row 163: retire busbar-release from busbar — docs and comments name ModernCI, not the hop/turnstile/EC2 fleet

.github/actionlint.yaml

@@ -1,12 +1,7 @@
-# actionlint's runner-label check works off a built-in list of GitHub-HOSTED labels. `busbar-xl` is
-# ours — the label the EC2 runner fleet (busbar-release-autoscaler) gives every agent — so without
-# this file actionlint reports every `runs-on: [self-hosted, linux, x64, busbar-xl]` in the repo as
-# an unknown label, and a lint that cries wolf on 32 correct lines is a lint nobody reads.
-#
 # `latchkey-small|medium|large|xlarge` are Latchkey's runner-size labels (latchkey.dev), used by
 # `runs-on:` lines of the Latchkey-hosted jobs. Without declaring them here actionlint reports each one as an unknown
-# label — 37 findings measured on this migration (LK-4) — for the same reason `busbar-xl` needed
-# declaring: they are real, fleet-issued (Latchkey-issued) labels, not typos.
+# label — 37 findings measured on this migration (LK-4): they are real, fleet-issued
+# (Latchkey-issued) labels, not typos. (`busbar-xl`, the EC2 fleet's label, left with that fleet.)
 #
 # Declaring it here is not a way of silencing the check; it is the check working as designed. The
 # list below is the ONLY custom labels the fleets issue, so a typo (`busbar-x1`, `latchkey-xlage`, a
@@ -16,7 +11,6 @@
 # is read only by a contributor who runs actionlint by hand.
 self-hosted-runner:
   labels:
-    - busbar-xl
     - latchkey-small
     - latchkey-medium
     - latchkey-large

Dockerfile

@@ -1,6 +1,6 @@
 # busbar container image: FROM scratch, because the binary is the whole product.
-# Static musl binaries are built by the release engine's container build (busbar-release) and copied
-# in per-arch; CA roots are compiled into the binary (webpki-roots), so no /etc/ssl
+# Static musl binaries are built by the release build of the `dev` -> `qa` move (ModernCI, .ci/dev.yaml)
+# and copied in per-arch; CA roots are compiled into the binary (webpki-roots), so no /etc/ssl
 # is needed. The vetted provider catalog ships inside the image as the default.
 #
 # /lib/lib{c.musl-*,gcc_s,stdc++}.* are ALSO in this image, and are NOT busbar's own runtime deps —

conformance/README.md

@@ -10,9 +10,8 @@ The conformance-claim manifest home (`CONFORMANCE-SYNC-DESIGN.md` §3.1).
 - `manifest.json` — NOT YET GENERATED. Written only by
   `cargo xtask conformance-manifest --write` (§3.2), which is NOT YET BUILT.
   Until that xtask subcommand and its `xtask conformance check --suite <id>`
-  companion land, the busbar-release `conformance::conformance_checks`
-  `CommandCheck`s that shell to `cargo xtask conformance check --suite <id>`
-  will fail closed (non-zero exit / could-not-spawn) — the correct deny-safe
+  companion land, the checks that run `cargo xtask conformance check`
+  (ModernCI's `conformance` check in `.ci/predev.yaml`) will fail closed (non-zero exit / could-not-spawn) — the correct deny-safe
   default for an unimplemented check, not a silent pass.
 
 ## What still needs building (tracked, not done here)
@@ -34,8 +33,8 @@ The conformance-claim manifest home (`CONFORMANCE-SYNC-DESIGN.md` §3.1).
    (`CONFORMANCE-GATES-PLAN.md` §5).
 
 See `CONFORMANCE-GATES-PLAN.md`, `CONFORMANCE-SYNC-DESIGN.md`, and
-`CONFORMANCE-MATRIX-RULING.md` for the full grounding. The turnstile/train
-gate wiring that CONSUMES this manifest is landed in the `busbar-release`
-repo (`crates/busbar-release-turnstile/src/conformance.rs`,
-`crates/busbar-release-turnstile/src/auto_apply.rs`,
-`crates/busbar-release-train/src/conformance.rs`).
+`CONFORMANCE-MATRIX-RULING.md` for the full grounding. What CONSUMES this
+manifest is ModernCI's `conformance` check on the `predev` → `dev` move
+(`.ci/predev.yaml`: `cargo xtask conformance record --all`, then
+`cargo xtask conformance check --musts`). The busbar-release turnstile and
+train that consumed it before are deleted.

deny.toml

@@ -1,5 +1,5 @@
-# cargo-deny policy for busbar. Run locally with `cargo deny check`; in CI the predev hop
-# (busbar-release) runs it as a build-test row. This file mechanically enforces the
+# cargo-deny policy for busbar. Run locally with `cargo deny check`; in CI ModernCI runs it on every
+# move into predev (the `deny` check of .ci/default.yaml). This file mechanically enforces the
 # supply-chain discipline that Cargo.toml already applies by hand (single TLS/HTTP
 # stack, no unmaintained/unsafe deps, license hygiene) so a future PR cannot
 # silently regress it.

docs/ci/gate-integrity.md

@@ -36,18 +36,18 @@ be promoted.
 
 ## What the pipeline holds mechanically
 
-Pull requests into `predev` are judged by ModernCI (required check `ci`). The promotion up the
-branch ladder runs `.github/workflows/promote.yml`, where the pinned release engine in busbar-release
-plans the hop from the PR's base branch.
+ModernCI judges every move up the branch ladder from this repository's branch files and posts one
+check, `ci` (OWNER 2026-10-12, "ModernCI only"; `docs/design/BUSBAR-1.6.0.md` Part 6). The
+busbar-release hop (`promote.yml`) is deleted.
 
-| check | what it is | required on |
+| move | branch file | what it runs |
 | --- | --- | --- |
-| `preflight` | formatting, `Cargo.lock` current, the generated C header current, on a free runner | dev (promote.yml) |
-| `hop` | the engine admits the candidate: EVERY registered `cargo xtask gate`, plus the oracle and conformance where the rung asks, then the fast-forward of the base | dev (promote.yml) |
+| a lane into `predev` | `.ci/default.yaml` | preflight (formatting, `Cargo.lock` current, the generated C header current), EVERY registered `cargo xtask gate`, clippy, compile, test, doctest, deletion matrix, `cargo deny`; no worse than predev |
+| `predev` into `dev` | `.ci/predev.yaml` | the gates, the oracle against the 1.5.5 golden, conformance, the done-oracle, the Q128 audit |
 
-`ship-ready` is a registered gate like the rest: it runs on every hop, with `XTASK_SHIP_TARGET` set to
-the hop's base branch, so it is strict for `qa` and `main` and carries the dev line's standing reds
-for `predev` and `dev`.
+`ship-ready` is a registered gate like the rest: it runs on every move, with `XTASK_SHIP_TARGET` set
+to the move's target branch, so it is strict for `qa` and `main` and carries the dev line's standing
+reds for `predev` and `dev`.
 
 ### Which executable scenario runs on the dev push
 
@@ -115,9 +115,8 @@ green-with-the-list-printed on the dev line and red for `qa`/`main` while anythi
 
 ## The landing runner
 
-Promotion is `promote.yml`'s hop (busbar-release `ci/promote/`): a pull request into `qa` or `main`
-is admitted by the engine or not at all, and the hop has no override flag. A lane lands on
-`predev` when ModernCI's `ci` check is green; CI is the proof.
+Every move is ModernCI's: a lane lands on `predev`, and a branch is promoted, only when ModernCI's
+`ci` check is green on the move's branch file, and there is no override flag. CI is the proof.
 
 ## The sentence this all exists for
 

docs/proof/README.md

@@ -2,9 +2,9 @@
 
 The Build Proof Dashboard manifest is collated by `cargo xtask proof-manifest`. The `proof-manifest`
 job that ran it (in the removed `ci.yml`, on a push to `dev`, `qa` or `main`) is deleted with the rest of busbar's
-workflows: `promote.yml` does not publish a manifest, so nothing refreshes the published copies until
-the collator is wired into the release engine in busbar-release. The last published manifests are on
-the `proof-manifests` branch.
+workflows, and `promote.yml` (the busbar-release hop) is deleted too: nothing refreshes the published
+copies until a ModernCI branch file runs the collator on a landing (`on.landed`). The last published
+manifests are on the `proof-manifests` branch.
 
 Usage:
 

docs/security/openssf-best-practices.md

@@ -74,7 +74,7 @@ The badge criteria are grouped as the bestpractices.dev form groups them. Answer
 | `crypto_published` + `crypto_call` + `crypto_floss` | Met | No home-grown crypto; standard vetted crates. Constant-time secret comparison (`crates/api/src/auth.rs`), SHA-256 digests. |
 | `crypto_keylength` + `crypto_working` + `crypto_weaknesses` | Met | SHA-256, ed25519 plugin signing key, TLS/mTLS. See posture doc §2.6, §2.3. |
 | `crypto_pfs` + `crypto_password_storage` + `crypto_random` | Met | TLS; secrets stored via `Redacted<T>` / `SecretRef` (posture doc §2.2), never plaintext at rest by design. |
-| `delivery_mitm` — signed/hash-verified delivery | Unmet | The release build, SBOM, build-provenance attestation and cosign signing lived in the deleted release workflows; the release engine in busbar-release does not build or publish yet (`promote.yml` fails a hop that plans a build). Verify recipes for past releases: <https://getbusbar.com/security/>. |
+| `delivery_mitm` — signed/hash-verified delivery | Unmet | The release build, SBOM, build-provenance attestation and cosign signing lived in the deleted release workflows; nothing builds or publishes until ModernCI's `qa` → `main` branch file (`.ci/qa.yaml`) signs and publishes the judged build on landing (`docs/design/BUSBAR-1.6.0.md` Part 6). Verify recipes for past releases: <https://getbusbar.com/security/>. |
 | `delivery_unsigned` — no unsigned critical delivery | Unmet | Nothing is published until the engine ports the builds; see `RELEASE.md`. |
 | `vulnerabilities_fixed_60_days` | Met | `SECURITY.md` backport policy: fix on `dev` first, severity-driven backport window. |
 | `vulnerabilities_critical_fixed` | Met | Critical/High cherry-picked to the latest two minor lines with a GitHub Security Advisory + CVE (`SECURITY.md`). |

scripts/mcp-conformance.sh

@@ -100,7 +100,7 @@ die() { printf 'FAIL: %s\n' "$*" >&2; exit 1; }
 
 # THE SUITE'S NODE. @modelcontextprotocol/conformance imports fs.globSync, which exists from Node 22;
 # on Node 20 the suite dies at import, enumerates zero scenarios, and every row it owes reads as a
-# failure. promote.yml runs Node 22, so this script provisions the same major itself rather than
+# failure. The suite needs Node 22, so this script provisions the same major itself rather than
 # relying on whatever the runner image ships: a pinned release from nodejs.org, checked against a
 # sha256 this file commits, unpacked under target/ and put first on PATH. A runner that already has
 # Node >= 22 is left alone. The hash is checked BEFORE the archive is unpacked, and a mismatch, a

xtask/src/conformance_check/mod.rs

@@ -1,8 +1,9 @@
 //! `cargo xtask conformance check` — the TURNSTILE-FACING per-suite conformance admission command.
 //!
-//! This is the one command the release pipeline's `busbar-release-turnstile` shells to as a
-//! `CommandCheck` (`CONFORMANCE-GATES-PLAN.md` §1.3: turnstile drives everything as local
-//! subprocesses over a busbar checkout, never GitHub check-runs). It answers exactly one question
+//! This is the one command the pipeline shells to: ModernCI's `conformance` check on the
+//! `predev` -> `dev` move (`.ci/predev.yaml`) runs it over a busbar checkout, as a local subprocess,
+//! never a GitHub check-run (`CONFORMANCE-GATES-PLAN.md` §1.3; the busbar-release turnstile that ran
+//! it before is deleted). It answers exactly one question
 //! per invocation — "is this suite a fresh green, right now, on this commit" — and answers it
 //! deny-safe: every error path (missing manifest, unparseable manifest, unregistered suite id,
 //! missing/absent verdict commit, a non-pass status, a stale pass) is a REFUSAL, never a silent 0.

xtask/src/gates/design_bindings/verify.rs

@@ -256,11 +256,10 @@ pub fn ci_invoked_refs(root: &Path) -> Result<BTreeSet<String>, String> {
     let gate_call = Regex::new(r"cargo[ \t]+xtask[ \t]+gate[ \t]+([a-z0-9][a-z0-9-]*)")?;
     let mut gate_modules: BTreeSet<String> = BTreeSet::new();
 
-    // THE PIPELINE'S TURNSTILE RUNS EVERY REGISTERED GATE. It discovers them with `cargo xtask gate
-    // --list` (busbar-release's `discover_gates`) and runs each by name on every hop, so no
-    // workflow in this tree names them one by one any more. The registry IS that list, so a gate
-    // module is invoked exactly when it is registered; a module that is not registered is run by
-    // nothing and is still refused.
+    // THE PIPELINE RUNS EVERY REGISTERED GATE. ModernCI's `gates` check runs `cargo xtask gate
+    // --all` on every move (`.ci/*.yaml`), so no workflow in this tree names them one by one. The
+    // registry IS that list, so a gate module is invoked exactly when it is registered; a module
+    // that is not registered is run by nothing and is still refused.
     for name in crate::gates::names() {
         gate_modules.insert(xtask_gate_module(name, root));
     }
@@ -403,7 +402,7 @@ pub fn check_verdict(c: &J, ctx: &Ctx) -> (bool, String) {
                     format!(
                         "{k}:{r} (exists on disk, but nothing under .github/workflows invokes it, \
                          directly or through a script one runs, and it is no registered \
-                         gate the turnstile runs -- a gate nobody runs compares nothing)"
+                         gate the pipeline runs -- a gate nobody runs compares nothing)"
                     ),
                 );
             }

xtask/src/gates/mod.rs

@@ -3356,7 +3356,7 @@ pub static REGISTRY: &[Registration] = &[
     },
     // THE ONE-MEMORY-ABI GATES (M0 ABI-SPEC; the design's locked plugin ABI). REPORT-ONLY: each is
     // armed at today's count as a drain-only ledger qa/<name>.toml whose rows are the M2 work
-    // list, and the pipeline's turnstile runs them like every registered gate.
+    // list, and the pipeline (ModernCI's `gates` check) runs them like every registered gate.
     Registration {
         name: "one-memory-abi",
         batch: 1,

xtask/tests/hot_path_gates.rs

@@ -2,7 +2,7 @@
 //!
 //! `docs/design/BUSBAR-1.6.0.md` Part 3 §8 owes a perf gate and an alloc gate; §11b counts
 //! their criterion benches toward the core-engine tests/benches 8→9 rise. Both are registered, so
-//! the pipeline's turnstile runs them by name on every hop; this file is the second route, driving
+//! the pipeline runs them on every move (`cargo xtask gate --all`); this file is the second route, driving
 //! each through the dispatcher under `cargo test --workspace --locked`.
 //!
 //! Driven through `cli::main` directly, like `xtask/tests/cli.rs`: exit 0 is green, and a gate that