CI Coverage — test → job mapping

Reading guide

The CI table shows which tests are executed by which job, not a blanket assertion that every runtime and provider was verified.

Read the ‘manual / gate-only’ section before citing security, real PG, or staged deployment coverage.

Workflow: .github/workflows/yetdapay.yml — triggers pull_request (paths: nougat-devpay/**, .github/workflows/yetdapay.yml) + workflow_dispatch. All jobs run on ubuntu-latest, Node 22.

This is the PR verification surface for the productization work (R4 §8.5). Every job below is a hard gate — no || true, no continue-on-error.

Product-plane jobs (p5)

Job	Step	Command	What it proves
product-suites	license-crypto	cargo test in be-cloudflare/license-crypto	JWS/PoP sign/verify, alg-confusion + wrong-issuer/key rejection (43 tests)
product-suites	Durable authority E2E	bash tests/run-durable.sh in be-cloudflare	worker-build → local D1 migrations 001–017 + seeds/demo.sql + tests/fixtures.sql → wrangler dev --local → durable.test.mjs (55 assertions: PAY idempotency/webhook dedup, INBOX conflict, LIC expiry/revocation/cross-tenant 404/401, USE counters, REC findings+autofix, OUTBOX redrive) on real miniflare sqlite, not mocks
product-suites	yp e2e	node --test tools/devpay-cli/tests/e2e.test.mjs	init/plan/apply/review/verify/doctor lifecycle + regression legs (vacuous-verify, auth pinning, TOCTOU bind, env scrub, traversal)
product-suites	auto-protection suites	node <suite>/tests/run.mjs ×8 in experiments/auto-protection (WABT_BIN=/usr/bin, apt wabt installed)	spec, planner, analyzer (static/dynamic/classify/determinism/bigint/wasm/protection — wasm legs need wasm-objdump -x/-d from wabt), partitioner (transform/hardening/sandbox-globals/select/equivalence), track-a, track-b, evidence (record/validate), metrics (reproducibility/traceability) — node:test, loopback-only servers
security-regression	artifact validation	node red-team/tests/run.mjs in experiments/auto-protection	Committed r18 47-leg battery artifacts: schema, result enum, on-disk evidence per executed claim, matrix↔results agreement, real sha256 on REA calls (13 checks)
security-regression	p4 battery (conditional)	be-cloudflare/tests/red-team/run.sh else run.mjs	Not landed yet — step is if:-gated on file existence; when absent it is skipped (not passed) and a ::notice:: annotates the run. When p4 merges it executes with worker-build + wrangler v4 preinstalled; prefers run.sh so the battery can orchestrate its own wrangler dev harness

Pre-existing jobs (unchanged)

Job	Covers
cf-worker-build	cargo build --release --target wasm32-unknown-unknown (be-cloudflare)
proto-check	buf lint + buf breaking vs PR base (contracts/) — reads buf.yaml only; contracts/buf.gen.yaml is intentionally unused dead config (no buf generate step; BE types come from be/build.rs protox+prost-build)
be-test	cargo test (axum be/: unit/integration/security/outbox/migration)
fe-check	pnpm vue-tsc --noEmit
e2e	Playwright against real be binary, dev auth, temp sqlite — needs be-test + fe-check
docker-smoke	compose build/up, FE proxy → BE health, prod-auth fail-closed 401 — needs be-test + fe-check

Still gate-only (not in CI)

Item	Why	Where it runs
REA MCP heavyweight legs (reajail-*, live binary/session probes)	Require the REA MCP toolchain + interactive agent runtime; CI validates their recorded artifacts only (security-regression step)	Manual agent gate — see experiments/auto-protection/results/rea-mcp/
red-team/unified-attacks.mjs live re-execution (47 legs)	Spawns partition servers + browser legs locally; ~minutes, research-surface scope. Artifact validation is in CI; re-execution is a release-gate decision	Manual: node unified-attacks.mjs then node red-team/tests/run.mjs
Production/staging deploy (wrangler deploy, Pages deploy, D1 remote)	Charter §0: staging-first, production requires explicit user authorization	Manual via deploy scripts only
Remote D1 migrations / seed / reset	Same authorization gate	Manual

Notes for CI maintainers

• run-durable.sh calls npx wrangler; the job installs [email protected] globally (exact pin = locally verified version) so npx resolves it from PATH. worker-build is pinned 0.8.7 to track worker = "0.8" in be-cloudflare/Cargo.toml — bump together.
• Workflow is permissions: contents: read — every job is build/test only; no step needs contents:write/packages/id-token. Deploys stay manual.
• Third-party actions remain tag-pinned (@v4, @stable) — accepted LOW risk; full-SHA pinning + Dependabot updates is a future hardening item (noted inline at the top of the workflow).
• run-durable.sh writes .dev.vars (git-ignored, test-only dummy keys — TOSS_* uses test_ prefixes, TOSS_API_BASE points at a loopback stub).
• wrangler dev --local + miniflare local D1 works on GH ubuntu runners (verified equivalent locally: 55/55 PASS, wrangler 4.156.0, node 22).
• wabt is a test dependency of the analyzer wasm legs: the job apt-get install -y wabt (Ubuntu universe → 1.0.34) and exports WABT_BIN=/usr/bin to the auto-protection step. Only wasm-objdump -x/-d is used, so the distro version suffices — verified locally against the extracted noble .deb (analyzer 61/61 PASS). analyzer/lib/wasm.mjs resolution order: wabtBin option → WABT_BIN env → PATH; with no wabt it degrades honestly to binary-fallback (callGraph null, requiresWabt), and the wabt-path assertions then fail — the tool is a hard dep in CI.
• No /home/... machine-local paths remain in executable sources under experiments/auto-protection (analyzer/lib/wasm.mjs, red-team/*.mjs, exp*/build.mjs now resolve via WABT_BIN/REA_BIN/CHROME_EXE/ PLAYWRIGHT_NODE_MODULES env → PATH). Absolute paths inside results/** / evidence/** JSON are recorded historical evidence — test inputs, not executed paths — and are intentionally not rewritten.
• The p4 red-team battery landing must keep tests/red-team/run.{mjs,sh} self-contained (orchestrate its own dev server like run-durable.sh) or the security-regression step needs revisiting.