Keep website metrics generation independent from ordinary CI queue

Author: KSemenenko

.github/workflows/AGENTS.md

@@ -60,3 +60,6 @@
 
 ## Latest completed result eligibility, 2026-10-04
 - Latest benchmark metrics means the newest completed own-main push/manual Benchmarks producer with success/failure conclusion. Pending, skipped and canceled workflows have no completed comparison cohort and MUST NOT displace ready JSON. Exclude them before choosing the latest eligible producer; then reject its missing/corrupt/failed aggregate without older fallback. A canceled workflow_run event still cannot authorize publication. This refines the latest-result rule without accepting incomplete or fabricated measurements.
+
+## Independent website queue, 2026-10-04
+- CI website generation MUST NOT wait for unrelated ordinary CI/RF3 execution from another run. Push/manual CI runs use their own run identity; PR keeps its existing ref-based cancellation. Website qualification and deployment use separate bounded job concurrency groups with cancel-in-progress=false, preserving source/latest-evidence freshness and all gates. This implements the owner-authorized independent website action without canceling database or test work.

.github/workflows/ci.yml

@@ -10,7 +10,7 @@ on:
 permissions:
   contents: read
 concurrency:
-  group: keyload-ci-${{ github.event_name == 'workflow_run' && 'site' || github.ref }}
+  group: keyload-ci-${{ github.event_name == 'workflow_run' && 'site' || github.event_name == 'pull_request' && github.ref || github.run_id }}
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 jobs:
   repository-checks:
@@ -205,6 +205,9 @@ jobs:
           if-no-files-found: error
   qualify:
     name: Check website
+    concurrency:
+      group: keyload-site-qualification
+      cancel-in-progress: false
     if: >-
       github.repository == 'managedcode/KeyLoad' && github.event.repository.id == 477801965 &&
       ((github.ref == 'refs/heads/main' &&
@@ -238,6 +241,9 @@ jobs:
         uses: ./control/.github/workflows/Features/BenchmarkComparisons/QualifySite
   deploy:
     name: Publish website
+    concurrency:
+      group: keyload-site-deployment
+      cancel-in-progress: false
     needs: qualify
     if: ${{ always() && !cancelled() && needs.qualify.result == 'success' && needs.qualify.outputs.mode == 'publish' }}
     runs-on: ubuntu-latest

AGENTS.md

@@ -459,3 +459,6 @@ A bounded website qualification candidate contains the20-project historical runt
 
 ## Latest completed result eligibility, 2026-10-04
 - Latest benchmark metrics means the newest completed own-main push/manual Benchmarks producer with success/failure conclusion. Pending, skipped and canceled workflows have no completed comparison cohort and MUST NOT displace ready JSON. Exclude them before choosing the latest eligible producer; then reject its missing/corrupt/failed aggregate without older fallback. A canceled workflow_run event still cannot authorize publication. This refines the latest-result rule without accepting incomplete or fabricated measurements.
+
+## Independent website queue, 2026-10-04
+- CI website generation MUST NOT wait for unrelated ordinary CI/RF3 execution from another run. Push/manual CI runs use their own run identity; PR keeps its existing ref-based cancellation. Website qualification and deployment use separate bounded job concurrency groups with cancel-in-progress=false, preserving source/latest-evidence freshness and all gates. This implements the owner-authorized independent website action without canceling database or test work.

docs/ADR/ADR-080-benchmark-failure-isolation.md

@@ -284,3 +284,13 @@ failure producers before selecting highest run number; the actual canceled event
 still cannot authorize publication. Preserve no-fallback rejection after the
 newest eligible producer has a failed/missing/corrupt aggregate. The original
 metadata digest is f8816dacf8a60b68a41b8911185b8c97f2e27cbd816980f1331972b929d19007.
+
+## Independent website execution queue
+
+The delivered ee7 CI push37193589875 queued behind an older ordinary CI scalar/
+recovery run under the legacy main-wide workflow group. REQ/AC-BC-FAIL-021 makes
+push/manual CI groups run-specific, retains PR ref cancellation and workflow_run
+serialization, and adds separate qualification/deployment job groups. Website
+work starts independently while all ordinary suites remain mandatory. Root owns
+this CI policy/YAML/regression join; unchanged source/latest-evidence freshness
+and false cancellation protect publication, without canceling existing tests.

docs/Features/BenchmarkComparisons.md

@@ -720,6 +720,8 @@ KeyLoad engine repair and concurrent series-codec work are outside this task.
 
 | REQ-BC-FAIL-020 latest metrics for every website build | AC-BC-FAIL-020 select the highest run-number completed own-main Benchmarks run with success/failure conclusion across push/workflow_dispatch producers; pending, skipped and canceled runs have no finished comparison cohort and are not candidates. Require success/failure producer conclusion, successful aggregate and all original270/277 proofs. Reject missing/corrupt/latest failed aggregation without older fallback. Own-main CI push/manual and workflow_run all use this selection; changed latest tuple before deploy prevents stale refresh | Real producer-selection positive/negative TUnit cases, native CI capture and freshness/provider join |
 
+| REQ-BC-FAIL-021 independent website queue | AC-BC-FAIL-021 own-main CI push/manual uses run-specific workflow concurrency so an unrelated older ordinary CI/RF3 run cannot queue the website consumer. PR retains ref cancellation; website qualify/deploy use distinct job-level serialization with cancel-in-progress=false. All tests, source/latest JSON and freshness gates remain unchanged | WorkflowLayoutCiSourceTests and actual CI job start while older ordinary source tests run |
+
 TASK-FAIL-SEPARATE-001 (root) records policy/requirements/ADR before edits.
 TASK-FAIL-SEPARATE-002 (root) removes site generation and qualify/deploy from
 Benchmarks, adds independent CI own-main push/manual and workflow_run website jobs, and prevents ordinary CI suites

docs/implementation/benchmark-json-ci-development-2026-10-04.json

@@ -267,5 +267,46 @@
     "formatPassed": true,
     "nativeCIRecheck": "pending next scoped push",
     "browserExecutedLocally": false
+  },
+  "independentWebsiteQueueFollowup": {
+    "oldQueuedCI": 37193589875,
+    "blockedByOrdinarySourceCI": 37192832065,
+    "workflowGroups": "run-specific push/manual; PR ref cancellation preserved; completed-workflow site channel preserved",
+    "websiteJobGroups": [
+      "keyload-site-qualification",
+      "keyload-site-deployment"
+    ],
+    "cancelInProgress": false,
+    "ordinaryRequiredSuitesAndAllWebsiteGatesPreserved": true,
+    "fullDevelopmentBuild": {
+      "passed": true,
+      "warnings": 0,
+      "errors": 0,
+      "logSha256": "adb249402deef8c2804582accfe5bbc820f54527024c1ee2c8ec7d72deef977e"
+    },
+    "formatPassed": true,
+    "focusedAspireUnitTests": {
+      "counts": {
+        "total": "34",
+        "executed": "34",
+        "passed": "34",
+        "failed": "0",
+        "error": "0",
+        "timeout": "0",
+        "aborted": "0",
+        "inconclusive": "0",
+        "passedButRunAborted": "0",
+        "notRunnable": "0",
+        "notExecuted": "0",
+        "disconnected": "0",
+        "warning": "0",
+        "completed": "0",
+        "inProgress": "0",
+        "pending": "0"
+      },
+      "sha256": "a078f3f0777130176bffe71592a59ce398c4b039e4ff9c32983ac1525fb6e6c6",
+      "githubQualification": false
+    },
+    "deliveredNativeRecheck": "pending scoped push"
   }
 }

docs/implementation/status.json

@@ -3814,7 +3814,8 @@
         "REQ-BC-FAIL-017",
         "REQ-BC-FAIL-018",
         "REQ-BC-FAIL-019",
-        "REQ-BC-FAIL-020"
+        "REQ-BC-FAIL-020",
+        "REQ-BC-FAIL-021"
       ],
       "ownerCorrection": "Independent static build action may follow JSON or run through CI; no benchmark Chrome/site tests; every site build uses latest completed authenticated benchmark",
       "implementation": "source_implemented_and_development_verified",
@@ -3866,6 +3867,21 @@
         "developmentBuildWarnings": 0,
         "developmentBuildErrors": 0,
         "nativeCIReverification": "pending_next_scoped_push"
+      },
+      "independentWebsiteQueue": {
+        "ordinaryPushManualGroup": "own_run_id",
+        "pullRequestCancellationPreserved": true,
+        "qualificationGroup": "keyload-site-qualification",
+        "deploymentGroup": "keyload-site-deployment",
+        "websiteCancelInProgress": false,
+        "fullDevelopmentBuildAndFormat": "passed",
+        "focusedAspireRegressions": {
+          "passed": 34,
+          "failed": 0,
+          "skipped": 0,
+          "trxSha256": "a078f3f0777130176bffe71592a59ce398c4b039e4ff9c32983ac1525fb6e6c6"
+        },
+        "nativeReverification": "pending next scoped push"
       }
     }
   }

tests/KeyLoad.UnitTests/Features/RepositoryGovernance/WorkflowLayoutCiSourceTests.cs

@@ -68,14 +68,19 @@ await Assert.That(events.Contains("workflow_run:\n    workflows: [Benchmarks]\n
     }
 
     [Test]
-    public async Task AcBcFail018IndependentWebsiteChannelRetainsQualifiedLeastPrivilegePagesDelivery()
+    public async Task AcBcFail018And021IndependentWebsiteQueueRetainsQualifiedLeastPrivilegePagesDelivery()
     {
         var ci = WorkflowLayoutSource.Read(CiFile);
-        await Assert.That(ci.Contains("group: keyload-ci-${{ github.event_name == 'workflow_run' && 'site' || github.ref }}",
+        await Assert.That(ci.Contains("group: keyload-ci-${{ github.event_name == 'workflow_run' && 'site' || github.event_name == 'pull_request' && github.ref || github.run_id }}",
             StringComparison.Ordinal)).IsTrue();
         await Assert.That(ci.Contains("cancel-in-progress: ${{ github.event_name == 'pull_request' }}",
             StringComparison.Ordinal)).IsTrue();
         var deploy = WorkflowLayoutSource.JobBlock(ci, "deploy");
+        var qualify = WorkflowLayoutSource.JobBlock(ci, "qualify");
+        await Assert.That(qualify.Contains("concurrency:\n      group: keyload-site-qualification\n      cancel-in-progress: false",
+            StringComparison.Ordinal)).IsTrue();
+        await Assert.That(deploy.Contains("concurrency:\n      group: keyload-site-deployment\n      cancel-in-progress: false",
+            StringComparison.Ordinal)).IsTrue();
         await Assert.That(deploy.Contains("needs: qualify", StringComparison.Ordinal)).IsTrue();
         await Assert.That(deploy.Contains("always() && !cancelled()", StringComparison.Ordinal)).IsTrue();
         await Assert.That(deploy.Contains("needs.qualify.result == 'success'", StringComparison.Ordinal)).IsTrue();