diff --git a/.github/workflows/product.yml b/.github/workflows/product.yml
index b14f5465..8863e1ee 100644
--- a/.github/workflows/product.yml
+++ b/.github/workflows/product.yml
@@ -6,8 +6,8 @@ on:
     branches: [main]
 
 concurrency:
-  group: conceptweave-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
+  group: ${{ github.workflow }}-${{ github.repository }}-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 permissions:
   contents: read
diff --git a/scripts/check_ci_contract.py b/scripts/check_ci_contract.py
index e0e7130e..1342082b 100644
--- a/scripts/check_ci_contract.py
+++ b/scripts/check_ci_contract.py
@@ -14,7 +14,8 @@ def main() -> int:
 
     required_fragments = (
         "runs-on: ubuntu-24.04",
-        "cancel-in-progress: true",
+        "group: ${{ github.workflow }}-${{ github.repository }}-${{ github.event.pull_request.number || github.run_id }}",
+        "cancel-in-progress: ${{ github.event_name == 'pull_request' }}",
         "actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0",
         "COVERAGE_TOOLCHAIN: nightly-2026-08-20",
         'rustup toolchain install "$COVERAGE_TOOLCHAIN" --profile minimal --component llvm-tools-preview',
@@ -31,6 +32,9 @@ def main() -> int:
             "evidence demonstrates selective floating-image starvation"
         )
 
+    if "github.event.pull_request.number || github.ref" in workflow:
+        raise SystemExit("Product CI must isolate non-PR runs by run_id")
+
     return 0