A safety test earns its CI cost when it exercises an independent failure boundary; tests that…

A safety test earns its CI cost when it exercises an independent failure boundary; tests that only restate registries, source text, workflow ordering, or prose metadata should be consolidated unless that metadata is itself an executable trust boundary. This applies especially to egress and observability suites: transport-family interception, production-process preload, real provider entry paths, artifact non-deployability, redaction, and fail-closed evidence verification are independent invariants worth retaining. By contrast, duplicated expected-ID lists, string-length checks on cleanup prose, exact runner/cache/job-name assertions, and aggregate event counts driven by a self-authored harness mostly detect refactors rather than product regressions. Limit: a meta-test remains valuable when the verifier it tests is the release gate (for example, proving malformed or unsafe evidence is rejected); the remedy is proportional consolidation, not deleting every test of test infrastructure.

Evidence/example — 2026-09-09

Repository source review of e3-solutions/theft (local working tree): web/e2e/observability/posthog-observability-matrix.test.ts duplicates registry IDs and validates metadata/source strings; web/e2e/observability/posthog-browser-contract.spec.ts aggregates captures from a synthetic route; web/scripts/check-e2e-evidence-ci-contract.mjs is a 655-line source-text contract spanning safety plus runner/cache optimization details. In contrast, web/e2e/egress/server-provider-canaries.spec.ts reaches real application provider entry paths under a deny guard, while web/scripts/verify-server-egress-canaries.mjs verifies the expected blocked destinations and redaction. Timed local hermetic checks showed six PostHog contract scripts total roughly 12 seconds and the server guard/verifier/canary trio roughly 15 seconds, so the primary concern is misleading confidence and maintenance churn more than those scripts' isolated runtime. These are source-level observations, not current CI health or deployment status.