Operator pushback: 'I don't want a smoke test I have to manually run
every time I commit.' Correct read — the script existed for local
debugging but its presence in scripts/ci-guards/ implied 'operator
runs this regularly,' which is the opposite of the design intent.
Changes:
- Removed scripts/ci-guards/cold-db-compose-smoke.sh.
- Inlined the smoke logic directly into the
cold-db-compose-smoke job in .github/workflows/ci.yml. Same
semantics: docker compose down -v -> up -d -> wait-healthy ->
bootstrap admin -> issue/renew/revoke -> assert audit rows ->
teardown. 15-min wall-clock cap. Logs dump on failure.
- Removed the cold-db-compose-smoke.sh skip case from the generic
regression-guards loop (no longer needed).
- Updated scripts/ci-guards/README.md and
docs/contributor/ci-guards.md to reflect the new shape: 'lives in
the workflow, not as a script.'
Workspace docs updated (cowork/WORKSPACE-CHANGELOG.md,
cowork/CLAUDE.md, cowork/auditable-codebase-bundle/RESULTS.md).
The gate is unchanged: CI runs the smoke on every push, master
branch-protection enforces it as a required check. Operator's
manual action is once — adding the check to branch-protection.
Audit-Closes: post-v2.1.0-anti-rot/item-6
Three doc changes for the bundle's discoverability:
1. New docs/contributor/ci-guards.md (185 lines)
Entry-point doc for new contributors. Explains the four categories
of guards (code-shape, contract-parity, build/dep, operational),
the discipline that keeps them honest (allowlist + expiration),
and how to add a new one. Cross-references scripts/ci-guards/README.md
for the exhaustive list.
2. scripts/ci-guards/README.md — added a 'Forward-looking guards'
subsection naming complete-path-config-coverage, doc-rot-detector,
and cold-db-compose-smoke with their item references + a
one-sentence description of what each catches. Replaced the
stale '22 guards' header with 'Count: re-derive via ls' per the
no-version-stamped-numbers convention from CLAUDE.md.
3. docs/README.md — wired ci-guards.md into the Contributor section
navigation table.
Bumped 'Last reviewed:' to 2026-05-12 on the two docs touched
(docs/README.md, docs/contributor/ci-pipeline.md).
Verified: doc-rot-detector.sh green at 91 docs scanned, 89 dated, 0
warns, 0 fails.
Audit-Closes: post-v2.1.0-anti-rot/item-1
Audit-Closes: post-v2.1.0-anti-rot/item-2
Audit-Closes: post-v2.1.0-anti-rot/item-5
Audit-Closes: post-v2.1.0-anti-rot/item-6
shankar0123