ci: acceptance.yml gates every PR into master; master only through an accepted PR

Captain Bob, 2026-11-06: what a developer runs, what CI runs and what
the nightly runs are one process, and "failures should not be allowed
to be merged to master".

acceptance.yml runs on every PR into master (opened, pushed to,
reopened): .claude/CLAUDE.md's acceptance protocol through the same
scripts/nightly.sh stages -- amd64, aarch64, riscv64 to [zuse@Hera]
ok>, the PC stick loaded high (and the three agree on dict_hash), then
make -C v4 test-32 -- one QEMU at a time, in one job. Its logs and DoE
CSVs are kept, pass or fail. master's branch protection requires it.

acceptance, nightly and release share the concurrency group qemu, so
the runner never runs two of them at once: CLAUDE.md's one-QEMU rule
holds in CI too. build.yml becomes the quick check on pushes only.

.claude/CLAUDE.md's Hard Rules: commit and push directly on the working
branch; master only through a PR that passed acceptance, no direct
pushes; no approval required while there is one developer. Named: the
Captain Bob method.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GE3SDvQn5EoxdGufk84zz2

.claude/CLAUDE.md

@@ -51,7 +51,8 @@ This file provides guidance to Claude Code (claude.ai/code) when working with co
 - **NEVER CREATE A BRANCH WITHOUT EXPLICIT PERMISSION FROM THE USER.** Work on the branch you are given or already on. Do not create feature branches, session branches, or any other branch unless the user explicitly asks. This applies every time, not just once per session — re-confirm before creating a branch even if one was created earlier in the same conversation.
 - **NEVER STASH WITHOUT EXPLICIT PERMISSION.** `git stash` hides work and creates debt. If the working tree is dirty, report it and wait for instructions. Do not stash to work around a problem.
 - **NEVER APPLY A FIX NOT EXPLICITLY REQUESTED.** If you identify a bug, report it. Do not fix it unless the user says to. Initiative on code changes causes damage.
-- **USE A SUBVERSION-LIKE WORKFLOW.** Commit and push directly to the working branch (including `master` — this repo works directly on `master`; see below). No detours, no side branches, no pull requests unless explicitly requested.
+- **USE A SUBVERSION-LIKE WORKFLOW ON THE WORKING BRANCH.** Commit and push directly to the working branch you were given (now `StarForth-v4.0.0`). No detours, no side branches.
+- **`master` IS REACHED ONLY THROUGH A PULL REQUEST THAT PASSED ACCEPTANCE** (Captain Bob, 2026-11-06: "failures should not be allowed to be merged to master"). Never push to `master` — its branch protection refuses it, admins included. A PR into `master` runs `.gitea/workflows/acceptance.yml` automatically: the acceptance protocol below, through the same `scripts/nightly.sh` stages a developer runs by hand. The merge button stays disabled until it passes. No approval is required while there is one developer; add one when there is a second.
 - **AFTER ANY OUT-OF-BRANCH WORK** (switching branches, resetting, fetching, etc.) always return to the correct working branch and do a full `git fetch` + `git pull` to ensure the working tree is clean and current before continuing.
 - **ALWAYS START CLEAN.** Before doing any work, verify `git status` is clean and the branch is the correct one. No surprises.
 - **ANNOUNCE THE BRANCH** at the start of every session resumption. First line of output after context load: state the current branch and last commit.
@@ -63,7 +64,13 @@ monorepo, diverging from a `master` that carried StarForth's hosted-VM productio
 That monorepo has been split into two separate repositories. **In this repo, `master` is now
 the sole LithosAnanke production line — there is no `lithosananke` branch here, and none is
 needed.** Don't look for one, and don't recreate the old two-branch framing when reasoning
-about "which line am I on."
+about "which line am I on." Work happens on the working branch and reaches `master` by an
+accepted PR (Hard Rules, above). The StarForth repository's history is the tag
+`archive/starforth-2026-09-17`; that repository is deleted.
+
+This is the **Captain Bob method** -- neither agile nor waterfall (Captain Bob, 2026-11-06). Its
+gate is the acceptance protocol: what a developer runs by hand, what a PR into `master` runs, and
+what the nightly runs are one and the same.
 
 ---
 

.gitea/workflows/acceptance.yml

@@ -0,0 +1,60 @@
+# The acceptance protocol, as the gate on every pull request into master (Captain Bob, 2026-11-06:
+# "failures should not be allowed to be merged to master"). It is .claude/CLAUDE.md's protocol,
+# run by the same stages a developer and the nightly run (scripts/nightly.sh), in its order, one
+# QEMU at a time:
+#
+#   amd64, aarch64, riscv64   to [zuse@Hera] ok>, POST: PASSED, `3 4 + .` -> 7 ok
+#   the PC stick loaded high  the same; and the three architectures' dict_hash agree
+#   the 32-bit build          make -C v4 test-32, 0 failures
+#
+# master's branch protection requires this check to pass before a PR merges. The serial logs and
+# DoE CSVs are kept as the run's artifacts, pass or fail.
+name: Acceptance
+
+on:
+  pull_request:
+    branches: [master]
+    types: [opened, synchronize, reopened]
+  workflow_dispatch:
+
+concurrency:
+  group: qemu                     # one QEMU at a time on the runner: shared with nightly.yml and release.yml
+  cancel-in-progress: false
+
+jobs:
+  acceptance:
+    name: Acceptance
+    runs-on: ubuntu-latest
+    container:
+      image: gitea/runner-images:ubuntu-24.04-v26.11.03   # the runner's own ubuntu-latest is Debian 11 (node:20-bullseye)
+    timeout-minutes: 120
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0          # the SBOM's version is git describe
+          lfs: false              # only the logs and DoE CSVs are in LFS; the build needs neither
+
+      - name: Install the build's dependencies
+        run: make ARCH=amd64,aarch64,riscv64 init INIT_DOCS=0
+
+      - name: Acceptance amd64
+        run: scripts/nightly.sh accept amd64
+      - name: Acceptance aarch64
+        run: scripts/nightly.sh accept aarch64
+      - name: Acceptance riscv64
+        run: scripts/nightly.sh accept riscv64
+      - name: Acceptance PC stick loaded high
+        run: scripts/nightly.sh accept stick-high
+      - name: Acceptance 32-bit build
+        run: scripts/nightly.sh test-32
+
+      - name: Keep the logs and DoE CSVs
+        if: always()
+        uses: actions/upload-artifact@v3
+        with:
+          name: acceptance-logs-${{ github.run_number }}
+          path: |
+            logs/
+            experiments/bare_metal/runs/
+            build/nightly/accept-*.txt
+            build/nightly/test-32.txt

.gitea/workflows/build.yml

@@ -1,4 +1,5 @@
-# The check on every push and pull request: each board's image builds, and the v4 tests pass.
+# The quick check on every push: each board's image builds, and the v4 tests pass. A pull
+# request into master is gated by acceptance.yml, the full acceptance protocol.
 # Nothing is published here. The nightlies own the rest: nightly.yml (the QEMU acceptance boots,
 # the 32-bit build, the Isabelle/HOL proofs, the images to Nexus) and nightly-docs.yml (the
 # documents to Nexus).
@@ -7,8 +8,6 @@ name: Build
 on:
   push:
     branches: [master, StarForth-v4.0.0]
-  pull_request:
-    branches: [master]
   workflow_dispatch:
 
 jobs:

.gitea/workflows/nightly.yml

@@ -16,6 +16,10 @@ on:
     - cron: '0 3 * * *'        # 03:00 UTC; the documents are at 04:00 (nightly-docs.yml)
   workflow_dispatch:
 
+concurrency:
+  group: qemu                     # one QEMU at a time on the runner: shared with acceptance.yml
+  cancel-in-progress: false
+
 jobs:
   nightly:
     name: Acceptance, proofs, images

.gitea/workflows/release.yml

@@ -13,6 +13,10 @@ on:
   push:
     tags: ['v*']
 
+concurrency:
+  group: qemu                     # one QEMU at a time on the runner: shared with acceptance.yml
+  cancel-in-progress: false
+
 jobs:
   release:
     name: Release ${{ github.ref_name }}