DR-120: The nightly owns its verification sequence, and the operator hook is deleted rather than reconciled

DR-120 — The lane owns its verification sequence; the operator hook is deleted

Context

.github/workflows/cocoindex-nightly.yml declared itself, at nine points, a READ-ONLY verbatim copy of deploy/onprem/verify/live-verify.sh — an on-prem B1 operator hook. That declaration is the mechanism behind id-412’s entire defect, not an incidental duplication: the workflow inherited the operator script’s docs/testing corpus choice, docs/testing later moved, and READ-ONLY made reconciliation nobody’s job. The lane therefore never walked the vendored Platform corpus it exists to dogfood.

id-412’s acceptance criterion assumed the fix was to extract shared steps both files call, with the script surviving as the manual against-a-live-box entry point. Measurement at S525 falsified that premise. The script had been unrunnable since the fixture relocation (b9c55abf/90cc3b03/eb9ccac9): step 0b hard-dies at :187 on the absent docs/testing, before the walk and before Vitest. It had also drifted three further ways nothing tracked — a 9-item Vitest exclude list against the workflow’s 1, a background walk pump the lane deleted at id-400 (W2), and a reference to the verify_driver.py sibling deleted at S524.

Decision

The nightly workflow is the source of truth for the stage → walk → Vitest sequence, and deploy/onprem/verify/live-verify.sh is deleted. The manual path is a workflow_dispatch of the nightly. If an against-a-live-box hook is needed again, it must be written as a thin wrapper that calls the workflow’s steps — never as a second copy of them.

Alternatives considered

• Repair step 0b, then extract shared steps (the AC as written). Rejected: you cannot extract a shared source of truth from a script that does not run, and the fact that nobody had hit the failure in the months since the relocation is the evidence that the manual path was not in use. Repairing it would have preserved a second copy on the strength of a use case with no user.
• Keep the script, keep the READ-ONLY declaration, reconcile by hand. This is the status quo that produced the defect.

Consequences

• The nine READ-ONLY declarations are gone; the workflow header now records why the copy existed, so the reasoning is not lost with the file.
• deploy/onprem/verify/ is emptied and removed. sync-platform-corpus.sh cited the deleted step 0b as its idempotence pattern at :36/:107; both now point at that script’s own header.
• The on-demand operator cadence and the ID-62 Inv-29 “launch flip” crontab line the script carried are lost with it. Neither was ever exercised; if a scheduled live-box verification is wanted at launch, it is a Coolify scheduled task or a workflow schedule, not a resurrected shell script.
• Generalisation worth keeping: a comment declaring a duplication deliberate is the mechanism that prevents it being fixed. When a file says “do not reconcile me”, that is the defect, not the guardrail.

Landed on PR #162 (id-412 AC-11).