Run the canonical Flect quality gate in GitHub CI

[robinbraemer]

Outcome

Run Flect's canonical quality gate on every pull request and protected-main change so browser, native, security, documentation, and performance regressions cannot rely on one developer machine.

Product-quality coverage

Supports every release-gated FQ-* outcome, with direct ownership of repeatable release evidence and the CI requirement in FQ-15 and FQ-22.

Required behavior

• Add a pinned GitHub Actions workflow for supported Bun, browser, Rust, and Tauri checks.
• Reuse repository-owned commands instead of duplicating the gate in workflow prose.
• Cache only reproducible dependencies and never persist provider credentials, prompts, capsules, or user workspaces.
• Upload bounded failure evidence needed to diagnose a failed public gate.
• Keep live Pi, Apple signing, notarization, and other credentialed release proof in separately authorized jobs.

Acceptance criteria

• Pull requests run the mandatory source checks, unit/contract tests, production Chromium suite, Rust tests, and build verification through the canonical repository commands.
• Required checks fail closed on test, accessibility, performance, generated-skill, Effect-version, formatting, type, or documentation drift.
• Main is protected against merging a failing or absent mandatory gate.
• The workflow uses least-privilege GitHub permissions, pinned action revisions, bounded artifacts, concurrency cancellation, and no untrusted secret exposure.
• A dated verification report records one passing run and one deliberately induced failing run through the public GitHub check surface.
• Native signing/notarization and live-provider jobs are neither silently skipped nor falsely represented by the credential-free pull-request gate.

Non-goals

• Moving product runtime behavior into CI.
• Storing Apple or provider credentials in repository files, logs, prompts, or fork-triggered jobs.
• Treating a green workflow as a substitute for packaged-app, clean-machine, or human accessibility evidence.

[robinbraemer]

Pushed verification update — 2026-08-10

The canonical workflow and implementation are now present on codex/flect-vision-complete. Its complete local equivalent passes: source, 84/84 Chromium, 26/26 Rust, bundle budgets, SDK packaging, and the ad-hoc desktop build.

The workflow intentionally triggers only for pull requests and main. No pull request or merge was authorized or created, so there is no honest hosted check to claim yet; this issue remains open for that run and branch-protection evidence.

[robinbraemer]

Hosted dispatch boundary — 2026-08-10

A direct workflow-dispatch attempt was checked after the branch push. GitHub does not expose Run workflow because .github/workflows/quality.yml does not yet exist on the default branch; workflow_dispatch cannot bootstrap a workflow that is only present on a feature branch.

Therefore the first honest hosted run requires either a pull request (which evaluates the branch workflow) or initial integration to main. Neither was created by this push-only run.

[robinbraemer]

Hosted CI evidence is now real, not inferred: PR #38 commit 53ebc56 passed the canonical Flect quality gate in https://github.com/akua-dev/flect/actions/runs/31383464208 (888 source tests, 84/84 production-Chromium workflows, Rust host tests, and desktop app build).

Repository settings were checked after the run: there is no classic branch protection rule and no ruleset. This issue therefore remains open only for the explicit repository-policy decision to require Flect quality / Flect quality gate on main; the workflow and hosted execution are proven.

[robinbraemer]

Current-head hosted quality evidence for PR #38:

• commit 29b809a
• canonical run 31397856719 succeeded in 12m52s
• 166 source files / 888 tests, 85/85 Chromium, 26/26 Rust, and the optimized ad-hoc signed desktop bundle all passed
• the exact real-Git conflict regression passed 10/10 repeated production runs; the full sharing suite passed 9/9

This issue stays open because making the check required on main is repository policy, and the repository still has no branch-protection rule or ruleset. The implementation gate itself is green.