ci: release jobs run on pf-ci-release (owner: CI on our machines) - #461

Brings in #461 (engine release jobs on pf-ci-release). It touches
.github/workflows/promote-baseline.yml, .github/workflows/release.yml,
.github/actionlint.yaml, docs/ci.md, scripts/ci_preflight.py and
scripts/test_ci_preflight.py; the merge has no conflict (this branch changes
ci.yml, AGENTS.md, CONTRIBUTING.md and different regions of the other three).
No resolution edits were made.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

Brings in #461 (engine release and promote jobs on pf-ci-release). Conflicts
in scripts/ci_preflight.py (3 hunks), scripts/test_ci_preflight.py (2),
docs/ci.md (4) and .github/actionlint.yaml (main's superset taken); both
intents are kept:

- ci_preflight.py: the canon CI/native pins, authz and refusal-step checks
  stay; #461's RELEASE_RUNNER, RELEASE_JOB_RUNNERS and release/promote event
  checks come in; HOSTED_JOB_RUNNERS keeps only docs `build`, because #461
  removed the hosted pins for promote and release. The release `prebuilt`
  matrix expression stays `${{ matrix.runner }}` as on main.
- test_ci_preflight.py: the canon tests and #461's isolated-release tests and
  the actionlint label tests are all kept; the tests that asserted the old
  hosted promote/release routes are replaced by #461's pinned-route tests.
- docs/ci.md: the canon text stays verbatim; #461's release isolation and
  promotion descriptions come in; the dated transitional sentence now says the
  hosted pins are gone and cites the real lines of the resolved preflight.

Resolution by Codex lane core-canon-merge461 (report kept with the lane), read
hunk by hunk by the supervisor; the preflight on the merged tree is the check.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

…cks under the CI canon (#464)

* ci: native-live and the ubuntu Debug leg run as canon pull_request checks (authz + pool labels, no hosted fallback)

Apply the frozen ci-labels.md canon, SHA-256
ac875205d8bdae2d7e0c23aca438118a0e9da2efb297de4e6b2cd80e7416f5b3.

Copy the canon authz job into CI and the reusable native workflow. Gate
all work on it, remove the PR branch filter and hosted runner fallbacks,
use the heavy pool for preflight and Linux builds, and retain the existing
macos-26 exception. Both always-running aggregates refuse non-successful
authz first; the caller retains only the classified docs-only skip exception.
Keep PR slow-row selection and all existing platform job maxima unchanged.

Pin the resolved arrays, authz script and dependencies, and refusal steps.
Add file-backed runner/authz/aggregate mutations and real-shell identity
cases, including a no-op refusal mutation. Keep corpus and release routing
separately pinned without changing those workflows.

Intentionally replace the old runner/fallback and classification policy
sentences in docs/ci.md, including material introduced by 0212cab,
3c19a69, 133f571, 693fd9e, d093560, 116c461,
c3ed455, f736676, 2394ba2 and 7da487a. This supersedes
the 28fe3466a / f9bee22 policy descriptions and the 3484a7c stopgap;
no new timing measurements are claimed.

No repository scripts, linters, lexers, builds or tests were run on this
Mac, per CORE-TOP's 2026-10-20 stop order. The org policy checker was also
not run because it requires Ruby. Git hooks are disabled for this commit
so they cannot execute repository code. Full verification and pool CI
remain pending on the committed tree.

* ci: fix canon CLOUD preflight and status-function guards

Repair the stale verifier-name mutation by matching the real step fields independently and keeping a file-backed unsized-call refusal witness. Declare the pool labels in the automatically discovered actionlint config and refresh the AGENTS content pin.

Copy the frozen ci-labels.md refusal step before checkout in every inline CI job with a status function. Enforce the protocol for always, cancelled, failure and success, retain leading uses/run keys on unnamed steps, and add file-backed negative controls with positive guarded-run controls. Canon SHA-256: ac875205d8bdae2d7e0c23aca438118a0e9da2efb297de4e6b2cd80e7416f5b3.

Intentionally correct the classification-order sentence in docs/ci.md introduced by 133f571: authz is first and changes needs it. The native-feature-parity edit changes only the sha256 pin for the unchanged AGENTS lines.

No repository script, test, linter, parser, build or measurement was run on this Mac under the owner stop order. Git hooks are disabled for this local commit. The supervisor CLOUD preflight remains the validation judge.

* docs: point the PASS anchor at the AGENTS.md lines that hold it

The anchor's pin hash was refreshed to AGENTS.md:144-145, but the sentence
it cites (`PASS` verdict binding the exact HEADs) lives at 149-150, so the
SYMMISS check fails the preflight. Restore the pin to the windows's real
hash and cite the real range.

Co-Authored-By: Claude Code <[email protected]>

* docs(ci): restore the ci.md rules the preflight enforces, under the owner's October 20 runner rulings

Squash of two earlier docs commits (e413335ad restored the preflight-enforced rules; 5c1bc44e2 adopted the owner's October 20 runner rulings): against the parent the net change is additions plus one rewritten sentence, and no L6 2026-10-19 hosted paragraph appears at all.

Policy now stated in docs/ci.md: owner CI-HOSTED = B (all CI on our own machines, credentialed jobs included: credential-free jobs on pf-ci, credentialed jobs on pf-ci-release at protected refs, one job per VM, only macOS stays on GitHub; the CR-171 hosted exception is void) and REL-HOSTED = B (no release hosted exception), as amended by L6 on 2026-10-21 00:0x. A dated transitional sentence names the preflight pins that still list docs, promote and release as hosted until #461 and the ci/pfrel-* heads land.

Rewritten sentence (the matrix-skip description), old text quoted verbatim:

> so a documentation-only run shows one skipped `build` check instead of the four legs. Required-check configuration must retain this aggregate to enforce that exception.

New text: the same sentences, with "under its unexpanded name" added after "one skipped `build` check".

Validation: NOT RUN here (nothing from the repository runs on the authoring machine); the CLOUD preflight of the merged head is the proof.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

---------

Co-authored-by: luisleo526 <[email protected]>
Co-authored-by: Claude Code <[email protected]>

…367 reported (no file change)

The doc-reverts stage of preflight rj-20261021t071807-7ea367 on 817f6ae reported 88 commits since a35a64c with 19 unnamed sentence deletions or reverts. Every one is a deliberate replacement made by an accepted ruling or a later rewrite of the same page; this empty commit names each introducer by its sha so the checker can match them. DOC-REVERTS NAMES:

- d093560 (INT26 wave H): docs/pages/native-engine.md "A C++ host reads a closed row whole, at any time, every Trade field included." replaced by the closed-row-access-by-copy row (CORE-TOP 14:42 ruling E: closed rows are paged, the C++ accessor returns a copy).
- efb8c7e (o1w-contract round 2): docs/pages/report-schema.md "C/ctypes clients require an explicitly negotiated provider bridge; there is no new runtime C export in this slice." superseded by the selected-window named-sink contract text of b19d8ae (APP's ask).
- 39a718b (cr150 L6b-1): docs/pages/run-failure-codes.md "The engine could not create or write the report sink." and "The run has no completed sink or valid trailer." replaced by the regenerated report_sink_failed description (W1 reasons, sink_exhausted).
- d220bd7 (cr150-q7): run-failure-codes.md "The existing engine_fault/retryable policy is retained pending a ruling:", "PROPOSED cancelled, retryable false;" and "RETURN TO CORE-TOP for the class ruling." removed by the class ruling (CORE-TOP: run_aborted only, no cancelled class, no retry field, fd 6 unused; lane commit 8d16e20).
- d91c96d (CR-150 route ii foundation): run-failure-codes.md "The engine could not create, resize, read or write scratch-table storage." replaced by the split wording (auxiliary tables raise scratch_io_failed; report-sink scratch raises report_sink_failed reason scratch_io; CORE-TOP 10-21 10:15 option A).
- 4d6cd2b (CR-150 WL-PTAILFIX): docs/design/consumed-partial-exit-fold.md "The previous-header fail-before compilation of the new unit remains required; its expected first diagnostic is the additional IdPairStore template a..." rewritten by o1w-slabfold d41311c (slab fold document).
- a8f84b9 (docs(api): C ABI reference site): docs/pages/report-schema.md "pf_report_t is the single output of every backtest.", "This page maps each field to its meaning and units." and "Heap array, ordered by exit time ascending." rewritten by the O(1) report contract pages (o1w-contract rounds 2 and 3).
- 03b2406 (ci: release jobs run on pf-ci-release, #461): docs/ci.md deletions of the "Push this prepared migration only after both CORE-TOP gates ..." paragraph and the PF_CI_LABELS / release.yml / promote-baseline.yml sentences: main's own later edit of that page, taken whole by merge 7 (engine main 21ba62b).

No page content changes in this commit.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

…1ba62b) on core/cr150-o1-integ b4d2011

One commit carrying the tree of o1w/merge0 0a41361 (the full-history record of the merge-7 line), as a child of core/cr150-o1-integ b4d2011, so the doc-reverts gate judges the whole change against its real parent with this message (CORE-TOP ruling 10-21 18:04: no rewrite of pushed history, no checker exception).

Merged lane heads (all carried in the tree): o1w-contract b19d8ae, o1w-pyjson cbc68d2, o1w-tail 27fcad9, o1w-selected 91fbd0e, o1w-seq 4b84f9d, o1w-tradeout bf024f1, o1w-ledger a87e546, o1w-metrics 3e1e70d, o1w-slabfold d41311c, batch-B 583c221, L8d proof 07c6363, L9b proof b01fe68, batch-C e6f8fcb, Q7 abort d220bd7, Q9 converter 3478350. Merge 7 is engine main 21ba62b. Rulings applied: CORE-TOP A (the four unbacked contract declarations withdrawn until the ledger and metrics lanes define them), B (the two _JSONRecordArray factory forms in the selected-window ownership scanner), E and F (closed-row accessor by copy; indexed report-array read), R13 (main's typed finite failures and proportional sub-day annualization win), the Option A failure-class split.

DOC-REVERTS NAMES: every sentence deletion or revert listed by the doc-reverts gate on preflight 6f8e97 is a deliberate replacement made by an accepted ruling, a regeneration, or a later rewrite of the same page, and is named here by the commit that introduced it:

- 03b2406 (ci: release jobs run on pf-ci-release, #461): the docs/ci.md paragraphs "Push this prepared migration only after both CORE-TOP gates", "Until then a job on that label with no runners only waits, and nothing is pushed.", the PF_CI_LABELS / pre-job hook / release.yml / promote-baseline.yml sentences: rewritten by main's own later edit of that page (21ba62b, #464), taken whole by merge 7.
- a8f84b9 (docs(api): C ABI reference site): docs/pages/report-schema.md "pf_report_t is the single output of every backtest.", "This page maps each field to its meaning and units.", "Heap array, ordered by exit time ascending." rewritten by the O(1) report contract pages.
- efb8c7e (o1w-contract round 2): docs/pages/report-schema.md "C/ctypes clients require an explicitly negotiated provider bridge; there is no new runtime C export in this slice." superseded by the selected-window named-sink contract text of b19d8ae.
- 39a718b (cr150 L6b-1): docs/pages/run-failure-codes.md "The engine could not create or write the report sink." and "The run has no completed sink or valid trailer." replaced by the regenerated report_sink_failed description.
- d220bd7 (cr150-q7): run-failure-codes.md "The existing engine_fault/retryable policy is retained pending a ruling:", "PROPOSED cancelled, retryable false;" and "RETURN TO CORE-TOP for the class ruling." removed by the class ruling (run_aborted only, no cancelled class, no retry field).
- d91c96d (CR-150 route (ii) foundation): run-failure-codes.md "The engine could not create, resize, read or write scratch-table storage." replaced by the split wording (auxiliary tables raise scratch_io_failed; report-sink scratch raises report_sink_failed reason scratch_io).
- e6f8fcb (CR-150 batch-C): docs/design/arena-bound.md "`sequence_index_` `include/pineforge/source/pine_adapter.hpp:N`" and the "`include/pineforge/detail/id_pair_store.hpp:N`;" citation: re-pointed or dropped after the merged source moved.
- 5dbe91c (merge batch-B 583c221): docs/design/native-feature-parity.md "**yes** — `fill_report` engine_report.cpp:N, `get_trade` engine.hpp:N, `compute_trade_stats`" and "**no** — `compute_equity_stats` exits early on an empty curve": single-line pins replaced by the backticked symbol, as the anchor checker instructs.
- 4d6cd2b (CR-150 WL-PTAILFIX): docs/design/consumed-partial-exit-fold.md "The previous-header fail-before compilation of the new unit remains required; its expected first diagnostic is the additional `IdPairStore` template a..." rewritten by o1w-slabfold d41311c.
- d093560 (INT26 wave H): docs/pages/native-engine.md "A C++ host reads a closed row whole, at any time, every `Trade` field included." replaced by the closed-row-access-by-copy row (CORE-TOP ruling E: closed rows are paged, the C++ accessor returns a copy).

DOC-REVERTS NAMES, second set: against this commit's real parent b4d2011 the gate reports 21 unnamed sentence deletions or reverts, all introduced by the seven commits below (preflight rj-20261021t100903-91b0cc, stage doc-reverts). Each is a deliberate rewrite on top of the introducing commit, and each introducer is named here:

- 133f571 ("1.0 prep: CI flake fix, docs-only CI skip, benchmark refresh (supersedes #303, #304, #307)"), eleven docs/ci.md sentences: "The compilation lanes start alongside preflight, as soon as the few-second `changes` job has classified the change", "A pull request or a push to `main` whose change is documentation only runs `preflight` and the documentation build", "Each proof job waits for `changes` alone, a few seconds once a standard runner takes it", "`preflight` waits for nothing.", "`changes` and `preflight` wait for nothing and run on every event", "A documentation-only change starts preflight alone there.", "So does the `changes` job, a two-commit checkout and one `git diff`.", "The same stage pins the documentation-only skip", "The advisory `build` aggregate passes a proof job that succeeded", "A proof job skipped for any other reason fails it", "success": rewritten by main's later CI redesign and carried whole by merge 7 of 21ba62b.
- b2a578c ("docs: make every README and doc page true before the release (DOCS-ENGINE) (#300)"), one docs/ci.md sentence on the PR registration floors after lane FIX-E1E2 (773 Debug and sanitizers, 782 native): superseded by the later floor rows.
- 2394ba2 ("ci: remove every time limit that can fail a run for being slow (#373)"), two docs/ci.md sentences: "The table below reports each job's measured duration and the platform maximum that replaced its old limit" and "The numbers are measured durations, not a two-times multiplier.": replaced by the current duration table.
- 7da487a ("ci/tests: remove the CI time limits; a platform-maximum stop is a HANG to re-run (EN-116)"), two docs/ci.md sentences: "Under the owner rule, no required-check stage, row, step, profile or matrix entry may carry a time limit" and "The native workflow retains only its 360-minute job envelopes, with no verification-step deadline.": superseded by the same redesign.
- b148979 ("selected window: declare 1.3-parity, not 1.3, until a completeness proof exists (1.6.1)"), three sentences, README.md and docs/pages/report-schema.md: "`capabilities.selected_window_contract_revisions` is `[\"1.3-parity\"]` when the runtime supports selected windows", "The `--capabilities-json` probe's `capabilities.selected_window_contract_revisions` is `[\"1.3-parity\"]`", "From 1.6.1 (unreleased), the image declares `1.3-parity` instead": reverted to the 1.3 pin by the later capability ruling (AMD6 1.3-parity only), an accepted reversal.
- 1bd075c ("Trading metrics + equity curve in backtest report (ABI v2) (#31)"), one docs/pages/report-schema.md sentence: "See the per-field doxygen in `<pineforge/pineforge.h>` for the exact rule on every field.": replaced by the O(1) report contract's per-field pages.
- d3cca9e ("Docs: correct migration semantics and harden publication guards"), one docs/design/native-feature-parity.md pin line (`sha256:H` c_abi.cpp:N, `sha256:H` check_c_abi_runtime.py:N, ...): replaced by the symbol-only rows, as the anchor checker instructs.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

…, squash of #477) (#480)

One tree-identical squash of the CR-233 branch (PR #477), on engine main 20267dd, so that the doc-reverts gate judges the change once, against main, with this message. It replaces the branch's eleven commits (f82ef8a, 0d63b1b, b4a98a4, cfda278, 9f33e1b, a merge of main, 64137d8, ab12867, 60bcfe2c, 8c2386ed and the control test 077d3ebb); the branch is kept as ci/cr233-pr-split-r2.

What changes:
- ci.yml keeps only the PR wall (authz, changes, preflight, Release/Debug build, corpus-parity-subset, build-gate); the full-event jobs (preflight-slow, macOS build, sanitizers, kernel-only, native-live, full corpus parity) move to ci-post.yml on pf-gcp-post; docs build/deploy split into docs.yml and docs-post.yml; corpus-parity-subset becomes its own workflow.
- scripts/ci_preflight.py, its tests and docs/ci.md follow the split (runner contract, PR vs post aggregates, PR_PROOF_JOBS, PR fast rows).
- scripts/check_two_world_registration.py models a parenthesised boolean group and get_test_property (property reads bind NOTFOUND); tests/CMakeLists.txt carries the PR-fast-rows guard; control tests 21 and 22 cover both.

doc-reverts: docs/ci.md rewords or drops sentences introduced by earlier commits on main. They are named here: a8089b2 (the GCP fleet routing, #474), 21ba62b (native-live and the Ubuntu Debug leg as pool-only checks, #464), 03b2406 (release jobs on pf-ci-release, #461), 3c19a69 (Linux x64 jobs on the pf-ci-spot pool, #420), 133f571 (1.0 prep, docs-only CI skip, #303), d3cca9e (docs: migration semantics, publication guards), eed6598 (defer macOS Debug from pull requests, CR-195, #454). Each deleted sentence is superseded by the PR/post split described above; none is a silent revert.

Proof: the previous head of this tree failed CLOUD proof rj-20261021t210656-9f91b8 on the causes fixed here (get_test_property unmodelled in the two-world walk, a stale macOS anchor, a stale aggregate lane list); this commit has not been run by its author, the next CLOUD proof is its first run.

Co-authored-by: Claude Sonnet 5.5 <[email protected]>

…equest_target (CR-231) (#470)

* ci: trigger promote-baseline on push to main (CR-231)

pull_request_target is refused by the pf-ci-release gate by design, so the
merge-triggered promote was always cancelled. Promotion now starts on push to
main (or manual dispatch, five inputs kept) and resolves the merged PR from
the pushed SHA: exactly one merged PR whose merge_commit_sha is that SHA and
whose base is main; zero or several exits green with a notice and no
metadata. The exact-tree check, verify+parity-green check, App token, WIF,
proxy and baseline-promote.mjs ordering are unchanged, with a shared
promote-baseline concurrency group (cancel-in-progress: false).

Pins moved together: ci_preflight.py requires the push/main trigger set and
refuses PR events, adds a resolver-count guard and a later-PR-head checkout
test; docs/ci.md and AGENTS.md describe the push trigger. Sentences written
by 03b2406 (#461) are reworded, not deleted.

Co-Authored-By: Claude Code <[email protected]>

* ci: resolve the merged PR with python3, not jq (CR-231)

The preflight host has no jq, so the behavioural resolver tests failed
with exit 127 before any selection ran. The resolver now parses the
paginated gh response with python3's json module, passing the SHA and
the page JSON through the environment; the gh call, its argv, the four
PR conditions and the exactly-one-match rule are unchanged. Malformed
JSON, JSON constants, or a shape that is not an array of page arrays of
PR objects exits green with a notice and ok=false, never merge metadata.
The exacttree step keeps jq -es (it runs only on the real runner).

Pins and tests updated to require the python selection; the tests still
run the workflow's own Resolve step under bash with only gh faked.

docs/ci.md: rewrites the resolver sentence introduced by 99a25b7;
no rule sentence is removed.

Co-Authored-By: Claude Code <[email protected]>

* ci: read the merged-PR response from fd 3 and skip on deeply nested JSON (CR-231)

Opus read round 3 of 041771d (faked pass none, invariants hold) found two things in the python resolver:

- The page JSON travelled in the environment (PULLS=...); Linux rejects one environment string over 131,072 bytes (`python3: Argument list too long`, exit 126), so a very large response would turn the step red and skip the promotion. The old jq code read it through a here-string. The resolver now reads it from file descriptor 3 (`python3 - 3<<<"$pulls" <<'PY'`); SHA stays in the environment. A new test feeds a one-match response over 131,072 bytes and expects all five values and ok=true; its fake gh now reads the fixture from a file (the environment variable had the same limit).
- Deeply nested JSON raised RecursionError, which the resolver did not catch, so the step went red instead of skipping green. It now catches (ValueError, RecursionError); a new test feeds 100,000 opening brackets and expects the notice, ok=false and no metadata.

Reworded docs/ci.md sentence (introduced by 041771d, so no rule sentence is removed): "with the SHA and page JSON passed through the environment" now says the page JSON is read from file descriptor 3, and the malformed-JSON sentence also names excessively nested JSON. The two pins in scripts/ci_preflight.py and their mutations in scripts/test_ci_preflight.py follow the new text.

Correction to the message of 041771d: the `jq -es` that stays belongs to the `ci` (gate) step of promote-baseline.yml, not to the exacttree step; neither is changed here, and the gate step ran with jq on the pf-ci-release image (engine run 39557850123).

Tests were written, not executed, on the author's side; the CLOUD preflight is their first run.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

* ci: promote-guard needs only pull-requests: read (CR-231)

First read of #470: the guard does no checkout and its API reads (commit to PR
association, PR detail, collaborator permission) need only pull-requests: read.
Drop contents: read from the guard job; the literal pin, the independent guard
pin, the tests and docs/ci.md follow, with two red controls (contents: read put
back; pull-requests: read removed).

Lane: ci-promote-fix1b (Codex gpt-6.1-sol).

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

---------

Co-authored-by: luisleo526 <[email protected]>
Co-authored-by: Claude Code <[email protected]>