test: Phase 1 e2e harness core and TC-01

.github/workflows/ci.yml

@@ -29,4 +29,4 @@ jobs:
         with:
           python-version: "3.12"
       - run: pip install -e . --group dev
-      - run: python -m pytest tests/unit -q
+      - run: python -m pytest tests/unit tests/ci -q

.github/workflows/vllm-e2e.yml

@@ -57,3 +57,41 @@ jobs:
           name: kvcr-vllm-e2e-${{ github.run_attempt }}
           path: e2e-artifacts/
           retention-days: 7
+
+  phase1:
+    # KVCR test plan Phase 1 functional gate in Guard mode on the same image and
+    # runner, after the peer-transfer smoke test. Guard mode needs a runner kernel
+    # of 6.5 or newer; otherwise the harness reports BLOCKED and the job fails.
+    # --batch-invariant keeps the bare-engine reference deterministic so token
+    # comparison is exact. Later parts of the series extend --cases as they add
+    # cases; TC-05/06 (performance, recovery timing) stay manual until a nightly
+    # lane exists.
+    needs: peer-transfer
+    runs-on: prod-kvcr-tester-amd-gpu-2-v1
+    container:
+      image: ${{ inputs.image }}
+    timeout-minutes: 60
+    env:
+      HF_HOME: /scratch/huggingface
+      VLLM_CACHE_ROOT: /scratch/vllm
+      XDG_CACHE_HOME: /scratch/cache
+    steps:
+      - uses: actions/checkout@v4
+      - name: Show NVIDIA devices
+        run: nvidia-smi
+      - name: Run Phase 1 (TC-01) in Guard mode
+        shell: bash
+        env:
+          MODEL: ${{ inputs.model }}
+        run: |
+          set -euo pipefail
+          python3 -u tests/e2e/run_phase1.py --output-dir artifacts/phase1/run \
+            --model "$MODEL" --mode guard --batch-invariant --timeout 2400 \
+            --cases TC-01
+      - name: Save Phase 1 evidence
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: kvcr-phase1-${{ github.run_attempt }}
+          path: artifacts/phase1/
+          retention-days: 14