[bokelley]

Summary

Run the existing full CI, CodeQL, and reference-seller interop workflows automatically for 13.x maintenance pull requests. CI and CodeQL also run on 13.x pushes for merged-head evidence; interop push execution remains delegated to the unchanged release workflow to avoid duplicate runs.

The embedded 13.x-local invariant locks the intended event, branch, and path-filter topology, including the changeset workflow. Existing jobs, permissions, concurrency, and release behavior are preserved.

Exact stack

• ci(13.x): use checked-in registry schema for generated checks #2892 is merged.
• Base: ac2368851ac6a0570dad75147d10e381df476dc0 (13.x)
• Head: e21f0706ccdbe8034e5dccffc2ede3b0ae1764c0
• Tree: f43bef84f515be99c21e0051a1a945a3bd7e9668
• Full sequence: fix(deps): remediate transitive audit advisories #2891 → ci(13.x): use checked-in registry schema for generated checks #2892 (merged) → this P3 → refresh fix(compliance): align required tools selector semantics #2890 onto the resulting 13.x tip

Evidence

• Fresh exact-head review on the merged base: the effective P3 delta is byte-identical to the previously reviewed P3 (range-diff =, patch-id 9bb280…, unchanged tree)
• Full CI, CodeQL, and reference-seller interop self-ran on exact head e21f0706ccdbe8034e5dccffc2ede3b0ae1764c0; all 31 checks passed
• npm ci — passed
• npm audit — 0 vulnerabilities
• Workflow lint — 16/16 passed
• Embedded maintenance invariant — passed
• Existing interop workflow test — 1/1 passed
• Workflow-only changeset simulation — passed
• Two offline registry generations — schema and type hashes unchanged
• Detached normal generated-check sequence — passed with no tracked diff
• Repository format, commitlint, and diff checks — passed
• release.yml — unchanged

Release and protection boundary

release.yml is byte-identical to the 13.x base. This PR adds no secrets or write permissions and does not broaden release triggers. Standalone interop push is intentionally absent because the release workflow already calls reusable interop on 13.x pushes.

The new trigger behavior is proven on exact head e21f0706ccdbe8034e5dccffc2ede3b0ae1764c0: full CI, both CodeQL lanes, and all interop lanes self-ran and passed, while these workflows did not fire on #2891 or #2892. Checks remain advisory because 13.x is currently unprotected. Ruleset/settings changes remain a separate human-admin action, followed by refreshing #2890. No auto-merge was requested.

[aao-secretariat]

Ladon verdict: Approve

Approve — workflow-only PR enabling CI, CodeQL, and reference-seller interop on the 13.x maintenance branch.

Checked:

• No Critical/High/Medium findings from the reviewer.
• Only .github/workflows/*.yml files changed (dev tooling); no src/lib/**, bin/**, or build-affecting scripts/** touched, so no changeset required.
• Embedded ci.yml invariant matches actual event/branch/path topology across all five workflows; require('yaml') resolves (direct dep, YAML 1.2 parser avoids the boolean-on trap).
• release.yml untouched; no new secrets or permissions.

Gates: gated_paths false, high_risk false, no no-auto-approve team match, no prior decision. No decision-table trigger fires (rows 1–8), so this falls through to row 9 = approve.

[aao-secretariat]

Ladon verdict: Approve

Approve — workflows-only PR extends CI/CodeQL/interop-python/changeset-check/release coverage to the 13.x maintenance branch.

What I checked:

• All 4 changed files are .github/workflows/*.yml — no src/lib/**, bin/**, or package.json changes, so witness-not-translator, official-transport-client, and changeset-vs-wire-impact rules do not apply.
• No changeset required (workflows-only, correctly covered by the changeset-check exemption regex).
• The self-testing "Verify stable maintenance workflow coverage" step's assertions match the actual on:/branches blocks across all five workflows.
• yaml is a direct dependency resolvable after npm ci.

No critical/high/medium findings. gated_paths is false, review_decision is APPROVED, high_risk is false, no no-auto-approve team match. No rows 1–8 fire → row 9 approve. Prior decision was also a clean approve.