feat(ci): Quality Gate v2 — Onda 0 + Onda 1 (gate flips, TIA, SAST, DAST-smoke, mutation infra) (#4016)

* docs(ops): add quality-gate assessment + replication playbook (Fase 9 foundation)

* feat(ci): flip oasdiff breaking-change gate to blocking (ratchet)

* docs(ops): deliver main branch-protection ruleset for owner to apply

* fix(ci): run typecheck:core in PR->release fast-gates (close fast-gates hole, part 1)

* perf(mutation): enable Stryker incremental mode + cache (scales the 60/80 rollout)

* feat(ci): commit CodeQL advanced config (security-extended), replacing default-setup

* feat(ci): version semgrep SAST workflow (owasp/secrets), advisory

* feat(quality): TIA test-impact map builder (import-graph; map built at runtime, gitignored)

* feat(quality): TIA impacted-test selector with run-all fail-safe

* fix(ci): run TIA-impacted unit tests in PR->release fast-gates (build map at runtime, fail-safe full)

* feat(ci): DAST-smoke per-PR (schemathesis subset + promptfoo injection-guard, blocking)

* fix(ci): unbreak Fase 9 PR CI (MDX frontmatter, CodeQL conflict, dast-smoke advisory)

- Add MDX frontmatter to docs/ops/{BRANCH_PROTECTION_MAIN,QUALITY_GATE_PLAYBOOK}.md.
  fumadocs rejects frontmatter-less docs -> 'npm run build' failed -> broke dast-smoke's
  build step (the release fast-gates never runs build, so this only surfaced on the PR).
- codeql.yml: workflow_dispatch-only until the owner switches repo CodeQL Default->Advanced
  (advanced configs cannot be processed while default setup is enabled; documented inline).
- dast-smoke.yml: job-level continue-on-error (advisory) so this brand-new gate matures
  before it blocks (repo convention: advisory -> blocking).

* ci(quality): make TIA unit-test step advisory until release test-debt is cleared

release/v3.8.27 carries ~17 pre-existing failing unit tests (budget #3537, apiKey
#3552, several Zod schemas, Puter/Qwen executors, mimocode entry, etc.) unrelated to
this PR — the new 'run tests on PR->release' gate surfaced them. Per the repo's
advisory->blocking convention, this step enters advisory (it still runs + reports)
so pre-existing debt doesn't block the gate program. typecheck:core stays blocking.
Flip to blocking (remove continue-on-error) once the release suite is green.

.github/workflows/ci.yml

@@ -248,14 +248,15 @@ jobs:
         run: npm run check:workflows -- --ratchet
       # OpenAPI breaking-change detection (oasdiff). Diffs the PR's public API
       # contract (docs/reference/openapi.yaml) against the base branch's spec.
-      # ADVISORY: reports `openapiBreaking=N` and self-skips when oasdiff is absent
-      # or the base spec can't be resolved. BASE_REF is read by the script from the
-      # env (never interpolated into a shell body) — workflow-injection-safe.
-      - name: OpenAPI breaking-change (oasdiff; advisory)
-        continue-on-error: true
+      # BLOCKING ratchet (Fase 9 Onda 0): reads metrics.openapiBreaking.value and
+      # exits 1 ONLY on a measured regression (count > baseline). It SKIPs (exit 0)
+      # when oasdiff is absent or the base spec can't be resolved — a missing
+      # measurement never blocks. BASE_REF is read by the script from the env
+      # (never interpolated into a shell body) — workflow-injection-safe.
+      - name: OpenAPI breaking-change (oasdiff, ratchet, blocking)
         env:
           BASE_REF: ${{ github.base_ref }}
-        run: npm run check:openapi-breaking
+        run: npm run check:openapi-breaking -- --ratchet
 
   docs-sync-strict:
     name: Docs Sync (Strict)

.github/workflows/codeql.yml

@@ -0,0 +1,31 @@
+name: CodeQL
+# OWNER ACTION REQUIRED before enabling auto-triggers: advanced CodeQL conflicts with
+# GitHub "default setup" — the analyze step fails with "CodeQL analyses from advanced
+# configurations cannot be processed when the default setup is enabled". Switch repo
+# Settings → Code security → CodeQL from Default to Advanced, THEN restore the
+# push/pull_request/schedule triggers below. Until then this only runs on manual dispatch
+# so it never produces a red check on PRs. (The codeqlAlerts ratchet keeps working via the
+# default setup's alerts in the meantime.)
+on:
+  workflow_dispatch:
+permissions:
+  contents: read
+jobs:
+  analyze:
+    name: Analyze (javascript-typescript)
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      actions: read
+      contents: read
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - uses: github/codeql-action/init@v3
+        with:
+          languages: javascript-typescript
+          queries: security-extended
+      - uses: github/codeql-action/analyze@v3
+        with:
+          category: "/language:javascript-typescript"

.github/workflows/dast-smoke.yml

@@ -0,0 +1,62 @@
+name: DAST smoke (PR)
+on:
+  pull_request:
+    branches: ["main", "release/**"]
+permissions:
+  contents: read
+jobs:
+  dast-smoke:
+    runs-on: ubuntu-latest
+    # ADVISORY while this new gate matures (repo convention: advisory -> blocking).
+    # Flip to blocking (remove continue-on-error) once it's proven stable across a few PRs.
+    continue-on-error: true
+    timeout-minutes: 12
+    env:
+      JWT_SECRET: ci-build-secret-with-sufficient-length-for-validation
+      API_KEY_SECRET: ci-api-key-secret-with-sufficient-length-aaaa
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "24"
+          cache: npm
+      - run: npm ci
+      - name: Build CLI bundle
+        run: npm run build:cli
+      - name: Start OmniRoute
+        env:
+          PORT: "20128"
+          INJECTION_GUARD_MODE: block
+        run: |
+          node dist/server.js > server.log 2>&1 &
+          echo $! > server.pid
+          for _ in $(seq 1 30); do
+            if curl -sf http://localhost:20128/api/monitoring/health >/dev/null; then echo up; break; fi
+            sleep 2
+          done
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - run: pip install schemathesis
+      - name: Schemathesis smoke (high-risk endpoints, blocking)
+        run: |
+          schemathesis run docs/reference/openapi.yaml --url http://localhost:20128 \
+            --include-path-regex '^/v1/(chat/completions|models)$|^/api/(auth|keys)' \
+            --max-examples 8 --workers 4 --checks all --max-response-time 30 \
+            --request-timeout 20 --suppress-health-check all --no-color
+      - name: promptfoo injection-guard (blocking)
+        env:
+          OMNIROUTE_URL: http://localhost:20128
+          OMNIROUTE_API_KEY: not-needed-blocked-before-upstream
+        run: npx --yes promptfoo@latest eval -c promptfooconfig.yaml --no-cache
+      - name: Stop server
+        if: always()
+        run: kill "$(cat server.pid)" || true
+      - uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: dast-smoke-logs
+          path: server.log
+          retention-days: 7

.github/workflows/nightly-mutation.yml

@@ -25,6 +25,12 @@ jobs:
           node-version: "24"
           cache: npm
       - run: npm ci
+      - name: Restore Stryker incremental cache
+        uses: actions/cache@v4
+        with:
+          path: reports/mutation/stryker-incremental.json
+          key: stryker-incremental-${{ github.run_id }}
+          restore-keys: stryker-incremental-
       - name: Run Stryker (advisory)
         id: stryker
         continue-on-error: true

.github/workflows/quality.yml

@@ -29,6 +29,7 @@ jobs:
     steps:
       - uses: actions/checkout@v6
         with:
+          fetch-depth: 0
           persist-credentials: false
       - uses: actions/setup-node@v6
         with:
@@ -49,3 +50,29 @@ jobs:
       - run: npm run check:route-guard-membership
       - run: npm run check:test-discovery
       - run: npm run check:any-budget:t11
+      - name: Typecheck (core)
+        run: npm run typecheck:core
+      # TIA: build the impact map at runtime (gitignored, ~21MB) and run only the
+      # unit tests impacted by this PR's changed files. Fail-safe runs the FULL
+      # unit suite on hub/unmapped changes — TIA accelerates, never replaces, the net.
+      #
+      # ADVISORY for now (repo convention: advisory -> blocking). release/v3.8.27 carries
+      # ~17 pre-existing red unit tests (budget #3537, apiKey #3552, several Zod schemas,
+      # executors, etc.) unrelated to this PR; running them is what surfaced the debt.
+      # Keep this advisory until that debt is cleared, THEN remove continue-on-error to
+      # block test regressions on PR->release. typecheck:core above stays blocking.
+      - name: Impacted unit tests (TIA, fail-safe full; advisory until release test-debt cleared)
+        continue-on-error: true
+        env:
+          GITHUB_BASE_REF: ${{ github.base_ref }}
+        run: |
+          git fetch --no-tags origin "$GITHUB_BASE_REF" || true
+          node scripts/quality/build-test-impact-map.mjs
+          SEL="$(node scripts/quality/select-impacted-tests.mjs)"
+          if [ -z "$SEL" ]; then echo "No source/test changes — skipping unit tests"; exit 0; fi
+          if echo "$SEL" | grep -q "__RUN_ALL__"; then
+            echo "Fail-safe: running FULL unit suite"; npm run test:unit; exit $?
+          fi
+          echo "Running impacted tests:"; echo "$SEL"
+          mapfile -t FILES <<< "$SEL"
+          node --import tsx --import ./open-sse/utils/setupPolyfill.ts --test --test-force-exit --test-concurrency=8 "${FILES[@]}"

.github/workflows/semgrep.yml

@@ -0,0 +1,29 @@
+name: semgrep
+on:
+  pull_request:
+    branches: ["main", "release/**"]
+  push:
+    branches: ["main"]
+permissions:
+  contents: read
+jobs:
+  semgrep:
+    runs-on: ubuntu-latest
+    container:
+      image: semgrep/semgrep
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - name: Run semgrep (advisory)
+        continue-on-error: true
+        run: |
+          semgrep scan --config p/owasp-top-ten --config p/secrets \
+            --sarif --output semgrep.sarif --metrics off || true
+          python -c "import json; d=json.load(open('semgrep.sarif')); print('semgrepFindings=%d' % len(d['runs'][0]['results']))" || echo "semgrepFindings=SKIP"
+      - uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: semgrep-sarif
+          path: semgrep.sarif
+          retention-days: 14