Fix main CI failures after legacy removals

.github/workflows/workflow-contracts.yml

@@ -227,26 +227,6 @@ jobs:
           npm run check:svg
           npm run docs:build
 
-  github-issue-query:
-    name: GitHub issue GraphQL integration
-    if: github.event_name != 'pull_request'
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    permissions:
-      contents: read
-      issues: read
-    steps:
-      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
-        with:
-          persist-credentials: false
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
-        with:
-          node-version: 24
-      - name: Test issueOrPullRequest query
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: node --test tests/integration/github-issue-or-pull-request.test.mjs
-
   dependabot-operational-value:
     name: Dependabot operational value integration
     if: github.event_name != 'pull_request'

scripts/run-unit-area.mjs

@@ -11,7 +11,7 @@ export const unitTestAreas = {
   dashboard: [/^dashboard-/, /^cli-action-/, /^server-azure-/],
   workflows: [
     /^workflow-contract-/, /^control-/, /^campaign-/, /^contoso-/,
-    /^github-apps\./, /^gh-aw-version-/, /^release-workflow\./, /^build-release\./,
+    /^github-apps\./, /^gh-aw-version-/, /^release-workflow\./, /^release-schedule\./, /^build-release\./,
     /^add-operational-value-skill\./, /^token-intervention-lifecycle\./,
   ],
   tooling: [

server/internal/server/query_cache_test.go

@@ -522,6 +522,8 @@ func TestQueryCacheSharedByAuthenticatedHTTPAndMCP(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
+	// The local bearer profile bypasses Redis; exercise the hosted cache path.
+	app.config.QueryCache.Disabled = false
 	alias := "agent:campaign-runs"
 	definition.Name = alias + ":source"
 	limit := 2

server/internal/server/site_embedded_test.go

@@ -16,9 +16,10 @@ import (
 )
 
 func TestEmbeddedDashboardResources(t *testing.T) {
-	t.Chdir(t.TempDir())
 	original, fixture := newLocalPostgresTestApp(t, false)
 	_ = original
+	// Leave the source checkout only after the fixture reads its relative query files.
+	t.Chdir(t.TempDir())
 	app := fixture.app(t, Config{
 		Listen: "127.0.0.1:8080", AccessToken: testAccessToken, MCPEnabled: true,
 	})

server/internal/simulator/azure_journey_test.go

@@ -84,7 +84,7 @@ func setupAzurePrivateFarm(t *testing.T, ctx context.Context, f *setupFixture, c
 	}
 	remote := filepath.Join(f.root, "published-control.git")
 	bootstrapRun(t, ctx, f.root, f.env, "git", "init", "--bare", "--quiet", "--initial-branch=main", remote)
-	bootstrapRun(t, ctx, f.checkout, f.env, "git", "add", ".github", "activity")
+	bootstrapRun(t, ctx, f.checkout, f.env, "git", "add", ".github")
 	bootstrapRun(t, ctx, f.checkout, f.env, "git", "-c", "user.name=CAO simulator", "-c", "user.email=simulator@example.invalid",
 		"commit", "-qm", "Publish reviewed private control plane")
 	bootstrapRun(t, ctx, f.checkout, f.env, "git", "push", remote, "HEAD:main")

server/internal/simulator/setup_topology_integration_test.go

@@ -335,7 +335,7 @@ func testSetupQuickstartPublication(t *testing.T, ctx context.Context, root, cat
 			f.api.mu.Unlock()
 			bootstrapRun(t, ctx, f.checkout, f.env, "git", "config", "user.name", "CAO simulator")
 			bootstrapRun(t, ctx, f.checkout, f.env, "git", "config", "user.email", "simulator@example.invalid")
-			bootstrapRun(t, ctx, f.checkout, f.env, "git", "add", ".github", "activity", "dashboard")
+			bootstrapRun(t, ctx, f.checkout, f.env, "git", "add", ".github", "dashboard")
 			bootstrapRun(t, ctx, f.checkout, f.env, "git", "commit", "-qm", "Installed runtime fixture")
 			bootstrapRun(t, ctx, f.checkout, f.env, "git", "push", "origin", "HEAD:main")
 			// The GitHub.com case follows the recording; GHE.com uses a private

tests/integration/gh-extension-installation.test.mjs

@@ -259,7 +259,10 @@ test("real GitHub CLI discovers, installs, and dispatches native release assets"
       const manifest = join(data, "gh", "extensions", "gh-cao", "manifest.yml");
       assert.match(readFileSync(manifest, "utf8"), new RegExp(`tag: ${scenario.pinned ? "v1.2.4" : "v1.2.3"}`));
       if (!scenario.pinned) {
-        await t.test("dashboard runs with gh, its installed extension and the selected container engine", async (t) => {
+        // Source builds embed no dashboard bundle; the release workflow supplies a release binary.
+        await t.test("dashboard runs with gh, its installed extension and the selected container engine", {
+          skip: !process.env.CAO_EXTENSION_BINARY && "requires a release binary via CAO_EXTENSION_BINARY",
+        }, async (t) => {
           await standaloneDashboard(t, directory, env, requests);
         });
       }

tests/integration/install-script.test.mjs

@@ -206,7 +206,5 @@ exec "$CAO_INSTALLER_GH" "$@"
   assert.equal(await readFile(path.join(home, ".curlrc"), "utf8"), curlrc);
   assert.match(await readFile(log, "utf8"), /auth status\n[\s\S]*repo view --json nameWithOwner/);
   assert.deepEqual((await readFile(metadataLog, "utf8")).trim().split("\n"), Object.keys(responses));
-  for (const bundle of ["activity", "dashboard"]) {
-    await run(process.execPath, [".github/workflows/shared/materialize-cao.mjs", "verify", bundle], { cwd: consumer, env });
-  }
+  await run(process.execPath, [".github/workflows/shared/materialize-cao.mjs", "verify", "dashboard"], { cwd: consumer, env });
 });

tests/unit/workflow-contract-ci-triggers.test.mjs

@@ -513,7 +513,7 @@ test("mixed workflows keep fast checks on PRs and gate expensive jobs off PRs",
   const cases = [
     ["workflow-contracts.yml", ["unit", "test"], [
       "agent-plugin", "installer",
-      "full-contracts", "github-issue-query",
+      "full-contracts",
       "dependabot-operational-value", "campaign-lifecycle-changes",
     ]],
     ["cgo.yml", ["server-quality", "server-spec"], [