ci: acceptance.yml gates every PR into master; master only through an accepted PR

Captain Bob, 2026-11-06: what a developer runs, what CI runs and what
the nightly runs are one process, and "failures should not be allowed
to be merged to master".

acceptance.yml runs on every PR into master (opened, pushed to,
reopened): .claude/CLAUDE.md's acceptance protocol through the same
scripts/nightly.sh stages -- amd64, aarch64, riscv64 to [zuse@Hera]
ok>, the PC stick loaded high (and the three agree on dict_hash), then
make -C v4 test-32 -- one QEMU at a time, in one job. Its logs and DoE
CSVs are kept, pass or fail. master's branch protection requires it.

acceptance, nightly and release share the concurrency group qemu, so
the runner never runs two of them at once: CLAUDE.md's one-QEMU rule
holds in CI too. build.yml becomes the quick check on pushes only.

.claude/CLAUDE.md's Hard Rules: commit and push directly on the working
branch; master only through a PR that passed acceptance, no direct
pushes; no approval required while there is one developer. Named: the
Captain Bob method.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GE3SDvQn5EoxdGufk84zz2

.gitea/workflows/acceptance.yml

@@ -0,0 +1,60 @@
+# The acceptance protocol, as the gate on every pull request into master (Captain Bob, 2026-11-06:
+# "failures should not be allowed to be merged to master"). It is .claude/CLAUDE.md's protocol,
+# run by the same stages a developer and the nightly run (scripts/nightly.sh), in its order, one
+# QEMU at a time:
+#
+#   amd64, aarch64, riscv64   to [zuse@Hera] ok>, POST: PASSED, `3 4 + .` -> 7 ok
+#   the PC stick loaded high  the same; and the three architectures' dict_hash agree
+#   the 32-bit build          make -C v4 test-32, 0 failures
+#
+# master's branch protection requires this check to pass before a PR merges. The serial logs and
+# DoE CSVs are kept as the run's artifacts, pass or fail.
+name: Acceptance
+
+on:
+  pull_request:
+    branches: [master]
+    types: [opened, synchronize, reopened]
+  workflow_dispatch:
+
+concurrency:
+  group: qemu                     # one QEMU at a time on the runner: shared with nightly.yml and release.yml
+  cancel-in-progress: false
+
+jobs:
+  acceptance:
+    name: Acceptance
+    runs-on: ubuntu-latest
+    container:
+      image: gitea/runner-images:ubuntu-24.04-v26.11.03   # the runner's own ubuntu-latest is Debian 11 (node:20-bullseye)
+    timeout-minutes: 120
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0          # the SBOM's version is git describe
+          lfs: false              # only the logs and DoE CSVs are in LFS; the build needs neither
+
+      - name: Install the build's dependencies
+        run: make ARCH=amd64,aarch64,riscv64 init INIT_DOCS=0
+
+      - name: Acceptance amd64
+        run: scripts/nightly.sh accept amd64
+      - name: Acceptance aarch64
+        run: scripts/nightly.sh accept aarch64
+      - name: Acceptance riscv64
+        run: scripts/nightly.sh accept riscv64
+      - name: Acceptance PC stick loaded high
+        run: scripts/nightly.sh accept stick-high
+      - name: Acceptance 32-bit build
+        run: scripts/nightly.sh test-32
+
+      - name: Keep the logs and DoE CSVs
+        if: always()
+        uses: actions/upload-artifact@v3
+        with:
+          name: acceptance-logs-${{ github.run_number }}
+          path: |
+            logs/
+            experiments/bare_metal/runs/
+            build/nightly/accept-*.txt
+            build/nightly/test-32.txt

.gitea/workflows/build.yml

@@ -1,4 +1,5 @@
-# The check on every push and pull request: each board's image builds, and the v4 tests pass.
+# The quick check on every push: each board's image builds, and the v4 tests pass. A pull
+# request into master is gated by acceptance.yml, the full acceptance protocol.
 # Nothing is published here. The nightlies own the rest: nightly.yml (the QEMU acceptance boots,
 # the 32-bit build, the Isabelle/HOL proofs, the images to Nexus) and nightly-docs.yml (the
 # documents to Nexus).
@@ -7,8 +8,6 @@ name: Build
 on:
   push:
     branches: [master, StarForth-v4.0.0]
-  pull_request:
-    branches: [master]
   workflow_dispatch:
 
 jobs:

.gitea/workflows/nightly.yml

@@ -16,6 +16,10 @@ on:
     - cron: '0 3 * * *'        # 03:00 UTC; the documents are at 04:00 (nightly-docs.yml)
   workflow_dispatch:
 
+concurrency:
+  group: qemu                     # one QEMU at a time on the runner: shared with acceptance.yml
+  cancel-in-progress: false
+
 jobs:
   nightly:
     name: Acceptance, proofs, images

.gitea/workflows/release.yml

@@ -13,6 +13,10 @@ on:
   push:
     tags: ['v*']
 
+concurrency:
+  group: qemu                     # one QEMU at a time on the runner: shared with acceptance.yml
+  cancel-in-progress: false
+
 jobs:
   release:
     name: Release ${{ github.ref_name }}