Adopt ai-flow proposal checks (origin-firing) on learning PRs

.github/workflows/proposal-checks.yml

@@ -0,0 +1,29 @@
+# ai-flow proposal checks — copy to .github/workflows/proposal-checks.yml
+# in the org knowledge repo (and any repo whose learning proposals should be
+# verified). Requires the same org secrets as the caller workflow
+# (CURSOR_API_KEY, AI_FLOW_APP_ID, AI_FLOW_APP_PRIVATE_KEY — this repo must be
+# in each secret's selected-repos list) and a self-hosted runner labeled
+# ai-learn.
+#
+# The origin-firing check (d3mlabs/ai-flow docs/paper.md §6.2): a proposed
+# learning must fire on the context it was distilled from. Runs on every PR —
+# GitHub draft state included, which is the point: the verdict lands while
+# the human gate is still deciding. Structure-only and unmarked PRs skip
+# green.
+name: proposal-checks
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened]
+
+permissions:
+  contents: read
+  pull-requests: read
+
+jobs:
+  origin-firing:
+    uses: d3mlabs/ai-flow/.github/workflows/origin-firing.yml@main
+    secrets:
+      CURSOR_API_KEY: ${{ secrets.CURSOR_API_KEY }}
+      AI_FLOW_APP_ID: ${{ secrets.AI_FLOW_APP_ID }}
+      AI_FLOW_APP_PRIVATE_KEY: ${{ secrets.AI_FLOW_APP_PRIVATE_KEY }}