[AnthonyRonning]

Adds the $change-maple-ci skill so a new agent learns Maple's CI in one read before changing, triggering or debugging it. It also brings the existing docs and skills in line with the CI as it works today, after #1315, #1337, #1339, #1341 and #1342.

The skill (.agents/skills/change-maple-ci/)

• Hard rules, each with its reason:
  • every PR's ci-ok stays well under 10 minutes;
  • master stays deployable;
  • checks are added only as lanes in lanes.py, with a test;
  • no [skip ci];
  • PRs never save caches, and master runs are never cancelled;
  • release and signing workflows and their contracts are off limits;
  • fat LTO stays;
  • OpenSecret is treated as reproducible TEE infrastructure;
  • no new process.
• How CI works: plan, then the lanes, then ci-ok, plus a table of what a typical PR runs, and what runs on a PR, a master push, nightly and on dispatch.
• How to trigger things: what each ci:* label adds, re-run semantics (labels are read when plan runs), the dispatch traps, and how to get Agent Dev and other master-only builds.
• How to change CI: lanes, runners and outage overrides, caches, timeouts, hook wiring, and what each guard test protects.
• How to validate locally and debug a red or slow run, with exact commands and known failure signatures.
• Release topics: only a short pointer section. Releases, signing and publication stay in $release-maple.
• Depth lives in references/: design.md (why it's built this way), changing-ci.md and debugging.md.

Tested on a fresh agent. It read only the skill and answered 18 practical questions, such as "how do I get the Windows installer smoke on my PR?" and "the runner lost communication, what now?". 16 answers were right first time and 2 partly right. The gaps it found are fixed, and every claim was audited against the code.

Docs fixed: AGENTS.md (routes CI work to the skill), docs/ci.md, docs/repository-workflows.md, the Agent docs, the Research Dev desktop doc, proxy/README.md, the OpenSecret EIF docs, and the develop-maple, develop-maple-agent, validate-* and review-opensecret-security skills. The fixes cover stale statements from before the recent CI changes, and duplicated CI text that now points to the skill.

Safe to merge:

• Docs and skills only, so plan.py explain selects no lane.
• Merging starts no signed build or deploy. READMEs that are build inputs were left untouched.
• One caveat for the release owner: four of these docs sit outside the release preflight's reuse list, so merging between a Research version bump and its release would make the preflight ask for fresh evidence.

Left for a follow-up code PR: a few stale comments inside ci.yml, lanes.py, codeql.yml, agent-desktop-build.yml, flake.nix and setup-hooks.sh.

Validation passes: plan.py lint, the scripts/ci suite (514 tests, including the docs-reference contract C7), the root flake checks, and a link check over every changed Markdown file.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}