[grandizzy]

Removes the pr-audit workflow, which is no longer needed.

[claude]

Nothing blocking. The comments below are optional suggestions. There is no need to push a fix for them before merging.

Apart from the inline finding, I checked whether the removed audit status was a required check. It isn't: docs/development/README.md:147 lists only Required / Core and Required / Local E2E for branch protection, so removing the workflow won't leave PRs waiting on a missing status. The workflow is also not pinned in e2e/harness/workflows-contract.test.ts.

Extended reasoning...

The change only deletes .github/workflows/pr-audit.yml. I ruled out a broken required check and a broken workflow-contract test, using the branch-protection list in the docs and a repo-wide grep.

Additional findings (outside the current diff — GitHub can't attach inline comments there):

• 🟡 .github/workflows/pr-audit.yml — After merging, maintainers reading the CI docs will still find a Cyclops audit workflow that no longer exists. The docs also still tell them to start it with a cyclops audit comment. AGENTS.md:61 says removing an integration means removing every reference to it. This PR deletes pr-audit.yml but leaves docs/development/README.md untouched. Fix: remove every Cyclops/pr-audit reference from docs/development/README.md#continuous-integration in this change, which covers the 3 sites listed. Same pattern at 3 sites (docs/development/README.md:158, docs/development/README.md:190, docs/development/README.md:199).

  Why this was flagged

  The PR deletes .github/workflows/pr-audit.yml and changes no other file. docs/development/README.md:158 still has a pr-audit.yml row in the workflow table, described as "The Cyclops audit". docs/development/README.md:190 still says "the audit and remediation-event jobs receive the EVENTS_* intake credentials". docs/development/README.md:199 still tells maintainers that fork PRs get the "push-triggered Cyclops audit, which a maintainer starts with a cyclops audit comment". After merge, such a comment does nothing, so the canonical CI and trust-model page (.github/AGENTS.md names it the owner) describes a workflow and a secret recipient that are gone. That breaks the rule at AGENTS.md:61 and docs/README.md:48: "Removing an integration removes every reference to it."

  Verification: Severity: nit. The PR deletes only .github/workflows/pr-audit.yml and changes no other file. The docs still describe it: docs/development/README.md:158 keeps the pr-audit.yml table row, and docs/development/README.md:198-199 still says a maintainer starts the audit with a cyclops audit comment. This breaks root AGENTS.md:61: "Removing an integration means removing every reference to it."