chore(repo/retirement): publish read-only posture

.agents/skills/maintaining-chatgpt-package/SKILL.md

@@ -1,13 +1,22 @@
 ---
 name: maintaining-chatgpt-package
-description: Use when changing native package metadata or payload, installer-generated launcher behavior, packaged runtime helper behavior, updater service or install behavior, or native package shape in this repository.
+description: Historical package-maintenance reference for the retired and unsupported ChatGPT for Linux repository; do not use it to start or continue maintenance.
 ---
 
 # Maintaining ChatGPT Package
 
-Use this skill for package and runtime maintenance in this repository.
+> [!IMPORTANT]
+> This is historical source for a retired and unsupported repository. Do not
+> use it to start or continue maintenance. Follow
+> [`docs/retirement.md`](../../../docs/retirement.md).
 
-Do not use it for README-only, policy-only, review-only, or generated-output-only turns unless the change also affects native package behavior, launcher generation, packaged runtime behavior, or updater install/service behavior.
+## Historical contract
+
+This skill records the package and runtime maintenance contract used before
+retirement. The remaining recipes support source interpretation only.
+
+It is not an active routing surface for package, updater, installer, launcher,
+or generated-output work.
 
 ## Start Discovery
 

.github/pull_request_template.md

@@ -1,23 +1,31 @@
-**IMPORTANT: Please keep only one pull request open at a time. The default maximum is two active pull requests from the same contributor, and even that should be reserved for exceptional circumstances. Maintainers may configure a different per-contributor limit for explicit exceptions. Do not open several pull requests at once; finish or close existing work before submitting more. An automated bot will close pull requests that exceed the effective limit.**
+> [!IMPORTANT]
+> ChatGPT for Linux is retired and unsupported. This repository does not accept
+> maintenance contributions, bug fixes, features, package work, dependency
+> updates, or security remediation. Pull requests are limited to
+> owner-directed retirement closeout authorized by an existing tracker item.
 
-<!-- Complete this template before requesting review or merge. -->
+<!-- Complete this template only for authorized retirement closeout. -->
+
+## Closeout authority
+
+<!-- Link the existing owner-directed retirement issue and name its bounded scope. -->
 
 ## Summary
 
-<!-- What changed, why, and which issue it resolves. -->
-<!--
-Repository labels are assigned by maintainers and authorized collaborators
-during triage. Describe the facts and scope; do not self-classify.
--->
+<!-- Explain what retirement record or closeout state changes. -->
+
+## Preservation boundary
+
+<!-- Identify historical evidence and private or downstream state that remains untouched. -->
 
 ## Validation
 
-<!-- List the tests and checks you ran. Mention anything not tested or any known risk. -->
+<!-- List the exact checks run and any remaining hosted or owner gate. -->
 
 ## Checklist
 
-- [ ] This pull request is ready for review and is no longer a draft.
-- [ ] I followed [CONTRIBUTING.md](https://github.com/nisavid/chatgpt-linux/blob/main/CONTRIBUTING.md), kept the change focused, edited source files rather than generated output, and removed unrelated changes.
-- [ ] If this fixes official-app drift, it targets only the latest `ChatGPT.dmg` and removes obsolete fallback code and tests from the affected area.
-- [ ] I added or updated relevant tests, ran the validation listed above, and confirmed that required CI checks pass.
-- [ ] I reviewed the final diff with my coding agent using maximum reasoning effort, addressed all findings, and reran the relevant tests.
+- [ ] This change is authorized by an existing retirement-closeout ticket.
+- [ ] It does not resume maintenance or create replacement work.
+- [ ] It preserves historical attribution, runs, and unresolved-risk status.
+- [ ] It does not mutate packages, host or user state, credentials, or private rollback evidence.
+- [ ] The final immutable diff and required checks have been reviewed.

.github/workflows/ci.yml

@@ -246,8 +246,8 @@ jobs:
       - name: Configure Cachix for Nix build substitutions
         uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
         with:
-          # Retain the existing external cache until the post-merge repository
-          # and Cachix migration in issue #123 is complete.
+          # Retain the historical external cache only for read-only substitutions.
+          # Retirement keeps writes disabled; no namespace migration is pending.
           name: codex-desktop-linux
           skipPush: true
 
@@ -316,8 +316,8 @@ jobs:
               {
                 echo "## Nix Pin Validation"
                 echo ""
-                echo "- Skipped package-output builds because the official \`ChatGPT.dmg\` metadata is ahead of the committed flake pins during rollout."
-                echo "- This is PR-only; main-branch validation still fails so the scheduled hash-refresh workflow can open a full pin-refresh PR from the current official DMG."
+                echo "- Skipped package-output builds because the official \`ChatGPT.dmg\` metadata is ahead of this retired repository's historical flake pins."
+                echo "- This is PR-only; push validation remains fail-closed. Retirement removed automated pin refresh, so there is no maintenance producer for this drift."
               } >> "$GITHUB_STEP_SUMMARY"
               echo "skip_package_outputs=true" >> "$GITHUB_OUTPUT"
               rm -f "$validation_log"
@@ -359,7 +359,7 @@ jobs:
                   echo ""
                   echo "- Skipped package-output builds after \`$output\` because the official \`ChatGPT.dmg\` is rolling between fixed-output hashes."
                   echo "- This does not mask non-DMG Nix failures; main-branch builds still fail on this condition."
-                  echo "- The scheduled hash-refresh workflow owns updating the committed DMG pin from the current official DMG."
+                  echo "- Retirement removed automated pin refresh; there is no maintenance producer for this drift."
                 } >> "$GITHUB_STEP_SUMMARY"
                 exit 0
               fi

.github/workflows/codeql.yml

@@ -3,15 +3,11 @@ name: CodeQL Advanced
 on:
   pull_request:
     branches: ["main"]
-  push:
-    branches: ["main"]
-  schedule:
-    - cron: "34 19 * * 2"
-  workflow_dispatch:
 
 permissions:
   actions: read
   contents: read
+  # Required only to publish the protected branch's CodeQL result.
   security-events: write
 
 jobs: