chore: sunset audit-only release.yml after ADR-0002 flow runs cleanly

[millsmillsymills]

Context

ADR-0002 keeps the existing post-push release.yml as an audit witness for "one quarter or three runs, whichever is later" after the new workflow-mediated flow lands. The sunset criterion is in the ADR but not in a trackable issue.

Acceptance

• Tracking issue contains the explicit trigger: (date >= ADR-0002-impl-merge + 90 days) OR (successful workflow-mediated releases >= 3), whichever lands later.
• When the trigger fires, open the deletion PR that removes .github/workflows/release.yml (audit) and updates ADR-0002 status to reflect the audit role retired.

Blocked on

• Issue Signed-tag impl: workflow-mediated release flow + SSH signing key provisioning #36 (ADR-0002 impl) merging.

Source

Follow-up from review of PR #32 (ADR-0002). Reviewer F3.

[millsmillsymills]

🤖 Automated multi-agent issue review

Recommendation: keep-open · Priority: P3 · Effort: small · Premise still valid: True

Review. A legitimate deferred tracking issue that records ADR-0002's sunset criterion for the audit-only release.yml. Its premise is fully valid: release.yml is still the primary signed-tag gate (not yet audit-only), no workflow-mediated flow exists, and the explicit blocker issue #36 (ADR-0002 impl) is still open and not started. The actual deletion work cannot begin until #36 merges AND the sunset trigger fires (impl-merge + 90 days OR ≥3 clean workflow-mediated runs). The deletion itself is small (remove one workflow + flip an ADR status line), but it is currently blocked, so it is not actionable now.

Suggested next step. Keep open as the canonical tracker for the ADR-0002 sunset trigger. Remove the misleading ready-for-agent label and add a blocked/needs-info style marker (or note) reflecting it is gated on #36, so an AFK agent does not pick it up prematurely — the work is genuinely blocked: #36 has not merged, so neither the 90-day clock nor the 3-clean-run counter has started. Optionally link it as "blocked by #36" via GitHub issue dependencies. Revisit only after #36 merges and the trigger condition is met.

Adversarial re-review (concurs). premise recheck: confirmed

The review is correct: premise fully reproduces against the code (release.yml still runs git verify-tag as the active primary gate, no workflow-mediated flow exists, blocker #36 is open/unstarted), so keep-open at P3/small is right. The only adjustment is emphasis — removing the misleading ready-for-agent label is an actionable step to take now (the deletion work itself remains genuinely blocked), and the stale ADR-0002 'Proposed' status line is worth a quick cleanup.

Open points raised:

• Minor: reviewer framed chore: sunset audit-only release.yml after ADR-0002 flow runs cleanly #45 as simply 'not actionable now,' but there IS an actionable-now component the framing buries — the ready-for-agent label is actively wrong and should be removed/changed immediately (a relabel is doable today even though the deletion is blocked). The reviewer did note this in suggested_action, so it's a framing quibble, not a substantive error.
• Reviewer's premise_notes did not flag a real doc inconsistency I found: ADR-0002's own Status line (docs/adr/0002-required-signed-tag-check.md:5) still reads 'Proposed', while CLAUDE.md asserts 'Plan-2 ADRs Accepted 2026-05-15'. This does not affect issue chore: sunset audit-only release.yml after ADR-0002 flow runs cleanly #45's validity but is adjacent dead/stale documentation worth flagging.

_{Posted by a review + adversarial-review agent sweep across all open issues. No code was changed; no PRs were opened.}

[millsmillsymills]

This was generated by AI during triage.

Relabeling ready-for-agent → ready-for-human. The sunset work is blocked on #36 (ADR-0002 PR-1 has not merged), so neither the 90-day clock nor the 3-clean-run counter has started; an AFK agent should not pick this up. This matches the 2026-06-23 review-sweep recommendation in this thread. The stale ADR-0002 Proposed status line flagged above is fixed in PR #87.