Restore #918's CI guards, minus the parts that turned out to be wrong

.github/workflows/check-dotfolder-anchors.yml

@@ -6,6 +6,20 @@ on:
   pull_request:
   merge_group:
 
+# Supersede, don't stack: a second push to the same branch cancels the still-running
+# check for the previous commit, which nobody is waiting on. The final state of the
+# branch is still checked in full, so no coverage is lost.
+#
+# `github.event_name` is in the group key on purpose: it keeps the push-event run and
+# the pull_request-event run of the same branch in SEPARATE groups. Collapsing them
+# would let a push run cancel a required PR check, and a cancelled required check
+# blocks the PR.
+#
+# merge_group is never cancelled — cancelling a merge-queue check breaks the queue.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.head_ref || github.ref }}
+  cancel-in-progress: ${{ github.event_name != 'merge_group' }}
+
 jobs:
   check-dotfolder-anchors:
     runs-on: ubuntu-latest

.github/workflows/check-notebooks-paired.yml

@@ -21,6 +21,20 @@ on:
 permissions:
   contents: read
 
+# Supersede, don't stack: a second push to the same branch cancels the still-running
+# check for the previous commit, which nobody is waiting on. The final state of the
+# branch is still checked in full, so no coverage is lost.
+#
+# `github.event_name` is in the group key on purpose: it keeps the push-event run and
+# the pull_request-event run of the same branch in SEPARATE groups. Collapsing them
+# would let a push run cancel a required PR check, and a cancelled required check
+# blocks the PR.
+#
+# merge_group is never cancelled — cancelling a merge-queue check breaks the queue.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.head_ref || github.ref }}
+  cancel-in-progress: ${{ github.event_name != 'merge_group' }}
+
 jobs:
   paired:
     runs-on: ubuntu-latest

.github/workflows/check-portable-paths.yml

@@ -6,6 +6,20 @@ on:
     branches: [main]
   merge_group:
 
+# Supersede, don't stack: a second push to the same branch cancels the still-running
+# check for the previous commit, which nobody is waiting on. The final state of the
+# branch is still checked in full, so no coverage is lost.
+#
+# `github.event_name` is in the group key on purpose: it keeps the push-event run and
+# the pull_request-event run of the same branch in SEPARATE groups. Collapsing them
+# would let a push run cancel a required PR check, and a cancelled required check
+# blocks the PR.
+#
+# merge_group is never cancelled — cancelling a merge-queue check breaks the queue.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.head_ref || github.ref }}
+  cancel-in-progress: ${{ github.event_name != 'merge_group' }}
+
 jobs:
   check-paths:
     runs-on: ubuntu-latest

.github/workflows/cross-platform-smoke.yml

@@ -20,6 +20,20 @@ on:
 permissions:
   contents: read
 
+# Supersede, don't stack: a second push to the same branch cancels the still-running
+# check for the previous commit, which nobody is waiting on. The final state of the
+# branch is still checked in full, so no coverage is lost.
+#
+# `github.event_name` is in the group key on purpose: it keeps the push-event run and
+# the pull_request-event run of the same branch in SEPARATE groups. Collapsing them
+# would let a push run cancel a required PR check, and a cancelled required check
+# blocks the PR.
+#
+# merge_group is never cancelled — cancelling a merge-queue check breaks the queue.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.head_ref || github.ref }}
+  cancel-in-progress: ${{ github.event_name != 'merge_group' }}
+
 jobs:
   smoke:
     strategy:

.github/workflows/laf-usb-manifest-policy.yml

@@ -14,6 +14,20 @@ on:
       - ".github/scripts/laf_usb_manifest.py"
       - ".github/workflows/laf-usb-manifest-policy.yml"
 
+# Supersede, don't stack: a second push to the same branch cancels the still-running
+# check for the previous commit, which nobody is waiting on. The final state of the
+# branch is still checked in full, so no coverage is lost.
+#
+# `github.event_name` is in the group key on purpose: it keeps the push-event run and
+# the pull_request-event run of the same branch in SEPARATE groups. Collapsing them
+# would let a push run cancel a required PR check, and a cancelled required check
+# blocks the PR.
+#
+# merge_group is never cancelled — cancelling a merge-queue check breaks the queue.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.head_ref || github.ref }}
+  cancel-in-progress: ${{ github.event_name != 'merge_group' }}
+
 jobs:
   validate:
     runs-on: ubuntu-latest

.github/workflows/large-file-policy.yml

@@ -7,6 +7,20 @@ on:
   merge_group:
   workflow_dispatch:
 
+# Supersede, don't stack: a second push to the same branch cancels the still-running
+# check for the previous commit, which nobody is waiting on. The final state of the
+# branch is still checked in full, so no coverage is lost.
+#
+# `github.event_name` is in the group key on purpose: it keeps the push-event run and
+# the pull_request-event run of the same branch in SEPARATE groups. Collapsing them
+# would let a push run cancel a required PR check, and a cancelled required check
+# blocks the PR.
+#
+# merge_group is never cancelled — cancelling a merge-queue check breaks the queue.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.head_ref || github.ref }}
+  cancel-in-progress: ${{ github.event_name != 'merge_group' }}
+
 jobs:
   check-large-files:
     runs-on: ubuntu-latest

.github/workflows/secret-pattern-policy.yml

@@ -3,10 +3,29 @@ name: Secret Pattern Policy
 on:
   pull_request:
   push:
-    branches: [main]
+    # Broadened 2026-07-02 from [main] only: the leak was a direct push to a
+    # working branch (logan/obsidian), which the main-only trigger never scanned.
+    # Runs on every branch push now; the job scopes the new-branch case
+    # (before==0000…) to the files that branch introduces, and falls back to the
+    # whole tree if it cannot isolate them.
+    branches: ['**']
   merge_group:
   workflow_dispatch:
 
+# Supersede, don't stack: a second push to the same branch cancels the still-running
+# check for the previous commit, which nobody is waiting on. The final state of the
+# branch is still checked in full, so no coverage is lost.
+#
+# `github.event_name` is in the group key on purpose: it keeps the push-event run and
+# the pull_request-event run of the same branch in SEPARATE groups. Collapsing them
+# would let a push run cancel a required PR check, and a cancelled required check
+# blocks the PR.
+#
+# merge_group is never cancelled — cancelling a merge-queue check breaks the queue.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.head_ref || github.ref }}
+  cancel-in-progress: ${{ github.event_name != 'merge_group' }}
+
 jobs:
   check-secret-patterns:
     runs-on: ubuntu-latest
@@ -41,8 +60,46 @@ jobs:
             before="${{ github.event.before }}"
             after="${{ github.sha }}"
             if [[ "$before" == "0000000000000000000000000000000000000000" ]]; then
-              git ls-tree -r -z --name-only "$after" |
-                python trusted-main/.github/scripts/check_secret_patterns.py --paths-from-stdin
+              # New branch: there is no `before` to diff against, but "everything in
+              # the repo" is the wrong answer. It re-reports ~55 findings that were
+              # already here (minified plugin bundles, clipped articles with embedded
+              # map keys) on every branch anyone creates, which is how a gate that
+              # caught a real leak gets trained into noise people click past.
+              #
+              # Scan what the BRANCH introduces: the commits reachable from it and
+              # from nothing else, diffed from the parent of the oldest one. A secret
+              # pushed straight to a working branch — the leak this trigger was
+              # broadened for on 2026-07-02 — is by definition in a file that branch
+              # touched, so it is still caught.
+              self_local="refs/heads/${GITHUB_REF#refs/heads/}"
+              self_remote="refs/remotes/origin/${GITHUB_REF#refs/heads/}"
+              # refs/tags included: if the branch starts from a commit reachable
+              # only through a tag, omitting tags makes `rev-list --not others`
+              # treat that pre-existing history as branch-unique, and the scan
+              # widens to unrelated files — the noise this scoping exists to stop.
+              others=$(git for-each-ref --format='%(refname)' refs/heads refs/remotes/origin refs/tags \
+                | grep -vFx "$self_local" | grep -vFx "$self_remote" || true)
+
+              base=""
+              if [ -n "$others" ]; then
+                first=$(git rev-list "$after" --not $others 2>/dev/null | tail -1)
+                if [ -n "$first" ] && git rev-parse -q --verify "${first}^" >/dev/null 2>&1; then
+                  base=$(git rev-parse "${first}^")
+                fi
+              fi
+
+              if [ -n "$base" ]; then
+                echo "New branch: scanning $base..$after (files this branch introduces)"
+                git diff --name-only -z --diff-filter=ACMR "$base" "$after" |
+                  python trusted-main/.github/scripts/check_secret_patterns.py --paths-from-stdin
+              else
+                # Fail closed. If the branch's own commits cannot be isolated (root
+                # commit, orphan branch, no other refs fetched), scan everything
+                # rather than scan nothing. Worst case is the previous behaviour.
+                echo "New branch: cannot isolate branch commits; scanning whole tree."
+                git ls-tree -r -z --name-only "$after" |
+                  python trusted-main/.github/scripts/check_secret_patterns.py --paths-from-stdin
+              fi
             else
               git diff --name-only -z --diff-filter=ACMR "$before" "$after" |
                 python trusted-main/.github/scripts/check_secret_patterns.py --paths-from-stdin

.github/workflows/validate-agent-content.yml

@@ -5,6 +5,20 @@ on:
     branches:
       - "agent/**"
 
+# Supersede, don't stack: a second push to the same branch cancels the still-running
+# check for the previous commit, which nobody is waiting on. The final state of the
+# branch is still checked in full, so no coverage is lost.
+#
+# `github.event_name` is in the group key on purpose: it keeps the push-event run and
+# the pull_request-event run of the same branch in SEPARATE groups. Collapsing them
+# would let a push run cancel a required PR check, and a cancelled required check
+# blocks the PR.
+#
+# merge_group is never cancelled — cancelling a merge-queue check breaks the queue.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.head_ref || github.ref }}
+  cancel-in-progress: ${{ github.event_name != 'merge_group' }}
+
 jobs:
   validate:
     name: Validate markdown content on agent branches

.github/workflows/validate-daily-notes.yml

@@ -8,6 +8,20 @@ on:
 permissions:
   contents: read
 
+# Supersede, don't stack: a second push to the same branch cancels the still-running
+# check for the previous commit, which nobody is waiting on. The final state of the
+# branch is still checked in full, so no coverage is lost.
+#
+# `github.event_name` is in the group key on purpose: it keeps the push-event run and
+# the pull_request-event run of the same branch in SEPARATE groups. Collapsing them
+# would let a push run cancel a required PR check, and a cancelled required check
+# blocks the PR.
+#
+# merge_group is never cancelled — cancelling a merge-queue check breaks the queue.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.head_ref || github.ref }}
+  cancel-in-progress: ${{ github.event_name != 'merge_group' }}
+
 jobs:
   check-date-placeholders:
     runs-on: ubuntu-latest