CI-10: One change-driven nightly coordinator, weekly full sweep, clean-from-tag release qualification

[Chris0Jeky]

Wave: Smart CI Fabric (ADR-0066 §Decision 10). Tracker: CI-00 #2324. Lane: deep qualification ownership.

Context

Deep coverage is split across ci-nightly.yml (03:25 UTC daily: backend solution, E2E smoke, cross-browser, k6, containers), nightly-quality.yml (03:55 UTC daily: coverage, dependency signals), manual mutation-testing.yml (ADR-0052 killed the schedule), ci-release.yml + release-security.yml (both on v* tags and release: published — the same commit may be qualified twice), release-desktop.yml, release-container.yml. No policy answers "what changed since the last deep qualification and which checks would give new evidence tonight". #1210 (ci-extended startup_failure, Testcontainers coverage dead) and #2180 (nightly mobile-safari red since 2026-08-24) are live symptoms.

Scope

• One nightly coordinator: find the last successfully deep-qualified main SHA; no relevant change -> honest green "no new evidence required" receipt; relevant change -> the affected deep suites; once weekly -> the full Linux + Windows + browser + container + dependency/SAST + performance entropy sweep.
• Merge CI Nightly and Nightly Quality Signals under that coordinator; keep mutation manual (ADR-0052 stands unless amended with evidence).
• Release: qualify from the exact tag in a clean hosted context (no untrusted build-output cache), rebuild artifacts, verify migrations/upgrade, SBOM + provenance, digests verified, signing only through the protected environment #2149 defines; measure and collapse the tag/release double trigger if the same commit is built twice.
• Fix or retire #1210's lane and triage #2180 inside the coordinator's ownership.

Acceptance

• No-change nightly exits through the coordinator receipt (proven on a quiet night).
• Weekly full sweep covers Linux, Windows, browsers, dependency/SAST, containers, performance.
• Release rebuilds from the tag and verifies digests/provenance; ordinary PR artifacts are never promoted.
• Mutation remains manual; ADR-0052 amended only if evidence changes the verdict.
• docs/STATUS.md §CI Status reflects the single ownership.

Dependencies / release

Depends on CI-01, CI-03, CI-05. Milestone v0.3 — moved from v0.4 on 2026-09-03 (maintainer ruling Q1 = A on #2337: checklist section H is a cutover prerequisite in full); release blocker, Priority I.

[Chris0Jeky]

Head-start material (2026-09-02, v0.3/v0.4 acceleration bundle re-pass under #2376, follow-up to #2348).

Curated head-start: docs/analysis/2026-08-30-acceleration-bundle/issues/2334-ci-10-nightly-coordinator-and-release-qualification.md (landing with the #2348 follow-up PR).

Verified against main de488fea0 — this issue's Context paragraph holds, with three additions.

1. The double trigger is two workflows, not one. Both ci-release.yml and release-security.yml declare push: tags: v* and release: types: [published]. Scope currently names only ci-release.yml; release-security.yml must be collapsed too. ci-nightly.yml ('25 3 * * *'), nightly-quality.yml ('55 3 * * *') and mutation-testing.yml (workflow_dispatch only, schedule removed 2026-08-19 under ADR-0052 / #1275) are all exactly as described.
2. The consolidation ordering in the bundle is inverted. docs/ci/SMART_CI.md §9 puts nightly consolidation in phase 3 (dedupe), gated on recall staying 100% and a weekly sweep existing — so CI10-3 (weekly sweep) must precede CI10-2 (merge the two nightlies), not follow it.
3. The "canonical deep-qualified SHA marker" is mostly already decided. ADR-0066 §Decision 3 fixed tree SHA as the fabric's receipt-binding identity; reusing it keeps one concept and needs no new mutable state (a repository variable has no history; a tag pollutes the v* namespace ci-release.yml triggers on). Recommend recording that and closing the decision. The tag-versus-release trigger owner stays genuinely open.
4. SBOM/provenance is not new work. ci-release.yml already runs reusable-sbom-provenance.yml (OPS-11 / #103) and scripts/ci/verify-sha256.sh / validate-release-tag.sh exist. The new parts are the exact-tag checkout ref, the digest-vs-provenance assertion, and the no-PR-artifact guarantee.
5. #1210 and #2180 are acceptance-relevant. docs/ci/CI_BASELINE.md measures 7 CI Nightly failures in the 31-day window from the mobile-safari lane.

First startable slice: CI10-1 — a pure coordinator module under scripts/ci/smart-ci/ with node --test, taking the last deep-qualified SHA plus the main diff and returning noChange | affectedSuites[] | weeklyFull and the receipt fields. It has no blocking predecessor and can consume lib/plan.mjs's matchGroups() today. Measuring the release double-build (group ci-release.yml runs by head SHA) is also startable read-only work. Blocked: CI10-2 and CI10-3 on the coordinator plus CI-09 #2333 retention; the no-change receipt shape on CI-12 #2336, since inventing a second receipt forks the ledger. Note "honest green" must be a receipt, not a skipped job — a skipped job reports success to branch protection.

Reference candidates: architecture/SMART_CI_DEPTH_BLUEPRINT.md §Nightly/release (validation preface prepended), diagrams/smart-ci-control-loop.svg, and docs/ci/CI_BASELINE.md for the measured nightly and release-lane numbers.