Reduce repeated Tool execution and enforce CI budget

.github/workflows/verify.yml

@@ -21,12 +21,15 @@ jobs:
   plan:
     name: Impact plan
     runs-on: ubuntu-latest
-    timeout-minutes: 5
+    timeout-minutes: 30 # Safety only; ci-required still enforces 360 seconds.
     outputs:
       mode: ${{ steps.plan.outputs.mode }}
       run_tests: ${{ steps.plan.outputs.run_tests }}
       check_matrix: ${{ steps.plan.outputs.check_matrix }}
       test_matrix: ${{ steps.plan.outputs.test_matrix }}
+      required_jobs: ${{ steps.plan.outputs.required_jobs }}
+      job_timeout_minutes: ${{ steps.plan.outputs.job_timeout_minutes }}
+      execution_deadline: ${{ steps.plan.outputs.execution_deadline }}
     steps:
       - name: Check out repository history
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -62,6 +65,7 @@ jobs:
             --base "$BASE_SHA" \
             --head "$HEAD_SHA" \
             --cost-history \
+            --ci-budget \
             --plan-path "$RUNNER_TEMP/ci-plan.json" \
             --github-output "$GITHUB_OUTPUT"
 
@@ -87,7 +91,10 @@ jobs:
     needs:
       - plan
     runs-on: ubuntu-latest
-    timeout-minutes: 15
+    timeout-minutes: ${{ fromJSON(needs.plan.outputs.job_timeout_minutes) }}
+    env:
+      CI_DEADLINE: ${{ needs.plan.outputs.execution_deadline }}
+      PYTHONDONTWRITEBYTECODE: "1"
     strategy:
       fail-fast: false
       matrix: ${{ fromJSON(needs.plan.outputs.check_matrix) }}
@@ -104,12 +111,12 @@ jobs:
 
       - name: Install the pinned Profile toolchain
         run: |
-          python -m pip install --disable-pip-version-check -r Tools/requirements-profile.txt -r Tools/requirements-host.txt
-          python .github/scripts/install_cue.py --destination "$RUNNER_TEMP/cambium-profile-cue"
+          python .github/scripts/ci_impact.py run-step --deadline "$CI_DEADLINE" -- python -m pip install --disable-pip-version-check -r Tools/requirements-profile.txt -r Tools/requirements-host.txt
+          python .github/scripts/ci_impact.py run-step --deadline "$CI_DEADLINE" -- python .github/scripts/install_cue.py --destination "$RUNNER_TEMP/cambium-profile-cue"
           echo "CAMBIUM_CUE=$RUNNER_TEMP/cambium-profile-cue/cue" >> "$GITHUB_ENV"
 
       - name: Run deterministic verification
-        run: make check
+        run: python .github/scripts/ci_impact.py run-step --deadline "$CI_DEADLINE" -- make check
 
       - name: Tracked and untracked non-ignored tree must be unchanged
         if: ${{ always() }}
@@ -127,7 +134,10 @@ jobs:
     needs:
       - plan
     runs-on: ubuntu-latest
-    timeout-minutes: 15
+    timeout-minutes: ${{ fromJSON(needs.plan.outputs.job_timeout_minutes) }}
+    env:
+      CI_DEADLINE: ${{ needs.plan.outputs.execution_deadline }}
+      PYTHONDONTWRITEBYTECODE: "1"
     strategy:
       fail-fast: false
       matrix: ${{ fromJSON(needs.plan.outputs.test_matrix) }}
@@ -160,8 +170,8 @@ jobs:
 
       - name: Install the pinned Profile toolchain
         run: |
-          python -m pip install --disable-pip-version-check -r Tools/requirements-profile.txt -r Tools/requirements-host.txt
-          python .github/scripts/install_cue.py --destination "$RUNNER_TEMP/cambium-profile-cue"
+          python .github/scripts/ci_impact.py run-step --deadline "$CI_DEADLINE" -- python -m pip install --disable-pip-version-check -r Tools/requirements-profile.txt -r Tools/requirements-host.txt
+          python .github/scripts/ci_impact.py run-step --deadline "$CI_DEADLINE" -- python .github/scripts/install_cue.py --destination "$RUNNER_TEMP/cambium-profile-cue"
           echo "CAMBIUM_CUE=$RUNNER_TEMP/cambium-profile-cue/cue" >> "$GITHUB_ENV"
 
       - name: Set up rendering Node
@@ -177,9 +187,9 @@ jobs:
           renderer_workspace="$RUNNER_TEMP/cambium-static-renderer"
           mkdir -p "$renderer_workspace"
           cp Tools/knowledge/rendering/static_renderer/package.json Tools/knowledge/rendering/static_renderer/package-lock.json "$renderer_workspace/"
-          npm ci --prefix "$renderer_workspace" --ignore-scripts --no-audit --no-fund
+          python .github/scripts/ci_impact.py run-step --deadline "$CI_DEADLINE" -- npm ci --prefix "$renderer_workspace" --ignore-scripts --no-audit --no-fund
           export PLAYWRIGHT_BROWSERS_PATH="$renderer_workspace/browsers"
-          node "$renderer_workspace/node_modules/playwright-core/cli.js" install --with-deps chromium
+          python .github/scripts/ci_impact.py run-step --deadline "$CI_DEADLINE" -- node "$renderer_workspace/node_modules/playwright-core/cli.js" install --with-deps chromium
           renderer_node="$(node -p 'process.execPath')"
           renderer_browser="$(node -e 'console.log(require(process.argv[1]).chromium.executablePath())' "$renderer_workspace/node_modules/playwright-core")"
           test -x "$renderer_node"
@@ -191,7 +201,8 @@ jobs:
       - name: Run catalog-selected tests
         env:
           TEST_FILES: ${{ matrix.test-files }}
-        run: make test-selected PYTHON=python TEST_FILES="$TEST_FILES" TEST_REPORT="$RUNNER_TEMP/test-costs.json"
+          TEST_DEADLINE: ${{ needs.plan.outputs.execution_deadline }}
+        run: make test-selected PYTHON=python TEST_FILES="$TEST_FILES" TEST_REPORT="$RUNNER_TEMP/test-costs.json" TEST_DEADLINE="$TEST_DEADLINE"
 
       - name: Preserve test costs
         if: ${{ always() }}
@@ -225,6 +236,11 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 2
     steps:
+      - name: Check out budget owner
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
       - name: Require every matrix job to succeed
         env:
           PLAN_RESULT: ${{ needs.plan.result }}
@@ -252,3 +268,14 @@ jobs:
           echo "verification mode: $VERIFICATION_MODE"
           echo "verify check matrix result: success"
           echo "verify test matrix result: $TEST_RESULT"
+
+      - name: Check complete required-chain budget
+        if: ${{ always() }}
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REQUIRED_JOBS: ${{ needs.plan.outputs.required_jobs }}
+        run: |
+          PYTHONDONTWRITEBYTECODE=1 python .github/scripts/ci_impact.py budget \
+            --repository "$GITHUB_REPOSITORY" \
+            --run-id "$GITHUB_RUN_ID" --attempt "$GITHUB_RUN_ATTEMPT" \
+            --expected-jobs "$REQUIRED_JOBS"

Card/R02 Single Note Authoring Card.md

@@ -14,9 +14,9 @@ source_files:
   - kernel/K12 Quality Assurance/05 Automated and Manual Checks.md
   - kernel/K12 Quality Assurance/14 Batch Review.md
   - kernel/K12 Quality Assurance/19 Incremental Audit Planning.md
-source_hash: 'eb24d3183345'
-reviewed_source_hash: 'eb24d3183345'
-reviewed_card_hash: 'ddc08602fdcf'
+source_hash: '0593c0ee65dd'
+reviewed_source_hash: '0593c0ee65dd'
+reviewed_card_hash: 'e7ce946f69f2'
 ---
 # R02 Single Note Authoring Card
 
@@ -29,7 +29,7 @@ Create or change one canonical page within an already confirmed scope and owner
 - Confirm the page owner, note type, intended reader, and applicable Profile bindings before writing.
 - Write to the applicable depth and preserve claim/source distinctions.
 - After the batch enters `open`, materialize its immutable AuditPlan; satisfy each obligation when due through its unique registered producer without changing its native evidence kind.
-- Send L-tier pages through independent substantive review and M-tier pages only through the M checklist inside Batch Review.
+- Send L-tier pages through independent substantive review and M-tier pages through the Batch Review checklist; answer only outstanding semantic items, preserving accepted machine evidence and common-condition coverage.
 - Treat applicable rendering predicates and the separate rendering-verification record as distinct obligations; neither substitutes for the other.
 
 ## Stop or escalate

Card/R03 Module Build Card.md

@@ -10,8 +10,8 @@ source_files:
   - kernel/K02 Knowledge Work Construction/01 Inventory and Coverage Ledger.md
   - kernel/K02 Knowledge Work Construction/09 Knowledge Batch Production.md
   - kernel/K12 Quality Assurance/03 Module and Coverage Review.md
-source_hash: 'e88900f27ac1'
-reviewed_source_hash: 'e88900f27ac1'
+source_hash: '6f0458ce0a58'
+reviewed_source_hash: '6f0458ce0a58'
 reviewed_card_hash: '5cc0da3869ce'
 ---
 # R03 Module Build Card

Card/R06 Migration and Refactor Card.md

@@ -11,8 +11,8 @@ source_files:
   - kernel/K09 Wiki Link and Navigation/03 Path Alias and Heading Links.md
   - kernel/K12 Quality Assurance/09 Batch-close Closed List.md
   - kernel/K12 Quality Assurance/19 Incremental Audit Planning.md
-source_hash: '72eb770fcb0f'
-reviewed_source_hash: '72eb770fcb0f'
+source_hash: '0dce5a8f8c34'
+reviewed_source_hash: '0dce5a8f8c34'
 reviewed_card_hash: '70f79fde556d'
 ---
 # R06 Migration and Refactor Card

Card/R07 Long-running Execution Card.md

@@ -15,9 +15,9 @@ source_files:
   - kernel/K13 Task Runtime and Execution Control/17 Escalation Policy.md
   - kernel/K12 Quality Assurance/14 Batch Review.md
   - kernel/K12 Quality Assurance/19 Incremental Audit Planning.md
-source_hash: 'f9c549102cec'
-reviewed_source_hash: 'f9c549102cec'
-reviewed_card_hash: '872a0e9da739'
+source_hash: '05849f18e6c2'
+reviewed_source_hash: '05849f18e6c2'
+reviewed_card_hash: 'c81aef9817d2'
 ---
 # R07 Long-running Execution Card
 
@@ -30,7 +30,7 @@ Execute admitted multi-batch work while keeping Queue, Progress, evidence, deliv
 - Resume or reconcile the current runtime before selecting the next action.
 - Confirm the frozen Standards/Profile identity and reconcile pending guidance before opening the next batch.
 - Work only on an admitted batch whose dependencies and delivery gate are satisfied.
-- Materialize the current AuditPlan, invoke the registered producer for every due obligation, and preserve each planned evidence kind; only `audit-receipt` obligations use the full AuditReceipt producer. Create the batch-review wrapper only after the complete due-stage closure resolves.
+- Materialize the current AuditPlan and follow its outstanding evidence actions; preserve each planned evidence kind and reuse accepted machine evidence or registered common facts without duplicate declarations. Create the batch-review wrapper only after the complete due-stage closure resolves.
 - Use the registered writer for every state transition, satisfy its required Gate evidence, and read back canonical state after each critical write.
 - Require the applicable batch review and close Gates before accepting the batch result.
 - Checkpoint accepted progress, evidence, remaining work, and the next safe action before yielding or handing off.

Card/R08 Audit and Completion Card.md

@@ -11,9 +11,9 @@ source_files:
   - kernel/K12 Quality Assurance/15 Terminal Audit and Convergence.md
   - kernel/K12 Quality Assurance/16 Terminal Proof Contract.md
   - kernel/K13 Task Runtime and Execution Control/11 Completion Policy.md
-source_hash: '2c2097205b20'
-reviewed_source_hash: '2c2097205b20'
-reviewed_card_hash: '9fd4b42419e2'
+source_hash: 'fd50177492a5'
+reviewed_source_hash: 'fd50177492a5'
+reviewed_card_hash: '3cf4afccd3ac'
 ---
 # R08 Audit and Completion Card
 
@@ -24,7 +24,7 @@ Evaluate an already requested build completion candidate and produce the applica
 ## Actions
 
 - Resolve the R08 completion Read Set only after a build task enters its completion boundary; maintenance completion does not use R08.
-- Reconcile current scope, Coverage, Queue, invalidations, reused evidence, each registered native evidence kind, full AuditReceipts where required, and applicable Profile dimensions.
+- Reconcile current scope, Coverage, Queue, invalidations, reused evidence, each registered native evidence kind, and applicable Profile dimensions.
 - Require the current K12/15–K12/16 Terminal Proof prerequisite set, including its registered Queue, Corpus Planning, Profile-load, and completion evidence, then require `terminal-proof`; return to those owners rather than maintaining a shorter local substitute.
 - From the verified resulting state, prepare a bounded handoff that states the completed scope and current evidence/result, and separates unresolved, optional, deferred, and external-evidence backlog with re-entry conditions.
 

Card/R10 Maintenance Run Card.md

@@ -11,8 +11,8 @@ source_files:
   - kernel/K12 Quality Assurance/09 Batch-close Closed List.md
   - kernel/K12 Quality Assurance/19 Incremental Audit Planning.md
   - kernel/K13 Task Runtime and Execution Control/12 Completion Gate Bindings.md
-source_hash: '49c87e213166'
-reviewed_source_hash: '49c87e213166'
+source_hash: '6de2beeca17a'
+reviewed_source_hash: '6de2beeca17a'
 reviewed_card_hash: 'a9645f211b03'
 ---
 # R10 Maintenance Run Card

Card/R11 Large-scale Work Admission Card.md

@@ -9,8 +9,8 @@ source_files:
   - kernel/K00 Standards Control/13 Runtime Admission and Recovery.md
   - kernel/K02 Knowledge Work Construction/03 Corpus Planning Applicability and Lifecycle.md
   - kernel/K12 Quality Assurance/19 Incremental Audit Planning.md
-source_hash: '79aa7fa4d3b6'
-reviewed_source_hash: '79aa7fa4d3b6'
+source_hash: '0b03cdc4156a'
+reviewed_source_hash: '0b03cdc4156a'
 reviewed_card_hash: '1aeaaed4ba97'
 ---
 # R11 Large-scale Work Admission Card

Card/R12 Targeted and Specialized Audit Card.md

@@ -12,9 +12,9 @@ source_files:
   - kernel/K12 Quality Assurance/12 Substantive Correctness Review.md
   - kernel/K12 Quality Assurance/18 Cross-page and Control-plane Dimension Map.md
   - kernel/K12 Quality Assurance/19 Incremental Audit Planning.md
-source_hash: '25b021dccaae'
-reviewed_source_hash: '25b021dccaae'
-reviewed_card_hash: '66b82089e307'
+source_hash: 'd43dfc404800'
+reviewed_source_hash: 'd43dfc404800'
+reviewed_card_hash: 'f6abc5510d05'
 ---
 # R12 Targeted and Specialized Audit Card
 
@@ -26,7 +26,7 @@ Audit one declared affected scope or specialized invariant without expanding it
 
 - Confirm the audit object, predicate, dimensions, affected boundary, and evidence eligible for reuse.
 - After R12 and the audit scope are already selected, resolve only the conditional owners implicated by that boundary.
-- Re-run only the due AuditPlan obligations or registered specialized-audit checks for invalidated dimensions and necessary global invariants. Preserve every planned evidence kind; complete only `audit-receipt` obligations into full AuditReceipts.
+- Re-run only the due AuditPlan obligations or registered specialized-audit checks for invalidated dimensions and necessary global invariants. Preserve every planned evidence kind and its exact first-publication acceptance binding.
 - Preserve the audit verdict and current evidence under their canonical owners.
 - For a discovered erroneous judgment, return to K12/07 and use `evidence-invalidation-v1` with the required decision; then resolve the original obligation's permitted continuation.
 

Card/R13 Corpus Planning Card.md

@@ -11,8 +11,8 @@ source_files:
   - kernel/K02 Knowledge Work Construction/05 Global Map Contract.md
   - kernel/K02 Knowledge Work Construction/06 Capability Matrix Contract.md
   - kernel/K02 Knowledge Work Construction/07 Gap Register Contract.md
-source_hash: 'af09637b3c3d'
-reviewed_source_hash: 'af09637b3c3d'
+source_hash: 'b83c98fc9543'
+reviewed_source_hash: 'b83c98fc9543'
 reviewed_card_hash: '4c37bfddf20e'
 ---
 # R13 Corpus Planning Card

Makefile

@@ -82,7 +82,7 @@ test: full
 
 test-selected:
 	@test -n "$(TEST_FILES)" || (echo "TEST_FILES is required" && exit 1)
-	PYTHONDONTWRITEBYTECODE=1 $(PYTHON) .github/scripts/ci_impact.py run-tests --root . --tests "$(TEST_FILES)" $(if $(TEST_REPORT),--report "$(TEST_REPORT)")
+	PYTHONDONTWRITEBYTECODE=1 $(PYTHON) .github/scripts/ci_impact.py run-tests --root . --tests "$(TEST_FILES)" $(if $(TEST_REPORT),--report "$(TEST_REPORT)") $(if $(TEST_DEADLINE),--deadline "$(TEST_DEADLINE)")
 
 fast:
 	PYTHONDONTWRITEBYTECODE=1 $(PYTHON) Tools/run_tests.py fast --root . --python "$(PYTHON)" --jobs "$(TEST_JOBS)"

Read Set/R07 Long-running Execution Read Set.md

@@ -72,7 +72,7 @@ load_edges:
       - kernel/K12 Quality Assurance/09 Batch-close Closed List.md
       - kernel/K12 Quality Assurance/12 Substantive Correctness Review.md
       - kernel/K12 Quality Assurance/14 Batch Review.md
-      - kernel/K12 Quality Assurance/audit-receipt-contract.yaml
+      - kernel/K12 Quality Assurance/audit-fingerprint-contract.yaml
       - kernel/K12 Quality Assurance/substantive-review-contract.yaml
       - kernel/K13 Task Runtime and Execution Control/12 Completion Gate Bindings.md
     read_sets:

Read Set/R08 Audit and Completion Read Set.md

@@ -14,7 +14,7 @@ load_edges:
       - kernel/K12 Quality Assurance/06 Completion Gate and Reporting.md
       - kernel/K12 Quality Assurance/07 Audit Evidence Reuse and Invalidation.md
       - kernel/K12 Quality Assurance/evidence-invalidation-contract.yaml
-      - kernel/K12 Quality Assurance/audit-receipt-contract.yaml
+      - kernel/K12 Quality Assurance/audit-fingerprint-contract.yaml
       - kernel/K12 Quality Assurance/08 Judgment Item Dimension Map.md
       - kernel/K12 Quality Assurance/09 Batch-close Closed List.md
       - kernel/K12 Quality Assurance/15 Terminal Audit and Convergence.md

Read Set/R12 Targeted and Specialized Audit Read Set.md

@@ -17,7 +17,7 @@ load_edges:
       - kernel/K12 Quality Assurance/18 Cross-page and Control-plane Dimension Map.md
       - kernel/K12 Quality Assurance/19 Incremental Audit Planning.md
       - kernel/K12 Quality Assurance/audit-plan-contract.yaml
-      - kernel/K12 Quality Assurance/audit-receipt-contract.yaml
+      - kernel/K12 Quality Assurance/audit-fingerprint-contract.yaml
       - kernel/K12 Quality Assurance/evidence-invalidation-contract.yaml
       - kernel/K12 Quality Assurance/batch-close-closed-list.yaml
       - kernel/K12 Quality Assurance/batch-review-obligation-registry.yaml