- insert changes job (dorny/paths-filter@v4) before fast-checks - changes job: permissions pull-requests:read, outputs code, no checkout - code filter lists positive patterns: **/*.ts, apps/**, pnpm-lock.yaml, Dockerfile, etc. - api job: needs [changes] + if combined with needs.changes.outputs.code == 'true' - harness job: same needs/if pattern as api - services, env, and step bodies unchanged in both heavy jobs