Complete Routine pipeline go-live: register Routines + pilot validation

[schmug]

Task

Bring the issue→PR→merge Routine pipeline (added in PR #306, #306) to live operation on dmarcheck. Branch protection on main has already been applied manually (requiring the check CI context). What remains: register the two Routines in the Claude cloud, pin the ledger issue, fix the shipped branch-protection script so it matches what was actually applied, and run the five pilot validation scenarios recording results in docs/routine-pipeline.md.

Context

PR #306 deliberately stopped at "merged code"; go-live mutates production settings and Claude-cloud state and was owner-gated. Branch protection was found absent on main and has since been applied (context: check). The shipped script still encodes a hollow ruleset and must be reconciled so future repos onboard correctly.

Motivation

• As the repo owner, I want the pipeline running so spec-approved issues become auto-merged or escalated PRs without me managing raw PR volume.
• Triggered now: PR feat: issue→PR→merge Routine pipeline + deterministic trust gate #306 is ready; the gate is validated against real PR chore: revert temporary validation cron to daily 17:06 UTC #302.

Pointers

• scripts/routine-pipeline/routine-implementer.md — Routine Rate limiter is a no-op in local dev #1 prompt
• scripts/routine-pipeline/routine-reviewer.md — Routine DKIM key size estimation is approximate #2 prompt
• scripts/routine-pipeline/setup-branch-protection.sh:30 — currently "contexts": []; must become "contexts": ["check"]
• docs/routine-pipeline.md — "Registering the Routines" + "Pilot validation log"
• Ledger issue: Routine pipeline ledger #304 (pin in UI)
• Gate CLI: npx tsx scripts/routine-gate/gate.ts --repo schmug/dmarcheck --pr <N>

Constraints

• No change to gate logic (scripts/routine-gate/) in this issue — script + ops only.
• setup-branch-protection.sh keeps audit-only default; only the applied JSON contexts changes.
• Routine registration is manual (no IaC) — document the exact schedule used.

Acceptance criteria

• Both Routines registered in claude.ai/code, bound to schmug/dmarcheck, schedules recorded (implementer ~4h, reviewer +1h).
• setup-branch-protection.sh applies "contexts": ["check"]; audit shows required_status_checks.contexts == ["check"].
• Ledger issue Routine pipeline ledger #304 pinned.
• All 5 pilot scenarios executed; actual vs expected recorded in docs/routine-pipeline.md.
• A real spec-approved test issue produces an auto-merged PR end-to-end.

Out of scope

• Expanding to other repos (separate issue).
• Gate parser hardening (separate issue).

Reasoning guidance

Think carefully and step-by-step; this touches production settings and the safety backstop.

[schmug]

Re-scope — the branch-protection item here is now obsolete, not a fix.

Investigation found schmug/claude-routines already owns dmarcheck's main protection via a GitHub repository ruleset (main-protection, id 14716629, enforcement: active — added by claude-routines#5). It is strictly stronger than what this pipeline shipped: check + Analyze (actions) + Analyze (javascript-typescript) + CODEOWNERS + last-push-approval + deletion/non-fast-forward.

Consequences:

• The legacy branch protection this pipeline applied was redundant/weaker and has been removed (main is now governed solely by the stronger ruleset — no gap).
• scripts/routine-gate/… wait — scripts/routine-pipeline/setup-branch-protection.sh should be deleted, not fixed. Branch protection for dmarcheck (and future repos) is ruleset-managed in claude-routines, not script-managed here.

Revised remaining scope for go-live:

• Delete scripts/routine-pipeline/setup-branch-protection.sh (obsolete)
• Confirm the main-protection ruleset is the single source of truth (done: legacy protection removed)
• Routine registration / pilot validation — reconcile with claude-routines' gen_routines.py + RemoteTrigger model rather than the hand-written prompts/manual steps (those are superseded; see claude-routines#7)
• Pin ledger issue Routine pipeline ledger #304

Net: this issue's branch-protection half is resolved by deletion + the existing ruleset; the routine-registration half should be folded into the claude-routines reconciliation (#7) rather than done standalone here.