ci: establish gate taxonomy and ESC operator

.github/workflows/README.md

@@ -7,6 +7,20 @@ is repository ruleset **19988544** (required status check context exactly
 A deterministic classifier runs only the policy, language, and binding jobs
 relevant to the pull request.
 
+`config/gate-registry.json` is the authoritative inventory for workflow and
+operator gates. It records class, owner, canonical command, evidence contract,
+freshness, and SHA binding. `scripts/ci/gate-registry.py` validates the registry
+in ordinary Repository Policy CI and renders commands for Make or operators.
+Every gate belongs to exactly one of four classes: required PR check, scheduled
+health/stress, operator qualification, or release certification. Supporting
+automation is inventoried with a non-gate role because it produces no gate
+decision. Only `github-status/CI Gate` is a required PR check.
+
+Provider-backed qualifications are Python operator commands entered through
+`pulumi env run`; Pulumi ESC owns secret projection and output filtering.
+GitHub workflow files are compatibility wrappers and evidence viewers, not the
+operational control plane.
+
 **Speed is a first-class value alongside honesty.** Surfaces shed work that is
 not required for their objective. PR CI does **not** run full `llvm-cov`.
 Frequent publishing uses the **publish-track** (Binding RC → tag →
@@ -139,36 +153,36 @@ this project.
 
 ### `g500-certification.yml` — Billion-edge certification
 
-This protected, manual-only workflow checks out an exact commit on a
-maintainer-approved ephemeral Linux scale host. It never provisions or spends.
-It runs the bounded target-live SCALE-26 lifecycle, writes an atomic typed phase
-journal, validates sanitized evidence, and uploads only the evidence JSON and
-journal. Provider, SKU, runner registration, cost approval, and teardown remain
-explicit maintainer decisions; see the
+This manual compatibility wrapper validates and renders the registry-owned
+operator command. It never provisions or spends. Provider, SKU, runner
+registration, cost approval, and teardown remain explicit operator decisions;
+the actual run must use the Python + Pulumi ESC control plane described in the
 [certification runbook](../../docs/development/g500-certification.md).
 
 ### `fly-tiny-qualification.yml` — Disposable Fly environment smoke
 
-This protected manual workflow checks out the exact current `main` commit and
-runs the non-ladder #958 qualification on a Blacksmith Linux runner. It builds
-the commit-pinned image with hosted Docker, pushes it to the disposable app's
-Fly registry path, resolves the immutable digest, runs only the 10 GiB
-`performance-1x` filesystem smoke, and independently verifies teardown. A
-separate recovery job has its own timeout budget after execution, and
-`fly-tiny-recovery.yml` provides receipt-bound manual orphan cleanup. The
-workflow uploads a one-day pre-creation ownership receipt plus sanitized
-plan/result documents and qualified evidence. The receipt binds the commit to
-a fresh 128-bit app-name nonce and never contains provider resource identifiers
-or credentials.
+This manual compatibility wrapper validates and renders the registry-owned
+operator command without credentials or provider execution. Live qualification
+is available only through the Python + Pulumi ESC control plane below.
+
+For new operator runs, use the registry-owned entry point instead of Actions
+dispatch. All controller flags are passed after `ARGS=`; the Python operator
+requires the exact SHA, an explicit live mode, and disposable confirmation
+before it opens the named ESC environment:
+
+```bash
+make -C benchmarks qualification-operator \
+  GATE=fly-tiny-qualification \
+  ESC_ENVIRONMENT=curatelabs/graphforge/qualification \
+  ARGS='--expected-sha <sha> --execute --confirm-disposable <remaining-controller-args>'
+```
 
 ### `fly-tiny-recovery.yml` — Manual Fly orphan recovery
 
-This protected manual janitor downloads the one-day ownership receipt from a
-specified qualification run and refuses deletion unless its exact nonce-bound
-app and commit match. It runs the trusted controller from current `main` and
-shares the qualification concurrency lock, so it cannot race the source run.
-It exists for runner loss, workflow cancellation, or a failed independent
-recovery job; it cannot infer ownership from an app prefix.
+This manual compatibility wrapper only validates and renders the registry-owned
+recovery command. Receipt-bound orphan cleanup must be launched through the
+Python + Pulumi ESC operator; Actions has no provider credential or deletion
+authority.
 
 ### CodeRabbit
 

.github/workflows/clean-env-verify.yml

@@ -47,9 +47,6 @@ jobs:
         with:
           toolchain: "1.96.0"
 
-      - name: Harness unit tests
-        run: python3 scripts/ci/test-clean-env-verify.py
-
       - name: Preflight public registries
         id: preflight
         run: |
@@ -71,10 +68,7 @@ jobs:
           fi
           if [[ "$LANES" == "all" ]]; then
             if [[ -z "$RECORD" ]]; then
-              # checksums requires a release record; run every other lane when absent
-              for lane in pip npm cli skills reopen urls; do
-                args+=(--lane "$lane")
-              done
+              args+=(--default)
             else
               args+=(--all)
             fi

.github/workflows/concurrency-stress-gate.yml

@@ -43,11 +43,6 @@ jobs:
         with:
           python-version: "3.13"
 
-      - name: Validate stress configuration
-        run: |
-          python3 scripts/ci/concurrency-stress-gate.py validate
-          python3 scripts/ci/test-concurrency-stress-gate.py
-
       - name: Build native Python wheel for mixed workload
         run: |
           uvx maturin build \
@@ -60,7 +55,7 @@ jobs:
       - name: Run bounded-resource stress lane
         run: >-
           /tmp/gf-concurrency-stress/bin/python
-          scripts/ci/concurrency-stress-gate.py run
+          scripts/ci/gate-registry.py run concurrency-stress --
           --seed "${GF_STRESS_SEED}"
           --iterations "${GF_STRESS_ITERATIONS}"
           --output "${{ runner.temp }}/concurrency-stress-evidence"

.github/workflows/durability-certification-gate.yml

@@ -43,14 +43,9 @@ jobs:
         with:
           toolchain: "1.96.0"
 
-      - name: Validate certification configuration
-        run: |
-          python3 scripts/ci/durability-certification-gate.py validate
-          python3 scripts/ci/test-durability-certification-gate.py
-
       - name: Run scheduled seeded certification lane
         run: >-
-          python3 scripts/ci/durability-certification-gate.py run
+          python3 scripts/ci/gate-registry.py run durability-certification --
           --seed "${GF_CERT_SEED}"
           --histories "${GF_CERT_HISTORIES}"
           --ops "${GF_CERT_OPS}"