docs(skills): fix three reviewer-flagged errors — source-verified

All three issues found by code review, fixed against actual workflow files:

1. docs/ci.md: remove all references to retired weekly-testing-promotion.yml,
   wrong Sunday 06:00 UTC schedule, daily 13:00 UTC schedule (no such trigger),
   and nightly :testing model. Replace with current execute-release.yml flow
   and correct Tuesday 04:00 UTC promotion cadence.

2. execute-release.yml commit message gate was wrong in both ci.md skill and
   workflow-map.md — said 'ci: promote testing images to stable' but actual
   regex is '^ci\(promote\): dakota testing|^chore: promote testing to main'
   (verified from execute-release.yml:31-33).

3. workflow-map.md Pipeline Map said 'nightly' for promote-testing-to-main.yml
   schedule — corrected to 'weekly Tuesday 04:00 UTC' (matches actual cron
   '0 4 * * 2' and release-promotion.md).

Assisted-by: Claude Sonnet 4.6 via GitHub Copilot

Author: castrojo

docs/ci.md

@@ -28,34 +28,30 @@ build.yml (main|testing|next) → [workflow_run] → publish.yml
 
 `promote` depends only on `publish-image`, not on SBOM — saves 10–15 min on the critical path.
 
-After every successful publish, `execute-release.yml` auto-fires and creates a GitHub Release.
+**`execute-release.yml`** fires on `push: main` and `workflow_dispatch`. A `check-trigger` job reads the commit message — proceeds only when it matches `^ci\(promote\): dakota testing` or `^chore: promote testing to main`. `workflow_dispatch` bypasses the gate. On success: copies `:testing` → `:stable`/`:latest`, then generates a GitHub Release with SBOM diff.
 
-After every successful publish, `release.yml` auto-fires (via `workflow_run`) and creates a GitHub Release with a card image, SBOM diff, and package changelog.
+**Critical ordering:** `publish.yml` pulls the OCI artifact from CAS. The artifact is only in CAS if `build.yml` ran first for that SHA. Always dispatch `build.yml --ref testing` (or let push trigger it) before manually dispatching `publish.yml`.
 
-**Critical ordering:** `publish.yml` pulls the OCI artifact from CAS. The artifact
-is only in CAS if `build.yml` ran on `main` first. If `build.yml` has only run on
-feature branches, CAS will not have the artifact for main's SHA and publish will
-fail with `"No artifacts to stage"`. Always dispatch `build.yml --ref main` before
-manually dispatching `publish.yml`.
+## Stable promotion (execute-release.yml)
 
-## Weekly promotion (weekly-testing-promotion.yml)
-
-Runs **Sunday 06:00 UTC**. Promotes `:testing` → `:latest` + `:stable` via digest-pinned re-tagging, then fast-forwards the `latest` and `stable` git branches to the promoted source SHA.
+Triggered by a push to `main` whose commit message matches the promotion pattern. The normal path is:
 
 ```
-resolve → check-diff → promote → update-branches
+push to testing (BST-affecting)
+  → build.yml → publish.yml → :testing
+  → promote-testing-to-main.yml → auto/promote-testing-to-main PR
+       → pr-release-gate.yml (cosign verify)
+       → auto-merge → push to main (commit: "ci(promote): dakota testing ...")
+           → execute-release.yml (check-trigger passes)
+               → :testing copied to :stable / :latest
+               → GitHub Release created
 ```
 
-| Job | What |
-|---|---|
-| `resolve` | Pins `:testing` digest, verifies default + NVIDIA share same source SHA |
-| `check-diff` | Skips if `:testing` == `:latest` (nothing new to promote) |
-| `promote` | Re-tags both variants as `:latest` + `:stable` (requires `production` environment approval) |
-| `update-branches` | Fast-forwards `latest` and `stable` branches to promoted source SHA |
+Schedule: `promote-testing-to-main.yml` runs `cron: '0 4 * * 2'` (Tuesday 04:00 UTC). That is the only automated promotion cadence.
 
 ## Schedule
 
-**13:00 UTC** daily — runs after GBM nightly (~08:00 UTC finish).
+No daily build schedule. Builds fire on push, merge_group, or workflow_dispatch only.
 
 ## Remote cache
 
@@ -66,11 +62,8 @@ resolve → check-diff → promote → update-branches
 `ghcr.io/projectbluefin/dakota:{testing,latest,stable}` and `ghcr.io/projectbluefin/dakota:<sha>`
 
 Streams:
-- `:testing` — nightly build, promoted after e2e passes
-- `:latest` — weekly promotion from testing (Tuesday 06:00 UTC)
-- `:stable` — weekly promotion from testing (same cadence as latest)
-
-Build triggers: `merge_group`, `schedule`, `workflow_dispatch` — **not** `pull_request`.
+- `:testing` — published on every BST-affecting push to `testing` or `main` branch
+- `:latest` / `:stable` — promoted from `:testing` via `execute-release.yml` after promotion PR merges to main (Tuesday 04:00 UTC scheduled path, or manual dispatch)
 
 Never bypass the merge queue with `--admin`.
 
@@ -79,19 +72,16 @@ Never bypass the merge queue with `--admin`.
 To manually cut a `:stable` and `:latest` release:
 
 ```bash
-# 1. Ensure :testing exists and is healthy
-gh run list --repo projectbluefin/dakota --workflow "Publish Bluefin dakota" --limit 5
+# 1. Ensure :testing exists and promotion PR is open
+gh pr list --repo projectbluefin/dakota --search 'head:auto/promote-testing-to-main state:open'
 
-# 2. Dispatch the weekly promotion workflow
-gh workflow run weekly-testing-promotion.yml \
-  --repo projectbluefin/dakota
+# 2. If the promotion PR gate has passed, dispatch execute-release directly
+gh workflow run execute-release.yml --repo projectbluefin/dakota --ref main
 
-# 3. Approve the deployment at the production environment gate
-# Approval URL: https://github.com/projectbluefin/dakota/deployments
+# OR: dispatch promote-testing-to-main to open/update the promotion PR
+gh workflow run promote-testing-to-main.yml --repo projectbluefin/dakota
 ```
 
-The `promote` job requires approval via the `production` GitHub Environment before it runs. The number of required approvals is configured in the environment settings.
-
 ## Restarting the factory (publish pipeline has been idle)
 
 When the publish pipeline has been paused intentionally (e.g., post-refactor),

docs/skills/ci.md

@@ -98,7 +98,7 @@ The rationalizations that have caused real production failures:
 | `publish.yml` | `workflow_run` from `build.yml` (branches: main, next, testing, + their gh-readonly-queue/* paths) | Export from CAS → push `:$sha` → sign/attest → promote to `:testing`/`:next`. No build happens here. |
 | `promote-testing-to-main.yml` | `push: testing`, `schedule: Tue 04:00 UTC`, `workflow_dispatch` | Opens/updates promotion PR from testing into main. |
 | `pr-release-gate.yml` | `pull_request` to `main` | Gates the promotion PR via cosign verify of `:testing`. |
-| `execute-release.yml` | `push: main`, `workflow_dispatch` | Reads commit message — proceeds only when it starts with `ci: promote testing images to stable`. Copies tags to `:latest`/`:stable`, creates GitHub Release. |
+| `execute-release.yml` | `push: main`, `workflow_dispatch` | `check-trigger` job gates on commit message matching `^ci\(promote\): dakota testing` or `^chore: promote testing to main`. `workflow_dispatch` bypasses the gate. Copies `:testing` → `:stable`/`:latest`, creates GitHub Release. |
 | `cache-warm.yml` | `schedule: Mon/Thu 06:00 UTC`, `workflow_dispatch` | Pre-warms remote CAS. Two parallel jobs (x86_64, aarch64), `continue-on-error: true`. **Not exempt from pre-flight — cancel before any real build.** |
 
 ## Trigger Behavior

docs/skills/workflow-map.md

@@ -58,7 +58,7 @@ Successful publish.yml
   └─ publish-smoke.yml
        └─ smoke suite [observational only]
 
-push: testing / nightly / manual
+push: testing / weekly Tuesday 04:00 UTC / manual
   └─ promote-testing-to-main.yml
        └─ opens or updates promotion PR
             └─ pr-release-gate.yml on that PR
@@ -78,7 +78,7 @@ merge promotion PR to main
 | `.github/workflows/e2e.yml` | PR-facing testsuite check | `pull_request` |
 | `.github/workflows/promote-testing-to-main.yml` | open/update promotion PR | `push: testing`, schedule, manual |
 | `.github/workflows/pr-release-gate.yml` | promotion PR gate | `pull_request` to `main` |
-| `.github/workflows/execute-release.yml` | stable release execution | `push: main`, manual |
+| `.github/workflows/execute-release.yml` | stable release execution | `push: main`, `workflow_dispatch`. `check-trigger` job gates on commit message matching `^ci\(promote\): dakota testing` or `^chore: promote testing to main`; `workflow_dispatch` bypasses the gate. |
 | `.github/workflows/sync-next-from-main.yml` | merge main into next (preserve junction refs) | `push: main`, `workflow_dispatch` |
 
 ## Branch / Tag Map