Review & approve: CI Workflows & Runs-as-Data plan

[dimashev]

@yairfalse — requesting review/approval of the CI Workflows & Runs-as-Data plan.

📋 Board (every item marked Approval: Proposed, nothing started): https://github.com/orgs/false-systems/projects/4

Goal

1. Proper CI/CD per repo — beyond today's single sykli gate: security audit + dependabot, container publish, releases, scheduled health.
2. Runs as data — every GitHub Actions run becomes a FALSE Occurrence and flows through the product pipeline (Polku → Vartio → Ahti), so our own CI is the integration-test corpus for the whole stack.

The loop

GHA run → ci.run.v1 occurrence (sykli in-run / workflow_run collector)
  → Polku ingest → correlate/aggregate → AhtiEmitter
  → Ahti append (false-ci namespace)
  → Vartio reads → operational chains / drift → decisions → back to Ahti
  → ci-loop integration suite asserts on real captured runs

Proposed items (13 on the board)

GitHub Actions workflows

1. Shared reusable workflows in false-systems/.github
2. dependabot config (all repos)
3. Security audit workflows (cargo audit/cargo deny; mix hex.audit)
4. Harden existing sykli CI + extend vartio gate
5. Container publish → GHCR (ahti, polku)
6. Release workflows (v* tags)
7. Nightly / scheduled + pipeline soak
8. emit-ci-occurrence.yml + workflow_run collector

Supporting pipeline (fed by the workflows)
8. ci.run.v1 occurrence schema (Ahti false-ci namespace)
10. GhaIngestor + Polku→Ahti pipeline example
11. Vartio CI chains + decisions
12. ci-loop integration suite (golden fixtures + soak)

13. Open decisions ↓

Open decisions (need your call)

1. Namespace: dedicated false-ci vs reuse vartio (lean false-ci)
2. Corpus storage: workflow artifacts vs a versioned false-ci-corpus data repo (lean repo)
3. Live Ahti in CI: ephemeral #103 container vs hosted (lean ephemeral now)
4. Vartio CI engine: align to sykli vs keep the script + only add the emit hook (lean keep)
5. Reusable vs duplicated workflows (lean reusable in false-systems/.github)

Ask

Approve all / a subset / request changes (comment here or on the board items). I'll set each item's Approval → Approved/Rejected per your call and implement only the approved ones — nothing is started.