fix(ci): cancel tests when pull requests close

.github/workflows/tests.yml

@@ -4,6 +4,7 @@ on:
   push:
     branches: [main]
   pull_request:
+    types: [opened, synchronize, reopened, closed]
 
 permissions:
   contents: read
@@ -15,6 +16,7 @@ concurrency:
 jobs:
   pytest:
     name: Full test suite
+    if: github.event_name != 'pull_request' || github.event.action != 'closed'
     runs-on: ubuntu-latest
     services:
       postgres:
@@ -60,6 +62,7 @@ jobs:
 
   frontend:
     name: Frontend lint, test, build
+    if: github.event_name != 'pull_request' || github.event.action != 'closed'
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository

docs/product-technical-gap-baseline.md

@@ -60,9 +60,10 @@ only aggregate, non-identifying evidence to this repository.
 
 ### Exact open-PR boundary
 
-At this snapshot there were 4 open PRs and 10 open issues. Exact observed heads
-were `#632 c5193532`, `#631 62deb34a` (this branch's observed parent),
-`#629 49675283`, and `#579 45769b0d`. PR #579 is open; its ADR 0211 reservation is why protected
+At this snapshot there were 6 open PRs and 10 open issues. Exact observed heads
+were `#634 14083a14` (this branch's observed parent), `#633 741b01c3`,
+`#632 7381c9ec`, `#631 e248b0a8`, `#629 49675283`, and `#579 45769b0d`.
+PR #579 is open; its ADR 0211 reservation is why protected
 main's filter-option decision is ADR 0212. PRs #627 and #628 reached protected
 `main`; #629 remains an open asynchronous-pool follow-up and is not release
 evidence. The open heads remain blocked on hosted gates and/or independent
@@ -71,7 +72,7 @@ observations are not merge readiness. Re-fetch exact heads,
 unresolved threads, checks, approvals, rulesets, and merge SHA before any
 lifecycle claim.
 
-> Audit snapshot: 2026-08-25 22:25 KST (refreshed by the autonomous merge
+> Audit snapshot: 2026-08-25 22:30 KST (refreshed by the autonomous merge
 > loop). This repository records synthetic fixtures and aggregate,
 > non-identifying runtime evidence only. Open PRs and local checks are not
 > protected-default-branch release evidence. Identifying post identifiers,
@@ -81,15 +82,17 @@ lifecycle claim.
 ## 1. Exact-head and governance evidence
 
 The protected default branch was `04e6b610655d0db91d5f7ba9486bdda1440e0b19`
-when this baseline was refreshed. The live queue contained 4 open PRs and 10
+when this baseline was refreshed. The live queue contained 6 open PRs and 10
 open issues. The exact-head inventory below supersedes older per-PR snapshots
 elsewhere in this document; those older rows remain useful historical delivery
 context only.
 
 | PR | Exact observed head | Merge/check state at this snapshot |
 | ---: | --- | --- |
-| #632 | `c5193532` | preserves the source-post provenance of ontology-annotated prompt facts; hosted gates and independent review remain required |
-| #631 | `62deb34a` (observed parent) | decomposes closed PR #490 without replaying it; this row advances when the snapshot correction is committed, and hosted gates plus independent review remain required |
+| #634 | `14083a14` (observed parent) | makes the existing Tests concurrency group cancel obsolete work when a PR closes; it is stacked on #631 and requires parent-first delivery plus exact-head gates |
+| #633 | `741b01c3` | keeps authenticated web reads responsive under measured concurrent load; hosted gates and independent review remain required |
+| #632 | `7381c9ec` | preserves the source-post provenance of ontology-annotated prompt facts; hosted gates and independent review remain required |
+| #631 | `e248b0a8` | decomposes closed PR #490 without replaying it; hosted gates and independent review remain required |
 | #629 | `49675283` | releases the Global Ask pool before embedding-provider work and records repaired replay/load evidence; hosted gates and independent review remain required |
 | #579 | `45769b0d` | persists leftover interaction-map coordinates through the fast-mlsirm owner contract and fails coverage closed with rejected maps; hosted gates and independent review remain required |
 
@@ -358,7 +361,8 @@ this file per §3.5 of the prior snapshot).
 
 | Gap | Current evidence | Acceptance requirement |
 | --- | --- | --- |
-| Protected release | 4 open PRs at snapshot: #632 preserves graph-fact provenance, #631 is this current-main decomposition, #629 is the asynchronous pool follow-up, and reopened #579 consumes the fast-mlsirm interaction-map contract; all retain hosted and independent-review gates | Terminal exact-head checks, no unresolved threads, independent exact-head approvals, protected squash-merge SHA |
+| Protected release | 6 open PRs at snapshot: #634 repairs stale-run cancellation, #633 follows measured web-read contention, #632 preserves graph-fact provenance, #631 is the current-main decomposition, #629 is the asynchronous pool follow-up, and reopened #579 consumes the fast-mlsirm interaction-map contract; all retain hosted and independent-review gates | Parent-first delivery for #634; terminal exact-head checks, no unresolved threads, two independent approvals including last-push approval, protected squash-merge SHA |
+| CI queue release latency | Two Tests runs for already merged PRs occupied the available runner slots while 54 newer runs remained queued. Manual cancellation released the stale work, but the central close workflow was itself queued behind those runs. #634 reuses the repository's existing per-PR concurrency group and emits a jobless close event so GitHub can cancel obsolete Tests work before runner allocation | Merge #631 then retarget and merge #634; close a synthetic PR while its Tests run is active and verify the old run becomes cancelled, the close-event jobs remain skipped, and a newer exact-head run starts without manual intervention |
 | Evidence-grounded operations workspace | Protected-main #614 delivers governed semantic Ask, live Similar VOC, disjoint pending/failed analysis metrics, full Storybook state inventory, and current desktop/mobile screenshot evidence. Authorized-corpus backfill acceptance remains unavailable | Perform authenticated authorized-corpus acceptance with aggregate evidence and retain fail-closed no-match behavior |
 | Shared frontend gate | The ADR 0109 login repair is on protected `main`; eight older branches carried the defect and received the same verified repair this loop (#521–#560) | Keep every future branch cut from post-repair bases; re-verify with frontend lint/test/build before push |
 | Identifying baseline regression | `main` gap file listed real post identifiers; separately, closed #506 and pre-existing public history contain a private runtime source-table identifier, while current `main` and #507 trees are clean | Land this non-identifying rewrite, then coordinate ADR 0001 history remediation with security/privacy owners; do not reproduce the value, force-push, or delete evidence ad hoc |

tests/test_tests_workflow_contract.py

@@ -0,0 +1,15 @@
+"""Regression contracts for the repository test workflow."""
+
+from pathlib import Path
+
+
+def test_pr_close_cancels_obsolete_test_runs_without_starting_jobs() -> None:
+    """A close event must cancel the same-PR run while scheduling no test work."""
+    workflow = (
+        Path(__file__).resolve().parents[1] / ".github/workflows/tests.yml"
+    ).read_text(encoding="utf-8")
+
+    assert "types: [opened, synchronize, reopened, closed]" in workflow
+    assert "group: tests-${{ github.ref }}" in workflow
+    assert "cancel-in-progress: true" in workflow
+    assert workflow.count("github.event.action != 'closed'") == 2