Merge remote-tracking branch 'origin/master' into feat/adr0016-type-build-check

.github/workflows/ci.yml

@@ -43,10 +43,11 @@ jobs:
         run: pnpm run lint
 
       # Doc-sync gates (doc-sync-enforcement RFC). doc-typecheck compiles the
-      # fenced ts blocks against the root project-reference graph. The event
-      # taxonomy, markdown wrap, and markdown link checks only read source. Same
-      # `doc-sync` script the pre-push hook runs (quality-gates RFC: one source of truth).
-      - name: Doc-sync gates (doc code blocks + event taxonomy + markdown)
+      # fenced ts blocks against the root project-reference graph. The cordis
+      # catalog freshness check, type-equiv check, and markdown wrap/link checks
+      # only read source. Same `doc-sync` script the pre-push hook runs
+      # (quality-gates RFC: one source of truth).
+      - name: Doc-sync gates (doc code blocks + cordis catalog + type-equiv + markdown wrap/links)
         run: pnpm run doc-sync
 
       # Module-graph freshness: regenerate docs/module-graph.md from the
@@ -78,7 +79,7 @@ jobs:
       - name: Demo smoke test
         run: |
           set -euo pipefail
-          out=$(printf 'echo ci smoke\n' | timeout 60 node --expose-internals --import tsx examples/echo-agent/start.ts 2>&1)
+          out=$(printf 'echo ci smoke\n' | timeout 60 pnpm run demo:echo 2>&1)
           echo "$out"
           echo "$out" | grep -q '\[tool call\] echo({"text":"ci smoke"})'
           echo "$out" | grep -q '\[tool result\] ECHO: CI SMOKE'
@@ -86,3 +87,12 @@ jobs:
           # per-run session log named main-session-<uuid>.jsonl. Assert one exists.
           ls .sessions/_no-cwd/main-session-*.jsonl >/dev/null
           rm -rf .sessions
+
+      # The published `bin` is `lib/bin.js`, run under plain `node` by a real
+      # consumer — NOT the tsx dev path the demo smoke and demo:* scripts use.
+      # These keyless smokes boot the BUILT bins (this step runs AFTER the build)
+      # in a temp dir that mirrors a real install, catching a regression in the
+      # published artifact that tsx would mask. They self-skip if lib/ is absent,
+      # so the e2e job (which does not build) does not run them.
+      - name: Built-bin smoke test (published lib/bin.js under node)
+        run: pnpm exec vitest run --config vitest.e2e.config.ts packages/ui/stdio-agent/tests/built-bin.e2e.ts packages/ui/acp-agent/tests/built-bin.e2e.ts

.github/workflows/e2e.yml

@@ -23,7 +23,7 @@ name: E2E (real DeepSeek API)
 # in the BASE repo's context WITH secrets while still able to check out untrusted
 # fork code — a textbook key-leak vector, especially once this repo is public.
 # The fork/secret model and its public-repo implications are recorded in
-# docs/rfc/implemented/2026-06-19-real-api-e2e-ci.md.
+# docs/rfc/implemented/testing/2026-06-19-real-api-e2e-ci.md.
 #
 # Note: scheduled triggers are auto-disabled after 60 days of repo inactivity;
 # push/pull_request/workflow_dispatch act as backstops.