P-R-N-D · Oct 12, 2026 · Oct 11, 2026 · Oct 11, 2026 · Oct 11, 2026 · Oct 11, 2026
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -213,3 +213,59 @@ jobs:
       - name: Run the unit tests
         # vitest run exits 1 when it finds no test file, so an empty run fails.
         run: npm run test:unit
+
+  compatibility:
+    # The compatibility model in docs/CI-MATRIX.md: the validator's own tests, the committed
+    # profile, and a record of this runner checked against that profile. A pass shows that
+    # this tooling works on this runner; it is not a support claim for any other platform.
+    name: Compatibility / Schema & Probe / Linux x64
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    env:
+      # uv ignores uv.toml and pyproject.toml files, which a pull request could add.
+      UV_NO_CONFIG: '1'
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
+        with:
+          version: '0.12.24'
+          enable-cache: false
+          # With a Python version given, setup-uv does not look for an interpreter in the checkout and run it.
+          python-version: '3.12.15'
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        with:
+          node-version-file: .nvmrc
+          package-manager-cache: false
+      - name: Create a CPython 3.12.15 environment with no packages
+        # The scripts use the standard library only, so nothing is installed into it.
+        run: |
+          uv venv --managed-python --python 3.12.15
+          echo "$GITHUB_WORKSPACE/.venv/bin" >> "$GITHUB_PATH"
+      - name: Record this runner's environment
+        # Reads /proc, /sys, os-release, a few files under /run, the checkout's .git, the event file's
+        # head and base SHAs and allowlisted variables, and runs node -p; the collector's docstring
+        # lists every source. Never escalates privileges, and writes no record that looks like a secret.
+        run: |
+          mkdir -p "$RUNNER_TEMP/compatibility"
+          python -I scripts/ci/collect_environment.py --profile-id linux-x64-gha --output "$RUNNER_TEMP/compatibility/linux-x64-gha.result.json" --summary "$GITHUB_STEP_SUMMARY"
+      - name: Check the record and the committed profile
+        # Also after a probe failure, which writes a partial record and exits 1.
+        if: ${{ !cancelled() }}
+        run: python -I scripts/ci/validate_compatibility.py --require-real --dependency-strategy docs/DEPENDENCY-STRATEGY.md --profile tests/compatibility/profiles/linux-x64-gha.json --summary "$GITHUB_STEP_SUMMARY" "$RUNNER_TEMP/compatibility/linux-x64-gha.result.json" tests/compatibility/profiles/*.json
+      - name: Test the validator, including records that must fail
+        if: ${{ !cancelled() }}
+        # Run directly, not through unittest discover, so scripts/ci/tests/ is not on the import path.
+        run: python -I scripts/ci/tests/test_compatibility_schema.py --verbose
+      - name: Test the probe
+        if: ${{ !cancelled() }}
+        run: python -I scripts/ci/tests/test_environment_probe.py --verbose
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        if: ${{ !cancelled() }}
+        with:
+          name: compatibility-linux-x64-attempt-${{ github.run_attempt }}
+          path: ${{ runner.temp }}/compatibility/
+          if-no-files-found: warn
+          # The record is a few KB and is the lane's only machine-readable evidence: keep it 90 days, GitHub's default for logs.
+          retention-days: 90
diff --git a/docs/CI-MATRIX.md b/docs/CI-MATRIX.md
diff --git a/docs/CODE-REVIEW.md b/docs/CODE-REVIEW.md
@@ -7,7 +7,7 @@ It is not a security policy (see [SECURITY-ARCHITECTURE.md](SECURITY-ARCHITECTUR
 ## Status
 
 - In effect for every code change, starting at HEAD 8ec5623 (committed 2026-09-21; the repository facts in this document were verified on 2026-10-08). The procedure depends on nothing that is Planned. (Updated 2026-10-10: the Frontend boundary checks were re-checked at 14b9109; unchanged through 3fe4d1a.)
-- Tooling: `.github/workflows/ci.yml` is the only workflow in this repository's files. It runs the baseline backend, frontend, and Playwright checks, plus the pytest and Vitest unit test jobs, on pull requests to `main` and pushes to `main`, on the checked lane only; [TESTING.md](TESTING.md) "Continuous integration" lists its jobs and what it does not cover. Its runs are evidence to read (see "Independence and authority" and step 8). GitHub-side integrations, such as review bots and required status checks, are configured outside the repository's files; whether one runs depends on the connected service and its settings, and its output is evidence to read. `.github/` also holds `copilot-instructions.md`, a bridge file that points to [CONTEXT.md](CONTEXT.md), and the advisory issue forms and pull request template described in [CONTEXT.md](CONTEXT.md) "GitHub issues and pull requests"; they are writing aids, not review tooling or evidence. Adding another workflow, or extending `ci.yml` beyond the checked lane, is a separate, explicitly requested change. (Updated 2026-10-10.)
+- Tooling: `.github/workflows/ci.yml` is the only workflow in this repository's files. It runs the baseline backend, frontend, and Playwright checks, plus the pytest and Vitest unit test jobs and the compatibility job of [CI-MATRIX.md](CI-MATRIX.md), on pull requests to `main` and pushes to `main`, on the checked lane only; [TESTING.md](TESTING.md) "Continuous integration" lists its jobs and what it does not cover. Its runs are evidence to read (see "Independence and authority" and step 8). GitHub-side integrations, such as review bots and required status checks, are configured outside the repository's files; whether one runs depends on the connected service and its settings, and its output is evidence to read. `.github/` also holds `copilot-instructions.md`, a bridge file that points to [CONTEXT.md](CONTEXT.md), and the advisory issue forms and pull request template described in [CONTEXT.md](CONTEXT.md) "GitHub issues and pull requests"; they are writing aids, not review tooling or evidence. Adding another workflow, or extending `ci.yml` beyond the checked lane, is a separate, explicitly requested change. (Updated 2026-10-11.)
 - Verification baseline: the automated tests that exist are listed in [TESTING.md](TESTING.md) under "Tests that exist today". They were not executed in this documentation pass. "Exists" and "executed" stay distinct throughout this document.
 - The checks under "Boundary-specific checks" for Realtime, Task, and Runtime cover Planned areas. They apply to a change that introduces such code; they never imply the feature exists.
 
@@ -156,7 +156,7 @@ A change that touches any of the following also goes through [SECURITY-REVIEW.md
 - External content handling: web pages, uploaded files, retrieved text, or tool output that reaches a model or a user.
 - Logging and audit: what is written to logs, Task records, or tool run summaries.
 - i18n locale input handling: cookies, `Accept-Language`, preference values, `<html lang>` ([I18N.md](I18N.md)).
-- CI workflows: any file under `.github/workflows/`, including its trigger events, `permissions`, secrets, `runs-on` labels, and action references.
+- CI workflows: any file under `.github/workflows/`, including its trigger events, `permissions`, secrets, `runs-on` labels, and action references, and the scripts and data a workflow runs and publishes the output of: `scripts/ci/` and `tests/compatibility/`. (Updated 2026-10-11.)
 
 The code review report states which triggers matched and whether the security review was done or is pending. Security findings use the finding format below plus the `SEC-*` IDs they map to, as [SECURITY-REVIEW.md](SECURITY-REVIEW.md) specifies.
 

diff --git a/docs/CONTEXT.md b/docs/CONTEXT.md
@@ -34,6 +34,7 @@ Implemented today, each with tests in the repository: the health APIs, the ASGI
 - [`docs/STATE-SCHEMA.md`](STATE-SCHEMA.md) describes conceptual collaboration and runtime state shapes. It is not a database schema.
 - [`docs/TESTING.md`](TESTING.md) describes testing strategy, the checks that exist today, and the verification still required.
 - [`docs/DEPENDENCY-STRATEGY.md`](DEPENDENCY-STRATEGY.md) records the applied dependency baseline, compatibility exceptions and residual advisories, platform and accelerator lanes, and the Python 3.15 Limited API/`abi3t` qualification and performance plan. It builds on the existing free-threading direction; the baseline update does not qualify 3.15/3.15t.
+- [`docs/CI-MATRIX.md`](CI-MATRIX.md) defines the compatibility model: how a lane is declared as a profile, how a run is recorded and validated (layers, privilege, runtimes, compute backends, stages), and what a passing compatibility job means. It records no support status; the lane table in DEPENDENCY-STRATEGY.md does.
 - [`docs/SECURITY-ARCHITECTURE.md`](SECURITY-ARCHITECTURE.md) defines trust boundaries and the `SEC-*` security requirements, with the current implementation facts. It is the only place those requirement IDs are defined.
 - [`docs/CODE-REVIEW.md`](CODE-REVIEW.md) defines how a coding agent independently reviews an actual code change and reports findings.
 - [`docs/SECURITY-REVIEW.md`](SECURITY-REVIEW.md) defines the security review procedure for changed code, reusing the `SEC-*` IDs.
@@ -52,6 +53,7 @@ Read this file first. Then read only the documents that match the work; do not r
 | Work that touches collaboration, Task, Artifact, Knowledge, or presentation state | [STATE-SCHEMA.md](STATE-SCHEMA.md) |
 | Before claiming anything is tested, and when adding tests | [TESTING.md](TESTING.md) |
 | Dependency, interpreter, native wheel/ABI, platform or accelerator, or packaging-tool updates | [DEPENDENCY-STRATEGY.md](DEPENDENCY-STRATEGY.md), then [TESTING.md](TESTING.md) |
+| Compatibility profiles, environment records, or a new OS, CPU, runtime, container, or accelerator lane in CI | [CI-MATRIX.md](CI-MATRIX.md), then [DEPENDENCY-STRATEGY.md](DEPENDENCY-STRATEGY.md) and [TESTING.md](TESTING.md) |
 | Changes to `.github/workflows/` or other CI configuration | [TESTING.md](TESTING.md) "Continuous integration", then [SECURITY-ARCHITECTURE.md](SECURITY-ARCHITECTURE.md) and [SECURITY-REVIEW.md](SECURITY-REVIEW.md) |
 | Reviewing a code change (yours or another agent's) | [CODE-REVIEW.md](CODE-REVIEW.md) |
 | Creating or editing a GitHub issue or pull request at the user's explicit request or a supported delegation | [GitHub issues and pull requests](#github-issues-and-pull-requests) below, then the matching template in [`.github/ISSUE_TEMPLATE/`](../.github/ISSUE_TEMPLATE/) or [`.github/pull_request_template.md`](../.github/pull_request_template.md) |

diff --git a/docs/DEPENDENCY-STRATEGY.md b/docs/DEPENDENCY-STRATEGY.md
@@ -176,9 +176,13 @@ Statuses used for the backend lock, installed binary-only:
 - **Statically resolvable**: every pin has a hashed wheel for the platform, and no dependency required only on that platform is missing from the lock. Not executed.
 - **Not supported**, **not binary-installable** or **incomplete**: a required wheel or platform-only dependency is missing, so the current lock cannot produce a working environment there without a new resolution or a source build (Windows x64 installs without `tzdata`; the other cases fail to install).
 
+This table is the only record of a lane's support status. Its statuses are for the backend lock, which is resolved for CPython 3.12 with the GIL. Compatibility profiles in `tests/compatibility/` copy a lane's status and name from it, a profile for another interpreter, such as 3.15 or 3.15t, names the lane with the status `not-assessed`, and `scripts/ci/validate_compatibility.py` fails a profile whose OS family, architecture, C library, or WSL2 layer is not the lane's, or whose declared versions do not meet the bounds of the status it claims, and with `--dependency-strategy` one that disagrees with the Lane and Backend lock columns, so renaming a lane or changing its status word changes what a profile may claim ([CI-MATRIX.md](CI-MATRIX.md#stage-status-and-support-status)). No compatibility run changes a status here; a status changes only by editing this table with its evidence.
+
+A status can hold for some versions only. Its cell then writes each bound as `<name> <version> or newer` or `or older`, and the validator keeps the same bounds, which a test compares with the cells. Linux x86-64 glibc is Checked for glibc 2.39 or newer and CPython 3.12.13 or newer, the lowest versions its recorded installs used (those installs used glibc 2.39 and 2.41 and CPython 3.12.13 and 3.12.15, and package tests also passed on 3.12.14); other glibc and CPython 3.12 releases at or above those bounds are taken to keep binary compatibility, which no install here has tested. A profile below a bound, such as one on RHEL 9 (glibc 2.34), on CPython 3.12.12, or on a pre-release, names the lane with `not-assessed`. macOS Apple Silicon is statically resolvable for macOS 15 or newer and not supported for macOS 14 or older. The distribution is not part of a status: a profile on another distribution with the same glibc and CPython versions copies the row's status, so a difference that only the distribution makes, such as its other system libraries, is outside the evidence. A statically resolvable Linux row has no glibc bound, although its wheels' manylinux tags set one.
+
 | Lane | Representative devices | Backend lock, binary-only | Frontend npm lock | Playwright browsers | Accelerator |
 |---|---|---|---|---|---|
-| Linux x86-64 glibc | Existing baseline | Checked (author-reported hashed-lock install with the pinned toolchain on glibc 2.41; supplemental fix-session hashed-lock install with uv 0.11.32 and CPython 3.12.13 on glibc 2.39; follow-up pinned-toolchain hashed-lock install with uv 0.12.24 and CPython 3.12.15 on glibc 2.39 at 53ac8c5; see [the checks above](#applied-baseline-and-verification)) | OK | Supported | CUDA optional (none used) |
+| Linux x86-64 glibc | Existing baseline | Checked for glibc 2.39 or newer and CPython 3.12.13 or newer (author-reported hashed-lock install with the pinned toolchain on glibc 2.41; supplemental fix-session hashed-lock install with uv 0.11.32 and CPython 3.12.13 on glibc 2.39; follow-up pinned-toolchain hashed-lock install with uv 0.12.24 and CPython 3.12.15 on glibc 2.39 at 53ac8c5; see [the checks above](#applied-baseline-and-verification)) | OK | Supported | CUDA optional (none used) |
 | Linux aarch64 glibc | NVIDIA DGX Spark (GB10: 20-core Arm CPU and Blackwell GPU; DGX OS 7.5.0, Ubuntu-based; CUDA 13.0.2 per the DGX Spark release notes), Arm servers, Linux on Snapdragon X2 (Debian support targeted for the end of 2026, Ubuntu certification in H1 2027), WSL2 on Windows on Arm | Statically resolvable: all 50 pins have a hashed wheel installable on manylinux aarch64 (11 native aarch64 wheels, 39 pure-Python wheels), and no platform-only dependency is missing | `linux-arm64-gnu` binaries present (`@next/swc`, `lightningcss`, `@tailwindcss/oxide`, `sharp`, `unrs-resolver`) | Chromium on Ubuntu 22.04/24.04/26.04 and Debian 12/13 arm64 (the Google Chrome channel is not available on Linux arm64) | CUDA on DGX Spark only |
 | Windows on Arm, native (`win_arm64`) | NVIDIA RTX Spark PCs (Arm Grace CPU and Blackwell RTX GPU on Windows on Arm; the CUDA Toolkit 13.4 developer preview adds Windows on Arm; OEM systems announced for fall 2026), Qualcomm Snapdragon X / X2 (no CUDA; CPU/GPU/NPU through QNN, ONNX Runtime and Windows ML) | Not supported: `tzdata`, which Django and psycopg require on win32, is absent from the Linux-resolved lock, and `autobahn`, `cryptography` and `psycopg-binary` have no `win_arm64` wheels | `win32-arm64-msvc` binaries present | Playwright ships only x64 browsers on Windows; they run under Prism emulation ([microsoft/playwright#40202](https://github.com/microsoft/playwright/issues/40202) was closed as not planned on 2026-05-12; Chrome for Testing has no win-arm64 build) | CUDA on RTX Spark only |
 | Windows on Arm with WSL2 (Ubuntu arm64) | Same devices | Same as Linux aarch64 glibc | OK | Linux arm64 Chromium | — |

diff --git a/docs/README.en.md b/docs/README.en.md
@@ -46,6 +46,7 @@ Technical documents for AI coding agents and contributors are written in English
 - [STATE-SCHEMA.md](STATE-SCHEMA.md): conceptual state shapes (not a database schema).
 - [TESTING.md](TESTING.md): the tests that exist today and the verification still required.
 - [DEPENDENCY-STRATEGY.md](DEPENDENCY-STRATEGY.md): the applied dependency update and its compatibility/security exceptions, plus Python 3.15 Limited API/`abi3t` wheel qualification, performance admission, and maintenance under the existing free-threading direction. Python 3.15 support remains unqualified.
+- [CI-MATRIX.md](CI-MATRIX.md): the compatibility model for CI lanes, covering profiles, run records, and what the validator checks. It records no support status.
 - [SECURITY-ARCHITECTURE.md](SECURITY-ARCHITECTURE.md): trust boundaries and the `SEC-*` security requirements.
 - [CODE-REVIEW.md](CODE-REVIEW.md), [SECURITY-REVIEW.md](SECURITY-REVIEW.md): independent code review and security review procedures for code changes.
 - [INTERACTION-INTERFACES.md](INTERACTION-INTERFACES.md), [WEBMCP.md](WEBMCP.md), [I18N.md](I18N.md): the not-yet-implemented interaction architecture, the WebMCP (experimental technology) contract, and the frontend i18n direction.

diff --git a/docs/README.ko.md b/docs/README.ko.md
@@ -46,6 +46,7 @@ AI 코딩 에이전트와 기여자를 위한 기술 문서는 영어로 작성
 - [STATE-SCHEMA.md](STATE-SCHEMA.md): 개념적 상태 모양(DB schema 아님).
 - [TESTING.md](TESTING.md): 현재 존재하는 테스트와 앞으로 필요한 검증.
 - [DEPENDENCY-STRATEGY.md](DEPENDENCY-STRATEGY.md): 적용한 의존성 업데이트와 호환성·보안 예외, 기존 free-threading 방침에 따른 Python 3.15 Limited API/`abi3t` wheel 대응, 성능 검증 및 유지보수 전략. Python 3.15 지원은 아직 미검증입니다.
+- [CI-MATRIX.md](CI-MATRIX.md): CI lane의 호환성 모델(profile, 실행 기록, validator가 검사하는 내용). 지원 상태는 기록하지 않습니다.
 - [SECURITY-ARCHITECTURE.md](SECURITY-ARCHITECTURE.md): 신뢰 경계와 `SEC-*` 보안 요구사항.
 - [CODE-REVIEW.md](CODE-REVIEW.md), [SECURITY-REVIEW.md](SECURITY-REVIEW.md): 코드 변경의 독립 리뷰와 보안 리뷰 절차.
 - [INTERACTION-INTERFACES.md](INTERACTION-INTERFACES.md), [WEBMCP.md](WEBMCP.md), [I18N.md](I18N.md): 아직 구현되지 않은 상호작용 구조, WebMCP(실험적 기술) 계약, 프런트엔드 i18n 방향.