ci(actions): reduce pull request runner contention

.github/workflows/fuzz.yml

@@ -22,8 +22,8 @@ permissions:
   contents: read
 
 concurrency:
-  group: fuzz-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
+  group: ${{ github.workflow }}-${{ github.repository }}-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
   fuzz:

.github/workflows/pages.yml

@@ -12,8 +12,8 @@ permissions:
   id-token: write
 
 concurrency:
-  group: pages
-  cancel-in-progress: true
+  group: ${{ github.workflow }}-${{ github.repository }}
+  cancel-in-progress: false
 
 jobs:
   deploy:

.github/workflows/server-tests.yml

@@ -14,8 +14,8 @@ permissions:
   contents: read
 
 concurrency:
-  group: server-tests-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
+  group: ${{ github.workflow }}-${{ github.repository }}-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
   unit-and-api:

ARCHITECTURE.md

@@ -17,12 +17,12 @@
 
 - `.github/workflows/pages.yml`: GitHub Pages deployment workflow for the
   static app.
-- OpenCode Review, Strix Security Scan, and PR Review Merge Scheduler:
-  organization-level required workflows from `ContextualWisdomLab/.github`.
-- `.github/workflows/dependency-review.yml`: authoritative manifest-diff
-  review workflow for repository dependency changes.
-- `.github/workflows/osvscanner.yml`: authoritative OSV/SARIF workflow
-  for dependency scanning.
+- `.github/workflows/server-tests.yml` and `.github/workflows/fuzz.yml`:
+  repository-owned product/runtime validation.
+- OpenCode Review, Strix Security Scan, PR Review Merge Scheduler, CodeQL,
+  Dependency Review, OSV, and the broader Security Scan are organization-level
+  required workflows owned by `ContextualWisdomLab/.github`; ScopeWeave does not
+  carry repository-local copies of those central lanes.
 - `tests/e2e/scopeweave.spec.js`: Playwright coverage for the user-facing
   app flows.
 - `tests/config/`: repository governance and workflow ownership checks.
@@ -44,4 +44,4 @@
   deployment ownership or blocking on absent IaC that this repo does not
   contain.
 - Kubernetes/IaC security coverage remains a follow-up design lane for
-  any future `infra/` or container packaging surface.
+  any future `infra/` or container packaging surface.

CLAUDE.md

@@ -105,11 +105,12 @@ deploy guide is `docs/deploy.md`.
 
 - **Default branch is `develop`.** SaaS work lands as a stacked PR train — see
   "Merge order" in `README.md` before retargeting or merging PRs.
-- Repo-local PR gates: `server-tests.yml` (unit + API + eval-safe check + cloud e2e),
-  `fuzz.yml`, `codeql.yml`, `dependency-review.yml`.
-- OpenCode Review, Strix Security Scan, and PR Review Merge Scheduler are
-  organization-level required workflows from `ContextualWisdomLab/.github` — never
-  copy them into this repository (`tests/config` pytest enforces this).
+- Repo-local PR gates are `server-tests.yml` (unit + API + eval-safe check + cloud e2e)
+  and `fuzz.yml`; Pages remains the repository-owned deployment workflow.
+- OpenCode Review, Strix Security Scan, PR Review Merge Scheduler, CodeQL,
+  Dependency Review, OSV, and the broader Security Scan are organization-level
+  required workflows owned by `ContextualWisdomLab/.github` — never copy them into
+  this repository (`tests/config` pytest enforces this ownership boundary).
 - A failing `trivy-fs` is a real finding, not a flake — follow the remediation
   protocol in `AGENTS.md`.
 
@@ -125,4 +126,4 @@ deploy guide is `docs/deploy.md`.
   security (`sentinel.md`: `Object.create(null)` for untrusted-key maps,
   `crypto.randomUUID()`, CSP). Follow them when touching related code.
 - `.agents/skills/github-robot-review-gate/SKILL.md` covers diagnosing PR merge-gate
-  blockers (CodeRabbit robot-review policy, required checks, rulesets).
+  blockers (CodeRabbit robot-review policy, required checks, rulesets).

README.md

@@ -50,7 +50,7 @@ two modes:
   project duplicate (templates), rate limiting (opt-in), metrics
   (JSON + Prometheus), structured logs
 - **Docs**: complete API reference at [`docs/api.md`](docs/api.md) (served at
-  `/docs/api.md`); deploy guide at [`docs/deploy.md`](docs/deploy.md)
+  `/docs/api.md`); deploy guide is [`docs/deploy.md`](docs/deploy.md)
 
 ## Architecture
 
@@ -168,9 +168,10 @@ the previous; merging in order auto-retargets the next):
 - Runtime dependencies are minimized (`hono`, `@hono/node-server` only, added
   by the SaaS stack); CI/dev-only automation under `.github/`, `scripts/`,
   `tests/`, and `docs/` is allowed.
-- OpenCode Review, Strix Security Scan, and PR Review Merge Scheduler are
-  inherited from the organization-level required workflows in
-  `ContextualWisdomLab/.github`, not copied into this repository.
+- OpenCode Review, Strix Security Scan, PR Review Merge Scheduler, CodeQL,
+  Dependency Review, OSV, and the broader Security Scan are inherited from the
+  organization-level required workflows in `ContextualWisdomLab/.github`, not
+  copied into this repository.
 
 ## Persistence model
 
@@ -187,12 +188,12 @@ the previous; merging in order auto-retargets the next):
 
 ## Security workflow
 
-- Organization required workflows provide OpenCode Review, Strix Security
-  Scan, PR Review Merge Scheduler, failed-check explanation, and coverage
+- Organization-required workflows from `ContextualWisdomLab/.github` own OpenCode
+  Review, Strix Security Scan, PR Review Merge Scheduler, CodeQL, Dependency
+  Review, OSV, the broader Security Scan, failed-check explanation, and coverage
   evidence.
-- Repository-local workflows remain for ScopeWeave-specific static delivery
-  and companion SCA lanes, including dependency review, OSV, Trivy,
-  Scorecard, and Pages.
+- Repository-local workflows remain for ScopeWeave-specific server/runtime tests,
+  fuzzing, and Pages delivery; they do not duplicate the central SCA lanes.
 - Server hardening: pinned-HS256 JWT (no header-alg trust), scrypt passwords,
   hash-only PAT/webhook-secret storage (secrets shown once), server-side RBAC,
   secrets never logged.

tests/config/test_strix_static_repo_adaptations.py

@@ -4,14 +4,16 @@
 from pathlib import Path
 
 REPO_ROOT = Path(__file__).resolve().parents[2]
-DEPENDENCY_REVIEW_WORKFLOW = REPO_ROOT / ".github" / "workflows" / "dependency-review.yml"
-OSV_WORKFLOW = REPO_ROOT / ".github" / "workflows" / "osvscanner.yml"
+WORKFLOW_DIR = REPO_ROOT / ".github" / "workflows"
 K8S_DEPLOYMENT = REPO_ROOT / "infra" / "k8s" / "deployment.yaml"
 K8S_SERVICE = REPO_ROOT / "infra" / "k8s" / "service.yaml"
 
 
 def test_central_review_workflows_are_not_copied_into_this_repository() -> None:
     central_only_paths = [
+        WORKFLOW_DIR / "dependency-review.yml",
+        WORKFLOW_DIR / "codeql.yml",
+        WORKFLOW_DIR / "osvscanner.yml",
         REPO_ROOT / ".github" / "workflows" / "opencode-review.yml",
         REPO_ROOT / ".github" / "workflows" / "pr-review-merge-scheduler.yml",
         REPO_ROOT / ".github" / "workflows" / "strix-selftest.yml",
@@ -34,6 +36,30 @@ def test_central_review_workflows_are_not_copied_into_this_repository() -> None:
         assert not central_only_path.exists(), central_only_path
 
 
+def test_ci_documentation_matches_central_sca_ownership() -> None:
+    documentation_paths = (
+        REPO_ROOT / "ARCHITECTURE.md",
+        REPO_ROOT / "CLAUDE.md",
+        REPO_ROOT / "README.md",
+    )
+
+    for documentation_path in documentation_paths:
+        source = documentation_path.read_text(encoding="utf-8")
+        assert "dependency-review.yml" not in source, documentation_path
+        assert "osvscanner.yml" not in source, documentation_path
+        assert "codeql.yml" not in source, documentation_path
+
+    architecture = (REPO_ROOT / "ARCHITECTURE.md").read_text(encoding="utf-8")
+    claude = (REPO_ROOT / "CLAUDE.md").read_text(encoding="utf-8")
+    readme = (REPO_ROOT / "README.md").read_text(encoding="utf-8")
+
+    for source in (architecture, claude, readme):
+        assert "CodeQL" in source
+        assert "Dependency Review" in source
+        assert "OSV" in source
+        assert "ContextualWisdomLab/.github" in source
+
+
 def test_kubernetes_deployment_uses_non_root_versioned_runtime() -> None:
     deployment_source = K8S_DEPLOYMENT.read_text(encoding="utf-8")
     service_source = K8S_SERVICE.read_text(encoding="utf-8")
@@ -56,11 +82,18 @@ def test_kubernetes_deployment_uses_non_root_versioned_runtime() -> None:
     assert 'targetPort: 8080' in service_source
 
 
-def test_companion_workflows_cover_named_requirements_manifests_and_full_history() -> None:
-    dependency_review_source = DEPENDENCY_REVIEW_WORKFLOW.read_text(encoding="utf-8")
-    osv_source = OSV_WORKFLOW.read_text(encoding="utf-8")
+def test_workflow_concurrency_is_trigger_aware() -> None:
+    pull_request_workflows = ("fuzz.yml", "server-tests.yml")
+    expected_group = (
+        "${{ github.workflow }}-${{ github.repository }}-"
+        "${{ github.event.pull_request.number || github.run_id }}"
+    )
+
+    for workflow_name in pull_request_workflows:
+        source = (WORKFLOW_DIR / workflow_name).read_text(encoding="utf-8")
+        assert f"group: {expected_group}" in source
+        assert "cancel-in-progress: ${{ github.event_name == 'pull_request' }}" in source
 
-    assert "actions/dependency-review-action@" in dependency_review_source
-    assert 'requirements(-[A-Za-z0-9._-]+)?\\.txt' in osv_source
-    assert "google/osv-scanner-action" in osv_source
-    assert "-r" in osv_source
+    deploy_source = (WORKFLOW_DIR / "pages.yml").read_text(encoding="utf-8")
+    assert "group: ${{ github.workflow }}-${{ github.repository }}" in deploy_source
+    assert "cancel-in-progress: false" in deploy_source