Best possible solution:

Land the hosted debounce only after exact-head CI is acceptable, then keep the documented runner-admission graph and monitor the first main push to confirm the intended cancellation behavior.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this is a maintainer CI workflow change rather than a user bug report. Source inspection and PR CI logs prove the PR path takes the no-op admission branch; the real canonical-main sleep path is only observable on main.

Is this the best way to solve the issue?

Yes, this is a narrow workflow-layer solution: it gates the two root CI jobs that can register Blacksmith work, while downstream jobs already depend on preflight. The safer remaining step is operational proof after merge, not a different code shape.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against d3f7f7d1fc91.

Label changes:

• add P2: This is a normal-priority CI automation improvement with limited product blast radius but meaningful maintainer operational impact.
• add merge-risk: 🚨 automation: The diff changes the main CI workflow graph and intentionally delays canonical main runner admission, which green PR checks cannot fully prove for the real main-push path.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: The contributor proof gate does not apply because this is a repository-member, maintainer-labeled PR; PR CI still shows the non-main admission branch executing successfully.

Label justifications:

• P2: This is a normal-priority CI automation improvement with limited product blast radius but meaningful maintainer operational impact.
• merge-risk: 🚨 automation: The diff changes the main CI workflow graph and intentionally delays canonical main runner admission, which green PR checks cannot fully prove for the real main-push path.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: The contributor proof gate does not apply because this is a repository-member, maintainer-labeled PR; PR CI still shows the non-main admission branch executing successfully.

PR surface:

Tests +16, Docs +13, Config +22. Total +51 across 3 files.

What I checked:

• Protected maintainer PR: Live PR metadata shows author association MEMBER and labels docs, maintainer, and size: XS, so cleanup close is not appropriate under the review policy. (d4b0c7d552fa)
• Admission job and graph gate: The PR head adds runner-admission on ubuntu-24.04, sleeps from a workflow-local 90-second env only for canonical main pushes, and makes both root Blacksmith jobs depend on it. (.github/workflows/ci.yml:44, d4b0c7d552fa)
• Downstream Blacksmith jobs remain behind preflight: A PR-head workflow scan shows all other CI jobs with Blacksmith runner expressions depend on preflight, so gating preflight and security-fast covers the main matrix registration path without adding per-matrix sleeps. (.github/workflows/ci.yml:524, d4b0c7d552fa)
• Docs align with workflow behavior: The docs now describe the 90-second hosted admission window, preserved PR/manual immediacy, and fail-fast order with runner-admission first. Public docs: docs/ci.md. (docs/ci.md:11, d4b0c7d552fa)
• Workflow guard coverage: The added test asserts the hosted runner, canonical-main condition, 90-second env, dependency edges, and existing main/pull-request cancellation expression. (test/scripts/ci-workflow-guards.test.ts:121, d4b0c7d552fa)
• PR-path live CI proof: The latest PR CI run executed runner-admission on the hosted runner and took the non-main no-op branch, then preflight and security-fast completed successfully after that dependency. (.github/workflows/ci.yml:54, d4b0c7d552fa)

Likely related people:

• vincentkoc: Git blame and history show Vincent Koc authored the current CI concurrency/preflight/security-fast structure and recent runner-sizing guard work, and the current PR continues that same CI graph area. (role: recent CI workflow contributor; confidence: high; commits: 536c8a840bda, 7d3bc4d944cd, d4b0c7d552fa; files: .github/workflows/ci.yml, docs/ci.md, test/scripts/ci-workflow-guards.test.ts)

• 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
• 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
• 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
• 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
• 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
• 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
• 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.