chore: delete render.yaml, the retired Render blueprint

CHANGELOG.md

@@ -49,6 +49,9 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 - **Rust CI for `integrations/cpex-ocsf-audit`: the crate now actually compiles in CI.** `.github/workflows/rust.yml` builds and tests the crate on every change to it: every other job in this repo is Python, Node or CodeQL, so a change to the crate's manifest could go green without anything ever compiling it. Renovate #497 is the case in point, it bumped `base64`/`p256`/`sha2` in `Cargo.toml`, failed to regenerate `Cargo.lock` (its checkout has no `cpex` sibling for the path dependency), and still showed nine green checks. `cargo check --locked --all-targets` closes that: a manifest asking for versions the lockfile does not carry now fails outright, and `RUSTFLAGS=-D warnings` holds the "clean, no warnings" bar `SEAM-PORT-RESULTS.md` claims for the port. `cpex-core` is a path dependency on a sibling checkout, so the job fetches `contextforge-org/cpex` at the pinned seam head `386710a`, depth-1, ~6 MB, beside the repo rather than through `actions/checkout`, which will not write outside the workspace; the toolchain comes from the runner's own `rustup` at the crate's 1.96.1 MSRV, so no new third-party action needs a SHA pin. Path-filtered to the crate and the workflow itself, so docs PRs do not pay for a cold Rust build. CI only, no product impact.
 - **Six-beat joint demo runner: a real restart, and the offline proof at the close.** `integrations/cpex-ocsf-audit/demo/run-demo.sh` drives the CPEX/OCSF/ledger demo end to end, with `examples/demo_stream.rs` as the machine-readable driver behind it: NDJSON out, and epoch, base `stream_seq`, stream id, case list, chain uid and signing key taken from the environment, so a runner can drive more than one process and get a genuine epoch boundary between them, `decision_sink_demo`, written to be read (pretty JSON under comment headers, stamps hardcoded, chaining off), cannot produce a second epoch or a stream a tool can consume. Case 6 is the fail-closed panic record (violation code `plugin_panic` on a terminal deny). Gate 1 prints the seam head, toolchain and a live test count rather than a remembered one; beats 01-05 run in one epoch and the producer is then `SIGKILL`ed while live, so the records that survive are the ones that actually reached the sink. The restart opens a new epoch and `stream_seq` legitimately resets; density is asserted within each epoch and never across the restart, since checking across it would report a gap that isn't one. The close is one offline validator run without `--strict-gaps`, so an `on_effect` gap surfaces as a finding rather than a hard error. Beat 06 shows amber and says so on screen: the CPEX core path is live through `catch_unwind`, finalized deny and the awaited audit sink, but the end-to-end panicking-plugin harness is still pending, so the runner emits the record rather than driving a real panic. Two defects the validator caught while this was built are fixed here, signed records carried no attestation `authority_uid` (section 6 rejects a signature without the authority a verifier checks the key against), and the restarted producer restarted its attestation counter, colliding `metadata.uid` with the first record of the previous epoch and reading as an idempotent replay; each producer process now owns its chain uid. The second defect only exists because the kill is real. (#499)
 
+
+### Removed
+- **`render.yaml` deleted: production has been on GKE since the Google Cloud migration, and the blueprint was the last live-looking pointer at the retired stack.** The file still defined `ai-identity-api` and `ai-identity-gateway` as Render web services for `api.ai-identity.co` and `gateway.ai-identity.co`, the same two hostnames `k8s/ingress.yaml` routes to `api-service` and `gateway-service` behind the `ai-identity-cert` ManagedCertificate, plus an `ai-identity-keepalive` cron. Read cold, two deploy configs claimed the same hosts, and the stale one carried current-looking `CORS_ORIGINS` and `GATEWAY_URL` values, which is what made it deceptive rather than merely dead. Nothing consumed it: no workflow under `.github/` mentions Render, and `deploy-gke.yml` is the deploy path. This completes the first item of `docs/gcloud-migration-plan.md` section 10.2, now ticked. The pointers the deletion would otherwise have left dangling are fixed in the same commit: `scripts/keepalive_cron.py` and `scripts/keepalive.sh` both said to see `render.yaml` for configuration and now record that the Render cron is retired and scheduling is external. Deliberately out of scope and still open in that same checklist: the keepalive scripts have no scheduler anywhere in this repo (no `k8s/` CronJob, no workflow references them), so whether to rewrite or delete them is the maintainer's call. `docs/gke-vs-cloudrun-evaluation.md` keeps its mention, since it records a decision taken while the file existed. Infrastructure config only, no product impact.
 ### Fixed
 - **Seam-port test count reconciled with `PRAXIS-PORT-PLAN.md`.** `integrations/cpex-ocsf-audit/SEAM-PORT-RESULTS.md` gave "32 total" in a way that read as the current suite size, when it was the count at the 2026-08-18 decision-sink addendum; `PRAXIS-PORT-PLAN.md` says 33 as of #480, and the crate carries 33 test functions on `main` (emitter 27, sign 6, no integration tests, no doc-tests). The 32 is now scoped to the addendum and the current count stated alongside it, so the two documents no longer disagree. The verified seam head is unchanged at `386710a`. Docs only, no product impact. (#498)
 

docs/gcloud-migration-plan.md

@@ -679,7 +679,7 @@ Only after 2+ weeks of stable operation on GCP:
 
 ### 10.2 Code Cleanup
 
-- [ ] Remove `render.yaml` from the repo (or archive it)
+- [x] Remove `render.yaml` from the repo (deleted 2026-09-13)
 - [ ] Delete `scripts/keepalive_cron.py` (replaced by Cloud Scheduler)
 - [ ] Update `scripts/keepalive.sh` or remove it
 - [ ] Update `scripts/qa-smoke-test.sh` default URLs

scripts/keepalive.sh

@@ -11,8 +11,8 @@
 #   # Manual test:
 #   ./scripts/keepalive.sh
 #
-#   # With Render Cron Job (render.yaml):
-#   Add a cron job entry — see render.yaml for configuration.
+#   # Scheduled runs:
+#   The Render cron that used to run this is retired; schedule it externally.
 #
 # Endpoints pinged:
 #   - AI Identity API:     https://api.ai-identity.co/health

scripts/keepalive_cron.py

@@ -6,7 +6,8 @@
 2. Once per day (first run after 16:00 UTC), triggers the follow-up email cron
    to send 5-day check-in emails to new users.
 
-Runs every 10 minutes via Render cron job (see render.yaml).
+Runs every 10 minutes from an external scheduler. The Render cron that
+used to run it is retired; see docs/gcloud-migration-plan.md section 10.2.
 """
 
 import datetime