[danielhanchen]

Problem

Two Unsloth guards have been red on master since the b11436 sync (2026-10-06):

• Unsloth: lint pr-set.json (27 of 40 runs failed, 17 of 19 pushes): check_workflow_triggers.py stops on release-publish.yml: RESTRICTED trigger 'workflow_run' has no '# lint:workflow_triggers-allow-workflow_run' comment.
• Unsloth: upstream sync guard (33 of 33 failed): the same trigger check fails its last step on every PR, and on master the "fork still owns only CI" step reports AGENTS.md, CLAUDE.md and CODEOWNERS as divergence.

Both come from the sync, not from fork work:

• Upstream CI came in with it. release-publish.yml, models-check.yml and the seven ci-self-hosted-*.yml are upstream workflows added between 09-21 and 10-04. The fork owns no upstream CI (the policy sync_deletes.py enforces), but these were not deleted.
  • release-publish.yml fires on workflow_run of a workflow named Release, which master does not have, so it can never run. It only fails the lint.
  • The repo has no self-hosted runners. The 8 self-hosted workflows sat queued until GitHub cancelled them: about 400 runs in 48h (42 to 46 of every 45 to 50 cancelled), all noise in the Actions tab and the queue.
• The three metadata files were deleted on purpose (8700cfd, 4f39f57, 43b49fa, 2026-08-27/31). The guard has no way to say so, so it fails on every master push.

Change

• Delete release-publish.yml, models-check.yml and ci-self-hosted-{cpu,cuda,kleidiai,metal,openvino,vulkan,webgpu}.yml from master. sync_deletes.py keeps these deletions on later syncs (modify/delete conflicts on upstream workflows resolve to the deletion).
• upstream-sync.json: new removed_ok list (AGENTS.md, CLAUDE.md, CODEOWNERS), documented in _doc.
• unsloth-upstream-sync-guard.yml: a path in removed_ok is waived only while its compare status is removed. If one of them comes back with fork edits it fails like any other source divergence. Every other path is checked as before.

No Unsloth workflow, prebuilt job or pr-set.json check depends on the deleted files. The unsloth-* workflows reference only each other (workflow_run on Unsloth prebuilt (full release) and Unsloth pin preflight).

Tests

• check_workflow_triggers.py: exits 1 on master's tree with the release-publish.yml error above, and exits 0 with this change (14 workflow(s): no pull_request_target, no unjustified workflow_run). check_workflow_scalars.py and check_workflow_outputs.py exit 0.
• The resolver tests the lint runs (test_additive_merge, test_pin_merge, test_merge_checks, test_sync_deletes, test_carry_vintage, test_pin_contract, test_feature_matrix, test_check_workflow_triggers), plus test_verify_upstream_sync: all pass.
• Sync guard filter, run against the live compare/b9a5a00b8...master (103 files):
  • the old filter lists AGENTS.md, CLAUDE.md, CODEOWNERS;
  • the new one lists nothing;
  • with an injected CODEOWNERS modified entry and a src/x.cpp removed entry, the new filter reports both, so only the listed deletions are waived.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-14T09:48:39.299033Z	037c9a6	PR opened
🔒 Security Review	✅ Completed 2026-10-14T09:50:31.389491Z	037c9a6	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.