diff --git a/.github/scripts/close-landed-copilot-prs.sh b/.github/scripts/close-landed-copilot-prs.sh
deleted file mode 100644
index 945b63fd..00000000
--- a/.github/scripts/close-landed-copilot-prs.sh
+++ /dev/null
@@ -1,40 +0,0 @@
-#!/usr/bin/env bash
-# Close open Copilot cloud agent PRs whose change landed by hand on $BRANCH.
-# A commit lands PR N when its message says "from Copilot cloud agent PR #N" or "The change is Copilot cloud
-# agent PR #N" (the coordinator's two conventions; use the first in new commits).
-# Env: REPO (owner/name), BRANCH, SCAN_DEPTH (commits to scan, default 60), GH_TOKEN.
-# DRY_RUN=1 prints what would happen and changes nothing.
-set -euo pipefail
-
-: "${REPO:?}" "${BRANCH:?}"
-depth="${SCAN_DEPTH:-60}"
-dry="${DRY_RUN:-0}"
-seen=" "
-
-run() {
-  if [ "$dry" = 1 ]; then echo "DRY: $*"; else "$@" >/dev/null; fi
-}
-
-for sha in $(git rev-list -n "$depth" HEAD); do
-  nums=$(git log -1 --format=%B "$sha" | grep -oiE '(from|change is) Copilot cloud agent PR #[0-9]+' | grep -oE '[0-9]+$' | sort -un || true)
-  for n in $nums; do
-    case "$seen" in *" $n "*) continue ;; esac
-    seen="$seen$n "
-    info=$(gh api "repos/$REPO/pulls/$n" --jq '[.state, .user.login, .head.ref, .head.repo.full_name] | @tsv' 2>/dev/null || true)
-    [ -n "$info" ] || { echo "PR #$n: not readable, skipped"; continue; }
-    IFS=$'\t' read -r state login head headrepo <<<"$info"
-    if [ "$state" != open ]; then echo "PR #$n: already $state"; continue; fi
-    if [ "$login" != Copilot ] || [ "$headrepo" != "$REPO" ]; then
-      echo "PR #$n: author $login from $headrepo, not a Copilot PR of this repo, left open"; continue
-    fi
-    short=$(git rev-parse --short "$sha")
-    echo "PR #$n: landed as $short on $BRANCH, closing"
-    run gh api -X POST "repos/$REPO/issues/$n/comments" \
-      -f body="Landed on $BRANCH as $short (applied by hand from this PR, so GitHub does not show it as merged). Closed automatically."
-    run gh api -X PATCH "repos/$REPO/pulls/$n" -f state=closed
-    case "$head" in
-      copilot/*) run gh api -X DELETE "repos/$REPO/git/refs/heads/$head" || echo "PR #$n: branch $head not deleted" ;;
-      *) echo "PR #$n: head $head is not a copilot/* branch, kept" ;;
-    esac
-  done
-done
diff --git a/.github/workflows/close-landed-copilot-prs.yml b/.github/workflows/close-landed-copilot-prs.yml
deleted file mode 100644
index 9c26f7a4..00000000
--- a/.github/workflows/close-landed-copilot-prs.yml
+++ /dev/null
@@ -1,36 +0,0 @@
-name: Close landed Copilot PRs
-
-# Copilot cloud agent PRs are landed by hand (diff-apply plus a commit whose message says
-# "Copilot cloud agent PR #N"), so GitHub never marks them merged. After each push to
-# main this closes every still-open Copilot PR that a recent commit names, with a
-# comment pointing at the commit, and deletes its copilot/* branch. Scanning the last
-# SCAN_DEPTH commits (not only the pushed range) makes the first run close the backlog too;
-# closing is idempotent.
-
-on:
-  push:
-    branches: [main]
-
-permissions:
-  contents: write       # delete the copilot/* head branch
-  pull-requests: write  # comment and close
-
-concurrency:
-  group: close-landed-copilot-prs
-  cancel-in-progress: false
-
-jobs:
-  close:
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
-        with:
-          fetch-depth: 80
-      - name: Close Copilot PRs whose change landed
-        env:
-          GH_TOKEN: ${{ github.token }}
-          REPO: ${{ github.repository }}
-          BRANCH: ${{ github.ref_name }}
-          SCAN_DEPTH: "60"
-        run: bash .github/scripts/close-landed-copilot-prs.sh
diff --git a/AGENTS.md b/AGENTS.md
index fbb9917d..3e809d4c 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -29,7 +29,7 @@ Ask the human and wait for a clear yes before you:
 
 Allowed without asking:
 
-- local branches; commits on a non-`main` branch; pushing that branch to `origin`. `ci.yml` and `live-acceptance.yml` in `.github/workflows` trigger only on pushes to `main`, pull requests, or a manual dispatch, so a feature-branch push runs no tests; the third workflow, `close-landed-copilot-prs.yml`, runs only on pushes to `main` and closes Copilot PRs whose change landed there;
+- local branches; commits on a non-`main` branch; pushing that branch to `origin`. `ci.yml` and `codeql.yml` in `.github/workflows` trigger only on pushes to `main` and pull requests (CodeQL also runs weekly), and `live-acceptance.yml` only by manual dispatch, so a feature-branch push runs no tests;
 - building, running tests, and running live evaluation/acceptance against already-running 8766/8767 services;
 - scratch fixtures, configs, data directories, and reports under `test-results/` or outside the repository.