chore(standards): sync latest guidance and remove review decisions

.agents/skills/ci-pipelines/SKILL.md

@@ -5,6 +5,8 @@ description: Use when changing continuous integration, GitHub Actions workflows,
 
 # CI pipelines
 
+Canonical workflows use maintained major-version tags for external actions.
+
 ## Billing shapes the job graph
 
 - Jobs bill per minute, rounded up, minimum one. Fold sub-minute checks into an existing job on the same trust level instead of giving them their own.

.agents/skills/declarative-infra/references/image-promotion-contracts.md

@@ -212,8 +212,13 @@ digest_hex=${DIGEST#sha256:}
 branch="image-bump/${APP}/${SOURCE_SHA:0:12}-${digest_hex:0:12}"
 prs=$(gh pr list --repo example/infra --state all --search "\"$marker\" in:body" --json number,body,state)
 pr=$(jq -er --arg marker "$marker" '[.[] | select(.state == "MERGED" and (.body | contains($marker)))] | if length == 1 then .[0].number else error("expected one merged promotion PR") end' <<<"$prs")
-view=$(gh pr view "$pr" --repo example/infra --json state,mergeCommit,author,headRefName,headRepository,files,statusCheckRollup)
-merge_sha=$(jq -er --arg branch "$branch" 'if .state == "MERGED" and .author.login == "promotion-bot[bot]" and .headRefName == $branch and .headRepository.nameWithOwner == "example/infra" and [.files[].path] == ["infra/images.json"] and ([.statusCheckRollup[] | select(.name == "trusted-promotion-provenance" and .conclusion == "SUCCESS")] | length) == 1 then .mergeCommit.oid else error("merged promotion PR is not trusted") end' <<<"$view")
+view=$(gh pr view "$pr" --repo example/infra --json state,mergeCommit,author,headRefName,headRepository,headRefOid,files)
+merge_sha=$(jq -er --arg branch "$branch" 'if .state == "MERGED" and .author.login == "promotion-bot[bot]" and .headRefName == $branch and .headRepository.nameWithOwner == "example/infra" and [.files[].path] == ["infra/images.json"] then .mergeCommit.oid else error("merged promotion PR is not trusted") end' <<<"$view")
+head=$(jq -er '.headRefOid | select(test("^[0-9a-f]{40}$"))' <<<"$view")
+checks=$(gh api "repos/example/infra/commits/$head/check-runs?check_name=trusted-promotion-provenance&filter=latest&per_page=100" --paginate --slurp)
+jq -e --arg head "$head" '[.[].check_runs[]] | length == 1 and all(.[];
+  .name == "trusted-promotion-provenance" and .head_sha == $head and
+  .app.slug == "github-actions" and .status == "completed" and .conclusion == "success")' <<<"$checks" >/dev/null
 encoded=$(gh api "repos/example/infra/contents/infra/images.json?ref=$merge_sha")
 images=$(jq -er '.content' <<<"$encoded" | base64 --decode)
 jq -er --arg app "$APP" --arg digest "$DIGEST" --arg sha "$SOURCE_SHA" 'select(.[$app].promotionEnabled == true and .[$app].digest == $digest and .[$app].promotedSourceSha == $sha) | true' <<<"$images" >/dev/null

.agents/skills/declarative-infra/references/image-promotion.md

@@ -128,6 +128,8 @@ The deploy workflow serializes production without cancellation. Its deploy job d
 
 Completion filters merged PRs before uniqueness, then authenticates the App bot, canonical same-repository branch, `images.json`-only file set, successful trusted provenance check, and exact resulting pin at the merge SHA. Open and closed marker copies are ignored; forged or multiple merged candidates fail closed. The exact merge-SHA deploy and its one successful deploy job are required.
 
+Read provenance through the Checks API for the exact PR head SHA, filter by `trusted-promotion-provenance` and `latest`, paginate, and require exactly one completed, successful GitHub Actions check. A missing, duplicate, failed, pending, wrong-head, or foreign-App check fails closed. The completion reader needs Actions read, Contents read, Pull requests read and Checks read; a reporter that publishes the completion check needs Checks write. Do not request `statusCheckRollup`: it also fetches commit statuses and can fail without `statuses: read`, even when the needed check is readable. Completion does not need access to those unrelated statuses.
+
 Announcing or opening a promotion proposes a release; it does not authorize deployment. An open or deliberately deferred PR is informational and must not fail a freshness check because a newer image exists. Record the pending proposal and its evidence without treating it as completed deployment.
 
 Promotion is push-based. Verify the exact approved images and service health during deployment and report completion on the promotion PR. Do not add a scheduled image drift detector, periodic running-image comparisons, publication-age failures, or a promotion latency field. There is no periodic image recheck after successful completion.

.agents/skills/review-fix/SKILL.md

@@ -13,7 +13,7 @@ An explicit user choice wins. Otherwise use Claude Opus 5 at high effort in Clau
 
 ## Scope
 
-Read `.agents/review/decisions.md` when present. Post one scope comment with the intent, threat model, out-of-scope work, and selected lenses; its timestamp starts the cycle. Ask about splitting only when the PR contains independent product outcomes.
+Post one scope comment with the intent, threat model, out-of-scope work, and selected lenses; its timestamp starts the cycle. Ask about splitting only when the PR contains independent product outcomes.
 
 Choose distinct lenses:
 
@@ -37,14 +37,14 @@ Reuse a successful equivalent exact-head gate. Otherwise run the repository gate
 
 For every required review or verification lens, spawn a separate read-only subagent using the [review skill](../review/SKILL.md). `review-pass` is an optional workflow helper. If delegation is unavailable, report incomplete coverage and stop.
 
-Review the PR base → initial head with the scope, gate result, decisions registry, lenses, and any model override. Retry a skipped lens once, then stop if coverage is still incomplete. Merge duplicate findings while preserving every reporting lens, and assign one decision:
+Review the PR base → initial head with the scope, gate result, lenses, and any model override. Retry a skipped lens once, then stop if coverage is still incomplete. Merge duplicate findings while preserving every reporting lens, and assign one decision:
 
 - `block`: demonstrated, in scope, material under the threat model, and worth stopping the merge;
 - `defer`: real but outside this PR or below the merge bar;
 - `discard`: refuted, speculative, already accepted, or not worth scheduling;
 - `ask`: a costly, durable product or architecture choice remains unresolved.
 
-Do not ask about inferable implementation details, naming, local refactors, test shape, or other reversible choices. Choose the smallest sound option and record durable assumptions. Collect every unavoidable `ask` into one decision brief with the options, consequences, and a recommendation.
+Do not ask about inferable implementation details, naming, local refactors, test shape, or other reversible choices. Choose the smallest sound option. Collect every unavoidable `ask` into one decision brief with the options, consequences, and a recommendation.
 
 ## Fix
 

.agents/skills/review/SKILL.md

@@ -13,7 +13,6 @@ Review the requested change without editing it. The goal is a trustworthy merge
 - Ground findings in inspected code, repository contracts, tests, command output, or documented framework behavior.
 - Show a reachable failure scenario. Suspicious patterns or theoretical possibilities alone are not findings.
 - Judge materiality against the supplied intent and threat model. Repository-rule drift is evidence, not automatically a blocker.
-- Read `.agents/review/decisions.md` when present and do not reopen a still-valid decision without new evidence.
 - If an exact-head gate result was supplied, do not rerun the full gate. Use focused probes only. Instrumented probes belong in a disposable worktree; never modify the shared checkout.
 
 Enumerate the surfaces owned by the lens rather than sampling them. Read other files when they prove an in-lens finding, but do not duplicate another lens’s charter.
@@ -24,7 +23,7 @@ Return exactly one decision per finding; do not add a separate severity:
 
 - **block** — demonstrated, in intent, material under the threat model, and serious enough to stop this merge.
 - **defer** — real and actionable, but outside the PR or below the merge bar.
-- **discard** — refuted, speculative, already accepted, or too low-value to schedule. Report only durable discards worth recording.
+- **discard** — refuted, speculative, already accepted, or too low-value to schedule.
 - **ask** — the repository cannot choose between materially different durable product or architecture outcomes, and choosing wrongly would be expensive to reverse.
 
 Do not ask about inferable implementation details, reversible choices, local refactors, naming, or test shape. Prefer the smallest in-scope correction and defer optional machinery.

.agents/skills/standards-sync/references/github.md

@@ -20,3 +20,5 @@ bun standards creds add github --dest ci:ci.broker_app
 ```
 
 The workflow mints two short-lived tokens for the current repository: a branch writer for contents and workflows, and a pull-request opener. Neither token enters the sync process, and there is no fallback credential. A repository with `autoSync: false` does not need these permissions until automatic sync is re-enabled.
+
+Canonical sync branches contain trusted upstream code and may run consumer CI before the generated PR is reviewed.

.github/workflows/standards.yml

@@ -269,6 +269,9 @@ jobs:
             echo "::error::Found a browser a11y suite but no installed playwright binary. Declare @playwright/test in the workspace that owns the suite."
             exit 1
           fi
+          # Playwright downloads its own Chromium. The runner's unused Chrome APT
+          # repository can break dependency installation with inconsistent metadata.
+          sudo rm -f /etc/apt/sources.list.d/google-chrome.list /etc/apt/sources.list.d/google-chrome.sources
           "$playwright" install --with-deps chromium
 
       - name: Check