diff --git a/.github/workflows/ci-full-race.yml b/.github/workflows/ci-full-race.yml
new file mode 100644
index 0000000..0d972bb
--- /dev/null
+++ b/.github/workflows/ci-full-race.yml
@@ -0,0 +1,37 @@
+name: CI Full Race
+
+# Weekly whole-suite race-detector sweep across all three platforms. The race
+# detector is too slow/memory-heavy to run on every PR for Windows and macOS,
+# so per-PR CI (ci.yml) runs -race only on ubuntu-latest. This workflow closes
+# the gap by exercising -race on every OS on a schedule. See REQ-CI-010.
+
+on:
+  schedule:
+    # Monday 06:00 UTC
+    - cron: '0 6 * * 1'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  race:
+    name: Race detector (${{ matrix.os }})
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, windows-latest, macos-latest]
+    env:
+      GOTOOLCHAIN: local
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: '1.25'
+
+      - name: Race detector
+        run: go test -race -shuffle=on ./...
\ No newline at end of file
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c9d490b..ea19076 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -41,8 +41,17 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-latest, windows-latest, macos-latest]
         go-version: ['1.25']
+        # -race is expensive (~2x time, high memory). Scope it to ubuntu-latest
+        # on every PR; the full race sweep across all platforms runs weekly in
+        # .github/workflows/ci-full-race.yml. See REQ-CI-010.
+        include:
+          - os: ubuntu-latest
+            race: true
+          - os: windows-latest
+            race: false
+          - os: macos-latest
+            race: false
     env:
       GOTOOLCHAIN: local
     steps:
@@ -63,7 +72,7 @@ jobs:
         run: task vet
 
       - name: Test
-        run: task test
+        run: go test -shuffle=on ${{ matrix.race && '-race' || '' }} ./...
 
   coverage:
     name: Coverage
diff --git a/.github/workflows/gga.yml b/.github/workflows/gga.yml
index 95428a7..42a5d77 100644
--- a/.github/workflows/gga.yml
+++ b/.github/workflows/gga.yml
@@ -30,6 +30,14 @@ jobs:
           echo "$HOME/.local/bin" >> "$GITHUB_PATH"
       - name: Verify GGA
         run: gga --version
+      - name: Install OpenCode CLI
+        run: |
+          curl -fsSL https://opencode.ai/install | bash
+          # The install script places the binary in ~/.opencode/bin. Add it to
+          # PATH for this and subsequent steps so `gga run` can shell out to it.
+          echo "$HOME/.opencode/bin" >> "$GITHUB_PATH"
+      - name: Verify OpenCode CLI
+        run: opencode --version
       - name: Run GGA
         env:
           OPENCODE_API_KEY: ${{ secrets.OPENCODE_API_KEY }}
diff --git a/cmd/login_test.go b/cmd/login_test.go
index 87a68bd..ad61410 100644
--- a/cmd/login_test.go
+++ b/cmd/login_test.go
@@ -1,14 +1,18 @@
 package cmd
 
 import (
-	"bytes"
 	"errors"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
 	"os"
 	"strings"
 	"testing"
+	"time"
 
 	"github.com/spf13/cobra"
 
+	"github.com/danielxxomg/bak-cli/internal/cloud"
 	"github.com/danielxxomg/bak-cli/internal/config"
 )
 
@@ -57,26 +61,46 @@ func TestRunLoginWithDeps_NonTTYGuard(t *testing.T) {
 	}
 }
 
+// TestRunLogin_EmptyToken proves the device-flow login path is deterministic and
+// does NOT touch the real network. The Device Flow is redirected to a local
+// httptest server that never authorizes, so it returns "timed out" within the
+// server-advertised expires_in (1s). Calling runLoginWithDeps directly (rather
+// than rootCmd.Execute) exercises the exact seam production uses. See REQ-CI-009.
 func TestRunLogin_EmptyToken(t *testing.T) {
 	if os.Getenv("GITHUB_TOKEN") != "" {
-		t.Skip("GITHUB_TOKEN is set, login may succeed with env token")
+		t.Skip("GITHUB_TOKEN is set, env token would short-circuit the device flow")
 	}
 
-	bufOut := new(bytes.Buffer)
-	bufErr := new(bytes.Buffer)
-	rootCmd.SetOut(bufOut)
-	rootCmd.SetErr(bufErr)
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch {
+		case strings.HasSuffix(r.URL.Path, "/login/device/code"):
+			fmt.Fprint(w, `{"device_code":"dc","user_code":"UC","verification_uri":"http://x","interval":1,"expires_in":1}`)
+		default:
+			fmt.Fprint(w, `{"error":"authorization_pending"}`)
+		}
+	}))
+	t.Cleanup(srv.Close)
 
-	rootCmd.SetArgs([]string{"login"})
-	err := rootCmd.Execute()
+	origBase := cloud.DeviceLoginBase
+	cloud.DeviceLoginBase = srv.URL
+	t.Cleanup(func() { cloud.DeviceLoginBase = origBase })
+
+	deps, _, _ := setupTestDeps(t)
+
+	start := time.Now()
+	err := runLoginWithDeps(&cobra.Command{}, nil, deps)
+	elapsed := time.Since(start)
 
 	if err == nil {
-		t.Skip("login succeeded (token possibly already configured)")
+		t.Fatal("expected error from un-authorized device login, got nil")
 	}
-
-	errStr := err.Error()
-	if !strings.Contains(errStr, "token") && !strings.Contains(errStr, "config") && !strings.Contains(errStr, "read") {
-		t.Errorf("unexpected error from login: %v", err)
+	// Must resolve in seconds, not the server-advertised 10 minutes — proves no
+	// real network call and the test cannot hang CI.
+	if elapsed > 2*time.Second {
+		t.Errorf("login exceeded 2s (elapsed=%v); test is not isolated from the network", elapsed)
+	}
+	if !strings.Contains(err.Error(), "timed out") && !strings.Contains(err.Error(), "token") {
+		t.Errorf("expected a token/timeout error, got: %v", err)
 	}
 }
 
diff --git a/internal/cloud/oauth_device.go b/internal/cloud/oauth_device.go
index bb82b1c..e1929c3 100644
--- a/internal/cloud/oauth_device.go
+++ b/internal/cloud/oauth_device.go
@@ -1,6 +1,7 @@
 package cloud
 
 import (
+	"context"
 	"encoding/json"
 	"fmt"
 	"io"
@@ -14,6 +15,12 @@ import (
 // Overridable for tests (e.g., set to httptest.Server.URL).
 var DeviceLoginBase = "https://github.com"
 
+// deviceLoginTimeout bounds the entire device-login poll loop, independent of
+// the expires_in the server reports. This prevents a hostile or stalled
+// authorization endpoint from hanging the client for the full server-declared
+// lifetime (GitHub reports 10 minutes). Overridable for tests.
+var deviceLoginTimeout = 60 * time.Second
+
 // DeviceClient performs GitHub OAuth Device Flow (RFC 8628) to obtain an
 // access token without requiring a web server on the client side.
 //
@@ -87,8 +94,14 @@ func (c *DeviceClient) RequestToken() (string, error) {
 		out = io.Discard
 	}
 
+	// Bound the entire Device Flow independently of the server-reported
+	// expires_in: a stalled or hostile authorization endpoint must not hold the
+	// client for the full server-declared lifetime (GitHub advertises 10 min).
+	ctx, cancel := context.WithTimeout(context.Background(), deviceLoginTimeout)
+	defer cancel()
+
 	// 1. Request device code.
-	deviceResp, err := requestDeviceCode(httpClient, baseURL, c.ClientID)
+	deviceResp, err := requestDeviceCode(ctx, httpClient, baseURL, c.ClientID)
 	if err != nil {
 		return "", fmt.Errorf("device code: %w", err)
 	}
@@ -112,6 +125,17 @@ func (c *DeviceClient) RequestToken() (string, error) {
 	}
 
 	// 3. Poll for access token.
+	return c.pollForAccessToken(ctx, httpClient, baseURL, deviceResp, out)
+}
+
+// pollForAccessToken drives the Device Flow poll loop until a token is issued,
+// the server-declared expires_in passes, or deviceLoginTimeout (via ctx) fires.
+// The server deadline bounds against a mismatched expires_in; the ctx bounds
+// against a stalled/hostile endpoint and is the guarantee relied on by tests.
+func (c *DeviceClient) pollForAccessToken(
+	ctx context.Context, httpClient *http.Client, baseURL string,
+	deviceResp *deviceCodeResponse, out io.Writer,
+) (string, error) {
 	interval := deviceResp.Interval
 	if interval < 1 {
 		interval = 5 // default per RFC 8628
@@ -122,8 +146,11 @@ func (c *DeviceClient) RequestToken() (string, error) {
 		if time.Now().After(deadline) {
 			return "", fmt.Errorf("login: timed out waiting for authorization")
 		}
+		if err := ctx.Err(); err != nil {
+			return "", fmt.Errorf("login: timed out waiting for authorization: %w", err)
+		}
 
-		resp, err := pollAccessToken(httpClient, baseURL, c.ClientID, deviceResp.DeviceCode)
+		resp, err := pollAccessToken(ctx, httpClient, baseURL, c.ClientID, deviceResp.DeviceCode)
 		if err != nil {
 			return "", err
 		}
@@ -166,7 +193,7 @@ func (c *DeviceClient) RequestToken() (string, error) {
 }
 
 // requestDeviceCode POSTs to /login/device/code to start the flow.
-func requestDeviceCode(httpClient *http.Client, baseURL, clientID string) (*deviceCodeResponse, error) {
+func requestDeviceCode(ctx context.Context, httpClient *http.Client, baseURL, clientID string) (*deviceCodeResponse, error) {
 	if clientID == "" {
 		return nil, fmt.Errorf("request device code: client_id is required")
 	}
@@ -176,7 +203,7 @@ func requestDeviceCode(httpClient *http.Client, baseURL, clientID string) (*devi
 	form.Set("scope", "gist")
 
 	var dr deviceCodeResponse
-	if err := postOAuthForm(httpClient, baseURL, "/login/device/code", form, &dr); err != nil {
+	if err := postOAuthForm(ctx, httpClient, baseURL, "/login/device/code", form, &dr); err != nil {
 		return nil, fmt.Errorf("device code: %w", err)
 	}
 
@@ -191,14 +218,14 @@ func requestDeviceCode(httpClient *http.Client, baseURL, clientID string) (*devi
 }
 
 // pollAccessToken POSTs to /login/oauth/access_token to check for completion.
-func pollAccessToken(httpClient *http.Client, baseURL, clientID, deviceCode string) (*tokenPollResponse, error) {
+func pollAccessToken(ctx context.Context, httpClient *http.Client, baseURL, clientID, deviceCode string) (*tokenPollResponse, error) {
 	form := url.Values{}
 	form.Set("client_id", clientID)
 	form.Set("device_code", deviceCode)
 	form.Set("grant_type", "urn:ietf:params:oauth:grant-type:device_code")
 
 	var tr tokenPollResponse
-	if err := postOAuthForm(httpClient, baseURL, "/login/oauth/access_token", form, &tr); err != nil {
+	if err := postOAuthForm(ctx, httpClient, baseURL, "/login/oauth/access_token", form, &tr); err != nil {
 		return nil, fmt.Errorf("poll token: %w", err)
 	}
 
@@ -207,15 +234,18 @@ func pollAccessToken(httpClient *http.Client, baseURL, clientID, deviceCode stri
 
 // postOAuthForm POSTs form-encoded data to an OAuth endpoint and unmarshals
 // the JSON response into target. Returns an error on transport, status, or
-// unmarshal failure.
-func postOAuthForm(httpClient *http.Client, baseURL, path string, form url.Values, target any) error {
+// unmarshal failure. The provided ctx bounds in-flight requests so a stalled
+// authorization endpoint cannot hang the caller.
+func postOAuthForm(ctx context.Context, httpClient *http.Client, baseURL, path string, form url.Values, target any) error {
 	urlStr := strings.TrimRight(baseURL, "/") + path
-	req, err := newRequest(http.MethodPost, urlStr, "",
-		"application/json", "application/x-www-form-urlencoded",
-		strings.NewReader(form.Encode()))
+	req, err := http.NewRequestWithContext(ctx, http.MethodPost, urlStr, strings.NewReader(form.Encode()))
 	if err != nil {
 		return fmt.Errorf("build request: %w", err)
 	}
+	// Device Flow endpoints are unauthenticated: no Authorization header.
+	req.Header.Set("Accept", "application/json")
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	req.Header.Set("User-Agent", "bak-cli")
 
 	body, status, err := doRequest(httpClient, req)
 	if err != nil {
diff --git a/internal/cloud/oauth_device_test.go b/internal/cloud/oauth_device_test.go
index 1b436dc..73e1eba 100644
--- a/internal/cloud/oauth_device_test.go
+++ b/internal/cloud/oauth_device_test.go
@@ -1,7 +1,9 @@
 package cloud
 
 import (
+	"context"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"io"
 	"net/http"
@@ -427,3 +429,53 @@ func TestDeviceClient_DefaultsApplied(t *testing.T) {
 		t.Errorf("expected gho_defaults, got %q", token)
 	}
 }
+
+// TestRequestToken_DeviceLoginTimeout proves the Device Flow poll loop honors a
+// bounded client-side timeout independent of the server-reported expires_in.
+// The /access_token endpoint below blocks longer than the test guard: without a
+// ctx-aware request the call cannot be cancelled and the test fails on the 2s
+// guard (RED); once RequestToken wraps deviceLoginTimeout via
+// context.WithTimeout the in-flight request is cancelled and returns
+// context.DeadlineExceeded well under a second (GREEN). See REQ-CI-009.
+func TestRequestToken_DeviceLoginTimeout(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch {
+		case strings.HasSuffix(r.URL.Path, "/login/device/code"):
+			fmt.Fprint(w, `{"device_code":"dc","user_code":"UC","verification_uri":"http://x","interval":5,"expires_in":2}`)
+		default:
+			// Slow poll: only a ctx-aware request can be cancelled before the guard.
+			time.Sleep(3 * time.Second)
+			fmt.Fprint(w, `{"error":"authorization_pending"}`)
+		}
+	}))
+	t.Cleanup(srv.Close)
+
+	origBase := DeviceLoginBase
+	DeviceLoginBase = srv.URL
+	t.Cleanup(func() { DeviceLoginBase = origBase })
+
+	origTimeout := deviceLoginTimeout
+	deviceLoginTimeout = 50 * time.Millisecond
+	t.Cleanup(func() { deviceLoginTimeout = origTimeout })
+
+	client := &DeviceClient{ClientID: "cid", sleepFn: func(time.Duration) {}}
+
+	done := make(chan error, 1)
+	go func() { _, err := client.RequestToken(); done <- err }()
+
+	start := time.Now()
+	select {
+	case err := <-done:
+		if err == nil {
+			t.Fatal("expected timeout error, got nil")
+		}
+		if !errors.Is(err, context.DeadlineExceeded) {
+			t.Fatalf("expected context.DeadlineExceeded, got: %v", err)
+		}
+		if elapsed := time.Since(start); elapsed > time.Second {
+			t.Errorf("RequestToken honored server expires_in, not deviceLoginTimeout: elapsed=%v", elapsed)
+		}
+	case <-time.After(2 * time.Second):
+		t.Fatal("RequestToken hung >2s — deviceLoginTimeout not honored")
+	}
+}
diff --git a/openspec/changes/archive/2026-06-25-fix-ci-hygiene/design.md b/openspec/changes/archive/2026-06-25-fix-ci-hygiene/design.md
new file mode 100644
index 0000000..24b688d
--- /dev/null
+++ b/openspec/changes/archive/2026-06-25-fix-ci-hygiene/design.md
@@ -0,0 +1,92 @@
+# Design: fix-ci-hygiene
+
+## Technical Approach
+
+Three P0 CI fixes, each independent and independently shippable. A.1 removes a
+network-dependent flaky test by (a) giving the device-login poller a real,
+overridable timeout and (b) converting the cmd-level test to exercise the
+deterministic manual/timeout error path instead of `rootCmd.Execute()`. A.2
+installs the OpenCode CLI into the GGA workflow so `gga run` can shell out to
+`opencode`. A.3 drops `-race` from the per-PR Windows/macOS matrix legs (Linux
+keeps it) and moves full `-race` coverage to a weekly schedule, adds the
+`setup-go` build cache, and removes the unused `tparse` install.
+
+> Note: the proposal's A.1 sketch referenced `Deps.DeviceLogin` and
+> `runLoginWithDeps(cmd, reader, deps)`. Those names do NOT exist in this
+> codebase. Actual shapes: `DeviceClient.RequestToken() (string, error)`
+> (no ctx), `LoginAction.OAuthClient` (interface `oauthTokenRequester`),
+> `runLoginWithDeps(cmd, args, deps)`. This design follows the existing
+> overridable-package-var seam pattern (`DeviceLoginBase`, `sleepFn`) rather
+> than fabricating the proposed-but-absent `DeviceLogin` field, per AGENTS.md
+> DRY / "follow existing pattern" rules.
+
+## Architecture Decisions
+
+| # | Decision | Option A (chosen) | Option B (rejected) | Rationale |
+|---|----------|-------------------|---------------------|-----------|
+| 1 | 60s login timeout | Package var `deviceLoginTimeout` + internal `context.WithTimeout` in `RequestToken` | Change `RequestToken(ctx)` signature | B breaks the `oauthTokenRequester` interface + `cmd/login.go` wiring; A matches the existing `DeviceLoginBase`/`sleepFn` override seam and needs no interface change. |
+| 2 | Cmd test form | Call `runLoginWithDeps(rootCmd, nil, depsFromCmd(rootCmd))` with `DeviceLoginBase`→`httptest` server + tiny `deviceLoginTimeout` | Keep `rootCmd.Execute()` | `rootCmd.Execute` hits the network (the bug); `runLoginWithDeps` is a pure seam; deterministic, AGENTS "don't unit-test cmd entry via Execute" spirit. |
+| 3 | GGA install | `curl -fsSL https://opencode.ai/install \| bash` before `gga run` | Vendor a binary / `go install` | Script already detects `GITHUB_ACTIONS=true` and appends `$HOME/.opencode/bin` to `$GITHUB_PATH`; run via `bash -s -- --no-modify-path --version <pin>` to avoid mutating shell rc files on the runner. |
+| 4 | Per-PR race matrix | `[{os: ubuntu-latest, race: true}, {windows-latest, false}, {macos-latest, false}]` | Keep `-race` on all three | Windows `-race` dominates runner minutes; Linux race catches the data races that matter on PR-sized diffs. Full sweep moves to weekly. |
+| 5 | Full-race safety net | New `ci-full-race.yml` on `schedule: cron: "0 6 * * 1"` + `workflow_dispatch` | Trust Linux-only race | Defends the cross-OS race surface without burning per-PR minutes; manual trigger for hotfix verification. |
+| 6 | Go cache | `actions/setup-go@v5` with `cache: true` | Manual `~/.cache/go-build` cache | setup-go v5 caches both modules and build cache keyed on `go.sum`; zero config. |
+| 7 | tparse | Remove install step | Keep / cache it | Grep shows no `tparse` consumer in the repo; dead weight on the runner. |
+
+## Data Flow
+
+A.1 (production login):
+
+    RequestToken()
+      └─ context.WithTimeout(bg, deviceLoginTimeout) ──► ctx
+      └─ poll loop: sleep(interval) ──► POST token ──► ctx.Err()? ──► return "login: timed out: %w"
+
+A.1 (test):
+
+    TestRunLogin_EmptyToken
+      ├─ DeviceLoginBase = httptest server (always "authorization_pending", interval=1, expires_in=600)
+      ├─ deviceLoginTimeout = 50ms        └─ runLoginWithDeps(rootCmd, nil, depsFromCmd(rootCmd))
+      └─ assert err contains "token" / "timed out"
+
+## File Changes
+
+| File | Action | Description |
+|------|--------|-------------|
+| `internal/cloud/oauth_device.go` | Modify | Add `var deviceLoginTimeout = 60 * time.Second`. In `RequestToken`, wrap poll with `ctx, cancel := context.WithTimeout(context.Background(), deviceLoginTimeout)`; check `ctx.Err()` each iteration → `fmt.Errorf("login: timed out waiting for authorization: %w", ctx.Err())`. |
+| `internal/cloud/oauth_device_test.go` | Modify | [RED then GREEN] Add table test: stub `DeviceLoginBase`→pending httptest server, set `deviceLoginTimeout=50ms`, assert `RequestToken` returns timeout error and does not exceed e.g. 1s wall clock. |
+| `cmd/login_test.go` | Modify | Rewrite `TestRunLogin_EmptyToken` to call `runLoginWithDeps(rootCmd, nil, depsFromCmd(rootCmd))` with `DeviceLoginBase`→pending httptest + `deviceLoginTimeout=50ms`; defer reset of both vars. Drop the `rootCmd.Execute()` network path. |
+| `.github/workflows/gga.yml` | Modify | Add step `Install OpenCode CLI` before `gga run`: `run: curl -fsSL https://opencode.ai/install \| bash -s -- --no-modify-path --version <pin>` (strip the literal backslash-pipe: real pipe). |
+| `.github/workflows/ci.yml` | Modify | Matrix → `include: [{os: ubuntu-latest, race: true}, {os: windows-latest, race: false}, {os: macos-latest, race: false}]`; test step `go test {{if race==true}}-race{{end}} -shuffle=on ./...`; pin `actions/setup-go@v5` with `cache: true`; remove `tparse` install. |
+| `.github/workflows/ci-full-race.yml` | Create | Weekly full `-race` on all 3 OS + manual `workflow_dispatch`; reuse the test step with `-race` unconditional. |
+
+## Interfaces / Contracts
+
+```go
+// internal/cloud/oauth_device.go — overridable, no signature change
+var deviceLoginTimeout = 60 * time.Second // tests may lower to force cancellation
+
+// internal/actions/login.go — UNCHANGED
+type oauthTokenRequester interface { RequestToken() (string, error) }
+```
+
+## Testing Strategy
+
+| Layer | What | How |
+|-------|------|-----|
+| Unit | `RequestToken` honors `deviceLoginTimeout` | httptest pending server + 50ms timeout; assert error + wall-clock bound |
+| Unit | `TestRunLogin_EmptyToken` deterministic error path | `runLoginWithDeps` direct call; assert error contains "token"/"timed out" |
+| Unit | Timeout var is restorable | `t.Cleanup`/defer resets `deviceLoginTimeout`, `DeviceLoginBase` |
+| CI | GGA workflow installs `opencode` and `gga run` completes | GHA workflow run on a sample PR |
+| CI | Per-PR matrix: `-race` only on Linux; full suite green | GHA matrix run |
+| CI | Weekly full-race passes on all 3 OS | Scheduled run + `workflow_dispatch` smoke |
+
+## Migration / Rollout
+
+No data migration. A.3 matrix change is backward compatible. Pin OpenCode CLI
+version in `gga.yml` to avoid installer drift; bump deliberately. Add
+`OPENCODE_API_KEY` secret confirmed present (current GGA already references it).
+
+## Open Questions
+
+- [ ] Pin exact OpenCode CLI version for reproducible GGA runs (default rolling).
+- [ ] Confirm `depsFromCmd(rootCmd)` is safe to use directly in unit test (it reads
+      cobra-level flags; may need `rootCmd.ResetFlags`/`SetArgs([])` setup).
\ No newline at end of file
diff --git a/openspec/changes/archive/2026-06-25-fix-ci-hygiene/proposal.md b/openspec/changes/archive/2026-06-25-fix-ci-hygiene/proposal.md
new file mode 100644
index 0000000..e547f52
--- /dev/null
+++ b/openspec/changes/archive/2026-06-25-fix-ci-hygiene/proposal.md
@@ -0,0 +1,120 @@
+# Proposal: fix-ci-hygiene
+
+## Intent
+
+Three P0 CI blockers prevent the product deep audit from being actionable:
+
+1. **TestRunLogin_EmptyToken** (`cmd/login_test.go:68-85`) calls `rootCmd.Execute()` which builds a real `cloud.DeviceClient` with a hardcoded GitHub OAuth `client_id` (`2472954d6d1c0de9be29`). The test sets `loginProvider = nil`, so `runLogin` (`cmd/login.go:107-110`) creates a live client that polls `github.com/login/device/code` for ~15 minutes across all 3 CI OS before `go test` kills it. This is the single biggest CI time sink.
+2. **GGA gate is theater**: `gga.yml` runs `gga run --pr-mode --diff-only` but the runner has no `opencode` binary. GGA uses `PROVIDER="opencode:opencode-go/qwen3.7-plus"` (`.gga:5`) which shells out to the OpenCode CLI. The job fails silently under `continue-on-error: true` — the gate provides zero review value.
+3. **CI timing waste**: `-race` runs on all 3 OS (~50% overhead on mac/windows where races rarely manifest differently), no Go module/build cache, and `tparse` is re-installed every run (`go install github.com/mfridman/tparse@latest` — uncached).
+
+## Scope
+
+### In Scope
+- **A.1**: Inject fake `DeviceClient` into `TestRunLogin_EmptyToken` via the existing `runLoginWithDeps`/`actions.Deps` pattern. Add 60s `context.WithTimeout` to real `DeviceLogin` in `internal/cloud/oauth_device.go`.
+- **A.2**: Install OpenCode CLI in `gga.yml` before `gga run`. Verify binary availability for `ubuntu-latest`.
+- **A.3**: Move `-race` to ubuntu-latest only in per-OS matrix. Add weekly full-race cron. Add Go module + build cache to `ci.yml`. Audit redundant steps.
+
+### Out of Scope
+- Enabling new linters (goconst, wrapcheck, etc.) — **Change B**
+- TUI personality features (spinners, progress bars, dashboard) — **Change C**
+- Unit tests for `cmd/` `os.Exit` paths (out of scope per AGENTS.md)
+- Modifying the 3-OS matrix (cross-platform is a product requirement)
+- Removing lint, coverage gate, govulncheck, or security jobs
+
+## Capabilities
+
+### New Capabilities
+- `ci-timing-optimization`: Go cache, race-flag scoping, weekly full-race cron
+
+### Modified Capabilities
+- `ci-consistency`: test job matrix changes (race flag), cache additions
+- `gga-bypass`: GGA workflow now functional (installs OpenCode CLI)
+
+## Approach
+
+### A.1 — Fix TestRunLogin_EmptyToken
+
+**Root cause**: `cmd/login_test.go:79` calls `rootCmd.Execute()` which triggers the real `runLogin` path (`cmd/login.go:107-130`). The test sets `loginProvider = nil`, so `runLogin` creates a fresh `&cloud.DeviceClient{HTTPClient: http.DefaultClient}` and calls `DeviceLoginBase` → `DevicePoll` which polls github.com for ~15 minutes.
+
+**Fix (TDD)**:
+1. **[RED]** Add test: `TestRunLogin_WithMockClient_CompletesFast` — calls `runLoginWithDeps` directly with `deps.DeviceLogin = fakeDeviceLoginOK`. Asserts completion in <2s.
+2. **[GREEN]** Refactor `TestRunLogin_EmptyToken` to use `runLoginWithDeps` with a fake `deps.DeviceLogin` that returns `context.DeadlineExceeded` immediately. Remove `rootCmd.Execute()` from this test.
+3. **[REFACTOR]** Add `context.WithTimeout(ctx, 60*time.Second)` wrapper in `cloud.DeviceLogin` (`internal/cloud/oauth_device.go:130`) so even production code can't hang forever. The timeout value is a package-level `var DeviceLoginTimeout = 60 * time.Second` for testability.
+
+**Files**: `cmd/login_test.go`, `cmd/login.go` (minor — expose `runLoginWithDeps` if needed), `internal/cloud/oauth_device.go` (timeout wrapper).
+
+### A.2 — Install OpenCode CLI in GGA
+
+**Root cause**: `gga.yml:27-36` checks out code and runs `gga run` but never installs the `opencode` binary that GGA shells out to.
+
+**Fix**:
+1. Add step before `gga run`: `curl -fsSL https://opencode.ai/install | bash`. The installer auto-detects `$GITHUB_ACTIONS` and appends `~/.opencode/bin` to `$GITHUB_PATH`.
+2. Add verification step: `opencode version` to confirm install.
+3. The `OPENCODE_API_KEY` secret is already configured (`gga.yml:35`).
+
+**Verification**: The install script (`https://opencode.ai/install`) downloads from `github.com/anomalyco/opencode/releases/latest/download/opencode-linux-x64.tar.gz`. Confirmed available for `ubuntu-latest` (x64 Linux). The old `opencode-ai/opencode` repo is archived; the project moved to `anomalyco/opencode`.
+
+**Files**: `.github/workflows/gga.yml`.
+
+### A.3 — CI Timing Optimization
+
+**Current state** (`ci.yml:60-93`):
+- `test` job: 3-OS matrix, each runs `go install tparse` (uncached), `go test -race -coverprofile=... ./...`
+- No Go module cache, no build cache
+- `-race` on all 3 OS
+
+**Fix**:
+1. **Race flag scoping**: Use matrix `include` to set `race: true` only for `ubuntu-latest`. Other OS run `go test -coverprofile=... ./...` without `-race`.
+2. **Weekly full-race cron**: Add `schedule: - cron: '0 6 * * 1'` (Monday 6am UTC) trigger to `ci.yml`. Use a matrix override or env var to force `-race` on all OS for the weekly run.
+3. **Go caches**: Add `actions/cache@v4` for `~/go/pkg/mod` (module cache) and `~/.cache/go-build` (build cache). Key: `hashFiles('**/go.sum')` + `runner.os`.
+4. **tparse cache**: Either cache the `tparse` binary or replace `go install` with a direct download of the release binary.
+
+**Files**: `.github/workflows/ci.yml`.
+
+## Affected Areas
+
+| Area | Impact | Description |
+|------|--------|-------------|
+| `cmd/login_test.go` | Modified | Refactor `TestRunLogin_EmptyToken` to use `runLoginWithDeps` with fake client |
+| `cmd/login.go` | Modified | Minor: ensure `runLoginWithDeps` is testable (may already be sufficient) |
+| `internal/cloud/oauth_device.go` | Modified | Add 60s `context.WithTimeout` wrapper in `DeviceLogin` |
+| `.github/workflows/gga.yml` | Modified | Add OpenCode CLI install step |
+| `.github/workflows/ci.yml` | Modified | Race scoping, caches, weekly cron |
+
+**Estimated lines**: ~120-150 lines changed across 5 files.
+
+## Risks
+
+| Risk | Likelihood | Mitigation |
+|------|------------|------------|
+| OpenCode install script breaks in CI | Low | Pin to a specific version tag if available; add `continue-on-error` fallback |
+| 60s timeout too aggressive for slow networks | Low | Make it configurable via `DeviceLoginTimeout` var; 60s is generous for OAuth polling |
+| `-race` only on ubuntu misses OS-specific races | Low | Weekly full-race cron on all 3 OS catches these |
+| Go cache keys become stale | Low | Use `go.sum` hash; cache restore with `restore-keys` fallback |
+| Fake client doesn't exercise real OAuth edge cases | Med | Keep one integration-style test (or rely on e2e) for real flow |
+
+## Rollback Plan
+
+- **A.1**: Revert `cmd/login_test.go` and `internal/cloud/oauth_device.go`. The test returns to its current (broken but passing-via-timeout) state. No production behavior change.
+- **A.2**: Remove the `curl | bash` step from `gga.yml`. GGA returns to silent-failure state (no regression — it was already failing).
+- **A.3**: Revert `ci.yml` to current matrix. No production impact.
+
+All changes are CI/test-only except the 60s timeout wrapper in `oauth_device.go`, which is a safety net that doesn't change happy-path behavior (OAuth flows complete in <30s normally).
+
+## Dependencies
+
+- OpenCode CLI install script (`https://opencode.ai/install`) must remain available and serve Linux x64 binaries
+- `OPENCODE_API_KEY` GitHub secret must remain configured (already set)
+- `actions/cache@v4` must be available (standard GitHub Actions)
+
+## Success Criteria
+
+- [ ] `TestRunLogin_EmptyToken` completes in <5s (currently ~15 minutes)
+- [ ] `go test ./...` on CI finishes in <3 minutes total (currently ~8-10 minutes)
+- [ ] GGA workflow step shows `opencode version` output confirming install
+- [ ] GGA `gga run` produces actual review output (not "OpenCode CLI not found")
+- [ ] Weekly cron runs `-race` on all 3 OS
+- [ ] Go module cache hit rate >80% on subsequent runs
+- [ ] No regression in test coverage (coverage gate still passes)
+- [ ] Cross-platform build verification still works on all 3 OS
diff --git a/openspec/changes/archive/2026-06-25-fix-ci-hygiene/specs/ci-consistency/spec.md b/openspec/changes/archive/2026-06-25-fix-ci-hygiene/specs/ci-consistency/spec.md
new file mode 100644
index 0000000..ea19dba
--- /dev/null
+++ b/openspec/changes/archive/2026-06-25-fix-ci-hygiene/specs/ci-consistency/spec.md
@@ -0,0 +1,79 @@
+# Delta for ci-consistency
+
+## ADDED Requirements
+
+### REQ-CI-009: Test Isolation from External Services
+
+Unit tests MUST NOT make real network calls. Tests that exercise external services (OAuth device flow, cloud APIs) MUST inject a fake or stub via the existing `Deps` dependency-injection pattern used by `runLoginWithDeps`.
+
+#### Scenario: TestRunLogin_EmptyToken completes quickly with fake DeviceLogin
+
+- GIVEN a test that calls `runLoginWithDeps` with a `DeviceLogin` dependency returning an error for empty tokens
+- WHEN the test executes
+- THEN the test MUST complete in under 2 seconds
+- AND no real HTTP request MUST be made to any OAuth endpoint
+
+### REQ-CI-010: Production Timeout Safety for External Calls
+
+External calls that block on user interaction or remote services (specifically the OAuth device flow) MUST wrap their context with `context.WithTimeout` to prevent indefinite hangs.
+
+#### Scenario: DeviceLogin times out after safety limit
+
+- GIVEN the production `DeviceLogin` implementation is invoked with a valid but non-completing device flow
+- WHEN 60 seconds elapse without user authorization
+- THEN the call MUST return a context deadline exceeded error
+- AND no goroutine MUST remain blocked indefinitely
+
+### REQ-CI-011: CI Race Detector Scoping
+
+The `-race` flag MUST run only on `ubuntu-latest` in the per-PR test matrix. A weekly scheduled job MUST run `-race` on all three operating systems (ubuntu, windows, macos) as a safety net.
+
+#### Scenario: Per-PR ubuntu job uses race detector
+
+- GIVEN a pull request triggers the CI workflow
+- WHEN the test job runs on `ubuntu-latest`
+- THEN the `go test` invocation MUST include the `-race` flag
+
+#### Scenario: Per-PR mac/windows jobs skip race detector
+
+- GIVEN a pull request triggers the CI workflow
+- WHEN the test job runs on `windows-latest` or `macos-latest`
+- THEN the `go test` invocation MUST NOT include the `-race` flag
+
+#### Scenario: Weekly cron runs race detector on all OS
+
+- GIVEN the weekly scheduled trigger fires (cron)
+- WHEN the test matrix executes
+- THEN all three OS runners MUST execute `go test` with the `-race` flag
+
+### REQ-CI-012: Go Module and Build Cache in CI
+
+CI MUST cache Go modules (`GOMODCACHE`) and the Go build cache (`GOCACHE`) across runs using `actions/setup-go` caching or an equivalent mechanism.
+
+#### Scenario: Second CI run uses cached modules
+
+- GIVEN a CI run has completed successfully and populated the cache
+- WHEN a subsequent CI run executes on the same `go.sum`
+- THEN the module download step MUST be skipped or significantly faster than a cold run
+
+### REQ-CI-013: GGA Job Functional Execution
+
+The GGA CI job MUST install the OpenCode CLI binary before running `gga run`. The GGA job MUST execute functionally (producing review output). The GGA job MUST remain advisory — findings MUST NOT fail the workflow (`continue-on-error: true`).
+
+#### Scenario: OpenCode binary available for GGA
+
+- GIVEN the GGA workflow job has completed its setup steps
+- WHEN `which opencode` or `opencode --version` is invoked
+- THEN the command MUST succeed and the binary MUST be in `$PATH`
+
+#### Scenario: GGA produces review output
+
+- GIVEN the OpenCode CLI is installed and `gga` is available
+- WHEN `gga run --pr-mode --diff-only` executes
+- THEN the step MUST produce visible output (review comments or summary)
+
+#### Scenario: GGA findings do not fail the workflow
+
+- GIVEN GGA reports findings or violations
+- WHEN the GGA step completes
+- THEN the overall job MUST still succeed (continue-on-error absorbs failures)
diff --git a/openspec/changes/archive/2026-06-25-fix-ci-hygiene/tasks.md b/openspec/changes/archive/2026-06-25-fix-ci-hygiene/tasks.md
new file mode 100644
index 0000000..0d2229b
--- /dev/null
+++ b/openspec/changes/archive/2026-06-25-fix-ci-hygiene/tasks.md
@@ -0,0 +1,115 @@
+# Tasks: fix-ci-hygiene
+
+## Review Workload Forecast
+
+| Field | Value |
+|-------|-------|
+| Estimated changed lines | ~215 (range 180–250) |
+| 400-line budget risk | Low |
+| Chained PRs recommended | No |
+| Suggested split | Single PR (3 independent fixes, all small) |
+| Delivery strategy | ask-always (cached) |
+| Chain strategy | pending (not needed) |
+
+Decision needed before apply: No
+Chained PRs recommended: No
+Chain strategy: pending
+400-line budget risk: Low
+
+## Phase 1: Fix TestRunLogin_EmptyToken (A.1 — TDD)
+
+- [x] 1.1 **[RED]** In `cmd/login_test.go`, write `TestRunLogin_EmptyToken_WithFakeOAuth` that builds a `cmdDeps` with a fake `OAuthClient` (inline struct implementing `RequestToken() (string, error)` returning a token instantly), calls `runLoginWithDeps(nil, nil, deps)`, and asserts: completes in <2s (`testing.Deadline` or `time.After`), `config.Load().Token == fakeToken`, zero real network calls. Must fail now because `runLoginWithDeps` doesn't accept `OAuthClient` from deps yet.
+
+- [x] 1.2 **[GREEN — refactor test]** Replace the existing `TestRunLogin_EmptyToken` body: instead of `rootCmd.SetArgs` + `rootCmd.Execute()`, construct a `cmdDeps` with `Stdout: &buf, Stderr: &buf, Stdin: strings.NewReader("1\n")`, `ConfigLoader: config.Load`, `ConfigSaver: config.Save`, `TokenValidator: cloud.ValidateToken`, and the fake `OAuthClient`. Call `runLoginWithDeps(nil, nil, deps)` directly. Assert exit 0 and token saved.
+
+- [x] 1.3 **[GREEN — production code]** In `cmd/deps.go`, add unexported interface `type oauthTokenRequester interface { RequestToken() (string, error) }` and field `OAuthClient oauthTokenRequester` to `cmdDeps`. In `cmd/login.go`, add package-level vars `var DeviceLoginBase = cloud.DeviceLoginBase` and `var sleepFn = time.Sleep`. In `runLoginWithDeps`, when building the `DeviceClient`, use `DeviceLoginBase` instead of the const; if `deps.OAuthClient != nil`, pass it to `cloud.NewDeviceClientWithOAuth` (or construct `DeviceClient{Base: DeviceLoginBase, OAuth: deps.OAuthClient}`); wire `sleepFn` into the polling loop.
+
+- [x] 1.4 **[RED]** In `internal/cloud/oauth_device_test.go`, write `TestDeviceLogin_ContextTimeout` that calls `DeviceLogin` with a `context.WithTimeout(ctx, 100*time.Millisecond)` and a bogus `Base` URL. Assert the returned error wraps `context.DeadlineExceeded` (or `ctx.Err()`). Must fail because current `DeviceLogin` ignores context.
+
+- [x] 1.5 **[GREEN]** In `internal/cloud/oauth_device.go`, add `var deviceLoginTimeout = 60 * time.Second`. Wrap the `DeviceLogin` body: `ctx, cancel := context.WithTimeout(ctx, deviceLoginTimeout); defer cancel()`. Propagate `ctx` to all `http.NewRequestWithContext` calls in the polling loop. Verify `TestDeviceLogin_ContextTimeout` now passes.
+
+- [x] 1.6 **[VERIFY]** Run `go test -race -count=1 ./cmd/ ./internal/cloud/`. Confirm: all pass, `TestRunLogin_EmptyToken_WithFakeOAuth` completes in <2s, no real network calls (verify via fake OAuthClient call count). Run `go vet ./...`.
+
+## Phase 2: GGA OpenCode CLI Install (A.2 — CONFIG)
+
+- [x] 2.1 **[CONFIG]** In `.github/workflows/gga.yml`, add a step before `Run GGA review`:
+  ```yaml
+  - name: Install OpenCode CLI
+    uses: opencode-ai/action@v1
+  ```
+  Add `continue-on-error: true` to the `Run GGA review` step. Pin `OPENCODE_MODEL` env var to the design-specified value.
+
+- [x] 2.2 **[VERIFY]** Validate YAML syntax: `python3 -c "import yaml; yaml.safe_load(open('.github/workflows/gga.yml'))"`. Confirm step ordering: checkout → setup Go → install GGA → install OpenCode → gga run.
+
+## Phase 3: CI Timing Optimization (A.3 — CONFIG)
+
+- [x] 3.1 **[CONFIG]** In `.github/workflows/ci.yml`, replace the flat `os` matrix with an `include` matrix:
+  ```yaml
+  strategy:
+    matrix:
+      include:
+        - os: ubuntu-latest
+          race: true
+        - os: windows-latest
+          race: false
+        - os: macos-latest
+          race: false
+  ```
+  Update the test step to conditionally apply `-race`: `go test ${{ matrix.race && '-race' || '' }} -coverprofile=coverage.out -covermode=atomic ./...`.
+
+- [x] 3.2 **[CONFIG]** Create `.github/workflows/ci-full-race.yml` — weekly cron (`cron: '0 6 * * 1'`), manual dispatch, 3-OS matrix all with `-race`, same test/build/install steps as ci.yml. No `tparse` install (audit result: unused, grep confirms zero consumers).
+
+- [x] 3.3 **[VERIFY]** Confirm `actions/setup-go@v5` with `cache: true` is already present in ci.yml (it is — no change needed). Validate both YAML files: `python3 -c "import yaml; yaml.safe_load(open(f)) for f in ['.github/workflows/ci.yml', '.github/workflows/ci-full-race.yml']"`. Confirm `tparse` has zero references in `.github/workflows/` (already clean).
+
+## Implementation Notes (apply batch)
+
+deviation source: tasks 1.1–1.6 text describes the **proposal** approach (fake
+`cmdDeps.OAuthClient` field, `cloud.NewDeviceClientWithOAuth`, a `DeviceLogin`
+function, a `sleepFn` package-var in `cmd/login.go`). Those symbols do not exist
+in the codebase. The design.md **correction note** overrides the proposal; this
+apply batch implements the design's corrected approach.
+
+phase 1 (REQ-CI-009 / REQ-CI-008):
+- 1.1–1.2 `TestRunLogin_EmptyToken` rewritten deterministically: redirects
+  `cloud.DeviceLoginBase` to a local `httptest` pending server (expires_in=1,
+  interval=1) and calls `runLoginWithDeps(&cobra.Command{}, nil, deps)` with
+  `setupTestDeps` (mock config → AGENTS.md isolation). Asserts <2s, no real
+  network, error mentions "timed out"/"token". RED: old body hit real github.com
+  (HTTP/2 readLoop captured) and hung >8s. GREEN: completes in ~1s.
+- 1.3–1.5 added `var deviceLoginTimeout = 60 * time.Second`
+  (`internal/cloud/oauth_device.go`). `RequestToken` now wraps the flow in
+  `context.WithTimeout(context.Background(), deviceLoginTimeout)`; the loop
+  checks `ctx.Err()`; `requestDeviceCode`/`pollAccessToken`/`postOAuthForm`
+  thread `ctx` via `http.NewRequestWithContext`. The 600s server-declared
+  expires_in can no longer hang the client. Extracted `pollForAccessToken` to
+  satisfy golangci-lint `funlen`.
+- cloud RED→GREEN: `TestRequestToken_DeviceLoginTimeout` — slow /access_token
+  endpoint + deviceLoginTimeout=50ms. RED: hung 3s past the 2s guard. GREEN:
+  cancelled via ctx, returns `context.DeadlineExceeded` in <1s.
+- 1.6 `go test ./cmd/ ./internal/cloud/` green; `golangci-lint run ./...` 0 issues.
+
+phase 2 (REQ-CI-011):
+- 2.1 added `Install OpenCode CLI` step (`curl -fsSL https://opencode.ai/install
+  | bash` + `~/.opencode/bin` → `$GITHUB_PATH`) before `gga run`, plus a
+  `Verify OpenCode CLI` (`opencode --version`) step. `continue-on-error` is
+  already on the job, satisfying REQ-CI-011 core-requirement.
+- 2.2 YAML validated; step order: setup Go → install GGA → verify GGA → install
+  OpenCode → verify OpenCode → gga run.
+
+phase 3 (REQ-CI-010):
+- 3.1 `ci.yml` test job uses `include` matrix (os paired with `race`); test step
+  is `go test -shuffle=on ${{ matrix.race && '-race' || '' }} ./...`. `-race`
+  now only on ubuntu-latest per PR.
+- 3.2 added `.github/workflows/ci-full-race.yml` — `cron: '0 6 * * 1'` (Monday
+  06:00 UTC) + `workflow_dispatch`, 3-OS matrix, `go test -race -shuffle=on
+  ./...`.
+- 3.3 `setup-go@v5` default `cache: true` already applies (no explicit cache
+  key) — no change.
+- 3.4 `tparse` absent from all workflows/Taskfile — no change.
+- 3.5 all three YAML files parse (python yaml.safe_load).
+
+TDD cycle evidence (Strict TDD):
+| task | RED evidence | GREEN evidence |
+|------|--------------|----------------|
+| 1.1/1.2 | old `TestRunLogin_EmptyToken` made real HTTP/2 calls, hung >8s | rewritten test PASS in 1.02s, no real net |
+| 1.4/1.5 | `TestRequestToken_DeviceLoginTimeout` FAIL: "hung >2s" (3.00s) | same test PASS, ctx cancelled <1s, DeadlineExceeded |
diff --git a/openspec/specs/ci-consistency/spec.md b/openspec/specs/ci-consistency/spec.md
index 43ff567..bf2e274 100644
--- a/openspec/specs/ci-consistency/spec.md
+++ b/openspec/specs/ci-consistency/spec.md
@@ -190,3 +190,89 @@ The GGA CI job MUST install GGA without Homebrew. GGA is a Bash application (not
 - GIVEN the runner is `ubuntu-latest`
 - WHEN the GGA install step completes
 - THEN the `gga` binary MUST be available in `$PATH` and `gga --version` succeeds
+
+---
+
+### REQ-CI-009: Test Isolation from External Services
+
+Unit tests MUST NOT make real network calls. Tests that exercise external services (OAuth device flow, cloud APIs) MUST inject a fake or stub via the existing `Deps` dependency-injection pattern used by `runLoginWithDeps`.
+
+#### Scenario: TestRunLogin_EmptyToken completes quickly with fake DeviceLogin
+
+- GIVEN a test that calls `runLoginWithDeps` with a `DeviceLogin` dependency returning an error for empty tokens
+- WHEN the test executes
+- THEN the test MUST complete in under 2 seconds
+- AND no real HTTP request MUST be made to any OAuth endpoint
+
+---
+
+### REQ-CI-010: Production Timeout Safety for External Calls
+
+External calls that block on user interaction or remote services (specifically the OAuth device flow) MUST wrap their context with `context.WithTimeout` to prevent indefinite hangs.
+
+#### Scenario: DeviceLogin times out after safety limit
+
+- GIVEN the production `DeviceLogin` implementation is invoked with a valid but non-completing device flow
+- WHEN 60 seconds elapse without user authorization
+- THEN the call MUST return a context deadline exceeded error
+- AND no goroutine MUST remain blocked indefinitely
+
+---
+
+### REQ-CI-011: CI Race Detector Scoping
+
+The `-race` flag MUST run only on `ubuntu-latest` in the per-PR test matrix. A weekly scheduled job MUST run `-race` on all three operating systems (ubuntu, windows, macos) as a safety net.
+
+#### Scenario: Per-PR ubuntu job uses race detector
+
+- GIVEN a pull request triggers the CI workflow
+- WHEN the test job runs on `ubuntu-latest`
+- THEN the `go test` invocation MUST include the `-race` flag
+
+#### Scenario: Per-PR mac/windows jobs skip race detector
+
+- GIVEN a pull request triggers the CI workflow
+- WHEN the test job runs on `windows-latest` or `macos-latest`
+- THEN the `go test` invocation MUST NOT include the `-race` flag
+
+#### Scenario: Weekly cron runs race detector on all OS
+
+- GIVEN the weekly scheduled trigger fires (cron)
+- WHEN the test matrix executes
+- THEN all three OS runners MUST execute `go test` with the `-race` flag
+
+---
+
+### REQ-CI-012: Go Module and Build Cache in CI
+
+CI MUST cache Go modules (`GOMODCACHE`) and the Go build cache (`GOCACHE`) across runs using `actions/setup-go` caching or an equivalent mechanism.
+
+#### Scenario: Second CI run uses cached modules
+
+- GIVEN a CI run has completed successfully and populated the cache
+- WHEN a subsequent CI run executes on the same `go.sum`
+- THEN the module download step MUST be skipped or significantly faster than a cold run
+
+---
+
+### REQ-CI-013: GGA Job Functional Execution
+
+The GGA CI job MUST install the OpenCode CLI binary before running `gga run`. The GGA job MUST execute functionally (producing review output). The GGA job MUST remain advisory — findings MUST NOT fail the workflow (`continue-on-error: true`).
+
+#### Scenario: OpenCode binary available for GGA
+
+- GIVEN the GGA workflow job has completed its setup steps
+- WHEN `which opencode` or `opencode --version` is invoked
+- THEN the command MUST succeed and the binary MUST be in `$PATH`
+
+#### Scenario: GGA produces review output
+
+- GIVEN the OpenCode CLI is installed and `gga` is available
+- WHEN `gga run --pr-mode --diff-only` executes
+- THEN the step MUST produce visible output (review comments or summary)
+
+#### Scenario: GGA findings do not fail the workflow
+
+- GIVEN GGA reports findings or violations
+- WHEN the GGA step completes
+- THEN the overall job MUST still succeed (continue-on-error absorbs failures)