docs: weekly releases, develop line and merge on green

[andersalm]

Anders approved the weekly release policy on 30 September and resumed this PR, including its rebase and merge, on 2 October. Task branches use develop as their standing base and target. Weekly candidates go through the agreed scope, human journey and release review before main or a tag changes.

AGENTS.md now directs agents to follow CI and installed journeys they start through completion in the same turn. Routine issue notes and check-ins link the PR, CI run and review. Exact identity and dirty-state checks before deletion remain, as do installed-binary and release receipts. Task security reviews use a current different-model-family adversarial PASS; Irzhy reviews merged security task PRs, while weekly release PRs retain their human approval gate.

The canonical branching skill and Cursor pointer agree with the process. The existing CI entropy gate refuses removal or weakening of the new process and retained safety clauses. The current CI workflow is preserved byte-for-byte during the approved rebase.

Validation: all four basic gates and nine actual policy mutation refusals pass. Current CI and current independent reviews will be linked before merge. The existing Irzhy request is preserved.

Refs #93. Main, tags, real signing, release publication and installed-system decisions remain with Anders.

[andersalm]

Independent adversarial review (Claude Opus via elastos-pr-review, 2026-10-02), head fb3b30b.
VERDICT: FAIL

Blocking findings:

• AGENTS.md:266-271: The approved policy and the contract give different reviewers when Irzhy writes a security task PR. The PR description says "When Irzhy is the author, Anders reviews." The diff applies that fallback only to weekly release PRs. Security task PRs now merge into develop after agent reviews alone. The only human security check comes after the merge, and Irzhy does it. So when Irzhy writes a gateway, auth, signing or install.sh change, no second person reviews it. At the weekly release PR, he would then approve his own code. The diff also removes two protections: "required human reviews must approve the candidate" (old merge permission) and the pre-merge irzhywau requirement. Fix: add "When he is the author of a security task PR, Anders does the follow-up review" or the agreed equivalent.

Non-blocking notes:

1. The PR description does not match the diff. It says "at most two rounds", but AGENTS.md:272 says one round. It also says Irzhy reviews this PR "because it changes the CI workflow", but the diff touches no workflow. The develop push trigger is already in ci.yml:12.
2. AGENTS.md:332-336 and the Weekly Releases section ask for CI screenshots at desktop and phone width. Those screenshots exist only after CI: prove installed journeys on GitHub machines #150 is done, and this PR finishes none of CI: prove installed journeys on GitHub machines #150's Done means. The rule cannot be met yet. Say "once CI: prove installed journeys on GitHub machines #150 lands".
3. Docs and the website still point to upstream/RELEASE-dev and upstream/0.7.1-dev: docs/MAC.md:30-35, website/elastos/index.html:23,57,121,126, site.js:11, claims.json:6. This conflicts with the new "only source" branch rule.

Not checked: I did not run node scripts/home-entropy-check.mjs. I compared each new needle with AGENTS.md by hand, and all of them match after whitespace normalization. I could not see the branch protection settings for develop, the develop rename, or whether upstream/0.7.1-dev still exists.

[andersalm]

The security-author fallback is repaired in the current change: Anders conducts the follow-up when Irzhy authors a security task PR. The existing entropy gate now refuses removal of that rule. All four basic gates pass.
The current PR description reflects Anders’s 2 October merge rule, one development round and the byte-identical CI workflow after rebase. Weekly release PRs retain human approval before merge/tag; explicit task acceptance gates remain issue-owned.
Current-base source checks are preparation. Wider installed screenshots and old branch references remain under #93’s unfinished acceptance; this PR leaves main, tags and publication with Anders. A new exact-candidate Opus verdict is being obtained.

[andersalm]

Independent development review (gpt-6.1-sol high, fork_turns none), same round: PASS for the current candidate.
The reviewed process matches Anders’s approved cadence, same-turn CI ownership and linked routine reports. It preserves exact deletion/lifecycle checks, installed-binary/release receipts, independent development PASS, different-family current-candidate security review and human release/operator authority. Anders takes the follow-up when Irzhy authors security work.
All four basic gates pass. The existing entropy checker rejects 13 policy-weakening mutations, including the repaired full review clauses and the human-author fallback. CI is byte-identical to develop. The separate current Opus verdict and CI result remain merge gates.

[andersalm]

Independent adversarial review (Claude Opus via elastos-pr-review, 2026-10-02), head c173cf5.
VERDICT: PASS

Blocking findings: none. This PR changes only process docs and scripts/home-entropy-check.mjs. It touches no Runtime, gateway, signing or sandbox code, so it does not change how the installed product runs or isolate anything less. The old policy text is gone from the whole tree: no matches remain for upstream/XX-dev, feat/0.7.1-models, "Signing runs outside CI" or "stable source line". The new entropy assertions at scripts/home-entropy-check.mjs:1856-1876 match the new AGENTS.md wording. Each one fails if its clause is deleted, so removing a clause is refused. ci.yml:10-14 already runs on pushes to develop and on all PRs, so "merge on green" into develop really is gated by CI.

Non-blocking notes:

1. Security PRs, including workflow and install.sh changes, now merge into develop with only an AI adversarial PASS. Irzhy's review moves to after the merge (AGENTS.md "Agents merge their own task PRs…"). A workflow merged this way can grant itself contents: write on pushes to develop. This trade-off is deliberate and Anders approved it. It is still worth confirming that branch and tag protection on main enforce the human gate on the release PR.
2. The Weekly Releases section names 0.7.N, 0.8.0 and "UP-01 to UP-03 are merged". That ties a standing instruction to the current release and to a task status. This conflicts with AGENTS.md's own "independent of the current release" rule and with "GitHub issues own status".
3. SKILL.md says AGENTS.md is "the only source", while AGENTS.md calls SKILL.md the "Canonical workflow", so each points to the other. SKILL.md also hardcodes origin/develop, but AGENTS.md refers to the remote as elacity/.

Not checked: I had only read tools, so I did not run home-entropy-check.mjs or the nine mutation refusals. I also did not check the result of the linked CI run, whether a develop branch exists remotely, or the GitHub branch protection rules on main and tags.