.mode == 'release' && needs.qualification.outputs.reuse == 'true')
+    permissions:
+      actions: read
+      contents: read
+      packages: read
     runs-on: ${{ inputs.unit-runner }}
     timeout-minutes: 30
     steps:
@@ -696,6 +788,10 @@ jobs:
   e2e:
     name: E2E
     if: vars.CI_BILLING_PAUSED != 'true' && inputs.mode == 'audit'
+    permissions:
+      actions: read
+      contents: read
+      packages: read
     runs-on: ${{ inputs.test-runner }}
     timeout-minutes: 45
     # Shards duplicate the whole job, but each shard owns a runner-local test
@@ -798,6 +894,10 @@ jobs:
   audit:
     name: Audit
     if: vars.CI_BILLING_PAUSED != 'true' && inputs.mode == 'audit'
+    permissions:
+      actions: read
+      contents: read
+      packages: read
     runs-on: ${{ inputs.security-runner }}
     timeout-minutes: 30
     steps:
@@ -1103,6 +1203,11 @@ jobs:
     # Release-please pull requests also analyze with CodeQL so repository
     # rulesets requiring code scanning results never deadlock the release.
     if: vars.CI_BILLING_PAUSED != 'true' && inputs.codeql == true && (inputs.mode == 'audit' || inputs.mode == 'release')
+    permissions:
+      actions: read
+      contents: read
+      packages: read
+      security-events: write
     uses: ./.github/workflows/codeql.yml
     with:
       runtime-repository: ${{ inputs.runtime-repository }}
@@ -1115,24 +1220,25 @@ jobs:
   # Aggregate check: "Validation / Gate" (caller job name + this job name).
   # Always evaluates; only jobs required for the mode must have succeeded.
   # Category results fold the merged job's lanes back into the same FOUNDRY_*
-  # vocabulary the split orchestrators feed the runtime gate, so
-  # evaluateValidationGate's mode truth table is reused unchanged.
+  # vocabulary the split orchestrators feed the runtime gate. Exact source
+  # receipts can replace repeat lint/type/unit work; Build, package inspection,
+  # CodeQL when configured, and the receipt gate remain required.
   gate:
     name: Gate
-    needs: [fast-lanes, lint, type-check, unit, e2e, audit, codeql]
+    needs: [fast-lanes, lint, type-check, unit, e2e, audit, codeql, qualification]
     if: vars.CI_BILLING_PAUSED != 'true' && always()
+    permissions:
+      contents: read
     runs-on: ubuntu-slim
     timeout-minutes: 10
     env:
       FOUNDRY_MODE: ${{ inputs.mode }}
-      # CI category: lint and type-check always run; the merged fast-lanes job
-      # carries the format and build lanes.
-      FOUNDRY_CI: ${{ (needs.lint.result != 'success' && needs.lint.result) || (needs.type-check.result != 'success' && needs.type-check.result) || (needs.fast-lanes.result != 'success' && needs.fast-lanes.result) || 'success' }}
-      # Test category: unit always runs and must succeed; integration and e2e
-      # are audit-tier jobs whose expected skip on fast/release is not a
-      # failure; the merged fast-lanes job carries performance, smoke, and
-      # eval-mode lanes, so its result joins the category too.
-      FOUNDRY_TEST: ${{ needs.unit.result == 'success' && needs.fast-lanes.result == 'success' && (needs.e2e.result == 'success' || needs.e2e.result == 'skipped') && 'success' || ((needs.e2e.result != 'success' && needs.e2e.result != 'skipped' && needs.e2e.result) || (needs.unit.result != 'success' && needs.unit.result) || (needs.fast-lanes.result != 'success' && needs.fast-lanes.result) || 'failure') }}
+      # CI category: normal and fallback runs include lint/type-check. A
+      # verified source receipt retains the build/package lane here.
+      FOUNDRY_CI: ${{ (inputs.mode == 'release' && needs.qualification.outputs.reuse == 'true' && needs.fast-lanes.result == 'success' && 'success') || ((needs.lint.result != 'success' && needs.lint.result) || (needs.type-check.result != 'success' && needs.type-check.result) || (needs.fast-lanes.result != 'success' && needs.fast-lanes.result) || 'success') }}
+      # Test category: a verified receipt replaces duplicate unit-test work;
+      # otherwise unit plus applicable integration/E2E lanes must succeed.
+      FOUNDRY_TEST: ${{ (inputs.mode == 'release' && needs.qualification.outputs.reuse == 'true' && needs.fast-lanes.result == 'success' && 'success') || (needs.unit.result == 'success' && needs.fast-lanes.result == 'success' && (needs.e2e.result == 'success' || needs.e2e.result == 'skipped') && 'success') || ((needs.e2e.result != 'success' && needs.e2e.result != 'skipped' && needs.e2e.result) || (needs.unit.result != 'success' && needs.unit.result) || (needs.fast-lanes.result != 'success' && needs.fast-lanes.result) || 'failure') }}
       FOUNDRY_SECURITY: ${{ needs.audit.result }}
       # This orchestrator runs CodeQL only when the consumer's canonical
       # configuration enables it; otherwise the unavailability decision is
@@ -1142,6 +1248,8 @@ jobs:
       # fast-lanes failure on that tier marks the eval category failed even if
       # another merged lane caused it, which fails closed.
       FOUNDRY_EVAL: ${{ needs.fast-lanes.result }}
+      FOUNDRY_SOURCE_QUALIFICATION: ${{ needs.qualification.outputs.reuse }}
+      FOUNDRY_QUALIFICATION: ${{ needs.qualification.result }}
     steps:
       - name: Checkout runtime
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
@@ -1173,3 +1281,31 @@ jobs:
         run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" validation release_diff
       - name: Evaluate aggregate gate
         run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" validation gate
+
+  qualification-receipt:
+    name: Qualification receipt
+    needs: [fast-lanes, lint, type-check, unit, e2e, audit, codeql, gate]
+    if: >-
+      vars.CI_BILLING_PAUSED != 'true' && inputs.mode == 'audit' &&
+      inputs.release-qualification-receipts == true &&
+      github.event_name == 'pull_request' && github.event.pull_request.base.ref == 'main' &&
+      needs.fast-lanes.result == 'success' && needs.lint.result == 'success' &&
+      needs.type-check.result == 'success' && needs.unit.result == 'success' &&
+      needs.e2e.result == 'success' && needs.audit.result == 'success' &&
+      (inputs.codeql != true || needs.codeql.result == 'success') &&
+      needs.gate.result == 'success'
+    permissions:
+      actions: read
+      contents: read
+      pull-requests: read
+    uses: ./.github/workflows/qualification-receipt.yml
+    with:
+      phase: produce
+      mode: ${{ inputs.mode }}
+      enabled: ${{ inputs.release-qualification-receipts }}
+      codeql-enabled: ${{ inputs.codeql }}
+      runtime-repository: ${{ inputs.runtime-repository }}
+      runtime-ref: ${{ inputs.runtime-ref }}
+      job-results-json: >-
+        {"ci":"${{ needs.lint.result == 'success' && needs.type-check.result == 'success' && needs.fast-lanes.result == 'success' && 'success' || 'failure' }}","test":"${{ needs.unit.result == 'success' && needs.fast-lanes.result == 'success' && needs.e2e.result == 'success' && 'success' || 'failure' }}","security":"${{ needs.audit.result }}","codeql":"${{ inputs.codeql == true && needs.codeql.result || 'not-configured' }}","eval":"${{ needs.fast-lanes.result }}","gate":"${{ needs.gate.result }}"}
+      required-job-names-json: '["Validation / Gate"]'

package/.github/workflows/validation-no-codeql.yml

@@ -7,6 +7,11 @@ on:
         description: Validation tier (fast, audit, or release).
         required: true
         type: string
+      release-qualification-receipts:
+        description: Reuse a recent exact-tree audit receipt for Release Please PRs.
+        required: false
+        type: boolean
+        default: false
       runtime-repository:
         description: Repository containing the Code Foundry runtime.
         required: false
@@ -75,6 +80,11 @@ on:
         required: false
         type: string
         default: task-result
+      integration-total-shards:
+        description: Integration partitions (1 or 2); sharded scripts must honor INTEGRATION_SHARD_INDEX and INTEGRATION_TOTAL_SHARDS.
+        required: false
+        type: string
+        default: '1'
       e2e-shard-list:
         description: Comma-separated E2E shard indices passed to the test lane's matrix, e.g. "1,2".
         required: false
@@ -98,12 +108,35 @@ permissions:
   actions: read
   contents: read
   packages: read
+  pull-requests: read
   security-events: write
 
 jobs:
+  qualification:
+    name: Qualification
+    if: >-
+      vars.CI_BILLING_PAUSED != 'true' &&
+      inputs.release-qualification-receipts == true && inputs.mode == 'release'
+    permissions:
+      actions: read
+      contents: read
+      pull-requests: read
+    uses: ./.github/workflows/qualification-receipt.yml
+    with:
+      phase: verify
+      mode: ${{ inputs.mode }}
+      enabled: ${{ inputs.release-qualification-receipts }}
+      codeql-enabled: false
+      runtime-repository: ${{ inputs.runtime-repository }}
+      runtime-ref: ${{ inputs.runtime-ref }}
+      required-job-names-json: '["Validation / Gate"]'
+
   ci:
     name: CI
-    if: vars.CI_BILLING_PAUSED != 'true' && (inputs.mode == 'fast' || inputs.mode == 'audit' || inputs.mode == 'release')
+    needs: qualification
+    if: >-
+      !cancelled() && vars.CI_BILLING_PAUSED != 'true' &&
+      (inputs.mode == 'fast' || inputs.mode == 'audit' || inputs.mode == 'release')
     # Forward issue-read only to the CI workflow that runs Type-Check.
     permissions:
       actions: read
@@ -116,13 +149,23 @@ jobs:
       runtime-ref: ${{ inputs.runtime-ref }}
       runner: ${{ inputs.ci-runner }}
       artifact-prefix: ${{ inputs.artifact-prefix }}
+      release-build-only: ${{ inputs.mode == 'release' && needs.qualification.outputs.reuse == 'true' }}
+      release-package-check: ${{ inputs.mode == 'release' && needs.qualification.outputs.reuse == 'true' }}
     secrets:
       TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
       NEXTAUTH_SECRET: ${{ secrets.NEXTAUTH_SECRET }}
 
   test:
     name: Test
-    if: vars.CI_BILLING_PAUSED != 'true' && (inputs.mode == 'fast' || inputs.mode == 'audit' || inputs.mode == 'release')
+    needs: qualification
+    if: >-
+      !cancelled() && vars.CI_BILLING_PAUSED != 'true' &&
+      (inputs.mode == 'fast' || inputs.mode == 'audit' ||
+      (inputs.mode == 'release' && needs.qualification.outputs.reuse != 'true'))
+    permissions:
+      actions: read
+      contents: read
+      packages: read
     uses: ./.github/workflows/test.yml
     with:
       runtime-repository: ${{ inputs.runtime-repository }}
@@ -130,11 +173,12 @@ jobs:
       runner: ${{ inputs.test-runner }}
       unit-runner: ${{ inputs.unit-runner }}
       performance-runner: ${{ inputs.performance-runner }}
-      # Release pull requests change version metadata only; their content was
-      # audited on the pull requests that merged into main. Integration, E2E,
-      # smoke, and performance lanes stay in the audit and scheduled lanes.
+      # Fast and Release Please pull requests run unit tests only. Until a
+      # successful full qualification is verifiable for the exact main tree,
+      # release mode keeps its CI and unit-test fallback.
       unit-only: ${{ inputs.mode == 'fast' || inputs.mode == 'release' }}
       artifact-prefix: ${{ inputs.artifact-prefix }}
+      integration-total-shards: ${{ inputs.integration-total-shards }}
       e2e-shard-list: ${{ inputs.e2e-shard-list }}
       e2e-total-shards: ${{ inputs.e2e-total-shards }}
     secrets:
@@ -143,6 +187,8 @@ jobs:
   security:
     name: Security
     if: vars.CI_BILLING_PAUSED != 'true' && inputs.mode == 'audit'
+    permissions:
+      contents: read
     uses: ./.github/workflows/security.yml
     with:
       runtime-repository: ${{ inputs.runtime-repository }}
@@ -151,10 +197,12 @@ jobs:
 
   eval:
     name: Eval
-    # Behavior evals cover content changes; the lean release lane skips them
-    # because its diff is version metadata only. The reusable workflow skips
-    # cleanly when the repository has no eval harness.
+    # Behavior evals are part of audit qualification. A release-only run may
+    # reuse that work only through the exact, unexpired source receipt below.
+    # The reusable workflow skips cleanly when there is no eval harness.
     if: vars.CI_BILLING_PAUSED != 'true' && inputs.mode == 'audit'
+    permissions:
+      contents: read
     uses: ./.github/workflows/eval.yml
     with:
       runtime-repository: ${{ inputs.runtime-repository }}
@@ -164,16 +212,16 @@ jobs:
 
   # Aggregate check: "Validation / Gate" (caller job name + this job name).
   # Always evaluates; only jobs required for the mode must have succeeded.
-  # The release tier requires the available fast suite; its diff is version
-  # metadata (validated against the release policy below), its content was
-  # audited on the pull requests that merged into main, and the scheduled
-  # audit lane re-covers drift. Its generated release diff policy executes
-  # as a conditional step below, so no separate release-policy job renders
-  # skipped checks on ordinary pull requests.
+  # Release Please branches require CI and the exact generated-diff audit
+  # below. The runtime gate also requires unit tests unless the separate
+  # qualification job verified a matching source receipt. Ordinary PRs still
+  # render no skipped release-policy row.
   gate:
     name: Gate
-    needs: [ci, test, security, eval]
+    needs: [ci, test, security, eval, qualification]
     if: vars.CI_BILLING_PAUSED != 'true' && always()
+    permissions:
+      contents: read
     runs-on: ubuntu-slim
     timeout-minutes: 10
     env:
@@ -182,6 +230,8 @@ jobs:
       FOUNDRY_TEST: ${{ needs.test.result }}
       FOUNDRY_SECURITY: ${{ needs.security.result }}
       FOUNDRY_EVAL: ${{ needs.eval.result }}
+      FOUNDRY_SOURCE_QUALIFICATION: ${{ needs.qualification.outputs.reuse }}
+      FOUNDRY_QUALIFICATION: ${{ needs.qualification.result }}
       # This workflow is selected only for repositories whose canonical
       # configuration explicitly disables unavailable CodeQL. Treat that
       # policy decision as satisfied without registering a skipped PR check.
@@ -217,3 +267,29 @@ jobs:
         run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" validation release_diff
       - name: Evaluate aggregate gate
         run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" validation gate
+
+  qualification-receipt:
+    name: Qualification receipt
+    needs: [ci, test, security, eval, gate]
+    if: >-
+      vars.CI_BILLING_PAUSED != 'true' && inputs.mode == 'audit' &&
+      inputs.release-qualification-receipts == true &&
+      github.event_name == 'pull_request' && github.event.pull_request.base.ref == 'main' &&
+      needs.ci.result == 'success' && needs.test.result == 'success' &&
+      needs.security.result == 'success' && needs.eval.result == 'success' &&
+      needs.gate.result == 'success'
+    permissions:
+      actions: read
+      contents: read
+      pull-requests: read
+    uses: ./.github/workflows/qualification-receipt.yml
+    with:
+      phase: produce
+      mode: ${{ inputs.mode }}
+      enabled: ${{ inputs.release-qualification-receipts }}
+      codeql-enabled: false
+      runtime-repository: ${{ inputs.runtime-repository }}
+      runtime-ref: ${{ inputs.runtime-ref }}
+      job-results-json: >-
+        {"ci":"${{ needs.ci.result }}","test":"${{ needs.test.result }}","security":"${{ needs.security.result }}","codeql":"not-configured","eval":"${{ needs.eval.result }}","gate":"${{ needs.gate.result }}"}
+      required-job-names-json: '["Validation / Gate"]'