[codex] add harness engineering guardrails (#284)

* refactor: add harness engineering guardrails

* fix: address harness review feedback

---------

Co-authored-by: apple <apple@appledeMacBook-Pro.local>

.github/workflows/ci.yml

@@ -50,7 +50,6 @@ jobs:
 
   test-core:
     name: Test Core
-    if: github.event_name == 'pull_request'
     runs-on: ubuntu-latest
     timeout-minutes: 20
 
@@ -74,7 +73,6 @@ jobs:
 
   build-web:
     name: Build Web
-    if: github.event_name == 'pull_request'
     runs-on: ubuntu-latest
     timeout-minutes: 15
 
@@ -96,7 +94,6 @@ jobs:
 
   build-server:
     name: Build Server
-    if: github.event_name == 'pull_request'
     runs-on: ubuntu-latest
     timeout-minutes: 15
 
@@ -118,7 +115,6 @@ jobs:
 
   build-desktop:
     name: Build Desktop
-    if: github.event_name == 'pull_request'
     runs-on: ubuntu-latest
     timeout-minutes: 15
 
@@ -140,7 +136,6 @@ jobs:
 
   typecheck:
     name: Typecheck
-    if: github.event_name == 'pull_request'
     runs-on: ubuntu-latest
     timeout-minutes: 15
 
@@ -160,9 +155,29 @@ jobs:
       - name: Run typecheck
         run: npm run typecheck
 
+  repo-drift:
+    name: Repo Drift Check
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci --prefer-offline --no-audit --no-fund
+
+      - name: Run repo drift check
+        run: npm run repo:drift-check
+
   schema-sqlite:
     name: Schema Check (SQLite)
-    if: github.event_name == 'pull_request'
     runs-on: ubuntu-latest
     timeout-minutes: 15
 
@@ -187,7 +202,6 @@ jobs:
 
   schema-mysql:
     name: Schema Check (MySQL)
-    if: github.event_name == 'pull_request'
     runs-on: ubuntu-latest
     timeout-minutes: 20
     services:
@@ -231,7 +245,6 @@ jobs:
 
   schema-postgres:
     name: Schema Check (Postgres)
-    if: github.event_name == 'pull_request'
     runs-on: ubuntu-latest
     timeout-minutes: 20
     services:
@@ -299,7 +312,6 @@ jobs:
 
   audit:
     name: Audit Production Dependencies
-    if: github.event_name == 'pull_request'
     runs-on: ubuntu-latest
     timeout-minutes: 10
     # Keep PR audit informational so build/test/schema remain the merge gate.

.github/workflows/harness-drift-report.yml

@@ -0,0 +1,44 @@
+name: Harness Drift Report
+
+on:
+  schedule:
+    - cron: '37 17 * * 1'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+env:
+  NODE_VERSION: 22
+
+jobs:
+  drift-report:
+    name: Generate Drift Report
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci --prefer-offline --no-audit --no-fund
+
+      - name: Generate repo drift report
+        run: npm run repo:drift-check -- --format markdown --output tmp/repo-drift-report.md --report-only
+
+      - name: Publish report to step summary
+        run: cat tmp/repo-drift-report.md >> "$GITHUB_STEP_SUMMARY"
+
+      - name: Upload report artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: repo-drift-report
+          path: tmp/repo-drift-report.md
+          retention-days: 30