ci: keep product validation local

openspec/changes/enforce-local-only-validation/.openspec.yaml

@@ -0,0 +1,2 @@
+schema: spec-driven
+created: 2026-09-21

openspec/changes/enforce-local-only-validation/design.md

@@ -0,0 +1,44 @@
+## Context
+
+The repository already requires builds, tests, formatting, linting, and release
+certification to run on the development machine. A legacy pull-request workflow
+still ran those checks on GitHub Actions and was observed starting on PR #22.
+
+## Goals / Non-Goals
+
+**Goals:**
+
+- Remove the observed hosted product-validation path.
+- Preserve documentation packaging and GitHub Pages deployment.
+
+**Non-Goals:**
+
+- Move product tests to another hosted runner.
+- Change local Rust validation commands.
+- Change documentation content or deployment behavior.
+
+## Decisions
+
+Delete the product CI workflow rather than disabling individual jobs. Every job
+in that file performs prohibited product validation, so no deployment behavior
+would remain after filtering it.
+
+The documentation workflow remains because its artifact build and publication
+are the deployment mechanism. Its type check protects the deployable
+documentation artifact and is not used as product certification.
+
+## Risks / Trade-offs
+
+- GitHub will no longer display Rust test checks on pull requests. Local command
+  evidence in the change record and PR description is authoritative.
+- Existing in-flight runs must be canceled separately; deleting the workflow
+  prevents later pushes from starting new runs.
+
+## Migration Plan
+
+Cancel the observed PR #22 run, delete the CI workflow, validate the OpenSpec
+change locally, and merge the removal through a dedicated pull request.
+
+## Open Questions
+
+None.

openspec/changes/enforce-local-only-validation/proposal.md

@@ -0,0 +1,28 @@
+## Why
+
+Pushing PR #22 started a hosted `Build, Clippy & Test` job even though this
+repository requires product validation to run locally. Leaving that workflow in
+place wastes hosted capacity and can misrepresent GitHub results as release
+evidence.
+
+## What Changes
+
+- Remove the hosted Rust build, Clippy, database-fixture, and test workflow.
+- Keep the documentation deployment workflow, whose hosted work is limited to
+  packaging and publishing the documentation site.
+
+## Capabilities
+
+### New Capabilities
+
+- `local-validation-policy`: Defines where product validation and documentation deployment execute.
+
+### Modified Capabilities
+
+None.
+
+## Impact
+
+The change removes `.github/workflows/ci.yml`. Developers and release tooling
+continue to run Rust validation locally; documentation deployment remains on
+GitHub Pages.

openspec/changes/enforce-local-only-validation/specs/local-validation-policy/spec.md

@@ -0,0 +1,29 @@
+## Purpose
+
+Keep product verification on owned local machines while allowing hosted automation only for documentation deployment.
+
+## ADDED Requirements
+
+### Requirement: Product validation runs locally
+
+The project SHALL run builds, checks, linting, tests, database fixtures, and
+release certification on a local development machine. GitHub Actions MUST NOT
+run those product-validation commands.
+
+#### Scenario: A source pull request is pushed
+
+- **WHEN** a pull request changes Rust source, tests, or configuration
+- **THEN** GitHub Actions does not start a product build, lint, or test job
+- **AND** the pull request records the applicable local validation evidence
+
+### Requirement: Hosted automation is limited to documentation deployment
+
+GitHub Actions SHALL be limited to packaging and deploying the documentation
+site. Checks that are intrinsic to producing the deployable documentation
+artifact MAY run inside that deployment workflow.
+
+#### Scenario: Documentation deployment runs
+
+- **WHEN** a qualifying documentation change reaches the deployment workflow
+- **THEN** the workflow may package and publish the documentation site
+- **AND** it does not run Rust product validation or release certification

openspec/changes/enforce-local-only-validation/tasks.md

@@ -0,0 +1,3 @@
+## 1. Remove hosted product validation
+
+- [x] 1.1 Cancel the observed PR #22 product-test run, remove the legacy CI workflow, retain documentation deployment, and verify the strict OpenSpec change plus workflow inventory locally.