Source baseline: main@0cdf0519dd937f04a4e0a98d077719b659f0e5d6 (2026-10-13); 61 direct workflow YAML files. This catalog is a configuration inventory, not an audit of runner isolation, the security of third-party actions, external service availability, or an assertion that any scheduled run succeeded. Inspect the linked workflow YAML for the operative if, paths, secrets, checkout ref, and job conditions before taking action. The repository PR Gate remains the required merge-safety check; path-filtered workflows are supplemental, and a green check is not human acceptance.
on:, not evidence the job runs for every event. Path filters, job conditions, secrets, concurrency, and external prerequisites also matter.permissions: ...: write declarations, not observed writes or an authorization certificate. The entry none means no explicit GitHub write scope, not no network or side effects. A workflow may call a provider with a separately supplied secret, run controlled Docker code, or send IndexNow notifications while its GitHub token remains read-only.| Workflow YAML | Declared triggers | Explicit write scopes | Source / purpose |
|---|---|---|---|
ace-activation-gate.yml |
pull_request,push | none | Run the fail-closed ACE activation snapshot contract; scripts/ace_activation_gate.py |
ace-cohort-contract.yml |
pull_request,push,workflow_dispatch | none | Check ACE cohort observer workflow contract; tests/test_ace_cohort_observer_contract.py |
ace-cohort-observer.yml |
issues,issue_comment,pull_request_target,schedule,workflow_dispatch | issues | Observe GitHub events and update bounded ACE issue evidence via github-script; actions/github-script |
ace-community-growth.yml |
issues,pull_request_target,push,watch,fork,workflow_dispatch | issues | Reconcile community-growth issue ledger via trusted github-script; actions/github-script |
ace-generation-shadow.yml |
pull_request,push,workflow_dispatch | none | Evaluate ACE generation controller in shadow mode; scripts/ace_generation_controller.py |
ace-lineage-check.yml |
pull_request,push,workflow_dispatch | none | Test ACE lineage schema and parser; scripts/ace_lineage.py |
ace-population-live-check.yml |
pull_request,push | none | Run synthetic population/capacity acceptance cases; experiments/ace_population_sim.py |
ace-safety-contract.yml |
pull_request,push,workflow_dispatch | none | Test the ACE community workflow safety constraints; tests/test_ace_safety_contract.py |
ace-workflow-hardening-check.yml |
pull_request,push | none | Guard ACE workflow event and authority hardening; tests/test_ace_workflow_hardening.py |
aco-stigmergy-sim.yml |
push,pull_request | none | Run seeded ACO task routing and replay comparisons; sim/aco_stigmergy_sim.py |
adversarial-evidence-envelope.yml |
push,pull_request,workflow_dispatch | none | Validate contamination-resistant evidence envelopes; scripts/adversarial_evidence_guard.py |
anytime-drift-guard.yml |
push,pull_request,workflow_dispatch | none | Test bounded drift and sequential-evidence assumptions; scripts/anytime_drift_guard.py |
auto-draft-pr.yml |
schedule,push | pull-requests | Trusted-main steward may create Draft PRs, never merge; tools/auto_draft_pr_steward.py |
benchmark-cohort-contract.yml |
pull_request,push | none | Validate frozen cohort contracts and readiness; tools/benchmark_cohort.py |
benchmark-publication.yml |
push,workflow_dispatch | contents | May commit a regenerated benchmark publication on trusted main; tools/benchmark_publication.py |
branch-convergence-audit.yml |
workflow_dispatch,schedule,push,pull_request_target,pull_request | none | Read-only branch convergence evidence and non-authoritative planning; tools/branch_convergence_audit.py |
ci-shadow-outcome.yml |
workflow_run | none | Join CI plans to actual check outcomes without cancelling checks; tools/ci_shadow_evaluator.py |
ci-shadow-planner.yml |
pull_request,push,workflow_dispatch | none | Suggest advisory check plans; all required checks still run; tools/ci_shadow_planner.py |
codeql.yml |
push,pull_request,schedule,workflow_dispatch | security-events | CodeQL scans and uploads security analysis, not a release approval; github/codeql-action |
collaboration-observables.yml |
workflow_dispatch,schedule | none | Sample pseudonymized collaboration observations and publish artifact evidence; scripts/collaboration_observables.py |
emergence-sim.yml |
push,pull_request | none | Exercise synthetic goal-shift/verification experiments and sweeps; sim/matched_budget_emergence.py |
evaluator-plan-binding.yml |
pull_request,push | none | Check exact source-bound independent verifier policy; experiments/evaluator_plan_runner.py |
evaluator-plan-v03-semantics.yml |
pull_request,push | none | Verify added-line substring semantics without candidate execution; experiments/evaluator_plan_v03.py |
evaluator-transformation-calibration.yml |
pull_request,push | none | Run bounded post-burn evaluator calibration; tools/task001_evaluator_calibration_v04_ci.py |
evidence-aggregation-fabric.yml |
push,pull_request,workflow_dispatch | none | Check conjunctive typed-evidence aggregation; scripts/evidence_aggregation_fabric.py |
evolution-loop.yml |
issues,pull_request_target,pull_request,push,workflow_dispatch,schedule | none | Trusted-main event observer, validated checkpoints and advisory score; scripts/evolution_score.py |
free-resource-plan.yml |
pull_request,push,workflow_dispatch | none | Inspect discovery versus concrete eligible compute offers; scripts/free_resource_planner.py |
free-resource-source-audit.yml |
pull_request,push,schedule,workflow_dispatch | none | Inspect registry source freshness; optional URL liveness; scripts/free_resource_source_audit.py |
gate-audit-action-selftest.yml |
push,pull_request,workflow_dispatch | none | Run the local gate-audit composite action against fixtures; actions/gate-audit |
idkgraph-invariants.yml |
push,pull_request,workflow_dispatch | none | Check typed-graph structural invariants; scripts/idkgraph_check.py |
idkgraph-link-integrity.yml |
pull_request,workflow_dispatch | none | Check deterministic Markdown link and heading identities; tools/idkgraph_link_check.py |
idkgraph-markdown-index.yml |
push,pull_request | none | Build/check deterministic Markdown document identity; tools/idkgraph_markdown_index.py |
idkgraph-observatory.yml |
pull_request,push | none | Emit read-only graph/health evidence and deterministic review sample; tools/idkgraph_observatory.py |
idkgraph-repository-mapping.yml |
pull_request,push | none | Project explicit repository identities into typed graph; tools/idkgraph_repository_mapping.py |
idkgraph-workunit-cycles.yml |
pull_request,push | none | Detect invalid executable WorkUnit dependency cycles; tools/idkgraph_workunit_cycles.py |
indexnow-discovery.yml |
push,schedule,workflow_dispatch | none | Notify external IndexNow of changed public docs; no ranking promise; tools/submit_indexnow.py |
interop-bindings-check.yml |
pull_request,push | none | Run A2A/MCP semantic binding and optional SDK conformance tests; interop/sdk_conformance.py |
issue-model-router.yml |
issues,schedule,push,workflow_dispatch | issues | Assign issue routing labels, distinct from dispatch approval; scripts/issue_model_router.py |
jules-dispatch.yml |
workflow_call,issues,schedule,workflow_run,workflow_dispatch | issues | Approved issue dispatch via Jules API, bounded by policy and secret; tools/jules_dispatcher.py |
mathematical-evolution-kernel.yml |
push,pull_request,workflow_dispatch,schedule | none | Exercise bounded evolutionary math/reference observer; scripts/evolution_math.py |
nightly-full-suite.yml |
schedule,workflow_dispatch | none | Run full testkit tier including slow simulation tests; scripts/testkit.py |
openhands-pilot.yml |
workflow_dispatch | none | Manual external OpenHands pilot, reads issue and uses opt-in provider secret; tools/openhands_pilot.py |
phase-b2-successor-v2-scaffold.yml |
pull_request,push | none | Verify successor benchmark scaffolds and frozen definitions; tools/benchmark_cohort.py |
phase0-schema-check.yml |
pull_request,push | none | Phase-0 fixture/schema/verification integration checks; experiments/harness.py |
pr-gate.yml |
pull_request,push,workflow_dispatch | none | Mandatory Python 3.11/3.13 tests, docs links and schema/API gates; scripts/testkit.py |
pr91-acceptance-harness-check.yml |
pull_request,push | none | Test controlled-host PR91 acceptance harness without live runtime; scripts/pr91_acceptance.py |
project-domain-contracts-check.yml |
pull_request,push | none | Validate manifest/domain composition and negative fixtures; experiments/project_contracts.py |
public-discovery-monitor.yml |
page_build,schedule,workflow_dispatch | none | Outbound probe of public discovery surfaces, observational only; tools/check_public_discovery.py |
publish-pypi.yml |
release,workflow_dispatch | attestations,contents,id-token | Tag-bound PyPI publication with environment approval and OIDC; tools/build_release_supply_chain.py |
randomness-lab.yml |
push,pull_request | none | Exercise R1-R3 synthetic models and replay/readiness checks; randomness_lab/__main__.py |
real-mixed-outcome-e2e.yml |
pull_request,workflow_dispatch | none | Controlled Docker pinned-node failure-isolation run; tools/real_mixed_outcome_e2e.py |
real-node-verifier-e2e.yml |
pull_request,workflow_dispatch | none | Controlled Docker node and independently bound verifier; tools/real_node_verifier_e2e.py |
real-two-attempt-e2e.yml |
pull_request,workflow_dispatch | none | Two real frozen-node attempts under external coordinator; tools/real_two_attempt_e2e.py |
real-two-attempt-evidence-e2e.yml |
pull_request,workflow_dispatch | none | Two-attempt evidence with mixed-outcome replay; tools/real_two_attempt_evidence_e2e.py |
repository-math-portfolio.yml |
push,pull_request_target,pull_request,issues,workflow_dispatch,schedule | none | Advisory attention/portfolio with trusted checkpoint state; scripts/repository_portfolio.py |
run-evidence-report-check.yml |
pull_request,push | none | Non-selecting evidence report generation/replay checks; experiments/run_evidence_report.py |
scorecard.yml |
push,schedule,workflow_dispatch | security-events | OpenSSF Scorecard scan uploaded as security findings; ossf/scorecard-action |
sequential-evidence-kernel.yml |
push,pull_request,workflow_dispatch | none | Anytime-valid sequential-evidence contract checks; scripts/sequential_evidence.py |
task001-real-transition-calibration.yml |
pull_request,push | none | Evaluator-owned frozen Task001 transition/behavioral matrix; tools/task001_real_transition_calibration.py |
task001-v04-canonical-calibration.yml |
pull_request,workflow_dispatch | none | Check canonical v0.4 calibration against burned task; tools/task001_evaluator_calibration_v04_ci.py |
visibility-observatory.yml |
workflow_dispatch,schedule,push | none | Observe SEO/community reach with non-attributable funnel coverage; scripts/visibility_observatory.py and scripts/visibility_funnel_coverage.py |
pr-gate.yml runs the unfiltered unit tier and contract/link checks for both supported Python versions; the testing guide explains what it excludes. Never substitute a path-filtered research workflow for this gate, nor count workflow_dispatch availability as evidence a task was executed.ace-cohort-observer.yml, ace-community-growth.yml and issue-model-router.yml declare issue-write; jules-dispatch.yml declares issue-write plus external Jules calls; auto-draft-pr.yml declares pull-request-write; benchmark-publication.yml declares contents-write. Check trusted checkout scope, conditions and policy before running these workflows. No such job may be treated as human approval.publish-pypi.yml uses tag identity, short-lived OIDC, an environment requiring owner configuration/review, build attestations and release-upload privileges. indexnow-discovery.yml sends public URLs to an external endpoint, not a ranking outcome; Scorecard/CodeQL upload security analyses.real-*-e2e.yml workflows run pinned candidates in a controlled Docker host. They do not make a general-purpose untrusted-code runner safe to run on a developer machine.sim/, randomness_lab/, ACE and portfolio jobs may upload artifacts or use external public metadata, but their outputs do not change the canonical capability/evidence classification without independent review.python -m pytest -q tests/test_github_workflow_docs.py
python scripts/check_links.py
The drift guard verifies a unique row for each direct workflow, exact declared event keys and explicit workflow/job GitHub write scopes. It intentionally does not evaluate YAML expressions, inherited external tokens, or third-party action privileges. Whenever workflow triggers/permissions change, update this table, architecture index, and the relevant operating manual in the same PR. Consult operations scripts map and research code map for ownership of the Python paths linked above.