Build on the GitHub plane again, so the console ships

The caller moved to .hanzo/workflows on 2026-09-15, but the forge mirror
of a hanzoai/* repo runs no workflows, so since then nothing gated, built
or published: kms.hanzo.ai still serves the bundle from before the move.
The one caller is .github/workflows/cicd.yml again, on hanzoai/ci
build.yml@v2 with mode delegate, reading hanzo.yml as before.

.github/workflows/cicd.yml

@@ -0,0 +1,23 @@
+# The one caller. hanzoai/* repos build on the GitHub plane, whose queued jobs the
+# platform serves with one ephemeral runner pod per job; the forge mirror of this
+# repo runs no workflows, so a caller under .hanzo/workflows built nothing. The
+# reusable lives at hanzoai/ci/.github/workflows/build.yml, and all config is in
+# /hanzo.yml: the gate, the kms and kms-fetch images (built at the door in-cluster,
+# mode delegate) and the console site.
+#
+# No pull_request trigger: a run holds the org's site deploy token, so a branch's
+# code does not run here before it is merged.
+name: CI/CD
+on:
+  workflow_dispatch:
+  push:
+    branches: [main]
+    tags: ['v*']
+jobs:
+  cicd:
+    uses: hanzoai/ci/.github/workflows/build.yml@v2
+    with:
+      mode: delegate
+    secrets:
+      KMS_CLIENT_ID: ${{ secrets.KMS_CLIENT_ID }}
+      KMS_CLIENT_SECRET: ${{ secrets.KMS_CLIENT_SECRET }}

.hanzo/workflows/cicd.yml

@@ -1,14 +0,0 @@
-# The whole pipeline is hanzoai/ci's build.yml reading hanzo.yml: the gate, the
-# images and the console site.
-name: CI/CD
-
-on:
-  push:
-    branches: [main]
-    tags: ['v*']
-  workflow_dispatch:
-
-jobs:
-  cicd:
-    uses: hanzoai/ci/.github/workflows/build.yml@v1
-    secrets: inherit

LLM.md

@@ -41,41 +41,22 @@ Non-`dev`/`devnet`/`local` `KMS_ENV` refuses to boot without
 
 ## How this ships
 
-One way, and it runs on our own stack:
+One caller, `.github/workflows/cicd.yml`, which uses
+`hanzoai/ci/.github/workflows/build.yml@v2` with `mode: delegate` and the org's KMS
+client pair. It reads `hanzo.yml`: the gate (`go test ./...`, the console's tests and
+typecheck), the `kms` and `kms-fetch` images (built at the build door in-cluster;
+deploying one is a universe pin), and the console site (`frontend/dist`, Sites slug
+`kms`, main only, served at kms.hanzo.ai by universe `static-sites.yaml`).
 
-    push  ->  github.com/hanzoai/kms          (a mirror)
+GitHub is where it runs. The forge mirror of a hanzoai/* repo runs no workflows, so
-              .github/workflows/sync.yml       carries refs onward
+the caller that sat under `.hanzo/workflows` from 6ba3f6d83c (2026-09-15) built
-      ->  git.hanzo.ai/hanzoai/kms             CANONICAL
+nothing: no gate, no image and no site publish for a month, with no red run to show
-              .hanzo/workflows/ci.yml          go test -race + builds kmsd/kms
+it. Check what is live by the served bundle:
-              .hanzo/workflows/build.yml       ghcr.io/hanzoai/kms on main
-              .hanzo/workflows/release.yml     v* tags: binaries + release + image
-              .hanzo/workflows/build-kms-fetch.yml  ghcr.io/hanzoai/kms-fetch
-              .hanzo/workflows/check-fe-ts-and-lint.yml  frontend typecheck on PRs
-              .hanzo/workflows/pr-preview.yml  ephemeral PR preview env
 
-**git.hanzo.ai is canonical; GitHub is a mirror.** `.github/workflows/` holds
+```sh
-exactly one file, `sync.yml`, and its only job is getting refs to the forge. Every
+B=$(curl -s https://kms.hanzo.ai/ | grep -oE '/assets/index-[A-Za-z0-9_-]+\.js')
-build, check and deploy is a workflow under `.hanzo/workflows/`, which the forge
+curl -s "https://kms.hanzo.ai$B" | grep -c 'hanzo_kms_return'
-reads. `.hanzo/workflows` uses GitHub Actions syntax, so a workflow moves between
+```
-the two by changing directory and nothing else.
-
-`ci.yml`, `release.yml` and `check-fe-ts-and-lint.yml` had been deleted from
-`.github/workflows` with no replacement anywhere — which silently removed the
-repo's only gate and the only producer of the release binaries and semver image
-tags, with no red run to show it, because a workflow that does not exist cannot
-fail. They are restored here at the path the forge reads.
-
-`release.yml` is the heaviest lane: a 4-way binary matrix
-(linux/darwin × amd64/arm64) for `cmd/kms` + `cmd/kmsd`, a GitHub Release with
-12 assets, a multi-arch `ghcr.io/hanzoai/kms:{vX.Y.Z, X.Y.Z, latest}`, and a
-final best-effort `notify-universe` job. That last job is
-`continue-on-error: true`, so a missing `UNIVERSE_DISPATCH_TOKEN` on the forge
-degrades to a yellow job and never fails the release.
-
-`build.yml`, `build-kms-fetch.yml` and `pr-preview.yml` are thin callers of
-`hanzoai/.github/.github/workflows/*@main`. Those references resolve by path, so
-they break the day the reusable workflows themselves move to `.hanzo/workflows` —
-worth inlining then, not now.
 
 ## Console sign-in (`frontend/src/lib/session.ts`)
 

hanzo.yml

@@ -1,4 +1,4 @@
-# Read by hanzoai/ci build.yml@v1 (.hanzo/workflows/cicd.yml) on the forge.
+# Read by hanzoai/ci build.yml@v2 (.github/workflows/cicd.yml).
 
 test:
   - name: go