ci: wire the DEV-2203 suites — post-deploy smoke, weekly canary, monthly matrix

[danielzytohoc]

Last in the DEV-2203 stack. Stacked on #187 — merge the stack bottom-up (#181 → #182 → #183 → #184/#185 → #186 → #187 → this).

The coverage layers this creates

Layer	Trigger	Containers
PR CI (unchanged)	every PR	0 — deterministic only, now incl. style-panel/version-pin/download/share-UI
Post-deploy @smoke	both deploy workflows, via workflow_call	1 — one render per engine, share fixture, docs example, one Style round-trip
Weekly canary	Mon 05:00 UTC, prod, AI on	~8, strictly serialized
Monthly full matrix	1st, 05:00 UTC	~50, --workers=2, unchanged discipline

e2e-live.yml

• New dispatch inputs: ai (LLM answer checks), pkg_pr_new_ref (one real container at a pkg.pr.new build — DEV-2198 validation days).
• Folds in the three orphaned live specs nothing ever ran: row-striping, preview-recovery's live half, import-live.
• Steps split by what they hold: sandpack/API-read specs run parallel; container suites strictly --workers=1; the authed share step pre-checks E2E_BROKER_TOKEN against the broker and turns rot into a ::warning, not a red run.
• Concurrency: mode-keyed as before, smoke calls keyed by run id, deployed/canary runs never cancellable (cancelled runs strand container sessions — cleanup lives in finally).

Notes

• runner/AGENTS.md CI/CD table updated.
• All four YAML files parse-checked. Before enabling the cron in anger: one manual dispatch against prod with everything on is the real proof — I'd do it right after the stack merges.
• The smoke jobs add ~8–10 min after each deploy; the API deploy's smoke boots exactly the container image that deploy just rebuilt.

---

Note

Medium Risk
Changes deploy concurrency and adds scheduled prod E2E that consume real container pool capacity and LLM budget on the weekly canary; mis-timed crons or cancellation policy regressions could strand Sandboxes or starve live traffic, but no application runtime code changes.

Overview
Adds post-deploy @smoke E2E to both API and authoring deploy workflows via workflow_call to e2e-live.yml against prod — one container render per engine, share fixture, docs example, and one Style round-trip after health/bundle curls.

Authoring deploy turns off cancel-in-progress so mid-smoke cancellation cannot strand live-preview sessions in the global Sandbox pool.

e2e-live.yml expands into the full live layer: weekly Monday 05:00 UTC prod canary (with AI), workflow_call smoke mode, dispatch inputs ai and pkg_pr_new_ref, split steps (parallel Sandpack vs --workers=1 container suites), previously orphaned specs (row-striping, import-live, etc.), broker-token-gated authed share with trace scrubbing, and concurrency keyed by mode/smoke run id.

e2e-starter-matrix.yml adds monthly cron (1st at 03:00 UTC) with prod fallback when schedule has no inputs, staggered from the weekly canary to avoid competing for five global container slots.

runner/AGENTS.md CI/CD table documents the new triggers and deploy smoke behavior.

^{Reviewed by Cursor Bugbot for commit b62ed73. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Stale comment

Agentic security review of the DEV-2203 workflow wiring: one high-severity finding on broker JWT exposure via Playwright artifacts.

  

_{Sent by Cursor Security Agent: Security Reviewer}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

There are 2 total unresolved issues (including 1 from previous review).

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 9e958c1. Configure here.}