test(smoke): add deterministic composition probes to the e2e smoke tier

The deterministic tier covered bash/script/bun/uv/timeout and two trigger rules. It did not cover join semantics against a skipped upstream, until_bash termination, output_type, or fan-out at all — so the composition primitives merged in #2223/#2224/#2467 had no unattended regression test.

Four workflows, no AI nodes, all assertions in bash:

  e2e-joins              trigger_rule all_done + none_failed_min_one_success against a
                         SKIPPED upstream, output_type, and a loop_group terminating
                         on until_bash
  e2e-echo-child         one bash node; the cheapest possible fan-out child
  e2e-fanout-alldone     fan_out over a literal list with one failing child; all_done
                         must aggregate it as {error,status}
  e2e-fanout-allsuccess  same list, join: all_success — must FAIL the node. Wired as a
                         negative test, so a zero exit is the regression and CI inverts
                         the assertion

Each runs in seconds and costs nothing, which is what makes them viable on every push
rather than as a deliberate exercise. Verified with --no-worktree, the form CI uses:
the first two exit 0, the third exits 1.

Also adds rasmus-tests/ for the AI-driven probes these were derived from. Those need a
funded provider and minutes per run, so they stay out of CI — t8-cascade additionally
needs a concurrent abandon to observe cascade-cancel and cannot run unattended without
a driver script. The split is now readable from either side: unattended work lives in
test-workflows/, subscription work in rasmus-tests/.

Two engine findings came out of running them: #2494 and #2495.

Author: Wirasm

.archon/config.yaml

@@ -3,3 +3,11 @@ worktree:
 
 docs:
   path: packages/docs-web/src/content/docs
+
+aliases:
+  # Cheap model for the t1–t4 engine-primitive test workflows. Every test workflow
+  # references `@mini` rather than a literal model id, so retargeting them all is a
+  # one-line edit here — and so per-run tier/alias rebinding (#2481) can reach them.
+  '@mini':
+    provider: pi
+    model: minimax/MiniMax-M3

.archon/workflows/rasmus-tests/README.md

@@ -0,0 +1,18 @@
+# rasmus-tests
+
+Test workflows running on Rasmus's config.
+
+They exercise engine primitives against real GitHub issues, so they need a funded
+provider and take minutes per run — that is why they are not in CI. The deterministic
+counterparts that *are* in CI live in `../test-workflows/` (`e2e-joins`,
+`e2e-fanout-alldone`, `e2e-fanout-allsuccess`).
+
+| Workflow | Exercises |
+| --- | --- |
+| `t1-fix-issue` | structured output · `when:` · `cancel:` · `loop_group` self-heal via `$LOOP_PREV` |
+| `t2-fix-issue-include` + `t2-review-block` | `include:` · `with:` → `$INPUTS` at load · namespacing |
+| `t3-triage-fanout` + `t3-probe-issue` | `fan_out` over a runtime list · `max_parallel` · `parent_run_id` |
+| `t4-subrun` | `workflow:` child run · `input:` forwarding · output threading |
+| `t8-cascade` + `t8-slow-child` | cascade-cancel — needs a concurrent `archon workflow abandon` |
+
+All AI nodes resolve through the `@mini` alias in `.archon/config.yaml`.

.archon/workflows/rasmus-tests/t1-fix-issue.yaml

@@ -0,0 +1,117 @@
+name: t1-fix-issue
+description: |
+  ENGINE-PRIMITIVE TEST — not a quality workflow. Prompts are deliberately minimal;
+  the point is to exercise the engine, not to produce good output.
+
+  Proves: bash node (stdout as output) · structured output + strict `.field` access ·
+  `when:` on a structured field · `cancel:` as a first-class outcome · `loop_group`
+  self-heal, where BOTH the validation failure and the review findings feed the next
+  implement iteration via `$LOOP_PREV` · `until:` signal · `max_iterations` bound.
+
+  NO ARTIFACTS. Nothing writes to $ARTIFACTS_DIR. Every hand-off between nodes is
+  `$node.output`. This is the by-reference-vs-by-value experiment (#2123, #1848) run
+  as a workflow: if in-and-out alone is sufficient here, that is evidence.
+
+  Usage: archon workflow run t1-fix-issue "<issue-number>"
+model: '@mini'
+
+nodes:
+  - id: fetch
+    depends_on: []
+    bash: |
+      set -euo pipefail
+      gh issue view "$ARGUMENTS" --json number,title,body,comments
+
+  - id: assess
+    depends_on: [fetch]
+    prompt: |
+      $fetch.output
+
+      Read the code this issue refers to. Is the problem real and worth fixing now?
+    output_format:
+      type: object
+      properties:
+        verdict:
+          type: string
+          enum: ['fix', 'skip']
+        reason:
+          type: string
+      required: [verdict, reason]
+
+  - id: bail
+    depends_on: [assess]
+    when: "$assess.output.verdict == 'skip'"
+    cancel: 'Not worth fixing — $assess.output.reason'
+
+  - id: build
+    depends_on: [assess]
+    when: "$assess.output.verdict == 'fix'"
+    loop_group:
+      until: 'BUILD-CLEAN'
+      max_iterations: 3
+      nodes:
+        - id: implement
+          depends_on: []
+          prompt: |
+            Fix this issue with the smallest change that works, then commit.
+            Do not write any report files — your reply is the only output that matters.
+
+            $fetch.output
+
+            Findings from the previous attempt (empty on the first iteration):
+            $LOOP_PREV.review.output
+
+        - id: check
+          depends_on: [implement]
+          bash: |
+            # This node must ALWAYS exit 0. A failing body node fails the whole
+            # loop_group immediately — which would kill the very loop that exists to
+            # fix the failure. So the gate REPORTS a verdict and `review` acts on it.
+            # (Fail-fast is right for a linear DAG and wrong inside a self-heal loop.)
+            set -o pipefail
+            ok=1
+            echo '=== type-check ==='
+            bun run type-check 2>&1 | tail -30 || ok=0
+            # `bun --filter`, never a bare `bun test <dir>`. A single invocation over a
+            # whole package runs every file in ONE process, where conflicting
+            # `mock.module()` calls poison each other — 616 spurious failures on an
+            # unmodified tree. Each package's own `test` script carries the splits that
+            # avoid it (see CLAUDE.md, "Test isolation").
+            for p in $(git diff --name-only "$BASE_BRANCH"...HEAD | grep '^packages/' | cut -d/ -f2 | sort -u); do
+              echo "=== tests: @archon/$p ==="
+              bun --filter "@archon/$p" test 2>&1 | tail -20 || ok=0
+            done
+            if [ "$ok" = 1 ]; then echo 'VALIDATION: PASS'; else echo 'VALIDATION: FAIL'; fi
+
+        - id: review
+          depends_on: [check]
+          prompt: |
+            Validation output — type-check, plus the tests of every package the diff touches:
+            $check.output
+
+            Review the working-tree diff against $BASE_BRANCH.
+
+            The validation above is AUTHORITATIVE and you cannot overrule it. If it ends
+            in `VALIDATION: FAIL`, do not reply BUILD-CLEAN no matter how the diff reads —
+            say what failed and what to change.
+
+            If it ends in `VALIDATION: PASS` and you have no findings of your own, reply
+            with exactly: BUILD-CLEAN
+            Otherwise list what to fix, in one short paragraph. That text is fed back
+            to the implementer verbatim on the next iteration.
+
+  - id: open-pr
+    depends_on: [build]
+    bash: |
+      set -euo pipefail
+      git push -u origin HEAD
+      gh pr create --base "$BASE_BRANCH" --title "fix: issue $ARGUMENTS" --body "$(cat <<'ARCHON_EOF'
+      Automated fix for issue $ARGUMENTS.
+
+      ## Assessment
+      $assess.output.reason
+
+      ## Final review pass
+      $build.output
+      ARCHON_EOF
+      )"

.archon/workflows/rasmus-tests/t2-fix-issue-include.yaml

@@ -0,0 +1,44 @@
+name: t2-fix-issue-include
+description: |
+  ENGINE-PRIMITIVE TEST — t1 with the review step pulled in by reference instead of
+  written inline. Same task, different composition.
+
+  Proves: `include:` load-time inlining · `with:` inputs and the `$INPUTS.<name>`
+  macro (#2467, merged 5 Aug) · namespacing — the block's internal `$gather.output`
+  ref must survive being renamed to `review__gather` · `$includeId.output` resolving
+  to the block's terminal node.
+
+  Worth running once with a required input REMOVED, to confirm it fails the LOAD
+  rather than reaching a model.
+
+  Usage: archon workflow run t2-fix-issue-include "<issue-number>"
+model: '@mini'
+
+nodes:
+  - id: fetch
+    depends_on: []
+    bash: |
+      set -euo pipefail
+      gh issue view "$ARGUMENTS" --json number,title,body
+
+  - id: implement
+    depends_on: [fetch]
+    prompt: |
+      Fix this issue with the smallest change that works, then commit.
+
+      $fetch.output
+
+  - id: review
+    depends_on: [implement]
+    include: t2-review-block
+    with:
+      base: dev
+      focus: correctness of the fix, and nothing else
+
+  - id: summary
+    depends_on: [review]
+    prompt: |
+      Review findings:
+      $review.output
+
+      State in one line whether this change is ready to open as a PR.

.archon/workflows/rasmus-tests/t2-review-block.yaml

@@ -0,0 +1,26 @@
+name: t2-review-block
+description: |
+  ENGINE-PRIMITIVE TEST — a shared building block, not a standalone workflow.
+  Authored once, pulled into any workflow that needs a review pass via `include:`.
+
+  Takes two load-time inputs: `$INPUTS.base` (branch to diff against) and
+  `$INPUTS.focus` (what the reviewer should care about). Both are substituted at
+  DISCOVERY time, before anything executes — a missing one fails the load.
+model: '@mini'
+
+nodes:
+  - id: gather
+    depends_on: []
+    bash: |
+      set -euo pipefail
+      git diff "$INPUTS.base"...HEAD --stat
+      echo '---'
+      git diff "$INPUTS.base"...HEAD | head -400
+
+  - id: critique
+    depends_on: [gather]
+    prompt: |
+      $gather.output
+
+      Review this diff. Focus on: $INPUTS.focus
+      Reply with your findings in one short paragraph, or "no findings".

.archon/workflows/rasmus-tests/t3-probe-issue.yaml

@@ -0,0 +1,45 @@
+name: t3-probe-issue
+description: |
+  ENGINE-PRIMITIVE TEST — the fan-out child. Probes ONE issue and reports a triage
+  verdict. Read-only: it reads the issue, reads the code, reads direction.md, and
+  writes nothing. No labels are applied — the parent reports proposals to a human.
+
+  Runs standalone too: archon workflow run t3-probe-issue "<issue-number>"
+model: '@mini'
+
+# Required for the fan-out in t3-triage-fanout. Concurrent children on one shared
+# checkout take a path-exclusive lock, so without this the engine refuses to spawn
+# them at all (correctly — a lock-cancelled child is not recoverable by resume,
+# #2180). This workflow only reads the issue, the code and direction.md.
+mutates_checkout: false
+
+nodes:
+  - id: issue
+    depends_on: []
+    bash: |
+      set -euo pipefail
+      gh issue view "$ARGUMENTS" --json number,title,body,comments,labels
+
+  - id: probe
+    depends_on: [issue]
+    prompt: |
+      $issue.output
+
+      Check the issue's claims against the actual code, then check it against the
+      project direction in `.archon/maintainer-standup/direction.md`.
+
+      Pick one label:
+        should-fix    — real, in scope, worth doing
+        should-close  — not real, already fixed, or out of scope per direction.md
+        needs-human   — you cannot tell without a maintainer's judgement
+    output_format:
+      type: object
+      properties:
+        issue:
+          type: string
+        label:
+          type: string
+          enum: ['should-fix', 'should-close', 'needs-human']
+        reason:
+          type: string
+      required: [issue, label, reason]

.archon/workflows/rasmus-tests/t3-triage-fanout.yaml

@@ -0,0 +1,45 @@
+name: t3-triage-fanout
+description: |
+  ENGINE-PRIMITIVE TEST — fan-out over unlabelled issues, one child run each.
+
+  Proves: `fan_out` over a runtime item list (#2224, merged 5 Aug) · `max_parallel` ·
+  `join: all_done` · child runs with `parent_run_id` · terminal outputs threading back
+  into the parent as `$node.output`.
+
+  READ-ONLY BY DESIGN. No child writes anything, so no child needs isolation — this is
+  the common fan-out shape, and the one that shows isolation is not a prerequisite.
+  Labels are proposed to a human, never applied.
+
+  The assertions that matter here are negative: a child returning `needs-human` must
+  not fail the parent, and abandoning the parent must cascade-cancel the children.
+
+  Usage: archon workflow run t3-triage-fanout ""
+model: '@mini'
+
+nodes:
+  - id: find
+    depends_on: []
+    bash: |
+      set -euo pipefail
+      gh issue list --state open --search 'no:label' --limit 3 --json number \
+        | jq -c '[.[].number | tostring]'
+
+  - id: probe-each
+    depends_on: [find]
+    workflow: t3-probe-issue
+    input: '$find.output'
+    fan_out:
+      # 2, not 3 — with max_parallel == item count nothing ever queues, so the
+      # concurrency bound would go untested. 3 items through a width of 2 forces
+      # one child to wait for a slot.
+      max_parallel: 2
+      items: '$find.output'
+      join: all_done
+
+  - id: triage
+    depends_on: [probe-each]
+    prompt: |
+      $probe-each.output
+
+      List each issue with its proposed label and a one-line reason.
+      End with the single label you are least confident about, and why.

.archon/workflows/rasmus-tests/t4-subrun.yaml

@@ -0,0 +1,27 @@
+name: t4-subrun
+description: |
+  ENGINE-PRIMITIVE TEST — the minimal sub-run. A parent that does nothing except
+  start one child and use its result.
+
+  Proves: `workflow:` as a runtime child run (#2121 phase 2) · its own run row with
+  `parent_run_id` · `input:` forwarding as the child's `$ARGUMENTS` · the child's
+  terminal output threading back as `$node.output`.
+
+  Deliberately trivial. If this fails, the sub-run mechanism is what failed — there
+  is nothing else in the graph to blame.
+
+  Usage: archon workflow run t4-subrun "<issue-number>"
+model: '@mini'
+
+nodes:
+  - id: delegate
+    depends_on: []
+    workflow: t3-probe-issue
+    input: '$ARGUMENTS'
+
+  - id: report
+    depends_on: [delegate]
+    prompt: |
+      $delegate.output
+
+      State in one line what the child run concluded.

.archon/workflows/rasmus-tests/t8-cascade.yaml

@@ -0,0 +1,23 @@
+name: t8-cascade
+description: |
+  ENGINE-PRIMITIVE TEST — cascade-cancel. Fans out three sleeping children, so the
+  parent can be abandoned mid-flight and the children observed.
+
+  Pass condition: abandoning the parent leaves every non-terminal child `cancelled`,
+  not orphaned `running`. Nothing here spends a model call.
+
+  Usage: archon workflow run t8-cascade "" --detach   # then: archon workflow abandon <id>
+mutates_checkout: false
+
+nodes:
+  - id: spread
+    depends_on: []
+    workflow: t8-slow-child
+    fan_out:
+      items: '["a", "b", "c"]'
+      max_parallel: 3
+      join: all_done
+
+  - id: after
+    depends_on: [spread]
+    bash: echo 'should not be reached if the parent was abandoned'

.archon/workflows/rasmus-tests/t8-slow-child.yaml

@@ -0,0 +1,14 @@
+name: t8-slow-child
+description: |
+  ENGINE-PRIMITIVE TEST — a child that takes long enough to interrupt. One bash node
+  that sleeps, so cascade-cancel can be observed without spending a model call.
+mutates_checkout: false
+
+nodes:
+  - id: wait
+    depends_on: []
+    timeout: 120000
+    bash: |
+      echo "child starting: $ARGUMENTS"
+      sleep 60
+      echo "child finished: $ARGUMENTS"