diff --git a/.agents/skills/ship/SKILL.md b/.agents/skills/ship/SKILL.md
index fdd7e52ad4f..74101b647c5 100644
--- a/.agents/skills/ship/SKILL.md
+++ b/.agents/skills/ship/SKILL.md
@@ -47,7 +47,7 @@ When the user runs `/ship`:
   - Run `/db-migrate` to review the migration for zero-downtime safety (expand/contract phasing, backward-compatibility with the deployed app version).
   - `(cd packages/db && bunx drizzle-kit generate && git status --porcelain ./migrations)` must print nothing (CI's schema/migration sync step).
   - `bun run check:migrations origin/staging` must pass (staging is the PR base). Do not silence a flagged statement with a `-- migration-safe:` annotation unless `/db-migrate` confirmed the old code no longer depends on it; otherwise split the destructive change into a later deploy.
-6. **Run pre-ship checks** from the repo root before staging. This has two phases: first **regenerate** every committed artifact so generated files never drift into a CI failure (this is what catches things like `agent-stream-docs` going stale after a `models.ts` edit), then run the **full audit suite** CI's `Lint and Test` job enforces. Both phases parallelize — but only across commands that write **disjoint** outputs — and a bare `wait` swallows child exit codes, so both phases below explicitly collect each job's status and abort ship if any failed.
+6. **Run pre-ship checks** from the repo root before staging. This has two phases: first **regenerate** every committed artifact so generated files never drift into a CI failure (this is what catches things like `agent-stream-docs` going stale after a `models.ts` edit), then run the **full audit suite** CI's `lint` job enforces. Both phases parallelize — but only across commands that write **disjoint** outputs — and a bare `wait` swallows child exit codes, so both phases below explicitly collect each job's status and abort ship if any failed.
 
   **Phase A — regenerate the always-in-repo committed artifacts (parallel), then let step 7 stage whatever changed.** Regenerate only the generators whose inputs live entirely in this repo and that any ordinary code change can drift — `agent-stream-docs:generate` (derives from the provider model registry), `docs-manifest:generate` (derives from docs page paths), and `skills:sync` (derives from `.agents/skills/**`). They write disjoint outputs (`apps/docs/…/agent.mdx`, `apps/sim/lib/mothership/generated/docs-manifest.ts`, and `.claude/skills` links), so they parallelize safely, and each is idempotent (a no-op when already in sync):
   ```bash
@@ -66,7 +66,7 @@ When the user runs `/ship`:
 
   **Do NOT blanket-run the domain generators here.** `mship:generate` (`generate-mship-contracts.ts`) is an **umbrella** that drives all nine mothership contract generators (`mship-contracts`, `billing-protocol-contract`, `mship-tools`, the four `trace-*`, `metrics-contract`, `vfs-snapshot-contract`) and biome-formats `apps/sim/lib/mothership/generated/` — never run it *and* its constituents (they write the same files and corrupt each other in parallel), and never run it on an ordinary ship: it reads an **external** copilot-contract source that isn't checked out in most worktrees, so it hard-fails with `ENOENT` and would abort ship for an unrelated reason. `generate:pi-model-catalog` (under `apps/sim`) likewise regenerates from the installed Pi package, not repo source. `scripts/generate-docs.ts` rewrites the integration docs and client-safe catalog; run it when this PR changes their block/icon/landing-content inputs or when `integration-catalog:check` reports drift, then review its broad generated diff. Only when **this PR's diff actually touches** a domain generator's input do you regenerate it deliberately and run its matching `:check` (`bun run mship:check` / the individual `*:check`) — with the external source present.
 
-  **Phase B — run lint + every audit CI enforces, in parallel, and abort ship if any fails.** Before running the commands, compare this list with `.github/workflows/test-build.yml`; when CI adds an audit, run it and update this skill instead of trusting a stale snapshot. The env-flag audit is currently an inline workflow block rather than a package script: when `apps/sim/lib/core/config/env-flags.ts` changed, run that current workflow block verbatim instead of copying a second version into this skill. Run `bun run lint` first (it autofixes formatting and mutates files, so don't parallelize it with the read-only audits), then run the base-sensitive block-registry check, then fan the independent audits out and collect exit codes:
+  **Phase B — run lint + every audit CI enforces, in parallel, and abort ship if any fails.** Before running the commands, compare this list with `.github/workflows/checks.yml`; when CI adds an audit, run it and update this skill instead of trusting a stale snapshot. The env-flag audit is currently an inline workflow block rather than a package script: when `apps/sim/lib/core/config/env-flags.ts` changed, run that current workflow block verbatim instead of copying a second version into this skill. Run `bun run lint` first (it autofixes formatting and mutates files, so don't parallelize it with the read-only audits), then run the base-sensitive block-registry check, then fan the independent audits out and collect exit codes:
   ```bash
   # autofix formatting first (mutating; not parallel-safe with the audits). Gate its exit too —
   # a non-zero lint (unfixable errors) must abort before the audits run, not be ignored.
diff --git a/.claude/rules/sim-testing.md b/.claude/rules/sim-testing.md
index dbbb381daac..95881561a31 100644
--- a/.claude/rules/sim-testing.md
+++ b/.claude/rules/sim-testing.md
@@ -32,11 +32,11 @@ contracts, and demonstrated regressions.
 
 | Suffix | Needs | Run with | In CI |
 |--------|-------|----------|-------|
-| `*.test.ts(x)` | nothing; global mocks from `vitest.setup.ts` | `vitest run` | Lint and Test job |
-| `*.integration.ts` | real PostgreSQL (`TEST_DATABASE_URL`), optionally Redis (`TEST_REDIS_URL`) | `vitest run --mode integration` | `PostgreSQL integration` job, by glob |
+| `*.test.ts(x)` | nothing; global mocks from `vitest.setup.ts` | `vitest run` | `test` jobs (sharded) |
+| `*.integration.ts` | real PostgreSQL (`TEST_DATABASE_URL`), optionally Redis (`TEST_REDIS_URL`) | `vitest run --mode integration` | `integration` jobs, by glob (sharded per provisioning path) |
 | `*.live.test.ts` | provider APIs, hosted sandboxes, local runtimes, or sibling checkouts | `vitest run --mode live <file>` (apps/sim) | never |
 | `apps/desktop/e2e/*.spec.ts` | the packaged Electron app | Playwright | desktop E2E workflow |
-| `apps/sim/scripts/test-*-e2e.ts` | a running app over HTTP | its `package.json` script when one exists (`bun run test:scim:e2e`; `test:workflow-version-compare:e2e` adds `--no-env-file`), else `bun scripts/test-<suite>-e2e.ts` from apps/sim | End-to-end over real HTTP job |
+| `apps/sim/scripts/test-*-e2e.ts` | a running app over HTTP | its `package.json` script when one exists (`bun run test:scim:e2e`; `test:workflow-version-compare:e2e` adds `--no-env-file`), else `bun scripts/test-<suite>-e2e.ts` from apps/sim | `e2e` jobs (`.github/scripts/http-e2e.sh`) |
 
 - A unit test lives next to its source: `feature.ts` → `feature.test.ts`. No network, no database,
   no real timers.
diff --git a/.cursor/rules/sim-testing.mdc b/.cursor/rules/sim-testing.mdc
index e4cc023d9f4..75197fc8a0e 100644
--- a/.cursor/rules/sim-testing.mdc
+++ b/.cursor/rules/sim-testing.mdc
@@ -30,11 +30,11 @@ contracts, and demonstrated regressions.
 
 | Suffix | Needs | Run with | In CI |
 |--------|-------|----------|-------|
-| `*.test.ts(x)` | nothing; global mocks from `vitest.setup.ts` | `vitest run` | Lint and Test job |
-| `*.integration.ts` | real PostgreSQL (`TEST_DATABASE_URL`), optionally Redis (`TEST_REDIS_URL`) | `vitest run --mode integration` | `PostgreSQL integration` job, by glob |
+| `*.test.ts(x)` | nothing; global mocks from `vitest.setup.ts` | `vitest run` | `test` jobs (sharded) |
+| `*.integration.ts` | real PostgreSQL (`TEST_DATABASE_URL`), optionally Redis (`TEST_REDIS_URL`) | `vitest run --mode integration` | `integration` jobs, by glob (sharded per provisioning path) |
 | `*.live.test.ts` | provider APIs, hosted sandboxes, local runtimes, or sibling checkouts | `vitest run --mode live <file>` (apps/sim) | never |
 | `apps/desktop/e2e/*.spec.ts` | the packaged Electron app | Playwright | desktop E2E workflow |
-| `apps/sim/scripts/test-*-e2e.ts` | a running app over HTTP | its `package.json` script when one exists (`bun run test:scim:e2e`; `test:workflow-version-compare:e2e` adds `--no-env-file`), else `bun scripts/test-<suite>-e2e.ts` from apps/sim | End-to-end over real HTTP job |
+| `apps/sim/scripts/test-*-e2e.ts` | a running app over HTTP | its `package.json` script when one exists (`bun run test:scim:e2e`; `test:workflow-version-compare:e2e` adds `--no-env-file`), else `bun scripts/test-<suite>-e2e.ts` from apps/sim | `e2e` jobs (`.github/scripts/http-e2e.sh`) |
 
 - A unit test lives next to its source: `feature.ts` → `feature.test.ts`. No network, no database,
   no real timers.
diff --git a/.github/actions/cache-mount/action.yml b/.github/actions/cache/action.yml
similarity index 98%
rename from .github/actions/cache-mount/action.yml
rename to .github/actions/cache/action.yml
index df0de0b106c..5d29c00565e 100644
--- a/.github/actions/cache-mount/action.yml
+++ b/.github/actions/cache/action.yml
@@ -1,4 +1,4 @@
-name: Cache Mount
+name: cache
 description: Mount a build cache directory using Blacksmith sticky disks, or the GitHub Actions cache when running on GitHub-hosted runners.
 
 inputs:
diff --git a/.github/actions/docker-build/action.yml b/.github/actions/image/action.yml
similarity index 99%
rename from .github/actions/docker-build/action.yml
rename to .github/actions/image/action.yml
index 7a880bc768c..950623c4b18 100644
--- a/.github/actions/docker-build/action.yml
+++ b/.github/actions/image/action.yml
@@ -1,4 +1,4 @@
-name: Docker Build and Push
+name: image
 description: Set up a buildx builder and build/push an image, using Blacksmith's builder or the upstream Docker actions on GitHub-hosted runners.
 
 inputs:
@@ -35,7 +35,7 @@ inputs:
     required: false
 
 # Registry logins must precede this action. provenance/sbom stay off: attestation
-# manifests break `imagetools create` retagging in promote-images.
+# manifests break `imagetools create` retagging in the `promote` job of ci.yml.
 runs:
   using: composite
   steps:
diff --git a/.github/actions/setup-workspace/action.yml b/.github/actions/setup/action.yml
similarity index 77%
rename from .github/actions/setup-workspace/action.yml
rename to .github/actions/setup/action.yml
index b6e2e48fdf2..889de90d65a 100644
--- a/.github/actions/setup-workspace/action.yml
+++ b/.github/actions/setup/action.yml
@@ -1,15 +1,23 @@
-name: Setup Workspace
+name: setup
 description: Install the pinned Bun and Node toolchain, mount the dependency (and optionally Turbo) caches, and install workspace dependencies.
 
 inputs:
   provider:
-    description: The CI_PROVIDER repo variable, forwarded to cache-mount.
+    description: The CI_PROVIDER repo variable, forwarded to the cache action.
     required: false
     default: ''
   turbo-cache-key:
     description: Suffix for a Turbo cache mounted at ./.turbo. Empty skips the mount. Jobs that write Turbo entries need distinct suffixes, or last-writer-wins commits evict each other's entries.
     required: false
     default: ''
+  node-version:
+    description: Node version to install. Empty keeps the runner's preinstalled Node, for jobs that only ever ran Bun.
+    required: false
+    default: '24'
+  registry-url:
+    description: npm registry to write an .npmrc for, so `npm publish` reads NODE_AUTH_TOKEN. Empty writes none.
+    required: false
+    default: ''
 
 # Cache keys are scoped by event name, and fork PRs get their own namespace on
 # top: untrusted fork runs must never share a cache with push runs (whose caches
@@ -30,19 +38,21 @@ runs:
         bun-version: 1.4.2
 
     - name: Setup Node
+      if: inputs.node-version != ''
       uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
       with:
-        node-version: 24
+        node-version: ${{ inputs.node-version }}
+        registry-url: ${{ inputs.registry-url }}
 
     - name: Mount Bun cache
-      uses: ./.github/actions/cache-mount
+      uses: ./.github/actions/cache
       with:
         provider: ${{ inputs.provider }}
         key: ${{ github.repository }}-bun-cache-${{ github.event_name }}${{ github.event.pull_request.head.repo.fork && '-fork' || '' }}
         path: ~/.bun/install/cache
 
     - name: Mount node_modules
-      uses: ./.github/actions/cache-mount
+      uses: ./.github/actions/cache
       with:
         provider: ${{ inputs.provider }}
         key: ${{ github.repository }}-node-modules-${{ github.event_name }}${{ github.event.pull_request.head.repo.fork && '-fork' || '' }}-${{ hashFiles('bun.lock') }}
@@ -50,7 +60,7 @@ runs:
 
     - name: Mount Turbo cache
       if: inputs.turbo-cache-key != ''
-      uses: ./.github/actions/cache-mount
+      uses: ./.github/actions/cache
       with:
         provider: ${{ inputs.provider }}
         key: ${{ github.repository }}-${{ inputs.turbo-cache-key }}-${{ github.event_name }}${{ github.event.pull_request.head.repo.fork && '-fork' || '' }}
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 00000000000..30fba8a2d88
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,19 @@
+version: 2
+
+# GitHub Actions only: every `uses:` is pinned to a commit SHA, and without this the pins drift
+# apart (checkout had three different SHAs across workflows). One grouped PR a week keeps every
+# workflow and composite action on the same version of each action.
+updates:
+  - package-ecosystem: github-actions
+    directories:
+      - /
+      - /.github/actions/*
+    schedule:
+      interval: weekly
+    target-branch: staging
+    groups:
+      actions:
+        patterns:
+          - '*'
+    commit-message:
+      prefix: ci
diff --git a/.github/scripts/http-e2e.sh b/.github/scripts/http-e2e.sh
new file mode 100755
index 00000000000..202a9a2f2a2
--- /dev/null
+++ b/.github/scripts/http-e2e.sh
@@ -0,0 +1,157 @@
+#!/usr/bin/env bash
+# Runs one end-to-end suite group over real HTTP, each against its own `next dev` app.
+#
+# Usage: http-e2e.sh <scim|cli|stop-after|desktop-inbox>   (run from apps/sim)
+#
+# The job provides DATABASE_URL, BETTER_AUTH_SECRET and ENCRYPTION_KEY; each group sets the rest of
+# its app's environment here. Reports and server logs land in $RUNNER_TEMP/e2e.
+#
+# The first request cold-compiles the app under Turbopack, which takes 42-150s on CI runners, so
+# the readiness deadline only has to catch a hung boot: an exited server fails immediately, and
+# either way the server log tail lands in the job log.
+#
+# Each app starts from an empty Turbopack dev cache: a cache written under other NEXT_PUBLIC_*
+# values, by a server that `next dev` SIGKILLs 100ms after SIGTERM, can panic Turbopack or wedge a
+# route compile on restore. It runs in its own session under an E2E_APP tag, and stop-session.sh
+# returns only once every process in that session or carrying that tag has exited (Next's
+# telemetry flush runs detached and still writes .next/dev).
+set -euo pipefail
+
+group=${1:?usage: http-e2e.sh <scim|cli|stop-after|desktop-inbox>}
+report_dir="$RUNNER_TEMP/e2e"
+ready_timeout_seconds=300
+mkdir -p "$report_dir"
+
+server_pid=''
+app_tag=''
+server_log=''
+status_log=''
+
+finish() {
+  local status=$?
+  if [ -n "$server_pid" ]; then
+    bash "$GITHUB_WORKSPACE/.github/scripts/stop-session.sh" "$server_pid" "$app_tag" || status=1
+    wait "$server_pid" 2>/dev/null || true
+    if [ -n "$status_log" ]; then
+      awk '/^ (GET|POST|PUT|PATCH|DELETE|HEAD) \/api\// { print }' "$server_log" > "$status_log"
+    fi
+    if [ "$status" -ne 0 ]; then
+      tail -n 200 "$server_log"
+    fi
+  fi
+  exit "$status"
+}
+trap finish EXIT
+
+# start_app <name> <port> <label> [record-http-status]
+start_app() {
+  local name=$1 port=$2 label=$3
+  server_log="$report_dir/$name-next.log"
+  if [ "${4:-}" = record-http-status ]; then
+    status_log="$report_dir/$name-http-status.log"
+  fi
+  app_tag="$name-$GITHUB_RUN_ID-$GITHUB_RUN_ATTEMPT-$$"
+  export NEXT_PUBLIC_APP_URL="http://127.0.0.1:$port"
+  export BETTER_AUTH_URL="$NEXT_PUBLIC_APP_URL"
+  export DISABLE_TELEMETRY=true NEXT_TELEMETRY_DISABLED=1
+  rm -rf .next/dev
+  E2E_APP="$app_tag" setsid node ../../node_modules/next/dist/bin/next dev --hostname 127.0.0.1 \
+    --port "$port" > "$server_log" 2>&1 &
+  server_pid=$!
+
+  local started=$SECONDS
+  until curl --fail --silent --max-time 10 "$NEXT_PUBLIC_APP_URL/api/health" > /dev/null; do
+    if ! kill -0 "$server_pid" 2>/dev/null; then
+      echo "::error::Local $label app exited during startup."
+      exit 1
+    fi
+    if [ $((SECONDS - started)) -ge "$ready_timeout_seconds" ]; then
+      echo "::error::Local $label app did not become ready within $ready_timeout_seconds seconds."
+      exit 1
+    fi
+    sleep 2
+  done
+  echo "Local $label app ready after $((SECONDS - started))s"
+}
+
+case "$group" in
+  scim)
+    export NEXT_PUBLIC_FORCE_HOSTED=true
+    export BILLING_ENABLED=true NEXT_PUBLIC_BILLING_ENABLED=true
+    export ENTERPRISE_ENABLED=true NEXT_PUBLIC_ENTERPRISE_ENABLED=true
+    export SCIM_ENABLED=true NEXT_PUBLIC_SCIM_ENABLED=true
+    export SSO_ENABLED=true NEXT_PUBLIC_SSO_ENABLED=true
+    export ORGANIZATIONS_ENABLED=true NEXT_PUBLIC_ORGANIZATIONS_ENABLED=true
+    export INTERNAL_API_SECRET=scim-http-ci-local-secret-at-least-32-characters
+    export DB_TX_TRIPWIRE=throw
+    export NEXT_PUBLIC_CHAT_DISABLED=true
+    start_app scim 3017 SCIM record-http-status
+    SCIM_E2E_BASE_URL="$NEXT_PUBLIC_APP_URL" \
+    SCIM_E2E_DATABASE_URL="$DATABASE_URL" \
+    SCIM_E2E_AUTH_SECRET="$BETTER_AUTH_SECRET" \
+    SCIM_E2E_REPORT_PATH="$report_dir/scim-e2e-report.json" \
+      bun run test:scim:e2e
+    VERSION_COMPARE_E2E_BASE_URL="$NEXT_PUBLIC_APP_URL" \
+    VERSION_COMPARE_E2E_DATABASE_URL="$DATABASE_URL" \
+    VERSION_COMPARE_E2E_AUTH_SECRET="$BETTER_AUTH_SECRET" \
+    VERSION_COMPARE_E2E_REPORT_PATH="$report_dir/version-compare-http-report.json" \
+      bun run test:workflow-version-compare:e2e
+    ;;
+
+  # The search suites serve their own fixtures in-process and need no app. They share this group
+  # because they finish in seconds. Self-hosted without billing: hosted billing admits runs through
+  # Redis, which the CLI app is not given.
+  cli)
+    for search in google-content lucid zoom google-meet; do
+      report_var="SEARCH_$(echo "$search" | tr 'a-z-' 'A-Z_')_REPORT_PATH"
+      env NEXT_PUBLIC_APP_URL=http://127.0.0.1:3040 NEXT_PUBLIC_FORCE_HOSTED=false \
+        "$report_var=$report_dir/search-$search.json" \
+        bun "scripts/test-search-$search-e2e.ts"
+    done
+    export NEXT_PUBLIC_FORCE_HOSTED=false
+    export INTERNAL_API_SECRET=cli-http-ci-local-secret-at-least-32-characters
+    start_app cli 3018 CLI
+    CLI_LATENCY_E2E_BASE_URL="$NEXT_PUBLIC_APP_URL" \
+    CLI_LATENCY_E2E_DATABASE_URL="$DATABASE_URL" \
+    CLI_LATENCY_E2E_RUNS=3 \
+    CLI_LATENCY_E2E_WARMUP=1 \
+    CLI_LATENCY_E2E_REPORT_PATH="$report_dir/cli-run-latency-report.json" \
+      bun run test:cli-run-latency:e2e
+    ;;
+
+  # Self-hosted: hosted billing admits a run only through a Redis usage reservation.
+  stop-after)
+    export NEXT_PUBLIC_FORCE_HOSTED=false
+    export INTERNAL_API_SECRET=stop-after-http-ci-local-secret-at-least-32-characters
+    export DB_TX_TRIPWIRE=throw
+    export NEXT_PUBLIC_CHAT_DISABLED=true
+    start_app stop-after 3018 workflow record-http-status
+    STOP_AFTER_E2E_BASE_URL="$NEXT_PUBLIC_APP_URL" \
+    STOP_AFTER_E2E_DATABASE_URL="$DATABASE_URL" \
+    STOP_AFTER_E2E_REPORT_PATH="$report_dir/stop-after-http-report.json" \
+      bun run test:workflow-stop-after:e2e
+    ;;
+
+  # The desktop background executor's protocol: device registration, the SSE doorbell over Redis
+  # pub/sub, presence, leased claims, Stop and isolation. The only group whose app gets Redis.
+  desktop-inbox)
+    export REDIS_URL=redis://127.0.0.1:6379
+    export NEXT_PUBLIC_FORCE_HOSTED=false
+    export MSHIP_DESKTOP_BACKGROUND_EXECUTOR=true
+    export COPILOT_TOOL_PERMISSIONS_ENABLED=true
+    export INTERNAL_API_SECRET=desktop-inbox-http-ci-local-secret-at-least-32-characters
+    export DB_TX_TRIPWIRE=throw
+    start_app desktop-inbox 3019 'desktop executor' record-http-status
+    DESKTOP_INBOX_E2E_BASE_URL="$NEXT_PUBLIC_APP_URL" \
+    DESKTOP_INBOX_E2E_DATABASE_URL="$DATABASE_URL" \
+    DESKTOP_INBOX_E2E_REDIS_URL="$REDIS_URL" \
+    DESKTOP_INBOX_E2E_AUTH_SECRET="$BETTER_AUTH_SECRET" \
+    DESKTOP_INBOX_E2E_REPORT_PATH="$report_dir/desktop-inbox-http-report.json" \
+      bun run test:desktop-inbox:e2e
+    ;;
+
+  *)
+    echo "::error::Unknown end-to-end group: $group" >&2
+    exit 2
+    ;;
+esac
diff --git a/.github/workflows/test-build.yml b/.github/workflows/checks.yml
similarity index 60%
rename from .github/workflows/test-build.yml
rename to .github/workflows/checks.yml
index 6309d81b51f..7d24e084d40 100644
--- a/.github/workflows/test-build.yml
+++ b/.github/workflows/checks.yml
@@ -1,4 +1,4 @@
-name: Test and Build
+name: checks
 
 on:
   workflow_call:
@@ -8,17 +8,23 @@ permissions:
   contents: read
 
 jobs:
-  postgres-integration:
+  integration:
     # Runs the real-infrastructure test layer: every `*.integration.ts` in packages/db and
     # apps/sim, discovered by glob (`vitest run --mode integration`), against the database each
     # provisioning path produces. A new integration suite needs no workflow change.
-    name: PostgreSQL integration (${{ matrix.provision }})
-    runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-8vcpu-ubuntu-2404' || 'ubuntu-latest' }}
-    timeout-minutes: 25
+    #
+    # The two paths build different schemas (migrations add triggers, checks and NOT VALID
+    # constraints that `db:push` does not), so each runs the whole suite. Vitest splits each
+    # suite's files across four shards; a shard runs its files one at a time against its own
+    # database. Files run serially, so a shard barely uses more than one core: 4 vCPU is enough.
+    name: integration (${{ matrix.provision }}, ${{ matrix.shard }}/4)
+    runs-on: &runner-4vcpu ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-4vcpu-ubuntu-2404' || 'ubuntu-latest' }}
+    timeout-minutes: 20
     strategy:
       fail-fast: false
       matrix:
         provision: [push, migrate]
+        shard: [1, 2, 3, 4]
     services:
       redis:
         image: redis:8.2-alpine
@@ -68,7 +74,7 @@ jobs:
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
 
       - name: Setup workspace
-        uses: ./.github/actions/setup-workspace
+        uses: ./.github/actions/setup
         with:
           provider: ${{ vars.CI_PROVIDER }}
 
@@ -79,23 +85,23 @@ jobs:
           bun run db:${{ matrix.provision }}
 
       - name: Verify migration replay is a no-op
-        if: matrix.provision == 'migrate'
+        if: matrix.provision == 'migrate' && matrix.shard == 1
         working-directory: packages/db
         run: bun run db:migrate
 
       - name: Run packages/db integration tests
         working-directory: packages/db
-        run: bun run test --mode integration
+        run: bun run test --mode integration --shard=${{ matrix.shard }}/4
 
       - name: Run apps/sim integration tests
         working-directory: apps/sim
         # A non-UTC process zone keeps timestamp-without-time-zone handling honest.
         env:
           TZ: America/Los_Angeles
-        run: bun run test --mode integration
+        run: bun run test --mode integration --shard=${{ matrix.shard }}/4
 
       - name: Verify cumulative billing timeout recovery on PostgreSQL 16
-        if: matrix.provision == 'push'
+        if: matrix.provision == 'push' && matrix.shard == 1
         working-directory: apps/sim
         env:
           TEST_DATABASE_URL: postgresql://postgres:postgres@127.0.0.1:5433/sim_test
@@ -107,24 +113,37 @@ jobs:
         if: always()
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
-          name: integration-reports-${{ matrix.provision }}
+          name: integration-reports-${{ matrix.provision }}-${{ matrix.shard }}
           path: |
             packages/db/test-results/*.json
             apps/sim/test-results/*.json
           if-no-files-found: warn
           retention-days: 14
 
-  # Acceptance suites that cross a real HTTP boundary. Its own job, off the
-  # integration legs' critical path and on its own database: the SCIM app boots
-  # hosted, which starts background usage replay against DATABASE_URL, so it must
-  # never share a database with suites asserting on billing rows. The suites
-  # exercise HTTP behavior rather than a provisioning path, so they run once,
-  # against the production (migrate) path.
-  http-e2e:
-    name: End-to-end over real HTTP
-    runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-8vcpu-ubuntu-2404' || 'ubuntu-latest' }}
-    # Four suites, each starting its own dev app, run in sequence.
-    timeout-minutes: 30
+  # Acceptance suites that cross a real HTTP boundary, one job per app, each on its own database.
+  # Off the integration jobs' path: the SCIM app boots hosted, which starts background usage replay
+  # against DATABASE_URL, so it must never share a database with suites asserting on billing rows.
+  # The suites exercise HTTP behavior rather than a provisioning path, so they run once, against
+  # the production (migrate) path. Each group's app environment lives in http-e2e.sh.
+  #
+  # SCIM runs two suites against a hosted app and is the longest group, so it keeps the 8 vCPU
+  # runner; the others boot a smaller self-hosted app and fit on 4.
+  e2e:
+    name: e2e (${{ matrix.group }})
+    runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && matrix.runner || 'ubuntu-latest' }}
+    timeout-minutes: 20
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - group: scim
+            runner: blacksmith-8vcpu-ubuntu-2404
+          - group: cli
+            runner: blacksmith-4vcpu-ubuntu-2404
+          - group: stop-after
+            runner: blacksmith-4vcpu-ubuntu-2404
+          - group: desktop-inbox
+            runner: blacksmith-4vcpu-ubuntu-2404
     services:
       postgres:
         image: pgvector/pgvector:pg17
@@ -141,7 +160,7 @@ jobs:
           --health-retries 10
       # Only the desktop executor's app is given REDIS_URL: its doorbell and presence live there.
       redis:
-        image: redis:7-alpine
+        image: redis:8.2-alpine
         ports:
           - 6379:6379
         options: >-
@@ -159,7 +178,7 @@ jobs:
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
 
       - name: Setup workspace
-        uses: ./.github/actions/setup-workspace
+        uses: ./.github/actions/setup
         with:
           provider: ${{ vars.CI_PROVIDER }}
 
@@ -168,276 +187,17 @@ jobs:
         working-directory: packages/db
         run: bun run db:migrate
 
-      - name: Verify Google document reads over real HTTP
-        working-directory: apps/sim
-        env:
-          NEXT_PUBLIC_APP_URL: http://127.0.0.1:3040
-          NEXT_PUBLIC_FORCE_HOSTED: 'false'
-          SEARCH_GOOGLE_CONTENT_REPORT_PATH: ${{ runner.temp }}/e2e/search-google-content.json
-        run: bun scripts/test-search-google-content-e2e.ts
-
-      - name: Verify Lucid MCP search and complete diagram reads over real HTTP
-        working-directory: apps/sim
-        env:
-          NEXT_PUBLIC_APP_URL: http://127.0.0.1:3040
-          NEXT_PUBLIC_FORCE_HOSTED: 'false'
-          SEARCH_LUCID_REPORT_PATH: ${{ runner.temp }}/e2e/search-lucid.json
-        run: bun scripts/test-search-lucid-e2e.ts
-
-      - name: Verify Zoom search over real HTTP
+      # No step timeout: the job's bound covers a hang without cutting a slow but healthy suite
+      # short of writing its report.
+      - name: Run end-to-end suites
         working-directory: apps/sim
-        env:
-          NEXT_PUBLIC_APP_URL: http://127.0.0.1:3040
-          NEXT_PUBLIC_FORCE_HOSTED: 'false'
-          SEARCH_ZOOM_REPORT_PATH: ${{ runner.temp }}/e2e/search-zoom.json
-        run: bun scripts/test-search-zoom-e2e.ts
-
-      - name: Verify Google Meet search over real HTTP
-        working-directory: apps/sim
-        env:
-          NEXT_PUBLIC_APP_URL: http://127.0.0.1:3040
-          NEXT_PUBLIC_FORCE_HOSTED: 'false'
-          SEARCH_GOOGLE_MEET_REPORT_PATH: ${{ runner.temp }}/e2e/search-google-meet.json
-        run: bun scripts/test-search-google-meet-e2e.ts
-
-      # The first request cold-compiles the app under Turbopack, which took 42-150s
-      # on this runner class: a fixed 120s readiness deadline failed on the slow
-      # tail. The deadline only has to catch a hung boot; an exited server fails
-      # immediately, and either way the server log tail lands in the job log. No
-      # step timeout: the job's bound covers a hang without cutting a slow but
-      # healthy suite short of writing its report.
-      #
-      # Every `next dev` app in this job shares apps/sim/.next, so each one follows the
-      # same lifecycle. It starts from an empty Turbopack dev cache: a cache written under
-      # other NEXT_PUBLIC_* values, by a server that `next dev` SIGKILLs 100ms after
-      # SIGTERM, can panic Turbopack or wedge a route compile on restore. It runs in its
-      # own session under an E2E_APP tag, and stop-session.sh returns only once every
-      # process in that session or carrying that tag has exited (Next's telemetry flush
-      # runs detached and still writes .next/dev), so no app starts beside one still
-      # writing .next/dev.
-      - name: Verify SCIM, administration and workflow comparisons over real HTTP
-        working-directory: apps/sim
-        env:
-          NEXT_PUBLIC_APP_URL: http://127.0.0.1:3017
-          BETTER_AUTH_URL: http://127.0.0.1:3017
-          NEXT_PUBLIC_FORCE_HOSTED: 'true'
-          BILLING_ENABLED: 'true'
-          NEXT_PUBLIC_BILLING_ENABLED: 'true'
-          ENTERPRISE_ENABLED: 'true'
-          NEXT_PUBLIC_ENTERPRISE_ENABLED: 'true'
-          SCIM_ENABLED: 'true'
-          NEXT_PUBLIC_SCIM_ENABLED: 'true'
-          SSO_ENABLED: 'true'
-          NEXT_PUBLIC_SSO_ENABLED: 'true'
-          ORGANIZATIONS_ENABLED: 'true'
-          NEXT_PUBLIC_ORGANIZATIONS_ENABLED: 'true'
-          INTERNAL_API_SECRET: scim-http-ci-local-secret-at-least-32-characters
-          DB_TX_TRIPWIRE: throw
-          DISABLE_TELEMETRY: 'true'
-          NEXT_TELEMETRY_DISABLED: '1'
-          NEXT_PUBLIC_CHAT_DISABLED: 'true'
-          READY_TIMEOUT_SECONDS: 300
-        run: |
-          report_dir="$RUNNER_TEMP/e2e"
-          server_log="$report_dir/scim-next.log"
-          mkdir -p "$report_dir"
-          rm -rf .next/dev
-          app_tag="scim-$GITHUB_RUN_ID-$GITHUB_RUN_ATTEMPT-$$"
-          E2E_APP="$app_tag" setsid node ../../node_modules/next/dist/bin/next dev --hostname 127.0.0.1 --port 3017 > "$server_log" 2>&1 &
-          server_pid=$!
-          finish() {
-            status=$?
-            bash ../../.github/scripts/stop-session.sh "$server_pid" "$app_tag" || status=1
-            wait "$server_pid" 2>/dev/null || true
-            awk '/^ (GET|POST|PUT|PATCH|DELETE|HEAD) \/api\// { print }' "$server_log" > "$report_dir/scim-http-status.log"
-            if [ "$status" -ne 0 ]; then
-              tail -n 200 "$server_log"
-              exit "$status"
-            fi
-          }
-          trap finish EXIT
-          fail_startup() {
-            echo "::error::$1"
-            exit 1
-          }
-          started=$SECONDS
-          until curl --fail --silent --max-time 10 http://127.0.0.1:3017/api/health > /dev/null; do
-            kill -0 "$server_pid" 2>/dev/null || fail_startup 'Local SCIM app exited during startup.'
-            [ $((SECONDS - started)) -lt "$READY_TIMEOUT_SECONDS" ] ||
-              fail_startup "Local SCIM app did not become ready within $READY_TIMEOUT_SECONDS seconds."
-            sleep 2
-          done
-          echo "Local SCIM app ready after $((SECONDS - started))s"
-          SCIM_E2E_BASE_URL="$NEXT_PUBLIC_APP_URL" \
-          SCIM_E2E_DATABASE_URL="$DATABASE_URL" \
-          SCIM_E2E_AUTH_SECRET="$BETTER_AUTH_SECRET" \
-          SCIM_E2E_REPORT_PATH="$report_dir/scim-e2e-report.json" \
-            bun run test:scim:e2e
-          VERSION_COMPARE_E2E_BASE_URL="$NEXT_PUBLIC_APP_URL" \
-          VERSION_COMPARE_E2E_DATABASE_URL="$DATABASE_URL" \
-          VERSION_COMPARE_E2E_AUTH_SECRET="$BETTER_AUTH_SECRET" \
-          VERSION_COMPARE_E2E_REPORT_PATH="$report_dir/version-compare-http-report.json" \
-            bun run test:workflow-version-compare:e2e
-
-      # Self-hosted without billing: hosted billing admits runs through Redis, which
-      # this job does not provision.
-      - name: Verify embedded CLI workflow runs and log reads over real HTTP
-        working-directory: apps/sim
-        env:
-          NEXT_PUBLIC_APP_URL: http://127.0.0.1:3018
-          BETTER_AUTH_URL: http://127.0.0.1:3018
-          NEXT_PUBLIC_FORCE_HOSTED: 'false'
-          INTERNAL_API_SECRET: cli-http-ci-local-secret-at-least-32-characters
-          DISABLE_TELEMETRY: 'true'
-          NEXT_TELEMETRY_DISABLED: '1'
-          READY_TIMEOUT_SECONDS: 300
-        run: |
-          report_dir="$RUNNER_TEMP/e2e"
-          server_log="$report_dir/cli-next.log"
-          mkdir -p "$report_dir"
-          rm -rf .next/dev
-          app_tag="cli-$GITHUB_RUN_ID-$GITHUB_RUN_ATTEMPT-$$"
-          E2E_APP="$app_tag" setsid node ../../node_modules/next/dist/bin/next dev --hostname 127.0.0.1 --port 3018 > "$server_log" 2>&1 &
-          server_pid=$!
-          finish() {
-            status=$?
-            bash ../../.github/scripts/stop-session.sh "$server_pid" "$app_tag" || status=1
-            wait "$server_pid" 2>/dev/null || true
-            if [ "$status" -ne 0 ]; then
-              tail -n 200 "$server_log"
-              exit "$status"
-            fi
-          }
-          trap finish EXIT
-          fail_startup() {
-            echo "::error::$1"
-            exit 1
-          }
-          started=$SECONDS
-          until curl --fail --silent --max-time 10 http://127.0.0.1:3018/api/health > /dev/null; do
-            kill -0 "$server_pid" 2>/dev/null || fail_startup 'Local CLI app exited during startup.'
-            [ $((SECONDS - started)) -lt "$READY_TIMEOUT_SECONDS" ] ||
-              fail_startup "Local CLI app did not become ready within $READY_TIMEOUT_SECONDS seconds."
-            sleep 2
-          done
-          echo "Local CLI app ready after $((SECONDS - started))s"
-          CLI_LATENCY_E2E_BASE_URL="$NEXT_PUBLIC_APP_URL" \
-          CLI_LATENCY_E2E_DATABASE_URL="$DATABASE_URL" \
-          CLI_LATENCY_E2E_RUNS=3 \
-          CLI_LATENCY_E2E_WARMUP=1 \
-          CLI_LATENCY_E2E_REPORT_PATH="$report_dir/cli-run-latency-report.json" \
-            bun run test:cli-run-latency:e2e
-
-      # A self-hosted app: hosted billing admits a run only through a Redis usage
-      # reservation, and the SCIM suite above asserts PostgreSQL rate-limit storage,
-      # so workflow execution gets its own app rather than adding Redis to that one.
-      - name: Verify single-block workflow runs over real HTTP
-        working-directory: apps/sim
-        env:
-          NEXT_PUBLIC_APP_URL: http://127.0.0.1:3018
-          BETTER_AUTH_URL: http://127.0.0.1:3018
-          NEXT_PUBLIC_FORCE_HOSTED: 'false'
-          INTERNAL_API_SECRET: stop-after-http-ci-local-secret-at-least-32-characters
-          DB_TX_TRIPWIRE: throw
-          DISABLE_TELEMETRY: 'true'
-          NEXT_TELEMETRY_DISABLED: '1'
-          NEXT_PUBLIC_CHAT_DISABLED: 'true'
-          READY_TIMEOUT_SECONDS: 300
-        run: |
-          report_dir="$RUNNER_TEMP/e2e"
-          server_log="$report_dir/stop-after-next.log"
-          mkdir -p "$report_dir"
-          rm -rf .next/dev
-          app_tag="stop-after-$GITHUB_RUN_ID-$GITHUB_RUN_ATTEMPT-$$"
-          E2E_APP="$app_tag" setsid node ../../node_modules/next/dist/bin/next dev --hostname 127.0.0.1 --port 3018 > "$server_log" 2>&1 &
-          server_pid=$!
-          finish() {
-            status=$?
-            bash ../../.github/scripts/stop-session.sh "$server_pid" "$app_tag" || status=1
-            wait "$server_pid" 2>/dev/null || true
-            awk '/^ (GET|POST|PUT|PATCH|DELETE|HEAD) \/api\// { print }' "$server_log" > "$report_dir/stop-after-http-status.log"
-            if [ "$status" -ne 0 ]; then
-              tail -n 200 "$server_log"
-              exit "$status"
-            fi
-          }
-          trap finish EXIT
-          fail_startup() {
-            echo "::error::$1"
-            exit 1
-          }
-          started=$SECONDS
-          until curl --fail --silent --max-time 10 http://127.0.0.1:3018/api/health > /dev/null; do
-            kill -0 "$server_pid" 2>/dev/null || fail_startup 'Local workflow app exited during startup.'
-            [ $((SECONDS - started)) -lt "$READY_TIMEOUT_SECONDS" ] ||
-              fail_startup "Local workflow app did not become ready within $READY_TIMEOUT_SECONDS seconds."
-            sleep 2
-          done
-          echo "Local workflow app ready after $((SECONDS - started))s"
-          STOP_AFTER_E2E_BASE_URL="$NEXT_PUBLIC_APP_URL" \
-          STOP_AFTER_E2E_DATABASE_URL="$DATABASE_URL" \
-          STOP_AFTER_E2E_REPORT_PATH="$report_dir/stop-after-http-report.json" \
-            bun run test:workflow-stop-after:e2e
-
-      # The desktop background executor's protocol: device registration, the SSE doorbell over
-      # Redis pub/sub, presence, leased claims, Stop and isolation, against its own app with Redis.
-      - name: Verify the desktop background executor's inbox over real HTTP
-        working-directory: apps/sim
-        env:
-          NEXT_PUBLIC_APP_URL: http://127.0.0.1:3019
-          BETTER_AUTH_URL: http://127.0.0.1:3019
-          REDIS_URL: redis://127.0.0.1:6379
-          NEXT_PUBLIC_FORCE_HOSTED: 'false'
-          MSHIP_DESKTOP_BACKGROUND_EXECUTOR: 'true'
-          COPILOT_TOOL_PERMISSIONS_ENABLED: 'true'
-          INTERNAL_API_SECRET: desktop-inbox-http-ci-local-secret-at-least-32-characters
-          DB_TX_TRIPWIRE: throw
-          DISABLE_TELEMETRY: 'true'
-          NEXT_TELEMETRY_DISABLED: '1'
-          READY_TIMEOUT_SECONDS: 300
-        run: |
-          report_dir="$RUNNER_TEMP/e2e"
-          server_log="$report_dir/desktop-inbox-next.log"
-          mkdir -p "$report_dir"
-          rm -rf .next/dev
-          app_tag="desktop-inbox-$GITHUB_RUN_ID-$GITHUB_RUN_ATTEMPT-$$"
-          E2E_APP="$app_tag" setsid node ../../node_modules/next/dist/bin/next dev --hostname 127.0.0.1 --port 3019 > "$server_log" 2>&1 &
-          server_pid=$!
-          finish() {
-            status=$?
-            bash ../../.github/scripts/stop-session.sh "$server_pid" "$app_tag" || status=1
-            wait "$server_pid" 2>/dev/null || true
-            awk '/^ (GET|POST|PUT|PATCH|DELETE|HEAD) \/api\// { print }' "$server_log" > "$report_dir/desktop-inbox-http-status.log"
-            if [ "$status" -ne 0 ]; then
-              tail -n 200 "$server_log"
-              exit "$status"
-            fi
-          }
-          trap finish EXIT
-          fail_startup() {
-            echo "::error::$1"
-            exit 1
-          }
-          started=$SECONDS
-          until curl --fail --silent --max-time 10 http://127.0.0.1:3019/api/health > /dev/null; do
-            kill -0 "$server_pid" 2>/dev/null || fail_startup 'Local desktop executor app exited during startup.'
-            [ $((SECONDS - started)) -lt "$READY_TIMEOUT_SECONDS" ] ||
-              fail_startup "Local desktop executor app did not become ready within $READY_TIMEOUT_SECONDS seconds."
-            sleep 2
-          done
-          echo "Local desktop executor app ready after $((SECONDS - started))s"
-          DESKTOP_INBOX_E2E_BASE_URL="$NEXT_PUBLIC_APP_URL" \
-          DESKTOP_INBOX_E2E_DATABASE_URL="$DATABASE_URL" \
-          DESKTOP_INBOX_E2E_REDIS_URL="$REDIS_URL" \
-          DESKTOP_INBOX_E2E_AUTH_SECRET="$BETTER_AUTH_SECRET" \
-          DESKTOP_INBOX_E2E_REPORT_PATH="$report_dir/desktop-inbox-http-report.json" \
-            bun run test:desktop-inbox:e2e
+        run: bash ../../.github/scripts/http-e2e.sh "${{ matrix.group }}"
 
       - name: Upload end-to-end reports and server logs
         if: failure()
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
-          name: http-e2e-reports
+          name: http-e2e-${{ matrix.group }}
           path: ${{ runner.temp }}/e2e/
           if-no-files-found: ignore
           retention-days: 7
@@ -445,9 +205,9 @@ jobs:
   # Pull requests skip the live desktop suite only when every change is clearly unrelated to the
   # app it drives (docs, other apps, published content). Anything else, and any failure to work
   # out the diff, runs it: a pull request that skipped it wrongly would first fail on staging.
-  desktop-live-changes:
-    name: Detect desktop tool changes
-    runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-2vcpu-ubuntu-2404' || 'ubuntu-latest' }}
+  desktop-changes:
+    name: desktop-changes
+    runs-on: &runner-2vcpu ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-2vcpu-ubuntu-2404' || 'ubuntu-latest' }}
     timeout-minutes: 5
     outputs:
       changed: ${{ github.event_name != 'pull_request' || steps.diff.outputs.changed != 'false' }}
@@ -464,11 +224,11 @@ jobs:
         run: bash .github/scripts/desktop-live-changes.sh "$BASE" >> "$GITHUB_OUTPUT"
 
   # Desktop tools in the real Electron app against a local app, on its own runner: the
-  # Electron app, the dev app and its realtime server together outgrow the http-e2e runner.
-  desktop-live-e2e:
-    name: Desktop tools against a local app
-    needs: desktop-live-changes
-    if: needs.desktop-live-changes.outputs.changed == 'true'
+  # Electron app, the dev app and its realtime server together outgrow the e2e runner.
+  desktop-live:
+    name: desktop-live
+    needs: desktop-changes
+    if: needs.desktop-changes.outputs.changed == 'true'
     runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-16vcpu-ubuntu-2404' || 'ubuntu-latest' }}
     timeout-minutes: 30
     services:
@@ -486,7 +246,7 @@ jobs:
           --health-timeout 5s
           --health-retries 10
       redis:
-        image: redis:7-alpine
+        image: redis:8.2-alpine
         ports:
           - 6379:6379
         options: >-
@@ -504,7 +264,7 @@ jobs:
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
 
       - name: Setup workspace
-        uses: ./.github/actions/setup-workspace
+        uses: ./.github/actions/setup
         with:
           provider: ${{ vars.CI_PROVIDER }}
 
@@ -584,9 +344,11 @@ jobs:
           if-no-files-found: ignore
           retention-days: 7
 
-  test-build:
-    name: Lint and Test
-    runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-8vcpu-ubuntu-2404' || 'ubuntu-latest' }}
+  # Lint, audits, type-check and the schema sync check: about two minutes of mostly cached work,
+  # kept off the test shards so neither waits on the other.
+  lint:
+    name: lint
+    runs-on: *runner-4vcpu
     timeout-minutes: 15
 
     steps:
@@ -604,7 +366,7 @@ jobs:
           fetch-depth: 2
 
       - name: Setup workspace
-        uses: ./.github/actions/setup-workspace
+        uses: ./.github/actions/setup
         with:
           provider: ${{ vars.CI_PROVIDER }}
           turbo-cache-key: turbo-cache
@@ -686,6 +448,20 @@ jobs:
       - name: Lint code
         run: bun run lint:check
 
+      # Workflow syntax, expressions, `needs` references and runner labels. ShellCheck stays off
+      # here: the existing run blocks carry info-level findings that are their own cleanup.
+      - name: Lint workflows
+        env:
+          ACTIONLINT_VERSION: 1.7.12
+          ACTIONLINT_SHA256: 8aca8db96f1b94770f1b0d72b6dddcb1ebb8123cb3712530b08cc387b349a3d8
+        run: |
+          archive="$RUNNER_TEMP/actionlint.tar.gz"
+          curl -fsSL -o "$archive" \
+            "https://github.com/rhysd/actionlint/releases/download/v${ACTIONLINT_VERSION}/actionlint_${ACTIONLINT_VERSION}_linux_amd64.tar.gz"
+          echo "${ACTIONLINT_SHA256}  ${archive}" | sha256sum -c -
+          tar -xzf "$archive" -C "$RUNNER_TEMP" actionlint
+          "$RUNNER_TEMP/actionlint" -color -shellcheck= -pyflakes=
+
       # Every zero-argument `check:*` script, run concurrently. The list is derived in
       # scripts/run-audits.ts, which also writes the per-audit timing table to the job
       # summary and annotates failures. Audits needing a base ref stay separate below.
@@ -701,19 +477,55 @@ jobs:
       # Every workspace, not just realtime. packages/emcn, packages/utils,
       # apps/desktop and apps/docs had no type check in CI at all; apps/sim's
       # source was covered only as a side effect of `next build` in the separate
-      # Build App job. Note this does NOT cover apps/sim's tests — its tsconfig
+      # `build` job. Note this does NOT cover apps/sim's tests — its tsconfig
       # excludes *.test.ts(x), and including them today surfaces ~2.2k errors,
       # so that is its own cleanup rather than a gate to switch on here.
       - name: Type-check all workspaces
         run: bunx turbo run type-check
 
+      - name: Check schema and migrations are in sync
+        working-directory: packages/db
+        run: |
+          bunx drizzle-kit generate --config=./drizzle.config.ts
+          if [ -n "$(git status --porcelain ./migrations)" ]; then
+            echo "❌ Schema and migrations are out of sync!"
+            echo "Run 'cd packages/db && bunx drizzle-kit generate' and commit the new migrations."
+            git status --porcelain ./migrations
+            git diff ./migrations
+            exit 1
+          fi
+          echo "✅ Schema and migrations are in sync"
+
+  # The root scripts and every workspace's Vitest suite (`bun run test`), split in two. apps/sim is
+  # about 98% of the time, so only its files are sharded; shard 1 also runs the root scripts and
+  # the other workspaces. Each shard keeps its own Turbo cache: pass-through args are part of the
+  # task hash, so a shard only ever replays its own result.
+  test:
+    name: test (${{ matrix.shard }}/2)
+    runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-8vcpu-ubuntu-2404' || 'ubuntu-latest' }}
+    timeout-minutes: 15
+    strategy:
+      fail-fast: false
+      matrix:
+        shard: [1, 2]
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        with:
+          fetch-depth: 2
+
+      - name: Setup workspace
+        uses: ./.github/actions/setup
+        with:
+          provider: ${{ vars.CI_PROVIDER }}
+          turbo-cache-key: turbo-cache-test-${{ matrix.shard }}
+
       # cloud-review-tools.test.ts runs the real helper on the runner, which shells
       # out to rg. Blacksmith's image ships it, GitHub's doesn't.
       - name: Install ripgrep
         run: command -v rg || (sudo apt-get update && sudo apt-get install -y ripgrep)
 
-      # Runs the root scripts and each workspace's Vitest suite,
-      # without `--coverage`.
       - name: Run tests
         env:
           NODE_OPTIONS: '--no-warnings --max-old-space-size=8192'
@@ -721,25 +533,18 @@ jobs:
           DATABASE_URL: 'postgresql://postgres:postgres@localhost:5432/simstudio'
           ENCRYPTION_KEY: '0000000000000000000000000000000000000000000000000000000000000000' # dummy key for CI only
           TURBO_CACHE_DIR: .turbo
-        run: bun run test
-
-      - name: Check schema and migrations are in sync
-        working-directory: packages/db
+          SHARD: ${{ matrix.shard }}
         run: |
-          bunx drizzle-kit generate --config=./drizzle.config.ts
-          if [ -n "$(git status --porcelain ./migrations)" ]; then
-            echo "❌ Schema and migrations are out of sync!"
-            echo "Run 'cd packages/db && bunx drizzle-kit generate' and commit the new migrations."
-            git status --porcelain ./migrations
-            git diff ./migrations
-            exit 1
+          if [ "$SHARD" = 1 ]; then
+            bun run test:scripts
+            bunx turbo run test --filter='!@sim/app'
           fi
-          echo "✅ Schema and migrations are in sync"
+          bunx turbo run test --filter=@sim/app -- --shard="$SHARD/2"
 
   # Next.js production build, in parallel with lint + tests. Sticky disks are
   # cloned from the last committed snapshot per job and committed last-writer-
   # wins, so concurrent mounts are safe. The bun/node_modules disks are shared
-  # with test-build (the lockfile-hashed key means they only ever share when the
+  # with the test jobs (the lockfile-hashed key means they only ever share when the
   # dependency tree really is identical, so LWW loss is harmless), but the Turbo
   # cache gets its own key: with a shared key, only the last committer's new
   # entries survive each run, so the test and build Turbo entries would evict
@@ -750,7 +555,7 @@ jobs:
   # peaked 51 GB. NODE_OPTIONS' --max-old-space-size caps only Node's JS heap,
   # not the native Turbopack workers that dominate, so it cannot prevent this.
   build:
-    name: Build App
+    name: build
     runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-16vcpu-ubuntu-2404' || 'linux-x64-8-core' }}
     # Build durations crossed 15 minutes as the app grew (10m02 on Jul 29 AM,
     # 14m44 after the folders/desktop/library merges, then two straight
@@ -763,7 +568,7 @@ jobs:
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
 
       - name: Setup workspace
-        uses: ./.github/actions/setup-workspace
+        uses: ./.github/actions/setup
         with:
           provider: ${{ vars.CI_PROVIDER }}
           turbo-cache-key: turbo-cache-build
@@ -802,3 +607,27 @@ jobs:
           ENCRYPTION_KEY: '0000000000000000000000000000000000000000000000000000000000000000' # dummy key for CI only
           TURBO_CACHE_DIR: .turbo
         run: bunx turbo run build --filter=@sim/app
+
+  # One status for every check above: the single check to require on a branch ruleset, so adding,
+  # sharding or renaming a job never means editing the ruleset. Skipped is a pass (the desktop live
+  # suite skips on pull requests that cannot affect it); a failure or a cancellation is not.
+  # `always()`, not `!cancelled()`: a skipped job satisfies a required check, so a gate that skips
+  # on a cancelled run would report a cancelled head commit as passing.
+  ci:
+    name: ci
+    needs: [integration, e2e, desktop-changes, desktop-live, lint, test, build]
+    if: ${{ always() }}
+    runs-on: *runner-2vcpu
+    timeout-minutes: 5
+    steps:
+      - name: Require every check to pass
+        env:
+          RESULTS: ${{ toJSON(needs) }}
+        run: |
+          failed="$(jq -r 'to_entries[] | select(.value.result != "success" and .value.result != "skipped") | "\(.key): \(.value.result)"' <<< "$RESULTS")"
+          if [ -n "$failed" ]; then
+            echo "::error::Checks did not pass:"
+            echo "$failed"
+            exit 1
+          fi
+          echo "All checks passed."
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 547db6f3459..be203bb1059 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,4 +1,4 @@
-name: CI
+name: ci
 
 # Runner provider toggle, read from the CI_PROVIDER repo variable:
 #
@@ -34,18 +34,17 @@ permissions:
   contents: read
 
 jobs:
-  test-build:
-    name: Test and Build
+  checks:
+    name: checks
     if: github.ref != 'refs/heads/dev' || github.event_name == 'pull_request'
-    uses: ./.github/workflows/test-build.yml
-    secrets: inherit
+    uses: ./.github/workflows/checks.yml
 
   # Detect if this is a version release commit (e.g., "v0.5.24: ...")
   # Smallest runner on purpose: a few seconds of pure shell over the commit
   # message, no checkout and no install.
-  detect-version:
-    name: Detect Version
-    runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-2vcpu-ubuntu-2404' || 'ubuntu-latest' }}
+  version:
+    name: version
+    runs-on: &runner-2vcpu ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-2vcpu-ubuntu-2404' || 'ubuntu-latest' }}
     timeout-minutes: 5
     if: github.event_name == 'push' && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/staging' || github.ref == 'refs/heads/dev')
     outputs:
@@ -74,9 +73,9 @@ jobs:
   # the Electron app or the bridge packages trigger a per-env prerelease build
   # (dev → dev stream, staging → staging) that the env's update feed
   # (/api/desktop/update) starts offering automatically.
-  detect-desktop-changes:
-    name: Detect Desktop Changes
-    runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-2vcpu-ubuntu-2404' || 'ubuntu-latest' }}
+  desktop-changes:
+    name: desktop-changes
+    runs-on: *runner-2vcpu
     timeout-minutes: 5
     if: github.event_name == 'push' && (github.ref == 'refs/heads/dev' || github.ref == 'refs/heads/staging')
     outputs:
@@ -116,36 +115,41 @@ jobs:
   # in place before the new app version deploys (replaces the removed ECS
   # migration sidecar)
   migrate:
-    name: Migrate DB
-    needs: [test-build]
+    name: migrate
+    needs: [checks]
     # Explicit need results instead of the implicit success(): a skipped job
     # anywhere in the transitive needs chain silently fails implicit success()
-    # and cascade-skips the deploy chain (migrate -> promote-images ->
+    # and cascade-skips the deploy chain (migrate -> promote ->
     # CodeDeploy) — this bit us on 2026-07-23. State requirements explicitly.
     if: >-
       !cancelled() &&
-      needs.test-build.result == 'success' &&
+      needs.checks.result == 'success' &&
       github.event_name == 'push' &&
       (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/staging')
-    uses: ./.github/workflows/migrations.yml
+    uses: ./.github/workflows/migrate.yml
     with:
       environment: ${{ github.ref == 'refs/heads/main' && 'production' || 'staging' }}
-    secrets: inherit
+    secrets:
+      DATABASE_URL: ${{ secrets.DATABASE_URL }}
+      STAGING_DATABASE_URL: ${{ secrets.STAGING_DATABASE_URL }}
+      MIGRATION_DATABASE_URL: ${{ secrets.MIGRATION_DATABASE_URL }}
+      STAGING_MIGRATION_DATABASE_URL: ${{ secrets.STAGING_MIGRATION_DATABASE_URL }}
 
   # Same ordering for dev (schema push before the dev image lands in ECR)
   migrate-dev:
-    name: Migrate Dev DB
+    name: migrate-dev
     if: github.event_name == 'push' && github.ref == 'refs/heads/dev'
-    uses: ./.github/workflows/migrations.yml
+    uses: ./.github/workflows/migrate.yml
     with:
       environment: dev
-    secrets: inherit
+    secrets:
+      DEV_DATABASE_URL: ${{ secrets.DEV_DATABASE_URL }}
 
   # Dev: build immutable images alongside the schema push and Trigger upload.
-  build-dev:
-    name: Build Dev ECR
+  image-dev:
+    name: image-dev (${{ matrix.id }})
     if: github.event_name == 'push' && github.ref == 'refs/heads/dev'
-    runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && matrix.bs_runner || matrix.gh_runner }}
+    runs-on: &runner-matrix ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && matrix.bs_runner || matrix.gh_runner }}
     timeout-minutes: 30
     permissions:
       contents: read
@@ -162,29 +166,33 @@ jobs:
           # deploy — nothing ships until the image is pushed — and its two
           # dominant steps both scale with cores (`bun install` ~300-400s, `next
           # build` ~260s). The same `next build` runs on 16 vCPU in the separate
-          # Build App verification job, which does not gate anything; this one
+          # checks `build` job, which does not gate anything; this one
           # was doing comparable work on half the cores.
           #
           # cache_mb is the layer cache the post-job prune retains, and it is the
-          # only reason the sticky disks stay bounded — see docker-build's
+          # only reason the sticky disks stay bounded — see the image action's
           # action.yml. Rows that omit it take the small-image default there. The
           # app image overrides because it carries ~34 layers plus apt and bun
           # cache mounts for the whole monorepo; 100 GB is several builds' worth
           # of headroom over that working set.
-          - dockerfile: ./docker/app.Dockerfile
+          - id: app
+            dockerfile: ./docker/app.Dockerfile
             cache_mb: '102400'
             ecr_repo_secret: ECR_APP
             gh_runner: linux-x64-8-core
             bs_runner: blacksmith-16vcpu-ubuntu-2404
-          - dockerfile: ./docker/db.Dockerfile
+          - id: db
+            dockerfile: ./docker/db.Dockerfile
             ecr_repo_secret: ECR_MIGRATIONS
             gh_runner: ubuntu-latest
             bs_runner: blacksmith-2vcpu-ubuntu-2404
-          - dockerfile: ./docker/realtime.Dockerfile
+          - id: realtime
+            dockerfile: ./docker/realtime.Dockerfile
             ecr_repo_secret: ECR_REALTIME
             gh_runner: ubuntu-latest
             bs_runner: blacksmith-2vcpu-ubuntu-2404
-          - dockerfile: ./docker/pii.Dockerfile
+          - id: pii
+            dockerfile: ./docker/pii.Dockerfile
             ecr_repo_secret: ECR_PII
             gh_runner: ubuntu-latest
             bs_runner: blacksmith-2vcpu-ubuntu-2404
@@ -215,7 +223,7 @@ jobs:
           ECR_REPO: ${{ matrix.ecr_repo_secret == 'ECR_APP' && secrets.ECR_APP || matrix.ecr_repo_secret == 'ECR_MIGRATIONS' && secrets.ECR_MIGRATIONS || matrix.ecr_repo_secret == 'ECR_REALTIME' && secrets.ECR_REALTIME || matrix.ecr_repo_secret == 'ECR_PII' && secrets.ECR_PII || '' }}
 
       - name: Build and push
-        uses: ./.github/actions/docker-build
+        uses: ./.github/actions/image
         with:
           provider: ${{ vars.CI_PROVIDER }}
           file: ${{ matrix.dockerfile }}
@@ -226,13 +234,13 @@ jobs:
           max-cache-size-mb: ${{ matrix.cache_mb }}
 
   # Staging/production coordinate task releases with app traffic cutover.
-  # Dev tasks deploy independently in deploy-trigger-dev.yml.
-  prepare-trigger:
-    name: Prepare Trigger.dev
+  # Dev tasks deploy independently in trigger-dev.yml.
+  trigger-upload:
+    name: trigger-upload
     if: >-
       github.event_name == 'push' &&
       (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/staging')
-    runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-4vcpu-ubuntu-2404' || 'ubuntu-latest' }}
+    runs-on: &runner-4vcpu ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-4vcpu-ubuntu-2404' || 'ubuntu-latest' }}
     timeout-minutes: 30
     outputs:
       version: ${{ steps.deploy.outputs.deploymentVersion }}
@@ -242,24 +250,11 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
 
-      - name: Setup Bun
-        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+      - name: Setup workspace
+        uses: ./.github/actions/setup
         with:
-          bun-version: 1.4.2
-
-      - name: Cache Bun dependencies
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
-        with:
-          path: |
-            ~/.bun/install/cache
-            node_modules
-            **/node_modules
-          key: ${{ runner.os }}-bun-${{ hashFiles('**/bun.lock') }}
-          restore-keys: |
-            ${{ runner.os }}-bun-
-
-      - name: Install dependencies
-        run: bun install --frozen-lockfile --ignore-scripts
+          provider: ${{ vars.CI_PROVIDER }}
+          node-version: ''
 
       - name: Select Trigger environment
         id: target
@@ -305,13 +300,13 @@ jobs:
   # Runs in parallel with tests — only immutable sha tags are pushed here, and
   # the CodePipeline EventBridge triggers filter on exactly the
   # latest/staging/dev ECR tags, so nothing deploys and no mutable tag moves
-  # until promote-images / create-ghcr-manifests retag after the gate.
-  build-amd64:
-    name: Build AMD64
+  # until promote / ghcr retag after the gate.
+  image-amd64:
+    name: image-amd64 (${{ matrix.id }})
     if: >-
       github.event_name == 'push' &&
       (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/staging')
-    runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && matrix.bs_runner || matrix.gh_runner }}
+    runs-on: *runner-matrix
     timeout-minutes: 30
     permissions:
       contents: read
@@ -321,30 +316,35 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - dockerfile: ./docker/app.Dockerfile
+          - id: app
+            dockerfile: ./docker/app.Dockerfile
             cache_mb: '102400'
             ghcr_image: ghcr.io/simstudioai/simstudio
             ecr_repo_secret: ECR_APP
             gh_runner: linux-x64-8-core
             bs_runner: blacksmith-16vcpu-ubuntu-2404
-          - dockerfile: ./docker/db.Dockerfile
+          - id: db
+            dockerfile: ./docker/db.Dockerfile
             ghcr_image: ghcr.io/simstudioai/migrations
             ecr_repo_secret: ECR_MIGRATIONS
             gh_runner: ubuntu-latest
             bs_runner: blacksmith-2vcpu-ubuntu-2404
-          - dockerfile: ./docker/realtime.Dockerfile
+          - id: realtime
+            dockerfile: ./docker/realtime.Dockerfile
             ghcr_image: ghcr.io/simstudioai/realtime
             ecr_repo_secret: ECR_REALTIME
             gh_runner: ubuntu-latest
             bs_runner: blacksmith-2vcpu-ubuntu-2404
-          - dockerfile: ./docker/pii.Dockerfile
+          - id: pii
+            dockerfile: ./docker/pii.Dockerfile
             ghcr_image: ghcr.io/simstudioai/pii
             ecr_repo_secret: ECR_PII
             gh_runner: ubuntu-latest
             bs_runner: blacksmith-2vcpu-ubuntu-2404
           # No ECR repo is provisioned for cron, so it publishes to GHCR only.
           # The tag step below omits the ECR tag when the repo name is empty.
-          - dockerfile: ./docker/cron.Dockerfile
+          - id: cron
+            dockerfile: ./docker/cron.Dockerfile
             ghcr_image: ghcr.io/simstudioai/cron
             gh_runner: ubuntu-latest
             bs_runner: blacksmith-2vcpu-ubuntu-2404
@@ -383,8 +383,8 @@ jobs:
           ECR_REPO: ${{ matrix.ecr_repo_secret == 'ECR_APP' && secrets.ECR_APP || matrix.ecr_repo_secret == 'ECR_MIGRATIONS' && secrets.ECR_MIGRATIONS || matrix.ecr_repo_secret == 'ECR_REALTIME' && secrets.ECR_REALTIME || matrix.ecr_repo_secret == 'ECR_PII' && secrets.ECR_PII || '' }}
 
       # Only sha tags here — the ECR deploy tags (latest/staging) are applied
-      # by promote-images and the GHCR latest-amd64/version tags by
-      # create-ghcr-manifests, both after tests and migrations pass.
+      # by promote and the GHCR latest-amd64/version tags by
+      # ghcr, both after tests and migrations pass.
       - name: Generate tags
         id: meta
         run: |
@@ -419,7 +419,7 @@ jobs:
 
       - name: Build and push images
         if: steps.meta.outputs.skip != 'true'
-        uses: ./.github/actions/docker-build
+        uses: ./.github/actions/image
         with:
           provider: ${{ vars.CI_PROVIDER }}
           file: ${{ matrix.dockerfile }}
@@ -434,33 +434,33 @@ jobs:
   # the image builds themselves run in parallel with the tests. A single job
   # (not a matrix) so all four sha manifests are verified before any tag
   # moves; a missing image can't produce a partial mixed-version deploy.
-  promote-images:
-    name: Promote Images
-    needs: [migrate, build-amd64, prepare-trigger, migrate-dev, build-dev]
+  promote:
+    name: promote
+    needs: [migrate, image-amd64, trigger-upload, migrate-dev, image-dev]
     # Explicit results: see migrate's comment.
     if: >-
       !cancelled() && github.event_name == 'push' &&
       (
         ((github.ref == 'refs/heads/main' || github.ref == 'refs/heads/staging') &&
-          needs.prepare-trigger.result == 'success' &&
+          needs.trigger-upload.result == 'success' &&
           needs.migrate.result == 'success' &&
-          needs.build-amd64.result == 'success') ||
+          needs.image-amd64.result == 'success') ||
         (github.ref == 'refs/heads/dev' &&
           needs.migrate-dev.result == 'success' &&
-          needs.build-dev.result == 'success')
+          needs.image-dev.result == 'success')
       )
-    runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-2vcpu-ubuntu-2404' || 'ubuntu-latest' }}
+    runs-on: *runner-2vcpu
     timeout-minutes: 10
     permissions:
       contents: read
       id-token: write
     outputs:
       # Whether the deploy tag was actually moved (false on a stale-run guard
-      # skip). promote-trigger keys off this so tasks are never promoted when
+      # skip). trigger-promote keys off this so tasks are never promoted when
       # the app itself wasn't.
       promoted: ${{ steps.guard.outputs.fresh }}
       # Epoch when the deploy tag was retagged (this push's ECS pipeline trigger).
-      # promote-trigger passes it to the poll script so a stale pipeline execution
+      # trigger-promote passes it to the poll script so a stale pipeline execution
       # reusing the same image digest can't satisfy the cutover gate.
       retag_epoch: ${{ steps.promote.outputs.retag_epoch }}
       # Unchanged tags verify the latest execution's cutover without an epoch bound.
@@ -552,21 +552,21 @@ jobs:
   # traffic cutover (CodeDeploy AllowTraffic on every target). The image retag
   # triggers the ECS pipeline; this job correlates it via the digest + retag epoch
   # (rejecting a stale execution reusing the digest) and promotes at cutover.
-  # Skipped when promote-images skipped the tag move (stale run) — tasks then
+  # Skipped when promote skipped the tag move (stale run) — tasks then
   # correctly stay on the old version. If the app deploy fails or never cuts over,
   # promote never fires and this job fails visibly.
-  promote-trigger:
-    name: Promote Trigger.dev
-    needs: [promote-images, prepare-trigger]
+  trigger-promote:
+    name: trigger-promote
+    needs: [promote, trigger-upload]
     # Explicit results also suppress skip propagation from optional ancestors.
     if: >-
       !cancelled() &&
       github.event_name == 'push' &&
       (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/staging') &&
-      needs.promote-images.result == 'success' &&
-      needs.prepare-trigger.result == 'success' &&
-      needs.promote-images.outputs.promoted == 'true'
-    runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-4vcpu-ubuntu-2404' || 'ubuntu-latest' }}
+      needs.promote.result == 'success' &&
+      needs.trigger-upload.result == 'success' &&
+      needs.promote.outputs.promoted == 'true'
+    runs-on: *runner-4vcpu
     # Leave setup/promotion headroom above the 70-minute cutover poll.
     timeout-minutes: 90
     permissions:
@@ -576,24 +576,11 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
 
-      - name: Setup Bun
-        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+      - name: Setup workspace
+        uses: ./.github/actions/setup
         with:
-          bun-version: 1.4.2
-
-      - name: Cache Bun dependencies
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
-        with:
-          path: |
-            ~/.bun/install/cache
-            node_modules
-            **/node_modules
-          key: ${{ runner.os }}-bun-${{ hashFiles('**/bun.lock') }}
-          restore-keys: |
-            ${{ runner.os }}-bun-
-
-      - name: Install dependencies
-        run: bun install --frozen-lockfile --ignore-scripts
+          provider: ${{ vars.CI_PROVIDER }}
+          node-version: ''
 
       - name: Configure AWS credentials
         uses: aws-actions/configure-aws-credentials@e7f100cf4c008499ea8adda475de1042d6975c7b # v6
@@ -607,10 +594,10 @@ jobs:
       - name: Wait for ECS traffic cutover
         env:
           OVERALL_TIMEOUT: 4200
-          APP_IMAGE_CHANGED: ${{ needs.promote-images.outputs.app_image_changed }}
-          DIGEST: ${{ needs.promote-images.outputs.app_image_digest }}
+          APP_IMAGE_CHANGED: ${{ needs.promote.outputs.app_image_changed }}
+          DIGEST: ${{ needs.promote.outputs.app_image_digest }}
           PIPELINE: sim-${{ github.ref == 'refs/heads/main' && 'production' || github.ref == 'refs/heads/dev' && 'dev' || 'staging' }}-us-east-1-app-deployment
-          RETAG_EPOCH: ${{ needs.promote-images.outputs.retag_epoch }}
+          RETAG_EPOCH: ${{ needs.promote.outputs.retag_epoch }}
         run: |
           set -eo pipefail
           case "$APP_IMAGE_CHANGED" in
@@ -625,9 +612,9 @@ jobs:
         env:
           TRIGGER_ACCESS_TOKEN: ${{ secrets.TRIGGER_ACCESS_TOKEN }}
           TRIGGER_PROJECT_ID: ${{ secrets.TRIGGER_PROJECT_ID }}
-          TRIGGER_ENV: ${{ needs.prepare-trigger.outputs.environment }}
-          TRIGGER_BRANCH: ${{ needs.prepare-trigger.outputs.preview_branch }}
-          VERSION: ${{ needs.prepare-trigger.outputs.version }}
+          TRIGGER_ENV: ${{ needs.trigger-upload.outputs.environment }}
+          TRIGGER_BRANCH: ${{ needs.trigger-upload.outputs.preview_branch }}
+          VERSION: ${{ needs.trigger-upload.outputs.version }}
         run: |
           set -eo pipefail
           if [ -z "$TRIGGER_ACCESS_TOKEN" ] || [ -z "$TRIGGER_PROJECT_ID" ]; then
@@ -635,7 +622,7 @@ jobs:
             exit 1
           fi
           if [ -z "$VERSION" ]; then
-            echo "ERROR: no deployed version passed from prepare-trigger" >&2
+            echo "ERROR: no deployed version passed from trigger-upload" >&2
             exit 1
           fi
           echo "Promoting Trigger.dev version $VERSION ($TRIGGER_ENV)"
@@ -647,11 +634,11 @@ jobs:
 
   # Build ARM64 images for GHCR (main branch only, runs in parallel with
   # tests). Pushes only the immutable sha tag — latest-arm64/version-arm64
-  # are applied by create-ghcr-manifests after the gate, so a failing run
+  # are applied by ghcr after the gate, so a failing run
   # never moves a documented tag.
-  build-ghcr-arm64:
-    name: Build ARM64 (GHCR Only)
-    runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && matrix.bs_runner || matrix.gh_runner }}
+  image-arm64:
+    name: image-arm64 (${{ matrix.id }})
+    runs-on: *runner-matrix
     timeout-minutes: 30
     if: github.event_name == 'push' && github.ref == 'refs/heads/main'
     permissions:
@@ -665,24 +652,29 @@ jobs:
         # and this job only runs on push to main — an unprovisioned label would
         # hang a release in `queued` rather than fail a PR.
         include:
-          - dockerfile: ./docker/app.Dockerfile
+          - id: app
+            dockerfile: ./docker/app.Dockerfile
             cache_mb: '102400'
             image: ghcr.io/simstudioai/simstudio
             gh_runner: linux-arm64-8-core
             bs_runner: blacksmith-16vcpu-ubuntu-2404-arm
-          - dockerfile: ./docker/db.Dockerfile
+          - id: db
+            dockerfile: ./docker/db.Dockerfile
             image: ghcr.io/simstudioai/migrations
             gh_runner: ubuntu-24.04-arm
             bs_runner: blacksmith-4vcpu-ubuntu-2404-arm
-          - dockerfile: ./docker/realtime.Dockerfile
+          - id: realtime
+            dockerfile: ./docker/realtime.Dockerfile
             image: ghcr.io/simstudioai/realtime
             gh_runner: ubuntu-24.04-arm
             bs_runner: blacksmith-4vcpu-ubuntu-2404-arm
-          - dockerfile: ./docker/pii.Dockerfile
+          - id: pii
+            dockerfile: ./docker/pii.Dockerfile
             image: ghcr.io/simstudioai/pii
             gh_runner: ubuntu-24.04-arm
             bs_runner: blacksmith-4vcpu-ubuntu-2404-arm
-          - dockerfile: ./docker/cron.Dockerfile
+          - id: cron
+            dockerfile: ./docker/cron.Dockerfile
             image: ghcr.io/simstudioai/cron
             gh_runner: ubuntu-24.04-arm
             bs_runner: blacksmith-4vcpu-ubuntu-2404-arm
@@ -699,7 +691,7 @@ jobs:
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Build and push ARM64 to GHCR
-        uses: ./.github/actions/docker-build
+        uses: ./.github/actions/image
         with:
           provider: ${{ vars.CI_PROVIDER }}
           file: ${{ matrix.dockerfile }}
@@ -709,18 +701,18 @@ jobs:
 
   # Publish all mutable GHCR tags (latest, latest-amd64/arm64, version tags)
   # and the multi-arch manifests from the immutable sha tags — only on main,
-  # after the deploy gate (promote-images) and the ARM64 build both pass.
-  create-ghcr-manifests:
-    name: Create GHCR Manifests
-    runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-2vcpu-ubuntu-2404' || 'ubuntu-latest' }}
+  # after the deploy gate (promote) and the ARM64 build both pass.
+  ghcr:
+    name: ghcr (${{ matrix.id }})
+    runs-on: *runner-2vcpu
     timeout-minutes: 10
-    needs: [promote-images, build-ghcr-arm64, detect-version]
+    needs: [promote, image-arm64, version]
     # Explicit results: see migrate's comment.
     if: >-
       !cancelled() &&
-      needs.promote-images.result == 'success' &&
-      needs.build-ghcr-arm64.result == 'success' &&
-      needs.detect-version.result == 'success' &&
+      needs.promote.result == 'success' &&
+      needs.image-arm64.result == 'success' &&
+      needs.version.result == 'success' &&
       github.event_name == 'push' && github.ref == 'refs/heads/main'
     permissions:
       contents: read
@@ -733,11 +725,16 @@ jobs:
     strategy:
       matrix:
         include:
-          - image: ghcr.io/simstudioai/simstudio
-          - image: ghcr.io/simstudioai/migrations
-          - image: ghcr.io/simstudioai/realtime
-          - image: ghcr.io/simstudioai/pii
-          - image: ghcr.io/simstudioai/cron
+          - id: simstudio
+            image: ghcr.io/simstudioai/simstudio
+          - id: migrations
+            image: ghcr.io/simstudioai/migrations
+          - id: realtime
+            image: ghcr.io/simstudioai/realtime
+          - id: pii
+            image: ghcr.io/simstudioai/pii
+          - id: cron
+            image: ghcr.io/simstudioai/cron
 
     steps:
       - name: Login to GHCR
@@ -747,7 +744,7 @@ jobs:
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
-      # Same monotonic guard as promote-images, applied to the public latest
+      # Same monotonic guard as promote, applied to the public latest
       # tags only — immutable sha and version tags are always published.
       - name: Guard against stale latest tags
         id: guard
@@ -771,8 +768,8 @@ jobs:
           docker buildx imagetools create -t "${IMAGE}:${SHA}" \
             "${IMAGE}:${SHA}-amd64" "${IMAGE}:${SHA}-arm64"
 
-          if [ "${{ needs.detect-version.outputs.is_release }}" = "true" ]; then
-            VERSION="${{ needs.detect-version.outputs.version }}"
+          if [ "${{ needs.version.outputs.is_release }}" = "true" ]; then
+            VERSION="${{ needs.version.outputs.version }}"
             echo "📦 Publishing version tags: ${VERSION}"
             docker buildx imagetools create -t "${IMAGE}:${VERSION}-amd64" "${IMAGE}:${SHA}-amd64"
             docker buildx imagetools create -t "${IMAGE}:${VERSION}-arm64" "${IMAGE}:${SHA}-arm64"
@@ -789,10 +786,10 @@ jobs:
 
   # Sign the published images and attach SLSA provenance and an SBOM to each.
   #
-  # This runs after create-ghcr-manifests rather than inside the build because
+  # This runs after ghcr rather than inside the build because
   # buildx's own provenance/sbom attestations stay off (see the note in
-  # .github/actions/docker-build): the extra manifests they add to an index
-  # break the `imagetools create` retagging that promote-images depends on.
+  # .github/actions/image): the extra manifests they add to an index
+  # break the `imagetools create` retagging that promote depends on.
   # Attaching attestations here instead leaves the index itself untouched — they
   # are stored as separate referrer manifests that point at it.
   #
@@ -804,18 +801,18 @@ jobs:
   # `:<sha>-amd64` manifest it wraps — attesting the manifest leaves the tag
   # people actually pin unverifiable. Which tags exist also varies per run:
   # version tags only on a release, and the latest tags only when the monotonic
-  # guard in create-ghcr-manifests passed. Resolving tag -> digest here and
+  # guard in ghcr passed. Resolving tag -> digest here and
   # de-duplicating is what keeps the two in step without hardcoding that logic
   # twice.
   attest-subjects:
-    name: Resolve Attestation Subjects
-    runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-2vcpu-ubuntu-2404' || 'ubuntu-latest' }}
+    name: attest-subjects
+    runs-on: *runner-2vcpu
     timeout-minutes: 10
-    needs: [create-ghcr-manifests, detect-version]
+    needs: [ghcr, version]
     if: >-
       !cancelled() &&
-      needs.create-ghcr-manifests.result == 'success' &&
-      needs.detect-version.result == 'success' &&
+      needs.ghcr.result == 'success' &&
+      needs.version.result == 'success' &&
       github.event_name == 'push' && github.ref == 'refs/heads/main'
     permissions:
       contents: read
@@ -834,10 +831,10 @@ jobs:
       - name: Resolve published tags to digests
         id: resolve
         env:
-          IS_RELEASE: ${{ needs.detect-version.outputs.is_release }}
-          VERSION: ${{ needs.detect-version.outputs.version }}
+          IS_RELEASE: ${{ needs.version.outputs.is_release }}
+          VERSION: ${{ needs.version.outputs.version }}
           SHA: ${{ github.sha }}
-          LATEST_FRESH: ${{ needs.create-ghcr-manifests.outputs.latest_fresh }}
+          LATEST_FRESH: ${{ needs.ghcr.outputs.latest_fresh }}
         run: |
           set -euo pipefail
 
@@ -911,7 +908,7 @@ jobs:
 
             # A moving alias is only taken when it resolves to the same index
             # digest this run published — content identity, which is what a
-            # digest can prove. create-ghcr-manifests holds the latest tags back when
+            # digest can prove. ghcr holds the latest tags back when
             # its monotonic guard sees a newer commit, and they then still point
             # at an older build — attesting those would put this run's signature
             # and provenance on an image it did not produce. The per-arch
@@ -983,9 +980,9 @@ jobs:
   # One leg per distinct published digest. Attesting each subject separately is
   # also what makes the SBOMs truthful: the amd64 and arm64 images contain
   # different packages, and one SBOM attached to the index cannot describe both.
-  attest-images:
-    name: Attest Images
-    runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-2vcpu-ubuntu-2404' || 'ubuntu-latest' }}
+  attest:
+    name: attest
+    runs-on: *runner-2vcpu
     timeout-minutes: 15
     needs: [attest-subjects]
     if: >-
@@ -1064,9 +1061,9 @@ jobs:
   # Check if docs changed
   # Smallest runner on purpose: a depth-2 checkout plus a path filter, no
   # install and no build.
-  check-docs-changes:
-    name: Check Docs Changes
-    runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-2vcpu-ubuntu-2404' || 'ubuntu-latest' }}
+  docs-changes:
+    name: docs-changes
+    runs-on: *runner-2vcpu
     timeout-minutes: 5
     if: github.event_name == 'push' && github.ref == 'refs/heads/main'
     outputs:
@@ -1085,41 +1082,43 @@ jobs:
               - 'apps/sim/lib/chunkers/**'
 
   # Process docs embeddings (only when docs change, after images are promoted)
-  process-docs:
-    name: Process Docs
-    needs: [promote-images, check-docs-changes]
+  docs:
+    name: docs
+    needs: [promote, docs-changes]
     # Explicit results: see migrate's comment.
     if: >-
       !cancelled() &&
-      needs.promote-images.result == 'success' &&
-      needs.check-docs-changes.result == 'success' &&
-      needs.check-docs-changes.outputs.docs_changed == 'true'
-    uses: ./.github/workflows/docs-embeddings.yml
-    secrets: inherit
+      needs.promote.result == 'success' &&
+      needs.docs-changes.result == 'success' &&
+      needs.docs-changes.outputs.docs_changed == 'true'
+    uses: ./.github/workflows/docs.yml
+    secrets:
+      DATABASE_URL: ${{ secrets.DATABASE_URL }}
+      OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
 
   # Create GitHub Release (only for version commits on main, after all builds complete)
-  create-release:
-    name: Create GitHub Release
-    runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-4vcpu-ubuntu-2404' || 'ubuntu-latest' }}
+  release:
+    name: release
+    runs-on: *runner-4vcpu
     timeout-minutes: 10
-    needs: [create-ghcr-manifests, attest-subjects, attest-images, detect-version]
-    # Explicit results: see migrate's comment. attest-images is a gate, not just
+    needs: [ghcr, attest-subjects, attest, version]
+    # Explicit results: see migrate's comment. attest is a gate, not just
     # an ordering edge — a release must not advertise images whose signature or
     # attestation failed to publish. The count check is belt and braces: today
     # attest-subjects already fails on an empty subject set, so this only bites
     # if that guard is ever removed.
     #
     # Note this gates the GitHub release, not the production deploy: CodePipeline
-    # fires from the ECR tags moved by promote-images, upstream of this job, and
+    # fires from the ECR tags moved by promote, upstream of this job, and
     # only the GHCR mirrors are attested.
     if: >-
       !cancelled() &&
-      needs.create-ghcr-manifests.result == 'success' &&
+      needs.ghcr.result == 'success' &&
       needs.attest-subjects.result == 'success' &&
       needs.attest-subjects.outputs.count != '0' &&
-      needs.attest-images.result == 'success' &&
-      needs.detect-version.result == 'success' &&
-      needs.detect-version.outputs.is_release == 'true'
+      needs.attest.result == 'success' &&
+      needs.version.result == 'success' &&
+      needs.version.outputs.is_release == 'true'
     permissions:
       contents: write
     steps:
@@ -1128,18 +1127,16 @@ jobs:
         with:
           fetch-depth: 0
 
-      - name: Setup Bun
-        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+      - name: Setup workspace
+        uses: ./.github/actions/setup
         with:
-          bun-version: 1.4.2
-
-      - name: Install dependencies
-        run: bun install --frozen-lockfile --ignore-scripts
+          provider: ${{ vars.CI_PROVIDER }}
+          node-version: ''
 
       - name: Create release
         env:
           GH_PAT: ${{ secrets.GITHUB_TOKEN }}
-        run: bun run scripts/create-single-release.ts ${{ needs.detect-version.outputs.version }}
+        run: bun run scripts/create-single-release.ts ${{ needs.version.outputs.version }}
 
   # Desktop release: builds, signs, notarizes, and attaches the macOS app to
   # the GitHub release created above. Gated on the Apple signing secrets so a
@@ -1147,14 +1144,14 @@ jobs:
   # Developer account is provisioned — the moment the six secrets exist, the
   # next vX.Y.Z release ships desktop artifacts with no further changes.
   # Job-level `if:` cannot read the secrets context, hence the probe job.
-  check-desktop-signing:
-    name: Check Desktop Signing Secrets
-    runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-2vcpu-ubuntu-2404' || 'ubuntu-latest' }}
+  desktop-signing:
+    name: desktop-signing
+    runs-on: *runner-2vcpu
     timeout-minutes: 2
-    needs: [detect-version, detect-desktop-changes]
-    # !cancelled(): detect-desktop-changes is skipped on main (and
-    # detect-version tags only on main); either path may need the probe.
-    if: ${{ !cancelled() && (needs.detect-version.outputs.is_release == 'true' || needs.detect-desktop-changes.outputs.changed == 'true') }}
+    needs: [version, desktop-changes]
+    # !cancelled(): desktop-changes is skipped on main (and
+    # version tags only on main); either path may need the probe.
+    if: ${{ !cancelled() && (needs.version.outputs.is_release == 'true' || needs.desktop-changes.outputs.changed == 'true') }}
     outputs:
       configured: ${{ steps.check.outputs.configured }}
     steps:
@@ -1169,24 +1166,31 @@ jobs:
           fi
 
   desktop-release:
-    name: Desktop Release
-    needs: [create-release, check-desktop-signing, detect-version]
-    # Suppress the implicit success() check: check-desktop-signing has an
+    name: desktop-release
+    needs: [release, desktop-signing, version]
+    # Suppress the implicit success() check: desktop-signing has an
     # intentionally skipped transitive dependency on main, which would
     # otherwise cascade-skip this job even when every direct need succeeded.
     if: >-
       !cancelled() &&
-      needs.create-release.result == 'success' &&
-      needs.check-desktop-signing.result == 'success' &&
-      needs.detect-version.result == 'success' &&
-      needs.check-desktop-signing.outputs.configured == 'true'
+      needs.release.result == 'success' &&
+      needs.desktop-signing.result == 'success' &&
+      needs.version.result == 'success' &&
+      needs.desktop-signing.outputs.configured == 'true'
     permissions:
       contents: write
     uses: ./.github/workflows/desktop-release.yml
     with:
-      version: ${{ needs.detect-version.outputs.version }}
+      version: ${{ needs.version.outputs.version }}
       publish: true
-    secrets: inherit
+    secrets:
+      DESKTOP_RELEASE_TOKEN: ${{ secrets.DESKTOP_RELEASE_TOKEN }}
+      CSC_LINK: ${{ secrets.CSC_LINK }}
+      CSC_KEY_PASSWORD: ${{ secrets.CSC_KEY_PASSWORD }}
+      APPLE_API_KEY_P8: ${{ secrets.APPLE_API_KEY_P8 }}
+      APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
+      APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
+      APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
 
   # Per-env desktop prereleases: a dev/staging push that touches shell code
   # publishes an environment-tagged GitHub prerelease to the public,
@@ -1194,19 +1198,19 @@ jobs:
   # builds out of this source repository prevents its followers from receiving
   # every internal shell release. Each environment's /api/desktop/update feed
   # still offers only its own signed stream.
-  create-desktop-prerelease:
-    name: Create Desktop Prerelease
-    runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-2vcpu-ubuntu-2404' || 'ubuntu-latest' }}
+  prerelease-create:
+    name: prerelease-create
+    runs-on: *runner-2vcpu
     timeout-minutes: 5
-    needs: [detect-desktop-changes, check-desktop-signing]
+    needs: [desktop-changes, desktop-signing]
     # Requires the signing probe to have actually succeeded (not just "not
     # cancelled") so a probe failure can't produce a release with no build.
     if: >-
       ${{
         !cancelled() &&
-        needs.detect-desktop-changes.outputs.changed == 'true' &&
-        needs.check-desktop-signing.result == 'success' &&
-        needs.check-desktop-signing.outputs.configured == 'true'
+        needs.desktop-changes.outputs.changed == 'true' &&
+        needs.desktop-signing.result == 'success' &&
+        needs.desktop-signing.outputs.configured == 'true'
       }}
     permissions:
       contents: read
@@ -1265,9 +1269,9 @@ jobs:
           echo "version=$TAG" >> "$GITHUB_OUTPUT"
           echo "✅ Created draft prerelease $TAG"
 
-  desktop-prerelease:
-    name: Desktop Prerelease Build
-    needs: [create-desktop-prerelease, check-desktop-signing]
+  prerelease-build:
+    name: prerelease-build
+    needs: [prerelease-create, desktop-signing]
     # The reusable workflow declares contents: write for its stable-release
     # path. GitHub cannot elevate a caller's token, even though this prerelease
     # path uses the dedicated cross-repository token for its actual upload.
@@ -1275,25 +1279,32 @@ jobs:
       contents: write
     uses: ./.github/workflows/desktop-release.yml
     with:
-      version: ${{ needs.create-desktop-prerelease.outputs.version }}
+      version: ${{ needs.prerelease-create.outputs.version }}
       publish: true
       sign: true
-    secrets: inherit
+    secrets:
+      DESKTOP_RELEASE_TOKEN: ${{ secrets.DESKTOP_RELEASE_TOKEN }}
+      CSC_LINK: ${{ secrets.CSC_LINK }}
+      CSC_KEY_PASSWORD: ${{ secrets.CSC_KEY_PASSWORD }}
+      APPLE_API_KEY_P8: ${{ secrets.APPLE_API_KEY_P8 }}
+      APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
+      APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
+      APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
 
   # The draft only becomes visible to the update feed once its artifacts are
   # attached — this is what makes a dev/staging push atomic from the shell's
   # point of view.
-  publish-desktop-prerelease:
-    name: Publish Desktop Prerelease
-    runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-2vcpu-ubuntu-2404' || 'ubuntu-latest' }}
+  prerelease-publish:
+    name: prerelease-publish
+    runs-on: *runner-2vcpu
     timeout-minutes: 5
-    needs: [create-desktop-prerelease, desktop-prerelease]
+    needs: [prerelease-create, prerelease-build]
     permissions:
       contents: read
     env:
       GH_TOKEN: ${{ secrets.DESKTOP_RELEASE_TOKEN }}
       GH_REPO: simstudioai/sim-desktop-releases
-      TAG: ${{ needs.create-desktop-prerelease.outputs.version }}
+      TAG: ${{ needs.prerelease-create.outputs.version }}
     steps:
       - name: Publish the draft release
         run: |
@@ -1307,17 +1318,17 @@ jobs:
   # and delete the rest (with their tags, so dev force-resets don't strand
   # commits behind stale tags). Leftover drafts (failed or superseded builds)
   # are always garbage by this point — the current run's release is published.
-  prune-desktop-prereleases:
-    name: Prune Desktop Prereleases
-    runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-2vcpu-ubuntu-2404' || 'ubuntu-latest' }}
+  prerelease-prune:
+    name: prerelease-prune
+    runs-on: *runner-2vcpu
     timeout-minutes: 5
-    needs: [create-desktop-prerelease, publish-desktop-prerelease]
+    needs: [prerelease-create, prerelease-publish]
     permissions:
       contents: read
     env:
       GH_TOKEN: ${{ secrets.DESKTOP_RELEASE_TOKEN }}
       GH_REPO: simstudioai/sim-desktop-releases
-      CURRENT_TAG: ${{ needs.create-desktop-prerelease.outputs.version }}
+      CURRENT_TAG: ${{ needs.prerelease-create.outputs.version }}
     steps:
       - name: Delete stale prereleases
         run: |
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index a57f223abb2..d5d91b22e9d 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -1,4 +1,4 @@
-name: CodeQL
+name: codeql
 
 # Advanced setup, replacing the repo-settings "default setup".
 #
@@ -77,7 +77,7 @@ permissions:
 
 jobs:
   analyze:
-    name: Analyze ${{ matrix.language }}
+    name: analyze (${{ matrix.language }})
     # Sized per language, not per workflow. The two analyses are nothing alike:
     # javascript-typescript peaks at 19.5 GB (p95 over 3090 runs), so it needs
     # the 8 vCPU tier's 30.4 GB and would OOM on the 4 vCPU tier's 15.2 GB; the
@@ -108,7 +108,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/companion-pr-check.yml b/.github/workflows/companion.yml
similarity index 99%
rename from .github/workflows/companion-pr-check.yml
rename to .github/workflows/companion.yml
index 38457781467..0ca74d32996 100644
--- a/.github/workflows/companion-pr-check.yml
+++ b/.github/workflows/companion.yml
@@ -1,4 +1,4 @@
-name: companion-pr-check
+name: companion
 
 # Soft, NON-BLOCKING warning: when a PR targeting staging/main declares a
 # cross-repo "Companion:" PR, surface whether that companion is merged yet, so
@@ -40,6 +40,7 @@ permissions:
 
 jobs:
   companion:
+    name: companion
     runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-2vcpu-ubuntu-2404' || 'ubuntu-latest' }}
     timeout-minutes: 5
     steps:
diff --git a/.github/workflows/desktop-e2e.yml b/.github/workflows/desktop-e2e.yml
index ab88c11f150..b449338e47e 100644
--- a/.github/workflows/desktop-e2e.yml
+++ b/.github/workflows/desktop-e2e.yml
@@ -1,4 +1,4 @@
-name: Desktop E2E
+name: desktop-e2e
 
 # Smoke coverage of the real Electron shell on desktop changes, plus a weekly
 # advisory canary against electron@latest so Chromium-cadence breakage surfaces
@@ -57,19 +57,34 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
-  e2e-pinned:
-    name: E2E (pinned)
+  e2e:
+    name: e2e
     if: github.event_name != 'schedule'
     runs-on: macos-26
+    timeout-minutes: 30
     steps:
       - name: Checkout code
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        with:
+          persist-credentials: false
 
       - name: Setup Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
           bun-version: 1.4.2
 
+      # Electron, electron-builder and Playwright download their binaries on every cold install. All
+      # three caches are keyed by version inside, so an older entry restored by prefix is harmless.
+      - name: Cache Electron and Playwright downloads
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
+        with:
+          path: |
+            ~/Library/Caches/electron
+            ~/Library/Caches/electron-builder
+            ~/Library/Caches/ms-playwright
+          key: desktop-downloads-${{ runner.os }}-${{ hashFiles('bun.lock') }}
+          restore-keys: desktop-downloads-${{ runner.os }}-
+
       - name: Install dependencies
         run: bun install --frozen-lockfile
 
@@ -100,20 +115,35 @@ jobs:
           path: apps/desktop/test-results
           retention-days: 7
 
-  e2e-latest-canary:
-    name: E2E (electron@latest canary)
+  e2e-canary:
+    name: e2e-canary
     if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
     runs-on: macos-26
+    timeout-minutes: 30
     continue-on-error: true
     steps:
       - name: Checkout code
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        with:
+          persist-credentials: false
 
       - name: Setup Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
           bun-version: 1.4.2
 
+      # Electron, electron-builder and Playwright download their binaries on every cold install. All
+      # three caches are keyed by version inside, so an older entry restored by prefix is harmless.
+      - name: Cache Electron and Playwright downloads
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
+        with:
+          path: |
+            ~/Library/Caches/electron
+            ~/Library/Caches/electron-builder
+            ~/Library/Caches/ms-playwright
+          key: desktop-downloads-${{ runner.os }}-${{ hashFiles('bun.lock') }}
+          restore-keys: desktop-downloads-${{ runner.os }}-
+
       - name: Install dependencies
         run: bun install --frozen-lockfile
 
@@ -149,12 +179,15 @@ jobs:
           retention-days: 7
 
   package-smoke:
-    name: Unsigned package smoke
+    name: package-smoke
     if: github.event_name != 'schedule'
     runs-on: macos-26
+    timeout-minutes: 20
     steps:
       - name: Checkout code
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        with:
+          persist-credentials: false
 
       - name: Setup Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
@@ -162,10 +195,22 @@ jobs:
           bun-version: 1.4.2
 
       - name: Setup Node
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: 22
 
+      # Electron, electron-builder and Playwright download their binaries on every cold install. All
+      # three caches are keyed by version inside, so an older entry restored by prefix is harmless.
+      - name: Cache Electron and Playwright downloads
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
+        with:
+          path: |
+            ~/Library/Caches/electron
+            ~/Library/Caches/electron-builder
+            ~/Library/Caches/ms-playwright
+          key: desktop-downloads-${{ runner.os }}-${{ hashFiles('bun.lock') }}
+          restore-keys: desktop-downloads-${{ runner.os }}-
+
       - name: Install dependencies
         run: bun install --frozen-lockfile
 
diff --git a/.github/workflows/desktop-release.yml b/.github/workflows/desktop-release.yml
index 0188f97c2bf..7381a406015 100644
--- a/.github/workflows/desktop-release.yml
+++ b/.github/workflows/desktop-release.yml
@@ -1,4 +1,4 @@
-name: Desktop Release (macOS)
+name: desktop-release
 
 # Builds, signs, notarizes, and uploads the desktop app to an existing GitHub
 # release. Stable releases live in this source repository; dev and staging
@@ -24,6 +24,21 @@ on:
         required: false
         type: boolean
         default: true
+    secrets:
+      DESKTOP_RELEASE_TOKEN:
+        required: false
+      CSC_LINK:
+        required: false
+      CSC_KEY_PASSWORD:
+        required: false
+      APPLE_API_KEY_P8:
+        required: false
+      APPLE_API_KEY_ID:
+        required: false
+      APPLE_API_ISSUER:
+        required: false
+      APPLE_TEAM_ID:
+        required: false
   workflow_dispatch:
     inputs:
       version:
@@ -45,8 +60,8 @@ permissions:
   contents: write
 
 jobs:
-  build-sign-notarize:
-    name: Build, Sign, Notarize
+  build:
+    name: build
     runs-on: macos-26
     timeout-minutes: 60
     steps:
@@ -131,12 +146,12 @@ jobs:
           bun-version: 1.4.2
 
       - name: Setup Node
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: 22
 
       - name: Cache Electron binaries
-        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
         with:
           path: |
             ~/Library/Caches/electron
diff --git a/.github/workflows/stickydisk-gc.yml b/.github/workflows/disk-gc.yml
similarity index 97%
rename from .github/workflows/stickydisk-gc.yml
rename to .github/workflows/disk-gc.yml
index 5ac5e54d800..24c5b02af8a 100644
--- a/.github/workflows/stickydisk-gc.yml
+++ b/.github/workflows/disk-gc.yml
@@ -1,7 +1,7 @@
-name: Sticky Disk GC
+name: disk-gc
 
 # node_modules sticky disks are keyed on hashFiles('bun.lock') by design — see the
-# "Mount node_modules" comment in test-build.yml. A sticky disk is a mutable volume
+# cache-key comment in .github/actions/setup/action.yml. A sticky disk is a mutable volume
 # and `bun install --frozen-lockfile` adds what the lockfile needs without pruning
 # what it dropped, so branches on different lockfiles must not share one. That
 # design is correct and is preserved here.
@@ -42,7 +42,7 @@ concurrency:
 
 jobs:
   gc:
-    name: Reclaim idle node_modules sticky disks
+    name: gc
     # GitHub-hosted on purpose, not a Blacksmith runner: the CLI is a pure API
     # client, and collection has to keep working during a Blacksmith outage or a
     # CI_PROVIDER break-glass switch — exactly when disks sit idle and still bill.
@@ -120,7 +120,7 @@ jobs:
           # because the key interpolates ${{ github.event_name }} and a
           # workflow_dispatch disk already exists that an enumerated list would have
           # skipped forever. `-fork` is a separate optional segment rather than part
-          # of that class: test-build.yml appends it after the event name, so a fork
+          # of that class: the setup action appends it after the event name, so a fork
           # key reads `pull_request-fork` and a character class cannot span the
           # hyphen. Without it, fork disks would never be collected.
           #
diff --git a/.github/workflows/docs-embeddings.yml b/.github/workflows/docs-embeddings.yml
deleted file mode 100644
index f20c6491b09..00000000000
--- a/.github/workflows/docs-embeddings.yml
+++ /dev/null
@@ -1,51 +0,0 @@
-name: Process Docs Embeddings
-
-on:
-  workflow_call:
-  workflow_dispatch: # Allow manual triggering
-
-permissions:
-  contents: read
-
-jobs:
-  process-docs-embeddings:
-    name: Process Documentation Embeddings
-    # Network-bound on the embeddings API: ~9% CPU and ~3% peak memory on 8 vCPU.
-    runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-2vcpu-ubuntu-2404' || 'ubuntu-latest' }}
-    timeout-minutes: 30
-    if: github.ref == 'refs/heads/main'
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
-
-      - name: Setup Bun
-        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
-        with:
-          bun-version: 1.4.2
-
-      - name: Setup Node
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
-        with:
-          node-version: 22
-
-      - name: Cache Bun dependencies
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
-        with:
-          path: |
-            ~/.bun/install/cache
-            node_modules
-            **/node_modules
-          key: ${{ runner.os }}-bun-${{ hashFiles('**/bun.lock') }}
-          restore-keys: |
-            ${{ runner.os }}-bun-
-
-      - name: Install dependencies
-        run: bun install --frozen-lockfile --ignore-scripts
-
-      - name: Process docs embeddings
-        working-directory: ./apps/sim
-        env:
-          DATABASE_URL: ${{ secrets.DATABASE_URL }}
-          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
-        run: bun run scripts/process-docs.ts --clear 
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
new file mode 100644
index 00000000000..db99ce6b387
--- /dev/null
+++ b/.github/workflows/docs.yml
@@ -0,0 +1,40 @@
+name: docs
+
+on:
+  workflow_call:
+    secrets:
+      DATABASE_URL:
+        required: false
+      OPENAI_API_KEY:
+        required: false
+  workflow_dispatch: # Allow manual triggering
+
+permissions:
+  contents: read
+
+jobs:
+  embeddings:
+    name: embeddings
+    # Network-bound on the embeddings API: ~9% CPU and ~3% peak memory on 8 vCPU.
+    runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-2vcpu-ubuntu-2404' || 'ubuntu-latest' }}
+    timeout-minutes: 30
+    if: github.ref == 'refs/heads/main'
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        with:
+          persist-credentials: false
+
+      - name: Setup workspace
+        uses: ./.github/actions/setup
+        with:
+          provider: ${{ vars.CI_PROVIDER }}
+          node-version: '22'
+
+      - name: Process docs embeddings
+        working-directory: ./apps/sim
+        env:
+          DATABASE_URL: ${{ secrets.DATABASE_URL }}
+          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
+        run: bun run scripts/process-docs.ts --clear 
diff --git a/.github/workflows/helm.yml b/.github/workflows/helm.yml
index 0ce30eaa4fb..4c925975c5d 100644
--- a/.github/workflows/helm.yml
+++ b/.github/workflows/helm.yml
@@ -1,4 +1,4 @@
-name: Helm Chart
+name: helm
 
 on:
   push:
@@ -33,11 +33,11 @@ permissions:
 
 jobs:
   chart:
-    name: Lint, test, and validate chart
-    runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-2vcpu-ubuntu-2404' || 'ubuntu-latest' }}
+    name: chart
+    runs-on: &runner-2vcpu ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-2vcpu-ubuntu-2404' || 'ubuntu-latest' }}
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           # ct diffs the chart against the PR base to decide whether the version
           # was bumped, so a shallow clone would leave it nothing to compare.
@@ -154,12 +154,12 @@ jobs:
           done
 
   install:
-    name: Install on kind and run helm test
+    name: install
     needs: chart
     runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-4vcpu-ubuntu-2404' || 'ubuntu-latest' }}
     timeout-minutes: 25
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           persist-credentials: false
 
@@ -198,9 +198,9 @@ jobs:
   # and a release becoming public between two independent API calls would be
   # enough to make the OCI artifact and the HTTP repo install different Sims.
   release-version:
-    name: Resolve the app release
+    name: release-version
     if: github.event_name == 'push' && github.ref == 'refs/heads/main' && github.repository == 'simstudioai/sim'
-    runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-2vcpu-ubuntu-2404' || 'ubuntu-latest' }}
+    runs-on: *runner-2vcpu
     timeout-minutes: 5
     permissions:
       contents: read # Read the release list.
@@ -211,7 +211,7 @@ jobs:
       # it -- so the subject is the only source available, and the latest release
       # is the source of truth for every other push.
       #
-      # The subject pattern MUST stay identical to detect-version in ci.yml, which
+      # The subject pattern MUST stay identical to the `version` job in ci.yml, which
       # is what actually creates the tag and builds the images. If this one
       # matched a subject that one rejects, the chart would publish naming a
       # release that was never cut.
@@ -246,10 +246,10 @@ jobs:
   # rendered clean under kubeconform, and actually installed on a kind cluster.
   # A separate workflow would race those instead of waiting for them.
   publish:
-    name: Publish chart to GHCR
+    name: publish
     needs: [chart, install, release-version]
     if: github.event_name == 'push' && github.ref == 'refs/heads/main' && github.repository == 'simstudioai/sim'
-    runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-2vcpu-ubuntu-2404' || 'ubuntu-latest' }}
+    runs-on: *runner-2vcpu
     timeout-minutes: 15
     permissions:
       contents: read # Read the chart source.
@@ -257,7 +257,7 @@ jobs:
       id-token: write # Sigstore signs against the runner's OIDC identity; no key material is stored.
       attestations: write # Let actions/attest-build-provenance record the SLSA provenance.
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           persist-credentials: false
 
@@ -439,15 +439,15 @@ jobs:
   # to cut a release and push the index, and there is no reason to hand that to
   # the job holding the signing identity.
   publish-http:
-    name: Publish chart to the Helm repo
+    name: publish-http
     needs: [chart, install, release-version]
     if: github.event_name == 'push' && github.ref == 'refs/heads/main' && github.repository == 'simstudioai/sim'
-    runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-2vcpu-ubuntu-2404' || 'ubuntu-latest' }}
+    runs-on: *runner-2vcpu
     timeout-minutes: 15
     permissions:
       contents: write # Cut the chart release and push index.yaml to the pages branch.
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           # chart-releaser diffs against the previous tag to decide which charts
           # changed, so it needs the full history rather than a shallow clone.
diff --git a/.github/workflows/migrations.yml b/.github/workflows/migrate.yml
similarity index 79%
rename from .github/workflows/migrations.yml
rename to .github/workflows/migrate.yml
index 724972803be..2fc7164374a 100644
--- a/.github/workflows/migrations.yml
+++ b/.github/workflows/migrate.yml
@@ -1,4 +1,4 @@
-name: Database Migrations
+name: migrate
 
 on:
   workflow_call:
@@ -7,6 +7,17 @@ on:
         description: Target environment (production, staging, or dev)
         required: true
         type: string
+    secrets:
+      DATABASE_URL:
+        required: false
+      STAGING_DATABASE_URL:
+        required: false
+      DEV_DATABASE_URL:
+        required: false
+      MIGRATION_DATABASE_URL:
+        required: false
+      STAGING_MIGRATION_DATABASE_URL:
+        required: false
   workflow_dispatch:
     inputs:
       environment:
@@ -23,7 +34,7 @@ permissions:
 
 jobs:
   migrate:
-    name: Apply Database Migrations
+    name: migrate
     runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-4vcpu-ubuntu-2404' || 'ubuntu-latest' }}
     # Bulk projection loads and concurrent index builds can outlast ordinary schema changes.
     timeout-minutes: 300
@@ -31,25 +42,14 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
-
-      - name: Setup Bun
-        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
-          bun-version: 1.4.2
+          persist-credentials: false
 
-      - name: Cache Bun dependencies
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
+      - name: Setup workspace
+        uses: ./.github/actions/setup
         with:
-          path: |
-            ~/.bun/install/cache
-            node_modules
-            **/node_modules
-          key: ${{ runner.os }}-bun-${{ hashFiles('**/bun.lock') }}
-          restore-keys: |
-            ${{ runner.os }}-bun-
-
-      - name: Install dependencies
-        run: bun install --frozen-lockfile --ignore-scripts
+          provider: ${{ vars.CI_PROVIDER }}
+          node-version: ''
 
       # The expression maps the explicit environment input to exactly one repo
       # secret, so the job never holds another environment's database URL. An
diff --git a/.github/workflows/publish-cli.yml b/.github/workflows/publish-cli.yml
index e8cbcd55120..6e5c12e973c 100644
--- a/.github/workflows/publish-cli.yml
+++ b/.github/workflows/publish-cli.yml
@@ -1,4 +1,4 @@
-name: Publish CLI Package
+name: publish-cli
 
 on:
   push:
@@ -9,39 +9,28 @@ on:
 permissions:
   contents: read
 
+# A newer push waits for the running publish rather than racing its version check.
+concurrency:
+  group: publish-cli-${{ github.ref }}
+  cancel-in-progress: false
+
 jobs:
-  publish-npm:
+  publish:
+    name: publish
     runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-4vcpu-ubuntu-2404' || 'ubuntu-latest' }}
     timeout-minutes: 15
     steps:
       - name: Checkout repository
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
-
-      - name: Setup Bun
-        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
-          bun-version: 1.4.2
+          persist-credentials: false
 
-      - name: Setup Node.js for npm publishing
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+      - name: Setup workspace
+        uses: ./.github/actions/setup
         with:
+          provider: ${{ vars.CI_PROVIDER }}
           node-version: '22'
-          registry-url: 'https://registry.npmjs.org/'
-
-      - name: Cache Bun dependencies
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
-        with:
-          path: |
-            ~/.bun/install/cache
-            node_modules
-            **/node_modules
-          key: ${{ runner.os }}-bun-${{ hashFiles('**/bun.lock') }}
-          restore-keys: |
-            ${{ runner.os }}-bun-
-
-      - name: Install dependencies
-        working-directory: packages/cli
-        run: bun install --frozen-lockfile --ignore-scripts
+          registry-url: https://registry.npmjs.org/
 
       - name: Build package
         working-directory: packages/cli
@@ -54,8 +43,10 @@ jobs:
 
       - name: Check if version already exists
         id: version_check
+        env:
+          VERSION: ${{ steps.package_version.outputs.version }}
         run: |
-          if npm view simstudio@${{ steps.package_version.outputs.version }} version &> /dev/null; then
+          if npm view "simstudio@$VERSION" version &> /dev/null; then
             echo "exists=true" >> $GITHUB_OUTPUT
           else
             echo "exists=false" >> $GITHUB_OUTPUT
@@ -70,4 +61,6 @@ jobs:
 
       - name: Log skipped publish
         if: steps.version_check.outputs.exists == 'true'
-        run: echo "Skipped publishing because version ${{ steps.package_version.outputs.version }} already exists on npm" 
\ No newline at end of file
+        env:
+          VERSION: ${{ steps.package_version.outputs.version }}
+        run: echo "Skipped publishing because version $VERSION already exists on npm" 
\ No newline at end of file
diff --git a/.github/workflows/publish-python-sdk.yml b/.github/workflows/publish-python-sdk.yml
index 98e598b11d8..892c2903518 100644
--- a/.github/workflows/publish-python-sdk.yml
+++ b/.github/workflows/publish-python-sdk.yml
@@ -1,4 +1,4 @@
-name: Publish Python SDK
+name: publish-python-sdk
 
 on:
   push:
@@ -9,13 +9,21 @@ on:
 permissions:
   contents: write
 
+# A newer push waits for the running publish rather than racing its version check.
+concurrency:
+  group: publish-python-sdk-${{ github.ref }}
+  cancel-in-progress: false
+
 jobs:
-  publish-pypi:
+  publish:
+    name: publish
     runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-4vcpu-ubuntu-2404' || 'ubuntu-latest' }}
     timeout-minutes: 15
     steps:
       - name: Checkout repository
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        with:
+          persist-credentials: false
 
       - name: Setup Python
         uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
@@ -40,12 +48,17 @@ jobs:
 
       - name: Check if version already exists
         id: version_check
+        # Exact lookup: PyPI answers 404 only for a version it has never published. Anything other
+        # than 200 or 404 stops the job rather than guessing.
+        env:
+          VERSION: ${{ steps.package_version.outputs.version }}
         run: |
-          if pip index versions simstudio-sdk | grep -q "${{ steps.package_version.outputs.version }}"; then
-            echo "exists=true" >> $GITHUB_OUTPUT
-          else
-            echo "exists=false" >> $GITHUB_OUTPUT
-          fi
+          status="$(curl -sS -o /dev/null -w '%{http_code}' "https://pypi.org/pypi/simstudio-sdk/$VERSION/json")"
+          case "$status" in
+            200) echo "exists=true" >> "$GITHUB_OUTPUT" ;;
+            404) echo "exists=false" >> "$GITHUB_OUTPUT" ;;
+            *) echo "::error::PyPI returned HTTP $status for simstudio-sdk $VERSION" >&2; exit 1 ;;
+          esac
 
       - name: Build package
         if: steps.version_check.outputs.exists == 'false'
@@ -67,11 +80,13 @@ jobs:
 
       - name: Log skipped publish
         if: steps.version_check.outputs.exists == 'true'
-        run: echo "Skipped publishing because version ${{ steps.package_version.outputs.version }} already exists on PyPI"
+        env:
+          VERSION: ${{ steps.package_version.outputs.version }}
+        run: echo "Skipped publishing because version $VERSION already exists on PyPI"
 
       - name: Create GitHub Release
         if: steps.version_check.outputs.exists == 'false'
-        uses: softprops/action-gh-release@de2c0eb89ae2a093876385947365aca7b0e5f844 # v1
+        uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:
diff --git a/.github/workflows/publish-sim-cli.yml b/.github/workflows/publish-sim-cli.yml
index f9d9717fa30..5c9e058acb3 100644
--- a/.github/workflows/publish-sim-cli.yml
+++ b/.github/workflows/publish-sim-cli.yml
@@ -1,4 +1,4 @@
-name: Publish Sim API CLI Package
+name: publish-sim-cli
 
 on:
   push:
@@ -19,39 +19,24 @@ concurrency:
   cancel-in-progress: false
 
 jobs:
-  publish-npm:
+  publish:
+    name: publish
     runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-4vcpu-ubuntu-2404' || 'ubuntu-latest' }}
     timeout-minutes: 15
     steps:
       - name: Checkout repository
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
-
-      - name: Setup Bun
-        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
-          bun-version: 1.4.2
+          persist-credentials: false
 
       # Vitest 5 requires Node 22.12+; the published bundle is still
       # smoke-tested on Node 20 below, its minimum supported runtime.
-      - name: Setup Node
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+      - name: Setup workspace
+        uses: ./.github/actions/setup
         with:
+          provider: ${{ vars.CI_PROVIDER }}
           node-version: '22'
 
-      - name: Cache Bun dependencies
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
-        with:
-          path: |
-            ~/.bun/install/cache
-            node_modules
-            **/node_modules
-          key: ${{ runner.os }}-bun-${{ hashFiles('**/bun.lock') }}
-          restore-keys: |
-            ${{ runner.os }}-bun-
-
-      - name: Install dependencies
-        run: bun install --frozen-lockfile --ignore-scripts
-
       - name: Verify npm authentication
         env:
           NPM_CONFIG_TOKEN: ${{ secrets.NPM_TOKEN }}
diff --git a/.github/workflows/publish-sim-setup.yml b/.github/workflows/publish-sim-setup.yml
index e6284e14392..7b2cca91a20 100644
--- a/.github/workflows/publish-sim-setup.yml
+++ b/.github/workflows/publish-sim-setup.yml
@@ -1,4 +1,4 @@
-name: Publish Sim Setup Package
+name: publish-sim-setup
 
 on:
   push:
@@ -19,39 +19,24 @@ concurrency:
   cancel-in-progress: false
 
 jobs:
-  publish-npm:
+  publish:
+    name: publish
     runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-4vcpu-ubuntu-2404' || 'ubuntu-latest' }}
     timeout-minutes: 15
     steps:
       - name: Checkout repository
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
-
-      - name: Setup Bun
-        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
-          bun-version: 1.4.2
+          persist-credentials: false
 
       # Vitest 5 requires Node 22.12+; the published bundle is still
       # smoke-tested on Node 20 below, its minimum supported runtime.
-      - name: Setup Node
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+      - name: Setup workspace
+        uses: ./.github/actions/setup
         with:
+          provider: ${{ vars.CI_PROVIDER }}
           node-version: '22'
 
-      - name: Cache Bun dependencies
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
-        with:
-          path: |
-            ~/.bun/install/cache
-            node_modules
-            **/node_modules
-          key: ${{ runner.os }}-bun-${{ hashFiles('**/bun.lock') }}
-          restore-keys: |
-            ${{ runner.os }}-bun-
-
-      - name: Install dependencies
-        run: bun install --frozen-lockfile --ignore-scripts
-
       - name: Verify npm authentication
         env:
           NPM_CONFIG_TOKEN: ${{ secrets.NPM_TOKEN }}
diff --git a/.github/workflows/publish-ts-sdk.yml b/.github/workflows/publish-ts-sdk.yml
index ff75d720589..e551375f4c9 100644
--- a/.github/workflows/publish-ts-sdk.yml
+++ b/.github/workflows/publish-ts-sdk.yml
@@ -1,4 +1,4 @@
-name: Publish TypeScript SDK
+name: publish-ts-sdk
 
 on:
   push:
@@ -9,38 +9,28 @@ on:
 permissions:
   contents: write
 
+# A newer push waits for the running publish rather than racing its version check.
+concurrency:
+  group: publish-ts-sdk-${{ github.ref }}
+  cancel-in-progress: false
+
 jobs:
-  publish-npm:
+  publish:
+    name: publish
     runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-4vcpu-ubuntu-2404' || 'ubuntu-latest' }}
     timeout-minutes: 15
     steps:
       - name: Checkout repository
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
-
-      - name: Setup Bun
-        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
-          bun-version: 1.4.2
+          persist-credentials: false
 
-      - name: Setup Node.js for npm publishing
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+      - name: Setup workspace
+        uses: ./.github/actions/setup
         with:
+          provider: ${{ vars.CI_PROVIDER }}
           node-version: '22'
-          registry-url: 'https://registry.npmjs.org/'
-
-      - name: Cache Bun dependencies
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
-        with:
-          path: |
-            ~/.bun/install/cache
-            node_modules
-            **/node_modules
-          key: ${{ runner.os }}-bun-${{ hashFiles('**/bun.lock') }}
-          restore-keys: |
-            ${{ runner.os }}-bun-
-
-      - name: Install dependencies
-        run: bun install --frozen-lockfile --ignore-scripts
+          registry-url: https://registry.npmjs.org/
 
       - name: Run tests
         working-directory: packages/ts-sdk
@@ -57,8 +47,10 @@ jobs:
 
       - name: Check if version already exists
         id: version_check
+        env:
+          VERSION: ${{ steps.package_version.outputs.version }}
         run: |
-          if npm view simstudio-ts-sdk@${{ steps.package_version.outputs.version }} version &> /dev/null; then
+          if npm view "simstudio-ts-sdk@$VERSION" version &> /dev/null; then
             echo "exists=true" >> $GITHUB_OUTPUT
           else
             echo "exists=false" >> $GITHUB_OUTPUT
@@ -73,11 +65,13 @@ jobs:
 
       - name: Log skipped publish
         if: steps.version_check.outputs.exists == 'true'
-        run: echo "Skipped publishing because version ${{ steps.package_version.outputs.version }} already exists on npm"
+        env:
+          VERSION: ${{ steps.package_version.outputs.version }}
+        run: echo "Skipped publishing because version $VERSION already exists on npm"
 
       - name: Create GitHub Release
         if: steps.version_check.outputs.exists == 'false'
-        uses: softprops/action-gh-release@de2c0eb89ae2a093876385947365aca7b0e5f844 # v1
+        uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:
diff --git a/.github/workflows/deploy-trigger-dev.yml b/.github/workflows/trigger-dev.yml
similarity index 77%
rename from .github/workflows/deploy-trigger-dev.yml
rename to .github/workflows/trigger-dev.yml
index 4c43abd0574..d9de9f5f70b 100644
--- a/.github/workflows/deploy-trigger-dev.yml
+++ b/.github/workflows/trigger-dev.yml
@@ -1,4 +1,4 @@
-name: Deploy Dev Tasks
+name: trigger-dev
 
 # Independent of app CI: task packaging and deployment must never delay dev images.
 on:
@@ -16,31 +16,20 @@ concurrency:
 
 jobs:
   deploy:
-    name: Deploy Trigger.dev preview
+    name: deploy
     runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-4vcpu-ubuntu-2404' || 'ubuntu-latest' }}
     timeout-minutes: 30
     steps:
       - name: Checkout code
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
-
-      - name: Setup Bun
-        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
-          bun-version: 1.4.2
+          persist-credentials: false
 
-      - name: Cache Bun dependencies
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
+      - name: Setup workspace
+        uses: ./.github/actions/setup
         with:
-          path: |
-            ~/.bun/install/cache
-            node_modules
-            **/node_modules
-          key: ${{ runner.os }}-bun-${{ hashFiles('**/bun.lock') }}
-          restore-keys: |
-            ${{ runner.os }}-bun-
-
-      - name: Install dependencies
-        run: bun install --frozen-lockfile --ignore-scripts
+          provider: ${{ vars.CI_PROVIDER }}
+          node-version: ''
 
       - name: Upload preview version
         id: deploy
diff --git a/apps/desktop/README.md b/apps/desktop/README.md
index 309160f0339..4d0f879d94b 100644
--- a/apps/desktop/README.md
+++ b/apps/desktop/README.md
@@ -107,8 +107,8 @@ Local unsigned pre-release share: `SIM_DESKTOP_DEFAULT_ORIGIN=https://www.dev.si
 The build also derives the app icon from `SIM_DESKTOP_DEFAULT_ORIGIN`. Every channel uses the exact production icon with its white background and black `sim` mark. Non-production channels add a thin outline using existing platform colors: dev uses orange, staging uses Loop blue, and localhost uses Workflow violet. The macOS menu-bar icon also carries a compact `D`, `S`, or `L` subscript for those environments; production remains unmarked. Native Icon Composer assets live in `build/`; `scripts/build.ts` copies the selected variant to the ignored `build/generated-icon.icon` path consumed by electron-builder. Electron-builder compiles it to `Assets.car` and derives the legacy `.icns` fallback from the same source. Matching 512px PNGs in `static/` provide the Dock icon for unpackaged runs.
 
 CI (`.github/workflows/desktop-release.yml`, wired into `ci.yml`):
-- Stable builds run only after `create-release` on a `vX.Y.Z:` commit to main — **never before**: `scripts/create-single-release.ts` skips creation if the tag exists, so a desktop job publishing first would eat the changelog. Stable assets remain on `simstudioai/sim`; dev/staging assets publish to the public `simstudioai/sim-desktop-releases` repository so source-repository followers are not notified for internal shell builds. The job builds `--publish never`; reruns verify the size and SHA-256 digest of existing release assets instead of overwriting them.
-- **Secrets gate**: `check-desktop-signing` in `ci.yml` probes the six Apple secrets and skips the desktop job with a warning until they exist — releases never fail on a missing Apple account, and the first release after the secrets land ships desktop artifacts automatically. Manual/one-off builds: Actions → "Desktop Release (macOS)" → Run workflow with a `vX.Y.Z` version (`publish: false` uploads artifacts to the run instead of the release).
+- Stable builds run only after `release` on a `vX.Y.Z:` commit to main — **never before**: `scripts/create-single-release.ts` skips creation if the tag exists, so a desktop job publishing first would eat the changelog. Stable assets remain on `simstudioai/sim`; dev/staging assets publish to the public `simstudioai/sim-desktop-releases` repository so source-repository followers are not notified for internal shell builds. The job builds `--publish never`; reruns verify the size and SHA-256 digest of existing release assets instead of overwriting them.
+- **Secrets gate**: `desktop-signing` in `ci.yml` probes the six Apple secrets and skips the desktop job with a warning until they exist — releases never fail on a missing Apple account, and the first release after the secrets land ships desktop artifacts automatically. Manual/one-off builds: Actions → "desktop-release" → Run workflow with a `vX.Y.Z` version (`publish: false` uploads artifacts to the run instead of the release).
 - The product semver is **injected** from the release tag into `apps/desktop/package.json` at build time (repo package versions are placeholders). A mismatch guard fails the build.
 - Fuses are flipped at package time (`electronFuses` in `electron-builder.yml`): runAsNode off, NODE_OPTIONS off, inspect args off, ASAR-only + integrity validation, and cookie encryption on. The packaged smoke test asserts every fuse byte so Electron upgrades fail until new fuses receive an explicit policy.
 - **Cookie-encryption go/no-go**: on every Electron bump, verify a packaged build keeps its session across relaunch (there are historical cookie-persistence bugs with the `EnableCookieEncryption` fuse). If it reproduces, set `enableCookieEncryption: false` and record it here.
diff --git a/apps/sim/ee/scim/TESTING.md b/apps/sim/ee/scim/TESTING.md
index bb73c2a942f..3a12121a398 100644
--- a/apps/sim/ee/scim/TESTING.md
+++ b/apps/sim/ee/scim/TESTING.md
@@ -76,7 +76,7 @@ timeout.
 
 ## Continuous integration and PostgreSQL regressions
 
-The `End-to-end over real HTTP` job in `.github/workflows/test-build.yml`
+The `e2e (scim)` job in `.github/workflows/checks.yml`
 provisions its own database through `db:migrate`, starts a local Next.js app
 with hosted Enterprise configuration, and runs the HTTP suite above. It has its
 own database because the hosted app runs background usage replay against it.
@@ -102,8 +102,8 @@ transaction. Hosted billing flags are configured for the test; subscription
 and entitlement reads use real PostgreSQL with the transaction tripwire enabled.
 The suite checks an active Enterprise subscription, an ended one, and a real
 billing query failure that must propagate instead of releasing directory locks.
-The `PostgreSQL integration` job, which runs every `*.integration.ts` against
-both `db:push` and `db:migrate`, also runs `lib/auth/sso/application/admit-sso-user.integration.ts`,
+The `integration` jobs, which run every `*.integration.ts` against
+both `db:push` and `db:migrate`, also run `lib/auth/sso/application/admit-sso-user.integration.ts`,
 which verifies that SCIM's `disableJit` setting blocks fresh SSO membership,
 preserves existing membership, and permits JIT when disabled. These checks run
 the admission operation and Enterprise entitlement reads through PostgreSQL.
diff --git a/scripts/desktop-prune-workflow.test.ts b/scripts/desktop-prune-workflow.test.ts
index 03348e7b33d..1deae32d7a8 100644
--- a/scripts/desktop-prune-workflow.test.ts
+++ b/scripts/desktop-prune-workflow.test.ts
@@ -5,7 +5,7 @@ import { join } from 'node:path'
 import { describe, expect, it } from 'vitest'
 
 const workflow = readFileSync(new URL('../.github/workflows/ci.yml', import.meta.url), 'utf8')
-const job = workflow.split('  prune-desktop-prereleases:')[1]
+const job = workflow.split('  prerelease-prune:')[1]
 const step = job?.match(/^ {8}run: \|\r?\n((?: {10}.*(?:\r?\n|$)|\r?\n)+)/m)?.[1]
 if (!step) throw new Error('Desktop pruning shell step is missing')
 const script = step.replace(/^ {10}/gm, '')
@@ -103,7 +103,7 @@ describe('desktop release change detection shell', () => {
     ['apps/desktop/src/main/index.ts', true],
     ['packages/desktop-bridge/src/index.ts', true],
     ['packages/browser-protocol/src/index.ts', true],
-    ['.github/workflows/migrations.yml', false],
+    ['.github/workflows/migrate.yml', false],
     ['.github/workflows/ci.yml.backup', false],
     ['apps/sim/app/page.tsx', false],
   ])('classifies %s as desktop change=%s', (path, changed) => {
diff --git a/scripts/dev-deployment-workflow.test.ts b/scripts/dev-deployment-workflow.test.ts
index c276071304c..a1d5e0c7c4a 100644
--- a/scripts/dev-deployment-workflow.test.ts
+++ b/scripts/dev-deployment-workflow.test.ts
@@ -4,10 +4,7 @@ import { runInNewContext } from 'node:vm'
 import { describe, expect, it } from 'vitest'
 
 const ci = readFileSync(new URL('../.github/workflows/ci.yml', import.meta.url), 'utf8')
-const tasks = readFileSync(
-  new URL('../.github/workflows/deploy-trigger-dev.yml', import.meta.url),
-  'utf8'
-)
+const tasks = readFileSync(new URL('../.github/workflows/trigger-dev.yml', import.meta.url), 'utf8')
 
 /** Evaluate the checked-in job condition for concrete GitHub job outcomes. */
 function eligible(job: string, branch: string, results: Record<string, string> = {}) {
@@ -17,11 +14,11 @@ function eligible(job: string, branch: string, results: Record<string, string> =
   const needs = Object.fromEntries(
     Object.entries({
       migrate: 'success',
-      'build-amd64': 'success',
+      'image-amd64': 'success',
       'migrate-dev': 'success',
-      'build-dev': 'success',
-      'prepare-trigger': 'success',
-      'promote-images': 'success',
+      'image-dev': 'success',
+      'trigger-upload': 'success',
+      promote: 'success',
       ...results,
     }).map(([name, result]) => [name, { result, outputs: { promoted: 'true' } }])
   )
@@ -66,9 +63,9 @@ ${script}`,
 
 describe('dev deployment independence', () => {
   it('promotes dev images with the skipped Trigger jobs and no cutover waiter', () => {
-    expect(eligible('prepare-trigger', 'dev')).toBe(false)
-    expect(eligible('promote-trigger', 'dev')).toBe(false)
-    expect(eligible('promote-images', 'dev', { 'prepare-trigger': 'skipped' })).toBe(true)
+    expect(eligible('trigger-upload', 'dev')).toBe(false)
+    expect(eligible('trigger-promote', 'dev')).toBe(false)
+    expect(eligible('promote', 'dev', { 'trigger-upload': 'skipped' })).toBe(true)
   })
 
   it('does not roll tasks back when an older push is retried', () => {
diff --git a/scripts/migrations-workflow.test.ts b/scripts/migrations-workflow.test.ts
index 2214709fb43..ce25ddd7058 100644
--- a/scripts/migrations-workflow.test.ts
+++ b/scripts/migrations-workflow.test.ts
@@ -2,10 +2,7 @@ import { spawnSync } from 'node:child_process'
 import { readFileSync } from 'node:fs'
 import { describe, expect, it } from 'vitest'
 
-const workflow = readFileSync(
-  new URL('../.github/workflows/migrations.yml', import.meta.url),
-  'utf8'
-)
+const workflow = readFileSync(new URL('../.github/workflows/migrate.yml', import.meta.url), 'utf8')
 const step = workflow.match(/^ {8}run: \|\r?\n((?: {10}.*(?:\r?\n|$)|\r?\n)+)/m)?.[1]
 if (!step) throw new Error('Migration workflow must contain its schema application shell step')
 const script = step.replace(/^ {10}/gm, '')