ci(governance): R5 — hard gate against doc canonical-reference drift #749

	# SPDX-License-Identifier: MPL-2.0
	name: MVP Smoke (Best Effort)

	on:
	push:
	branches: [main]
	pull_request:
	branches: [main]

	# Cause-B mitigation (#77): cancel superseded runs so stacked pushes
	# to the same ref don't pile up identical jobs in the queue.
	concurrency:
	group: ${{ github.workflow }}-${{ github.ref }}
	cancel-in-progress: true

	permissions:
	contents: read

	env:
	CARGO_TERM_COLOR: always

	jobs:
	mvp-smoke:
	name: MVP Smoke
	runs-on: ubuntu-latest
	permissions:
	contents: read
	steps:
	- name: Checkout repository
	uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4

	- name: Setup Rust toolchain
	uses: dtolnay/rust-toolchain@6d9817901c499d6b02debbb57edb38d33daa680b # stable
	with:
	toolchain: stable

	- name: Cache Cargo
	uses: Swatinem/rust-cache@65012b490220f477f20ab979e35ae732e6de4e68 # v2

	- name: Install just
	uses: taiki-e/install-action@184183c2401be73c3bf42c2e61268aa5855379c1 # v2.78.1
	with:
	# Governance R1 requires versioned family-tool pins
	# (just\|must\|trust\|adjust\|bust\|dust\|intend); bare `tool: just`
	# tripped the Security policy check on every push to main since
	# #130 landed (2026-05-30). 1.51.0 is the current upstream stable.
	tool: just@1.51.0

	- name: Build release
	run: cargo build --release

	- name: MVP smoke checks (best effort)
	run: just --justfile Justfile mvp-env

Provide feedback