From 6fc7e23bbe0143302fa7e2e08e04efa2fbb3eea7 Mon Sep 17 00:00:00 2001
From: Eric <ciregenz@berkeley.edu>
Date: Thu, 28 May 2026 02:13:21 -0700
Subject: [PATCH] [eric] ci: chain the four new preflight verifiers (selftest,
 rigs, race, matrix) at the head of verify-all and add hostile-env legs to
 e2e.yml so network=blocked + appdata=readonly + lang=de-DE all run on every
 push

---
 .github/workflows/e2e.yml | 39 +++++++++++++++++++++++++++++++++++++++
 scripts/ci/verify-all.js  |  4 ++++
 2 files changed, 43 insertions(+)

diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml
index 3cba9393..4a0b1878 100644
--- a/.github/workflows/e2e.yml
+++ b/.github/workflows/e2e.yml
@@ -61,6 +61,36 @@ jobs:
         shell: bash
         run: node scripts/ci/selftest-gate.js
 
+      # Preflight Layer 1+2+3+4 (unit, hang fuzz, failure rigs, race) - pure node, ~5s.
+      - name: Preflight selftest (Layers 1+2)
+        shell: bash
+        run: node scripts/ci/selftest-preflight.js
+      - name: Preflight failure rigs (Layer 3)
+        shell: bash
+        run: node scripts/ci/verify-preflight-rigs.js
+      - name: Preflight race / cache (Layer 4)
+        shell: bash
+        run: node scripts/ci/verify-preflight-race.js
+
+      # Preflight Layer 5: hostile-env scenarios. Each leg asserts the verdict
+      # matches the expected envelope for that scenario; network=blocked
+      # producing 'fail' instead of 'warn' is the false-positive bug class.
+      - name: Preflight matrix (normal)
+        shell: bash
+        run: node scripts/ci/verify-preflight.js
+      - name: Preflight matrix (network=blocked must -> warn)
+        shell: bash
+        env: { OPENSWARM_TEST_NETWORK: blocked }
+        run: node scripts/ci/verify-preflight.js
+      - name: Preflight matrix (appdata=readonly must -> fail)
+        shell: bash
+        env: { OPENSWARM_TEST_APPDATA: readonly }
+        run: node scripts/ci/verify-preflight.js
+      - name: Preflight matrix (lang=de-DE must stay -> ok)
+        shell: bash
+        env: { OPENSWARM_TEST_LANG: de-DE }
+        run: node scripts/ci/verify-preflight.js
+
       - name: Build packaged app (Windows)
         if: startsWith(matrix.os, 'windows')
         shell: pwsh
@@ -139,6 +169,15 @@ jobs:
       - name: Gate selftest (mutation)
         shell: bash
         run: node scripts/ci/selftest-gate.js
+      - name: Preflight selftest + rigs + race + matrix (Layers 1-5)
+        shell: bash
+        run: |
+          node scripts/ci/selftest-preflight.js
+          node scripts/ci/verify-preflight-rigs.js
+          node scripts/ci/verify-preflight-race.js
+          node scripts/ci/verify-preflight.js
+          OPENSWARM_TEST_NETWORK=blocked node scripts/ci/verify-preflight.js
+          OPENSWARM_TEST_APPDATA=readonly node scripts/ci/verify-preflight.js
       - name: Build packaged app (Windows)
         shell: pwsh
         run: pwsh -NoProfile -File scripts/build-app-win.ps1
diff --git a/scripts/ci/verify-all.js b/scripts/ci/verify-all.js
index cf9bd55f..20865409 100644
--- a/scripts/ci/verify-all.js
+++ b/scripts/ci/verify-all.js
@@ -27,6 +27,10 @@ function main() {
 
   const steps = [
     // Pure-logic gates run first - cheap, no build needed, fail fast.
+    ['preflight selftest (Layer 1+2: unit + hang fuzz)', 'selftest-preflight.js', []],
+    ['preflight rigs (Layer 3: failure simulators)', 'verify-preflight-rigs.js', []],
+    ['preflight race (Layer 4: parallel + cache)', 'verify-preflight-race.js', []],
+    ['preflight matrix (Layer 5: hostile-env scenario)', 'verify-preflight.js', []],
     ['deps fully pinned (reproducible backend builds)', 'verify-deps-pinned.js', []],
     ['no build-host paths leaked into the artifact', 'verify-host-leakage.js', appArg],
     ['bundled python runs (--version + import smoke)', 'verify-python-health.js', appArg],