ci: adopt tiered contributor validation

.github/workflows/ci.yml

@@ -2,9 +2,12 @@ name: CI
 
 on:
   pull_request:
+  workflow_dispatch:
   push:
     branches:
       - main
+    tags:
+      - "v*"
 
 permissions:
   contents: read
@@ -22,6 +25,7 @@ env:
 jobs:
   package:
     name: Package
+    if: github.event_name == 'workflow_dispatch' || startsWith(github.ref, 'refs/tags/v')
     runs-on: ubuntu-latest
     timeout-minutes: 15
     env:
@@ -221,8 +225,117 @@ jobs:
           scripts/check_supply_chain_policy.py
           scripts/gemma4_12b_recursive_loop.py || true
 
+  pr-core:
+    name: Pull request core
+    if: github.event_name == 'pull_request' || (github.event_name == 'push' && github.ref == 'refs/heads/main')
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    env:
+      CUDA_VISIBLE_DEVICES: ""
+      HF_DATASETS_OFFLINE: "1"
+      HF_HUB_DISABLE_TELEMETRY: "1"
+      HF_HUB_OFFLINE: "1"
+      TOKENIZERS_PARALLELISM: "false"
+      TRANSFORMERS_OFFLINE: "1"
+      TEST_ENV: /tmp/obliteratus-pr-test-env
+
+    steps:
+      - name: Check out exact candidate
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+          ref: ${{ env.CANDIDATE_SHA }}
+
+      - name: Set up Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.12"
+          cache: pip
+          cache-dependency-path: |
+            pyproject.toml
+            uv.lock
+
+      - name: Install locked package and test tools
+        run: |
+          python -m pip install "uv==${UV_VERSION}"
+          UV_PROJECT_ENVIRONMENT="$TEST_ENV" \
+            uv sync --locked --no-default-groups --extra dev --no-editable
+
+      - name: Resolve exact comparison base
+        env:
+          EVENT_BASE: ${{ github.event.pull_request.base.sha || github.event.before }}
+        run: |
+          coverage_base="$EVENT_BASE"
+          if ! git rev-parse --verify "${coverage_base}^{commit}" >/dev/null 2>&1; then
+            coverage_base="$(git rev-parse HEAD^)"
+          fi
+          echo "COVERAGE_BASE=$coverage_base" >> "$GITHUB_ENV"
+
+      - name: Validate lock and test policy
+        run: |
+          uv lock --check
+          "$TEST_ENV/bin/python" scripts/check_quality_policy.py \
+            --policy ci/test-quality-policy.json
+          "$TEST_ENV/bin/python" scripts/check_conditional_policy.py
+          "$TEST_ENV/bin/python" scripts/check_test_risk_map.py
+
+      - name: Select and run core and risk-mapped tests
+        run: |
+          mkdir -p test-results
+          "$TEST_ENV/bin/python" scripts/select_pr_tests.py \
+            --base-ref "$COVERAGE_BASE" > test-results/selected-tests.txt
+          mapfile -t selected_tests < test-results/selected-tests.txt
+          if [ "${#selected_tests[@]}" -eq 0 ]; then
+            echo "PR test selector returned no tests"
+            exit 1
+          fi
+          printf '%s\n' "${selected_tests[@]}"
+          "$TEST_ENV/bin/python" -m pytest \
+            "${selected_tests[@]}" \
+            -m "not slow and not gpu and not mps and not mlx and not network and not download and not remote and not operator_ui" \
+            --cov=app \
+            --cov-branch \
+            --cov-fail-under=0 \
+            --junitxml=test-results/junit-pr-core.xml \
+            --cov-report=xml:test-results/coverage-pr-core.xml \
+            --cov-report=json:test-results/coverage-pr-core.json
+
+      - name: Enforce pull-request changed-line floor
+        run: |
+          "$TEST_ENV/bin/python" scripts/check_coverage_thresholds.py \
+            test-results/coverage-pr-core.json \
+            --min-line 0 \
+            --min-branch 0 \
+            --min-changed 50 \
+            --base-ref "$COVERAGE_BASE"
+
+      - name: Smoke import and CLI
+        run: |
+          "$TEST_ENV/bin/python" -c 'import obliteratus; print(obliteratus.__version__)'
+          "$TEST_ENV/bin/python" -m obliteratus --help
+
+      - name: Build distributions when package inputs change
+        run: |
+          if git diff --quiet "$COVERAGE_BASE" HEAD -- \
+            pyproject.toml uv.lock MANIFEST.in app.py \
+            obliteratus/__init__.py obliteratus/__main__.py; then
+            echo "package inputs unchanged; release build deferred"
+          else
+            "$TEST_ENV/bin/python" -m build --sdist --wheel
+          fi
+
+      - name: Upload pull-request evidence
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: pr-core-evidence-py3.12
+          path: test-results/
+          if-no-files-found: error
+          retention-days: 30
+
   test:
     name: Tests py${{ matrix.python-version }}
+    if: github.event_name == 'workflow_dispatch' || startsWith(github.ref, 'refs/tags/v')
     runs-on: ubuntu-latest
     timeout-minutes: 10
     strategy:
@@ -247,6 +360,16 @@ jobs:
         with:
           fetch-depth: 0
 
+      - name: Resolve exact release comparison base
+        env:
+          EVENT_BASE: ${{ github.event.before }}
+        run: |
+          coverage_base="$EVENT_BASE"
+          if ! git rev-parse --verify "${coverage_base}^{commit}" >/dev/null 2>&1; then
+            coverage_base="$(git rev-parse HEAD^)"
+          fi
+          echo "COVERAGE_BASE=$coverage_base" >> "$GITHUB_ENV"
+
       - name: Set up Python
         uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
@@ -291,7 +414,6 @@ jobs:
         env:
           BASE_TEST_ENV: /tmp/obliteratus-base-test-env
           BASE_WORKTREE: /tmp/obliteratus-base-worktree
-          COVERAGE_BASE: ${{ github.event.pull_request.base.sha || github.event.before }}
         run: |
           git rev-parse --verify "${COVERAGE_BASE}^{commit}"
           git worktree add --detach "$BASE_WORKTREE" "$COVERAGE_BASE"
@@ -308,8 +430,6 @@ jobs:
           ) | tee test-results/base-tests-py3.12.log
 
       - name: Enforce line and branch coverage floors
-        env:
-          COVERAGE_BASE: ${{ github.event.pull_request.base.sha || github.event.before }}
         run: |
           module_args=()
           if [ "${{ matrix.python-version }}" = "3.12" ]; then
@@ -334,7 +454,7 @@ jobs:
             --min-file obliteratus/reporting/report.py=70 \
             --min-file obliteratus/community.py=70 \
             --min-file obliteratus/telemetry.py=70 \
-            --min-changed 95 \
+            --min-changed 50 \
             --base-ref "$COVERAGE_BASE" \
             "${module_args[@]}"
 
@@ -348,8 +468,6 @@ jobs:
 
       - name: Write normalized test trend evidence
         if: always()
-        env:
-          COVERAGE_BASE: ${{ github.event.pull_request.base.sha || github.event.before }}
         run: |
           base_args=()
           if [ -f test-results/base-coverage-py3.12.json ]; then
@@ -381,6 +499,7 @@ jobs:
 
   checkpoint-windows:
     name: Checkpoint contracts (Windows)
+    if: github.event_name == 'workflow_dispatch' || startsWith(github.ref, 'refs/tags/v')
     runs-on: windows-latest
     timeout-minutes: 15
     env:
@@ -436,6 +555,7 @@ jobs:
 
   quality-depth:
     name: Quality depth
+    if: github.event_name == 'workflow_dispatch' || startsWith(github.ref, 'refs/tags/v')
     runs-on: ubuntu-latest
     timeout-minutes: 45
     env:
@@ -450,6 +570,18 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+
+      - name: Resolve exact release comparison base
+        env:
+          EVENT_BASE: ${{ github.event.before }}
+        run: |
+          coverage_base="$EVENT_BASE"
+          if ! git rev-parse --verify "${coverage_base}^{commit}" >/dev/null 2>&1; then
+            coverage_base="$(git rev-parse HEAD^)"
+          fi
+          echo "COVERAGE_BASE=$coverage_base" >> "$GITHUB_ENV"
 
       - name: Set up Python
         uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
@@ -502,8 +634,6 @@ jobs:
 
       - name: Write normalized quality trend evidence
         if: always()
-        env:
-          COVERAGE_BASE: ${{ github.event.pull_request.base.sha || github.event.before }}
         run: |
           evidence_args=()
           if [ -f quality-evidence/repeat-gate.json ]; then
@@ -536,6 +666,7 @@ jobs:
 
   supply-chain:
     name: Supply chain
+    if: github.event_name == 'workflow_dispatch' || startsWith(github.ref, 'refs/tags/v')
     runs-on: ubuntu-latest
     timeout-minutes: 30
     env: