Run the canary weekly on Mondays instead of daily

.github/workflows/canary.yml

@@ -1,17 +1,17 @@
-# One real run against play.google.com, every morning.
+# One real run against play.google.com, every Monday.
 #
 # `tests.yml` deliberately never touches the site; this is the job that does.
 #
 # It carries NO SECRETS AND IS EXPECTED TO BE GREEN, and that is the whole
 # design. The README's central claim is "no key, no proxy, no account", and
-# the only honest way to keep a sentence like that true is to run it daily
+# the only honest way to keep a sentence like that true is to run it on a schedule
 # from an address nobody controls — a bare GitHub runner — and let the badge
-# go red the morning it stops being true.
+# go red on the first run after it stops being true.
 #
 # A canary that CANNOT pass must skip rather than fail (a check that is always
 # red teaches everyone to ignore checks). The other half of that rule applies
 # here: a canary that CAN pass without a credential must never be gated on
-# one, or it goes green every day while testing nothing.
+# one, or it goes green on every run while testing nothing.
 #
 # Measured 2026-09-22 from a datacentre address, and re-measured by this job
 # from GitHub's: every route below answers without a key.
@@ -20,7 +20,7 @@ name: canary
 
 on:
   schedule:
-    - cron: "17 6 * * *"
+    - cron: "17 6 * * 1"
   workflow_dispatch:
 
 permissions:

CHANGELOG.md

@@ -11,6 +11,10 @@ discovered from a bill or a diff.
 
 ## [Unreleased]
 
+### Changed
+
+- CI only: the canary now runs weekly (Mondays 06:17 UTC) instead of daily, and on a manual dispatch.
+
 ## [0.2.0] — 2026-10-15
 
 > **Behaviour changes for existing callers.**

CONTRIBUTING.md

@@ -89,11 +89,11 @@ Then the rest of the presentation, in the order that matters:
 
 1. `python3 smoke_test.py` green, and the canary dispatched at least once by
    hand before anyone trusts the badge. This canary needs **no secret** and
-   runs daily on a schedule, which is deliberate: the README's central claim
+   runs weekly (Mondays) on a schedule, which is deliberate: the README's central claim
    is that you need no key, no proxy and no account to read this site, and a scheduled, ungated, real three-page run is that claim
-   under test every morning. The family's rule that a canary which cannot
+   under test every Monday. The family's rule that a canary which cannot
    pass must SKIP has a second half — a canary that CAN pass without a
-   credential must never be gated on one, or the badge goes green every day
+   credential must never be gated on one, or the badge goes green on every run
    while testing nothing.
 
    Note that `workflow_dispatch` needs the workflow to exist on the DEFAULT

README.md

@@ -84,9 +84,9 @@ been exercised offline against a stubbed solver only; no live solve has been
 run on this site.
 
 The canary is the standing test of that claim: it runs a real three-page
-scrape **daily from a bare GitHub runner with no secrets** and is expected to
+scrape **weekly (Mondays) from a bare GitHub runner with no secrets** and is expected to
 be green. If Play ever puts these routes behind a key or a challenge, the
-badge goes red the next morning and the sentence above gets retested without
+badge goes red on the next weekly run and the sentence above gets retested without
 anyone remembering to.
 
 ## The five modes