ci: use hosted checks for public pull requests

.github/workflows/rust-ci.yml

@@ -0,0 +1,109 @@
+name: Rust CI
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: rust-ci-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+env:
+  CARGO_TERM_COLOR: always
+  RUST_BACKTRACE: 1
+
+jobs:
+  quality:
+    name: Format, lint, docs, and metadata
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+    steps:
+      - name: Check out the exact source commit
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          repository: ${{ github.event.pull_request.head.repo.full_name || github.repository }}
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+          persist-credentials: false
+          fetch-depth: 1
+          lfs: false
+          submodules: false
+      - name: Resolve the pinned Rust toolchain
+        run: rustup show active-toolchain
+      - name: Check formatting
+        run: cargo fmt --all -- --check
+      - name: Deny Clippy warnings
+        run: cargo clippy --locked --workspace --all-targets --all-features -- -D warnings
+      - name: Build documentation without dependency docs
+        env:
+          RUSTDOCFLAGS: -D warnings
+        run: cargo doc --locked --workspace --all-features --no-deps
+      - name: Verify release metadata
+        run: cargo run --locked --quiet --example generate_release_metadata -- --check
+
+  test:
+    name: Test (${{ matrix.runner }})
+    strategy:
+      fail-fast: false
+      matrix:
+        runner: [ubuntu-24.04, macos-15]
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 45
+    steps:
+      - name: Check out the exact source commit
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          repository: ${{ github.event.pull_request.head.repo.full_name || github.repository }}
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+          persist-credentials: false
+          fetch-depth: 1
+          lfs: false
+          submodules: false
+      - name: Resolve the pinned Rust toolchain
+        run: rustup show active-toolchain
+      - name: Run the complete deterministic suite
+        env:
+          CCP_TEST_ROOT: ${{ runner.temp }}/ccp-tests
+        run: cargo test --locked --workspace --all-targets --all-features
+
+  windows_compile:
+    name: Compile tests (windows-2025)
+    runs-on: windows-2025
+    timeout-minutes: 45
+    steps:
+      - name: Check out the exact source commit
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          repository: ${{ github.event.pull_request.head.repo.full_name || github.repository }}
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+          persist-credentials: false
+          fetch-depth: 1
+          lfs: false
+          submodules: false
+      - name: Resolve the pinned Rust toolchain
+        run: rustup show active-toolchain
+      - name: Compile every test target without execution
+        run: cargo test --locked --workspace --all-targets --all-features --no-run
+
+  gate:
+    name: Hosted CI gate
+    if: always()
+    needs: [quality, test, windows_compile]
+    permissions: {}
+    runs-on: ubuntu-24.04
+    timeout-minutes: 1
+    steps:
+      - name: Require every hosted lane
+        env:
+          QUALITY_RESULT: ${{ needs.quality.result }}
+          TEST_RESULT: ${{ needs.test.result }}
+          WINDOWS_COMPILE_RESULT: ${{ needs.windows_compile.result }}
+        run: |
+          set -euo pipefail
+          [[ "$QUALITY_RESULT" == "success" ]]
+          [[ "$TEST_RESULT" == "success" ]]
+          [[ "$WINDOWS_COMPILE_RESULT" == "success" ]]

CHANGELOG.md

@@ -9,6 +9,18 @@ Semantic Versioning after its first public release.
 
 ### Added
 
+- Added auditable economic qualification guidance with machine-readable August
+  2026 case-study inputs for Matryca-Knowledge and the private case published as
+  Matryca-Brain. The documentation separates quota preservation and GitHub
+  compute avoided from still-uncertified net savings.
+
+- Replaced this public repository's ordinary per-PR receipt gate with standard
+  GitHub-hosted Rust CI: Linux and macOS execute the complete deterministic
+  suite, while Windows compiles every test target without claiming runtime
+  qualification. Receipt verification remains an optional product capability
+  for economically qualified private workloads or separately justified
+  non-economic evidence.
+
 - Unix cache generations now preserve ordinary opaque payload links during inventory and reuse; strict control paths remain link-free, failed preparation owns cleanup before reuse, and native candidate qualification remains pending.
 
 - Added the adoption-help issue-form source and a 1280 × 640 social-preview PNG

README.md

@@ -11,6 +11,7 @@ growing without weakening review, security, or platform coverage.
 Start here:
 
 - [PR #71 case study](docs/CASE_STUDY_PR71.md) — a bounded, public example.
+- [Economic qualification](docs/ECONOMIC_QUALIFICATION.md) — measured private-repository savings and limits.
 - [Clean-room tutorial](docs/TUTORIAL.md) — produce and verify a first receipt.
 - [Adoption guide](docs/ADOPTION_GUIDE.md) — decide whether CCP fits your repository.
 
@@ -128,11 +129,22 @@ repository policy.
 For installation, checksum verification, and local candidate archives, see
 [the installation guide](docs/INSTALLATION.md).
 
-## Dogfooding proof
+## Repository CI policy
 
-This repository uses CCP for its own bounded qualification workflow. See the
-[PR #71 case study](docs/CASE_STUDY_PR71.md) for the exact public anchors and
-the limits of what that evidence proves.
+This public repository uses standard GitHub-hosted CI for ordinary pull
+requests. Linux and macOS execute the complete deterministic suite; Windows
+compiles every test target without executing runtime and cache paths whose
+native qualification remains pending. Public standard runners are free.
+Replacing those jobs with local execution produces no billable public-runner
+savings. It would consume maintainer time and Mac resources without an
+economic return, so the per-PR receipt requirement is retired here.
+
+The historical CCP receipts remain valid
+evidence for their exact commits; they are not current pull-request gates. The
+[PR #71 case study](docs/CASE_STUDY_PR71.md)
+records the exact public anchors and limits. CCP can still qualify its own
+release candidates or bounded native behavior when a separate non-economic
+reason and exact authorization justify that work.
 
 ## What makes it different
 
@@ -157,10 +169,29 @@ Official project descriptions used for this comparison:
 These projects solve overlapping but different problems. Commit CI Preflight
 does not claim feature superiority or full GitHub Actions parity.
 
-## Cost example (assumptions only)
+## When CCP actually saves money
+
+CCP produces no billable runner saving when it replaces standard hosted CI in
+a public repository. In a private repository it can preserve included quota
+and avoid billed compute, but only when the same required checks move off the
+hosted runners and the retained receipt gate remains cheaper.
+
+Measured August 2026 examples:
+
+| Case | Observed result |
+|---|---|
+| This public repository | `$0` billable saving from replacing ordinary standard hosted PR jobs; hosted CI remains the default |
+| Matryca-Knowledge | 28 rounded runner-minutes avoided across 30 gate events, approximately 46.7% of the former minimum and `$0.168` at the billed Linux rate |
+| Matryca-Brain | 22 CCP-guarded local attempts correspond to an estimated 635.1 hosted Linux minutes and `$3.81` of GitHub compute avoided |
+
+These are bounded observations, not a universal savings promise. The detailed
+inputs, arithmetic, privacy boundary, and limits are in
+[Economic qualification and measured savings](docs/ECONOMIC_QUALIFICATION.md).
+
+## Cost model
 
-Assumption (example only): pricing and quotas vary by account and date, so treat
-the formula below as a planning aid.
+Pricing and quotas vary by account and date, so treat the formula below as a
+planning aid and replace every input with current measurements.
 
 Remote bill estimate (assumption):
 

docs/BENCHMARK_AND_PARITY.md

@@ -125,6 +125,10 @@ their current plan, runner multiplier, included quota, taxes, and local energy
 or hardware assumptions. Commit CI Preflight does not hard-code a currency or
 claim guaranteed savings.
 
+For measured private-repository examples, including the distinction between
+remote compute avoided and uncertified net savings, see
+[Economic qualification and measured savings](ECONOMIC_QUALIFICATION.md).
+
 Quality-critical remote responsibilities remain separate: event identity,
 review/permission policy, secret-backed integration, deployment environments,
 and native platforms not covered by accepted local receipts.

docs/BETA_SUPPORT.md

@@ -14,6 +14,7 @@ without an operator review of the threat model, policy, and local runtime.
 | Fixed benchmark on native macOS arm64 | `QUALIFIED` | Deterministic correctness digest matched |
 | Fixed benchmark on native Linux x86_64 | `QUALIFIED` | Standard `ubuntu-24.04` runner receipt independently verified |
 | Fixed benchmark on native Windows x86_64 | `QUALIFIED` | Standard `windows-2025` runner receipt independently verified |
+| Ordinary hosted pull-request CI | `ACTIVE_BOUNDARY` | Linux and macOS execute the complete deterministic suite; Windows compiles every test target without execution |
 | Unsigned macOS arm64 archive in GitHub prerelease `v0.1.0-rc.1` | `PUBLISHED_RC` | Exact tagged source, archive checksum, SBOM, notices, and rollback evidence |
 | Complete project `run` path on Linux x86_64 | `PENDING` | Benchmark evidence is not full runtime qualification |
 | Complete project `run` path on Windows x86_64 | `PENDING` | Benchmark evidence is not full runtime qualification |