ci: split verification into separate typecheck, lint, test, and docs jobs

Each runs as its own check so a failure names the thing that broke and can be
required individually in branch protection, rather than one combined job.

Also give the docs job a self-describing name: it verifies the generated agent
index (public/llms.txt, llms-full.txt, AGENTS.md), which is committed and goes
stale when routes change.

Co-Authored-By: Claude <noreply@anthropic.com>

Author: montycheese

.github/workflows/ci.yml

@@ -15,41 +15,64 @@ permissions:
   contents: read
 
 jobs:
-  verify:
-    name: typecheck · lint · test · docs
+  typecheck:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-
       - uses: actions/setup-node@v4
         with:
           node-version: 24
           cache: npm
-
       - run: npm ci
-
       - run: npm run typecheck
 
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 24
+          cache: npm
+      - run: npm ci
       - run: npm run lint
 
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 24
+          cache: npm
+      - run: npm ci
       - run: npm test
 
-      # Fails if public/llms.txt, llms-full.txt, or AGENTS.md are stale. These
-      # are generated from the route tree and committed, so a new or renamed
-      # route must come with a regeneration (npm run llms && npm run agents).
+  # public/llms.txt, llms-full.txt, and AGENTS.md are generated from the route
+  # tree and committed. They go stale whenever a route is added, renamed, or
+  # removed, so this fails if they differ from a fresh generation (it also
+  # reports sitemap drift). Fix with: npm run llms && npm run agents
+  docs:
+    name: docs (generated agent index)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 24
+          cache: npm
+      - run: npm ci
       - run: npm run docs:check
 
   public-build-excludes-internal:
     name: public build excludes internal-only surfaces
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-
       - uses: actions/setup-node@v4
         with:
           node-version: 24
           cache: npm
-
       - run: npm ci
 
       # The default (external) build is what ships to Vercel. Deliberately no

README.md

@@ -37,7 +37,12 @@ to run the **internal** build locally with those sections visible. See
 
 `.github/workflows/ci.yml` runs on every pull request and on pushes to `main`:
 
-- **verify** — `typecheck`, `lint`, `test`, `docs:check`
+- **typecheck** — `tsc --noEmit`
+- **lint** — eslint
+- **test** — vitest
+- **docs (generated agent index)** — fails if the committed `public/llms.txt`,
+  `llms-full.txt`, or `AGENTS.md` are stale relative to the route tree. Fix with
+  `npm run llms && npm run agents`.
 - **public build excludes internal-only surfaces** — builds the default
   (external) target and asserts that internal-only routes 404 and never appear
   in the nav or sitemap, so the deployment matrix can't silently regress