ci: parallelize tests and cleanup setup

.github/workflows/ci.yml

@@ -11,10 +11,37 @@ permissions:
   contents: read
 
 jobs:
-  smoke:
-    name: Lint, build, and KERIA smoke tests
+  static:
+    name: Static app checks
     runs-on: ubuntu-latest
-    timeout-minutes: 45
+    timeout-minutes: 20
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 10.33.0
+          run_install: false
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+          cache: pnpm
+
+      - name: Install Node dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Run static app checks
+        run: pnpm ci:static
+
+  live:
+    name: Live KERIA smoke
+    runs-on: ubuntu-latest
+    timeout-minutes: 35
 
     env:
       KERIPY_BRANCH: v1.2.13
@@ -78,8 +105,8 @@ jobs:
       - name: Start KERIA and demo witnesses
         run: scripts/ci/start-keri-stack.sh
 
-      - name: Run CI test suite
-        run: pnpm test:ci
+      - name: Run live KERIA smoke
+        run: pnpm ci:live
 
       - name: Upload KERIA stack logs
         if: always()

.gitignore

@@ -10,4 +10,5 @@ dist/
 coverage/*
 
 .cache/
+.ci/
 .smoke-artifacts/

docs/ci.md

@@ -1,13 +1,27 @@
 # CI
 
-The repository uses GitHub Actions to run the Signify boundary smoke tests
-and scenario tests against a real local KERIA stack.
+The repository uses GitHub Actions to run fast static app checks separately
+from the Signify boundary smoke tests that need a real local KERIA stack.
 
 Workflow: `.github/workflows/ci.yml`
 
-## What CI Runs
+## Required Jobs
 
-The main CI job:
+### Static app checks
+
+The static app job is Node-only and runs:
+
+```bash
+pnpm ci:static
+```
+
+That script runs lint, production build, and the unit suite. Unit tests use
+`vitest.unit.config.ts` so pure unit files can run in parallel without changing
+the serial policy used by live KERIA scenarios.
+
+### Live KERIA smoke
+
+The live KERIA job:
 
 1. installs system dependencies needed by KERIpy, currently `libsodium-dev`,
 2. sets up Python 3.12.8,
@@ -17,27 +31,48 @@ The main CI job:
 6. installs pinned KERIpy and KERIA from GitHub commits,
 7. starts local KERI demo witnesses,
 8. starts local KERIA,
-9. runs `pnpm test:ci`,
+9. runs `pnpm ci:live`,
 10. uploads KERIA/witness logs on success or failure.
 
-`pnpm test:ci` currently runs:
+`pnpm ci:live` currently runs:
 
 ```bash
-pnpm lint
-pnpm build
 pnpm keria:smoke -- --mode connect
 pnpm keria:smoke
-pnpm scenario:test
-pnpm browser:smoke
+pnpm scenario:ci
+pnpm browser:ci-smoke
 ```
 
-Future tests that require the same local KERIA stack should be added to
-`test:ci` or called from that script.
+`pnpm test:ci` remains as a local parity wrapper for developers who want the
+same static and live checks in one command:
+
+```bash
+pnpm ci:static && pnpm ci:live
+```
+
+Future required checks that need the same local KERIA stack should be added to
+`ci:live` or a script it calls. Do not append broad/manual suites to required
+CI unless they protect an active change.
+
+`pnpm scenario:ci` is the required live scenario subset. It keeps one
+two-member multisig canary for invitation, acceptance, interaction, and
+rotation, but leaves the full multisig matrix in `pnpm multisig:test`.
+
+`pnpm scenario:test` runs the broader top-level scenario files for manual or
+pre-merge confidence. Optional schema and external-fixture scenarios live under
+`tests/scenarios/optional` and are available through `pnpm scenario:test:all`,
+where they skip unless their required config is present.
+
+The W3C holder presentation smoke is intentionally not part of required PR CI.
+It attaches to a pre-seeded live W3C stack with W3C-enabled KERIA and live
+verifier services:
+
+```bash
+pnpm w3c:holder-presentation:smoke
+```
 
-`pnpm scenario:test` runs only the top-level scenario test files. Optional
-schema and external-fixture scenarios live under `tests/scenarios/optional` and
-are available through `pnpm scenario:test:all`, where they skip unless their
-required config is present.
+If this smoke becomes automated, pin KERIA and any cross-repo stack inputs by
+immutable SHAs, not floating branches.
 
 ## Pinned Python Stack
 

docs/smoke-tests.md

@@ -42,9 +42,11 @@ admin and boot APIs work without involving witnesses or browser automation.
 CI runs all smoke checks through:
 
 ```bash
-pnpm test:ci
+pnpm ci:live
 ```
 
+Run `pnpm test:ci` to execute both static and live required checks locally.
+
 See [CI](./ci.md) for the GitHub Actions service setup and pinned KERIpy/KERIA
 versions.
 
@@ -65,6 +67,7 @@ The smoke-test stack has one shared smoke module and two executable wrappers.
 | --------------- | ------------------------------------ | ------------------------------------------------------------------------------------------------------------------- |
 | Shared smoke    | `tests/smoke/clientBoundarySmoke.ts` | Boots/connects through the Signify boundary, reads client state, and optionally creates a witnessed identifier.     |
 | CLI wrapper     | `scripts/keria-smoke.ts`             | Parses process args, calls the shared smoke module, and prints JSON.                                                |
+| Required browser wrapper | `tests/browser-ci-smoke.ts` | Runs the compact required browser path: layout, connect, identifier table, and contact/OOBI notification payload. |
 | Browser wrapper | `tests/browser-smoke.ts`             | Starts or reuses Vite, drives the React UI with Puppeteer, and verifies the client summary.                         |
 | Contact OOBI smoke | `tests/contact-oobi-smoke.ts` | Resolves harness and witness OOBIs through the React Contacts UI and verifies operation/notification payload links. |
 | Contact challenge smoke | `tests/contact-challenge-smoke.ts` | Exercises browser challenge generation, harness response, synthetic challenge notifications, detail response, and bell response. |

package.json

@@ -7,24 +7,28 @@
     "scripts": {
         "dev": "vite",
         "build": "npx tsc && vite build",
-        "lint": "eslint src tests scripts eslint.config.mjs vite.config.ts vitest.config.ts --max-warnings 0",
+        "lint": "eslint src tests scripts eslint.config.mjs vite.config.ts vitest.config.ts vitest.unit.config.ts --max-warnings 0",
         "preview": "vite preview",
         "keria:smoke": "tsx scripts/keria-smoke.ts",
         "contact:ui-smoke": "tsx tests/contact-oobi-smoke.ts",
         "contact:challenge-smoke": "tsx tests/contact-challenge-smoke.ts",
         "identifier-agent-oobi:smoke": "tsx tests/identifier-agent-oobi-smoke.ts",
         "browser:smoke": "tsx tests/browser-smoke.ts",
+        "browser:ci-smoke": "tsx tests/browser-ci-smoke.ts",
         "w3c:holder-presentation:smoke": "node tests/w3c-holder-presentation-smoke.mjs",
         "responsive:smoke": "tsx tests/responsive-smoke.ts",
-        "unit:test": "vitest run tests/unit",
+        "unit:test": "vitest run --config vitest.unit.config.ts tests/unit",
         "multisig:test": "vitest run tests/scenarios/multisig.test.ts tests/scenarios/multisig-interaction.test.ts",
+        "scenario:ci": "vitest run tests/scenarios/challenge.test.ts tests/scenarios/credentials.test.ts tests/scenarios/multisig-ci.test.ts",
         "scenario:test": "vitest run tests/scenarios/salty.test.ts tests/scenarios/randy.test.ts tests/scenarios/witnessed.test.ts tests/scenarios/challenge.test.ts tests/scenarios/controller-rotation.test.ts tests/scenarios/oobi-contacts.test.ts tests/scenarios/credentials.test.ts tests/scenarios/multisig.test.ts tests/scenarios/multisig-interaction.test.ts",
         "delegation:test": "vitest run tests/scenarios/optional/delegation.test.ts",
         "scenario:test:all": "vitest run tests/scenarios",
         "portable:wallet-api": "vitest run tests/scenarios/challenge.test.ts tests/scenarios/credentials.test.ts tests/scenarios/multisig.test.ts tests/scenarios/multisig-interaction.test.ts tests/scenarios/optional/delegation.test.ts",
         "portable:wallet-browser": "pnpm browser:smoke && pnpm responsive:smoke && tsx tests/contact-challenge-smoke.ts",
         "portable:e2e": "pnpm portable:wallet-api && pnpm portable:wallet-browser",
-        "test:ci": "pnpm lint && pnpm build && pnpm unit:test && pnpm responsive:smoke && pnpm keria:smoke -- --mode connect && pnpm keria:smoke && pnpm scenario:test && pnpm contact:ui-smoke && pnpm browser:smoke"
+        "ci:static": "pnpm lint && pnpm build && pnpm unit:test",
+        "ci:live": "pnpm keria:smoke -- --mode connect && pnpm keria:smoke && pnpm scenario:ci && pnpm browser:ci-smoke",
+        "test:ci": "pnpm ci:static && pnpm ci:live"
     },
     "engines": {
         "node": ">=20.19.0"

scripts/ci/start-keri-stack.sh

@@ -99,7 +99,7 @@ socket_wait 127.0.0.1 3903 "KERIA boot API"
 echo "Starting vLEI schema server"
 (
   cd "$ROOT_DIR"
-  exec vLEI-server \
+  exec python -m vlei.server \
     --http 7723 \
     --schema-dir "$SCHEMA_DIR" \
     --cred-dir "$CREDENTIAL_DIR" \