[Deicyde]

Since #72, CI's aggregate required job needs worker, python and browser, but three docs still described the browser job as a non-required soak waiting for promotion.

Changes

• CLAUDE.md and AGENTS.md (Security / credentials, CI test boundaries, commands block):
  • required aggregates the hermetic worker, python and browser gates.
  • The browser job has been required since CI: make the browser soak required #72. Its failure-artifact upload is unchanged.
  • The commands block calls the Playwright run "Browser tests, required in CI" instead of "Browser soak".
• CONTRIBUTING.md:
  • The "Browser tests" paragraph says the job is required.
  • The CI bullet says worker and browser use Node 22, python uses Python 3.12, and required needs all three.
• Local prerequisite, in all three: the e2e server builds /brain by importing site/build_brain_page.py with the python3 on PATH. Its imports need Python 3.10 or newer: brain/build_context.py uses @dataclass(frozen=True, slots=True) (and brain/stage_io.py @dataclass(slots=True)), and build_brain_page.py evaluates list[str] | None at definition time. Python 3.10 imports it and 3.9 fails. CI's browser job uses the runner's system python3.
• Activation CI evidence: brain/authority/README.md and site/ops/brain_activation_ci.py's docstring called that evidence "the (three) required CI commands". The recorder runs npm ci, npm run test:ci and scripts/ci-python.sh, never the browser job, so both now say Worker and Python and note that the browser job is excluded. Whether activation evidence should attest the browser gate too is a separate decision: it would mean a schema change, and Playwright on the operator host.

Not changed: docs/ROADMAP.md:1080, a completed checklist entry that describes the CI of its time.

Testing

Docs and one docstring; nothing executes these lines. They match .github/workflows/ci.yml on main (required has needs: [worker, python, browser] and checks all three results) and branch protection (it requires only required). Every touched file is release-neutral under site/ops/brain_release_authority.py.

[Deicyde]

Recommendation: merge. An independent adversarial review of 072cbf2a found no defects. CI is green, and every touched file is release-neutral.

• Claims checked:
  • required needs worker, python and browser, and has since CI: make the browser soak required #72 (afd1f2a0, merged in 4593c994).
  • Branch protection requires only required, and there are no rulesets.
  • The e2e server imports build_brain_page with the python3 on PATH and never runs main(). The 3.10 floor holds: slots=True dataclasses and a list[str] | None annotation evaluated at definition time.
  • The activation CI recorder runs exactly npm ci, test:ci and ci-python.sh.
• No textual conflict with Docs: leave the hotfix-path decision open; correct the activation record and status rows #74, the other open PR touching CLAUDE.md/AGENTS.md (its hunk is at lines 177-184), in either merge order.
• Optional polish, none blocking:
  • CONTRIBUTING.md:112: the new Python sentence now sits before "Linux CI uses … to install system dependencies too", so "too" reads as "in addition to Python". Moving the sentence after it fixes that.
  • CLAUDE.md/AGENTS.md:51: the "# Required, hermetic CI checks" heading still lists only the Worker and Python commands, next to "Browser tests, required in CI".
  • The Python 3.10 prerequisite sits under "Security / credentials". It fits better in the CI test boundaries Playwright bullet.
  • The body says build_context.py uses @dataclass(slots=True). It is @dataclass(frozen=True, slots=True); the bare form is in brain/stage_io.py.
• For CI: Dependabot for npm (wiki), pip and GitHub Actions #80, not this PR: its dependabot.yml header still calls the browser job a "soak".

[Deicyde]

Follow-up: polish applied in a9418e34. Recommendation: merge. CI is green (run 39077189670).

• CONTRIBUTING.md: the Python 3.10 sentence now comes after "Linux CI uses … to install system dependencies too", so "too" again means Chromium.
• CLAUDE.md/AGENTS.md:
  • The "Required, hermetic CI checks" heading notes that the browser tests below are required too.
  • The Python 3.10 prerequisite moved from Security / credentials to the CI test boundaries Playwright bullet.
  • required is described as the hermetic Worker and Python gates plus the loopback-only browser gate.
  • "since CI: make the browser soak required #72" now reads "since PR CI: make the browser soak required #72".
• Body: the dataclass detail is corrected (frozen=True, slots=True in build_context.py, slots=True in stage_io.py).

The two files still match apart from line 1. All touched files remain release-neutral, and there is still no overlap with #74's hunk.

[Deicyde]

Re-review on main (eaa5950b): fine. Every statement holds on main:

• required needs worker, python and browser.
• Branch protection requires only required, and there are no rulesets.
• The e2e server imports build_brain_page with the python3 on PATH. Its import closure fails on 3.9 and imports on 3.10.
• The activation recorder runs exactly npm ci, test:ci and ci-python.sh.
• Later edits to CLAUDE.md/AGENTS.md (Security hardening: agent sandbox, fail-closed auth, request caps, static headers, token sealing #84) don't contradict it, the two files still match apart from line 1, and no doc still calls the browser job a soak.

Minor: "required" doesn't bind admins (enforce_admins: false, strict: false). docs/ROADMAP.md:1080 keeps its completed-entry wording on purpose.