ci(gitea): skip Phoenix deploy on doc/report-only pushes; ignore ephemeral artifacts

Add paths-ignore on deploy-to-phoenix so pushes that only touch docs/, reports/,
editor paths, AGENTS.md, or root screenshot/tarballs do not run validate+deploy.
Manual workflow_dispatch still runs the full pipeline.

Extend .gitignore for Playwright MCP, root verification screenshots/bundles, and
common reports/status pipeline churn (locks, jsonl, ei-matrix/cw-multitoken blobs).

Co-authored-by: Cursor <cursoragent@cursor.com>

.gitea/workflow-sources/deploy-to-phoenix.yml

@@ -1,10 +1,28 @@
 # Canonical deploy workflow. Keep source and checked-in workflow copies byte-identical.
 # Validation checks both file sync and main/master parity.
+#
+# Push runs validate + Phoenix only when at least one changed path is outside paths-ignore.
+# Doc/report/editor-only pushes skip CI deploy churn; use workflow_dispatch for a manual run.
 name: Deploy to Phoenix
 
 on:
   push:
     branches: [main, master]
+    paths-ignore:
+      # Narrative / audit text — does not change Phoenix-running code on the host
+      - 'docs/**'
+      - 'reports/**'
+      # Editor & local agent tooling
+      - '.cursor/**'
+      - '.cursorindexingignore'
+      - '.playwright-mcp/**'
+      # Repo guidance only (submodules + scripts drive deploy semantics)
+      - 'AGENTS.md'
+      # Typical local verification screenshots/bundles at repo root (regenerate at will)
+      - '/explorer-*.png'
+      - '/explorer-*.jpg'
+      - '/eip155-*.svg'
+      - '/*.tar.gz'
   workflow_dispatch:
 
 jobs:
@@ -59,7 +77,7 @@ jobs:
           BRANCH="$(git rev-parse --abbrev-ref HEAD)"
           set +e
           curl -sSf --retry 3 --retry-connrefused --retry-delay 10 --retry-max-time 180 \
-            --connect-timeout 10 --max-time 120 \
+            --connect-timeout 10 --max-time 3600 \
             -X POST "${{ secrets.PHOENIX_DEPLOY_URL }}" \
             -H "Authorization: Bearer ${{ secrets.PHOENIX_DEPLOY_TOKEN }}" \
             -H "Content-Type: application/json" \
@@ -92,7 +110,7 @@ jobs:
           SHA="$(git rev-parse HEAD)"
           BRANCH="$(git rev-parse --abbrev-ref HEAD)"
           curl -sSf \
-            --connect-timeout 10 --max-time 900 \
+            --connect-timeout 10 --max-time 3600 \
             -X POST "${{ secrets.PHOENIX_DEPLOY_URL }}" \
             -H "Authorization: Bearer ${{ secrets.PHOENIX_DEPLOY_TOKEN }}" \
             -H "Content-Type: application/json" \
@@ -117,7 +135,7 @@ jobs:
           SHA="$(git rev-parse HEAD)"
           BRANCH="$(git rev-parse --abbrev-ref HEAD)"
           curl -sSf --retry 5 --retry-all-errors --retry-connrefused --retry-delay 10 --retry-max-time 300 \
-            --connect-timeout 10 --max-time 120 \
+            --connect-timeout 10 --max-time 900 \
             -X POST "${{ secrets.PHOENIX_DEPLOY_URL }}" \
             -H "Authorization: Bearer ${{ secrets.PHOENIX_DEPLOY_TOKEN }}" \
             -H "Content-Type: application/json" \

.gitea/workflow-sources/validate-on-pr.yml

@@ -1,7 +1,7 @@
 # Canonical PR validation workflow. Keep source and checked-in workflow copies byte-identical.
 # Validation checks both file sync and main/master parity.
-# PR-only: push validation already runs in deploy-to-phoenix.yml; this gives PRs the same
-# no-LAN checks without the deploy job (and without deploy secrets).
+# PR-only: merges to main/master run deploy-to-phoenix only when push touches deploy-relevant
+# paths (see paths-ignore there); this workflow always validates PRs without Phoenix deploy.
 name: Validate (PR)
 on:
   pull_request:
@@ -27,6 +27,8 @@ jobs:
           pnpm install --frozen-lockfile
       # Optional: set org/repo variable URA_STRICT_CLOSURE=1 to fail PRs while pilot placeholders
       # remain in manifest (see scripts/ura/validate-manifest-closure.mjs). Not enabled by default.
+      # Optional: set org/repo vars ETHEREUM_MAINNET_RPC + RPC_URL_138 and EI_MATRIX_ONCHAIN_AUDIT_CI=1 to run
+      # scripts/lib/ei_matrix_onchain_readiness_audit.py via run-all-validation (see OPERATOR_READY_CHECKLIST §5e).
       - name: run-all-validation (no LAN, no genesis)
         env:
           URA_STRICT_CLOSURE: ${{ vars.URA_STRICT_CLOSURE }}

.gitea/workflows/deploy-to-phoenix.yml

@@ -1,10 +1,28 @@
 # Canonical deploy workflow. Keep source and checked-in workflow copies byte-identical.
 # Validation checks both file sync and main/master parity.
+#
+# Push runs validate + Phoenix only when at least one changed path is outside paths-ignore.
+# Doc/report/editor-only pushes skip CI deploy churn; use workflow_dispatch for a manual run.
 name: Deploy to Phoenix
 
 on:
   push:
     branches: [main, master]
+    paths-ignore:
+      # Narrative / audit text — does not change Phoenix-running code on the host
+      - 'docs/**'
+      - 'reports/**'
+      # Editor & local agent tooling
+      - '.cursor/**'
+      - '.cursorindexingignore'
+      - '.playwright-mcp/**'
+      # Repo guidance only (submodules + scripts drive deploy semantics)
+      - 'AGENTS.md'
+      # Typical local verification screenshots/bundles at repo root (regenerate at will)
+      - '/explorer-*.png'
+      - '/explorer-*.jpg'
+      - '/eip155-*.svg'
+      - '/*.tar.gz'
   workflow_dispatch:
 
 jobs:
@@ -59,7 +77,7 @@ jobs:
           BRANCH="$(git rev-parse --abbrev-ref HEAD)"
           set +e
           curl -sSf --retry 3 --retry-connrefused --retry-delay 10 --retry-max-time 180 \
-            --connect-timeout 10 --max-time 120 \
+            --connect-timeout 10 --max-time 3600 \
             -X POST "${{ secrets.PHOENIX_DEPLOY_URL }}" \
             -H "Authorization: Bearer ${{ secrets.PHOENIX_DEPLOY_TOKEN }}" \
             -H "Content-Type: application/json" \
@@ -92,7 +110,7 @@ jobs:
           SHA="$(git rev-parse HEAD)"
           BRANCH="$(git rev-parse --abbrev-ref HEAD)"
           curl -sSf \
-            --connect-timeout 10 --max-time 900 \
+            --connect-timeout 10 --max-time 3600 \
             -X POST "${{ secrets.PHOENIX_DEPLOY_URL }}" \
             -H "Authorization: Bearer ${{ secrets.PHOENIX_DEPLOY_TOKEN }}" \
             -H "Content-Type: application/json" \
@@ -117,7 +135,7 @@ jobs:
           SHA="$(git rev-parse HEAD)"
           BRANCH="$(git rev-parse --abbrev-ref HEAD)"
           curl -sSf --retry 5 --retry-all-errors --retry-connrefused --retry-delay 10 --retry-max-time 300 \
-            --connect-timeout 10 --max-time 120 \
+            --connect-timeout 10 --max-time 900 \
             -X POST "${{ secrets.PHOENIX_DEPLOY_URL }}" \
             -H "Authorization: Bearer ${{ secrets.PHOENIX_DEPLOY_TOKEN }}" \
             -H "Content-Type: application/json" \

.gitea/workflows/validate-on-pr.yml

@@ -1,7 +1,7 @@
 # Canonical PR validation workflow. Keep source and checked-in workflow copies byte-identical.
 # Validation checks both file sync and main/master parity.
-# PR-only: push validation already runs in deploy-to-phoenix.yml; this gives PRs the same
-# no-LAN checks without the deploy job (and without deploy secrets).
+# PR-only: merges to main/master run deploy-to-phoenix only when push touches deploy-relevant
+# paths (see paths-ignore there); this workflow always validates PRs without Phoenix deploy.
 name: Validate (PR)
 on:
   pull_request:
@@ -27,6 +27,8 @@ jobs:
           pnpm install --frozen-lockfile
       # Optional: set org/repo variable URA_STRICT_CLOSURE=1 to fail PRs while pilot placeholders
       # remain in manifest (see scripts/ura/validate-manifest-closure.mjs). Not enabled by default.
+      # Optional: set org/repo vars ETHEREUM_MAINNET_RPC + RPC_URL_138 and EI_MATRIX_ONCHAIN_AUDIT_CI=1 to run
+      # scripts/lib/ei_matrix_onchain_readiness_audit.py via run-all-validation (see OPERATOR_READY_CHECKLIST §5e).
       - name: run-all-validation (no LAN, no genesis)
         env:
           URA_STRICT_CLOSURE: ${{ vars.URA_STRICT_CLOSURE }}

.gitignore

@@ -162,3 +162,22 @@ vendor/
 
 # Operator-local secrets (SSH keys, tokens — never commit)
 .secrets/
+
+# --- Ephemeral local outputs (avoid accidental commits that re-trigger Phoenix via push) ---
+# Playwright MCP session data (Cursor)
+.playwright-mcp/
+
+# Root-level verification screenshots / bundles (use reports/status with git add -f if retaining)
+/explorer-*.png
+/explorer-*.jpg
+/eip155-*.svg
+/*.tar.gz
+
+# Operator pipeline chunks, locks, and screenshot dumps under reports/status (force-add to retain)
+reports/status/**/*.lock
+reports/status/**/*.idx
+reports/status/**/*.hex
+reports/status/**/*.jsonl
+reports/status/ei-matrix-*
+reports/status/cw-multitoken-l2-remediation-*.jsonl
+reports/status/screenshots/