ci(warden): Reduce PR review cost and enforce timeout

.agents/skills/xcodebuildmcp-snapshot-fixture-review/SKILL.md

@@ -30,11 +30,15 @@ Review guardrails for fixture and snapshot contract integrity.
 - JSON fixtures preserve stable structured output envelopes.
 - Volatile values are normalized in code, not patched ad hoc in fixtures.
 - Missing fixtures are generated through the snapshot update flow.
-
-## Validation
-
-- `npm run test:snapshots`
-- `npm run test:schema-fixtures`
-- `npm test -- src/snapshot-tests/__tests__/fixture-io.test.ts`
-- `npm test -- src/snapshot-tests/__tests__/json-normalize.test.ts`
-- `npx skill-check .agents/skills/xcodebuildmcp-snapshot-fixture-review`
+- Verify project-defined normalization sentinels in normalization code and tests before reporting
+  them as implausible fixture values. In particular, `99999` is an intentional sentinel for
+  volatile UI capture counts.
+- Group every occurrence of the same root cause into one finding and list the affected fixtures.
+  Do not emit separate findings for equivalent CLI, MCP, text, or JSON drift.
+- Do not repeat a finding that is already resolved by the current diff.
+
+## Review limits
+
+- Review the changed fixtures and the directly relevant normalization or contract code only.
+- Do not run snapshot or smoke suites as part of an automated PR review.
+- Prefer one high-confidence cross-fixture finding over multiple speculative discrepancies.

.agents/skills/xcodebuildmcp-test-boundary-review/SKILL.md

@@ -17,6 +17,7 @@ Review guardrails for test isolation, scope, and contract validation.
 - `src/**/__tests__/**`
 - `src/test-utils/**`
 - `src/snapshot-tests/**`
+- `scripts/**/__tests__/**`
 - `package.json`
 - `xcodebuildmcp.com/app/docs/_content/testing.mdx`
 - `xcodebuildmcp.com/app/docs/_content/contributing.mdx`

.github/workflows/warden-watchdog.yml

@@ -0,0 +1,39 @@
+name: Warden watchdog
+
+on:
+  workflow_run:
+    workflows: [Warden]
+    # GitHub omits `requested` for reruns, so reruns are caught when they enter `in_progress`.
+    types: [requested, in_progress]
+
+permissions:
+  actions: write
+  contents: read
+
+jobs:
+  enforce-timeout:
+    if: >-
+      github.event.workflow_run.event == 'pull_request' &&
+      (github.event.action == 'requested' || github.event.workflow_run.run_attempt > 1)
+    runs-on: ubuntu-latest
+    timeout-minutes: 11
+    concurrency:
+      group: warden-watchdog-${{ github.event.workflow_run.id }}
+      cancel-in-progress: true
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
+        with:
+          ref: ${{ github.event.repository.default_branch }}
+          persist-credentials: false
+      - name: Setup Node.js
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
+        with:
+          node-version: '24'
+      - name: Enforce Warden timeout
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+          TARGET_RUN_ID: ${{ github.event.workflow_run.id }}
+          TARGET_RUN_ATTEMPT: ${{ github.event.workflow_run.run_attempt }}
+          WARDEN_MAX_RUNTIME_SECONDS: 600
+          WARDEN_POLL_SECONDS: 15
+        run: node scripts/warden-watchdog.mjs

AGENTS.md

@@ -48,7 +48,9 @@ ESM TypeScript project (`type: module`). Key layers:
 - NEVER remove or downgrade code to fix type errors from outdated dependencies; upgrade the dependency instead
 - Always ask before removing functionality or code that appears to be intentional
 - Do not add fallback behavior by default. If required context, configuration, runtime state, or dependencies are missing, fail loudly and fix the caller/setup instead of silently switching to an alternate path. Add a fallback only when explicitly requested or when it is a documented product requirement.
-- Follow TypeScript best practices
+- Review the complete merge-base diff and trace changed or reused helper contracts, including error and sentinel returns, through callers, consumers, tests, and operational configuration.
+- Verify standard quality commands include every changed path and exercise exact entry points and argument variants; validate explicitly when they do not.
+- For asynchronous, workflow, or process-boundary changes, enumerate lifecycle states, retries, supersession, and race transitions; test terminal outcomes and missing or optional metadata.
 
 ## Import Conventions
 - ESM with explicit `.ts` extensions in `src/` (tsup rewrites to `.js` at build)
@@ -92,6 +94,7 @@ When reading issues:
 - CLI design note: do not rely on CLI session-default writes. CLI is intentionally deterministic for CI/scripting and should use explicit command arguments as the primary input surface.
 - When working on skill sources in `skills/`, use the `skill-creator` skill workflow.
 - After modifying any skill source, run `npx skill-check <skill-directory>` and address all errors/warnings before handoff.
+- Before handoff, run the matching manual Warden review for high-risk changes: runtime/CLI/daemon boundaries → `xcodebuildmcp-runtime-boundary-review`; test infrastructure or harnesses → `xcodebuildmcp-test-boundary-review`; tool manifests, schemas, or contracts → `xcodebuildmcp-tool-contract-review`. Invoke only applicable skills with `warden --skill <name>`.
 -
 ## Multi-process filesystem state
 - XcodeBuildMCP explicitly supports multiple concurrent MCP server, daemon, CLI, test, and helper processes for the same or different workspaces.

CLAUDE.md

@@ -7,7 +7,9 @@
 - NEVER remove or downgrade code to fix type errors from outdated dependencies; upgrade the dependency instead
 - Always ask before removing functionality or code that appears to be intentional
 - Do not add fallback behavior by default. If required context, configuration, runtime state, or dependencies are missing, fail loudly and fix the caller/setup instead of silently switching to an alternate path. Add a fallback only when explicitly requested or when it is a documented product requirement.
-- Follow TypeScript best practices
+- Review the complete merge-base diff and trace changed or reused helper contracts, including error and sentinel returns, through callers, consumers, tests, and operational configuration.
+- Verify standard quality commands include every changed path and exercise exact entry points and argument variants; validate explicitly when they do not.
+- For asynchronous, workflow, or process-boundary changes, enumerate lifecycle states, retries, supersession, and race transitions; test terminal outcomes and missing or optional metadata.
 
 ## Test Conventions
 - Snapshot tests (`*.snapshot.test.ts`) must only assert generated tool output against fixtures. Move helper, parser, schema, setup, or behavior assertions to non-snapshot unit/integration tests.
@@ -25,6 +27,7 @@ When reading issues:
 - CLI design note: do not rely on CLI session-default writes. CLI is intentionally deterministic for CI/scripting and should use explicit command arguments as the primary input surface.
 - When working on skill sources in `skills/`, use the `skill-creator` skill workflow.
 - After modifying any skill source, run `npx skill-check <skill-directory>` and address all errors/warnings before handoff.
+- Before handoff, run the matching manual Warden review for high-risk changes: runtime/CLI/daemon boundaries → `xcodebuildmcp-runtime-boundary-review`; test infrastructure or harnesses → `xcodebuildmcp-test-boundary-review`; tool manifests, schemas, or contracts → `xcodebuildmcp-tool-contract-review`. Invoke only applicable skills with `warden --skill <name>`.
 -
 ## Multi-process filesystem state
 - XcodeBuildMCP explicitly supports multiple concurrent MCP server, daemon, CLI, test, and helper processes for the same or different workspaces.

package.json

@@ -30,10 +30,10 @@
     "package:macos:universal": "scripts/package-macos-portable.sh --universal",
     "verify:portable": "scripts/verify-portable-install.sh",
     "homebrew:formula": "scripts/create-homebrew-formula.sh",
-    "lint": "eslint 'src/**/*.{js,ts}' 'benchmarks/claude-ui/**/*.ts'",
-    "lint:fix": "eslint 'src/**/*.{js,ts}' 'benchmarks/claude-ui/**/*.ts' --fix",
-    "format": "prettier --write 'src/**/*.{js,ts}' 'benchmarks/claude-ui/**/*.{ts,md,yml}'",
-    "format:check": "prettier --check 'src/**/*.{js,ts}' 'benchmarks/claude-ui/**/*.{ts,md,yml}'",
+    "lint": "eslint 'src/**/*.{js,ts}' 'benchmarks/claude-ui/**/*.ts' scripts/warden-watchdog.mjs scripts/__tests__/warden-watchdog.test.mjs",
+    "lint:fix": "eslint 'src/**/*.{js,ts}' 'benchmarks/claude-ui/**/*.ts' scripts/warden-watchdog.mjs scripts/__tests__/warden-watchdog.test.mjs --fix",
+    "format": "prettier --write 'src/**/*.{js,ts}' 'benchmarks/claude-ui/**/*.{ts,md,yml}' scripts/warden-watchdog.mjs scripts/__tests__/warden-watchdog.test.mjs",
+    "format:check": "prettier --check 'src/**/*.{js,ts}' 'benchmarks/claude-ui/**/*.{ts,md,yml}' scripts/warden-watchdog.mjs scripts/__tests__/warden-watchdog.test.mjs",
     "typecheck": "npx tsc --noEmit && npx tsc -p tsconfig.test.json && npx tsc -p tsconfig.benchmarks.json",
     "typecheck:tests": "npx tsc -p tsconfig.test.json",
     "inspect": "npx @modelcontextprotocol/inspector@latest node build/cli.js mcp",
@@ -47,6 +47,8 @@
     "license:check": "npx -y license-checker --production --onlyAllow 'MIT;ISC;BSD-2-Clause;BSD-3-Clause;Apache-2.0;Unlicense;FSL-1.1-MIT;BlueOak-1.0.0'",
     "knip": "knip",
     "test": "vitest run",
+    "posttest": "npm run test:warden-watchdog",
+    "test:warden-watchdog": "node --test scripts/__tests__/warden-watchdog.test.mjs",
     "test:schema-fixtures": "vitest run src/snapshot-tests/__tests__/json-fixture-schema.test.ts",
     "test:snapshot": "npm run build && vitest run --config vitest.snapshot.config.ts",
     "test:snapshots": "npm run test:snapshot",