**no more vouching! let's see how it goes for a week :)**

.github/workflows/ci.yml

@@ -3,14 +3,12 @@ name: CI
 on:
    push:
       branches: [main]
-      # Vouch bookkeeping commits (mitchellh/vouch writes VOUCHED.td back to
-      # main on !vouch/!denounce/!unvouch) only edit the vouch list and need no
-      # build. Skip CI when a main push changes nothing but the vouch file; a
-      # push that also touches anything else still runs the full matrix.
-      paths-ignore:
-         - .github/VOUCHED.td
+      paths:
+         - "packages/**"
    pull_request:
       branches: [main]
+      paths:
+         - "packages/**"
    workflow_dispatch:
       inputs:
          skip_npm:

.github/workflows/vouch-manage.yml

@@ -1,44 +0,0 @@
-name: Vouch (manage)
-
-# Let maintainers vouch/denounce/unvouch by commenting on a Discussion:
-#   !vouch                 vouch the discussion author
-#   !vouch @user [reason]  vouch a specific user
-#   !denounce [@user] [reason]
-#   !unvouch [@user]
-# Only collaborators with admin/maintain/write are honored (triage EXCLUDED;
-# upstream's default `roles` includes triage, which we override below).
-#
-# Commits the VOUCHED.td change back to the default branch using the stock
-# GITHUB_TOKEN (no GitHub App needed). NOTE: this works only while the default
-# branch is UNPROTECTED — GITHUB_TOKEN cannot bypass branch protection. If you
-# protect the branch later, switch back to a GitHub App token on a bypass list.
-
-on:
-  discussion_comment:
-    types: [created]
-
-# Serialize writes to VOUCHED.td so concurrent vouches don't clobber.
-concurrency:
-  group: vouch-manage
-  cancel-in-progress: false
-
-permissions:
-  contents: write # commit VOUCHED.td
-  discussions: write # read the comment / acknowledge
-
-jobs:
-  manage:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: mitchellh/vouch/action/manage-by-discussion@v1
-        with:
-          discussion-number: ${{ github.event.discussion.number }}
-          comment-node-id: ${{ github.event.comment.node_id }}
-          vouch-keyword: "!vouch"
-          denounce-keyword: "!denounce"
-          unvouch-keyword: "!unvouch"
-          roles: admin,maintain,write
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/vouch-pr.yml

@@ -1,51 +0,0 @@
-name: Vouch (PR gate)
-
-# Auto-close PRs from unvouched or denounced users. Issues are left alone
-# (robomp triages those). Runs under `pull_request_target` so the token can
-# act on fork PRs; this job does NO checkout and runs NO PR code — it only
-# reads .github/VOUCHED.td from the base repo and calls the GitHub API.
-
-on:
-  pull_request_target:
-    types: [opened, reopened, ready_for_review]
-
-permissions:
-  contents: read # read VOUCHED.td from the base branch
-  pull-requests: write # close + comment
-  issues: write # add the `vouched` label (labels use the Issues API)
-
-concurrency:
-  group: vouch-pr-${{ github.event.pull_request.number }}
-  cancel-in-progress: true
-
-jobs:
-  check:
-    runs-on: ubuntu-latest
-    steps:
-      - id: vouch
-        uses: mitchellh/vouch/action/check-pr@v1
-        with:
-          pr-number: ${{ github.event.pull_request.number }}
-          auto-close: true
-          require-vouch: true # block unvouched, not only denounced
-          # vouched-file: .github/VOUCHED.td (default)
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-      # Survivors of the gate (vouched, or auto-allowed collaborators/bots) get
-      # a FRESH `vouched` label on every (re)open / ready-for-review. robomp
-      # reviews ONLY on that label event (ROBOMP_PR_REVIEW_TRIGGER=vouched_label),
-      # so review is always triggered by a just-validated PR, never a stale label.
-      - name: Label vouched PRs for robomp review
-        if: ${{ steps.vouch.outputs.status == 'vouched' || steps.vouch.outputs.status == 'allowed' }}
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          REPO: ${{ github.repository }}
-          PR: ${{ github.event.pull_request.number }}
-        run: |
-          gh label create vouched --repo "$REPO" --color 2da44e --description "Passed the vouch gate" --force
-          # remove+add so a fresh `labeled` event fires even when the label
-          # persisted across close/reopen (re-adding an existing label emits no
-          # event). The check above just re-validated, so trust is never stale.
-          gh pr edit "$PR" --repo "$REPO" --remove-label vouched || true
-          gh pr edit "$PR" --repo "$REPO" --add-label vouched