Move the Okapi parity suite to okapi-bridge and drop the release gate

.github/workflows/contract-audit.yml

@@ -1,17 +1,17 @@
 name: Contract Audit
 
 # Re-runs the contract-audit pipeline (Okapi @Test methods → 4-state
-# coverage view) and uploads the dashboard JSON. The audit is the
-# evolution-tolerant counterpart to parity.yml: it pins to a chosen
+# coverage view) and uploads the dashboard JSON. It pins to a chosen
 # Okapi version, runs `mvn test` against upstream Okapi to get the
 # canonical contract list, joins with native `go test -json` plus
 # `// okapi:` annotations, and renders /contract-audit on the docs
 # site.
 #
-# This job is opt-in (workflow_dispatch + scheduled). The contract
-# audit is informational, not a release gate — parity.yml remains the
-# release gate. The audit becomes a release gate later, once coverage
-# of the bowrain-critical filters reaches the agreed bar.
+# This job is opt-in (workflow_dispatch + scheduled) and informational,
+# not a release gate. It needs only upstream Okapi and this repository:
+# the okapi-bridge schema check (BRIDGE_SCHEMAS) and the head-to-head
+# parity column are not run here. Parity is reported on a schedule by
+# the okapi-bridge repository's own parity workflow.
 
 on:
   schedule:
@@ -58,13 +58,6 @@ jobs:
           git clone --depth 1 --branch "$OKAPI_REF" \
             https://gitlab.com/okapiframework/Okapi.git okapi-java
 
-      - name: Checkout okapi-bridge (spec.config schemas)
-        uses: actions/checkout@v7
-        with:
-          repository: neokapi/okapi-bridge
-          path: okapi-bridge
-          fetch-depth: 1
-
       - name: Set up Java 17
         uses: actions/setup-java@v6
         with:
@@ -107,7 +100,6 @@ jobs:
         working-directory: neokapi
         env:
           OKAPI_REPO: ${{ github.workspace }}/okapi-java
-          BRIDGE_SCHEMAS: ${{ github.workspace }}/okapi-bridge/schemas
           # Drift checking: a `// okapi: ClassName#methodName` annotation
           # whose Java target no longer exists in the pinned upstream
           # version is a contract bug — the dashboard would silently
@@ -119,7 +111,7 @@ jobs:
           mkdir -p .contract-audit
           for filter in $(echo "$FILTERS" | tr ',' ' '); do
             echo "::group::contract-audit $filter"
-            make contract-audit CONTRACT_FILTER="$filter" OKAPI_REPO="$OKAPI_REPO" BRIDGE_SCHEMAS="$BRIDGE_SCHEMAS" CONTRACT_FAIL_ON_DRIFT="$CONTRACT_FAIL_ON_DRIFT"
+            make contract-audit CONTRACT_FILTER="$filter" OKAPI_REPO="$OKAPI_REPO" CONTRACT_FAIL_ON_DRIFT="$CONTRACT_FAIL_ON_DRIFT"
             echo "::endgroup::"
           done
 

.github/workflows/release-bowrain.yml

@@ -63,44 +63,6 @@ jobs:
             echo "prerelease=$pre"
           } >> "$GITHUB_OUTPUT"
 
-  # Verify the parity workflow (#448) succeeded for the tagged commit before any
-  # release artifact is built or published. Mirrors release.yml's gate.
-  parity-gate:
-    name: Parity Gate (#448)
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      actions: read
-    steps:
-      - name: Verify parity workflow status for tagged commit
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          REPO: ${{ github.repository }}
-          SHA: ${{ github.sha }}
-        run: |
-          set -euo pipefail
-          echo "Looking up parity workflow status for ${REPO}@${SHA}..."
-          # Consider ALL parity runs for this commit, not just the most recent:
-          # the gate passes if ANY of them succeeded. This is robust to a second
-          # (e.g. manually-dispatched) parity run being in-flight or failed while
-          # an earlier run already passed for the same SHA — picking only
-          # workflow_runs[0] would spuriously block the release.
-          runs=$(gh api \
-            "repos/${REPO}/actions/workflows/parity.yml/runs?head_sha=${SHA}&per_page=50" \
-            --jq '[.workflow_runs[] | .status+":"+(.conclusion//"none")]')
-          echo "Parity runs for ${SHA}: ${runs}"
-          successes=$(echo "$runs" | grep -c '"completed:success"' || true)
-          inflight=$(echo "$runs" | grep -cE '"(queued|in_progress|requested|waiting|pending):' || true)
-          if [ "$successes" -gt 0 ]; then
-            echo "Parity gate passed (a successful parity run exists for ${SHA})."
-          elif [ "$inflight" -gt 0 ]; then
-            echo "::error::Parity is still running for ${SHA} and none has succeeded yet. Wait for it to finish, then re-run this job."
-            exit 1
-          else
-            echo "::error::No successful parity run for ${SHA}. Run parity.yml against this commit (it succeeds on push for core changes; otherwise 'gh workflow run parity.yml --ref main') before releasing."
-            exit 1
-          fi
-
   # Build the kapi-bowrain plugin binary natively per OS/arch with cgo +
   # statically-linked ICU + the fts5 tag, matching the framework the desktop
   # apps use. Mirrors release.yml's build-cli, but builds ONLY kapi-bowrain (the
@@ -109,7 +71,7 @@ jobs:
   # as in the former combined workflow).
   build-bowrain-cli:
     name: Build kapi-bowrain (${{ matrix.target.goos }}/${{ matrix.target.goarch }})
-    needs: [setup, parity-gate]
+    needs: [setup]
     env:
       REF_NAME: ${{ needs.setup.outputs.tag }}
     strategy:
@@ -251,7 +213,7 @@ jobs:
   # plugin only — no deb/rpm, no apt/yum, no cli.json.
   package-bowrain-cli:
     name: Package + publish kapi-bowrain
-    needs: [setup, parity-gate, build-bowrain-cli]
+    needs: [setup, build-bowrain-cli]
     runs-on: ubuntu-latest
     # Coordinated releases route this publish job through a manual-approval
     # environment so the bowrain tap/registry writes land together with kapi's.
@@ -614,7 +576,7 @@ jobs:
 
   build-bowrain:
     name: Build Bowrain (${{ matrix.build.platform }})
-    needs: [setup, parity-gate]
+    needs: [setup]
     env:
       REF_NAME: ${{ needs.setup.outputs.tag }}
     strategy:

.github/workflows/release.yml

@@ -65,51 +65,6 @@ jobs:
             echo "prerelease=$pre"
           } >> "$GITHUB_OUTPUT"
 
-  # Verify the parity workflow (#448) succeeded for the tagged commit
-  # before any release artifact is built or published. Parity runs on
-  # every push to main, so the result is normally already cached by the
-  # time a release tag is pushed.
-  #
-  # If parity has not run for the tagged commit (e.g. the commit only
-  # touched paths excluded from the parity workflow's paths-filter),
-  # this gate fails closed: pre-release work for #448 explicitly
-  # requires the parity report to be fresh for every release.
-  parity-gate:
-    name: Parity Gate (#448)
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      actions: read
-    steps:
-      - name: Verify parity workflow status for tagged commit
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          REPO: ${{ github.repository }}
-          SHA: ${{ github.sha }}
-        run: |
-          set -euo pipefail
-          echo "Looking up parity workflow status for ${REPO}@${SHA}..."
-          # Consider ALL parity runs for this commit, not just the most recent:
-          # the gate passes if ANY of them succeeded. This is robust to a second
-          # (e.g. manually-dispatched) parity run being in-flight or failed while
-          # an earlier run already passed for the same SHA — picking only
-          # workflow_runs[0] would spuriously block the release.
-          runs=$(gh api \
-            "repos/${REPO}/actions/workflows/parity.yml/runs?head_sha=${SHA}&per_page=50" \
-            --jq '[.workflow_runs[] | .status+":"+(.conclusion//"none")]')
-          echo "Parity runs for ${SHA}: ${runs}"
-          successes=$(echo "$runs" | grep -c '"completed:success"' || true)
-          inflight=$(echo "$runs" | grep -cE '"(queued|in_progress|requested|waiting|pending):' || true)
-          if [ "$successes" -gt 0 ]; then
-            echo "Parity gate passed (a successful parity run exists for ${SHA})."
-          elif [ "$inflight" -gt 0 ]; then
-            echo "::error::Parity is still running for ${SHA} and none has succeeded yet. Wait for it to finish, then re-run this job."
-            exit 1
-          else
-            echo "::error::No successful parity run for ${SHA}. Run parity.yml against this commit (it succeeds on push for core changes; otherwise 'gh workflow run parity.yml --ref main') before releasing."
-            exit 1
-          fi
-
   # Build the kapi CLI binary natively per OS/arch with cgo + statically-linked
   # ICU + the fts5 tag, so it matches the framework the desktop apps use (native
   # mattn SQLite + ICU FTS5 tokenizer + UAX-29). cgo rules out single-runner
@@ -130,7 +85,7 @@ jobs:
   # ICU archive names) legs are expected to need CI iteration.
   build-cli:
     name: Build CLI (${{ matrix.target.goos }}/${{ matrix.target.goarch }})
-    needs: [setup, parity-gate]
+    needs: [setup]
     env:
       REF_NAME: ${{ needs.setup.outputs.tag }}
     strategy:
@@ -339,7 +294,7 @@ jobs:
   # manifest-plugins.json registration are produced by release-bowrain.yml.
   package-cli:
     name: Package + publish CLI
-    needs: [setup, parity-gate, build-cli]
+    needs: [setup, build-cli]
     runs-on: ubuntu-latest
     outputs:
       # make_latest for the desktop uploads in build-kapi-desktop.

.gitignore

@@ -245,7 +245,6 @@ website/videos/public/raw/
 .env.local
 platform/docker/traefik/certs
 .playwright-mcp/
-.parity/
 .contract-audit/
 
 # Generated kapi/bowrain skill copies. The canonical source is host/skills/data/
@@ -345,3 +344,6 @@ packaging/.stage/
 /*.jpeg
 /*.webp
 .vitest/
+
+# The okapi-bridge parity report the format-ops parity-publish ritual downloads.
+.parity/

.golangci.yml

@@ -1,14 +1,13 @@
 version: "2"
 run:
   timeout: 5m
-  # Analyze the code behind these build constraints too — without them the
-  # FTS5 content memory path, the cgo ICU tokenizer, and the parity harness are silently
-  # excluded from staticcheck/govet/errcheck. The cgo files additionally need
-  # pkg-config icu-uc/icu-i18n on PKG_CONFIG_PATH (the lint CI job installs
-  # libicu-dev, mirroring the test job).
+  # Analyze the code behind this build constraint too — without it the FTS5
+  # content memory path and the cgo ICU tokenizer are silently excluded from
+  # staticcheck/govet/errcheck. The cgo files additionally need pkg-config
+  # icu-uc/icu-i18n on PKG_CONFIG_PATH (the lint CI job installs libicu-dev,
+  # mirroring the test job).
   build-tags:
     - fts5
-    - parity
 linters:
   enable:
     - errorlint