The social card asked for Inter first. That is not a face this estate
licenses, ships or ever drew, so a renderer with Inter installed painted
the wrong face and one without it silently fell through to system-ui.
Zen leads now; the same tail follows it.
(cherry picked from commit 900a1763cddeabf938859fce1d3ccd200684996d)
git.hanzo.ai is canonical and GitHub is its mirror, so CI belonged on the forge
and was running on GitHub instead. cicd.yml and spec-sync.yml move to
.hanzo/workflows/ where the rest of the estate keeps them, and hero.svg moves
with them because .github should hold nothing this repo depends on (README
updated, or the banner 404s the moment the directory is gone).
What stays on GitHub is sync-hanzo.yml, and only that. A mirror's one duty is
that anything landing on it reaches canonical rather than diverging quietly —
a push from a laptop on the wrong remote, a merge through the web UI, a bot. It
is not a build, a test or a deploy; a second lane here is how two pipelines come
to disagree about what shipped.
It forwards FAST-FORWARD ONLY. --force-with-lease would not do: that permits a
rewrite so long as the remote sits where we last saw it, and a rewrite is
precisely what canonical must never take from a mirror. A refusal means the two
lines really diverged and wants a human, so the step fails loudly and names the
other cause it will hit today — this repo is still flagged as a pull-mirror on
the forge, and a mirror is read-only, so it cannot receive. That flag is the
thing to clear; the workflow is already correct for after.
spec-sync keeps its hourly --check and still commits nothing, which is why the
82-path staleness it was designed to catch had to be fixed by hand.
zeekay
