fix: run full local CI lanes in parallel and speed up Python codegen (#450)

* ci: run the full local CI as parallel lanes and fix the slow steps at the root

The flagless scripts/ci-local.sh took about 85 minutes, every lane one after
another. Measured on the same 24-core machine it now takes 10m17s, green, with
the same tests: every suite reports the same counts, less the duplicate below.

- Parallel lanes. The tree-writing steps (install, drift gates, one workspace
  build) run first; the rest run as independent lanes, at most MO_CI_JOBS (8)
  at once, each into its own log printed as one block when it ends. The
  summary lists every step's time, the slowest steps and each lane's wall
  time. --quick and --only stay serial and select exactly what they did.
- Each test runs once. tests/integration ran inside "conformance: python" and
  again as "integration-tests (python)"; the java and kotlin conformance
  classes ran inside the reactor and again on their own; the workspace was
  rebuilt and reinstalled by several lanes; mvn install ran three times.
- Python codegen ran ruff as `python -m ruff`, a second interpreter per call,
  twice per emitted file: ~90% of codegen time. It now runs ruff's binary
  (find_ruff_bin), same version, same output. Python conformance 16m49s ->
  1m20s alone (with xdist).
- The shared Java test logback config was never wired, so every module but
  metadata logged at DEBUG (1.86M lines a run). Surefire now points every
  module at it.
- Runners in parallel: pytest-xdist, bun test --parallel for the TS
  integration suite, surefire forkCount=3 for the JVM integration modules.
  TS integration 15m52s -> 2m49s, Java 6m57s -> 1m55s, Kotlin 4m52s -> 2m33s,
  Python integration 5m51s -> 56s, each measured alone.
- The Postgres sidecar is named per checkout; each scenario still gets its own
  database.

* no-mistakes(review): apply reviewer inline fixes

* no-mistakes(review): Keep python integration tests in conformance when docker down

* no-mistakes(test): Bind servers and containers to OS-assigned ports

* no-mistakes(document): Fix stale cube lane ordering in cube-export docs

Author: dmealing

CHANGELOG.md

@@ -10,6 +10,16 @@ here.**
 
 ## [Unreleased]
 
+### Changed
+
+- **Python: `metaobjects gen` and `verify --codegen` run ruff as its own binary.** Every emitted
+  file is import-sorted and formatted by ruff twice, and each call used to go through
+  `python -m ruff`, which starts a second interpreter only to exec the binary the ruff package
+  installed. That start was about 90% of codegen time (59 ms against 6 ms a call, measured). The
+  formatter now resolves that binary once with ruff's own `find_ruff_bin`, so the ruff version
+  and the generated output are unchanged; it falls back to `python -m ruff` if the binary cannot
+  be found.
+
 ## [1.1.0] — 2026-10-22
 
 _npm `1.1.0` (all 14 `@metaobjectsdev/*` packages in lockstep), PyPI `1.1.0`, NuGet `1.1.0` and

CONTRIBUTING.md

@@ -91,6 +91,14 @@ scripts/ci-local.sh --quick    # hygiene.yml in full + the TypeScript half of
 MO_CI_LIST_ONLY=1 scripts/ci-local.sh --quick   # print the steps, run nothing
 ```
 
+The full run does its tree-writing steps first (install, the drift gates, one workspace
+build), then runs the rest as parallel lanes: at most `MO_CI_JOBS` at once, default 8. Each
+lane's output prints as one block when the lane finishes, so lanes never interleave. The
+summary gives every step's time, the slowest steps and each lane's wall time. `--quick` and
+`--only` run serially. `MO_CI_PY_WORKERS` (default 8), `MO_CI_TS_WORKERS` (default 6) and
+`MO_CI_JVM_FORKS` (default 3) set the worker counts for pytest-xdist, the TypeScript
+integration suite and the JVM integration modules' surefire forks.
+
 It SKIPS (loudly, not silently) any port whose toolchain (bun/dotnet/uv/mvn) isn't
 installed. The `.githooks/pre-push` hook additionally runs the TS build+typecheck
 gate and a Java pom-version drift guard on every push (activate hooks once per

docs/CONFORMANCE.md

@@ -34,7 +34,7 @@ regenerate with `ls -d fixtures/<corpus>/*/ | wc -l` for directory-shaped corpor
 | [`fixtures/extract-conformance/`](../fixtures/extract-conformance/) | 48 | ✓ | ✓ | inherits the shared JVM engine | ✓ | ✓ |
 | [`fixtures/output-prompt-conformance/`](../fixtures/output-prompt-conformance/) | 17 | ✓ | ✓ | ✓ | ✓ | ✓ |
 | [`fixtures/persistence-conformance/`](../fixtures/persistence-conformance/) | 59 (53 query + 6 migration) | all 59; the 24 `report-*` and the `-15` decimal scenarios also on SQLite, MySQL and D1, `decimal-exact` also on MySQL (a scenario's `engines:` key is exact) | 53 query (migrations TS-only, ADR-0015); the `report-*` and `engines:` scenarios also on SQLite and MySQL | 53 query (via Exposed); the `report-*` and `engines:` scenarios also on SQLite and MySQL | 53 query; the `report-*` and `engines:` scenarios also on SQLite and MySQL | 53 query (pg8000); the `report-*` and `engines:` scenarios also on SQLite (`sqlite3`) and MySQL (PyMySQL) |
-| [`fixtures/api-contract-conformance/`](../fixtures/api-contract-conformance/) | 106 (31 core + 10 tph + 9 m2m + 4 jsonb + 2 write-through + 12 projection + 27 report + 11 decimal) | ✓ (Fastify reference + generated lane); `report/` and `decimal/` also on SQLite, MySQL and D1 | ✓ (embedded HTTP + JDBC); `report/` and `decimal/` generated controllers over OMDB on Postgres, SQLite and MySQL | ✓ (embedded HTTP + Exposed); `report/` and `decimal/` also on SQLite and MySQL | ✓ (HttpListener + Npgsql); `report/` and `decimal/` also on SQLite and MySQL | ✓ (FastAPI + pg8000); `report/` and `decimal/` also on SQLite and MySQL |
+| [`fixtures/api-contract-conformance/`](../fixtures/api-contract-conformance/) | 106 (31 core + 10 tph + 9 m2m + 4 jsonb + 2 write-through + 12 projection + 27 report + 11 decimal) | ✓ (Fastify reference + generated lane); `report/` and `decimal/` also on SQLite, MySQL and D1 | ✓ (embedded HTTP + JDBC); `report/` and `decimal/` generated controllers over OMDB on Postgres, SQLite and MySQL | ✓ (embedded HTTP + Exposed); `report/` and `decimal/` also on SQLite and MySQL | ✓ (Kestrel + Npgsql); `report/` and `decimal/` also on SQLite and MySQL | ✓ (FastAPI + pg8000); `report/` and `decimal/` also on SQLite and MySQL |
 | [`fixtures/decimal-wire/`](../fixtures/decimal-wire/) | 1 vector file (format, parse, filter operand, 15-digit read) | ✓ (`runtime-ts` and the generated helper) | ✓ (`CanonicalDecimal`) | ✓ (the generated wire file) | ✓ (`DecimalWire`) | ✓ (`decimal_wire`) |
 | [`fixtures/validation-conformance/`](../fixtures/validation-conformance/) | 42 cases | ✓ (generated Zod + run-time `runValidators`) | ✓ | ✓ | ✓ | ✓ (generated Pydantic + run-time `run_validators`) |
 | [`fixtures/registry-conformance/`](../fixtures/registry-conformance/) | 1 canonical manifest | ✓ (reference emitter) | ✓ | ✓ | ✓ | ✓ |

docs/features/cube-export.md

@@ -648,8 +648,8 @@ both together), the TPH subtype's `sql`, a one-to-one join from both ends, the i
 `CASE`, and a two-hop `@spine` report, whose rows, the spine rows with no facts included, must
 equal the lowered view's. Each query's rows are compared with plain SQL on the same database.
 
-Run it with `scripts/ci-local.sh --only cube`. The full `scripts/ci-local.sh` runs it after the
-integration suite, and `--quick` and `--no-integration` drop it. The first run pulls the Cube
+Run it with `scripts/ci-local.sh --only cube`. The full `scripts/ci-local.sh` runs it as its own
+parallel lane, and `--quick` and `--no-integration` drop it. The first run pulls the Cube
 image, which is about 1 GB. With Docker down, the lane records a SKIP behind a banner, never a
 pass; under `--strict-toolchains` it is a failure. In CI it is a `cube` entry in
 `integration-tests.yml`, which runs on release tags and on manual dispatch, not on every push.

fixtures/api-contract-conformance/jsonb/README.md

@@ -132,7 +132,7 @@ booted over HTTP) are wired and green for:
   converter refuses polymorphic bodies → HTTP 415), so the Kotlin generated lane
   wires a small Jackson `JsonElement` codec module (the consumer's serialization
   wiring).
-- **C#** — reference (hand-rolled `HttpListener` over Postgres testcontainer) +
+- **C#** — reference (hand-rolled Kestrel server over Postgres testcontainer) +
   generated (the real `MetaObjects.Codegen` `DocumentRoutes` + `AppDbContext`
   Roslyn-compiled and booted full-stack on Kestrel over Postgres testcontainer).
   The generated lane locks the #105 codegen: the `payload` property is typed