Final Audit Opt

.github/workflows/prepare-release.yml

@@ -9,6 +9,8 @@ on:
         type: string
 
 permissions:
+  actions: read
+  checks: read
   contents: read
 
 jobs:

.github/workflows/release-core.yml

@@ -18,6 +18,8 @@ on:
         type: boolean
 
 permissions:
+  actions: read
+  checks: read
   contents: write
 
 jobs:
@@ -34,6 +36,36 @@ jobs:
           git fetch origin main:refs/remotes/origin/main
           git merge-base --is-ancestor HEAD refs/remotes/origin/main
 
+      - name: Ensure CI passed for release commit
+        env:
+          GH_TOKEN: ${{ github.token }}
+          GH_REPO: ${{ github.repository }}
+          TARGET_REF: ${{ inputs.target_ref }}
+        run: |
+          set -euo pipefail
+
+          ci_pass_json="$(
+            gh api "repos/$GH_REPO/commits/$TARGET_REF/check-runs" \
+              -f per_page=100 \
+              --paginate \
+              --jq '[.check_runs[] | select(.name == "ci-pass")] | sort_by(.completed_at // "") | last // empty'
+          )"
+
+          if [ -z "$ci_pass_json" ] || [ "$ci_pass_json" = "null" ]; then
+            echo "::error::No ci-pass check run was found for $TARGET_REF. Run CI before releasing."
+            exit 1
+          fi
+
+          status="$(printf '%s' "$ci_pass_json" | jq -r '.status // ""')"
+          conclusion="$(printf '%s' "$ci_pass_json" | jq -r '.conclusion // ""')"
+          url="$(printf '%s' "$ci_pass_json" | jq -r '.html_url // ""')"
+          if [ "$status" != "completed" ] || [ "$conclusion" != "success" ]; then
+            echo "::error::ci-pass for $TARGET_REF is $status/$conclusion. Release packaging requires green CI. $url"
+            exit 1
+          fi
+
+          echo "ci-pass succeeded for $TARGET_REF: $url"
+
   build-mac-release:
     needs:
       - verify

.github/workflows/release.yml

@@ -16,6 +16,8 @@ on:
         type: string
 
 permissions:
+  actions: read
+  checks: read
   contents: write
 
 jobs:

apps/ade-cli/src/cli.test.ts

@@ -79,6 +79,7 @@ describe("ADE CLI", () => {
     if (plan.kind !== "help") return;
     expect(plan.text).toContain("ade code --socket /tmp/ade.sock");
     expect(plan.text).toContain("ade code --require-socket");
+    expect(plan.text).toContain("ade code --lane <id|name|branch>");
     expect(plan.text).toContain("Command palette");
   });
 

apps/ade-cli/src/cli.ts

@@ -855,6 +855,7 @@ const HELP_BY_COMMAND: Record<string, string> = {
     $ ade code --embedded                          Force the embedded runtime fallback
     $ ade code --require-socket                    Fail instead of embedding when no socket exists
     $ ade code --socket /tmp/ade.sock              Attach to a specific runtime socket
+    $ ade code --lane <id|name|branch>             Launch focused on a specific lane
     $ ade --project-root <path> code                Launch against a specific ADE project
 
   Keys:

apps/ade-cli/src/multiProjectRpcServer.test.ts

@@ -426,4 +426,73 @@ describe("multi-project RPC server", () => {
 
     handler.dispose();
   });
+
+  it("can subscribe to project runtime events without replaying buffered history", async () => {
+    const { projectRoot, registry } = createRegistry();
+    const added = registry.add(projectRoot);
+    const eventBuffer = createEventBuffer();
+    eventBuffer.push({
+      timestamp: "2026-05-10T00:00:00.000Z",
+      category: "runtime",
+      payload: { type: "file_change", event: { path: "old.ts" } },
+    });
+    const scopeRegistry = {
+      get: vi.fn(async () => ({
+        registryProjectId: added.projectId,
+        record: added,
+        runtime: {
+          eventBuffer,
+          dispose: vi.fn(),
+        },
+        dispose: vi.fn(),
+      })),
+      ensureSyncHost: vi.fn(),
+      dispose: vi.fn(),
+      disposeAll: vi.fn(),
+    } as unknown as ProjectScopeRegistry;
+    const handler = createMultiProjectRpcRequestHandler({
+      serverVersion: "test",
+      projectRegistry: registry,
+      scopeRegistry,
+    });
+    const notify = vi.fn();
+    handler.setNotifier(notify);
+
+    await handler({
+      jsonrpc: "2.0",
+      id: 1,
+      method: "ade/initialize",
+      params: {},
+    });
+
+    const subscribed = await handler({
+      jsonrpc: "2.0",
+      id: 2,
+      method: "runtimeEvents.subscribe",
+      params: {
+        projectId: added.projectId,
+        category: "runtime",
+        replay: false,
+      },
+    }) as { subscriptionId: string; hasMore: boolean; nextCursor: number };
+
+    expect(subscribed.hasMore).toBe(false);
+    expect(notify).not.toHaveBeenCalled();
+
+    eventBuffer.push({
+      timestamp: "2026-05-10T00:00:01.000Z",
+      category: "runtime",
+      payload: { type: "file_change", event: { path: "new.ts" } },
+    });
+
+    expect(notify).toHaveBeenCalledTimes(1);
+    expect(notify).toHaveBeenCalledWith("runtime/event", expect.objectContaining({
+      subscriptionId: subscribed.subscriptionId,
+      event: expect.objectContaining({
+        payload: { type: "file_change", event: { path: "new.ts" } },
+      }),
+    }));
+
+    handler.dispose();
+  });
 });

apps/ade-cli/src/multiProjectRpcServer.ts

@@ -323,6 +323,7 @@ export function createMultiProjectRpcRequestHandler(
     }
     const cursor = readCursor(params.cursor);
     const limit = readLimit(params.limit);
+    const replay = params.replay !== false;
     const scope = await scopeRegistry.get(projectId);
     const subscriptionId = `runtime-events-${nextSubscriptionId++}`;
     const shouldForward = (event: BufferedEvent): boolean =>
@@ -337,15 +338,17 @@ export function createMultiProjectRpcRequestHandler(
       unsubscribe,
     });
 
-    const replay = scope.runtime.eventBuffer.drain(cursor, limit);
-    for (const event of replay.events) {
+    const replayResult = replay
+      ? scope.runtime.eventBuffer.drain(cursor, limit)
+      : { events: [], nextCursor: cursor, hasMore: false };
+    for (const event of replayResult.events) {
       if (shouldForward(event))
         emitRuntimeEvent(subscriptionId, projectId, event);
     }
     return {
       subscriptionId,
-      nextCursor: replay.nextCursor,
-      hasMore: replay.hasMore,
+      nextCursor: replayResult.nextCursor,
+      hasMore: replayResult.hasMore,
     };
   };