✅ test(audit): pin the AUD2 remediations behind a PR-visible exit gate (AUD2-S05)

.github/workflows/verify.yaml

@@ -40,6 +40,24 @@ jobs:
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: stable # go.mod stays the minimum; CI runs latest stable (govulncheck needs it)
+      - name: AUD2 exit gate (AUD2-S05 — REQ-AUD2-S05-01..05)
+        # The four 2026-08-18 remediations (REL-01/02/07, REL-03, SEC-03,
+        # TEST-02) are still present. It runs HERE, in the job that fires on
+        # pull_request — NOT only in release-exitgate, whose
+        # `if: github.event_name != 'pull_request'` is RELSE-08, the blind spot
+        # that let AUD-S18's stale CHECK_STAGES pin merge green four times.
+        # POSITION IS LOAD-BEARING: this gate runs `go test` against reverted
+        # copies of the tree, so it must come AFTER actions/setup-go. It sat
+        # above it until now — with `toolchain go1.26.6` in go.mod the first
+        # `go test` would have had to download a toolchain with no Go cache
+        # present, and this branch has never had a CI run to reveal it.
+        # Keep it undisarmed and argument-free: the gate asserts its own step
+        # carries no `if:`/`continue-on-error:` and no arguments (`--text-only`
+        # would skip the behavioural runs), so weakening this reddens it.
+        # These comment lines live INSIDE the step on purpose — hack/lint/
+        # workflow_pins_test.sh isolates the step ABOVE up to the next `- `
+        # marker and caps it at six lines.
+        run: bash hack/audit/aud2_exitgate_test.sh
       - run: go vet ./...
       - run: go vet -tags e2e ./... # compile+vet e2e-tagged wiring (test/e2e, P4-E1-S09)
       - name: golangci-lint (incl. gosec)
@@ -140,7 +158,8 @@ jobs:
       - name: E9 release exit gate (RELSE-03 — REQ-E9-S13)
         run: bash hack/release/exitgate_test.sh
       # AUD-S18 (REQ-AUD-S18-01/02) — the P5-AUD exit gate: the 2026-08-06 audit's
-      # conditions closed, all 14 `task check` stages green, coverage at the raised
+      # conditions closed, all 19 `task check` stages green (the count is pinned in
+      # that script's CHECK_STAGES array — it read "14" until AUD2-S05), coverage at the raised
       # bar, the frozen JSON schemas unchanged against the v0.1.0 tag, and every
       # audit finding dispositioned. Invoked with NO arguments on purpose:
       # `--text-only` skips the toolchain layer, and the gate's own CI-wiring check

CHANGELOG.md

@@ -85,9 +85,21 @@ repository still gets a decision, never by following the link; no release carrie
 - :memo: docs(spec): decompose the 2026-08-18 audit Next wave as epic P5-AUD2 (D-152)
 - :memo: docs(spec): AUD2-S02 names resolveRunFacts, not the nonexistent loadProviderHosts
 - :memo: docs(openspec): amend AUD2-S03 to the shipped pin and log D-153 (SEC-03)
+- :memo: docs(audit): document the AUD2 gate and correct stale line counts (F4, F6)
+- :memo: docs(backlog): mark P5-AUD2 complete (S01-S05 landed)
+
+### Features
+- :sparkles: feat(audit): measure REL-03/REL-07 by real mutation run, not by name
 
 ### Fixes
 - :bug: docs(decisions): reference the AUD2 spec as a path, not an mkdocs link
+- :bug: fix(audit): scope the REL-03 branch assertion to the guard block (F1)
+- :bug: fix(audit): measure the REL-03 guard's terminal path, not "a return appears"
+- :bug: fix(audit): assert no fall-through, not where the return sits
+- :bug: fix(audit): require an ALL-of FAIL quorum and refuse bash < 4.3
+
+### Refactoring
+- :recycle: refactor(audit): pin REL-03 and REL-07 by test name, demote source shape
 
 ### Security
 - :lock: fix(cmd): discriminate absent provider declaration from forge failure (REL-03)
@@ -98,6 +110,8 @@ repository still gets a decision, never by following the link; no release carrie
 ### Testing
 - :white_check_mark: test(cmd): assert the REL-03 error wrap as one contiguous substring
 - :test: test(compare): kill the surviving EffectChallenge intervention mutant (TEST-02)
+- :white_check_mark: test(audit): pin the AUD2 remediations behind a PR-visible exit gate
+- :white_check_mark: test(audit): assert verify.yaml still triggers on pull_request
 ## [0.3.0] - 2026-08-18
 
 ### Chores

Taskfile.yml

@@ -127,6 +127,13 @@ tasks:
       # Operator 2026-08-13: Dependabot is the updater; a reintroduced
       # renovate.json would otherwise merge green.
       - task: ci-audit-test
+      # AUD2-S05 (REQ-AUD2-S05-03): the P5-AUD2 exit gate. NOT free — it runs
+      # `go test` against reverted copies of the tree (~40-50s), which is the only
+      # way it can tell a live test from a hollowed-out one. Placed last, after
+      # `test` has already built the packages. It also runs in the
+      # pull-request-visible `verify` job, which is the point: the four
+      # 2026-08-18 remediations must not be revertible behind a green PR.
+      - task: audit-aud2-exitgate-test
 
   ci-audit-test:
     desc: "E9-S04 + Dependabot-only: single CodeQL workflow; no Renovate config"
@@ -267,6 +274,11 @@ tasks:
     cmds:
       - bash hack/release/install_cosign_pin_test.sh
 
+  audit-aud2-exitgate-test:
+    desc: "AUD2-S05 exit gate: the four 2026-08-18 remediations (REL-01/02/07, REL-03, SEC-03, TEST-02) are still present (REQ-AUD2-S05-01..05)"
+    cmds:
+      - bash hack/audit/aud2_exitgate_test.sh
+
   audit-exitgate-test:
     desc: "AUD-S18 exit gate: 2026-08-06 audit conditions closed + gates green at the new bar (REQ-AUD-S18-01/02). NOT in `check` — it runs `task check` itself."
     cmds: