perf(ci): parallelize repo audits, guard env-dependent tests, and fix the docs generator

.agents/skills/ship/SKILL.md

@@ -65,21 +65,10 @@ When the user runs `/ship`:
     echo "❌ block registry audit failed — do not ship"
     exit 1
   }
-  rm -f /tmp/ship-audit-results
-  for s in check:boundaries check:api-validation:strict check:desktop-bridge check:desktop-ipc \
-           check:utils check:zustand-v5 \
-           check:react-query check:client-boundary check:bare-icons check:icon-paths \
-           check:realtime-prune check:tool-registry-boundary check:tool-request-boundary \
-           tool-metadata:check \
-           integration-catalog:check skills:check agent-stream-docs:check; do
-    ( bun run "$s" >"/tmp/ship-audit-${s//:/-}.log" 2>&1; echo "$? $s" >>/tmp/ship-audit-results ) &
-  done
-  wait
-  # any non-zero line is a failing audit — read its /tmp/ship-audit-<name>.log and fix before shipping.
-  # `exit 1` on failure preserves the original sequential checks' semantics (their non-zero exit is
-  # what an agent gates on); never use `grep … && echo ❌ || echo ✅` here — it always exits 0.
-  if grep -vE '^0 ' /tmp/ship-audit-results; then echo "❌ audit(s) failed — do not ship"; exit 1; fi
-  echo "✅ all audits passed"
+  # Runs every audit CI runs, concurrently, and replays the output of any that fail.
+  # Do not hand-list the audits here: the list is derived in scripts/run-audits.ts, and the
+  # copy that used to live in this file had already drifted five audits behind package.json.
+  bun run check:audits || { echo "❌ audit(s) failed — do not ship"; exit 1; }
   ```
   If Phase A regenerated a file, its matching `:check` in Phase B now passes trivially — that parity is the point. Do not ship with any generator or audit failing; fix the cause (never silence it) and re-run. `check:migrations` and `type-check` are covered by steps 5 and CI respectively and are not repeated here.
 7. **Stage and commit** the changes with the generated message — including any files Phase A regenerated in step 6

.claude/commands/ship.md

@@ -64,21 +64,10 @@ When the user runs `/ship`:
     echo "❌ block registry audit failed — do not ship"
     exit 1
   }
-  rm -f /tmp/ship-audit-results
-  for s in check:boundaries check:api-validation:strict check:desktop-bridge check:desktop-ipc \
-           check:utils check:zustand-v5 \
-           check:react-query check:client-boundary check:bare-icons check:icon-paths \
-           check:realtime-prune check:tool-registry-boundary check:tool-request-boundary \
-           tool-metadata:check \
-           integration-catalog:check skills:check agent-stream-docs:check; do
-    ( bun run "$s" >"/tmp/ship-audit-${s//:/-}.log" 2>&1; echo "$? $s" >>/tmp/ship-audit-results ) &
-  done
-  wait
-  # any non-zero line is a failing audit — read its /tmp/ship-audit-<name>.log and fix before shipping.
-  # `exit 1` on failure preserves the original sequential checks' semantics (their non-zero exit is
-  # what an agent gates on); never use `grep … && echo ❌ || echo ✅` here — it always exits 0.
-  if grep -vE '^0 ' /tmp/ship-audit-results; then echo "❌ audit(s) failed — do not ship"; exit 1; fi
-  echo "✅ all audits passed"
+  # Runs every audit CI runs, concurrently, and replays the output of any that fail.
+  # Do not hand-list the audits here: the list is derived in scripts/run-audits.ts, and the
+  # copy that used to live in this file had already drifted five audits behind package.json.
+  bun run check:audits || { echo "❌ audit(s) failed — do not ship"; exit 1; }
   ```
   If Phase A regenerated a file, its matching `:check` in Phase B now passes trivially — that parity is the point. Do not ship with any generator or audit failing; fix the cause (never silence it) and re-run. `check:migrations` and `type-check` are covered by steps 5 and CI respectively and are not repeated here.
 7. **Stage and commit** the changes with the generated message — including any files Phase A regenerated in step 6

.cursor/commands/ship.md

@@ -59,21 +59,10 @@ When the user runs `/ship`:
     echo "❌ block registry audit failed — do not ship"
     exit 1
   }
-  rm -f /tmp/ship-audit-results
-  for s in check:boundaries check:api-validation:strict check:desktop-bridge check:desktop-ipc \
-           check:utils check:zustand-v5 \
-           check:react-query check:client-boundary check:bare-icons check:icon-paths \
-           check:realtime-prune check:tool-registry-boundary check:tool-request-boundary \
-           tool-metadata:check \
-           integration-catalog:check skills:check agent-stream-docs:check; do
-    ( bun run "$s" >"/tmp/ship-audit-${s//:/-}.log" 2>&1; echo "$? $s" >>/tmp/ship-audit-results ) &
-  done
-  wait
-  # any non-zero line is a failing audit — read its /tmp/ship-audit-<name>.log and fix before shipping.
-  # `exit 1` on failure preserves the original sequential checks' semantics (their non-zero exit is
-  # what an agent gates on); never use `grep … && echo ❌ || echo ✅` here — it always exits 0.
-  if grep -vE '^0 ' /tmp/ship-audit-results; then echo "❌ audit(s) failed — do not ship"; exit 1; fi
-  echo "✅ all audits passed"
+  # Runs every audit CI runs, concurrently, and replays the output of any that fail.
+  # Do not hand-list the audits here: the list is derived in scripts/run-audits.ts, and the
+  # copy that used to live in this file had already drifted five audits behind package.json.
+  bun run check:audits || { echo "❌ audit(s) failed — do not ship"; exit 1; }
   ```
   If Phase A regenerated a file, its matching `:check` in Phase B now passes trivially — that parity is the point. Do not ship with any generator or audit failing; fix the cause (never silence it) and re-run. `check:migrations` and `type-check` are covered by steps 5 and CI respectively and are not repeated here.
 7. **Stage and commit** the changes with the generated message — including any files Phase A regenerated in step 6

.github/workflows/test-build.yml

@@ -117,70 +117,11 @@ jobs:
       - name: Lint code
         run: bun run lint:check
 
-      - name: Enforce monorepo boundaries
-        run: bun run check:boundaries
-
-      - name: API contract boundary audit
-        run: bun run check:api-validation:strict
-
-      - name: Desktop bridge contract audit
-        run: bun run check:desktop-bridge
-
-      # Complements the bridge audit above, which compares against a snapshot
-      # this same PR is allowed to regenerate. This one derives every fact from
-      # the source both sides execute, so it has no such blind spot.
-      - name: Desktop IPC contract audit
-        run: bun run check:desktop-ipc
-
-      - name: Shared utils enforcement audit
-        run: bun run check:utils
-
-      - name: Zustand v5 selector audit
-        run: bun run check:zustand-v5
-
-      - name: React Query pattern audit
-        run: bun run check:react-query
-
-      - name: Client boundary import audit
-        run: bun run check:client-boundary
-
-      - name: Bare-icon theme-safety audit
-        run: bun run check:bare-icons
-
-      - name: Icon SVG path validity audit
-        run: bun run check:icon-paths
-
-      - name: Verify realtime prune graph
-        run: bun run check:realtime-prune
-
-      - name: Tool registry client-boundary audit
-        run: bun run check:tool-registry-boundary
-
-      - name: Tool request transport boundary audit
-        run: bun run check:tool-request-boundary
-
-      - name: Trigger/block initialization cycle audit
-        run: bun run check:trigger-block-cycle
-
-      # This job builds with webpack; devs run Turbopack. A specifier only webpack
-      # resolves passes here and breaks every dev server.
-      - name: Import specifier hygiene audit
-        run: bun run check:import-specifiers
-
-      - name: SQL Date binding audit
-        run: bun run check:sql-date-binding
-
-      - name: Verify generated tool metadata is in sync
-        run: bun run tool-metadata:check
-
-      - name: Verify integration deployment metadata is in sync
-        run: bun run integration-catalog:check
-
-      - name: Verify skill projections are in sync
-        run: bun run skills:check
-
-      - name: Verify agent stream capability docs are in sync
-        run: bun run agent-stream-docs:check
+      # Every zero-argument `check:*` script, run concurrently. The list is derived in
+      # scripts/run-audits.ts, which also writes the per-audit timing table to the job
+      # summary and annotates failures. Audits needing a base ref stay separate below.
+      - name: Repo audits
+        run: bun run check:audits
 
       - name: Migration safety (zero-downtime) audit
         run: |
@@ -192,12 +133,6 @@ jobs:
           fi
           bun run check:migrations "$BASE_REF"
 
-      # Runs before the type-check itself: if a bare `tsc` has fallen back to the
-      # JavaScript TypeScript 6 compiler that `@typescript/typescript6` drags in
-      # transitively, the type-check below still passes — it just takes ~10x longer.
-      - name: Native type-check audit
-        run: bun run check:native-typecheck
-
       # Every workspace, not just realtime. packages/emcn, packages/utils,
       # apps/desktop and apps/docs had no type check in CI at all; apps/sim's
       # source was covered only as a side effect of `next build` in the separate
@@ -236,21 +171,6 @@ jobs:
           fi
           echo "✅ Schema and migrations are in sync"
 
-      # DEAD PATH: nothing generates `apps/sim/coverage`. The test step runs
-      # `vitest run` without `--coverage`, and vitest.config.ts declares no
-      # coverage provider, so this uploads nothing and still reports success in
-      # ~1s (`fail_ci_if_error: false` hides it). `@vitest/coverage-v8` IS
-      # installed, so wiring it up is possible — but coverage instrumentation
-      # costs test time and nothing gates on the result today. Left in place
-      # pending a decision to either enable coverage or drop this step; do not
-      # read its green tick as "coverage was published".
-      - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v5
-        with:
-          directory: ./apps/sim/coverage
-          fail_ci_if_error: false
-          verbose: true
-
   # Next.js production build, in parallel with lint + tests. Sticky disks are
   # cloned from the last committed snapshot per job and committed last-writer-
   # wins, so concurrent mounts are safe. The bun/node_modules disks are shared

apps/docs/content/docs/en/integrations/a2a.mdx

@@ -28,7 +28,7 @@ Use the A2A (Agent-to-Agent) protocol to call external AI agents over the latest
 
 ## Tools
 
-### `a2a_send_message`
+### A2A Send Message
 
 Send a message to an external A2A agent and return its response.
 
@@ -54,7 +54,7 @@ Send a message to an external A2A agent and return its response.
 | `state` | string | Task lifecycle state: `submitted`, `working`, `input-required`, `auth-required`, `completed`, `failed`, `canceled`, or `rejected` |
 | `artifacts` | array | Structured task output artifacts |
 
-### `a2a_get_task`
+### A2A Get Task
 
 Retrieve the current state and result of an A2A task.
 
@@ -77,7 +77,7 @@ Retrieve the current state and result of an A2A task.
 | `state` | string | Task lifecycle state |
 | `artifacts` | array | Structured task output artifacts |
 
-### `a2a_cancel_task`
+### A2A Cancel Task
 
 Request cancellation of an in-progress A2A task.
 
@@ -97,7 +97,7 @@ Request cancellation of an in-progress A2A task.
 | `state` | string | Task lifecycle state after cancellation |
 | `canceled` | boolean | Whether the task reached the canceled state |
 
-### `a2a_get_agent_card`
+### A2A Get Agent Card
 
 Fetch the Agent Card (discovery document) for an external A2A agent.