Isolate the Cloudflare runtime package lane

.github/workflows/check.yml

@@ -24,6 +24,8 @@ jobs:
     timeout-minutes: 30
     steps:
       - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
       - uses: actions/setup-node@v4
         with:
           node-version: 22

.github/workflows/cloudflare-check.yml

@@ -0,0 +1,37 @@
+name: Cloudflare Check
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+concurrency:
+  group: cloudflare-check-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  cloudflare-check:
+    name: package check
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: npm
+          cache-dependency-path: packages/runtime-cloudflare/npm-shrinkwrap.json
+      - name: Install Cloudflare package lock
+        run: npm ci --prefix packages/runtime-cloudflare --workspaces=false
+      - name: Check repository package boundaries
+        run: npm run test:runtime-package-boundaries
+      - name: Run Cloudflare package checks
+        run: npm --prefix packages/runtime-cloudflare run check
+      - name: Bundle installed Cloudflare package artifact
+        run: npm --prefix packages/runtime-cloudflare run test:packed-wrangler

.gitignore

@@ -1,5 +1,7 @@
 node_modules/
 vendor/
+!packages/runtime-cloudflare/vendor/
+!packages/runtime-cloudflare/vendor/**
 dist/
 artifacts/
 runtime-overlays/*

docs/runtime-package-lanes.md

@@ -0,0 +1,11 @@
+# Runtime Package Lanes
+
+The root package is the Node CLI lane. Its explicit workspace list excludes Cloudflare, so a default root `npm ci`, `npm run build`, `npm run check`, or `npm pack` does not install, compile, test, or package Cloudflare. The root's `cloudflare:*` commands only forward into the package with `npm --prefix packages/runtime-cloudflare run ...`.
+
+`packages/runtime-cloudflare` remains in the monorepo but has its own packed `npm-shrinkwrap.json`, runtime and development dependencies, install-time stream-compression patch, TypeScript check, tests, Wrangler dry runs, package dry run, generators, and local gates. Its operational commands resolve only package-owned scripts, assets, dependencies, and configs, and local gates provision their locked Playwright Chromium before use. The packed artifact bundles the selected contract surface and dependency closure reproducibly compiled from `@automattic/wp-codebox-core` `0.26.2` at commit `d3fac4ad4e4bbf6dd457ea2cd46aeb1a081b217b` using that release's locked install. Root boundary tests compare every generated JavaScript and declaration byte and cover positive and negative contract behavior. Install it reproducibly with:
+
+```sh
+npm ci --prefix packages/runtime-cloudflare --workspaces=false
+```
+
+Run both independent lanes with `npm run check:all`.

homeboy.json

@@ -15,7 +15,7 @@
     "provider": "cloudflare-workers.deploy",
     "policy": {
       "wrangler": {
-        "binary": "./node_modules/.bin/wrangler",
+        "binary": "./packages/runtime-cloudflare/node_modules/.bin/wrangler",
         "config": "packages/runtime-cloudflare/wrangler.d1.jsonc",
         "config_ref": "packages/runtime-cloudflare/wrangler.d1.jsonc"
       },
@@ -24,7 +24,9 @@
         "WORDPRESS_STATE_BUCKET",
         "WORDPRESS_STATE_DATABASE"
       ],
-      "predeploy_commands": [],
+      "predeploy_commands": [
+        "npm ci --omit=dev --engine-strict --prefix packages/runtime-cloudflare --workspaces=false"
+      ],
       "timeout_ms": 300000
     }
   },