feat(ci): workflow on: blocks from a t27 spec; Website checks in five parallel jobs

.github/workflows/brain-ci.yml

@@ -1,13 +1,25 @@
 name: S³AI Brain CI — "Functional MRI" Gate
 
+# Managed by apps/website/scripts/ci-triggers-from-spec.mjs from specs/ci/workflow_triggers.t27.
+# Do not edit this block: edit the spec, then run npm --prefix apps/website run gen:ci-triggers.
 on:
   push:
-    branches: [main, v*, 'feat/*', 'fix/*', 'refactor/*']
+    branches: [main, 'v*', 'feat/*', 'fix/*', 'refactor/*']
+    # No schedule: block. The Queen (Inngest app t27-queen) dispatches this workflow
+    # on '0 0 * * 0' UTC from the card specs/crons/trinity-brain-ci.t27 in gHashTag/t27.
+    # The brain is Zig in src/; a website or docs change cannot move its
+    # health score, and the site carries its own checks.
+    paths-ignore:
+      - 'apps/website/**'
+      - 'docs/**'
+      - '**/*.md'
   pull_request:
-    branches: [main, v*]
+    branches: [main, 'v*']
+    paths-ignore:
+      - 'apps/website/**'
+      - 'docs/**'
+      - '**/*.md'
   workflow_dispatch:
-  # No schedule: block. The Queen (Inngest app t27-queen) dispatches this workflow
-  # on '0 0 * * 0' UTC from the card specs/crons/trinity-brain-ci.t27 in gHashTag/t27.
 
 env:
   BRAIN_HEALTH_THRESHOLD: "80"  # Minimum health score for merge

.github/workflows/ci.yml

@@ -1,10 +1,26 @@
 name: CI
 
+# Managed by apps/website/scripts/ci-triggers-from-spec.mjs from specs/ci/workflow_triggers.t27.
+# Do not edit this block: edit the spec, then run npm --prefix apps/website run gen:ci-triggers.
 on:
   push:
     branches: [main]
+    # A website or docs change ships no binary: the site carries its own
+    # checks (website-checks.yml), and this build would test an unchanged
+    # Zig tree twice for prose.
+    paths-ignore:
+      - 'apps/website/**'
+      - 'docs/**'
+      - '**/*.md'
   pull_request:
     branches: [main]
+    paths-ignore:
+      - 'apps/website/**'
+      - 'docs/**'
+      - '**/*.md'
+  # So this workflow's verdict can be refreshed behind a path filter;
+  # without it, its status is whatever its last accepted run concluded.
+  workflow_dispatch:
 
 jobs:
   test:

.github/workflows/codegen.yml

@@ -1,12 +1,24 @@
 name: Codegen Validation
 
+# Managed by apps/website/scripts/ci-triggers-from-spec.mjs from specs/ci/workflow_triggers.t27.
+# Do not edit this block: edit the spec, then run npm --prefix apps/website run gen:ci-triggers.
 on:
   push:
-    branches: [main, ralph/dev-*, vibee-v5-production]
+    branches: [main, 'ralph/dev-*', vibee-v5-production]
+    # No schedule: block. The Queen (Inngest app t27-queen) dispatches this workflow
+    # on '0 0 * * *' UTC from the card specs/crons/trinity-codegen.t27 in gHashTag/t27.
+    # Codegen consumes specs and the compiler in src/, not prose or the
+    # website; a docs-only merge regenerates byte-identical output.
+    paths-ignore:
+      - 'apps/website/**'
+      - 'docs/**'
+      - '**/*.md'
   pull_request:
     branches: [main]
-  # No schedule: block. The Queen (Inngest app t27-queen) dispatches this workflow
-  # on '0 0 * * *' UTC from the card specs/crons/trinity-codegen.t27 in gHashTag/t27.
+    paths-ignore:
+      - 'apps/website/**'
+      - 'docs/**'
+      - '**/*.md'
   workflow_dispatch:
 
 jobs:

.github/workflows/koschei-production.yml

@@ -4,15 +4,23 @@
 
 name: KOSCHEI Production Deploy
 
+# Managed by apps/website/scripts/ci-triggers-from-spec.mjs from specs/ci/workflow_triggers.t27.
+# Do not edit this block: edit the spec, then run npm --prefix apps/website run gen:ci-triggers.
 on:
   push:
     branches: [main]
+    # A production deploy follows the code and images the swarm is built
+    # from, not prose: a website or docs merge ships nothing to KOSCHEI.
+    paths-ignore:
+      - 'apps/website/**'
+      - 'docs/**'
+      - '**/*.md'
   workflow_dispatch:
     inputs:
       environment:
         description: 'Deployment environment'
         required: true
-        default: 'production'
+        default: production
         type: choice
         options:
           - staging

.github/workflows/reproduce.yml

@@ -9,25 +9,41 @@ name: Reproduce the headless profile
 # is uploaded as the artifact reproduce-headless-<arch>, with the capability index of
 # tools/capabilities.py built on it (capabilities-<arch>.json, and a table in the job summary).
 
+# Managed by apps/website/scripts/ci-triggers-from-spec.mjs from specs/ci/workflow_triggers.t27.
+# Do not edit this block: edit the spec, then run npm --prefix apps/website run gen:ci-triggers.
 on:
-  pull_request:
+  push:
     branches: [main]
+    # The same inputs as the pull_request block: without them, every
+    # merge to main -- a blog post included -- rebuilt the headless profile
+    # from a cold cache to prove nothing new.
     paths:
-      - "build.zig"
-      - "build.zig.zon"
-      - "src/**"
-      - "external/**"
-      - "deploy/**/*.zig"
-      - "tools/reproduce.py"
-      - "tools/capabilities.py"
-      - "tools/contracts.py"
-      - "specs/reproduce/**"
-      - ".github/workflows/reproduce.yml"
-  push:
+      - 'build.zig'
+      - 'build.zig.zon'
+      - 'src/**'
+      - 'external/**'
+      - 'deploy/**/*.zig'
+      - 'tools/reproduce.py'
+      - 'tools/capabilities.py'
+      - 'tools/contracts.py'
+      - 'specs/reproduce/**'
+      - '.github/workflows/reproduce.yml'
+  pull_request:
     branches: [main]
-  schedule:
-    - cron: "23 4 * * 1"
+    paths:
+      - 'build.zig'
+      - 'build.zig.zon'
+      - 'src/**'
+      - 'external/**'
+      - 'deploy/**/*.zig'
+      - 'tools/reproduce.py'
+      - 'tools/capabilities.py'
+      - 'tools/contracts.py'
+      - 'specs/reproduce/**'
+      - '.github/workflows/reproduce.yml'
   workflow_dispatch:
+  schedule:
+    - cron: '23 4 * * 1'
 
 jobs:
   headless: