@@ -3,7 +3,7 @@
 # model or an AI tool (scripts/redline/public-text.mjs). The review leaves dashes to this check,
 # and a credit, which the review also blocks, is caught here in seconds, before a review round;
 # every one shows in a single run.
-# It is its own workflow, apart from the review: the forge posts a Redline verdict only when the
+# It is its own workflow, apart from the review: a Redline verdict is posted only when the
 # review run's conclusion agrees with it, so a failing job inside that run would hold back an
 # approval.
 # It reads the pull request through the API and checks out none of its code, so a fork PR is
 
@@ -1,11 +1,11 @@
 # Redline fix: the first-party answer to a Redline REQUEST_CHANGES, as a CI job. Each repository
-# calls this from its own redline-fix.yml (workflow_dispatch; forge dispatches it with the PR, the
+# calls this from its own redline-fix.yml (workflow_dispatch; the ops tick dispatches it with the PR, the
 # head Redline reviewed and the review). The job checks out that head on the repository's own
 # non-root exec runner, lets the fix script edit and test inside it, and uploads the result as the
 # redline-fix artifact: fix.json, notes.md and, when there is a fix, fix.bundle (one commit on top
 # of the head). The job's status is the outcome: 0 for fixed, or for a description replaced with no
-# file changed (forge applies that too); 1 for anything else.
-# Nothing here pushes or comments and no token that could is on the runner: forge verifies the
+# file changed (the ops tick applies that too); 1 for anything else.
+# Nothing here pushes or comments and no token that could is on the runner: the ops tick verifies the
 # artifact (the run came from the pinned redline-fix.yml, the bundle is one fast-forward commit as
 # askalf with no attribution) and pushes it to the PR branch with the token it already holds.
 # The model is reached through FIX_ENV_FILE, which only the exec account that runs this job can
@@ -135,7 +135,7 @@ jobs:
 
       # The checkout was asked for the head sha, so this proves only that it landed nowhere else.
       # Whether the PR is still at that head is read from the API by fix.mjs before the model is
-      # called: a PR that moved is refused, and forge dispatches again at its new head.
+      # called: a PR that moved is refused, and the ops tick dispatches again at its new head.
       - name: Check the checkout is at the head
         env:
           HEAD_SHA: ${{ inputs.head }}
@@ -169,7 +169,7 @@ jobs:
           DRY_RUN: ${{ inputs.dry_run && '1' || '0' }}
         run: node .redline/scripts/redline/fix.mjs
 
-      # fix.json goes up whatever the outcome; forge reads it to know why there is no bundle.
+      # fix.json goes up whatever the outcome; the ops tick reads it to know why there is no bundle.
       - name: Upload the fix
         if: always()
         uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
 
@@ -1,8 +1,8 @@
-# Redline fix: when Redline requests changes on a pull request here, forge dispatches this run
+# Redline fix: when Redline requests changes on a pull request here, the ops tick dispatches this run
 # with the PR, the head Redline reviewed and the review. The fix itself is computed by
 # askalf/ci (redline-fix-run.yml) on this repository's fix-lane runner and uploaded as
 # the redline-fix artifact. Nothing here pushes or comments, and no token that could is on the
-# runner: forge verifies the artifact and pushes the fix to the PR branch with its own token.
+# runner: the ops tick verifies the artifact and pushes the fix to the PR branch with its own token.
 name: Redline fix
 run-name: Redline fix ${{ github.repository }}#${{ inputs.pr }} @ ${{ inputs.head }}
 
@@ -31,7 +31,7 @@ permissions:
   contents: read
   pull-requests: read
 
-# No concurrency group: forge dispatches one run per review and reads each run's artifact, and
+# No concurrency group: the ops tick dispatches one run per review and reads each run's artifact, and
 # a group keeps only one pending run, so a third dispatch would cancel the second before it ran.
 # Runs need no serializing, since none of them pushes; they wait for the fix-lane runner in GitHub's
 # job queue, which cancels nothing.
 
@@ -1,7 +1,8 @@
 # Opens a PR in each Redline caller that moves its pins, and the redline-ref input that names the
-# same commit, to the main commit that changed the review or the fix. A caller pins two reusable
-# workflows by SHA: redline.yml calls redline-review.yml and redline-fix.yml, where the repository
-# has one, calls redline-fix-run.yml. A workflow pins this repository's actions as steps, in
+# same commit, to the main commit that changed the review or the fix. A caller pins its reusable
+# workflows by SHA: redline.yml calls redline-review.yml, and, where the repository has them,
+# redline-fix.yml calls redline-fix-run.yml, public-text.yml calls public-text.yml and
+# redline-post.yml calls redline-post-verdict.yml. A workflow pins this repository's actions as steps, in
 # whichever workflow file it lives: uses: askalf/ci/actions/drift-report@<sha> (a watcher's report
 # step), uses: askalf/ci/actions/checkout-with-retry@<sha> (any job's checkout), and
 # uses: askalf/ci/actions/fleet-status@<sha> and fleet-status-check@<sha> (the fleet lanes).
@@ -72,15 +73,15 @@ jobs:
       # A bot-shaped branch opened by askalf: the fleet lanes treat it as a bot PR.
       BRANCH: bot/redline-pin
       # The review caller is in every repo but platform; the fix caller only where the fix lane is
-      # wired, and the public-text caller where the dash check is, so a missing one is skipped, not
-      # an error. A repository with neither is still a caller
+      # wired, the public-text caller where the dash check is and the post caller where the verdict
+      # posts from CI, so a missing one is skipped, not an error. A repository with neither is still a caller
       # when a workflow there pins one of this repository's actions, drift-report,
       # checkout-with-retry, fleet-status or fleet-status-check (platform, whose own CI gates it,
       # not Redline): it is bumped for those pins alone, and only a repository with no pin at all
       # is wrong.
       CALLER_PATHS: >-
         .github/workflows/redline.yml .github/workflows/redline-fix.yml
-        .github/workflows/public-text.yml
+        .github/workflows/public-text.yml .github/workflows/redline-post.yml
       # What a caller runs: the scripts the reusable workflows fetch, and the workflows. The tests,
       # their fixtures and the README change nothing a caller runs, so they move no pin; nor does
       # local.mjs, the pre-push review, which runs on a laptop and the runner host and in no
@@ -105,6 +106,7 @@ jobs:
         .github/workflows/redline-review.yml
         .github/workflows/redline-fix-run.yml
         .github/workflows/public-text.yml
+        .github/workflows/redline-post-verdict.yml
         .github/workflows/redline-pin-bump.yml
       QUIET_MINUTES: 60
       WAVE_SIZE: 3
@@ -139,6 +141,7 @@ jobs:
             .github/workflows/redline-review.yml
             .github/workflows/redline-fix-run.yml
             .github/workflows/public-text.yml
+            .github/workflows/redline-post-verdict.yml
           sparse-checkout-cone-mode: false
           persist-credentials: false
 
@@ -245,7 +248,7 @@ jobs:
           pr="$(gh api "repos/${SOURCE}/commits/${SHA}/pulls" --jq '.[0].number // empty' || true)"
           note="main ${day}"
           if [ -n "$pr" ]; then note="${note}, ${SOURCE}#${pr}"; fi
-          pattern="uses: ${SOURCE}/.github/workflows/(redline-review|redline-fix-run|public-text).yml@[0-9a-f]{40}"
+          pattern="uses: ${SOURCE}/.github/workflows/(redline-review|redline-fix-run|public-text|redline-post-verdict).yml@[0-9a-f]{40}"
           title="ci: bump Redline to ${SOURCE}@${short}"
           body="Moves the pinned ${SOURCE} calls and their redline-ref inputs, and every ${SOURCE} action pin (drift-report, checkout-with-retry, fleet-status, fleet-status-check), to ${SOURCE}@${SHA}, the main commit that last changed the review, the fix or an action (${note}). The scripts are fetched at that same commit. The pins are the only change."
 
@@ -295,6 +298,7 @@ jobs:
               case "$path" in
                 */redline-fix.yml) called=.github/workflows/redline-fix-run.yml ;;
                 */public-text.yml) called=.github/workflows/public-text.yml ;;
+                */redline-post.yml) called=.github/workflows/redline-post-verdict.yml ;;
                 *) called=.github/workflows/redline-review.yml ;;
               esac
               # In this repository the called workflows sit beside its own callers, and public-text.yml
@@ -323,7 +327,7 @@ jobs:
                 echo "::error::${repo}: ${path} does not grant $(printf '%s' "$missing" | paste -sd, -), which $(basename "$called") at ${short} asks for, so every run there fails at startup; grant it in ${path} first"
                 bad=1; continue
               fi
-              if grep -Eq "(redline-review|redline-fix-run|public-text).yml@${SHA}" <<< "$current" && grep -q "redline-ref: ${SHA}" <<< "$current"; then
+              if grep -Eq "(redline-review|redline-fix-run|public-text|redline-post-verdict).yml@${SHA}" <<< "$current" && grep -q "redline-ref: ${SHA}" <<< "$current"; then
                 echo "${path} already at ${short}"; continue
               fi
               todo+=("$path")
@@ -383,7 +387,7 @@ jobs:
               for path in "${todo[@]}"; do
                 at="$(uri "$path")"
                 if ! current="$(gh api "repos/${repo}/contents/${at}?ref=${BRANCH}" --jq .content 2>/dev/null | base64 -d)"; then carried=0; break; fi
-                if ! grep -Eq "(redline-review|redline-fix-run|public-text).yml@${SHA}" <<< "$current" || ! grep -q "redline-ref: ${SHA}" <<< "$current"; then carried=0; break; fi
+                if ! grep -Eq "(redline-review|redline-fix-run|public-text|redline-post-verdict).yml@${SHA}" <<< "$current" || ! grep -q "redline-ref: ${SHA}" <<< "$current"; then carried=0; break; fi
               done
               for path in "${atodo[@]}"; do
                 at="$(uri "$path")"
 
@@ -4,20 +4,21 @@
 # credentials and its system prompt from files on the host, so no secret is stored in GitHub and
 # the reviewer's rubric sits in no public repository.
 # The finished review is uploaded as the redline-verdict artifact (verdict.json). When the host file
-# holds no reviewer token the review is not posted here: the forge posts it as sprayberry-redline
+# holds no reviewer token the review is not posted here: the ops tick, or the repository's own
+# redline-post.yml, posts it as sprayberry-redline
 # only after checking, from the GitHub API, that the run came from the pinned redline.yml at the PR's
 # current head and that the PR changes no workflow or action definitions.
 # The PR's code is checked out only to be read by the review's read-only tools; nothing from it runs.
 #
-# Dispatch mode: a caller's redline.yml also takes workflow_dispatch, and forge dispatches it on the
+# Dispatch mode: a caller's redline.yml also takes workflow_dispatch, and the ops tick dispatches it on the
 # default branch with the PR, the head to review and whether this is a re-read of a head already
 # reviewed. The run then executes the default branch's workflow files, not the PR's, so its verdict
-# holds even for a PR that changes CI definitions. Forge uses it for every head its pull_request run
+# holds even for a PR that changes CI definitions. The ops tick uses it for every head its pull_request run
 # cannot vouch for: a PR that changes CI, a verdict it refused, and a description-only re-read.
 # Fork PRs come here only in dispatch mode (operator, 2026-10-18). The pull_request path still refuses
 # a fork head before anything is fetched. On a dispatch the default branch's workflow files run, the
 # PR is read from the API, and the fork head is fetched by the repository's own pull ref, compared
-# with the sha forge named, and checked out with symlinks written as plain files. The review's tools
+# with the sha the ops tick named, and checked out with symlinks written as plain files. The review's tools
 # only list, read and search inside that checkout (review.mjs confines every path by its real path);
 # nothing from the head executes, and the job holds no credential that could write anywhere. A fork
 # PR whose workflows are still held at the contributor gate ("Approve and run") is not reviewed: the
@@ -109,7 +110,7 @@ jobs:
             process.exit(1);
           '
 
-      # A dispatch runs the default branch's workflow files, which is the only reason forge trusts
+      # A dispatch runs the default branch's workflow files, which is the only reason the ops tick trusts
       # its verdict, so it must be a workflow_dispatch on the default branch. The PR it names must be
       # open, not a draft and at the head given. A head in a fork is allowed here, and only here:
       # the step says so in its `fork` output, and only once a job of a pull_request run for that
@@ -200,7 +201,7 @@ jobs:
 
       # A fork head is fetched from this repository's own pull ref (GitHub mirrors every PR head
       # there), so nothing is read from the fork itself, and the fetched commit must be the sha
-      # forge named. The checkout writes symlinks as plain files: a link pointing out of the
+      # the ops tick named. The checkout writes symlinks as plain files: a link pointing out of the
       # checkout becomes text, and the review's tools refuse any path that resolves outside it
       # anyway. No hooks exist in a fresh repository, no submodule is fetched, nothing runs.
       - name: Fetch the fork head to read
 
@@ -1,10 +1,10 @@
 # Redline, the gating code review, as this repo's CI check. The review itself is this repo's own redline-review.yml, called at a pinned commit like every other caller does:
-# read-only tools, verdict = pass or fail. On pull_request it reviews same-repo PRs. Forge also
+# read-only tools, verdict = pass or fail. On pull_request it reviews same-repo PRs. The ops tick also
 # dispatches it on the default branch for a head the pull_request run cannot vouch for (a PR that
-# changes CI, a verdict forge refused, a re-read after a description edit); that run executes the
+# changes CI, a verdict the ops tick refused, a re-read after a description edit); that run executes the
 # default branch's workflow files, not the PR's, and reviews the head it is given.
 name: Redline
-# Forge finds its dispatch by this title; keep it exact.
+# The ops tick finds its dispatch by this title; keep it exact.
 run-name: ${{ github.event_name == 'workflow_dispatch' && format('Redline review {0}#{1} @ {2}{3}', github.repository, inputs.pr, inputs.head, inputs.reread && ' (re-read)' || '') || github.event.pull_request.title }}
 
 on:
@@ -35,7 +35,7 @@ permissions:
 
 # On pull_request the newest push wins. A dispatch gets a group of its own per head and mode, and
 # is never cancelled: a group holds one pending run and a newer one cancels it, and a cancelled
-# dispatch leaves forge no verdict to read. Forge sends one dispatch per head and mode at a time.
+# dispatch leaves the ops tick no verdict to read. The ops tick sends one dispatch per head and mode at a time.
 concurrency:
   group: redline-${{ github.event_name }}-${{ github.event.pull_request.number || inputs.pr }}${{ inputs.head && format('-{0}-{1}', inputs.head, inputs.reread) || '' }}
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
@@ -36,7 +36,7 @@ full commit sha of `main`, so a change here reaches it only through a reviewed b
 
 | This repository's own | What it does |
 |---|---|
-| `redline.yml`, `redline-fix.yml` | This repository's callers of the review and the fix, pinned and bumped like every other caller's. |
+| `redline.yml`, `redline-fix.yml`, `redline-post.yml` | This repository's callers of the review, the fix and the post, pinned and bumped like every other caller's. |
 | `redline-pin-bump.yml` | Hourly, moves every caller's pins to the newest `main` commit that changed what a caller runs, one pull request per repository. |
 | `redline-self-test.yml` | The Redline, public-text, drift-report, fleet-status and pin-bump tests on every pull request: a required check. |
 | `checkout-with-retry-self-test.yml` | Proves the retry action on a runner: a healthy checkout, the retry paths through a stub, and the act path under act. |
@@ -104,8 +104,8 @@ Next to the prompts the hosts hold the credential files the scripts read (`/etc/
 what a caller runs: the scripts the reusable workflows and actions fetch (their tests, test fixtures
 and READMEs aside), one of the four actions, or one of the reusable workflows. It rewrites, in every
 repository in its `CALLERS` list,
-the reusable-workflow pins in `redline.yml`, `redline-fix.yml` and `public-text.yml` where the
-repository has them, and every pin of one of the four actions in any workflow file there, through
+the reusable-workflow pins in `redline.yml`, `redline-fix.yml`, `public-text.yml` and
+`redline-post.yml` where the repository has them, and every pin of one of the four actions in any workflow file there, through
 `pin.mjs`: one commit per file on `bot/redline-pin`, one pull request per repository. Each
 repository's own gate reviews and merges the bump. This repository is in the list: its own callers
 move the same way. A repository with no pin of any kind is reported as wrong.
 
@@ -81,12 +81,12 @@ through the API (no checkout) and fails when an added line, the title, the descr
 message carries an em or en dash, or when the title, the description or a commit message credits a
 model or an AI tool (a co-author trailer, a "generated with" footer, a session link), naming every
 one. Credits are read in that text only, since code and docs may name these tools for other
-reasons. Context and removed lines are never read, and captured data is skipped. It is a workflow of its own because forge posts a review only when the
+reasons. Context and removed lines are never read, and captured data is skipped. It is a workflow of its own because a review is posted only when the
 review run's conclusion agrees with the verdict.
 
 ## The fix: `redline-fix-run.yml` and `fix.mjs`
 
-When a review requests changes, forge dispatches the repository's `.github/workflows/redline-fix.yml`
+When a review requests changes, the ops tick dispatches the repository's `.github/workflows/redline-fix.yml`
 (`workflow_dispatch`: `pr`, `head`, `review`, `dry_run`), which calls `redline-fix-run.yml` at the
 same pinned commit on `[self-hosted, <repo>-exec]`, the repository's non-root exec runner. The job
 checks that the checkout is exactly the reviewed head, then `fix.mjs`:
@@ -128,7 +128,7 @@ job killed at its 60-minute timeout still uploads a `fix.json` that says so. The
 `fixed`, and for `no_change` with `description: true` (the fix was a new description, which the
 caller applies); 1 for anything else. `fix-tools.json` is the fixer's `TOOLS` as a file, pinned in `truecopy.lock` like the
 reviewer's. The artifact is `redline-fix`. Nothing on the runner can push:
-forge verifies the artifact and pushes the commit to the PR branch with its own token, then
+the ops tick verifies the artifact and pushes the commit to the PR branch with its own token, then
 comments with the notes. The model is reached through a dario key socket named by `DARIO_SOCKET`
 in the env file, so no runner holds the key itself: the socket is the credential, and only the
 exec accounts can connect to it, never an account that runs untrusted code. `DARIO_API_KEY` in