Five-minute release CI: core plus affected tests, full suite off the critical path

[alexeygrigorev]

Outcome

Release CI (push to main and workflow_dispatch promote of a main SHA) must finish in about five minutes of wall-clock time when the change is ordinary. It always runs a small core, plus only the tests the change affects. A broken change still fails the run and does not deploy.

The complete Django suite and the large Playwright suite stay on the scheduled path. End-to-end checks against the already deployed host stay on a live/post-deploy path. They must not sit on the critical path of every release.

Why current CI is ~30–50 minutes

#104 already shipped change-selective Django. Follow-ups #210 (Playwright smoke/core/full), #212, and #213 also shipped. That design is still too slow for release because of gaps, not because the selector is missing:

1. workflow_dispatch is always profile=full / reason=manual_dispatch, with no Git range. A promote of current main therefore selects full Playwright (~49 minutes measured on [P0] Root-cause and fix the Playwright harness deadlock #206) even when the commit only changed docs.
2. _browser_profile forces full for manual_dispatch and diff_empty, so the smoke tier never runs on the exact path operators use to ship.
3. The Django job ignores django_mode. Playwright already skips the suite when playwright_mode != rerun. Django still uv syncs and runs tests. Docs-only plans that mark Django skip still pay the full suite.
4. Quality failure does not stop siblings. Quality can fail in seconds; Playwright keeps the serialized website-development-release group busy for tens of minutes. Observed on run 32949380835.
5. courses/ focused closure is most of the suite and used to be slower than full; --parallel --noinput is now on the focused runner, but the closure is still huge.
6. Concurrency cancel-in-progress: false is correct for an in-flight deploy, but a long failed run still blocks the next release. Fail-fast is the fix for that case.
7. Live e2e exists (e2e/, playwright_tests/test_deployed_smoke.py, deploy smoke) but is not the scheduled “test the version that is live” lane the release path should rely on.

Do not rebuild the classifier, ownership graph, evidence envelopes, or the four-hour scheduled backstop. Tighten the release lane and keep the full lane scheduled.

Target shape

Lane	When	What	Budget
Release	push to main; workflow_dispatch operation=promote of a main SHA	Core + affected. Deploy if the aggregate gate is green.	~5 minutes wall clock, jobs in parallel
Scheduled full	existing 17 */4 * * *	Full Django, full Playwright, quality, container	unbounded except current job timeouts
Live e2e	after a successful deploy and/or a cheap schedule against https://web.dtcdev.click	Deployed smoke / remote-readonly, not in-process Playwright	does not block the next commit's compile/test start

Release core (always, in parallel):

• classification
• quality contract (lint, types, security, terminology, portability, test-ci)
• container/image (cache-hit expected after Key tested-image cache by sealed release identity #222)
• Playwright smoke unless the plan selects core/full for render/harness impact

Release affected:

• Django focused closure when the first-parent (or push) range is one mapped app
• Django full only when the existing force-full rules fire (shared core/accounts, migrations, templates, deps, unknown paths, cross-app)
• Screenshots only on render impact (already planned)

Fail closed: unknown/unsafe range still full. Full on the release lane may miss the 5-minute budget; that is acceptable for migrations/shared runtime. The SLO applies to ordinary application or docs commits.

Scope (implement in slices)

Slice A — this issue's first engineering delivery

1. Classify promote dispatch from the exact first parent of release_sha (git rev-parse <sha>^1). That SHA is the previous main for a fast-forward or --no-ff merge. Use the same NUL-safe diff and force-full rules as push. operation=rollback and any dispatch whose first parent cannot be proven stay manual_dispatch full.
2. Allow workflow_dispatch selections to carry a real base and single_application when that range is valid. Stop forcing Playwright full solely because reason=manual_dispatch when the selection is no longer that reason.
3. Honor django_mode == 'rerun' in the Django job the same way Playwright honors playwright_mode (skip the suite, still record success for an intentional skip).
4. Fail fast: if the quality job fails, cancel the rest of the same run so Playwright cannot occupy the release group. Document that the run conclusion may be cancelled while the quality log holds the failure. Do not weaken the quality contract.
5. Contract tests and _docs/ci/change-selective-ci.md for the new dispatch rule, Django skip, and fail-fast step.

Slice B — follow-up (same epic, can be the same issue's later commits or a child)

• Default release Playwright to smoke for non-render; keep core for ordinary render; full only for harness/templates. Confirm smoke is a small set (today test_foundation_smoke.py is still a large file).
• Scheduled or post-deploy live e2e against https://web.dtcdev.click (test_deployed_smoke / e2e remote-readonly), never blocking the next push's compile.
• Measure wall-clock of green ordinary pushes; report in the existing scheduled observability summary.

Slice C — later

• Shrink the courses/ focused closure once reverse-import coverage is trusted.
• Optional: serialize only after a failed quality job without cancelling (job if:), if cancel-as-conclusion is too noisy.

Non-goals

• No skipped quality/lint/security on release.
• No deploy when the aggregate gate is red.
• No deleting the four-hour full regression.
• No cancel-in-progress: true on an in-flight deploy.
• No guessing a dispatch base from HEAD^ of the runner checkout, merge-base with origin, or the last green run. First parent of the sealed release_sha only.
• No application product behavior changes.

Authority

• _docs/ci/change-selective-ci.md
• _docs/audits/2026-08-20-ci-smart-test-selection-audit.md (items 5–6 still relevant; 7–10 largely done)
• _docs/specs/10-verification-strategy.md
• _docs/PROCESS.md (smoke/core/full tester tiers)
• Closed Run change-selective CI with four-hour full regression #104, [P2] Add a real Playwright smoke tier and retier core/full #210, [P2] Guard new top-level apps and publish selection-rate observability #212, [P3] Stop double-running compatibility tests in full CI #213 (do not reopen; this issue supersedes their remaining speed gap)

Acceptance criteria

• workflow_dispatch operation=promote of a reachable main SHA classifies release_sha^1..release_sha when that parent exists and is an ancestor; otherwise manual_dispatch full.
• Rollback dispatch remains full / manual_dispatch.
• A one-app promote dispatch can be focused and Playwright smoke/core according to impact, not automatically full Playwright.
• Django job skips the suite when django_mode != rerun and still succeeds; ci-gate still requires the job outcome success.
• Quality failure cancels remaining jobs in the same run within a short bound; the quality log remains the failure evidence.
• Push selection is unchanged: exact github.event.before → after.
• Scheduled full regression still runs local make test and full Playwright as today.
• Classifier, selection, gate, workflow-contract, and provenance tests cover the new dispatch range, the still-full rollback path, Django skip, and fail-fast permissions/step.
• Docs: reason glossary for promote-dispatch vs manual_dispatch; 5-minute release budget; scheduled + live e2e lanes.

Scenarios

• Repository: promote dispatch of a docs-only commit vs first parent selects documentation skip for Django/Playwright suite execution; quality still runs; wall-clock dominated by quality+container.
• Repository: promote dispatch of courses/** only is focused Django + smoke Playwright, not make test-playwright.
• Repository: rollback dispatch stays full.
• Repository: quality portability failure cancels Playwright; run does not sit for 30+ minutes.
• Operations: scheduled full regression unchanged; live host e2e not required for slice A.

Dependencies

None. #104/#210/#212/#213 are merged. #222 (image cache) helps container time but is not a blocker for slice A.

[alexeygrigorev]

Grooming Complete

Owner-directed speed work after the #104 selective-CI audit. Slice A is implementation-ready: classify promote dispatch from release_sha^1, honor Django skip, fail-fast on quality failure. Scheduled full regression and live e2e stay off the release critical path. No needs grooming.

[alexeygrigorev]

Software Engineer Report

Slice A of #228 is implemented in this worktree and left uncommitted. verification-run was not started: a fresh plan honestly selected make test-playwright (full), and this change has no product-page render impact.

Identity

• base: b0a4def1834edd00481259852de5eaa9746949c3 (origin/main, "Fix pre-existing database-portability-check failure blocking CI")
• head: b0a4def1834edd00481259852de5eaa9746949c3 (committed tree unchanged)
• source_mode: worktree (--include-worktree; dirty tree vs current HEAD)
• worktree: /home/alexey/git/dtc-website/.tmp/issue-228-engineer
• branch: issue-228-five-minute-release-ci
• git status --short:

   M .github/workflows/ci.yml
   M _docs/ci/change-selective-ci.md
   M ci/classifier.py
   M ci/selection.py
   M ci/tests/test_classifier.py
   M ci/tests/test_selection.py
   M ci/tests/test_workflows.py
  

• HEAD stayed at b0a4def. No commit, push, or PR.

Plan digests

• Command: make verification-plan VERIFY_ISSUE=228
• Plan: .tmp/verification/verification-plan.json
• plan sha256: 7aa804f9b8c86a76566e8f86cc556bf2733851e177b635bfebf5b698383d657f
• graph_sha256: 05ffeee99244c9becd5e98e40be08188f1c5e2a61204daece984c3beb1d1bce6
• policy_version: 5
• schema_version: 3
• Classifier artifact (committed range only): .tmp/verification/ci-selection.json sha256 da192d86c6b1232c6962af0e4bcd248143d2435aceba3f50d3848e907af725d8 → event=push, changed_path_count=0, reason=diff_empty, profile=full because VERIFY_BASE_SHA=HEAD and VERIFY_HEAD_SHA=HEAD.

This plan is not the stale mixed range a36a83b..b0a4def. Changed paths are exactly the seven slice-A files above.

Profile / render

• profile: full
• reason: test_infrastructure (owners surface.ci, surface.github, surface.documentation; risk flags deployment_runtime, test_infrastructure)
• browser_profile: full → command make test-playwright
• render.impact: false (reasons [], required_captures [])
• screenshots: not_applicable (render_inputs_unchanged_without_reusable_visual)

_browser_profile would return smoke for these owners with no render impact. It returned full because the local classifier selection is profile=full / reason=diff_empty (empty committed range). That is not product-page or Playwright-harness impact. Per the engineer stop-gate, full Playwright (234 tests) was not run. Unrelated Playwright failures would not be #228.

Changed files

.github/workflows/ci.yml, _docs/ci/change-selective-ci.md, ci/classifier.py, ci/selection.py, ci/tests/test_classifier.py, ci/tests/test_selection.py, ci/tests/test_workflows.py.

Four buckets (fresh plan; verification-run not executed)

rerun (planned)

Component	Reason	Command	Executed?
selector	always_fresh_control_plane	make verification-plan	yes (plan generation)
evidence_validation	always_fresh_control_plane	make test-ci	yes, outside runner
quality	fresh_full_regression	quality-contract-v1	partial: make lint format-check typecheck only
django	fresh_full_regression	make test-django-full	no
playwright	fresh_full_regression	make test-playwright	no (stop-gate)
container	fresh_full_regression	make verification-container	no

reused: none. No prior envelopes. Provenance/expiry: N/A.

skipped: django, playwright, container, and the remainder of quality were not executed, so there is no valid aggregate verification-report.json. This would fail verification-report-check if forced. That is intentional: do not treat a skipped full Playwright suite as a pass.

not_applicable

Component	Reason
compatibility	outside_impact_closure
content_invariants	outside_large_content_closure
screenshots	render_inputs_unchanged_without_reusable_visual

Commands and counts

make verification-plan VERIFY_ISSUE=228
make test-ci
make lint format-check typecheck

• make test-ci: 605 passed in 65.53s (uv run --frozen pytest ci/tests tests_ci -q)
• lint: All checks passed
• format-check: 618 files already formatted
• typecheck: no issues in 448 source files
• Django: not run
• Playwright: not run
• Container: not run
• make verification-run VERIFY_ISSUE=228 VERIFY_WORKTREE=issue-228-five-minute-release-ci: not started

Artifacts

• Plan: /home/alexey/git/dtc-website/.tmp/issue-228-engineer/.tmp/verification/verification-plan.json
• Selection: /home/alexey/git/dtc-website/.tmp/issue-228-engineer/.tmp/verification/ci-selection.json
• Report: not produced (runner not started)
• Screenshots: not_applicable (internal CI, no product render). Engineer-produced product screenshots are not evidence.

Behavior vs slice A

1. Promote dispatch first parent: classify_git_change(..., dispatch_operation="promote") uses git rev-parse release_sha^1 then _classify_range. Missing parent / non-promote stays manual_dispatch full with base=None. Covered by test_promote_dispatch_classifies_the_first_parent_range.
2. Rollback: test_rollback_dispatch_stays_full_without_a_base → full / manual_dispatch / base=None.
3. Focused promote + browser by impact: validate_selection allows focused workflow_dispatch when the range is one mapped app; remaining manual_dispatch still requires full and base=None. _browser_profile no longer treats every dispatch as full—only leftover manual_dispatch / diff_empty.
4. Django skip: quality job unchanged; Django uv sync / lock / suite / record gated on django_mode == 'rerun'. Job still succeeds when skipped; ci-gate still requires job success (same pattern as Playwright).
5. Fail-fast: quality job permissions.actions: write and gh run cancel on failure. Documented that the run conclusion may be cancelled while the quality log holds the failure.
6. Push selection: push still uses exact before..after via _classify_range; --dispatch-operation is extra on the classification job.
7. Scheduled full regression: .github/workflows/scheduled-full-regression.yml not modified.
8. Tests: classifier/selection/workflow-contract coverage for promote range, rollback, Django skip, fail-fast; make test-ci 605 passed (includes gate/provenance contracts).
9. Docs: _docs/ci/change-selective-ci.md glossary for promote vs manual_dispatch, ~5-minute release budget, scheduled full + live deployed smoke off the release critical path.

Limitations

• Slice B/C remain: small smoke set, live e2e lane, wall-clock reporting, shrinking courses/ closure. Leave Five-minute release CI: core plus affected tests, full suite off the critical path #228 open (Refs #228, not Closes).
• Five-minute wall-clock is measured on GitHub Actions after merge, not locally.
• Local make verification-plan classifies HEAD..HEAD as diff_empty, which forces browser_profile=full even for this CI-only worktree. Tester should recompute the plan from this same base/head and must not treat unrelated full Playwright as Five-minute release CI: core plus affected tests, full suite off the critical path #228 evidence. Preferred browser evidence for this slice is make test-playwright-smoke or N/A given render.impact=false.
• Aggregate verification report is absent because the runner was not started.

Freeze

Worktree frozen with the seven slice-A files uncommitted. No commit, no push, no PR.

[alexeygrigorev]

Software Engineer Report

Updated after the local planner fix. Slice A remains uncommitted. make verification-run completed with verdict=success. Playwright was smoke (30 tests), not full.

Identity

• base: b0a4def1834edd00481259852de5eaa9746949c3
• head: b0a4def1834edd00481259852de5eaa9746949c3
• source_mode: worktree
• worktree: /home/alexey/git/dtc-website/.tmp/issue-228-engineer
• branch: issue-228-five-minute-release-ci
• git status --short:

   M .github/workflows/ci.yml
   M _docs/ci/change-selective-ci.md
   M ci/classifier.py
   M ci/evidence.py
   M ci/selection.py
   M ci/tests/test_classifier.py
   M ci/tests/test_selection.py
   M ci/tests/test_workflows.py
   M ci/verification.py
   M tests_ci/test_evidence.py
   M tests_ci/test_verification.py
  

• HEAD stayed at b0a4def. No commit, push, or PR.

Planner fix (unblocks local verification)

_browser_profile now treats diff_empty / leftover manual_dispatch as “unknown range → full Playwright” only when impact.owners is empty. Local HEAD..HEAD plus --include-worktree therefore keeps smoke/core from known owners and render.

Fail-closed coverage kept:

• empty canonical diff / empty owners still make test-playwright (test_empty_canonical_diff_uses_shared_planner_and_fails_closed_to_full)
• rollback/manual dispatch with no base and empty owners still full
• Playwright/test_support/template owners still full
• render impact still core unless those full owners apply

New test: test_worktree_ci_records_keep_smoke_playwright_on_empty_committed_range.

Recorder fix (needed to record smoke)

PYTEST_INTERRUPTION_RE was matching Make’s echoed timeout --foreground --signal=TERM ... line (case-insensitive Timeout), so a green smoke run could not be recorded. The regex is now case-sensitive; pytest +++ Timeout +++ still fails closed. Test: test_make_timeout_wrapper_echo_is_not_an_interrupted_pytest_run.

Plan digests

• Command: make verification-plan VERIFY_ISSUE=228
• Plan file: .tmp/verification/verification-plan.json
• plan file sha256: 8942124917bb1be1d42dd89ffd10fe214e5c96e90c97264f702aad035a42a713
• report plan_sha256 (canonical): ebf66c660a2e378c5aa4080d1b147953214c74b15576cfdc89e8da43d368ff2b
• graph_sha256: 05ffeee99244c9becd5e98e40be08188f1c5e2a61204daece984c3beb1d1bce6
• profile: full / reason: test_infrastructure
• browser_profile: smoke
• render.impact: false
• changed paths (11): the git-status files above

Four buckets

rerun (all success; reused none; skipped none)

Component	Reason	Command	Counts
selector	always_fresh_control_plane	make verification-plan	11 changed paths
evidence_validation	always_fresh_control_plane	make test-ci	607 passed
quality	fresh_full_regression	quality-contract-v1	607 passed (includes test-ci)
django	fresh_full_regression	make test-django-full	2496 tests, 2487 passed, 9 skipped
playwright	fresh_full_regression	make test-playwright-smoke	30 passed, 0 failed, 207 deselected
container	fresh_full_regression	make verification-container	13 assertions, success

reused: none. Provenance/expiry: N/A.

skipped: none.

not_applicable

Component	Reason
compatibility	outside_impact_closure
content_invariants	outside_large_content_closure
screenshots	render_inputs_unchanged_without_reusable_visual

Commands

make test-ci
make verification-plan VERIFY_ISSUE=228
make verification-run VERIFY_ISSUE=228 VERIFY_WORKTREE=issue-228-five-minute-release-ci

• make test-ci before the run: 607 passed in 62.32s
• verification-run exit 0, engineer report success
• Django: 2487 passed / 9 skipped / 2496
• Playwright: 30 passed (make test-playwright-smoke), not make test-playwright
• Container: success
• Screenshots: not_applicable (internal CI, no product render)

Artifacts

• Plan: /home/alexey/git/dtc-website/.tmp/issue-228-engineer/.tmp/verification/verification-plan.json
• Report: /home/alexey/git/dtc-website/.tmp/issue-228-engineer/.tmp/verification/verification-report.json (file sha256 78eb725b5f66c01a3e2762443169ccba9d3129236bc5b700e478a9d13dba075c)
• Evidence: /home/alexey/git/dtc-website/.tmp/issue-228-engineer/.tmp/verification/evidence/
• Log: /home/alexey/git/dtc-website/.tmp/issue-228-engineer/.tmp/verification/verification-run.log

Behavior vs slice A

Unchanged from the previous report, plus: local worktree plans no longer force full Playwright when owners are known. Promote/rollback/Django skip/fail-fast/push range/scheduled workflow/docs remain as implemented.

Limitations

• Slice B/C remain (small smoke set, live e2e, wall-clock reporting, shrinking courses/ closure). Leave Five-minute release CI: core plus affected tests, full suite off the critical path #228 open (Refs #228, not Closes).
• Five-minute wall-clock is measured on GitHub Actions after merge, not locally.
• Django/quality/container stay full here because surface.ci / surface.github carry test_infrastructure / deployment_runtime. That is expected.

Freeze

Worktree frozen with the eleven files uncommitted. No commit, no push, no PR.

[alexeygrigorev]

QA Review

PASS for slice A. Slice B/C remain; leave #228 open (Refs #228, not Closes). Screenshots: not_applicable.

Independent tester worktree: /home/alexey/git/dtc-website/.tmp/issue-228-tester on issue-228-five-minute-release-ci-tester. Product/CI source was not modified after the engineer freeze.

Identity

• base/head: b0a4def1834edd00481259852de5eaa9746949c3 / same (origin/main)
• source_mode: worktree (make verification-plan uses --include-worktree)
• git status --short: 11 modified files, same set as the engineer freeze (classifier/selection/workflow/docs/verification/evidence). HEAD unchanged. No commit, push, or PR.

Plan vs engineer handoff

Command: make verification-plan VERIFY_ISSUE=228 VERIFY_CONSUMER=tester

Digest / field	Engineer	Tester	Drift
graph_sha256	05ffeee99244c9becd5e98e40be08188f1c5e2a61204daece984c3beb1d1bce6	same	none
ci-selection.json sha256	da192d86c6b1232c6962af0e4bcd248143d2435aceba3f50d3848e907af725d8	same	none
committed classifier range	HEAD..HEAD, event=push, changed_path_count=0, reason=diff_empty, profile=full	same	none
worktree owners	surface.ci, surface.documentation, surface.github	same	none
plan minus created_at	c2b87016d3bc822bd8fc9b28ce6fb02b3bc5f018daeb482ac6e98fb67eb2cb57	same	none
plan file sha256	8942124917bb1be1d42dd89ffd10fe214e5c96e90c97264f702aad035a42a713	653780be58ec1a2162d69749ebceaa0c61583939ce64f95c6518375f3e0b5f12	created_at only
canonical sha256_json(plan)	ebf66c660a2e378c5aa4080d1b147953214c74b15576cfdc89e8da43d368ff2b	5c7b4c90632b27cb50049f0773f592fb977e756def09ccd502eb932f3a206201	created_at only
profile / reason	full / test_infrastructure	same	none
browser_profile	smoke (make test-playwright-smoke)	same	none
render.impact	false, required_captures []	same	none

Empty committed HEAD..HEAD plus worktree owners is expected. Playwright is smoke, not full. Every component disposition matches the handoff. Unexplained drift: none.

Reuse / provenance

reused: none. Engineer local evidence was not accepted as CI provenance and was not loaded into this run. All rerun envelopes are origin.kind=local, producer_role=tester, worktree=issue-228-five-minute-release-ci-tester, issue=228. Policy graph_sha256=05ffeee9… / policy_version=5. Latest result for every rerun component is success with exit 0. No older pass after a newer failure. Report-bound artifacts are present and SHA-256-matched.

Commands and counts

make verification-plan VERIFY_ISSUE=228 VERIFY_CONSUMER=tester
make verification-run VERIFY_ISSUE=228 VERIFY_WORKTREE=issue-228-five-minute-release-ci-tester VERIFY_CONSUMER=tester VERIFY_PHASE=tester
make verification-report-check VERIFY_ISSUE=228 VERIFY_CONSUMER=tester VERIFY_PHASE=tester

Tester-final report: verdict=success, phase=tester, skipped=[], reused=[], invalid_evidence=[].

rerun

Component	Reason	Command	Counts
selector	always_fresh_control_plane	make verification-plan	11 changed paths
evidence_validation	always_fresh_control_plane	make test-ci	607 passed / 59.43s
quality	fresh_full_regression	quality-contract-v1	607 passed (includes test-ci 61.48s); lint/format/mypy/migrations/django-check/deploy-check green
django	fresh_full_regression	make test-django-full	2496 tests, 2487 passed, 9 skipped, 0 failed
playwright	fresh_full_regression	make test-playwright-smoke	30 passed, 0 failed, 207 deselected, flake policy complete
container	fresh_full_regression	make verification-container	13 assertions, status pass

not_applicable: compatibility (outside_impact_closure); content_invariants (outside_large_content_closure); screenshots (render_inputs_unchanged_without_reusable_visual).

Artifacts

• Plan: .tmp/verification/verification-plan.json (file sha256 653780be58ec1a2162d69749ebceaa0c61583939ce64f95c6518375f3e0b5f12; canonical 5c7b4c90632b27cb50049f0773f592fb977e756def09ccd502eb932f3a206201)
• Report: .tmp/verification/verification-report.json (file sha256 807466594722b96180870bc159ecabd5c05a8b89dfdb0bb8255dc16360899a5b)
• Selection: .tmp/verification/ci-selection.json (sha256 da192d86c6b1232c6962af0e4bcd248143d2435aceba3f50d3848e907af725d8)
• Evidence: .tmp/verification/evidence/
• Log: .tmp/verification/verification-run.log
• Screenshots: not_applicable (internal CI, no product-page render). No unrelated product pages captured.

Envelope output SHA-256: evidence_validation log e7a21c25971cfcf15cd734e4d99fe109f6a79db4e639b3fd9e7d93e280e961ef; quality log 49dd557e1a5ff946d386b383da6152dc0d0d8567538ae1d11b5a458e55f18e62; django log daecf4282ca329cd6568c1fc6052af579af79afd6f0d8403c9a6c9a48dd76e35; playwright log f0e357c0f4317a27b14e0e4fcb8ff4cb0c71d554319d1d36eebe25b34a1f23a5; container-check 049a480e7707e6dd962d12c3a66c9953c4b6cce9e29ba72199f60196bb48d87a.

Slice A acceptance criteria

Independently verified; engineer checkboxes left checked.

1. Promote first parent — classify_git_change(..., dispatch_operation="promote") uses git rev-parse <sha>^1 then the same _classify_range as push. Missing parent / non-exact commit / non-promote stays manual_dispatch full with base=None. Covered by test_promote_dispatch_classifies_the_first_parent_range.
2. Rollback full — test_rollback_dispatch_stays_full_without_a_base → full / manual_dispatch / base=None.
3. Focused promote + browser by impact — validate_selection allows focused workflow_dispatch when the range is one mapped app. _browser_profile forces full for leftover diff_empty / manual_dispatch only when impact.owners is empty. Local HEAD..HEAD + worktree CI owners produced smoke, not make test-playwright.
4. Django skip — Django uv sync, lock, suite, and record steps are gated on django_mode == 'rerun'. Job still succeeds when those steps skip. ci-gate still lists django in NORMAL_REQUIRED_JOBS and requires outcome success.
5. Fail-fast — quality job permissions.actions: write and gh run cancel on failure() after quality-contract-v1. Quality log remains on the job. Workflow-level cancel-in-progress: false is unchanged.
6. Push range unchanged — push still classifies exact before..after via _classify_range; --dispatch-operation is unused on that path.
7. Scheduled full regression — .github/workflows/scheduled-full-regression.yml unmodified; still make test and make test-playwright.
8. Tests — classifier/selection/workflow-contract coverage for promote range, rollback, Django skip string, fail-fast permissions/step; make test-ci 607 passed. Recorder no longer treats Make’s timeout --foreground echo as a pytest interruption (test_make_timeout_wrapper_echo_is_not_an_interrupted_pytest_run).
9. Docs — glossary distinguishes promote vs leftover manual_dispatch; ~5-minute release budget; scheduled full + live deployed smoke off the release critical path; empty committed range keeps smoke/core from known worktree owners.

Findings (non-blocking)

• Django skip does not skip release-source checkout or the always-on classifier/provenance uv run steps in that job (unlike Playwright’s skip path). The suite is skipped and the job can still succeed; leftover setup cost is slice-B-adjacent, not a failed criterion.
• gh run cancel is only the step after the quality contract. A later quality-job failure (test-ci / compatibility) does not fire that cancel. Portability/lint-in-seconds is the stated fail-fast scenario and is covered.
• Scope asked to document that the GitHub run conclusion may be cancelled while the quality log holds the failure. _docs/ci/change-selective-ci.md does not spell that out. Glossary / budget / lanes criteria still hold.
• ci/tests/test_gate.py and ci/tests/test_provenance.py were not extended; leftover manual_dispatch no-base remains covered. New dispatch/skip/fail-fast assertions live in classifier, selection, and workflow tests.

Verdict

PASS. Ready for PM acceptance of slice A. Do not close #228.

[alexeygrigorev]

Product Acceptance

Verdict: ACCEPT (slice A only)

Reviewed from a release-operator perspective against the groomed #228 contract, the frozen uncommitted candidate at /home/alexey/git/dtc-website/.tmp/issue-228-engineer (HEAD b0a4def, 11 dirty files; byte-identical to the tester copy), the engineer handoff, and the independent tester-final report (verdict=success, phase tester). QA Review PASS: #228 (comment)

Operator outcome (slice A)

• Promote workflow_dispatch of a reachable main SHA classifies release_sha^1..release_sha with the same NUL-safe range and force-full rules as push. Rollback/probe and an unprovable parent stay manual_dispatch full with no guessed base.
• A one-app promote can be focused Django plus Playwright smoke/core by impact; leftover manual_dispatch/diff_empty no longer forces full Playwright when owners are known.
• Django skips the suite when django_mode != rerun and the job can still succeed. ci-gate still requires the Django job outcome success. Publish/deploy still require a green aggregate; a red gate does not deploy.
• Quality-contract failure cancels remaining jobs in the same run (actions: write + gh run cancel). Concurrency cancel-in-progress: false is unchanged, so an in-flight deploy is not pre-empted.
• Push still uses exact before..after. Scheduled full regression is unmodified (make test + full Playwright). Live host e2e is not required for this slice.
• No public product-page, navigation, copy, or auth surface. Screenshots are correctly not_applicable.

Evidence

Tester-final report classifies every component exactly once (9/9): selector, evidence_validation, quality, django, playwright, container rerun/success; compatibility, content_invariants, screenshots not_applicable. skipped=[], reused=[] (no reuse to justify), invalid_evidence=[], required_captures=[]. Screenshot N/A reason: render_inputs_unchanged_without_reusable_visual (internal CI, render.impact=false, no product-page render). Playwright was smoke (30 passed), not full.

The ~5-minute wall-clock SLO is for ordinary GitHub Actions runs after merge, not local proof. This change itself is test_infrastructure / deployment_runtime, so local Django/quality/container staying full is expected.

Follow-ups (do not block slice A)

Slice B/C remain: smaller smoke set, live e2e, wall-clock reporting, courses/ closure. Tester notes that are out of this slice: leftover Django-job setup on skip; cancel fires after quality-contract-v1 (the stated portability/lint fail-fast), not later quality-job steps; docs do not spell “run conclusion may be cancelled while the quality log holds the failure.”

Slice A may merge with Refs #228. Leave the issue open for B/C. Do not use Closes #228.

[alexeygrigorev]

On-call report — slice A push

Verdict: RED

• Run: https://github.com/DataTalksClub/website/actions/runs/32963147116
• Event: push to main
• Merge SHA: 373e77e920e3978c718d6bde2921a2d01581548b
• Feature commit: 109a108b33f106029530dda95fbd85896dd084c7 (Refs #228)
• Wall-clock: 30m12s (2026-08-26T11:24:20Z → 2026-08-26T11:54:32Z)
• Issue remains open (slices B/C). This comment does not close Five-minute release CI: core plus affected tests, full suite off the critical path #228.

Required jobs

Job	Conclusion	Duration
resolve-release	success	35s
classification	success	28s
quality	success	2m36s
screenshots	success	21s
container	success	1m20s
django	success	7m59s
playwright	success	2m44s
ci-gate	success	25s
auto-capture-prior	success	28s
publish	success	1m48s
deploy	failure	18m00s

OIDC probe jobs (probe-publisher, probe-deployer, probe-contract, probe-wrong-main-claims, probe-wrong-environment-claim) were skipped, as expected for a push (not a probe dispatch).

Quality's fail-fast cancel step was skipped because quality passed.

Slice A selection (this CI-only change)

Classifier/plan for b0a4def… → 373e77e… (11 paths, CI workflow/docs/Python only):

• browser_profile: smoke (not forced full). Playwright: 30 passed, 207 deselected in 1m51s.
• screenshots: not_applicable (no render impact).
• django: rerun make test-django-full (139 passed in 2m31s) because the plan reason is test_infrastructure (documentation_only: false).
• quality: rerun, passed. Compatibility: not_applicable.

Failure evidence (no secrets)

Deploy did run. Image publish succeeded. Promotion reached live https://web.dtcdev.click as version 20260826-112453-373e77e. Health/admin-API smoke passed. Then deployed HTML smoke failed and the controller reported:

release failed safely: deployed browser smoke failed

Failed tests (desktop and mobile viewports):

playwright_tests/test_deployed_smoke.py::test_deployed_public_and_studio_html_are_exact_and_read_only

Assertion:

Locator expected to be visible
waiting for locator("main #courses a[href=\"/courses/de-zoomcamp/2026\"]").first
playwright_tests/course_catalog_contract.py:21

Page under test: https://web.dtcdev.click/courses. Failed job: https://github.com/DataTalksClub/website/actions/runs/32963147116/job/98162884851

This is a code/test failure in the deployed catalog contract, not an AWS/OIDC/ECS infrastructure outage (app reachable, health passed). Return to engineering on #228 (or a dedicated catalog/smoke issue if product wants it split). Do not escalate to DataTalksClub/aws-infra from this evidence.

The same catalog-link assertion also failed on the immediately previous main run (https://github.com/DataTalksClub/website/actions/runs/32951351045, SHA b0a4def…). Process still treats this push as red; it is not dismissed as acceptable pre-existing failure.

Routing

• Introducing commit for this push: 109a108 Refs #228
• No on-call code push from this observation
• Next owner: engineering verification of the live /courses catalogue vs REPRESENTATIVE_COURSE_PATH (/courses/de-zoomcamp/2026)

[alexeygrigorev]

PM disposition — preserve slice A; split remaining B/C work (2026-08-30)

Disposition: do not rewrite or reopen slice A, and do not treat the remaining bullets as one engineer-ready #228 change. Split them into three bounded child intakes. #228 remains OPEN as the parent epic.

Evidence and preserved delivery

Slice A remains shipped and accepted exactly as recorded:

• feature commit 109a108b33f106029530dda95fbd85896dd084c7 (Refs #228), merged at 373e77e920e3978c718d6bde2921a2d01581548b;
• independent tester PASS and PM acceptance remain authoritative for promote first-parent classification, Django intentional skip, known-owner smoke planning, and quality fail-fast;
• its issue checkboxes and reports must not be rewritten as pending work.

The post-push run for 373e77e proves the distinction the follow-up must preserve: classification through ci-gate took about 9m40s, Playwright smoke selected 30 tests and its job took 2m44s, while publish/deploy continued separately and deploy failed on the already-existing live course-catalog contract. That run is evidence, not a green five-minute SLO sample.

Current main is 9a491cd9baeb1e723bd05e8dacb20978fbaf9d33. Its exact push run 33236915907 failed with the #232 homepage baseline (21 Playwright failures, screenshot overflow, no publish/deploy). Recent scheduled runs at that SHA also fail after roughly 35–36 minutes on Playwright while Django, quality, migrations, factories, container, and quarantine monitoring pass. The ordered #236-then-#232 candidate has focused behavior green but still lacks a terminal full-Playwright pass, independent tester screenshots, PM acceptance, commits, and an exact-SHA green push. Therefore none of the remaining #228 work is ready to claim release-budget or live-host acceptance today.

#222's sealed tested-image cache contract is already shipped and technically accepted. Its still-open exact-live-delivery evidence is related to the first future green release, but #222 is not permission to mix cache-key work into these children.

Why children are required

The remainder crosses three independent ownership and failure boundaries:

1. local release-smoke selection plus historical duration observability;
2. remote, deployed, read-only verification with live-evidence expiry and production-safety rules;
3. the courses/ Django ownership closure and its reverse-import proof.

Combining them would make failures hard to attribute, couple remote authority to local marker changes, and turn the later closure experiment into a P0 release-path rewrite. Each child needs its own grooming, engineer/tester/PM lifecycle, evidence, and commit.

Child 1 — release smoke and budget observability

File a P0 child for a deliberately small release-smoke contract and redacted wall-clock reporting. It may not weaken quality, unknown/full fallback, render-driven core/full selection, scheduled full Playwright, or deployment gating.

The measurement contract is:

• release verification critical path: classification job start through ci-gate completion;
• delivery path: run creation through deploy completion, reported separately and never used to make the five-minute verification claim;
• eligible SLO samples are successful ordinary main pushes whose selection is documentation-only or one mapped application and which do not carry a force-full risk;
• report sample count, latest value, median, maximum, and count/rate within 5m00s over the existing bounded 20-run history; do not publish run IDs, SHAs, paths, logs, or production data in the aggregate;
• missing/malformed history is unavailable, never a pass and never permission to narrow verification.

Readiness: the child may be filed/groomed now but engineering is blocked until #236 then #232 are accepted, merged in the ruled order, and their exact combined main push records Playwright, screenshots, and ci-gate green. Empirical acceptance additionally requires at least one eligible green ordinary push; do not manufacture or rerun workflows merely to create a sample.

Child 2 — non-blocking deployed read-only smoke

File a separate P0 operations/testing child for a workflow that runs after a successful deploy and, optionally, on a cheap schedule against https://web.dtcdev.click. It must use only the guarded remote_readonly boundary (playwright_tests/test_deployed_smoke.py or an explicitly reviewed equivalent), bind evidence to the exact live release identity, expire as live evidence, redact outputs, and never run the mutating e2e/ provisioning/homework/project/email suite.

Its outcome must be visible and actionable without becoming a prerequisite for the next push's classification/quality/container/Django/Playwright start. A stale or already-superseded live identity is not a pass for the triggering release. It must not remove the existing deployment-time health/readiness/safe-smoke checks or permit deploy on a red aggregate gate.

Readiness: implementation is blocked until the ordered #236/#232 release produces a successful exact-SHA deploy and the live host reports that sealed identity healthy/ready. #222 closure is not a source dependency, but the same release evidence may satisfy #222's remaining live cache-identity observation.

Child 3 — reduce the courses/ focused Django closure

File this as a later P1 child, not as current P0 engineering. The current reviewed closure is intentionally broad; the AST reverse-import contract is necessary but not by itself proof that database/service/fixture behavior is independent.

The child must first record the current graph-derived labels, test count, and duration for an exact synthetic courses/**-only range. Any removed label must have deterministic reverse-import and behavioral-boundary proof; unknown/dynamic imports, shared runtime, migrations, templates, dependencies, cross-app changes, or graph ambiguity remain full. It must show a materially smaller focused run while the prior closure, full Django, ownership/selection tests, and scheduled full backstop remain green. No application behavior or test deletion is in scope.

Readiness: keep this intake deferred until #236/#232 have landed with a green exact-SHA release, at least one scheduled full-regression run at the resulting verification state is successful, and Child 1 has established the duration metric used to judge improvement. Only then should PM turn it into an engineer-ready closure delta.

Parent status

No #228 body checkbox, label, or shipped evidence changed in this PM pass. The parent remains P0/open until the bounded B children are delivered or explicitly deferred by the owner; the C child remains a separately prioritized later optimization. No code, workflow dispatch/rerun, commit, push, deployment, issue close, or other issue mutation was performed.