docs/ci.md

@@ -110,10 +110,24 @@ to avoid provisioning collisions.
 
 ## CI workflow
 
-Three jobs are defined in [`.forgejo/workflows/ci.yml`](../.forgejo/workflows/ci.yml):
+The single CI job is defined in `.forgejo/workflows/ci.yml`:
-`nix flake check`, `tracker-tag lint`, and `comment-block lint`. All three are
+
-required — a lint failure blocks merge. `hive-forge ci-rerun --pr N` dispatches
+```yaml
-a `workflow_dispatch` retrigger without an empty commit.
+name: CI
+on:
+  pull_request:
+    branches: ["**"]
+jobs:
+  check:
+    name: nix flake check
+    runs-on: [hive-ci]
+    steps:
+      - uses: actions/checkout@v3
+      - name: check
+        run: nix flake check
+```
+
+This runs on every PR, executing all flake checks (treefmt, rustfmt, cargo test, cargo clippy, module evaluation). No `--no-build`: the checks' derivations are the canonical source of truth.
 
 ## Security: unsandboxed builds and trusted contributors