fix(ci): retire the a2ml manifest gates (D-B) and stop CodeQL on PR/push

[hyperpolymath]

Retires the a2ml-keyed manifest gates per owner ruling D-B, stops CodeQL firing on PR/push, and fixes one unambiguous defect that the retirement exposed.

This is PR 6a — the first of a three-way split of the original PR 6. It contains only the parts that could be fully pre-measured locally; the hypatia gate (6b) and the Governance parse failure (6c) follow separately, because a five-part PR has five ways to be red and the standing ruling is to land only fully-green PRs.

What changed, and why each

1. verify-manifests.yml — retire STATE / ECOSYSTEM / META (D-B).
Job Verify Machine-Readable Manifest Currency halted at step 3 on .machine_readable/STATE.a2ml, leaving steps 4–7 skipped — unknown, not passing. All three a2ml files are absent, so there is no content to move and nothing to preserve: only steps to remove. The requirement survives as issue #81 (re-express as .deed). Nothing new connects to a2ml.

2. verify-manifests.yml — repair a step that had never once executed.
Unmasking step 6 exposed a real defect in Check TEMPLATE-STANDARDS-AUDIT.adoc currency:

first line of the file : v1.2, 2026-07-26
old: sed 's/v//'       → "1.2, 2026-07-26"   compared against literal "1.2"  → FAIL
new: sed 's/^v//' | cut -d, -f1 | tr -d '[:space:]' → "1.2"                  → PASS

The document is v1.2, is dated 2026-07-26, and does reference DEP-09. The gate's own extraction was wrong, not the content — so this is an unambiguous defect fixed directly, per the 09-22 ruling. Both arms were measured against the real file; the old code is a working mutant control.

3. openssf-compliance.yml — same STATE.a2ml demand, three steps masked.
Step retired. The three a2ml filenames are also dropped from the placeholder-token list, where each was already guarded by [ -f "$f" ] and therefore inert.

4. codeql.yml — workflow_dispatch: only.
Org code-scanning config 256896 sets allow_advanced: false, so this workflow's SARIF is refused outright ("analyses from advanced configurations cannot be processed when the default setup is enabled"). Default-setup CodeQL runs separately, is green, and already satisfies the code_scanning ruleset rule. The file is not deleted — actions.lock keys an entry to it, and deleting it would orphan that entry and red the bidirectional check-lock-sync.sh arriving in #73. The rationale is recorded in-file so a later reader does not "restore" the trigger.

Pre-measured, not predicted

Deleting a failing step promotes whatever sat behind it to its first real measurement. All five newly-unmasked predicates were run locally against the real tree before pushing:

unmasked predicate	result
Check TEMPLATE-STANDARDS-AUDIT.adoc currency	❌ → fixed in this PR (item 2)
Check reusable workflow pins	✅ both 40-hex and identical
Check CHANGELOG exists	✅ CHANGELOG.md present
Check no unfilled placeholder tokens	✅ 0 across 7 present files
Summary	✅

⚠ Scope — what this PR does not claim

This does not turn the Verify Manifest Files workflow green. Its other job, Verify AI-MANIFEST and README.adoc files, fails independently on two missing README.adoc files whose cure lives on PR #73's branch. The assertion here is the job-level check-run Verify Machine-Readable Manifest Currency, not the workflow conclusion. Reading job 1's red as "D-B failed" would be a misreading.

🚨 Finding for #82 — a fourth settings.yml divergence

.github/settings.yml declares analyze (javascript-typescript, none) as a required status check. That is the CodeQL advanced job's matrix name, which item 4 makes permanently unemittable. It is inert today only because the live ruleset carries no required_status_checks rule at all — which is precisely the drift #82 already tracks. Adding it there rather than silently working around it.

Verification

• yq parses all three files; actionlint clean.
• SPDX header still within head -5 on codeql.yml (the gate PR fix(ci): resync actions.lock after PR #66 and clear the SPDX gate #70 relaxed).
• yq e '.on | keys' on codeql.yml returns exactly [workflow_dispatch].
• Commit signed (%G? = G), satisfying required_signatures.
• Assertion is per step, not per job.

🤖 Generated with Claude Code

https://claude.ai/code/session_01YSq3UodR3CjsuAK5yoTzHF

[coderabbitai]

Warning

Review limit reached

Next included review available in 34 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 45680344-a474-42f3-ac38-2be77b4c5583

📥 Commits

Reviewing files that changed from the base of the PR and between b500a7b and 5814a57.

📒 Files selected for processing (3)

• .github/workflows/codeql.yml
• .github/workflows/openssf-compliance.yml
• .github/workflows/verify-manifests.yml

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}