canary-executionlisted

# canary-execution skill ## Purpose Make "tests run locally" and "tests validate canary deploys" compatible — same code, separate entry point. ## The contract ### Entry point The canary suite runs from a **dedicated entry point** — a separate npm script (`test:canary`) or a dedicated Playwright project (e.g., `playwright.canary.config.ts`). It must never reuse `test:smoke` or the local smoke runner. The separation is mechanical: CI wires two distinct jobs — `smoke` (pre-merge, boots local deps, runs `test:smoke`) and `canary` (post-deploy, sets `TEST_TARGET_URL`, runs `test:canary`). These jobs must not share a script. ### Mode selection Every canary-eligible smoke/E2E test reads `TEST_TARGET_URL` at process start: - **Unset** → `local` mode. Test boots its dependencies inline (docker-compose / testcontainers / in-memory) and makes HTTP calls to `http://localhost:<port>`. - **Set to a URL** → `canary` mode. Test skips local boot. Makes HTTP calls directly to `$TEST_TARGET_URL`. Uses canary-only auth credentials supplied via separate env vars (e.g., `TEST_AUTH_TOKEN`). The test code is identical. Only the setup-fixture layer branches. ### Eligibility rules A test is canary-eligible iff **all** of the following hold: 1. **Layer** ∈ {smoke, E2E}. Never canary unit or integration tests — they require boundaries that don't exist in a deployed environment. 2. **Criticality** ∈ {critical, high}. Don't waste canary budget on medium-tier flows. 3. **Read-only OR self-clea