Compact maintenance docs and run CI only for changed risks

.downstream/README.md

@@ -1,23 +1,22 @@
 # Downstream release channel
 
-`upstream-base` is the exact official stable tag merged into this fork. The
-hourly `Upstream Stable Sync` workflow follows only non-draft,
-non-prerelease GitHub Releases from `Wei-Shaw/sub2api`.
+`upstream-base` records the exact integrated official stable tag. The hourly
+`Upstream Stable Sync` follows non-draft, non-prerelease Releases from
+`Wei-Shaw/sub2api`; current source contracts are in [DOWNSTREAM.md](../DOWNSTREAM.md).
 
-An upstream candidate is eligible for checked auto-merge only when the
-machine-readable risk report records zero downstream-overlap files, zero
-critical paths, and a conflict-free merge. Every other conflict-free candidate
-is labeled `upstream-review-required`; an authorized maintainer records the
-completed review with `upstream-reviewed`. Text conflicts stop before a branch is pushed and
-create a named issue with the conflicted paths.
+A conflict-free candidate is eligible for checked auto-merge only when its risk
+report has zero downstream-overlap files and zero critical paths. Other
+conflict-free candidates receive `upstream-review-required`; authorized review
+records `upstream-reviewed`. Text conflicts stop before push and create a named
+issue. Historical reviews and machine risk inputs keep their existing paths.
 
-After a safe candidate merges, automation creates the immutable
-`vX.Y.Z-codexrip.1` tag once. The normal Downstream Release workflow builds and
-attests the linux/amd64 OCI image. A successful release dispatches Production
-Deploy with `release_tag` and `confirmation=DEPLOY`; that run waits at the GitHub
-`production` Environment for the configured approval. Authorized delegated maintenance may
-complete that approval; the release workflow does not approve itself.
+After admission, automation creates immutable `vX.Y.Z-codexrip.1` once.
+Downstream Release builds/attests linux/amd64 and dispatches Production Deploy
+with `release_tag` and `confirmation=DEPLOY`. The `production` Environment keeps
+its configured approval; authorized delegated maintenance may complete it,
+and the release workflow does not approve itself. Verification reuses admitted
+results under [the repository rules](../AGENTS.md).
 
-Sub2API does not store a GitHub token. The admin VersionBadge reads only public
-repository metadata and links to the official Release, candidate PR,
-downstream Release, and production workflow run.
+Sub2API stores no GitHub token. VersionBadge reads public metadata and links the
+official Release, candidate PR, downstream Release and production run. Release
+or merge success alone does not establish production completion.

.downstream/upstream-review-ranxi-v2.10.3.md

@@ -1,43 +1,13 @@
 # ranxi v2.10.3 scoped review
 
-Reference: `fd1b5ee4eeb20961fbb783fa6f136a1704271e90`, released tag v2.10.3.
-Official Wei-Shaw v0.2.15 is already integrated; do not merge it again.
+Historical reference: `fd1b5ee4eeb20961fbb783fa6f136a1704271e90`, released tag v2.10.3, reviewed over official Wei-Shaw v0.2.15. Borrowing is retired; current boundaries are in [DOWNSTREAM](../DOWNSTREAM.md) and [retired borrowing](native-domains.md#retired-gateway-borrowing).
 
-| Upstream change | Disposition |
-| --- | --- |
-| Borrow fingerprint, candidate, STATE probe and automatic preparation core | No change from v2.10.2; correct downstream deviations against the non-rotation branch. |
-| Official v0.2.15 protocol compatibility, provider catalog and model directory | Reuse integrated code. `model_protocol_catalog.go` and the single-manifest preservation in `openai_codex_models_pinned.go` are already present. |
-| Pelican showcase notice (#356) | Apply its factual interpretation to the downstream workbench: visual works are observations, not model identity or intelligence scores. |
-| Excel/BPS OAuth, dynamic tools and model discovery | Excluded. |
-| Worker/TOTP, 2FA, tickets, notifications, automatic group takeover, exit rotation | Excluded. |
-| Unreleased production branch | Excluded; not the update baseline. |
+The review reused integrated official protocol/catalog code and the Pelican interpretation that visual works are observations, not identity or intelligence scores. Excel/BPS, worker/TOTP, account takeover, exit rotation and unreleased branches were excluded.
 
 ## Host adaptations retained
 
-- Parameterize target model for Sol, with qualification isolated from Astra.
-- Use the host credential/identity builders and currently bound account proxy.
-- Keep request-body model context so strict borrowing also applies to large business requests.
-- Shared flights, per-waiter cancellation and revision cancellation replace the original global try-lock.
-- Serialize complete two-shot probes by account within the existing execution capacity.
-- Bounded save preparation continues after individual target failure and checks actual expiry at completion.
-- Observation context prevents health, scheduling, quota and billing writes, while allowing normal credential refresh.
-- Retain strict dispatch proofs, continuation isolation, diagnostic budget and raw administrator evidence.
+The historical implementation isolated Sol qualification from Astra, used bound account credentials/proxy, serialized account probes within existing capacity, and kept cancellation, expiry checks and observation isolation. These borrowing adapters are no longer active contracts.
 
 ## Removed deviations
 
-- Ignoring business STATE in the v12 cache identity.
-- Extra cache keys and business-tier injection into the fixed target probe.
-- Target rejection forcing a fresh source candidate and retry in the non-rotation path.
-- Separate source/target HTTP manager configuration copies and custom TLS policy.
-- Displacing a live active source with a backup or failing refresh despite a
-  still-valid primary/backup. Original active-source preference is retained.
-- Stopping target probes at an early terminal instead of reading their bounded
-  body to EOF and applying the original completion/event-delimiter validator.
-  Ordinary business/Pelican streaming retains its own completion behavior.
-- Accepting a source session cookie without expiry, or a non-SSE source response.
-- Scope-filtering target route replacement and waiting for its body before rejection.
-  The target probe now uses the original header-time route check and first usable
-  `__cflb` rule; only sources enforce the original Secure/domain/path/expiry filter.
-
-Source alignment and offline regression do not prove successful live borrowing.
-Production and live acceptance are recorded separately in the deployment evidence.
+The review restored reference STATE/cache identity, source preference, expiry/cookie validation, bounded target completion and header-time route checks. Offline alignment did not prove live borrowing; production and live results belonged to separate delivery evidence.

.downstream/upstream-review-ranxi-v2.10.5.md

@@ -1,50 +1,15 @@
 # ranxi v2.10.5 borrowing review
 
-Reference: `d977e7a5e24e5536db6ce8b8478743e0c4b11f77`, released v2.10.5.
-Official Wei-Shaw v0.2.15 remains the downstream base. This is a scoped update,
-not a merge of ranxi's database, BPS, scheduling, or exit-management features.
+Historical reference: `d977e7a5e24e5536db6ce8b8478743e0c4b11f77`, released v2.10.5, reviewed over official Wei-Shaw v0.2.15. Borrowing and its reference/probe tooling are retired; current behavior is in [DOWNSTREAM](../DOWNSTREAM.md) and [retired borrowing](native-domains.md#retired-gateway-borrowing).
 
 ## Protocol evidence
 
-`.github/scripts/generate_ranxi_borrow_reference.py` extracts original functions
-from the pinned Git object, prefixes test-only identifiers, and records source
-and generated hashes in `ranxi-borrow-reference.json`. It does not translate the
-reference algorithm. `--check` verifies provenance offline when that Git object
-is available. The generated Go file is test-only and needs no network in CI.
-
-The differential test covers the original source payload, two-shot target
-requests and verdicts, cookie scope/deletion/expiry, and business STATE echo.
-Host-dependent preparation, fingerprint and cache policies have source hashes
-and retain the previously reviewed account coordination and observation adapters.
-These hashes are a review boundary, not a claim that those whole subsystems were
-executed as a second reference service.
-
-The source/pool/probe core is unchanged from v2.10.3. Sol remains an independent
-downstream extension; an Astra result never qualifies Sol.
+The historical differential reference pinned source/generated hashes and covered two-shot requests, verdicts, cookie rules and STATE echo. Host-adapter hashes bounded the review; they did not prove a second live service or successful model calls. Astra qualification did not qualify Sol.
 
 ## Changes
 
-- Restore original native HTTP business STATE echo behavior: unknown or expired local
-  provenance is preserved; a live record identifying a different account still
-  strips it. Target two-shot qualification and WS provenance are unchanged.
-- Observe connect/TLS/write/header phases. Retry an observation once only when
-  transport trace proves failure before any HTTP request headers were written.
-  No trace, any response, cancellation, exhausted diagnostic budget, or written
-  headers forbids replay. Every connection attempt counts against the budget.
-- Port account-test SSE keepalive from #350, preserving the host parser's error
-  wording, observation cancellation and already committed successful terminals.
-  Body-close cancellation after completion must not erase a completed test.
-  A heartbeat is not model output.
-- Extend the existing administrator diagnostic with an explicitly selected,
-  bounded native replay for comparable fixture/tool sessions. Ordinary source
-  controls are limited to saved source accounts. No credentials, routing cookies,
-  destination override or previous-response anchor can be supplied by replay.
-
-The production account-proxy selection and live model results are deployment
-evidence, not protocol unit-test results. No recurring ranxi update is installed.
+The scoped update restored native STATE echo, allowed one observation retry only before any request headers were written, and retained completed terminals during SSE keepalive cancellation. Bounded replay accepted no caller credentials, routing cookies, destination override or response anchor. Production proxy selection and live results were separate evidence.
 
 ## Excluded release changes
 
-BPS credentials/Redis/tool routing, optional timezone rewriting, subscription
-renewal, Grok video, automatic grouping and Mihomo rotation are outside this fix.
-The existing WS switch and official upstream synchronization remain unchanged.
+BPS/Redis/tool routing, timezone rewriting, subscription renewal, Grok video, automatic grouping and Mihomo rotation were excluded. No recurring ranxi update was installed.