ci: delete unread advisory workflows and the canary PR trigger

.github/workflows/ci.yml

@@ -475,7 +475,6 @@ jobs:
             .github/workflows/claude-review.yml
             .github/workflows/claude-security-review.yml
             .github/workflows/dependabot-miro-bundle.yml
-            .github/workflows/hook-utils-timing.yml
             .github/workflows/silent-revert-canary.yml
 
       - name: Verify shebang files are executable

.github/workflows/silent-revert-canary.yml

@@ -12,13 +12,10 @@ name: silent-revert-canary
 #
 # DETECTION, NOT PREVENTION -- and deliberately so.
 #
-#   * Scanning runs on `push` to main only. There IS a `pull_request` trigger
-#     below, but it only exercises the detector against its own tests and its
-#     recorded corpus (see the note above `on:`); the range-resolution and scan
-#     steps are both gated `if: github.event_name != 'pull_request'`, so no PR
-#     is ever inspected for silent reverts. By the time the canary speaks, the
-#     merge has happened; the value is that a human learns within minutes
-#     instead of during a from-scratch content audit weeks later.
+#   * Scanning runs on `push` to main only, so no PR is ever inspected for
+#     silent reverts. By the time the canary speaks, the merge has happened;
+#     the value is that a human learns within minutes instead of during a
+#     from-scratch content audit weeks later.
 #   * It is NOT in ci.yml and is NOT wired into that workflow's `ci-status`
 #     aggregate, which is the single required check the org ci-gate ruleset
 #     keys on. Adding it there would make a detection heuristic able to block
@@ -38,33 +35,9 @@ name: silent-revert-canary
 # exactly the false-green this lane exists to remove. Pushes to main are
 # infrequent enough that letting every run finish costs nothing worth saving.
 
-# The `pull_request` trigger exercises the detector against its OWN unit tests
-# and its recorded incident corpus, never against the PR. The range-resolution
-# and scan steps are gated off for PR events below, so nothing on a PR ever
-# inspects that PR for silent reverts -- detection stays post-merge, per the
-# design note above. What a PR gets is ordinary coverage of a shipped script,
-# scoped by `paths` to the canary's own files so it is inert on every other PR.
-#
-# Without it the detector would ship untested until the next push to main, and
-# the specific way this script can break is a false GREEN: if the blame parser
-# stops matching (awk dialects differ between the runner's mawk and a
-# developer's gawk), attribution yields nothing and every commit reports `ok`.
-# A canary whose failure mode is silent success is the exact thing #2691 is
-# about, so it gets tested before it lands, not after.
-#
-# This does not make the lane a merge gate. It is not in ci.yml and not in that
-# workflow's `ci-status` aggregate, which is the single required check the org
-# ci-gate ruleset keys on, so nothing here can block a merge.
 on:
   push:
     branches: [main]
-  pull_request:
-    paths:
-      - 'scripts/check-silent-revert.sh'
-      - 'scripts/check-silent-revert.test.sh'
-      - 'scripts/silent-revert-incidents.txt'
-      - 'scripts/silent-revert-acknowledged.txt'
-      - '.github/workflows/silent-revert-canary.yml'
   workflow_dispatch:
 
 permissions:
@@ -109,12 +82,8 @@ jobs:
       # workflow_dispatch; in both cases fall back to the head commit and SAY
       # SO, rather than reporting a clean scan of nothing. Values arrive through
       # env, never interpolated into the script body.
-      # Detection is post-merge only. On a pull_request event the two steps
-      # above have already proven the detector works; scanning stops here so the
-      # lane never inspects a PR and never has an opinion about merging it.
       - name: Resolve the pushed range
         id: range
-        if: github.event_name != 'pull_request'
         env:
           EVENT_BEFORE: ${{ github.event.before }}
           EVENT_AFTER: ${{ github.event.after }}
@@ -141,7 +110,6 @@ jobs:
           fi
 
       - name: Scan the merged commits for silent reverts
-        if: github.event_name != 'pull_request'
         env:
           SCAN_MODE: ${{ steps.range.outputs.mode }}
           SCAN_TARGET: ${{ steps.range.outputs.target }}
@@ -181,14 +149,9 @@ jobs:
       # skip the restoration answer. It excludes cancellation, so a cancelled
       # run still reports nothing rather than a result it did not earn.
       #
-      # UNGATED on the event, exactly like the self-test and the replay. The
+      # Runs on every push, exactly like the self-test and the replay. The
       # failure that produced #2828 is "nobody thought to check", so an
-      # on-demand mode would reproduce it. Running on pull_request events too is
-      # not a merge gate: this workflow is not in ci.yml and not in that
-      # workflow's `ci-status` aggregate, which is the single required check the
-      # org ci-gate ruleset keys on -- and it is `paths`-scoped to the canary's
-      # own files, so it is inert on every other PR. What it buys is that a PR
-      # editing this corpus proves its markers resolve before the merge.
+      # on-demand mode would reproduce it.
       #
       # No rev argument: it resolves against the checked-out tree, which is the
       # question worth asking here -- is the content on main RIGHT NOW. The

docs/architecture/landscape.json

@@ -84,10 +84,9 @@
     {"from":"claude-code-plugins","to":"anthropics/claude-plugins-official","type":"installs-plugin","relation":"external","count":1,"files":["plugins/playgrounds/skills/use/SKILL.md"]},
     {"from":"claude-code-plugins","to":"dometrain/mcp","type":"installs-plugin","relation":"external","count":1,"files":["plugins/dometrain/README.md"]},
     {"from":"claude-code-plugins","to":"trailofbits/skills","type":"installs-plugin","relation":"external","count":1,"files":["plugins/review/skills/audit-enforceability/SKILL.md"]},
-    {"from":"claude-code-plugins","to":"actions/checkout","type":"uses-workflow","relation":"external","count":15,"files":[".github/workflows/ci.yml",".github/workflows/claude-review.yml",".github/workflows/claude-security-review.yml",".github/workflows/dependabot-miro-bundle.yml",".github/workflows/hook-utils-timing.yml"]},
-    {"from":"claude-code-plugins","to":"actions/setup-node","type":"uses-workflow","relation":"external","count":5,"files":[".github/workflows/ci.yml",".github/workflows/dependabot-miro-bundle.yml",".github/workflows/video-digest-source-liveness.yml"]},
+    {"from":"claude-code-plugins","to":"actions/checkout","type":"uses-workflow","relation":"external","count":11,"files":[".github/workflows/ci.yml",".github/workflows/claude-review.yml",".github/workflows/claude-security-review.yml",".github/workflows/dependabot-miro-bundle.yml",".github/workflows/managed-files-guard.yml"]},
+    {"from":"claude-code-plugins","to":"actions/setup-node","type":"uses-workflow","relation":"external","count":3,"files":[".github/workflows/ci.yml",".github/workflows/dependabot-miro-bundle.yml"]},
     {"from":"claude-code-plugins","to":"actions/setup-python","type":"uses-workflow","relation":"external","count":3,"files":[".github/workflows/ci.yml"]},
-    {"from":"claude-code-plugins","to":"actions/upload-artifact","type":"uses-workflow","relation":"external","count":1,"files":[".github/workflows/video-digest-source-liveness.yml"]},
     {"from":"claude-code-plugins","to":"melodic-software/ci-workflows","type":"uses-workflow","relation":"internal","count":23,"files":[".github/workflows/ci.yml",".github/workflows/claude-review.yml",".github/workflows/claude-security-review.yml",".github/workflows/issue-triage-label.yml",".github/workflows/managed-files-guard.yml"]}
   ]
 }

docs/architecture/landscape.md

@@ -43,11 +43,11 @@ C4Context
   Rel(melodic_software_claude_code_plugins, melodic_software_provisioning, "cites (5)")
   Rel(melodic_software_claude_code_plugins, melodic_software_runner_policy_runtime, "cites (1)")
   Rel(melodic_software_claude_code_plugins, melodic_software_standards, "cites (53)")
-  Rel(melodic_software_claude_code_plugins, actions_checkout, "uses-workflow (15)")
+  Rel(melodic_software_claude_code_plugins, actions_checkout, "uses-workflow (11)")
   Rel(melodic_software_claude_code_plugins, melodic_software_ci_workflows, "uses-workflow (23)")
 ```
 
-64 external repositories are referenced but not drawn; the record carries
+63 external repositories are referenced but not drawn; the record carries
 every one of them.
 
 ## Annotations

docs/ci-runner-routing.md

@@ -1,9 +1,8 @@
 # CI runner routing
 
 This repository is public, so every lane runs on GitHub-hosted runners, free for
-public repositories: `ubuntu-24.04` for all of them except the two informational
-Windows lanes, `test-windows` in `ci.yml` and `windows` in
-`hook-utils-timing.yml`, which run `windows-2025`. The organization's
+public repositories: `ubuntu-24.04` for all of them except the informational
+Windows lane `test-windows` in `ci.yml`, which runs `windows-2025`. The organization's
 runner-policy engine refuses a governed fleet label here outright, reporting
 `public-self-hosted-routing`. There is no observer credential and no
 self-hosted exception inventory in this repository.