ci: two-state CI — the seven non-blocking ci.yml jobs run only on schedule and workflow_dispatch (Refs #2170)

[noahgift]

Merges after #2167. This branch is red on its own tree by design until #2167 lands: assertion 5 of the new falsifier requires the schedule: and workflow_dispatch: triggers that #2167 adds. Without them, the seven jobs below would never run at all. That turns a check off; it does not move it to the night. The red keeps this PR from merging first.

Plan row C3 of docs/specifications/sub/release-v0.1.619-plan.md, epic #2124. Refs #2170. Its acceptance asks for the first PR run and the first night run to be recorded on the epic, so this PR does not close the issue.

What changes

• ci.yml: seven jobs cannot block a merge (the required set is gate and workspace-test). They are kani, lake-build, docs, wasi, lean-models, shader-validate and license-scan. Each now has exactly this job-level condition:
  if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
gate and workspace-test do not change. A TWO-STATE CI comment after the enforcement-marker block records the rule.
• docs/RELEASE.md §5 step 2: dispatch ci while main is on the pinned SHA, and check that run's head_sha before recording the advisory statuses.
• New falsifier crates/xpile/tests/night_checks_off_pr_path.rs (XPILE-NIGHT-CHECKS-001). It reads only ci.yml and finds the night set from the ADVISORY-CONTEXTS marker. It asserts five things:
  1. every advisory job has exactly the night if:;
  2. required jobs have no if:, and pull_request and push stay;
  3. no required job needs: a night job;
  4. there is no continue-on-error in a job without the night if:;
  5. the schedule (with a cron: entry) and workflow_dispatch triggers exist.

Evidence

• RED first (commit b45b94d, on the old ci.yml): assertion 1 failed for all seven jobs, and assertion 4 failed on license-scan's report step.
• With the change: assertions 1 to 4 are GREEN. Assertion 5 is RED until ci: run the full ci workflow nightly on main (PMAT-2166) #2167. On a scratch merge with origin/ci/nightly-schedule, the falsifier (4/4) and ruleset_drift (5/5) are GREEN. I also ran the other tests that read ci.yml, all green: enforcement_prose_witness, changelog_freshness, ci_tool_install, dependency_license_policy, derived_corpus_vacuity_witness, release_runbook_facts_witness, roadmap_registration and witness_floor.
• Reverted once: restoring the old ci.yml turns assertions 1 and 4 RED again. A planted mutant that puts the night if: on workspace-test turns assertion 2 RED.

Quorum

• Author: claude-opus-5-5. Lanes: gemini-4-argon-high (agy), claude-sonnet-5-5-high (agy) and claude-haiku-4-5 (Claude Code).
• Rounds 1 and 2 were on the branch alone. Both were NOT AGREED (2 FAIL), because the tree has no night triggers. Those findings led to assertion 5. Round 2 also flagged a misplaced comment, now moved.
• Round 3 judged these commits cherry-picked onto ci/nightly-schedule (stacked head 7ca2607d): 3/3 PASS (docs/audits/quorum-PMAT-2170.json).
• Planted control: the same stack, with the night if: also on workspace-test and assertion 2 weakened so it no longer checks that job. Result: 3/3 FAIL, each naming ci.yml:160-161 (docs/audits/quorum-PMAT-2170-control.json).
• The receipt is bound to the stacked head, not to this branch. After ci: run the full ci workflow nightly on main (PMAT-2166) #2167 merges, rebase this branch onto main and run a fresh round before any arming. The roadmap.yaml EOF conflict with ci: run the full ci workflow nightly on main (PMAT-2166) #2167 resolves as main plus this row.

🤖 Generated with Claude Code

[noahgift]

seat 2, aprender-clerk @852d1628ef — APPROVE.

I authored none of these commits (b45b94d, 91cbfb9, e64ad9c, 9ba9150, 73dd69a, merge 852d162; all by infra-38-worker).

• Workflow change: ci.yml gives exactly the seven ADVISORY jobs the job-level if schedule || workflow_dispatch: kani, lake-build, docs, wasi, lean-models, shader-validate, license-scan. The required gate and workspace-test have no job-level if.
• No hidden skip of a gate: no job in ci.yml uses needs:, so a required job cannot be skipped through a moved one.
• Two states only: no continue-on-error is added. On this PR's run the seven show SKIPPED and both gates show SUCCESS.
• The schedule trigger is in place: #2167's schedule and workflow_dispatch triggers are already on main.
• Falsifier: crates/xpile/tests/night_checks_off_pr_path.rs (XPILE-NIGHT-CHECKS-001) reads the REQUIRED and ADVISORY markers and refuses an empty set. It asserts four things: advisory jobs run only at night, gates are unconditioned and need no night job, no continue-on-error is on the PR path, and the schedule/dispatch triggers exist. It runs in workspace-test, which is green.
• RELEASE.md step 2 now dispatches ci on the pinned SHA to record advisory statuses in the release notes, without blocking the tag. Non-blocking note: that wait adds wall time to the release. Reading the latest nightly run on the pinned SHA, when one exists, would avoid it.
• Stale receipts: the in-tree docs/audits/quorum-PMAT-2170*.json bind the stacked 7ca2607d, as the author says. The receipt bound to this head is out of tree.
  Required checks gate and workspace-test are green @852d1628ef.

[noahgift]

APPROVE — seat 1, aprender-a7, head 852d162

Read the full diff at this head; gate and workspace-test are green on it, and the seven night jobs show as skipped, as intended.

• .github/workflows/ci.yml: the identical job-level if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' goes on exactly the seven jobs in the ADVISORY-CONTEXTS marker (docs, kani, lake-build, lean-models, license-scan, shader-validate, wasi).
• gate and workspace-test, the only required contexts in the main ruleset, carry no if:. No job needs: a night job, so a skipped job cannot skip a required one.
• crates/xpile/tests/night_checks_off_pr_path.rs pins this from the marker: night-only advisory jobs, gates unconditional, no continue-on-error on the PR path, and the schedule/workflow_dispatch triggers present.
• docs/RELEASE.md §5 step 2 now dispatches ci on the pinned SHA and checks head_sha before reading statuses. Without that, the release would read skipped runs.

Non-blocking:

1. The new comment says a night red "opens or updates one issue with one owner", but nothing in ci.yml does that yet. Either add the step or name who triages the nightly run, or a red sits unseen until a release dispatch.
2. The committed docs/audits/quorum-PMAT-2170*.json bind the earlier stacked head, not this one; the binding round for this head is out of tree.