chore: delete the Harness Lockstep job, whose tool no longer exists

[thomasluizon]

Staleness audit of every tracked file in orbit-api (1,672 files) after the 2026-08-04 harness rebuild. One deletion survived adversarial verification. Everything else is listed below with the reason it stays.

Deleted

.github/workflows/guards.yml : the lockstep job (91 lines)

Class: dead reference + a CI job that fails every run.

The job's only real step was:

node orbit-ui-mobile/tools/check-lockstep.mjs --ui-root ... --api-root ...

check-lockstep.mjs was deleted from orbit-ui-mobile by the harness rebuild (#676). Live evidence, not inferred:

$ gh run view 30935791677 --repo thomasluizon/orbit-api --log-failed
Harness Lockstep  Six harness twins stay in lockstep
  Error: Cannot find module
  '/home/runner/work/orbit-api/orbit-api/orbit-ui-mobile/tools/check-lockstep.mjs'
  code: 'MODULE_NOT_FOUND'
  ##[error]Process completed with exit code 1.

That is the most recent push run on main, 2026-08-04T17:50:54Z. The four most recent guards.yml runs are all failure for this reason.

It was safe to remove because it blocks nothing:

$ gh api repos/thomasluizon/orbit-api/branches/main/protection --jq '.required_status_checks.contexts'
["Unit Tests","Build","Dependency Review","OpenAPI Breaking-Change Gate","Dependency Scan",
 "Guard Conventions","Guard Migrations","GitGuardian Security Checks","Analyze (csharp)",
 "Analyze (javascript-typescript)","Analyze (actions)","SonarCloud Code Analysis","Dash Ban"]

13 contexts, Harness Lockstep is not one of them. It produced a permanently red check and nothing else.

Two clauses in .claude/skills/pr-review/{SKILL.md,rubric.md}

Both said the lockstep run "blocks nothing and soon will not run at all". Written while the deletion was still pending; this PR performs it, so the sentence now describes a job that does not exist. Removed the clause only; the surrounding twin-discipline paragraph is unchanged.

Considered and kept, with the reason

Every one of these was checked against the live system, never against a document.

File / thing	Why it stays
.github/workflows/mutation.yml	284 runs. A previous deletion list claimed "0 runs. Ever." It ran 4 times on 2026-08-04 alone.
.github/workflows/benchmark.yml	20 of 20 green on the nightly schedule. Previously miscalled a report nobody reads.
arch-map.yml (58), codeql.yml (19), dependabot-auto-merge.yml (404), dependency-review.yml (256), sonarcloud.yml (814), test.yml (711)	All have real run histories. No workflow in this repo has ever had zero runs.
opencode.json, .opencode/agents/*.md	Live, and CLAUDE.md:52 says so explicitly: "opencode remains live in THIS repo via opencode.json, .opencode/agents/*.md, and the /second-opinion skill." opencode.json loads tests/CLAUDE.md, which exists.
tools/check-frontmatter.mjs	Backs the surviving Skill and Agent Frontmatter job. Ran green in the same failing run above.
tools/check-push-target.mjs	Wired in lefthook.yml.
tools/arch-map.mjs	Wired in arch-map.yml, generates the committed architecture.json / architecture.html.
bench/baseline.json	Read by benchmark.yml:33 via check_bench.py.
load-tests/** (10 files)	k6 scenarios, human-invoked developer tooling with its own README. No inbound import is expected. sonarcloud.yml:80 deliberately excludes it as such. Ruled out "orphan": it is an entry point, not a library.
.config/dotnet-tools.json	mutation.yml:40 runs dotnet tool restore; this file is what it restores.
CodeMetricsConfig.txt	Referenced by Directory.Build.props.
.github/scripts/check_coverage.py, check_migration_idempotency.py	Wired at test.yml:66 and test.yml:124.
stryker-config.{application,domain,infrastructure}.json	Consumed by the live mutation.yml.
.claudeignore	Config discovered by convention, not by import. Absence of an inbound reference is expected and proves nothing. See "could not determine" below.
.claude/agents/{contract-aligner,security-reviewer}.md	Both cited by pr-review/SKILL.md and rubric.md.
AGENTS.md:29, CLAUDE.md:34 "lockstep"	Different sense: the cross-repo API contract, not the deleted CI job. Untouched.

No tracked-but-gitignored files. git ls-files -i -c --exclude-standard returns empty in this repo.

No agent scratch, no empty or stub files, no orphaned source.

Drifted twins, reported not deleted

check-lockstep.mjs used to compare six files against orbit-ui-mobile. Nothing compares them now. Measured drift today:

Twin	Drift
.claude/skills/pr-review/rubric.md	665 differing lines
.claude/skills/pr-review/SKILL.md	539 differing lines
.claude/skills/_shared/verification-protocol.md	289 differing lines
.claude/skills/second-opinion/SKILL.md	191 differing lines
.claude/hooks/git-guardrails.mjs	126 differing lines
.claude/skills/second-opinion/second-opinion.mjs	identical

Drift is not death, so nothing here was deleted. Much of it is legitimate divergence the rubric itself documents (backend-only dimensions here, harness-execution evidence there). Whether the gate should come back, in a form that does not depend on a sibling checkout, is a decision for a ticket rather than this PR.

Could not determine

.claudeignore (this repo and orbit-ui-mobile). I could not confirm from the live system whether Claude Code still reads it. It is kept, because deleting a convention-discovered config on an unverified belief is exactly the failure this audit exists to avoid. What would settle it: the current Claude Code docs, or a run with a file matched by .claudeignore observed being excluded.

Gates

$ node tools/check-dashes.mjs --check-baseline      exit 0
$ git diff --name-only HEAD | xargs node tools/check-dashes.mjs --files    exit 0
$ node tools/check-frontmatter.mjs
frontmatter ok: 8 skill and agent files parse    exit 0
$ python -c "import yaml; print(list(yaml.safe_load(open('.github/workflows/guards.yml'))['jobs']))"
['dashes', 'frontmatter']

guards.yml should go green on this PR for the first time since 2026-08-04.

Not merged. Yours to merge.

Generated with Claude Code

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud