PR admission without atomicity boilerplate

Ordinary mixed-file PRs do not require a Cacophony-Atomicity declaration. CLI declarations with implementation, tests, and docs, or profile sources with generated docs, are ordinary reviewable changes. Path groups remain diagnostic output, not a correctness gate; missing, malformed, or changing PR prose cannot reject source admission. Do not manufacture JSON declarations, empty commits, or meaningless sibling edits to publish a cohesive change.

Content rather than touched-file checks

A path list cannot prove that generated content is current. Schema validation, generated-output comparisons, tests, review, authorization, and protected-branch checks retain their existing owners. A source change that leaves generated output unchanged needs no fake generated-file edit. HTML-only navigation, style, or marker repairs need no Markdown edit. The page validator still checks the current Markdown hash, links, and page structure; stale markers and missing siblings still fail actual content validation. Run docs/validate-pages.sh docs/page.html for scoped page diagnostics, not a ceremonial edit to both files. Source merge is not runtime rollout approval: deployment and activation safety gates remain at deployment.

Exact-generation discovery

Cacophony's portable CI now uses hermetic Nix checks, without membership or changed-surface admission gating. The following classifier contract remains applicable to consumers that explicitly select that integration.

The classifier reads live provider identity before and after changed-file discovery, checking both reads against the exact event head and branch/repository identities. When CI supplies CACO_CI_MATERIALIZED_BASE after trusted selected-ref materialization and lineage verification, that exact base SHA replaces the stale event base SHA for both identity validation and the checked-out diff fallback. When it also supplies CACO_CI_MATERIALIZED_BASE_REF, the live base branch the materializer read together with that SHA replaces the stale event base ref, so a rerun after a stack retarget validates against its current target. The event head SHA, head ref and repositories stay pinned, and both live reads must still match the materialized base exactly. Without materialized-base metadata, the original event base SHA remains mandatory; malformed or empty supplied metadata refuses admission rather than falling back. The classifier never independently follows a moving base branch. A changed head, a base retargeted away from the materialized base ref, a base differing from the verified materialized base, closed PR, foreign repository, or unavailable identity refuses admission. PR body contents are not read as validation evidence, including during reruns whose original event body is stale. The checked-out changed-file fallback remains available only when identity can still be verified. A refusal is not permission to skip required CI or mutate the event to make it match.

CI scheduling ownership

Cacophony runs real main/PR validation without a membership prerequisite and moves Fast Tests to a scheduled/manual lane. Other projects that select a queue keep that engine's exact-generation scheduling and reuse ownership; publication must not add a competing dispatcher or merge actor. A deferred, cancelled, missing, or incomplete result is not passing source evidence. Body edits deliberately do not trigger broad CI, and empty commits or close/reopen rituals are not recovery mechanisms.

Retired cancelled-prerequisite automation

The former preparation/aggregate pipeline and its PR CI re-run recovery workflow are retired. The current Nix producer propagates its actual check failure directly and has no cancelled-preparation aggregate to repair. Historical runs retain their original workflow and evidence; removing that workflow does not authorize replay, cancellation, or fabricated success. Use the configured, bounded owner recovery path for an exact current failure when authorized, preserving head/base identity and genuine source failures.

Old workflow/source limitation

A rerun keeps its original workflow and selected source; landing this fix on main does not retroactively replace an old classifier. Before a bounded owner recovery, verify that selected-ref materialization actually contains the corrected detector. Use the self-owned recovery contract for an exact failed-run repair when needed, not as the ordinary publication path. If the selected source is still old, route its failed receipt to the selected-ref recovery owner; do not inject a detector into an unverified checkout or dispatch without generation admission. No replacement PR, fake source commit, force push, fabricated check success, or branch-protection exception is part of this simplification.