[eric] ci: add dogfood.yml scheduled every six hours across windows-latest+macos-13+macos-14 that builds, runs verify-dogfood, uploads the per-leg manifest, then aggregates into preflight-tunings.json; gate both release-windows and release-macos on a release-gate job that downloads the latest tunings via gh run download and runs verify-release-readiness so a v* tag halts before signing if the dogfood loop has not validated twelve consecutive clean runs per platform

.github/workflows/dogfood.yml

@@ -0,0 +1,101 @@
+name: Dogfood (preflight verdict vs reality)
+
+# Runs verify-dogfood every 6 hours across the matrix plus on push. Each leg
+# launches the packaged app, captures the [preflight2] verdict, INDEPENDENTLY
+# verifies boot success, and asserts they agree. Mismatches (false-positive,
+# false-negative, or missing line) fail the leg red. The aggregator job
+# downloads every leg's manifest, computes per-check disagreement rates, and
+# writes preflight-tunings.json which the preflight module reads to silently
+# downgrade a chronically-noisy check. Release-readiness gate runs at the end:
+# blocks the v* tag until every required platform has 12 consecutive clean runs.
+
+on:
+  schedule:
+    - cron: '0 */6 * * *'   # every 6 hours; 4 runs/day; 12 runs ~= 3 days of dogfood
+  push:
+    branches: [eric/lock]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  actions: read
+
+jobs:
+  dogfood:
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [windows-latest, macos-13, macos-14]
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 60
+    env:
+      CSC_IDENTITY_AUTO_DISCOVERY: 'false'
+      GOOGLE_OAUTH_CLIENT_ID: 'e2e-placeholder.apps.googleusercontent.com'
+      GOOGLE_OAUTH_CLIENT_SECRET: 'e2e-placeholder-secret'
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with: { node-version: '20.18.1' }
+      - uses: actions/setup-python@v5
+        with: { python-version: '3.13' }
+
+      - name: Build packaged app (Windows)
+        if: startsWith(matrix.os, 'windows')
+        shell: pwsh
+        run: pwsh -NoProfile -File scripts/build-app-win.ps1
+
+      - name: Build packaged app (macOS)
+        if: startsWith(matrix.os, 'macos')
+        shell: bash
+        run: bash scripts/build-app.sh
+
+      - name: Dogfood run (verdict vs reality cross-check)
+        shell: bash
+        run: node scripts/ci/verify-dogfood.js --manifest scripts/ci/dogfood-manifest.jsonl
+
+      - name: Upload per-leg manifest fragment
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: dogfood-manifest-${{ matrix.os }}
+          path: scripts/ci/dogfood-manifest.jsonl
+          retention-days: 90
+
+  aggregate:
+    needs: dogfood
+    if: always()
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with: { node-version: '20.18.1' }
+
+      - name: Download every leg's manifest
+        uses: actions/download-artifact@v4
+        with:
+          pattern: dogfood-manifest-*
+          path: dogfood-fragments
+
+      - name: Merge into the rolling manifest
+        shell: bash
+        run: |
+          touch scripts/ci/dogfood-manifest.jsonl
+          for f in dogfood-fragments/*/dogfood-manifest.jsonl; do
+            [ -f "$f" ] && cat "$f" >> scripts/ci/dogfood-manifest.jsonl
+          done
+          wc -l scripts/ci/dogfood-manifest.jsonl
+
+      - name: Aggregate + auto-tune
+        shell: bash
+        run: node scripts/ci/dogfood-aggregator.js
+
+      - name: Upload tunings (preflight reads this next build)
+        uses: actions/upload-artifact@v4
+        with:
+          name: preflight-tunings
+          path: scripts/ci/preflight-tunings.json
+          retention-days: 90
+
+      - name: Release readiness summary (informational; release workflow enforces it on v* tag)
+        shell: bash
+        run: node scripts/ci/verify-release-readiness.js || echo "Not yet ready - the v* tag will be blocked until consecutive clean runs accrue."

.github/workflows/release-macos.yml

@@ -38,8 +38,29 @@ permissions:
   contents: write
 
 jobs:
+  # Release-readiness gate (mirrors release-windows): the dogfood loop must have validated 12 consecutive clean runs per platform OR the v* tag halts before any DMG is built.
+  release-gate:
+    runs-on: ubuntu-latest
+    permissions: { contents: read, actions: read }
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with: { node-version: '20.18.1' }
+      - name: Fetch latest preflight-tunings from dogfood
+        env: { GH_TOKEN: ${{ github.token }} }
+        shell: bash
+        run: |
+          set -e
+          run_id=$(gh run list --workflow dogfood.yml --branch eric/lock --limit 1 --json databaseId --jq '.[0].databaseId' || true)
+          if [ -z "$run_id" ]; then echo "no dogfood runs yet; release cannot proceed"; exit 1; fi
+          gh run download "$run_id" --name preflight-tunings --dir scripts/ci/ || { echo "no preflight-tunings artifact"; exit 1; }
+      - name: Verify release readiness
+        shell: bash
+        run: node scripts/ci/verify-release-readiness.js
+
   build-macos:
     runs-on: macos-latest
+    needs: release-gate
     timeout-minutes: 90
 
     env:

.github/workflows/release-windows.yml

@@ -43,8 +43,30 @@ permissions:
   contents: write
 
 jobs:
+  # Release-readiness gate: fetches the most recent dogfood workflow's preflight-tunings artifact and asserts every required platform has the consecutive clean dogfood runs. Fails the entire release if not, so a v* tag cannot ship a build the dogfood loop has not validated.
+  release-gate:
+    runs-on: ubuntu-latest
+    permissions: { contents: read, actions: read }
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with: { node-version: '20.18.1' }
+      - name: Fetch latest preflight-tunings from dogfood
+        env: { GH_TOKEN: ${{ github.token }} }
+        shell: bash
+        run: |
+          set -e
+          run_id=$(gh run list --workflow dogfood.yml --branch eric/lock --limit 1 --json databaseId --jq '.[0].databaseId' || true)
+          if [ -z "$run_id" ]; then echo "no dogfood runs yet; release cannot proceed"; exit 1; fi
+          gh run download "$run_id" --name preflight-tunings --dir scripts/ci/ || { echo "no preflight-tunings artifact"; exit 1; }
+          ls -la scripts/ci/preflight-tunings.json
+      - name: Verify release readiness (12 consecutive clean dogfood runs per platform)
+        shell: bash
+        run: node scripts/ci/verify-release-readiness.js
+
   build-windows:
     runs-on: windows-latest
+    needs: release-gate
     timeout-minutes: 60
 
     env: