ci: run Playwright smoke with two workers

.github/workflows/ci.yaml

@@ -82,6 +82,29 @@ jobs:
           if-no-files-found: ignore
           retention-days: 14
 
+  browser-smoke:
+    name: browser-smoke
+    runs-on: ubuntu-latest
+    container: mcr.microsoft.com/playwright:v1.61.1-noble
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: "24"
+          cache: npm
+      - run: npm ci
+      - run: npm run test:e2e
+      - name: Upload smoke artifacts
+        if: failure()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: browser-smoke-artifacts
+          path: |
+            test-results
+            playwright-report
+          if-no-files-found: ignore
+          retention-days: 14
+
   governance:
     # Repo-owned gates: godfile ratchet, changed-file maintainability,
     # Terraform fmt/validate, import-plan guard, HCP run guard, CloudFront
@@ -150,7 +173,7 @@ jobs:
   ci-complete:
     name: ci-complete
     if: always()
-    needs: [static, build, unit, visual, governance]
+    needs: [static, build, unit, visual, browser-smoke, governance]
     runs-on: ubuntu-latest
     steps:
       - name: All required jobs passed

AGENTS.md

@@ -31,8 +31,8 @@ build (`tsc -b && vite build`), unit tests (`vitest run`), and the governance
 checks (`npm run governance`), including G13 app/Terraform isolation. **Do not
 claim a task is done until `npm run verify` is green locally.** CI runs the same
 gates as parallel jobs in [`.github/workflows/ci.yaml`](.github/workflows/ci.yaml)
-(`static`, `build`, `unit`, `visual`, `governance`) with `ci-complete` failing if
-any of those jobs did not succeed.
+(`static`, `build`, `unit`, `visual`, `browser-smoke`, `governance`) with
+`ci-complete` failing if any of those jobs did not succeed.
 
 ## Non-negotiable rules (enforced; do not work around)
 

QUALITY_GATES.md

@@ -63,9 +63,10 @@ isolation). A task is not done until this is green.
 - **CI ([`.github/workflows/ci.yaml`](.github/workflows/ci.yaml)):** this
   repository owns every job. `static` (`format:check` + `lint`), `build`
   (`tsc -b && vite build`), `unit` (`vitest run` in four shards), `visual`
-  (Playwright visual), and `governance` (`npm run governance`, with Terraform
-  1.16.0) run in parallel. `ci-complete` fails unless all of those jobs
-  succeeded and is the required merge-queue check. Live G13 runs on
+  (Playwright visual), `browser-smoke` (`npm run test:e2e`), and `governance`
+  (`npm run governance`, with Terraform 1.16.0) run in parallel. `ci-complete`
+  fails unless all of those jobs succeeded and is the required merge-queue
+  check. Live G13 runs on
   `pull_request` (merge-base range), `merge_group` (each queued PR as a
   first-parent commit), and locally. It skips `push`. A Terraform-only PR
   stacked with an app-only PR still passes; a mixed change set still fails.

README.md

@@ -150,7 +150,8 @@ No stored AWS keys — OIDC only. Infrastructure and content deploy separately:
 
 - **CI** ([`.github/workflows/ci.yaml`](.github/workflows/ci.yaml)) — on push
   and PRs to `main`, runs format, lint, build, sharded unit tests, visual
-  regression, and `npm run governance` as parallel jobs, then `ci-complete`.
+  regression, Playwright smoke, and `npm run governance` as parallel jobs, then
+  `ci-complete`.
   Conventions and gates are documented under
   [`AGENTS.md`](AGENTS.md), [`QUALITY_GATES.md`](QUALITY_GATES.md),
   [`ARCHITECTURE_AND_CODE_QUALITY.md`](ARCHITECTURE_AND_CODE_QUALITY.md), and

playwright.config.ts

@@ -6,7 +6,7 @@ export default defineConfig({
   fullyParallel: true,
   forbidOnly: Boolean(process.env.CI),
   retries: process.env.CI ? 2 : 0,
-  workers: process.env.CI ? 1 : undefined,
+  workers: process.env.CI ? 2 : undefined,
   reporter: process.env.CI ? "github" : "list",
   use: {
     // Port 4173 isolates Playwright from the app's normal port 3000 server.

playwright.visual.config.ts

@@ -6,7 +6,7 @@ export default defineConfig({
   fullyParallel: false,
   forbidOnly: true,
   retries: 0,
-  workers: 1,
+  workers: 2,
   reporter: [["list"], ["html", { outputFolder: "playwright-report-visual", open: "never" }]],
   outputDir: "test-results/visual",
   snapshotPathTemplate: "{testDir}/__screenshots__/{testFilePath}/{arg}{ext}",