chore(ci): delete both workflow graveyards and the rule that mandates one (A0.8)

[0xDEnYO]

Which Linear task belongs to this PR?

Ref EXSC-874 — deliberately Ref, not Fixes: this is the housekeeping half of WP-0.5 and the four defects D2/D3/D4/D11 are still open, so the ticket must not auto-close on merge. A0.7 / A0.8 under EXSC-686 (Signing 2.0, WP-0.5 housekeeping). Ruled by Daniel 2026-08-31.

Why did I implement it this way?

.github/workflows_deactivated/ held ten parked workflow files. Nothing in the codebase
referenced the directory, none of the ten had been re-enabled, and one of them is actively dangerous
to re-enable: protectAuditFolder.yml restricts audit/** to the auditors GitHub team, and that
team has zero members — turning it back on would deadlock the folder.
.github/workflows/disabled/unreviewedPRReminder.yml was a second, undocumented graveyard nobody
had recorded.

Deleting the files alone would not have worked. .agents/rules/500-github-actions.md:90 said:

Deactivated workflows: Move to .github/workflows_deactivated/ instead of deleting

so the convention would have recreated the directory the next time a workflow was retired. The rule
is amended in the same PR, which is the whole point of doing it as one change rather than two.

Git history is the archive. A parked copy is strictly worse than a deletion: it never gets
re-enabled, it drifts out of date against the actions and secrets it references, and it reads to a
newcomer like live policy.

Evidence

$ git ls-tree -r HEAD --name-only -- .github/workflows_deactivated | wc -l
0
$ git ls-tree -r HEAD --name-only -- .github/workflows/disabled | wc -l
0
$ git grep -n "workflows_deactivated\|workflows/disabled" -- .
$ echo $?
1

Rule diff:

-- **Deactivated workflows**: Move to `.github/workflows_deactivated/` instead of deleting
+- **Retiring a workflow**: delete it. Git history is the archive — a parked copy under a sibling directory is never re-enabled, drifts out of date, and hides live-looking policy that no longer runs

bunx markdownlint-cli2 .agents/rules/500-github-actions.md — 0 errors.

Note for the reviewer: this touches .github/, so it needs InfoSec-Manager approval. No active
workflow is modified — every deleted file was already outside .github/workflows/ and therefore
never dispatched by GitHub.

Checklist before requesting a review

• I have performed a self-review of my code
• This pull request is as small as possible and only tackles one problem
• I have added tests that cover the functionality / test the bug — n/a, deletion only
• For new facets: I have checked all points from this list: https://www.notion.so/lifi/New-Facet-Contract-Checklist-157f0ff14ac78095a2b8f999d655622e
• I have updated any required documentation

Checklist for reviewer (DO NOT DEPLOY and contracts BEFORE CHECKING THIS!!!)

• I have checked that any arbitrary calls to external contracts are validated and or restricted
• I have checked that any privileged calls (i.e. storage modifications) are validated and or restricted
• I have ensured that any new contracts have had AT A MINIMUM 1 preliminary audit conducted on by <company/auditor>

🤖 Generated with Claude Code

[coderabbitai]

Warning

Review limit reached

Next included review available in 27 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used all 2 included reviews currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Team

Run ID: 2458bddf-93b7-47ef-8095-2003dfbcc4c9

📥 Commits

Reviewing files that changed from the base of the PR and between 0e3fac1 and 3c6a15b.

📒 Files selected for processing (12)

• .agents/rules/500-github-actions.md
• .github/workflows/disabled/unreviewedPRReminder.yml
• .github/workflows_deactivated/enforceTestCoverage.yml
• .github/workflows_deactivated/ensureDeployProcessIntegrity.yml
• .github/workflows_deactivated/ensureSCCoreDevApproval.yml
• .github/workflows_deactivated/hexagateTestWorkflow.yml
• .github/workflows_deactivated/protectAuditFolder.yml
• .github/workflows_deactivated/protectAuditorsGroup.yml
• .github/workflows_deactivated/slither.yaml
• .github/workflows_deactivated/types.oldVersion.yml
• .github/workflows_deactivated/verifyAudit.yml
• .github/workflows_deactivated/versionCheck.yml

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[0xDEnYO]

Gate review — clean, with the required-checks question answered explicitly

The combined review-gate agent for this PR died on an API error before reporting, so I verified its highest-risk item myself: could deleting these files remove a required status check and wedge every PR?

No. Two independent lines of evidence.

1. Zero name overlap. The job ids inside the 11 deleted files are check, enforce-min-test-coverage, protect-security-system, core-dev-approval, test_job / hexagate-test-workflow, protect-audit-folder, protect-auditors-group, analyze, generate-tag, verify-audit, check-version. The main protection ruleset (20990859) requires: audit-verification, check-new-network-health, protect-critical-code, protect_audit_labels, smoke-test-required, solc-floor-build-required, ts-tests-required, unit-tests-required, validate-json, validate-scripts-required, version-control. Intersection is empty. The near-misses are all distinct checks provided by live workflows: verify-audit ≠ audit-verification, protect-audit-folder ≠ protect_audit_labels, check-version ≠ version-control.

2. This PR's own check run produces 9 of the 11 required checks, and the two absent ones are absent by trigger design, not by deletion — both live workflows are untouched on this branch:

• protect_audit_labels ← .github/workflows/protectAuditLabels.yml, which triggers on pull_request types [labeled, unlabeled, synchronize, review_requested, ready_for_review] — not opened. It fires on flip-to-ready.
• protect-critical-code ← .github/workflows/protectSecurityRelevantCode.yml, which triggers only on pull_request_review: submitted and is gated if: draft == false. By design it cannot report until a human submits a review.

That is a property of the repo's gate design and applies to every PR here, so a reviewer should not read either absence as a regression from this change.

A detail that strengthens the deletion. The deleted ensureDeployProcessIntegrity.yml carries job protect-security-system — a stale twin of the live protectSecurityRelevantCode.yml job protect-critical-code, which is one of the required checks. So the graveyard was holding an out-of-date duplicate of an active protection, which is exactly the failure mode the amended rule now names: a parked copy "hides live-looking policy that no longer runs".

Also confirmed: no real duplicate of .agents/rules/500-github-actions.md exists outside the symlink convention, and no other rule, doc or template still instructs moving workflows to a deactivated folder (git grep for both graveyard paths → zero hits).

[0xDEnYO]

@coderabbitai review

The automatic review on this PR was rate-limited ("Review limit reached", 2 included reviews exhausted) and the CodeRabbit check still reported pass — so this PR currently has no review of any kind. Requesting one now that the window has reset.

[coderabbitai]

Your plan includes PR reviews subject to rate limits. Reviews are available now.