docs: adopt risk-tiered PR validation

.github/workflows/ci.yml

@@ -1,18 +1,21 @@
 name: CI
 
 on:
-  push:
-    branches: [main]
   pull_request:
+    types: [opened, synchronize, reopened]
     branches: [main]
 
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
 jobs:
-  build-and-test:
-    runs-on: ${{ matrix.os }}
-    strategy:
-      fail-fast: false
-      matrix:
-        os: [ubuntu-latest, macos-latest, windows-latest]
+  check:
+    name: Repository check
+    runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
       - uses: pnpm/action-setup@v4
@@ -21,8 +24,4 @@ jobs:
           node-version: 24
           cache: pnpm
       - run: pnpm install --frozen-lockfile
-      - run: pnpm run lint
-      - run: pnpm run format:check
-      - run: pnpm run typecheck
-      - run: pnpm test
-      - run: pnpm run build
+      - run: pnpm run check

AGENTS.md

@@ -28,7 +28,10 @@ The committed `skills/lavish/SKILL.md` is generated by `pnpm run build:skill`; `
 - Run `pnpm run check` before pushing.
 - Treat repo-provided `.agents/` skill content as vendored; Prettier intentionally ignores it.
 - Do not hand-edit `CHANGELOG.md` or `.release-please-manifest.json` - release-please owns them.
-- Human-authored PRs to `main` must go through [`no-mistakes`](https://github.com/kunchenguid/no-mistakes); CI enforces a deterministic signature in the PR body. See CONTRIBUTING.md.
+- Direct pull requests validated by repository-native tests and CI are the default.
+  Use [`no-mistakes`](https://github.com/kunchenguid/no-mistakes) only when the captain explicitly requests it or when a change affects security, privacy, authentication or authorization, destructive data or schema behavior, billing, production deployment or infrastructure, or another broad/high-blast-radius subsystem.
+  Routine docs, tests, CI/configuration, narrow UI changes, and small bounded fixes must not invoke it solely because they are ship work.
+  The captain still approves merges. See CONTRIBUTING.md.
 
 ## Documentation ownership
 

CONTRIBUTING.md

@@ -1,35 +1,32 @@
 # Contributing
 
 Thanks for wanting to contribute.
-One rule up front:
 
-**Human-authored pull requests targeting `main` must be raised through [`no-mistakes`](https://github.com/kunchenguid/no-mistakes).**
-We require this to reduce the maintainer's burden of reviewing and merging contributions.
+Direct pull requests validated by repository-native tests and GitHub CI are the routine default.
+The captain still decides when a pull request is approved to merge.
 
-`no-mistakes` puts a local git proxy in front of your real remote.
-Pushing through it runs an AI-driven review/test/lint pipeline in an isolated worktree, forwards the push upstream only after every check passes, and opens a clean PR automatically.
+Use [`no-mistakes`](https://github.com/kunchenguid/no-mistakes) only when:
 
-A GitHub Actions check (`Require no-mistakes`) runs on PRs targeting `main` and fails if the body is missing the deterministic signature that no-mistakes writes.
-The release and dependency bots are exempt so their automation keeps working, but regular contributor PRs without the signature will not be reviewed or merged.
+- the captain explicitly requests it; or
+- the task changes security, privacy, authentication or authorization, destructive data or schema behavior, billing, production deployment or infrastructure, or another broad/high-blast-radius subsystem.
 
-## Workflow
+Routine docs, tests, CI/configuration, narrow UI changes, and small bounded fixes must not invoke `no-mistakes` solely because they are ship work.
 
-Fork routing requires `no-mistakes` v1.30.1 or newer.
+## Workflow
 
-1. Fork the repo, then clone the parent repo or set your local `origin` back to the parent repo (`git@github.com:kunchenguid/lavish-axi.git`).
+1. Fork and clone the repo.
 2. Create a branch and make your changes.
-3. Initialize or refresh the gate with your fork as the push target: `no-mistakes init --fork-url git@github.com:<you>/lavish-axi.git`.
-4. Commit your changes.
-5. Push through the gate instead of pushing to `origin`:
+3. Run the repository-native validation:
 
    ```sh
-   git push no-mistakes
+   pnpm run check
    ```
 
-6. Run `no-mistakes` to attach to the pipeline, watch findings, and auto-fix or review as needed.
-7. Once the pipeline passes, it pushes the branch to your fork and opens the PR against this parent repo for you.
+4. Commit your changes and push the branch to your fork.
+5. Open a pull request targeting `main`.
+6. Address GitHub CI failures and review feedback. The captain decides whether to merge.
 
-See the [no-mistakes quick start](https://kunchenguid.github.io/no-mistakes/start-here/quick-start/) for the full first-run walkthrough.
+When the risk policy above requires `no-mistakes`, follow its [quick start](https://kunchenguid.github.io/no-mistakes/start-here/quick-start/) instead of the direct-push steps.
 
 ## Repo Conventions