diff --git a/.github/workflows/gh-aw-validation.yml b/.github/workflows/gh-aw-validation.yml
index 8062fa45c..8f0b98fcc 100644
--- a/.github/workflows/gh-aw-validation.yml
+++ b/.github/workflows/gh-aw-validation.yml
@@ -62,7 +62,6 @@ jobs:
       - name: Compile and validate workflows
         run: |
           gh aw compile \
-            eventrelay-ci-investigator \
             canonical-pr-remediator \
             focused-coverage-controller \
             --validate \
@@ -71,7 +70,6 @@ jobs:
       - name: Run actionlint, zizmor, and poutine checks
         run: |
           gh aw compile \
-            eventrelay-ci-investigator \
             canonical-pr-remediator \
             focused-coverage-controller \
             --actionlint \
@@ -82,6 +80,5 @@ jobs:
       - name: Verify compiled lock files are committed
         run: |
           git diff --exit-code -- \
-            .github/workflows/eventrelay-ci-investigator.lock.yml \
             .github/workflows/canonical-pr-remediator.lock.yml \
             .github/workflows/focused-coverage-controller.lock.yml
diff --git a/tests/unit/test_gh_aw_workflow_governance.py b/tests/unit/test_gh_aw_workflow_governance.py
index 2a7a99e52..8f0eee27c 100644
--- a/tests/unit/test_gh_aw_workflow_governance.py
+++ b/tests/unit/test_gh_aw_workflow_governance.py
@@ -103,43 +103,13 @@ def test_focused_coverage_controller_can_read_authoritative_runs() -> None:
     assert "requires a separate approved GitHub App canary" in source
 
 
-def test_ci_investigator_requires_dedicated_codex_credential() -> None:
-    workflow = _load_frontmatter(
-        ROOT / ".github/workflows/eventrelay-ci-investigator.md"
-    )
-    triggers = workflow.get("on", workflow.get(True))
-    assert triggers is not None
-    credential_gate = next(
-        step
-        for step in triggers["steps"]
-        if step.get("name") == "Require dedicated Codex credential"
-    )
-
-    assert credential_gate["id"] == "require_codex_credential"
-    assert credential_gate["env"]["CODEX_API_KEY"] == "${{ secrets.CODEX_API_KEY }}"
-    assert "Dedicated CODEX_API_KEY is required" in credential_gate["run"]
-    assert "OPENAI_API_KEY" not in credential_gate["run"]
-
-    compiled = _load_yaml(
-        ROOT / ".github/workflows/eventrelay-ci-investigator.lock.yml"
-    )
-    pre_activation_steps = compiled["jobs"]["pre_activation"]["steps"]
-    activation = compiled["jobs"]["activation"]
-    agent_steps = compiled["jobs"]["agent"]["steps"]
-
-    compiled_gate = next(
-        step
-        for step in pre_activation_steps
-        if step.get("id") == "require_codex_credential"
-    )
-    assert compiled_gate["name"] == "Require dedicated Codex credential"
-    assert compiled_gate["env"]["CODEX_API_KEY"] == "${{ secrets.CODEX_API_KEY }}"
-    assert activation["needs"] == "pre_activation"
-    assert any(step.get("id") == "validate-secret" for step in activation["steps"])
-    assert not any(
-        step.get("name") == "Require dedicated Codex credential"
-        for step in agent_steps
-    )
+def test_obsolete_ci_investigator_workflow_removed() -> None:
+    # The EventRelay CI Investigator workflow (source .md and compiled .lock.yml)
+    # was intentionally removed in 07b8a2e ("noise-only output; per repo cleanup").
+    # Guard against reintroduction; canonical-pr-remediator and
+    # focused-coverage-controller remain the authoritative agentic workflows.
+    assert not (ROOT / ".github/workflows/eventrelay-ci-investigator.md").exists()
+    assert not (ROOT / ".github/workflows/eventrelay-ci-investigator.lock.yml").exists()
 
 
 def test_live_smoke_modules_are_excluded_before_import(monkeypatch) -> None:
@@ -202,6 +172,9 @@ def test_gh_aw_validation_pins_runtime_version() -> None:
     step_scripts = [step.get("run", "") for step in workflow["jobs"]["validate-gh-aw"]["steps"]]
     combined = "\n".join(step_scripts)
     assert "gh extension install github/gh-aw --pin v0.82.14" in combined
-    assert "eventrelay-ci-investigator" in combined
+    # eventrelay-ci-investigator was removed (07b8a2e); validation must no longer
+    # compile or diff it, otherwise the gh-aw Validation workflow fails at runtime
+    # against a source/lock file that no longer exists.
+    assert "eventrelay-ci-investigator" not in combined
     assert "canonical-pr-remediator" in combined
     assert "focused-coverage-controller" in combined