ci(test): enforce hermetic deterministic Reborn suite

.github/workflows/README.md

@@ -18,6 +18,13 @@ on `push` to main, the merge queue must run it in the same shape first
 instead). External/live checks (canaries, deploys, releases, benchmark
 thresholds) are exempt: they stay out of the queue by design.
 
+The canonical local composition of the deterministic Reborn gates is
+`scripts/ci/run-hermetic-deterministic-suite.sh all`. CI invokes the same
+checked-in stages through that runner so credentials, ambient behavior,
+mutable roots, clock/seed inputs, and non-loopback egress have one mechanical
+boundary. Setup and exclusions are documented in
+`docs/internal/hermetic-deterministic-suite.md`.
+
 The WASM WIT compatibility lane uses two risk scopes. Pull requests run it only
 for direct WIT, WASM host, extension, compatibility-test, or lane-workflow
 changes. Root `Cargo.toml` and `Cargo.lock` changes are broader workspace risk:

.github/workflows/code_style.yml

@@ -233,6 +233,7 @@ jobs:
           scripts/ci/test-reborn-crate-test-buckets.sh
           python3 scripts/ci/test_ws12_suite_shards.py
           python3 scripts/ci/test_ws12_workflow_contracts.py
+          scripts/ci/test-hermetic-test-process.sh
           bash .github/scripts/test-pr-labeler.sh
 
   clippy:

.github/workflows/reborn-e2e.yml

@@ -50,6 +50,7 @@ on:
       - "crates/ironclaw_*/**"
       - "docs/reborn/**"
       - "scripts/reborn-e2e-rust.sh"
+      - "scripts/ci/*hermetic*"
       - "tests/e2e/**"
       - "build.rs"
       - "providers.json"
@@ -99,7 +100,7 @@ jobs:
 
           # Keep this pattern in sync with the push `paths:` filter in the
           # `on:` block above.
-          if printf '%s\n' "$CHANGED_FILES" | grep -Eq '^(crates/ironclaw_[^/]+/|docs/reborn/|scripts/reborn-e2e-rust\.sh$|tests/e2e/|build\.rs$|providers\.json$|Cargo\.toml$|Cargo\.lock$|\.github/workflows/reborn-e2e\.yml$)'; then
+          if printf '%s\n' "$CHANGED_FILES" | grep -Eq '^(crates/ironclaw_[^/]+/|docs/reborn/|scripts/reborn-e2e-rust\.sh$|scripts/ci/[^/]*hermetic[^/]*$|tests/e2e/|build\.rs$|providers\.json$|Cargo\.toml$|Cargo\.lock$|\.github/workflows/reborn-e2e\.yml$)'; then
             echo "has_e2e_scope=true" >> "$GITHUB_OUTPUT"
           else
             echo "has_e2e_scope=false" >> "$GITHUB_OUTPUT"
@@ -138,14 +139,19 @@ jobs:
       - name: Run deterministic Reborn Rust gate
         env:
           CARGO_TEST_ARGS: "-- --nocapture"
-        run: scripts/reborn-e2e-rust.sh ${{ matrix.group }}
+        run: >-
+          scripts/ci/run-hermetic-deterministic-suite.sh
+          rust-e2e
+          ${{ matrix.group }}
 
   webui-v2-smoke:
     name: Reborn WebUI v2 smoke
     needs: changes
     if: needs.changes.outputs.has_e2e_scope == 'true'
     runs-on: ubuntu-latest
     timeout-minutes: 30
+    env:
+      IRONCLAW_HERMETIC_SUITE_SKIP_PREPARE: "1"
     steps:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
@@ -156,6 +162,9 @@ jobs:
           ref: ${{ inputs.ref || (github.event_name == 'pull_request' && github.event.pull_request.head.sha) || github.sha }}
           persist-credentials: false
 
+      - name: Configure isolated Playwright browser path
+        run: echo "PLAYWRIGHT_BROWSERS_PATH=${RUNNER_TEMP}/ms-playwright" >> "$GITHUB_ENV"
+
       - name: Install Rust
         uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
 
@@ -233,7 +242,7 @@ jobs:
       - name: Cache Playwright browsers
         uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         with:
-          path: ~/.cache/ms-playwright
+          path: ${{ runner.temp }}/ms-playwright
           key: ${{ runner.os }}-playwright-${{ hashFiles('tests/e2e/pyproject.toml') }}
           restore-keys: ${{ runner.os }}-playwright-
       - name: Install E2E dependencies
@@ -244,6 +253,8 @@ jobs:
 
       - name: Validate product-surface evidence contracts
         run: >-
+          scripts/ci/run-hermetic-deterministic-suite.sh
+          command
           pytest
           tests/e2e/scenarios/test_product_surface_coverage.py
           tests/e2e/scenarios/test_provider_capability_inventory.py
@@ -276,6 +287,8 @@ jobs:
 
       - name: Run Reborn WebUI v2 smoke
         run: >-
+          scripts/ci/run-hermetic-deterministic-suite.sh
+          command
           pytest
           tests/e2e/scenarios/test_reborn_webui_v2_smoke.py
           tests/e2e/scenarios/test_reborn_webui_v2_sso.py
@@ -286,6 +299,8 @@ jobs:
         env:
           IRONCLAW_EMULATE_CLI: ${{ github.workspace }}/.emulate/packages/emulate/dist/index.js
         run: >-
+          scripts/ci/run-hermetic-deterministic-suite.sh
+          command
           pytest
           tests/e2e/scenarios/test_provider_capability_inventory.py
           tests/e2e/scenarios/test_journey_coverage.py
@@ -306,6 +321,8 @@ jobs:
           IRONCLAW_EMULATE_CLI: ${{ github.workspace }}/.emulate/packages/emulate/dist/index.js
           IRONCLAW_JOURNEY_ORDER: reverse
         run: >-
+          scripts/ci/run-hermetic-deterministic-suite.sh
+          command
           pytest
           tests/e2e/scenarios/test_reborn_qa_trace_full_path.py::test_mutating_qa_journeys_replay_in_reverse_against_shared_provider_world
           -v
@@ -331,7 +348,8 @@ jobs:
           echo "replaying ${#journeys[@]} journeys alone"
           for journey in "${journeys[@]}"; do
             echo "::group::alone: $journey"
-            pytest tests/e2e/scenarios/test_reborn_qa_trace_full_path.py \
+            scripts/ci/run-hermetic-deterministic-suite.sh command \
+              pytest tests/e2e/scenarios/test_reborn_qa_trace_full_path.py \
               -k "$journey and not isolated" \
               -v --timeout=120
             echo "::endgroup::"
@@ -346,7 +364,8 @@ jobs:
             echo "No Reborn Responses API E2E tests selected"
             exit 1
           fi
-          pytest "${responses_tests[@]}" -v --timeout=120
+          scripts/ci/run-hermetic-deterministic-suite.sh command \
+            pytest "${responses_tests[@]}" -v --timeout=120
 
       - name: Package live-canary binary
         id: live_canary_binary
@@ -392,6 +411,8 @@ jobs:
     if: needs.changes.outputs.has_e2e_scope == 'true'
     runs-on: ubuntu-latest
     timeout-minutes: 30
+    env:
+      IRONCLAW_HERMETIC_SUITE_SKIP_PREPARE: "1"
     steps:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
@@ -442,7 +463,13 @@ jobs:
           pip install -e .
 
       - name: Run Reborn black-box smoke
-        run: pytest tests/e2e/scenarios/test_reborn_blackbox_smoke.py -v --timeout=120
+        run: >-
+          scripts/ci/run-hermetic-deterministic-suite.sh
+          command
+          pytest
+          tests/e2e/scenarios/test_reborn_blackbox_smoke.py
+          -v
+          --timeout=120
 
   reborn-e2e:
     name: Reborn E2E