ci: cancel sibling PR lanes after failure

.agents/skills/manage-ci/SKILL.md

@@ -175,20 +175,26 @@ owning source, and update the inventory and topology in the same change.
 - Cancel superseded PR runs. Do not cancel releases, deployments, cache
   warming, cleanup, or publishing unless their rollback semantics explicitly
   permit it.
-- Treat each focused PR workflow as an independent failure domain. A Quality
-  or Website failure must not cancel platform compilation, tests, products, or
-  smoke jobs, and a platform failure must not cancel another focused PR
-  workflow.
+- Keep the five focused PR workflows as separate visible checks, but stop
+  wasting capacity after the first definitive job failure for one exact PR
+  revision. The protected default-branch sibling monitor may cancel the other
+  queued or in-progress Quality, Website, Linux, macOS, and Windows workflow
+  runs for the same PR number, head SHA, and event epoch. It must preserve the
+  workflow containing the first failure so that lane can publish its stable
+  diagnostic result. This policy is PR-only; main, manual, release,
+  deployment, cleanup, cache-warming, and newer PR revisions are never targets.
 - Within a PR platform lane, compilation, functional-test, product, and smoke
   matrices fail fast so a required row failure cancels their queued and
   in-progress sibling rows. Keep this profile-derived: exhaustive main/manual
   runs continue sibling rows to retain complete diagnostics, and Quality
   matrices continue all rows because they are independent diagnostics rather
   than producer/consumer gates.
 - Prefer declared `needs` edges to suppress impossible consumers after a
-  producer failure. Do not cancel an entire workflow run through the Actions
-  API on first failure: that prevents the stable lane summary from reporting a
-  terminal failure and discards unrelated failure-domain evidence.
+  producer failure. Cross-workflow PR cancellation is owned only by the
+  protected `workflow_run` monitor: ordinary PR-controlled workflows and
+  checked-out code must never receive `actions: write`. Cancelled sibling
+  checks are expected terminal evidence after another lane has already failed;
+  the preserved failed lane remains the root diagnostic.
 - Control fan-out in the graph. Use bounded matrices and `max-parallel` after
   eliminating irrelevant work; do not use additional runner capacity as a
   substitute for routing and composition.

.agents/skills/manage-ci/references/current-inventory.md

@@ -13,6 +13,7 @@ Read it with `../SKILL.md` and `ci/ci.md` before editing CI.
 | `pr_linux.yml` (`PR · Linux`) | PR lifecycle | Canonical PR planning plus the protected reusable Linux lane |
 | `pr_macos.yml` (`PR · macOS`) | PR lifecycle | Canonical PR planning plus the protected reusable macOS lane |
 | `pr_windows.yml` (`PR · Windows`) | PR lifecycle | Canonical PR planning plus the protected reusable Windows lane |
+| `pr-cancel-sibling-runs.yml` (`PR · Cancel sibling lanes`) | protected `workflow_run` on `PR · Quality` entering progress | No-PR-checkout monitor that cancels other exact-revision PR validation lanes after the first definitive job failure |
 | `pr_builds.yml` | `workflow_call` only | Inert migration shim for the pre-merge protected runner-contract filename check; no PR event trigger |
 | `ci-orchestrator.yml` | `workflow_call` only | Inert migration shim for the pre-merge protected runner-contract filename check; no PR event trigger or lane calls |
 | `main_quality.yml` (`Main · Quality`) | push to `main` | Exhaustive main planning plus the same-commit reusable Quality lane |
@@ -44,8 +45,10 @@ target; prerelease tags are excluded so RC and final notes use the same stable
 baseline.
 
 The five PR lifecycle rows and five main push rows above are the complete
-allowed routine validation entry sets. Their separation and direct GitHub log
-visibility are contractual, not a presentation preference. `pr_builds.yml`,
+allowed routine validation entry sets. The protected sibling monitor is
+metadata/control infrastructure, not a sixth validation entrypoint or required
+check. Their separation and direct GitHub log visibility are contractual, not
+a presentation preference. `pr_builds.yml`,
 `ci-orchestrator.yml`, and `ci.yml` are reusable-only migration scaffolding;
 they must never regain event triggers or call the five lanes. They are
 removable after this branch's runner contract is active on protected main.
@@ -151,8 +154,15 @@ the pnpm store without racing to save it. Trusted main owns shared publication.
 
 PR Rust-test, host, native-runtime, product, and platform-check matrices receive
 `fail_fast: true`; main/manual pass `false`. Quality matrices remain
-non-fail-fast, failed producers suppress only declared consumers through
-`needs`, and focused PR workflows never cancel one another.
+non-fail-fast and failed producers suppress impossible consumers through
+`needs`. One protected, default-branch `workflow_run` monitor starts with
+`PR · Quality`, polls the five exact-PR/exact-SHA validation runs, preserves the
+run containing the first definitive failed job, and cancels its queued or
+in-progress siblings. It checks out only the default branch, owns the sole
+`actions: write` token for this operation, and never targets main, manual,
+release, deployment, cleanup, cache-warming, another PR event epoch, or a newer
+revision. PR-controlled workflows and executor jobs retain no Actions-write
+permission.
 
 ## Providers and variables
 

.github/AGENTS.md

@@ -43,6 +43,14 @@ remain separate PR-associated workflows with directly drillable nested jobs
 and one stable `PR / <lane>` result each. Do not add path filters; planning owns
 skips so every stable result exists.
 
+The protected `workflow_run` sibling-failure monitor is control infrastructure,
+not a sixth PR validation entrypoint. It may cancel only queued or in-progress
+Quality, Website, Linux, macOS, and Windows runs for the same PR number, exact
+head SHA, and event epoch after preserving the workflow containing the first
+definitive job failure. Its Actions-write token must never enter a PR-controlled
+workflow, checkout, action, or process, and it must never target main or other
+workflow classes.
+
 Preserve the five-entry main shape as well. Routine pushes to `main` must use
 five focused native workflows with one stable `Main / <lane>` result each.
 They must not use path filters, cancel older main revisions, call detached

.github/actions/cancel-pr-sibling-runs/action.yml

@@ -0,0 +1,19 @@
+name: Cancel sibling PR validation runs
+description: Monitor one exact PR revision and cancel its other validation lanes after the first definitive job failure.
+
+inputs:
+  token:
+    description: Repository-scoped token with Actions write permission.
+    required: true
+  poll_seconds:
+    description: Seconds between read-only workflow/job status polls.
+    required: false
+    default: "30"
+  max_minutes:
+    description: Maximum monitoring duration before failing visibly.
+    required: false
+    default: "180"
+
+runs:
+  using: node24
+  main: index.js