From 0476e0379fc5071187c4ced44d6d1861c9389e7e Mon Sep 17 00:00:00 2001
From: Konrad Heimel <konrad.heimel@gmail.com>
Date: Sun, 23 Aug 2026 18:45:19 +0200
Subject: [PATCH 1/8] :white_check_mark: test(ci): share PR-reach and cross-pin
 the three PR-visible gates (D-157)

The three PR-visible text gates each answered "am I reachable on a pull
request?" for themselves, and two of them answered it with
`grep -qE '^[[:space:]]+pull_request:'`. A reviewer added `paths:` under
the trigger and measured rc=0: present, grep-satisfied, and disarmed for
every PR that touches only Taskfile.yml or .github/workflows/**. The
third gate never asked at all.

hack/lib/pr_reach.sh is now the single reader for all three:

  * assent_pr_reach reds on paths:/paths-ignore:, on a types: list that
    omits a GitHub default, on a branch filter excluding main, and on a
    `pull_request:` that is not a 2-space key of `on:`. It accepts the
    inline `on:` forms, the quoted "on": key, a types: superset and
    branches: [main], and refuses (fail-closed, distinct code) flow
    mappings and anchors rather than guessing.
  * assent_step_wired matches an anchored `run:` COMMAND, adds a
    job-level `needs:` check, and replaces the 1..6 line cap with the
    one-`run:`-key/no-`uses:`-key isolation invariant.
  * Each gate now cross-pins the other two's steps, so deleting any one
    of the three reds on the PR that does it.

aud2's fixed-string step check is replaced by the anchored form: with
the `run:` line commented out it reported "WITH ARGUMENTS" instead of
"does not invoke".

Every branch is mutation-controlled, including the legitimate shapes
that must stay GREEN. One fail-open was found by building the mutant:
accepting a block-scalar invocation naively let a bare `bash <script>`
line inside another step's multi-command `run: |` body pass; the block
form now counts only as a block's sole command.

CONTROL_FLOOR 38 -> 51 (text-only 32 -> 45), both met exactly.
No `check:` stage added; CHECK_STAGES untouched.
---
 CHANGELOG.md                         |   1 +
 docs/decisions/decisions.md          |   1 +
 hack/audit/aud2_exitgate_test.sh     | 365 +++++++++++++++-----
 hack/examples/dogfood_wiring_test.sh | 294 ++++++++++++----
 hack/lib/pr_reach.sh                 | 481 +++++++++++++++++++++++++++
 hack/lint/workflow_pins_test.sh      | 385 +++++++++++++++++----
 openspec/specs/backlog.md            |   1 +
 7 files changed, 1314 insertions(+), 214 deletions(-)
 create mode 100644 hack/lib/pr_reach.sh

diff --git a/CHANGELOG.md b/CHANGELOG.md
index e638c8d3..6bf325dc 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -133,6 +133,7 @@ repository still gets a decision, never by following the link; no release carrie
 - :white_check_mark: test(hack): the bash-3.2-clean assertion could not fail (BASH32-F01)
 - :white_check_mark: test(hack): close two gate fail-opens found by review (BASH32-F01)
 - :white_check_mark: test(ci): wire release-verify-test into task check (D-159)
+- :white_check_mark: test(ci): share PR-reach and cross-pin the three PR-visible gates (D-157)
 ## [0.3.0] - 2026-08-18
 
 ### Chores
diff --git a/docs/decisions/decisions.md b/docs/decisions/decisions.md
index 8d6de3b3..2aa9a683 100644
--- a/docs/decisions/decisions.md
+++ b/docs/decisions/decisions.md
@@ -160,6 +160,7 @@ project/process decisions.
 | D-153 | 2026-08-19 | **The cosign signer-identity pin published in `SECURITY.md` was WRONG, not merely missing from `hack/install.sh`: the identity regexp is widened to `^https://github\.com/PlatformRelay/[Aa]ssent/` in both files (AUD2-S03 / SEC-03).** Substance first: `SECURITY.md`'s "Verify a tagged release" instructions pinned `--certificate-identity-regexp '^https://github.com/PlatformRelay/assent/'`, and an adopter who followed them on **v0.2.0 or v0.3.0 got a verification FAILURE on a genuine, correctly signed artifact** — the published recipe has been broken for every release since v0.2.0, and the natural reading of that failure is "this release was tampered with". Cause: the repository was renamed `PlatformRelay/assent` → `PlatformRelay/Assent` between v0.1.0 and v0.2.0; the keyless signing certificate's Subject Alternative Name carries GitHub's canonical casing; cosign compiles `--certificate-identity-regexp` as a Go RE2 pattern and matches it **case-sensitively**. Decoded from the published bundles: v0.3.0 and v0.2.0 sign as `https://github.com/PlatformRelay/Assent/.github/workflows/release.yaml@refs/tags/vX.Y.Z`, v0.1.0 as `https://github.com/PlatformRelay/assent/.github/workflows/release.yaml@refs/heads/main`. All three verify under the new value; independently re-confirmed with real cosign against the real v0.3.0 artifact (`Verified OK` under the new pin, exit 1 "expected SAN value to match regex" under the old). Options considered: **(a)** ship the pin byte-identical to the published-but-broken value and file the breakage as a follow-up (rejected — it would land a green gate asserting a guarantee that fails closed on this project's own releases, D-124's defect one level up); **(b)** case-insensitive `(?i)` (rejected — wider than the defect and it silently accepts casings GitHub never issues); **(c)** an explicit `[Aa]` class in both files, dots escaped (chosen). Not widened otherwise: the `^` anchor and the owner/repo scope stand, so another owner, an `assent-mirror` typosquat, another forge and an unescaped-dot host all still fail. Enforcement, per D-128: **one** published truth — `hack/release/install_cosign_pin_test.sh` extracts the pair from `hack/install.sh` and `SECURITY.md`, requires exactly one distinct value per file, reddens on drift, and (this is the assertion that would have caught the defect) matches the pin against the three **real** SANs above, committed as offline fixtures, plus six negatives. Extends D-110 (bundles beside archives) and D-109; the maintainer-path twin at `hack/release/verify-artifacts.sh:124` is still unpinned and is tracked in the backlog, not fixed here. Revert: restore `'^https://github.com/PlatformRelay/assent/'` in both files — which re-breaks verification of v0.2.0 and every later release, so revert only together with a repo rename back to lowercase. |
 | D-154 | 2026-08-23 | **Every `hack/**` script that uses a bash 4+ feature declares a PER-SCRIPT version floor via the shared `hack/lib/require-bash.sh`, because one of them was a silent local FAIL-OPEN under stock macOS bash 3.2 (BASH32-F01).** Substance first: `/bin/bash hack/docs/truthlag_pins_test.sh` on macOS printed 20 `PASS` lines, died at its `declare -A ex_s09_prefix_hint=(…)`, never printed its final `OK: all truth-lag pins green` banner — and **exited 0**. Its caller `task docs-gates`, and therefore `task check`, read that as a green gate, and AGENTS.md rule 4 makes a green local `task check` a per-commit precondition; CI is ubuntu/bash 5, so nothing merges through this path, which is precisely why it survived. Mechanism, measured on bash 3.2.57: 3.2 has no associative arrays, so under `set -u` it re-reads `declare -A x=([k]=v)` as an INDEXED array assignment and evaluates the subscript `k` **arithmetically**, hitting "unbound variable"; the shell terminates the script and the exit status is 0. Two theories were disproved en route and are recorded so they are not re-explored: the `trap … EXIT` status-swallow (3.2 propagates 1 through an EXIT trap correctly) and `set -e` (the script runs `set -uo pipefail`). The other two affected scripts fail CLOSED, but only incidentally: `hack/release/verify-artifacts.sh:202`'s literal is EMPTY, so there is no subscript to evaluate and it degrades to `declare: -A: invalid option`, which its `set -e` turns into exit 2 (measured with a `--dist` that reaches line 202 — an unreachable dist exits 1 much earlier); `hack/validate-schemas-stock.sh`'s `mapfile` degrades to "command not found" and it exits 1. Populating an empty literal or dropping `-e` silently converts a closed failure into the open one, so "how this construct happens to degrade" is not a guarantee worth depending on. Options considered: **(a)** one blanket repo-wide floor (rejected — the binding minimum differs per feature: `declare -A` 4.0, `local -n` 4.3, `mapfile -d ''` 4.4; a blanket floor both refuses shells that could run the 4.0 gates and hides which feature actually binds); **(b)** rewrite the three scripts to be 3.2-compatible (rejected — associative arrays and `mapfile` are the right tools here, a rewrite is a large risky change to scripts whose correctness IS the product, and it does nothing about the next gate author); **(c)** copy the existing inline `BASH_VERSINFO` guard from `hack/audit/aud2_exitgate_test.sh:71` into each script (rejected as the *only* measure — it duplicates the explanation three more times and still leaves the next author to rediscover the hazard); **(d) chosen** — a shared `require_bash <major>[.<minor>] <feature>` helper, called with each script's own correct floor (4.0 / 4.0 / 4.4), plus a meta-gate. Enforcement, per D-128, is one place: `hack/lint/bash_version_guard_test.sh`, wired as `task check` stage **20** and pinned in `hack/audit/exitgate_test.sh`'s `CHECK_STAGES` in the same commit. It scans every `hack/**/*.sh` for command-position bash 4+ constructs, requires a guard on each, requires the declared floor to be at least the feature's own minimum, and — the assertion that makes the rest non-vacuous — requires the scan to still find all four known feature-using files, so a typo in a detection pattern reds instead of quietly matching nothing. Its own negative control mutates real copies of the three scripts with the guard lines stripped and asserts they are flagged. `hack/audit/aud2_exitgate_test.sh` keeps its inline guard and is accepted by the gate as guarded; adopting the helper there is a follow-up, not this lane. Stated limits: the gate sees only command-position constructs in `hack/**/*.sh` (not `eval`, dynamically built command names, case-modification expansions, or scripts outside `hack/`), and the exit-0 control needs a real bash 3.2 — present on macOS, absent on CI ubuntu, where it SKIPs **loudly** rather than passing silently. Accepted behaviour change: under 3.2, `hack/release/verify-artifacts.sh --help` now refuses instead of printing usage. Revert: delete the guard calls — `task check` then silently stops certifying the docs truth-lag pins for every contributor whose `bash` is 3.2. |
 | D-156 | 2026-08-23 | **The tier-1 (CEL) ceiling is recorded (`docs/planning/rego-tier-ceiling.md`, E11-S01 / REQ-E11-S01-01+02) and it NARROWS E11: two of the four named shapes are struck outright and a third in part.** Substance first: of multi-pass / cross-manifest / set-difference / graph-relationship (`openspec/specs/later-phases.md:284`), **cross-manifest and set-difference are struck, the "named intermediate" half of multi-pass is struck, and only fold/aggregate-over-a-collection and in-input graph reasoning survive as justification for a second backend.** Measured against the surface this repo actually binds — `internal/core/aggregate/evaluate.go` `newEvalEnv`, eleven frozen predicate-scope variables, **zero extension libraries** — reproduced in a nested throwaway module pinned to the repo's `cel-go v0.31.0` (root `go.mod`/`go.sum` byte-unchanged; nothing added to the dependency graph, which judgment call (d) has not authorised). **What exceeds tier 1: (1) folds.** `sum`, `reduce`, `math.*` and `lists.*` are all `undeclared reference`; `size()` is the only aggregate in the surface, so a rule counting matched changes is expressible and a rule summing a numeric delta across them is not. **(2) Graph reasoning** — the iteration count of a CEL expression cannot be made data-dependent, so depth is syntactic and **unbounded** reachability has no spelling; a bounded `k`-hop form *is* writable and answers a fixed-depth question, not the rule (detailed below, with the refutations of two sharper claims this row previously made). **What is struck, with the CEL that does the job:** registry membership — `string(new) in facts.registry.topics.value` over a `cardinality: set` fact, already shipped green at `examples/packs/service-catalog/.assent/packs/catalog/rules/ownership.yaml:21`; keyed attribute lookup — either a purpose-built provider (`builtin/resource-owner`, exercised in both polarities by `examples/archetypes/referenced-resource-ownership/`) or `facts.<p>.<n>.value[key].field`, which compiles and is lint-clean because `internal/lint/facts_ref.go`'s D-051 shape check permits arbitrary navigation past `.value` and only forbids indexing `facts` itself; set difference — `oldEntry.acls.filter(a, !(a in entry.acls)).size() == 0`; named intermediates — no `cel.bind`, but re-deriving the sub-expression inside each leaf is semantically identical and compiles. **The sharpest finding is a distinction, not a rule:** same-changeset **cross-file** reasoning fails for **input availability**, not expressiveness — the evaluation unit is one file (`change.ChangeSet` is documented "for one file", `internal/change/diff.go:129`; `assent run` strips one `--subject file:<path>`, `cmd/assent/run.go:266`, and diffs it alone, `:293`) and **REQ-E11-S05-01 pins the Rego module to the identical `EvaluationInput`** with the tier fenced to "declared data, no I/O". **A Rego module therefore fails that rule identically, so it is struck from E11's justification too** — the fix is an input decision, which E11's non-goals fence, not a backend decision. Corroborating: the one committed illustration of the escape hatch, `examples/policies/rego/bounded_change.rego`, is **entirely tier-1 expressible** — both `violations` rules are per-change predicates and `examples/policies/declarative/bounded-change.yaml` is the same rule already in the envelope. **The strongest single piece of evidence, and the one that sizes the epic, is the graph shape.** On the `assent run` path document-mode `walkNode` emits a Change **only where two scalars differ** — a sequence on either side makes the whole ChangeSet **opaque → REVIEW** before any rule runs (`internal/change/diff.go`) — and collection-mode `DiffEntries` is reached only from `internal/adoptertest`, so `old`/`new`/`entry`/`oldEntry` and every `changes[i].old`/`.new` bind **scalars**. That does **not** starve a graph rule, because a flat `set` fact still carries structure: `edges: {type: string, cardinality: set}` returning `["orders|billing","billing|ledger"]` is a **fully declarable, in-contract adjacency inside `EvaluationInput` today** — the declaration is legal (`schemas/provider/v1alpha1/response.schema.json`), `fact.value` carries no JSON-Schema type constraint and `ResolveFactsChecked` cross-checks the *declaration* not the value (`internal/provider/resolve.go`), outputs are operator-authored (`internal/provider/config.go`), the `http` transport is live on the plain run path with **no `--checkout`** (`cmd/assent/provider_host.go` `providerCallFor`), and a set fact binds as a CEL list. Tier-1 CEL nonetheless cannot answer the actual question over it: **CEL has no recursion, fixpoint, fold or user-defined function, so unbounded reachability has no spelling** (`transitiveClosure` → `undeclared reference`; the four comprehension macros iterate one level and cannot call themselves). **Stated precisely, because two drafts of this record overreached and both were caught by independent review:** a *bounded* `k`-hop check **is** expressible and does **not** need the string decomposition CEL lacks — over a finite in-input candidate set (a `nodes` set fact, the same construction as `edges`), decode is replaceable by **encode-and-compare**: `nodes.value.exists(m, nodes.value.exists(n, (string(new)+"|"+m) in edges.value && (m+"|"+n) in edges.value && (n+"|"+string(new)) in edges.value))` compiles **and evaluates** under the real `cel.CostLimit(1_000_000)` to `true/true/true/false` over the fixture above, and `nodes.value.filter(m, (string(new)+"|"+m) in edges.value)` recovers an edge's far end as `[billing]`. Both primitives (`+` on strings, `in`) were already in this record's own function census, so the claim that decoding was a second independent barrier was internally inconsistent as well as false. **The real ceiling is `k`, and a third draft got its cost wrong too** — it claimed `O(|N|^(k-1)·|E|)` "exhausts the cost budget on any real graph". Wrong complexity class and wrong conclusion, because the census had omitted the surface's only value binder, `[expr].all(v, …)`: binding each BFS frontier once per level makes cost additive across levels, and measured under the real `cel.CostLimit(1_000_000)` a ring `|N|=50, deg 5` costs 89,551 at `k=10`, 235,297 at `k=20` and 686,317 at `k=50` — roughly linear in `k`, and at `k=50 ≥ |N|` CEL is **not approximating at all, it decides reachability exactly**, in 69% of budget. The practical `k` collapses around `|N|≈200` (`k=10` at 46% of budget, `k=20` exceeds). Recorded because a reader sizing this epic is entitled to ask "would CEL suffice for *our* graph?" and the previous sentence foreclosed that question with an assertion measurement refutes; it is **not** offered as a second reason. **What carries the verdict is one property, now measured rather than recalled: the iteration count of a tier-1 CEL expression cannot be made data-dependent.** `reduce`, `transformList`, `transformMap`, two-var `all(i,x,…)`, `range`/`lists.range` and `cel.bind` are all `undeclared reference`; `for` is a `reserved identifier`; there is no fold, self-reference or generator; so depth is a **syntactic** property, hard-capped by cel-go's parser recursion limit of 250 (`expression recursion limit exceeded: 250` at depth 260, depth 200 still compiles). That a fixed `k` really is an approximation when the data outruns it is measured too: on a 4-cycle the `k=3` form evaluates `false` and the `k=4` form `true`. **Rego answers the unbounded question with `graph.reachable` — pure and deterministic — and that single gap is the whole justification.** **An input that is in contract and available today, over which CEL can only approximate and Rego decides, is exactly the per-rule evidence D-017's gate demanded — so E11 has TWO unconditional justifications (folds and graphs), neither waiting on any open question.** Deliverability caveat, stated because this row makes the same distinction for sub-shape B1: **no provider in the corpus ships an encoded adjacency today** — that one *can* follows from the provider contract, the same inference used to strike B1, not from a shipped example. Options considered: **(a)** record all four shapes as exceeding, the reading D-141's unlock invites (rejected — three are demonstrably expressible and an unfalsifiable ceiling claim is the defect this story exists to prevent); **(b)** strike set-difference **conditionally**, so that a narrowing answer to OQ-35 would return it to the ceiling (rejected on the second pass — both resolutions strike it: extending the entry binding makes CEL express it, narrowing makes it an input-availability failure that REQ-E11-S05-01 hands to Rego unchanged, so a conditional would have left a downstream story waiting on an answer that cannot change the verdict); **(c)** strike cross-manifest and set-difference **unconditionally**, strike half of multi-pass, keep folds and in-input graphs **both unconditionally** **(chosen)**. **Two rejected drafts are recorded because the same failure produced both, with the sign flipped, and only independent review caught either.** Draft 1 made the graph shape *contingent* on OQ-35/OQ-36 on the premise that "an adjacency needs a mapping-valued fact" — it does not; a set of encoded strings carries one inside the frozen declaration — which came from conflating a *provider-supplied catalog* (sub-shapes B1/B2, struck here as working and shipped) with **B3, which is specifically same-changeset cross-file *diffs***. It would have advised the operator to defer a 14-story epic on a premise that does not hold. Draft 2 replaced that with a second "independent reason" — that CEL cannot decode an edge, killing even a bounded two-hop check — **refuted by execution** (the encode-and-compare leaf above). Draft 3 replaced *that* with the exponential-cost claim above — **refuted by measurement**. The common cause across all three is one habit: **reaching for a second independent reason when one sufficient reason was already in hand**, and then applying an **asymmetric evidentiary standard** to protect it — accepting awkward-but-working spellings when they *struck* a shape (A2's re-derivation, B2's dynamic index) and rejecting them when they would have *narrowed* one this record wanted to keep. The verdict was right in all four drafts; the supporting argument was wrong in three. It now rests on one measured property and no supporting argument at all, which is the form it should have taken first. The correction to A2 runs the same way: the value binder `[expr].all(v, …)` removes the evaluation-cost half of A2's residual, so **A2 is struck more firmly than the first draft struck it**. Binds later stories: **S05** must not be widened to carry cross-manifest data; **S07**'s violation shape must support a fold result and a path/cycle witness, not a cross-manifest reference; **S12** must correct ADR-0002's `rego` bullet, which calls the tier an "escape hatch for **cross-entry checks**" — inaccurate for the shipped input contract; **S11** must label the unquarantined example a shape illustration, never evidence of need. **Binds E11-S04, whose denylist is not yet written: `graph.reachable` MUST be allowed**, with `split` alongside it — both pure and deterministic. `graph.reachable` is the one that carries the justification (it closes the graph at any depth); `split` is a convenience for rebuilding the adjacency. A capability set drafted from "deny anything unfamiliar" would strike out the epic's own strongest justification. Recorded in the S04 section of the epic spec, not only S01's. **That floor is held by REVIEW, not by a gate, and this row says so rather than inventing an enforcement path:** REQ-E11-S04-02's committed golden detects a *change* to the allowed set (so the sandbox cannot silently widen) and cannot detect an *omission* — a golden written without `graph.reachable` stays green forever. It says nothing about judgment call (d), since *which* builtins are callable is orthogonal to *where* the evaluator lives. Two residuals raised, neither decided, **neither gating any verdict here**, and neither the escalated rule-7 (d1)/(d2) question: **OQ-35** (the `entry`/`oldEntry` binding asymmetry — a silent `assent test` / `assent run` divergence; set-difference is struck either way and the graph shape needs no entry tree) and **OQ-36** (the frozen provider declaration has no object/map type, yet the authoring surface and `builtin/repo-file` together permit a mapping-valued fact). Also flagged, not edited (out of lane): `REQ-DEM-S05-04` calls the provider-visible tree the "merged-result checkout"; the code reads `<root>/head`, documented at `cmd/assent/checkout.go:44` as "the MERGE-REQUEST HEAD". This lane writes no Go, adds no dependency and touches no schema. Revert: delete `docs/planning/rego-tier-ceiling.md` and the D-156 narrowing text from the E11 spec — which restores an epic justified by four shapes, three of which this record shows are not real. |
+| D-157 | 2026-08-23 | **"Reaches pull requests" is now a SHARED, structural check (`hack/lib/pr_reach.sh`), the three PR-visible text gates CROSS-PIN each other's steps, and the fixed-string step check is replaced by an anchored `run:`-command match (GATES3).** Three residuals, each *demonstrated* by an independent reviewer on an earlier lane and each deliberately left unfixed there, all living in the same three files — `hack/lint/workflow_pins_test.sh`, `hack/audit/aud2_exitgate_test.sh`, `hack/examples/dogfood_wiring_test.sh`. **(1) The substantive one.** Two of the three answered "am I reachable on a PR?" with `grep -qE '^[[:space:]]+pull_request:'` over the workflow's `on:` block; a reviewer added `paths: ['internal/**']` under the trigger and measured **rc=0** — the trigger is present, the grep is satisfied, and the gate is disarmed for every PR that touches only `Taskfile.yml` or `.github/workflows/**`, which is exactly the class of PR these gates exist to grade. `types: [closed]` is the same defect by another route, and the grep's `[[:space:]]+` is indent-blind, so a `pull_request:` nested under `workflow_call.inputs` satisfied it too. **The third gate did not answer the question at all** — `workflow_pins_test.sh` asserted its step was present and undisarmed and never that the workflow carrying it runs on a PR; this is new coverage there, not a strengthening, and the brief that commissioned this lane assumed otherwise. **Decision on meaning:** a workflow "reaches PRs" when it has a top-level `pull_request:` trigger carrying **no** `paths:`/`paths-ignore:`, a `types:` list that is absent or a **superset** of GitHub's defaults (`opened`, `synchronize`, `reopened`), and no branch filter excluding `main` — and when the target job carries neither a job-level `if:` **nor a job-level `needs:`** (a dependency that skips on PRs skips its dependents, defeating all three gates at once while every other assertion stays green). **Deliberately still accepted**, stated so a reviewer does not read the narrowing as wider than it is: `on: pull_request` and `on: [push, pull_request]` (the inline forms cannot carry a filter, so they are strictly safer than the block form), the quoted `"on":` key, a `types:` superset, `branches:` listing the literal `main`, `branches-ignore:` sparing `main`, block-scalar `run: |` invocations, arbitrarily long comment blocks inside a gate step, and step-level `if:` on *other* steps (`verify.yaml`'s changelog gate is legitimately PR-excluded). **Deliberately narrower than GitHub:** a `branches:` glob covering main without the literal token (`['ma*']`) reds, because a bash gate cannot honestly evaluate GitHub's glob semantics, and a flow mapping or anchor in the `on:` block is **refused** (distinct code) rather than guessed at. **(2)** Each gate pinned only its OWN step, so a PR deleting one of the other two was invisible to the gate that still ran — caught locally by `task check` and on push by `release-exitgate`, hence a gap and not a hole. Each gate now asserts all three steps; the mutation matrix is the full cross-product (3 deleted steps × the 2 observers that still run) rather than a diagonal. **(3)** `aud2_exitgate_test.sh`'s `check_pr_wiring` located its step with `grep -nF -- "$SELF"` — a search for the script *name*, which the step's own comments satisfy. Measured by the reviewer: with the `run:` line commented out it still failed, but reported **"WITH ARGUMENTS"** instead of "does not invoke", sending an operator to look for an argument that does not exist. The anchored form from `dogfood_wiring_test.sh` is ported back and shared. **Why one lane and one helper, not three fixes:** the INBOX residual explicitly asked for a single shared helper so the next gate author inherits the strong check rather than copying the weak one; fixing one of three identical checks would have been misleading. **Judgment calls.** (a) The helper is **codes-only and prints nothing** — every caller owns its wording, because roughly twenty existing `expect_red` controls pin stderr fragments. (b) The 1..6 **line cap** `workflow_pins_test.sh` used to bound step isolation is replaced by a structural invariant — exactly one `run:` key and no `uses:` key, both of which actionlint itself flags — because cross-pinning made the helper isolate the aud2 and dogfood steps, whose comment blocks are a dozen lines long, and no cap admits an honest step of theirs while rejecting a merged one. (c) The helper is held to `workflow_pins_test.sh`'s preamble rules (**bash 3.2**, portable ERE, no `git`, no `grep -q` on a pipe) rather than aud2's ≥4.3 floor: that gate runs first in CI before any toolchain, and the other two callers do not refuse bash 3.2, so a bash-4 construct here would silently weaken them on a maintainer's machine. (d) It is a **line-oriented reader with a structural bias, not a YAML parser** — it says so in its own header and fails closed on anchors, aliases and flow mappings, because an honest narrow gate beats an overreaching one. (e) No new `check:` stage and `CHECK_STAGES` untouched: all three gates were already wired. **Evidence:** 44 helper-level probes plus, in the gates themselves, 13 new red controls in aud2 (`CONTROL_FLOOR` 38→51, text-only 32→45, both floors met exactly), 15 in `workflow_pins_test.sh` and 12 in `dogfood_wiring_test.sh` — each pinned to its own finding text or rc — and, in every gate, **green** controls for the legitimate shapes above, so the new checks are provably not always-red. **One fail-open was found by building a mutant rather than by reasoning, and it was in this lane's own widening:** accepting a block-scalar `run: |` invocation naively means a bare `bash <script>` line anywhere in the job satisfies the step check, including inside another step's multi-command `run: |` body where `echo skip && exit 0` a line above would mean the gate never runs — measured rc=0. The block form now counts only as a block's **sole** command, and all three gates carry that mutant. Revert: delete `hack/lib/pr_reach.sh` and restore the three gates' local readers — which restores the `paths:`-filtered bypass, the self-only pinning, and the misreport. |
 | D-158 | 2026-08-23 | **CI-TOOLCHAIN — `verify` was red on every PR from a golangci-lint/Go skew; the remedy is to bump `GOLANGCI_LINT_VERSION` v2.12.2 → v2.13.1 and KEEP `go-version: stable`.** Symptom: PR #85, a six-file Markdown diff with **zero Go bytes**, failed `verify` with `/opt/hostedtoolcache/go/1.27.0/x64/src/crypto/internal/randutil/randutil.go:11:2: could not import math/rand/v2 (… method must have no type parameters) (typecheck)` — the failing path is inside the **Go toolchain's own source tree**, so no author change can fix it and re-running cannot clear it. `Analyze (go)`, `Analyze (actions)` and `CodeQL` all passed on the same run: the tree compiles clean under Go 1.27, only the linter chokes. **Mechanism**: golangci-lint typechecks the standard library with the `go/types` it was **compiled with**, not the `go` on `PATH`. GitHub's `stable` rolled 1.26 → 1.27.0 between this repo's last green `main` run (2026-08-19) and 2026-08-23; the v2.12.2 release binary is built with go1.26.x and cannot read the 1.27 stdlib. **Reproduced locally, not reasoned** (Go 1.27.0 SDK on `PATH`, `GOTOOLCHAIN=local`, whole tree): v2.12.2 → **panic** in `pkg/goanalysis/runner_loadingpackage.go:335` inside `go/types.(*Checker).Files`, exit 2; official v2.13.1 asset (`built with go1.27.0`) → **0 issues**, exit 0; `golangci-lint config verify` → exit 0, so the v2 config schema in `.golangci.yml` needs no migration; v2.13.1 also → **0 issues** against local Go 1.26.6, so the bump is safe for contributors who have not moved; and `go install …@v2.13.1` under Go 1.27.0 → 0 issues, which is the **`release-exitgate`** path (that job builds the binary rather than using the action, and `if: github.event_name != 'pull_request'` / RELSE-08 means no PR ever exercises it). **Diagnosis heuristic worth keeping**: golangci-lint's `go.mod` carries the comment *"the minimum Go version must always be latest-1"*, so its `go` directive is a machine-readable "supports Go 1.N+1" signal — v2.12.2 says `go 1.25.0` (supports ≤1.26), v2.13.1 says `go 1.26.0` (supports ≤1.27), and upstream commit `42a0530` in v2.13.0 is literally "go1.27 support". **Options considered.** (A) *bump the linter* — CHOSEN: treats the root cause, is a **one-line** diff because the version is single-sourced at workflow scope (D-128), fixes BOTH exposed sites (the `golangci-lint-action` in `verify` and the `go install` in `release-exitgate`) at once, and the risk it carried — new findings from a newer linter blocking every merge, since `golangci-lint` runs inside `task lint` inside `task check` — was **measured at zero** on the whole tree under both Go versions. (B) *pin `go-version: 1.26.x`* — REJECTED as the primary: it needs two pins (`verify.yaml:56` and `:171`), leaves the class of bug live, undercuts the stated reason `stable` is there (`# govulncheck needs it`, with `setup-go` exporting `GOTOOLCHAIN=local` so a pinned toolchain can fail to `go run` a tool whose module requires a newer Go — unverified, and moot under (A)), and trades a loud recurrence for **silent indefinite drift onto an unsupported Go** in a repo whose posture is govulncheck + cosign + SLSA + Scorecard. (C) *both* — REJECTED as gold-plating: (A) alone is measured green, and a second simultaneous remedy would make a still-red PR ambiguous. **Per-file sweep of `go-version: stable`, stated rather than silently skipped:** `verify.yaml:56` and `:171` were the only exposed sites and are fixed by the env bump without touching either line; `schemas.yml:57` (runs `go test` + ajv, no linter), `vulncheck.yaml:30` (govulncheck only — `stable` is actively *desirable* there) and `codeql.yaml:45` (CodeQL, which passed on 1.27.0) carry no golangci-lint and are NOT exposed; `release.yaml` uses `go-version-file: go.mod` and is unaffected. `hack/lint/workflow_pins_test.sh` asserts `TASK_VERSION`, action SHA pins and step wiring but **not** `go-version` or `GOLANGCI_LINT_VERSION`; it passes on this change. **Revert is (B), not bare v2.12.2** — reverting the env line alone restores a known-red state: revert = `GOLANGCI_LINT_VERSION` back to `v2.12.2` **and** pin `verify.yaml:56` + `:171` to `go-version: 1.26.x`. **Residual risk, stated plainly:** when `stable` rolls to Go 1.28, v2.13.1 breaks identically. The repo finds out because `verify` reds on **every** PR including zero-Go diffs — loud and immediate, with the signature recorded in `verify.yaml`'s env comment and the fix being one env line. Nothing detects it *earlier*: dependabot's `github-actions` ecosystem updates `uses:` refs, not `env:` literals (backlog `CI-TOOLCHAIN-F01`). Accepted on purpose over (B)'s failure mode. Note also the pre-existing local/CI linter skew — `Taskfile.yml`'s `lint` task is bare `golangci-lint run ./...` against whatever binary a contributor has installed, so this pin has never governed local `task check`; deliberately not changed here (that file was owned by a concurrent lane). |
 | D-159 | 2026-08-23 | **ORPHAN — `release-verify-test` was a gate invoked by nothing (D-124 again), and it is wired into `task check` in its three OFFLINE modes, not its default `all`.** Finding: `Taskfile.yml` defined `release-verify-test` — the **only** test of `hack/release/verify-artifacts.sh` — and no caller existed anywhere: not `check:`, not `CHECK_STAGES` in `hack/audit/exitgate_test.sh`, not `.github/workflows/**`, not the push-only `release-exitgate`. That script is not incidental: **`SECURITY.md:61` publishes it as the procedure release consumers run** to check artifact checksums, the stamped `assent version` and cosign signatures, and D-153/AUD2-F01 had just proved that published verification instructions rot silently. Measured before fixing, as the lane required: the gate was **green**, so this is a wiring defect only — nothing was being papered over. **Why not the `all` default.** `verify_test.sh` with no argument adds `test_snapshot_pass`, which shells out to `task release-snapshot`: `go install github.com/goreleaser/goreleaser/v2@…` on any machine without it (**network**, in a gate that runs before every commit), a `before: hooks: go mod tidy` that **rewrites `go.mod`/`go.sum` in the middle of `task check`**, `--clean` on the developer's `dist/`, and a five-target cross-compile (10s here with warm caches and goreleaser already installed; minutes cold). A flaky or network-bound stage is worse than a missing one, so `check:` runs `negative`, `cosign-skip-when-absent` and `readme` — REQ-E9-S12-02/03/04, all offline, together well under a second. **Consequence, stated precisely: REQ-E9-S12-01 (the real snapshot→verify round trip) is not gated per-commit in `task check`; it runs in push-only CI via `hack/release/exitgate_test.sh:33-34` (the `release-exitgate` job, `if: github.event_name != 'pull_request'`) — automated but not PR-visible, i.e. the RELSE-08 blind spot.** Those two lines are literally `task release-snapshot` then `task release-verify`, which is the `Verify:` string the spec gives the requirement (`openspec/specs/p5-e9-distribution/spec.md:441-442`), so nothing here needs a new gate built — an earlier draft of this row claimed the requirement was covered by no automation at all, which was false, and acting on it would have meant a future lane duplicating `exitgate_test.sh:33-34`. What this lane declines to do is move that L1 round trip into a per-commit gate: it cannot be, for the network/`go mod tidy`/`--clean` reasons above. Narrowing the RELSE-08 exposure for this requirement is a separate question from D-159. **Pinning.** `CHECK_STAGES` goes 20 → 21 in the same commit as the `check:` line (the AUD-S18/RELSE-08 lockstep), and `STAGE_BODY_PINS` pins the body **per mode** rather than by the bare script path — a single `bash hack/release/verify_test.sh` pin would stay green if two modes were dropped *and* if the stage were reverted to the unrunnable-in-check default. Three mutation controls prove it: deleting the `check:` line reds `check_check_wiring` by stage name, gutting one of the three modes reds `check_stage_bodies` while the other two still run, and the same deletion applied to the real tree reds the real gate at rc=1. **Also fixed, minimally, because wiring made it matter:** `verify_test.sh` wrote its captured stdout/stderr to fixed `/tmp/verify-{tamper,nosig}.{out,err}` and then **grepped** them; harmless while nothing ran it, but this repo runs several lane worktrees whose `task check` invocations overlap, and a concurrent run truncating `/tmp/verify-nosig.err` at open would fail the other run's `skip.*cosign` grep spuriously. Scratch files now live in each run's own `mktemp -d` (invisible to `verify-artifacts.sh`, which globs only `*.tar.gz`/`*.zip`) and are removed by the existing `RETURN` trap. |
 | D-160 | 2026-08-23 | **UNIV-COSIGN — the cosign signer-pin gate asserted an EXISTENTIAL property where the guarantee it publishes is UNIVERSAL, so it certified nothing about a file's second `cosign verify-blob`; `hack/release/install_cosign_pin_test.sh` now grades EVERY invocation in ALL THREE published files, statically and at runtime.** Substance first, and measured before anything was written: a scratch copy of each graded file with a **second, unpinned** `cosign verify-blob` spliced IN-BODY next to its real invocation (the splice shape matters — see UC-04 below) ran the gate to **exit 0** — `hack/install.sh` rc=0, `SECURITY.md` rc=0, `hack/release/verify-artifacts.sh` rc=0, the last of these being the shape a reviewer had already demonstrated on an earlier lane. **Every individual assertion in that gate was sound.** `has_flag` grepped the whole folded extraction, so a pinned sibling satisfied it; `one_value`'s `sort -u` collapsed two agreeing values to one, so the D-153 drift comparison saw a consistent file; section 0 **printed** the extracted invocation count and asserted nothing about it; and 4b/5d's stub-log checks were positive-only greps, i.e. the same existential shape at runtime, where a second unpinned call leaves the pinned call's log line intact. The conjunction of sound existential assertions is still an existential assertion. **This is the AUD2-S05 quorum defect one layer out: not a wrong assertion, a wrong quantifier**, and it predates both AUD2-S03 and AUD2-F01. **`SECURITY.md` was worse than the other two** — it fed only the drift comparison and had **no invocation-level grading at all**, so an unpinned recipe published to adopters was invisible to the gate that exists to police the recipe. **Property chosen: "every `cosign verify-blob` invocation in every graded file carries `--certificate-oidc-issuer`, `--certificate-identity-regexp` and `--bundle`, EACH WITH SECURITY.md's published value".** The value half is not decoration: `--certificate-identity-regexp ''` carries the flag and matches every Fulcio identity ever issued, and `one_value`'s `sort -u` does not catch it either, because an empty capture is not a line and the file still reports exactly one distinct value — a presence-only universal check would be the same defect one level down, so each invocation's own extracted value is compared against the published pair (reported `WRONG-VALUE[...]`, distinct from `UNPINNED[...]`). Options considered: **(a)** the remedy recorded when the finding was filed — assert the extracted invocation count is **exactly 1** per file (**REJECTED AS FACTUALLY WRONG — do not implement it in a later lane; it would red `main` on the day it lands.** `SECURITY.md` legitimately publishes **two** — one over the archive, one over `checksums.txt`, which is what covers the SBOMs listed inside it — so that assertion reds `main` on the day it lands, and the natural repair is to weaken it again); **(b)** universal quantification over invocations **(chosen)** — strictly stronger than (a) where (a) is true, and it keeps holding when a file legitimately grows a third correctly-pinned call. **Enforcement, per D-128, is one predicate**: `pin_violations <file>` prints one line per problem and nothing when the file is clean, so callers grade its OUTPUT and the identical function is asserted empty against the tree and non-empty against a mutant with no `set -e` games; `assert_all_pinned` is the thin failing wrapper; `log_unpinned_lines` is its runtime twin over the stub-cosign argv log. **Classification is fail-CLOSED, which is the part that carries the guarantee.** The candidate extractor is deliberately left un-narrowed (every non-comment line mentioning `cosign verify-blob`, continuations folded), because anything the *denominator* drops is a hole. A candidate is an invocation when the folded text begins with `cosign verify-blob`; the ONE waved-through non-invocation shape is a markdown inline-code mention (`` `cosign verify-blob` ``, which is how `SECURITY.md`'s capability table names it); **on a line carrying NO backticked mention, anything else — `foo && cosign verify-blob …`, a here-doc line, an un-backticked prose sentence — is reported UNCLASSIFIABLE rather than skipped**, because "this gate cannot tell whether that call is pinned" must never read as "that call is fine". **That scoping is not cosmetic, and the unscoped version of this sentence was FALSE (R3-01, caught by review on the round that added the honest banner).** The exemption tests whether the substring `` `cosign verify-blob` `` appears **anywhere on the line**, not whether the line is prose, and it is tested BEFORE the command-position and multi-token checks. So a line carrying a backticked mention AND one or more LIVE calls is exempted, neither graded nor refused: measured by splicing ``See `cosign verify-blob`: cosign verify-blob --bundle A.json a && cosign verify-blob --bundle EVIL.json evil`` into `SECURITY.md` — `occurrence_count` = 2 by the definition the banner itself states, `pin_violations` EMPTY, **whole gate rc=0**, while the banner reported that line among those "exempted as backticked prose". The **static** defect is not markdown-specific — splicing a live unpinned call with a trailing backticked mention into `hack/install.sh` gives candidates=2, invocations=1, `pin_violations` EMPTY — but the **whole-gate green is** markdown-specific, and the distinction is stated because a looser sentence here would itself be falsifiable: in that shell script the run reds at §4b for an unrelated RUNTIME reason (the spliced call executes and its bundle is absent), whereas `SECURITY.md` is a document with no runtime twin, which is why rc=0 survives there. Measured both ways rather than inferred from either. **Narrowing the exemption needs quote- and markdown-aware parsing — the machinery that produced UC-01/02/03 — so it is deliberately NOT patched here.** It is instead disclosed as residual (1) in the PASS banner, ahead of the variable/`eval`/fragment spellings, because it is the residual that is actually REACHABLE in these three files while those are not present in any of them. The banner also no longer labels an exempted line "prose": the branch it took is a fact, "prose" was an inference, and R3-01 is the case where that inference is wrong. **This is UC-07 doing its job on its own author:** the claim was falsifiable, it was checked, and the gate is now incomplete-and-honest rather than complete-and-wrong. Accepted cost, stated rather than discovered later: a *correctly pinned* invocation written off command position also reds. That is the intended direction of error for a security gate over three files carrying four invocations in one canonical style, and the message names the fix. **Anti-vacuity, because a lane whose entire deliverable is "make a gate stricter" is maximally exposed** (this repo's #1 review finding is an assertion that cannot fail — D-124, AUD-S18): section 2b runs **eight** mutants against **each** of the three files and 2c runs a ninth, and they were chosen for **branch** coverage of the new predicate rather than for variety of shape — (a) a second **unpinned** invocation must red, name the file, quote the offending command, and produce **exactly two** violations so the pinned siblings are provably not flagged; (b) a second **correctly pinned** invocation must stay green **and** must raise the extractor's invocation count by one, without which (b)'s green could mean "the extractor never saw it"; (c) an occurrence off command position, appended **fully pinned on purpose** so the only thing that can redden it is the classifier itself; (d) every invocation deleted → `NO-CANDIDATES`; (e) the continuation fold broken → `FOLD-BROKEN`, asserted **not** to also report `UNPINNED`, because conflating "the extractor truncated this" with "the pin is missing" sends the next maintainer to the wrong file; (f) every invocation displaced off command position → `NO-INVOCATIONS`; (g) a second invocation carrying both flags with an **empty** identity regexp → `WRONG-VALUE`, the hostile shape a presence-only check waves through; (h) a second invocation carrying both flags with a **foreign OIDC issuer** → `WRONG-VALUE` on the issuer half; and 2c strips the backticks from `SECURITY.md`'s prose mention and requires the same row to fail closed, proving the exemption keys on the backticks and is not a blanket bypass. The runtime twin has its own vacuity control (an unpinned line appended to a copy of the stub log must be seen). **One real defect was caught by this section during the lane and is recorded because it is a trap for the next author**: `log_unpinned_lines` was first written with `awk -v id="identity_re=${sec_identity}"`, and **awk processes escape sequences in a `-v` assignment**, so the pin's `github\.com` arrived as `github.com` and matched nothing; the values now reach awk through `ENVIRON`. **Stated limit, same posture as D-154's**: the denominator is the literal string `cosign verify-blob`, so an invocation spelled through a variable (`"$COSIGN" verify-blob …`), built by `eval`, or assembled from fragments is invisible to this gate. Widening the trigger to bare `verify-blob` was considered and **rejected** — it buys one hypothetical no file uses, and turns any future `SECURITY.md` sentence saying "verify-blob" outside backticks into a red gate, whose repair would be to loosen the classifier. **Nothing outside the gate changed**: `hack/install.sh`, `SECURITY.md` and `hack/release/verify-artifacts.sh` are byte-unchanged, and all four of their invocations were already pinned — this row closes a hole in the *checker*, not in the checked. The stage `release-install-cosign-pin-test` was already wired into `task check` and pinned in `hack/audit/exitgate_test.sh`'s `CHECK_STAGES`, so no wiring changed either. **SECOND ROUND — the first version of this fix REPRODUCED the very defect it closes, one level down, and independent review caught it before merge.** `has_flag` grepped the whole FILE; the replacement grepped the whole LINE. Both are existential; only the scope shrank. **UC-01**: one folded line was graded as at most ONE invocation, so `cosign verify-blob <both pins> --bundle a.json a && cosign verify-blob --bundle EVIL.json evil` began with `cosign verify-blob` (not UNCLASSIFIABLE), carried `--bundle` (not FOLD-BROKEN), carried both flag strings (not UNPINNED) and yielded the published values (not WRONG-VALUE) — **green**, in same-line, `;`-separated and backslash-folded forms, on all three graded files. Worse, the **full gate exited 0** for `SECURITY.md`: the two shell scripts were incidentally caught by the runtime twin (`log_unpinned_lines` at §5d), but **SECURITY.md is a document and has no runtime twin**, so the hole was unmitigated precisely on the file this row calls "the copy-paste recipe adopters run by hand" — D-153's exact incident class — while the gate printed "EVERY cosign verify-blob invocation ... is pinned", false as printed. The stated-limit paragraph did not cover it: it enumerated `$COSIGN`, `eval` and fragments, not `&&` chaining, and **leading** `&&` was explicitly handled (mutant (c) → UNCLASSIFIABLE), so the operator had been considered and only one side handled. Closed by grading per **OCCURRENCE** (`occurrence_count` + a new `MULTI-OCCURRENCE` violation that fails closed on any line carrying two calls) rather than per line; counting inside an already-triggered line uses the shorter `verify-blob`, so a second call spelled `cosign  verify-blob` or `"$COSIGN" verify-blob` and chained onto a pinned one is caught too, which the literal file-level trigger would miss. **UC-02**: `extract_issuer`/`extract_identity` anchor on a greedy `.*`, so the LAST value on a line wins — a hostile `--certificate-identity-regexp ''` placed FIRST was masked by a correct value placed second, **the extraction direction favoured the attacker**. Closed by `flag_value_tokens`, which returns EVERY value of every flag on the occurrence; each must equal the published one, so a repeated flag with an empty value first now reds. **UC-03 (P2, the erosion path)**: a CORRECTLY pinned call written with **double quotes** was refused as `WRONG-VALUE ... identity=<empty/unparsable> ... (an empty regexp matches every Fulcio identity)` — a true refusal with a **false reason**, and the repair a maintainer reaches for on that message is widening the extractor. Both quote styles are now accepted (double quotes are correct shell for this value: it contains no `$` and no backtick), and a **bare** value is diagnosed as `UNQUOTED-VALUE`, a QUOTING defect, never as a wrong or empty one — a gate that misdiagnoses erodes faster than one that refuses. **UC-04**: this row's "rc=0, rc=0, rc=0" reproduction figure is **splice-shape-sensitive** and is stated as measured: it holds for a second unpinned call spliced **in-body** next to the real one. An EOF-appended mutant reds the two shell scripts for an unrelated runtime reason, so the figure should not be read as holding for any second unpinned call. The same sensitivity is why the UC-03 double-quoted mutant reds the two scripts through the full gate (the spliced call actually RUNS and its fixture bundle is absent) while `SECURITY.md`, having no runtime, is the clean end-to-end proof at rc=0. The classifier's fail-closed posture on off-command-position occurrences was independently adjudicated KEEP, since §2c proves the prose exemption keys on the backticks and cannot be widened silently. **The lesson, recorded because it is the whole point of the lane:** a fix for an existential-where-universal defect is itself maximally exposed to the same defect at the next scope down — file, then line, then occurrence — and the only thing that caught it was a reviewer building the chained-call mutant that neither the 20-row external matrix nor the 25 in-gate mutants contained. **THIRD ROUND (UC-05..UC-09), and the reason this row now reads the way it does.** **UC-05**: `occurrence_count` compared whitespace-delimited fields to `verify-blob`, found one, and concluded **singularity** — when all it had established is that it did not find a second. `cosign "verify-blob"`, `cosign 'verify-blob'` and `cosign verify-blob""` are the same command to the shell, and each hid a chained unpinned call from the count. Measured against the round-2 gate on **all three** files at whole-gate level: **rc=0, rc=0, rc=0** — worse than first reported, because `A && B` short-circuits and `set -e` does **not** fire on a non-final member of an AND-list, so even the two shell scripts' runtime twin missed it. Closed by stripping shell quotes before the field compare, which is **a spelling patch, not a terminator, and is labelled as one in the code**. A structural terminator was sought and **ruled out with evidence**: refusing any graded line carrying a command separator would red the REAL files, since `hack/install.sh` and `hack/release/verify-artifacts.sh` both legitimately end their genuine invocation with an or-else `die` tail. **No structural terminator exists for this gate**, so completeness is not available and must not be claimed. **UC-07 is therefore the durable fix, and it is a change of posture rather than of logic.** The `PASS:` banner was printed unconditionally and asserted "EVERY cosign verify-blob OCCURRENCE ... is pinned" plus "a second unpinned call reddens whether it sits on its own line or is chained onto a pinned one" — a **universal claim bound to no assertion**. Under UC-05 that banner did not merely overstate: on a green run it printed something **false**, which is strictly worse than printing nothing, and it is this repo's #1 defect class (an assertion that cannot fail) wearing a different hat. The banner now reports **OBSERVED** counts per file (occurrences found, classified-and-graded, prose-exempt, refused), lists **ASSERTED** properties each of which is shown to fail on a mutant, and states the **NOT ASSERTED** residual in the same breath: this gate finds calls by a literal string and counts quote-stripped words, so a call spelled through a variable, `eval`, or fragments is not seen and not graded, and the counts are what was classified — **not a proof that nothing else exists**. When a fifth spelling turns up, the gate is then **incomplete rather than wrong**, and incomplete is recoverable. **UC-06**: a TRAILING comment mentioning `verify-blob` fired `MULTI-OCCURRENCE: … has 2 verify-blob calls chained on ONE line` — fail-closed but **false as printed**, since `cosign_candidates` only drops lines whose FIRST non-space character is `#`. That is the UC-03 misdiagnosis shape recurring **inside the UC-01 fix**. The message now says TOKENS, names both possible causes, and names the correct repair; excluding trailing comments was rejected as it needs quote-aware parsing, which is the machinery that produced UC-01/02/03. **UC-08**: `shellcheck` SC1087 ×2 (error severity) on `flag_value_tokens` — `"$flag[[:space:]]…"` parses as an array subscript; `${flag}` silences it. Cosmetic: no shellcheck gate exists in this repo. **UC-09**: two stage-count figures reported during this lane ("25", then "28") were **both wrong** and neither came from a committed file — they counted `task: [` lines in a run LOG, which includes nested task invocations. Measured: the Taskfile `check:` block has **21** `- task:` entries and `CHECK_STAGES` has **21** stage names; they agree, and both files are byte-identical to `origin/main`. There is no stage-count mismatch and this lane could not have caused one. **THE PATTERN, recorded because it is the lane's most transferable output:** four P1s, three of them the same scope error at successively finer scopes — file (`has_flag`), line (round 1), then occurrence-spelling (round 2) — each found by review and none by the author's own mutant matrix, because each matrix was built from the shape the previous round had just learned. The general lesson is not "add another spelling": it is that **when a gate's denominator cannot be made provably complete, the gate must report what it classified instead of asserting what exists.** That is now enforced where it is hardest to ignore, in the banner the gate prints on every green run. Revert: restore `has_flag`, drop the per-occurrence grading and the per-invocation value comparison, and restore the two positive-only stub-log greps — which returns the gate to certifying that *some* cosign call in each file is pinned, a property that is compatible with an unpinned one sitting beside it. |
diff --git a/hack/audit/aud2_exitgate_test.sh b/hack/audit/aud2_exitgate_test.sh
index 968ac77b..3884f86f 100755
--- a/hack/audit/aud2_exitgate_test.sh
+++ b/hack/audit/aud2_exitgate_test.sh
@@ -109,6 +109,29 @@ WORKFLOW="$ROOT/.github/workflows/verify.yaml"
 # This gate's own `task check` stage, and the script the stage must invoke.
 STAGE="audit-aud2-exitgate-test"
 SELF="hack/audit/aud2_exitgate_test.sh"
+
+# D-157 — the PR-reach and step-wiring readers are SHARED with the other two
+# PR-visible text gates (hack/lint/workflow_pins_test.sh,
+# hack/examples/dogfood_wiring_test.sh). Sourced, not executed; it returns codes
+# and prints nothing, so every finding below keeps this script's own wording and
+# every existing mutation control keeps its pinned fragment.
+#
+# Two defects of the local copy this replaces, both demonstrated by reviewers:
+#   * PR reach was `grep -qE '^[[:space:]]+pull_request:'`, which a
+#     `paths:`-filtered trigger satisfies while disarming this gate for any PR
+#     that does not touch the listed paths (measured rc=0).
+#   * step presence was `grep -nF -- "$SELF"`, a search for the script NAME,
+#     which the step's own comments satisfy. It still went red when the `run:`
+#     line was commented out — but with "WITH ARGUMENTS", the wrong finding.
+#     hack/examples/dogfood_wiring_test.sh had already grown the anchored
+#     `run:`-command form; this is that form, ported back and shared.
+PR_REACH_LIB="$ROOT/hack/lib/pr_reach.sh"
+if [[ ! -f "$PR_REACH_LIB" ]]; then
+  echo "FAIL: missing $PR_REACH_LIB — the shared PR-reach/step-wiring helper (D-157). Refusing to run rather than certifying REQ-AUD2-S05-05 without it." >&2
+  exit 1
+fi
+# shellcheck source=../lib/pr_reach.sh
+. "$PR_REACH_LIB"
 # The named unit case AUD2-S04 added; TEST-02 is closed by its existence.
 CHALLENGE_TEST="TestClassifyStricterInterventionAddedChallengeEffect"
 
@@ -1268,99 +1291,149 @@ check_stage_pinned() { # <hack/audit/exitgate_test.sh>
   return 0
 }
 
-# extract_job <workflow> <job-name> — the body of a 2-space-indented job key.
-extract_job() {
-  awk -v name="$2" '
-    $0 == "  " name ":" { inj = 1; next }
-    inj && /^  [A-Za-z0-9_.-]+:[[:space:]]*$/ { inj = 0 }
-    inj { print }
-  ' "$1"
-}
-
-# isolate_step <job-block> <lineno> — the 6-space `- ` step containing a line.
-isolate_step() {
-  awk -v n="$2" '
-    /^      - / { start = NR }
-    NR == n { want = start }
-    { line[NR] = $0 }
-    END {
-      if (!want) exit 1
-      for (i = want; i <= NR; i++) {
-        if (i > want && line[i] ~ /^      - /) break
-        print line[i]
-      }
-    }
-  ' "$1"
-}
-
 # REQ-AUD2-S05-05: RELSE-08 not reproduced. release-exitgate carries
 # `if: github.event_name != 'pull_request'`, so anything that runs ONLY there is
 # invisible on pull requests — which is how AUD-S18's stale pin survived four
 # merges. This gate must therefore be a step of the `verify` job, which has no
 # such job-level guard, undisarmed.
+#
+# D-157: the reading is now hack/lib/pr_reach.sh's, shared with the other two
+# PR-visible text gates. The wording, and therefore every pinned control
+# fragment below, stays this script's own.
 check_pr_wiring() { # <verify.yaml>
   local wf="$1" rc=0
   [[ -f "$wf" ]] || {
     echo "  REQ-AUD2-S05-05: missing $wf" >&2
     return 1
   }
-  # The job-level guard is not the only way to lose PR reach: deleting
-  # `pull_request` from the workflow's own `on:` block removes it for every job
-  # at once, and every assertion below would stay green while the gate's entire
-  # pull-request coverage disappeared.
-  local trigger="$WORK/on.block"
-  awk '/^on:/ { ino = 1; next } ino && /^[A-Za-z]/ { ino = 0 } ino { print }' "$wf" >"$trigger"
-  if [[ ! -s "$trigger" ]]; then
-    echo "  REQ-AUD2-S05-05: the workflow's 'on:' block extracted empty — the trigger assertion would be vacuous" >&2
-    return 1
-  fi
-  if ! grep -qE '^[[:space:]]+pull_request:' "$trigger"; then
-    echo "  REQ-AUD2-S05-05: verify.yaml no longer triggers on pull_request — the gate's step and the job's missing if: are both irrelevant, because the workflow never runs on a PR at all (RELSE-08 by another route)" >&2
-    return 1
-  fi
 
-  local job="$WORK/job.verify"
-  extract_job "$wf" verify >"$job"
-  if [[ ! -s "$job" ]] || ! grep -q '^    steps:' "$job"; then
-    echo "  REQ-AUD2-S05-05: the 'verify' job block extracted empty or without a 'steps:' key — the PR-visibility assertions would be vacuous" >&2
+  # The job-level guard is not the only way to lose PR reach, and neither is
+  # deleting `pull_request` from the workflow's `on:` block: a `paths:` filter
+  # on the trigger leaves it PRESENT and still costs this gate every PR that
+  # touches only internal/** or Taskfile.yml — which is most of them, and
+  # includes every PR that could revert an AUD2 remediation.
+  local reach=0
+  assent_pr_reach "$wf" "$WORK" || reach=$?
+  case "$reach" in
+    0) : ;;
+    2)
+      echo "  REQ-AUD2-S05-05: verify.yaml no longer triggers on pull_request — the gate's step and the job's missing if: are both irrelevant, because the workflow never runs on a PR at all (RELSE-08 by another route)" >&2
+      return 1
+      ;;
+    10)
+      echo "  REQ-AUD2-S05-05: verify.yaml's 'on:' block uses a shape hack/lib/pr_reach.sh refuses to evaluate (a flow mapping, an anchor or an alias). A paths:/types: filter hidden in there would disarm this gate silently, so the reader fails closed instead of guessing" >&2
+      return 1
+      ;;
+    11)
+      echo "  REQ-AUD2-S05-05: verify.yaml's pull_request trigger carries a 'paths:' or 'paths-ignore:' filter. The trigger is PRESENT — a plain grep for it is satisfied — and this gate still does not run on a PR outside those paths, so a reverted REL-03/REL-07 remediation in internal/** could merge green (RELSE-08 with the trigger intact)" >&2
+      return 1
+      ;;
+    12)
+      echo "  REQ-AUD2-S05-05: verify.yaml's pull_request trigger carries a 'types:' filter that omits one of GitHub's defaults (opened, synchronize, reopened) — 'types: [closed]' satisfies a presence grep and never fires on an open PR" >&2
+      return 1
+      ;;
+    13)
+      echo "  REQ-AUD2-S05-05: verify.yaml's pull_request trigger carries a branch filter that excludes 'main' — PRs onto the branch these remediations protect would not run this gate" >&2
+      return 1
+      ;;
+    *)
+      echo "  REQ-AUD2-S05-05: assent_pr_reach returned an unmapped code $reach" >&2
+      return 1
+      ;;
+  esac
+
+  local wired=0
+  assent_step_wired "$wf" "$ASSENT_PR_JOB" "$SELF" "$WORK" || wired=$?
+  case "$wired" in
+    0) : ;;
+    3)
+      echo "  REQ-AUD2-S05-05: the 'verify' job block extracted empty or without a 'steps:' key — the PR-visibility assertions would be vacuous" >&2
+      rc=1
+      ;;
+    4)
+      echo "  REQ-AUD2-S05-05: the 'verify' job carries a JOB-LEVEL if: — if it skips pull requests, this gate is push-only exactly like release-exitgate and RELSE-08 is reproduced" >&2
+      rc=1
+      ;;
+    5)
+      # THE residual-3 fix. The old check was `grep -nF -- "$SELF"` over the job
+      # block — a search for the script NAME, which the step's own comment block
+      # satisfies. Measured by the reviewer: with the `run:` line commented out
+      # and the comments left naming the script, the fixed-string check reported
+      # "WITH ARGUMENTS" (the comment line is not an argument-free invocation)
+      # instead of "does not invoke". It failed, but it misreported — and the
+      # operator reading that finding would have gone looking for an argument.
+      echo "  REQ-AUD2-S05-05: the 'verify' job — the only job that runs on pull_request — does not invoke ${SELF} as an actual run: COMMAND. The gate would run only in release-exitgate, which skips PRs (RELSE-08): a reverted AUD2 remediation would merge green and be caught only after landing on main. (A comment naming this script is not an invocation.)" >&2
+      rc=1
+      ;;
+    6)
+      echo "  REQ-AUD2-S05-05: could not isolate the AUD2 gate step in the verify job — its region is not exactly one step (two 'run:' keys, or a stray 'uses:' key: the shape a deleted '- name:' line produces), so the disarm assertion would be vacuous" >&2
+      rc=1
+      ;;
+    7)
+      # Same argument ban as the Taskfile stage: `--text-only` in CI would leave
+      # the behavioural runs unexecuted on every pull request.
+      echo "  REQ-AUD2-S05-05: the AUD2 gate step invokes ${SELF} WITH ARGUMENTS — '--text-only' skips the behavioural mutation runs, so the step would look wired while certifying nothing about REL-03 and REL-07" >&2
+      rc=1
+      ;;
+    8)
+      echo "  REQ-AUD2-S05-05: the AUD2 gate step is present but DISARMED — an 'if:' or 'continue-on-error:' means a red gate does not fail the PR" >&2
+      rc=1
+      ;;
+    9)
+      echo "  REQ-AUD2-S05-05: the 'verify' job carries a JOB-LEVEL needs: — a dependency that skips on pull requests skips this job with it, so the gate is push-only by proxy while the step, the trigger and the missing job-level if: all still look right" >&2
+      rc=1
+      ;;
+    *)
+      echo "  REQ-AUD2-S05-05: assent_step_wired returned an unmapped code $wired" >&2
+      rc=1
+      ;;
+  esac
+  return "$rc"
+}
+
+# D-157 residual 2 — CROSS-PINNING. Until now each of the three PR-visible text
+# gates pinned only its OWN step (check_pr_wiring above, hack/lint/
+# workflow_pins_test.sh section 5, hack/examples/dogfood_wiring_test.sh section
+# 7); a reviewer grepped and confirmed none named another. So a PR that deleted
+# one of those three steps was invisible to the gate still running on that PR —
+# caught locally by `task check` and on push by release-exitgate, which is why
+# it was a gap and not a hole. Each gate now asserts all three steps.
+check_cross_pins() { # <verify.yaml>
+  local wf="$1" rc=0
+  [[ -f "$wf" ]] || {
+    echo "  REQ-AUD2-S05-05: missing $wf" >&2
     return 1
-  fi
-  # The job must not have grown release-exitgate's push-only guard: a job-level
-  # `if:` sits at 4 spaces, a step-level one at 8.
-  local jobif="$WORK/hits.jobif"
-  grep -nE '^    if:' "$job" >"$jobif" || true
-  if [[ -s "$jobif" ]]; then
-    echo "  REQ-AUD2-S05-05: the 'verify' job carries a JOB-LEVEL if: — if it skips pull requests, this gate is push-only exactly like release-exitgate and RELSE-08 is reproduced:" >&2
-    sed 's/^/    /' "$jobif" >&2
+  }
+  local others="$WORK/cross.others"
+  if ! assent_pr_gate_others "$SELF" >"$others"; then
+    echo "  REQ-AUD2-S05-05: ${SELF} is not listed in ASSENT_PR_GATES (hack/lib/pr_reach.sh) — the cross-pin set is not the set this gate belongs to, so this check would grade an unrelated pair" >&2
     return 1
   fi
-  local hit lineno
-  hit="$(grep -nF "$SELF" "$job" | head -1 || true)"
-  if [[ -z "$hit" ]]; then
-    echo "  REQ-AUD2-S05-05: the 'verify' job — the only job that runs on pull_request — does not invoke ${SELF}. The gate would run only in release-exitgate, which skips PRs (RELSE-08): a reverted AUD2 remediation would merge green and be caught only after landing on main" >&2
+  if ((${#ASSENT_PR_GATES[@]} != 3)); then
+    echo "  REQ-AUD2-S05-05: ASSENT_PR_GATES holds ${#ASSENT_PR_GATES[@]} entries, expected the 3 PR-visible text gates — a fourth needs its own cross-pin, not a silently widened one" >&2
     return 1
   fi
-  lineno="${hit%%:*}"
-  local step="$WORK/step.aud2"
-  isolate_step "$job" "$lineno" >"$step" || true
-  if [[ ! -s "$step" ]] || ! grep -qE '^      - ' "$step"; then
-    echo "  REQ-AUD2-S05-05: could not isolate the AUD2 gate step in the verify job — the extraction broke, so the disarm assertion would be vacuous" >&2
+  local n
+  n="$(wc -l <"$others" | tr -d '[:space:]')"
+  if [[ "$n" != "2" ]]; then
+    echo "  REQ-AUD2-S05-05: expected exactly 2 sibling gates to cross-pin, got $n — the positive control on the shared list failed, so the assertions below would be vacuous" >&2
     return 1
   fi
-  # Same argument ban as the Taskfile stage: `--text-only` in CI would leave the
-  # behavioural runs unexecuted on every pull request.
-  if ! grep -qE "bash ${SELF//\//\\/}[[:space:]]*\$" "$step"; then
-    echo "  REQ-AUD2-S05-05: the AUD2 gate step invokes ${SELF} WITH ARGUMENTS — '--text-only' skips the behavioural mutation runs, so the step would look wired while certifying nothing about REL-03 and REL-07:" >&2
-    sed 's/^/    /' <(grep -F "$SELF" "$step") >&2
-    rc=1
-  fi
-  local disarmed="$WORK/hits.disarmed"
-  grep -nE '^[[:space:]]*(if|continue-on-error):' "$step" >"$disarmed" || true
-  if [[ -s "$disarmed" ]]; then
-    echo "  REQ-AUD2-S05-05: the AUD2 gate step is present but DISARMED — an 'if:' or 'continue-on-error:' means a red gate does not fail the PR:" >&2
-    sed 's/^/    /' "$disarmed" >&2
-    rc=1
-  fi
+  local g w
+  while IFS= read -r g; do
+    [[ -n "$g" ]] || continue
+    if [[ ! -f "$ROOT/$g" ]]; then
+      echo "  REQ-AUD2-S05-05: cross-pinned gate $g does not exist on disk — the pin would assert a step that runs nothing" >&2
+      rc=1
+      continue
+    fi
+    w=0
+    assent_step_wired "$wf" "$ASSENT_PR_JOB" "$g" "$WORK" || w=$?
+    if ((w != 0)); then
+      echo "  REQ-AUD2-S05-05: the sibling PR-visible gate $g is NOT wired undisarmed into the '$ASSENT_PR_JOB' job (assent_step_wired rc=$w: 3 job unextractable, 4 job-level if:, 5 no run: command, 6 step unisolatable, 7 arguments, 8 disarmed, 9 job-level needs:). Deleting any one of the three gate steps must redden the PR that does it; this is the half of that guarantee this script owns" >&2
+      rc=1
+    fi
+  done <"$others"
   return "$rc"
 }
 
@@ -1987,6 +2060,7 @@ echo "== (6) REQ-AUD2-S05-03/04/05 — this gate is wired where it can be seen =
 expect_green check_task_wiring "'task check' runs ${STAGE}, which invokes ${SELF}" "$TASKFILE"
 expect_green check_stage_pinned "${STAGE} is pinned in CHECK_STAGES (AUD-S18 grades it)" "$AUD_GATE"
 expect_green check_pr_wiring "the pull-request-visible 'verify' job runs ${SELF}, undisarmed" "$WORKFLOW"
+expect_green check_cross_pins "the same job also runs the other two PR-visible text gates, undisarmed (D-157)" "$WORKFLOW"
 
 echo "== (6b) the wiring assertions proved capable of going RED =="
 m="$WORK/Taskfile.nostage.yml"
@@ -2079,6 +2153,137 @@ for disarm in "continue-on-error: true" "if: false"; do
     "DISARMED" "$m"
 done
 
+# ---- D-157 residual 3: the invocation COMMENTED OUT, comments left naming it -
+# The `verify.nostep` control above deletes every line containing $SELF, which
+# takes the step's comment block with it — so it never exercised the case the
+# fixed-string check actually got wrong. This one comments out ONLY the `run:`
+# line. Measured before the fix: `grep -nF -- "$SELF"` found the comments, the
+# check went red with "WITH ARGUMENTS", and the operator was sent looking for
+# an argument that does not exist. The pinned fragment here is what makes the
+# fix real: it must report the step as NOT INVOKED.
+m="$WORK/verify.commentedout.yaml"
+sed "s|^\([[:space:]]*\)run: bash ${SELF}\$|\\1# run: bash ${SELF}  # temporarily disabled|" "$WORKFLOW" >"$m"
+assert_changed "$WORKFLOW" "$m"
+grep -Fq -- "$SELF" "$m" ||
+  fail "mutation harness: the commented-out mutant no longer mentions ${SELF} at all — then it is the verify.nostep control again and proves nothing about comment-vs-command"
+expect_red check_pr_wiring "the gate's run: line was COMMENTED OUT while the step comments still name the script (D-157 residual 3 — the fixed-string check reported 'WITH ARGUMENTS' here)" \
+  "does not invoke" "$m"
+
+# ---- D-157 residual 1: PR reach that survives the old presence grep ----------
+# Each mutant below leaves `^[[:space:]]+pull_request:` matching — the check
+# this replaces was green on the first one (measured rc=0).
+pr_filter_mutant() { # <name> <yaml line> -> prints the mutant path
+  local name="$1" line="$2"
+  local out="$WORK/verify.${name}.yaml"
+  awk -v add="$line" '{ print } $0 == "  pull_request:" { print add }' "$WORKFLOW" >"$out"
+  assert_changed "$WORKFLOW" "$out"
+  grep -qE '^[[:space:]]+pull_request:' "$out" ||
+    fail "mutation harness: the ${name} mutant no longer satisfies even the OLD '^[[:space:]]+pull_request:' grep, so it does not demonstrate the bypass"
+  grep -Fq -- "$SELF" "$out" ||
+    fail "mutation harness: the ${name} mutant lost the ${SELF} step — it must stay present, or the control grades absence instead of trigger reach"
+  printf '%s' "$out"
+}
+
+m="$(pr_filter_mutant prpaths "    paths: [internal/**]")"
+expect_red check_pr_wiring "the pull_request trigger grew a paths: filter — present, grep-satisfying, and blind to a PR that touches only Taskfile.yml (the reviewer's measured bypass)" \
+  "carries a 'paths:' or 'paths-ignore:' filter" "$m"
+
+m="$(pr_filter_mutant prpathsignore "    paths-ignore: [docs/**]")"
+expect_red check_pr_wiring "the pull_request trigger grew a paths-ignore: filter" \
+  "carries a 'paths:' or 'paths-ignore:' filter" "$m"
+
+m="$(pr_filter_mutant prtypes "    types: [closed]")"
+expect_red check_pr_wiring "the pull_request trigger was narrowed to types: [closed] — it never fires on an open PR" \
+  "omits one of GitHub's defaults" "$m"
+
+m="$(pr_filter_mutant prtypespartial "    types: [opened, reopened]")"
+expect_red check_pr_wiring "the pull_request types: list dropped 'synchronize' — the gate would not re-run when a PR is updated" \
+  "omits one of GitHub's defaults" "$m"
+
+m="$(pr_filter_mutant prbranches "    branches: [release]")"
+expect_red check_pr_wiring "the pull_request trigger was restricted to base branches that exclude main" \
+  "branch filter that excludes 'main'" "$m"
+
+m="$WORK/verify.prflowmap.yaml"
+sed 's|^  pull_request:$|  pull_request: {paths: [internal/**]}|' "$WORKFLOW" >"$m"
+assert_changed "$WORKFLOW" "$m"
+expect_red check_pr_wiring "the paths: filter was hidden inside a YAML flow mapping — refused, not guessed at" \
+  "refuses to evaluate" "$m"
+
+# The indent-scoping half: the only `pull_request:` left is an input NAME nested
+# under another trigger, which the old grep accepted.
+m="$WORK/verify.prnested.yaml"
+awk '
+  { if ($0 == "  pull_request:") { print "  workflow_call:"; print "    inputs:"; print "      pull_request:"; print "        type: string" } else print }
+' "$WORKFLOW" >"$m"
+assert_changed "$WORKFLOW" "$m"
+grep -qE '^[[:space:]]+pull_request:' "$m" ||
+  fail "mutation harness: the nested-key mutant has no 'pull_request:' line at all, so it does not test indent scoping"
+expect_red check_pr_wiring "the only 'pull_request:' left is a workflow_call INPUT NAME — the old indent-blind grep says yes, GitHub never runs the workflow on a PR" \
+  "no longer triggers on pull_request" "$m"
+
+# ---- D-157: the two job-level routes that leave the step untouched ----------
+m="$WORK/verify.jobneeds.yaml"
+awk '{ print; if ($0 == "  verify:") print "    needs: release-exitgate" }' "$WORKFLOW" >"$m"
+assert_changed "$WORKFLOW" "$m"
+grep -Fq -- "$SELF" "$m" ||
+  fail "mutation harness: the needs: mutant lost the ${SELF} step"
+expect_red check_pr_wiring "the verify JOB was made to depend on the push-only release-exitgate job — a skipped dependency skips this job, step and trigger untouched" \
+  "JOB-LEVEL needs:" "$m"
+
+m="$WORK/verify.jobrenamed.yaml"
+sed "s|^  ${ASSENT_PR_JOB}:\$|  ${ASSENT_PR_JOB}-all:|" "$WORKFLOW" >"$m"
+assert_changed "$WORKFLOW" "$m"
+grep -Fq -- "$SELF" "$m" ||
+  fail "mutation harness: the job-rename mutant lost the ${SELF} step"
+expect_red check_pr_wiring "the '${ASSENT_PR_JOB}' job was renamed — with three gates now cross-pinning that job name, an uncontrolled extraction failure here would go vacuous for all of them at once" \
+  "extracted empty" "$m"
+
+# ---- D-157 residual 2: deleting a SIBLING gate's step reds THIS gate --------
+# Two of the six rows in the cross-product (3 deleted steps x the 2 gates that
+# still run on that PR); the other four live in the sibling scripts.
+while IFS= read -r sibling; do
+  [[ -n "$sibling" ]] || continue
+  m="$WORK/verify.nosibling.$(basename "$sibling" .sh).yaml"
+  grep -vE "^[[:space:]]*run: bash ${sibling//./\\.}\$" "$WORKFLOW" >"$m"
+  assert_changed "$WORKFLOW" "$m"
+  grep -Fq -- "run: bash $SELF" "$m" ||
+    fail "mutation harness: deleting ${sibling}'s step also removed THIS gate's step — the control would grade self-wiring again"
+  expect_red check_cross_pins "the step running the sibling gate ${sibling} was deleted from the verify job (D-157 residual 2)" \
+    "the sibling PR-visible gate $sibling is NOT wired" "$m"
+done < <(assent_pr_gate_others "$SELF")
+
+# ---- the other polarity: D-157 must not have made this a gate that reds on
+# any workflow structure at all. Without these, the eleven red controls above
+# are equally satisfied by a check that always fails. Each of these is a shape
+# a maintainer could legitimately introduce; each must stay GREEN.
+# A fail-open found by building the mutant, not by reasoning about it: the
+# block-scalar `run: |` form is accepted on purpose (green control below), and
+# accepting it naively makes a BARE `bash <script>` line anywhere in the job
+# satisfy the check — including inside another step's multi-command `run: |`
+# body, where `echo skip && exit 0` a line above would mean this gate never
+# runs. Measured at rc=0 before the restriction; the block form now counts only
+# as a block's SOLE command.
+m="$WORK/verify.blockbleed.yaml"
+grep -vF "run: bash $SELF" "$WORKFLOW" \
+  | awk -v s="$SELF" '{ print } /go test -count=2 \.\/internal\/render/ { print "          bash " s }' >"$m"
+assert_changed "$WORKFLOW" "$m"
+[[ "$(grep -cF "bash $SELF" "$m")" == "1" ]] ||
+  fail "mutation harness: expected exactly one 'bash $SELF' occurrence in the bleed mutant"
+expect_red check_pr_wiring "this gate's own step was deleted and its invocation smuggled into ANOTHER step's multi-command 'run: |' body — a shell script is not a workflow step" \
+  "does not invoke" "$m"
+
+m="$(pr_filter_mutant prtypessuperset "    types: [opened, synchronize, reopened, ready_for_review]")"
+expect_green check_pr_wiring "a types: list that SUPERSETS GitHub's defaults is accepted" "$m"
+m="$(pr_filter_mutant prbranchesmain "    branches: [main]")"
+expect_green check_pr_wiring "branches: [main] — the branch these remediations protect — is accepted" "$m"
+m="$(pr_filter_mutant prbranchesignoreother "    branches-ignore: [gh-pages]")"
+expect_green check_pr_wiring "branches-ignore: on a branch that is not main is accepted" "$m"
+m="$WORK/verify.blockscalar.yaml"
+awk -v s="        run: bash $SELF" '{ if ($0 == s) { print "        run: |"; print "          bash '"$SELF"'" } else print }' "$WORKFLOW" >"$m"
+assert_changed "$WORKFLOW" "$m"
+expect_green check_pr_wiring "a block-scalar 'run: |' invocation of this gate is accepted" "$m"
+
 
 # The floor is a FLOOR, and the banner below says exactly that. An earlier
 # wording claimed the controls proved "every assertion" could fail; this script
@@ -2090,8 +2295,16 @@ done
 # Mode-aware floor: --text-only legitimately skips the four behavioural
 # controls, and a single number would either pass a truncated full run or red
 # every text-only run. Both floors are pinned so neither mode can quietly shrink.
-CONTROL_FLOOR=38
-((TEXT_ONLY == 0)) || CONTROL_FLOOR=32
+# D-157 raised both floors by 13: eleven new red controls over check_pr_wiring
+# (the residual-3 comment-out, six pull_request-filter bypasses, the nested
+# input name, the job-level needs:, the job rename, the block-scalar bleed)
+# plus one over the new check_cross_pins per sibling gate. All are pure text,
+# so they run in BOTH
+# modes and both floors move together. Not bumping would not have reddened —
+# the floor is `>=` — which is exactly why it has to be bumped: an unbumped
+# floor stops pinning the sections it was raised for.
+CONTROL_FLOOR=51
+((TEXT_ONLY == 0)) || CONTROL_FLOOR=45
 ((MUTATIONS_PROVED >= CONTROL_FLOOR)) ||
   fail "only ${MUTATIONS_PROVED} mutation controls ran in $([[ $TEXT_ONLY == 1 ]] && echo --text-only || echo full) mode, fewer than the pinned floor of ${CONTROL_FLOOR} — a section was skipped, so REQ-AUD2-S05-02's evidence is incomplete"
 
diff --git a/hack/examples/dogfood_wiring_test.sh b/hack/examples/dogfood_wiring_test.sh
index 0b84a974..8304556b 100755
--- a/hack/examples/dogfood_wiring_test.sh
+++ b/hack/examples/dogfood_wiring_test.sh
@@ -33,6 +33,21 @@ TASKFILE="$ROOT/Taskfile.yml"
 WORKFLOW="$ROOT/.github/workflows/verify.yaml"
 SCRIPT="hack/dogfood-examples.sh"
 
+# D-157 — the PR-reach and step-wiring checks are SHARED with the other two
+# PR-visible text gates (hack/lint/workflow_pins_test.sh,
+# hack/audit/aud2_exitgate_test.sh). Sourced, not executed; it returns codes and
+# prints nothing, so the wording below stays this script's own. Guarded rather
+# than assumed: under `set -e` a missing helper would abort this script
+# mid-section, and a gate that stops half-way must say so instead of exiting on
+# whatever code the failed source left behind.
+PR_REACH_LIB="$ROOT/hack/lib/pr_reach.sh"
+if [[ ! -f "$PR_REACH_LIB" ]]; then
+  echo "FAIL: missing $PR_REACH_LIB — the shared PR-reach/step-wiring helper (D-157). Refusing to run rather than skipping section 7." >&2
+  exit 1
+fi
+# shellcheck source=../lib/pr_reach.sh
+. "$PR_REACH_LIB"
+
 WORK="$(mktemp -d)"
 trap 'rm -rf "$WORK"' EXIT
 
@@ -349,73 +364,30 @@ echo "OK: stripping -count=1 from verify.yaml's command line (comment intact) tu
 
 SELF_REL="hack/examples/dogfood_wiring_test.sh"
 
-# extract_on_block <workflow> — the body of the top-level `on:` mapping.
-extract_on_block() {
-  awk '/^on:/ { ino = 1; next } ino && /^[A-Za-z]/ { ino = 0 } ino { print }' "$1"
-}
-
-# extract_job <workflow> <job> — the body of a 2-space-indented jobs: entry.
-extract_job() {
-  awk -v name="$2" '
-    $0 == "  " name ":" { inb = 1; next }
-    inb && /^  [A-Za-z0-9_.-]+:[[:space:]]*$/ { inb = 0 }
-    inb { print }
-  ' "$1"
-}
-
-# isolate_step_at <job-block-file> <line no> — the step containing that line,
-# from its `- ` marker to the next one.
-isolate_step_at() {
-  local blockfile="$1" hitline="$2" start end
-  start="$(grep -nE '^      - ' "$blockfile" | cut -d: -f1 | awk -v h="$hitline" '$1 <= h { s = $1 } END { print s }')"
-  [[ -n "$start" ]] || return 1
-  end="$(awk -v s="$start" 'NR > s && /^      - / { print NR; exit }' "$blockfile")"
-  [[ -n "$end" ]] || end="$(($(wc -l <"$blockfile") + 1))"
-  sed -n "${start},$((end - 1))p" "$blockfile"
-}
-
-# SELF_RE — SELF_REL as an ERE (the dot in `.sh` must not be a wildcard).
-SELF_RE="${SELF_REL//./\\.}"
-
 # pr_step_pinned <workflow> — 0 when this gate runs, undisarmed, in a
 # pull-request-visible job. Distinct codes so a mutation control can prove it
-# went red for ITS reason: 2 no pull_request trigger, 3 job block unextractable,
-# 4 job-level if:, 5 step absent, 6 step unisolatable, 7 arguments, 8 disarmed.
+# went red for ITS reason. The whole body now delegates to hack/lib/pr_reach.sh
+# (D-157): the on:/job/step readers that used to live here were copied into two
+# sibling gates, one of which had already drifted weaker, and the PR-reach test
+# was a bare `grep -qE '^[[:space:]]+pull_request:'` that a reviewer defeated
+# with a `paths:`-filtered trigger (measured rc=0). The codes are unchanged for
+# 2..8 — 9..13 are the ones the old check could not distinguish at all:
+#
+#   2  no top-level pull_request trigger      9  job-level needs:
+#   3  job block unextractable               10  on: shape not evaluable
+#   4  job-level if:                         11  pull_request has paths:
+#   5  step absent (no run: COMMAND)         12  pull_request types: too narrow
+#   6  step unisolatable                     13  pull_request branch filter
+#   7  arguments                                 excludes main
+#   8  disarmed
 pr_step_pinned() {
-  local wf="$1"
-  extract_on_block "$wf" >"$WORK/on.block"
-  [[ -s "$WORK/on.block" ]] || return 2
-  grep -qE '^[[:space:]]+pull_request:' "$WORK/on.block" || return 2
-  extract_job "$wf" verify >"$WORK/job.verify"
-  { [[ -s "$WORK/job.verify" ]] && grep -q '^    steps:' "$WORK/job.verify"; } || return 3
-  grep -qE '^    if:' "$WORK/job.verify" && return 4
-  # Anchored on a `run:` COMMAND, never a mention: verify.yaml's step comments
-  # name this script ("Pinned by hack/examples/dogfood_wiring_test.sh"), and a
-  # fixed-string search would let those comments satisfy the presence check
-  # after the real invocation was deleted. Measured while building 7b.
-  local runline
-  runline="$(grep -nE "^[[:space:]]*run:[[:space:]]*bash[[:space:]]+${SELF_RE}([[:space:]]|\$)" "$WORK/job.verify" | head -1 | cut -d: -f1)"
-  [[ -n "$runline" ]] || return 5
-  isolate_step_at "$WORK/job.verify" "$runline" >"$WORK/step.self" || return 6
-  { [[ -s "$WORK/step.self" ]] && grep -qE '^      - ' "$WORK/step.self"; } || return 6
-  # Isolation bound, the same defect hack/lint/workflow_pins_test.sh:433-440
-  # closes with a 1..6 LINE cap. Without a bound, deleting only this step's
-  # `- name:` line merges it into the neighbouring step and the isolated region
-  # silently becomes that other step's body plus ours — a malformed workflow
-  # this function called fine (measured: rc=0). A line cap is the wrong shape
-  # here: this step carries a long comment block, so the honest size (14) and
-  # the merged size (15) are one line apart and any cap that admits the first
-  # admits the second. The structural invariant is what actionlint itself
-  # flags — a step has exactly ONE `run:` key — and it holds whatever the
-  # comments do. (Also caught independently by workflow_pins_test.sh's own
-  # "got 15 lines, expected 1..6" and by actionlint's `key "run" is
-  # duplicated`, so this is a bound made explicit, not a hole being closed.)
-  local n_run
-  n_run="$(grep -cE '^        run:' "$WORK/step.self" || true)"
-  ((n_run == 1)) || return 6
-  grep -qE "^[[:space:]]*run:[[:space:]]*bash[[:space:]]+${SELF_RE}[[:space:]]*\$" "$WORK/step.self" || return 7
-  grep -qE '^[[:space:]]*(if|continue-on-error):' "$WORK/step.self" && return 8
-  return 0
+  local wf="$1" rc=0
+  assent_pr_reach "$wf" "$WORK" || rc=$?
+  if ((rc != 0)); then
+    return "$rc"
+  fi
+  assent_step_wired "$wf" "$ASSENT_PR_JOB" "$SELF_REL" "$WORK" || rc=$?
+  return "$rc"
 }
 
 echo "== 7. this gate runs in the pull-request-visible verify job, undisarmed =="
@@ -429,16 +401,23 @@ case "$rc" in
   6) fail "could not isolate this gate's step in the verify job — the extraction broke, so the disarm assertions would be vacuous" ;;
   7) fail "the step invokes $SELF_REL WITH ARGUMENTS — an argument-carrying invocation is how a wired-looking step is hollowed out" ;;
   8) fail "the step is present but DISARMED — an 'if:' or 'continue-on-error:' means a red gate does not fail the PR" ;;
+  9) fail "the 'verify' job carries a JOB-LEVEL needs: — a dependency that skips on pull requests skips this job with it, so the gate is push-only by proxy while the step still looks wired (RELSE-08 through the back door)" ;;
+  10) fail "verify.yaml's 'on:' block uses a shape hack/lib/pr_reach.sh cannot evaluate (a flow mapping, an anchor or an alias) — it refuses rather than guess, because a hidden paths:/types: filter there would disarm this gate silently" ;;
+  11) fail "verify.yaml's pull_request trigger carries a 'paths:' or 'paths-ignore:' filter — the trigger is present and the gate still loses every PR that does not touch the listed paths, which includes PRs to Taskfile.yml and .github/workflows/** (the two files this gate reads)" ;;
+  12) fail "verify.yaml's pull_request trigger carries a 'types:' filter that omits one of GitHub's defaults (opened, synchronize, reopened) — e.g. 'types: [closed]' satisfies a presence grep while the gate never runs on an open PR" ;;
+  13) fail "verify.yaml's pull_request trigger carries a branch filter that excludes 'main' — PRs onto the branch this gate protects would not run it" ;;
   *) fail "pr_step_pinned returned an unmapped code $rc" ;;
 esac
 
 echo "== 7b. every branch of the PR-visibility pin proved capable of going RED =="
-# Bound, stated rather than implied: rc=3 (verify job block unextractable —
-# reachable by renaming the `verify:` job) has NO control here. rc=6 is
-# controlled for the reachable route (a step merged into its neighbour by a
-# deleted `- name:`); its other route, a region that is not a step at all,
-# needs a workflow actionlint cannot parse and so is unreachable through green
-# CI. Every other branch below is controlled.
+# Bound, stated rather than implied: rc=6 is controlled for the reachable route
+# (a step merged into its neighbour by a deleted `- name:`); its other route, a
+# region that is not a step at all, needs a workflow actionlint cannot parse and
+# so is unreachable through green CI. rc=13's `branches-ignore:` half is
+# controlled through its `branches:` sibling only. Every other branch below,
+# including the ones D-157 added (9..13) and rc=3, which was uncontrolled until
+# cross-pinning made the JOB NAME a single point of failure for all three
+# gates, is controlled.
 expect_rc() { # <want> <file> <label>
   local want="$1" f="$2" label="$3" got=0
   pr_step_pinned "$f" || got=$?
@@ -489,4 +468,177 @@ grep -vE '^[[:space:]]+pull_request:[[:space:]]*$' "$WORKFLOW" >"$m"
 [[ "$(wc -l <"$m")" -lt "$(wc -l <"$WORKFLOW")" ]] || fail "mutation did not land: pull_request: is still in the on: block"
 expect_rc 2 "$m" "the workflow stopped triggering on pull_request at all"
 
-echo "PASS: dogfood wiring (REQ-EX-S08-02, REQ-EX-S08-03) — task check runs dogfood-examples after build; Taskfile.yml and verify.yaml both delegate to the shared discovery script; the cache-blind go test gates (${COUNT1_TASKS[*]}) carry -count=1, in Taskfile.yml AND in verify.yaml; and this gate itself runs undisarmed in the pull-request-visible verify job"
+# --- D-157: the branches the OLD `grep -qE '^[[:space:]]+pull_request:'` could
+# not tell apart. Each of these leaves that grep satisfied. The first two are
+# the reviewer's measured bypass (rc=0 before this change).
+insert_under_pr() { # <outfile> <lines...> — insert under `  pull_request:`
+  local out="$1"
+  shift
+  local payload
+  payload="$(printf '%s\n' "$@")"
+  awk -v add="$payload" '{ print } $0 == "  pull_request:" { print add }' "$WORKFLOW" >"$out"
+  cmp -s "$WORKFLOW" "$out" && fail "mutation did not land: nothing was inserted under 'pull_request:' in $out"
+  grep -qE '^[[:space:]]+pull_request:' "$out" ||
+    fail "mutation is not the intended one: $out no longer satisfies even the OLD presence grep, so it does not demonstrate the bypass"
+  return 0
+}
+
+m="$WORK/verify.prpaths.yaml"
+insert_under_pr "$m" "    paths: ['internal/**']"
+expect_rc 11 "$m" "the pull_request trigger grew a paths: filter (the reviewer's measured bypass: present, and disarmed for a PR that touches only Taskfile.yml)"
+
+m="$WORK/verify.prpathsignore.yaml"
+insert_under_pr "$m" "    paths-ignore: ['docs/**']"
+expect_rc 11 "$m" "the pull_request trigger grew a paths-ignore: filter"
+
+m="$WORK/verify.prtypes.yaml"
+insert_under_pr "$m" "    types: [closed]"
+expect_rc 12 "$m" "the pull_request trigger was narrowed to types: [closed] — it never fires on an open PR"
+
+m="$WORK/verify.prtypespartial.yaml"
+insert_under_pr "$m" "    types: [opened, reopened]"
+expect_rc 12 "$m" "the pull_request types: list dropped 'synchronize' — the gate would not re-run when a PR is updated"
+
+m="$WORK/verify.prbranches.yaml"
+insert_under_pr "$m" "    branches: [release]"
+expect_rc 13 "$m" "the pull_request trigger was restricted to branches that do not include main"
+
+m="$WORK/verify.prflowmap.yaml"
+awk 'NR == 1 { print; next } { print }' "$WORKFLOW" | sed "s|^  pull_request:\$|  pull_request: {paths: ['internal/**']}|" >"$m"
+cmp -s "$WORKFLOW" "$m" && fail "mutation did not land: pull_request: was not rewritten as a flow mapping"
+expect_rc 10 "$m" "the pull_request filter was hidden in a YAML flow mapping the reader refuses to guess at"
+
+m="$WORK/verify.jobneeds.yaml"
+awk '{ print; if ($0 == "  verify:") print "    needs: release-exitgate" }' "$WORKFLOW" >"$m"
+cmp -s "$WORKFLOW" "$m" && fail "mutation did not land: the job-level needs: was not inserted"
+grep -qF -- "run: bash $SELF_REL" "$m" || fail "mutation is not the intended one: the needs: mutant lost the gate step"
+expect_rc 9 "$m" "the verify JOB was made to depend on the push-only release-exitgate job — skipped dependency, skipped job, step still there"
+
+m="$WORK/verify.jobrenamed.yaml"
+sed "s|^  ${ASSENT_PR_JOB}:\$|  ${ASSENT_PR_JOB}-all:|" "$WORKFLOW" >"$m"
+cmp -s "$WORKFLOW" "$m" && fail "mutation did not land: the '${ASSENT_PR_JOB}:' job key was not renamed"
+grep -qF -- "run: bash $SELF_REL" "$m" || fail "mutation is not the intended one: the job-rename mutant lost the gate step"
+expect_rc 3 "$m" "the '${ASSENT_PR_JOB}' job was renamed — with three gates now cross-pinning that job name, an uncontrolled extraction failure here would go vacuous for all of them at once"
+
+m="$WORK/verify.prnested.yaml"
+awk '
+  { print }
+  $0 == "  push:" && !done {
+    print "  workflow_call:"
+    print "    inputs:"
+    print "      pull_request:"
+    print "        type: string"
+    done = 1
+  }
+' "$WORKFLOW" | grep -vE '^  pull_request:[[:space:]]*$' >"$m"
+grep -qE '^[[:space:]]+pull_request:' "$m" ||
+  fail "mutation is not the intended one: the nested-key mutant has no 'pull_request:' line at all, so it does not test indent scoping"
+expect_rc 2 "$m" "the only 'pull_request:' left is an INPUT NAME nested under workflow_call — indent-blind grep says yes, GitHub says the workflow never runs on a PR"
+
+# A fail-open found by building this mutant rather than by reasoning about it.
+# The block-scalar form is accepted on purpose (see 7's legit-shapes control
+# below), and accepting it naively means a BARE `bash <script>` line anywhere in
+# the job satisfies the check — including inside some OTHER step's multi-command
+# `run: |` body, where `echo skip && exit 0` on the line above would mean this
+# gate never runs. Measured at rc=0 before the restriction; the block form is
+# now accepted only when it is the block's SOLE command.
+m="$WORK/verify.blockbleed.yaml"
+grep -vF "run: bash $SELF_REL" "$WORKFLOW" \
+  | awk -v s="$SELF_REL" '{ print } /go test -count=2 \.\/internal\/render/ { print "          bash " s }' >"$m"
+[[ "$(grep -cF "bash $SELF_REL" "$m")" == "1" ]] ||
+  fail "mutation did not land: expected exactly one 'bash $SELF_REL' occurrence in the bleed mutant"
+grep -qF -- "run: bash $SELF_REL" "$m" && fail "mutation did not land: the real step's run: line survived in the bleed mutant"
+expect_rc 5 "$m" "this gate's own step was deleted and its invocation smuggled into ANOTHER step's multi-command 'run: |' body"
+
+# --- the other polarity. Seventeen red controls above are equally satisfied by a
+# pin that always fails, so the shapes a maintainer could legitimately introduce
+# must be proved to stay GREEN. These are the narrowings D-157 deliberately does
+# NOT make: a types: superset, a branches: list containing main, a
+# branches-ignore: that spares main, the inline `on:` forms (which cannot carry
+# a filter at all), the quoted `"on":` key, and a block-scalar invocation.
+m="$WORK/verify.typessuperset.yaml"
+insert_under_pr "$m" "    types: [opened, synchronize, reopened, ready_for_review]"
+expect_rc 0 "$m" "a types: list that SUPERSETS GitHub's defaults is still accepted"
+
+m="$WORK/verify.branchesmain.yaml"
+insert_under_pr "$m" "    branches: [main]"
+expect_rc 0 "$m" "branches: [main] — the branch this gate protects — is still accepted"
+
+m="$WORK/verify.branchesignoreother.yaml"
+insert_under_pr "$m" "    branches-ignore: [gh-pages]"
+expect_rc 0 "$m" "branches-ignore: on a branch that is not main is still accepted"
+
+m="$WORK/verify.inlineseq.yaml"
+awk '{ if ($0 == "on:") { print "on: [push, pull_request]"; skip = 1; next } if (skip && $0 ~ /^  /) next; skip = 0; print }' "$WORKFLOW" >"$m"
+cmp -s "$WORKFLOW" "$m" && fail "mutation did not land: the on: block was not replaced by an inline sequence"
+expect_rc 0 "$m" "the inline 'on: [push, pull_request]' form — which cannot carry a filter at all — is still accepted"
+
+m="$WORK/verify.quotedon.yaml"
+sed 's|^on:$|"on":|' "$WORKFLOW" >"$m"
+cmp -s "$WORKFLOW" "$m" && fail "mutation did not land: the on: key was not quoted"
+expect_rc 0 "$m" "the quoted '\"on\":' key (YAML 1.1 truthiness) is still accepted"
+
+m="$WORK/verify.blockscalar.yaml"
+awk -v s="        run: bash $SELF_REL" '{ if ($0 == s) { print "        run: |"; print "          bash '"$SELF_REL"'" } else print }' "$WORKFLOW" >"$m"
+cmp -s "$WORKFLOW" "$m" && fail "mutation did not land: the run: line was not turned into a block scalar"
+expect_rc 0 "$m" "a block-scalar 'run: |' invocation of this gate is still accepted"
+
+# ------------------------------- 7c. the OTHER two PR-visible text gates --
+#
+# D-157 residual 2. Until now each of the three PR-visible text gates pinned
+# only its OWN step: workflow_pins_test.sh section 5, aud2_exitgate_test.sh's
+# check_pr_wiring, and section 7 above. A reviewer grepped and confirmed none
+# named another — so a PR deleting one of those three steps was invisible to
+# the gate that still ran on that PR. (`task check` and the push-only
+# release-exitgate job caught it afterwards, which is why this was a gap and
+# not a hole.) Each gate now asserts all three steps, so deleting ANY ONE of
+# them reds on the pull request that does it, twice over.
+check_sibling_gates() { # <workflow> — 0 when both siblings are wired
+  local wf="$1" g rc=0
+  while IFS= read -r g; do
+    [[ -n "$g" ]] || continue
+    rc=0
+    assent_step_wired "$wf" "$ASSENT_PR_JOB" "$g" "$WORK" || rc=$?
+    if ((rc != 0)); then
+      SIBLING_FINDING="$g (rc=$rc)"
+      return "$rc"
+    fi
+  done < <(assent_pr_gate_others "$SELF_REL")
+  return 0
+}
+
+echo "== 7c. the OTHER two PR-visible text gates are wired in the same job =="
+# Positive control on the shared list first: if this script is not a member,
+# every "other" below is the wrong set and the section certifies nothing.
+assent_pr_gate_others "$SELF_REL" >"$WORK/siblings" ||
+  fail "$SELF_REL is not listed in ASSENT_PR_GATES (hack/lib/pr_reach.sh) — the cross-pin set is not the set this gate belongs to, so section 7c would grade an unrelated pair"
+((${#ASSENT_PR_GATES[@]} == 3)) ||
+  fail "ASSENT_PR_GATES holds ${#ASSENT_PR_GATES[@]} entries, expected the 3 PR-visible text gates — if a fourth is added, give it its own cross-pin section rather than widening this one silently"
+[[ "$(wc -l <"$WORK/siblings" | tr -d ' ')" == "2" ]] ||
+  fail "expected exactly 2 sibling gates, got $(wc -l <"$WORK/siblings" | tr -d ' ')"
+while IFS= read -r sibling; do
+  [[ -f "$ROOT/$sibling" ]] || fail "cross-pinned gate $sibling does not exist on disk — the pin would assert a step that runs nothing"
+done <"$WORK/siblings"
+SIBLING_FINDING=""
+rc=0
+check_sibling_gates "$WORKFLOW" || rc=$?
+((rc == 0)) ||
+  fail "a sibling PR-visible gate is not wired undisarmed into the '${ASSENT_PR_JOB}' job: ${SIBLING_FINDING} — see the rc table at pr_step_pinned. Deleting one of the three gate steps must redden the PR that does it, and this is the half of that guarantee this script owns"
+echo "OK: both sibling gates ($(tr '\n' ' ' <"$WORK/siblings"| sed 's/ $//')) are wired, argument-free and undisarmed in the ${ASSENT_PR_JOB} job"
+
+echo "== 7d. the cross-pin can fail — each sibling's step deleted in turn =="
+while IFS= read -r sibling; do
+  m="$WORK/verify.nosibling.$(basename "$sibling").yaml"
+  grep -vF -- "run: bash $sibling" "$WORKFLOW" >"$m"
+  [[ "$(wc -l <"$m")" -lt "$(wc -l <"$WORKFLOW")" ]] ||
+    fail "mutation did not land: '$sibling' still has its run line in $m"
+  grep -qF -- "run: bash $SELF_REL" "$m" ||
+    fail "mutation is not the intended one: deleting $sibling's step also removed THIS gate's step, so the control grades self-wiring again"
+  rc=0
+  check_sibling_gates "$m" || rc=$?
+  ((rc == 5)) ||
+    fail "cross-pin control: deleting $sibling's step returned rc=$rc, want 5 (no run: command) — the cross-pin either cannot fail or failed for another reason"
+  echo "OK: cross-pin control — deleting $sibling's step from the ${ASSENT_PR_JOB} job reds THIS gate (rc=5)"
+done <"$WORK/siblings"
+
+echo "PASS: dogfood wiring (REQ-EX-S08-02, REQ-EX-S08-03) — task check runs dogfood-examples after build; Taskfile.yml and verify.yaml both delegate to the shared discovery script; the cache-blind go test gates (${COUNT1_TASKS[*]}) carry -count=1, in Taskfile.yml AND in verify.yaml; and all THREE PR-visible text gates (this one and its two siblings) run undisarmed in a verify job whose pull_request trigger carries no paths:/types:/branches narrowing (D-157)"
diff --git a/hack/lib/pr_reach.sh b/hack/lib/pr_reach.sh
new file mode 100644
index 00000000..d8ec464f
--- /dev/null
+++ b/hack/lib/pr_reach.sh
@@ -0,0 +1,481 @@
+#!/usr/bin/env bash
+# hack/lib/pr_reach.sh — shared "does this gate actually run on a pull request?"
+# helper for the PR-visible text gates (D-157 / GATES3).
+#
+# WHY THIS FILE EXISTS. Three gates —
+#   hack/lint/workflow_pins_test.sh
+#   hack/audit/aud2_exitgate_test.sh
+#   hack/examples/dogfood_wiring_test.sh
+# — each independently answered "am I reachable on a PR?", and two of them
+# answered it with `grep -qE '^[[:space:]]+pull_request:'` over the workflow's
+# `on:` block. (The third, workflow_pins_test.sh, did not answer it at all: it
+# asserted its step exists and is undisarmed, and never that the workflow
+# carrying the step reaches a pull request. That is new coverage here, not a
+# strengthening.) An independent reviewer built the mutant that defeats the
+# grep and measured rc=0:
+#
+#     on:
+#       pull_request:
+#         paths: ['internal/**']
+#
+# The trigger is present, the grep is satisfied, and a PR that touches only
+# Taskfile.yml or .github/workflows/** — the very files these gates protect —
+# never runs them. `types: [closed]` is the same defect by another route.
+#
+# Fixing that in one gate would have left two copies of the weak check for the
+# next gate author to copy. So the check lives HERE, once, and the next gate
+# inherits the strong form. Same reasoning for the step-wiring check
+# (assent_step_wired): hack/examples/dogfood_wiring_test.sh had grown an
+# anchored `run:`-command match while hack/audit/aud2_exitgate_test.sh still
+# used a fixed-string search for the script NAME, which a reviewer proved is
+# satisfied by a mere comment (it still went red, but with the wrong finding —
+# "WITH ARGUMENTS" for a step whose command had been commented out).
+#
+# CONTRACT: this file is SOURCED, never executed. Every function returns a
+# distinct numeric code and prints NOTHING. The caller owns the wording,
+# because each caller's mutation controls pin their own stderr fragments.
+#
+# PORTABILITY RULES, inherited from hack/lint/workflow_pins_test.sh's preamble
+# because that gate runs first in CI, before any toolchain, and must work in a
+# bare `debian:stable-slim`:
+#   * bash 3.2 clean — no `declare -A`, no `mapfile`, no namerefs. Stock macOS
+#     /bin/bash is 3.2; hack/audit/aud2_exitgate_test.sh refuses to run there,
+#     but the other two callers do not, and a bash-4 construct here would
+#     silently weaken them on a maintainer's machine.
+#   * portable ERE only: no `\t`, `\s`, `\b`, no `grep -P`.
+#   * no `git`, no `sed -i`, no `grep -q` on the read end of a pipe (SIGPIPE
+#     under `set -o pipefail`); matches go to a file, the file is inspected.
+#   * `set -e` safe: no bare `[[ ... ]] && return N` tails.
+#
+# WHAT THIS IS NOT. It is a line-oriented reader with a structural bias, not a
+# YAML parser. It understands block mappings at 2/4/6-space indent, block
+# sequences, and inline flow SEQUENCES. It does NOT understand anchors, aliases,
+# merge keys, or flow MAPPINGS, and it refuses (fails closed, with a distinct
+# code) rather than guessing when it meets one. Stated here rather than
+# discovered later: an honest narrow gate beats an overreaching one.
+
+# The three PR-visible text gates, single-sourced so each can cross-pin the
+# others (D-157 residual 2: before this, each gate pinned only its OWN step, so
+# a PR deleting one of the other two was invisible to the gate that ran).
+ASSENT_PR_GATES=(
+  "hack/lint/workflow_pins_test.sh"
+  "hack/audit/aud2_exitgate_test.sh"
+  "hack/examples/dogfood_wiring_test.sh"
+)
+ASSENT_PR_WORKFLOW=".github/workflows/verify.yaml"
+ASSENT_PR_JOB="verify"
+
+# assent_pr_gate_others <self-rel-path> — prints ASSENT_PR_GATES minus <self>,
+# one per line. Returns 1 if <self> is not a member, which is the positive
+# control every caller runs: a renamed gate must not silently drop out of the
+# cross-pin set and leave the caller asserting over an unrelated pair.
+assent_pr_gate_others() {
+  local self="$1" g found=0
+  for g in "${ASSENT_PR_GATES[@]}"; do
+    if [[ "$g" == "$self" ]]; then
+      found=1
+    else
+      printf '%s\n' "$g"
+    fi
+  done
+  if ((found != 1)); then
+    return 1
+  fi
+  return 0
+}
+
+# _assent_ere_escape <literal> — the literal as an ERE. `.` in `.sh` must not be
+# a wildcard; a path is otherwise metachar-free, but the full set is escaped so
+# a future gate name carrying a `+` or `(` cannot silently widen a match.
+_assent_ere_escape() {
+  printf '%s' "$1" | sed 's/[][\.*+?(){}|^$]/\\&/g'
+}
+
+# _assent_strip_comment — drop a ` #` comment tail from stdin, line by line.
+# That is YAML's rule for a PLAIN scalar. It is NOT the rule inside a quoted or
+# block scalar (hack/lint/workflow_pins_test.sh's N6 note), which is why it is
+# applied ONLY to `on:`/`types:`/`branches:` values, where a quoted ` #` would
+# be absurd. Its effect on the membership tests is asymmetric and both
+# directions are safe: for `types:`/`branches:` (must CONTAIN a token) stripping
+# removes a way to satisfy the check with prose; for `branches-ignore:` (must
+# NOT contain `main`) a leftover comment can only cause a false RED.
+_assent_strip_comment() {
+  sed -e 's/[[:space:]]#.*$//' -e 's/^#.*$//'
+}
+
+# ---------------------------------------------------------------------------
+# assent_pr_reach <workflow-file> <scratch-dir>
+#
+# 0  the workflow runs on EVERY pull request, unfiltered by content
+# 2  no top-level `pull_request:` trigger (absent, or `on:` unextractable)
+# 10 the `on:` block uses a flow MAPPING, an anchor/alias, or another shape this
+#    reader cannot honestly evaluate — refused rather than guessed (fail closed)
+# 11 the `pull_request:` trigger carries `paths:` or `paths-ignore:` — the gate
+#    is disarmed for PRs that do not touch the listed paths
+# 12 the `pull_request:` trigger carries a `types:` filter that omits one of
+#    GitHub's defaults (opened, synchronize, reopened) — e.g. `types: [closed]`
+# 13 the `pull_request:` trigger carries a branch filter that excludes `main`
+#
+# DELIBERATELY ACCEPTED (legitimate shapes this must not red on):
+#   * `on: pull_request` and `on: [push, pull_request]` — the inline forms
+#     cannot carry a filter at all, so they are strictly SAFER than the block
+#     form and refusing them would red an honest refactor.
+#   * `"on":` / `'on':` — YAML 1.1 makes bare `on` a boolean and some linters
+#     ask for the quoted key.
+#   * `types:` that is a SUPERSET of the defaults (e.g. + ready_for_review).
+#   * `branches:` that lists the literal `main` alongside anything else.
+#   * `push:`/`schedule:` triggers carrying whatever filters they like — only
+#     the `pull_request:` trigger is graded, because only it decides PR reach.
+# DELIBERATE NARROWING, stated: a `branches:` GLOB that covers main without the
+# literal token (`branches: ['ma*']`) reds. A bash gate cannot honestly evaluate
+# GitHub's glob semantics, and refusing is the fail-closed direction.
+# ---------------------------------------------------------------------------
+assent_pr_reach() {
+  local wf="$1" work="$2"
+  if [[ ! -f "$wf" ]]; then
+    return 2
+  fi
+
+  # --- the `on:` key itself, and any INLINE value it carries -----------------
+  local onhits="$work/pr_reach.on_line"
+  grep -nE "^(on|\"on\"|'on'):" "$wf" >"$onhits" || true
+  if [[ ! -s "$onhits" ]]; then
+    return 2
+  fi
+  local onlineno onvalue
+  onlineno="$(head -1 "$onhits" | cut -d: -f1)"
+  onvalue="$(head -1 "$onhits" | cut -d: -f3-)"
+  onvalue="$(printf '%s' "$onvalue" | _assent_strip_comment | sed 's/^[[:space:]]*//; s/[[:space:]]*$//')"
+
+  if [[ -n "$onvalue" ]]; then
+    case "$onvalue" in
+      '{'*)
+        # `on: {pull_request: {paths: [...]}}` — a flow mapping CAN hide a
+        # filter, and this reader cannot see into it. Refuse.
+        return 10
+        ;;
+      '['*)
+        # A flow SEQUENCE of event names. It cannot carry paths/types/branches,
+        # so membership is the whole question.
+        local seq
+        seq="$(printf '%s' "$onvalue" | tr -c 'A-Za-z0-9_' '\n' | grep -x 'pull_request' || true)"
+        if [[ -n "$seq" ]]; then
+          return 0
+        fi
+        return 2
+        ;;
+      '|'* | '>'* | '&'* | '*'*)
+        # Block scalar, anchor or alias in the `on:` value — not evaluable.
+        return 10
+        ;;
+      pull_request)
+        return 0
+        ;;
+      *)
+        # A single event name that is not pull_request (`on: push`).
+        return 2
+        ;;
+    esac
+  fi
+
+  # --- block-mapping form: the body of `on:` ---------------------------------
+  # Everything after the `on:` line until the next COLUMN-0 key. A column-0
+  # comment does not end the block: ending on one would be the fail-OPEN
+  # direction, because a `paths:` below it would go unseen.
+  local onblk="$work/pr_reach.on_block"
+  awk -v start="$onlineno" 'NR > start { if ($0 ~ /^[^[:space:]#]/) exit; print }' "$wf" >"$onblk"
+  if [[ ! -s "$onblk" ]]; then
+    return 2
+  fi
+
+  # An anchor, alias or merge key anywhere in the trigger block means the
+  # effective value is not what these lines say. Refuse rather than grade a
+  # fiction.
+  local anchors="$work/pr_reach.anchors"
+  grep -nE '^[[:space:]]+(<<:|[A-Za-z0-9_-]+:[[:space:]]*[&*])' "$onblk" >"$anchors" || true
+  if [[ -s "$anchors" ]]; then
+    return 10
+  fi
+
+  # The trigger must be a key of `on:` ITSELF — exactly 2-space indent. A
+  # `pull_request:` nested deeper (a `workflow_call:` input named
+  # `pull_request`, an `inputs:` key, a `paths:` entry) satisfied the old
+  # `^[[:space:]]+pull_request:` grep while reaching no pull request at all.
+  local prhits="$work/pr_reach.pr_line"
+  grep -nE '^  pull_request:' "$onblk" >"$prhits" || true
+  if [[ ! -s "$prhits" ]]; then
+    return 2
+  fi
+  local prlineno prvalue
+  prlineno="$(head -1 "$prhits" | cut -d: -f1)"
+  prvalue="$(head -1 "$prhits" | cut -d: -f3-)"
+  prvalue="$(printf '%s' "$prvalue" | _assent_strip_comment | sed 's/^[[:space:]]*//; s/[[:space:]]*$//')"
+  if [[ -n "$prvalue" ]]; then
+    # `pull_request: {paths: [...]}` or `pull_request: &anchor`. Not evaluable.
+    return 10
+  fi
+
+  # --- the trigger's own filters --------------------------------------------
+  local prblk="$work/pr_reach.pr_block"
+  awk -v start="$prlineno" 'NR > start { if ($0 ~ /^  [^[:space:]#]/) exit; print }' "$onblk" >"$prblk"
+
+  # No sub-block at all (`pull_request:` with nothing under it) is the
+  # unfiltered default, and is the shape verify.yaml has today.
+  if [[ ! -s "$prblk" ]]; then
+    return 0
+  fi
+
+  local pathhits="$work/pr_reach.paths"
+  grep -nE '^    (paths|paths-ignore):' "$prblk" >"$pathhits" || true
+  if [[ -s "$pathhits" ]]; then
+    return 11
+  fi
+
+  local typehits="$work/pr_reach.types"
+  grep -nE '^    types:' "$prblk" >"$typehits" || true
+  if [[ -s "$typehits" ]]; then
+    local toks="$work/pr_reach.types.tok" t
+    _assent_key_tokens "$prblk" types >"$toks"
+    for t in opened synchronize reopened; do
+      if ! grep -qx "$t" "$toks"; then
+        return 12
+      fi
+    done
+  fi
+
+  local brhits="$work/pr_reach.branches"
+  grep -nE '^    branches:' "$prblk" >"$brhits" || true
+  if [[ -s "$brhits" ]]; then
+    local btoks="$work/pr_reach.branches.tok"
+    _assent_key_tokens "$prblk" branches >"$btoks"
+    if ! grep -qx 'main' "$btoks"; then
+      return 13
+    fi
+  fi
+
+  local bihits="$work/pr_reach.branches_ignore"
+  grep -nE '^    branches-ignore:' "$prblk" >"$bihits" || true
+  if [[ -s "$bihits" ]]; then
+    local bitoks="$work/pr_reach.branches_ignore.tok"
+    _assent_key_tokens "$prblk" branches-ignore >"$bitoks"
+    if grep -qx 'main' "$bitoks"; then
+      return 13
+    fi
+  fi
+
+  return 0
+}
+
+# _assent_key_tokens <pull_request-block> <key> — every token of a 4-space
+# `key:` whose value is an inline flow sequence, a block sequence, or a plain
+# scalar. One token per line, quotes and punctuation removed.
+_assent_key_tokens() {
+  local blk="$1" key="$2"
+  awk -v key="$key" '
+    BEGIN { re = "^    " key ":" }
+    $0 ~ re { ink = 1; v = $0; sub(re, "", v); print v; next }
+    ink && /^    [^[:space:]#]/ { ink = 0 }
+    ink { print }
+  ' "$blk" \
+    | _assent_strip_comment \
+    | tr -c 'A-Za-z0-9_' '\n' \
+    | grep -v '^$' || true
+}
+
+# ---------------------------------------------------------------------------
+# assent_step_wired <workflow-file> <job> <script-rel-path> <scratch-dir>
+#
+# 0  the job runs the script as a real command, argument-free and undisarmed
+# 3  the job block extracted empty, or has no `steps:` key
+# 4  the job carries a JOB-LEVEL `if:` — release-exitgate's push-only guard is
+#    exactly this, and it takes every step in the job with it
+# 5  no `run:` COMMAND invokes the script: deleted, commented out, or surviving
+#    only as a comment tail beside a live no-op. THIS is the code the fixed-
+#    string check in hack/audit/aud2_exitgate_test.sh could not reach — it
+#    reported "WITH ARGUMENTS" instead, because the step's comments still
+#    named the script (D-157 residual 3, measured by the reviewer).
+# 6  the step could not be isolated: not exactly one `run:` key, or a `uses:`
+#    key inside it. Both mean the region is not one step — the shape you get by
+#    deleting a step's `- name:` line, which merges it into its neighbour.
+# 7  the script is invoked WITH ARGUMENTS — how a wired-looking gate is
+#    hollowed out (`--text-only` skips aud2's behavioural runs entirely)
+# 8  the step is present but DISARMED with `if:` or `continue-on-error:`
+# 9  the job carries a JOB-LEVEL `needs:` — a dependency that skips on pull
+#    requests skips this job too, so the gate becomes push-only by proxy while
+#    every other assertion here stays green
+#
+# DELIBERATELY ACCEPTED: a block-scalar invocation (`run: |` then
+# `bash <script>`) — but ONLY when that is the block's sole command; a bare
+# invocation smuggled into some OTHER step's multi-command `run: |` body is
+# rc=5, because what the rest of that shell script does is not readable from
+# here; arbitrarily long comment blocks INSIDE the step (all three
+# gate steps carry them, which is why a line cap was rejected in favour of the
+# one-`run:`-key invariant); step-level `if:` on OTHER steps in the same job
+# (verify.yaml's changelog drift gate is legitimately PR-excluded).
+#
+# NOT PARSED, stated: `strategy:`/matrix skips, `jobs.<id>.uses:` reusable
+# workflows, and a `container:` whose entrypoint could no-op the run. A gate
+# reading text cannot see those.
+# ---------------------------------------------------------------------------
+assent_step_wired() {
+  local wf="$1" job="$2" script="$3" work="$4"
+  if [[ ! -f "$wf" ]]; then
+    return 3
+  fi
+
+  local jb="$work/step_wired.job"
+  awk -v name="$job" '
+    $0 == "  " name ":" { inj = 1; next }
+    inj && /^[^[:space:]#]/ { inj = 0 }
+    inj && /^  [A-Za-z0-9_.-]+:[[:space:]]*$/ { inj = 0 }
+    inj { print }
+  ' "$wf" >"$jb"
+  if [[ ! -s "$jb" ]]; then
+    return 3
+  fi
+  local stepskey="$work/step_wired.stepskey"
+  grep -nE '^    steps:' "$jb" >"$stepskey" || true
+  if [[ ! -s "$stepskey" ]]; then
+    return 3
+  fi
+
+  # Job-level keys sit at 4 spaces; step-level ones at 8.
+  local jobif="$work/step_wired.jobif"
+  grep -nE '^    if:' "$jb" >"$jobif" || true
+  if [[ -s "$jobif" ]]; then
+    return 4
+  fi
+  local jobneeds="$work/step_wired.jobneeds"
+  grep -nE '^    needs:' "$jb" >"$jobneeds" || true
+  if [[ -s "$jobneeds" ]]; then
+    return 9
+  fi
+
+  # The COMMAND, never a mention. All three gate steps carry comments that name
+  # this script by path; a fixed-string search calls those comments "wired".
+  # A `#` in front of either form below fails the anchor.
+  #
+  # Two forms, tried in that order, because they are NOT equally safe:
+  #   plain  `run: bash <script>` — the step's whole command is this gate.
+  #   block  a bare `bash <script>` line inside a `run: |` body. Accepted, but
+  #          only under the extra conditions checked further down: the step's
+  #          `run:` must be a block-scalar header and that line must be the only
+  #          command in the body. WITHOUT that restriction this is a FAIL-OPEN,
+  #          measured while building this file: append `bash <script>` to any
+  #          existing multi-command `run: |` step and delete the real step, and
+  #          the check returned 0 — while `echo skip && exit 0` on the line
+  #          above would mean the gate never runs. A shell script is not a
+  #          workflow step, and a gate cannot read one.
+  local re
+  re="$(_assent_ere_escape "$script")"
+  local cmdhits="$work/step_wired.cmd" cmdform="plain"
+  grep -nE "^[[:space:]]*run:[[:space:]]*bash[[:space:]]+${re}([[:space:]]|\$)" "$jb" >"$cmdhits" || true
+  if [[ ! -s "$cmdhits" ]]; then
+    cmdform="block"
+    grep -nE "^[[:space:]]*bash[[:space:]]+${re}([[:space:]]|\$)" "$jb" >"$cmdhits" || true
+  fi
+  if [[ ! -s "$cmdhits" ]]; then
+    return 5
+  fi
+
+  local lineno
+  lineno="$(head -1 "$cmdhits" | cut -d: -f1)"
+  local step="$work/step_wired.step"
+  awk -v target="$lineno" '
+    { lines[NR] = $0; if ($0 ~ /^      - /) starts[NR] = 1 }
+    END {
+      start = 0
+      for (i = target; i >= 1; i--) if (i in starts) { start = i; break }
+      if (start == 0) exit 1
+      end = NR
+      for (i = start + 1; i <= NR; i++) if (i in starts) { end = i - 1; break }
+      for (i = start; i <= end; i++) print lines[i]
+    }
+  ' "$jb" >"$step" || true
+  if [[ ! -s "$step" ]]; then
+    return 6
+  fi
+  local marker="$work/step_wired.marker"
+  grep -nE '^      - ' "$step" >"$marker" || true
+  if [[ ! -s "$marker" ]]; then
+    return 6
+  fi
+
+  # THE isolation invariant, and the reason the earlier 1..6 LINE cap was
+  # dropped: a step has exactly one `run:` key and, if it runs a command, no
+  # `uses:` key. Both are what actionlint itself flags. Deleting a step's
+  # `- name:` merges it into its neighbour, which yields either two `run:` keys
+  # or a stray `uses:` — a malformed workflow the older checks accepted (rc=0,
+  # measured). A line cap cannot separate those cases here, because these steps
+  # carry long comment blocks and the honest size and the merged size differ by
+  # one line.
+  local n_run n_uses
+  n_run="$(grep -cE '^[[:space:]]*(-[[:space:]]+)?run:' "$step" || true)"
+  n_uses="$(grep -cE '^[[:space:]]*(-[[:space:]]+)?uses:' "$step" || true)"
+  if [[ "$n_run" != "1" ]] || [[ "$n_uses" != "0" ]]; then
+    return 6
+  fi
+
+  # The block-scalar form's extra conditions. `run:` must be a block-scalar
+  # HEADER (`|`, `|-`, `>`, `>-`, `|2` …) and the body must contain exactly one
+  # command — this one. Anything else means the isolated step's script does more
+  # than run this gate, and what the rest of that script does (`exit 0` two
+  # lines up) is beyond what a text gate can honestly grade. Shell comment lines
+  # are allowed through: they cannot execute, and forbidding them would red an
+  # honest step that documents its own command.
+  local runhdr="$work/step_wired.runline"
+  grep -nE '^[[:space:]]*(-[[:space:]]+)?run:' "$step" >"$runhdr" || true
+  if [[ ! -s "$runhdr" ]]; then
+    return 6
+  fi
+  if [[ "$cmdform" == "block" ]]; then
+    local runno
+    runno="$(head -1 "$runhdr" | cut -d: -f1)"
+    local hdrline
+    hdrline="$(sed -n "${runno}p" "$step")"
+    case "$hdrline" in
+      *run:*) : ;;
+      *) return 6 ;;
+    esac
+    local blockhdr="$work/step_wired.blockhdr"
+    printf '%s\n' "$hdrline" | grep -nE 'run:[[:space:]]*[|>][-+0-9]*[[:space:]]*$' >"$blockhdr" || true
+    if [[ ! -s "$blockhdr" ]]; then
+      return 5
+    fi
+    local body="$work/step_wired.runbody"
+    awk -v s="$runno" '
+      NR == s { match($0, /^[ ]*/); ind = RLENGTH; next }
+      NR > s {
+        if ($0 ~ /^[[:space:]]*$/) next
+        match($0, /^[ ]*/)
+        if (RLENGTH <= ind) exit
+        if ($0 ~ /^[[:space:]]*#/) next
+        print
+      }
+    ' "$step" >"$body"
+    local n_body
+    n_body="$(grep -c . "$body" || true)"
+    if [[ "$n_body" != "1" ]]; then
+      return 5
+    fi
+    local bodycmd="$work/step_wired.bodycmd"
+    grep -nE "^[[:space:]]*bash[[:space:]]+${re}([[:space:]]|\$)" "$body" >"$bodycmd" || true
+    if [[ ! -s "$bodycmd" ]]; then
+      return 5
+    fi
+  fi
+
+  local argfree="$work/step_wired.argfree"
+  grep -nE "^[[:space:]]*(run:[[:space:]]*)?bash[[:space:]]+${re}[[:space:]]*\$" "$step" >"$argfree" || true
+  if [[ ! -s "$argfree" ]]; then
+    return 7
+  fi
+
+  local disarmed="$work/step_wired.disarmed"
+  grep -nE '^[[:space:]]*(if|continue-on-error):' "$step" >"$disarmed" || true
+  if [[ -s "$disarmed" ]]; then
+    return 8
+  fi
+
+  return 0
+}
diff --git a/hack/lint/workflow_pins_test.sh b/hack/lint/workflow_pins_test.sh
index a424ac31..e479c7da 100755
--- a/hack/lint/workflow_pins_test.sh
+++ b/hack/lint/workflow_pins_test.sh
@@ -47,6 +47,23 @@ cd "$ROOT"
 WORKFLOWS="$ROOT/.github/workflows"
 VALIDATOR="$ROOT/hack/schemas-validator"
 
+# D-157 — the PR-reach and step-wiring readers are SHARED with the other two
+# PR-visible text gates (hack/audit/aud2_exitgate_test.sh,
+# hack/examples/dogfood_wiring_test.sh). Sourced, not executed; it returns codes
+# and prints nothing, so every finding below stays this script's own wording.
+# The helper is held to THIS file's preamble rules (bash 3.2, portable ERE, no
+# git, no `grep -q` on a pipe) because this gate is the strictest consumer: it
+# runs first in CI, before any toolchain, and must work in `debian:stable-slim`.
+PR_REACH_LIB="$ROOT/hack/lib/pr_reach.sh"
+[[ -f "$PR_REACH_LIB" ]] || {
+  echo "FAIL: missing $PR_REACH_LIB — the shared PR-reach/step-wiring helper (D-157). Refusing to run rather than skipping section 5." >&2
+  exit 1
+}
+# shellcheck source=../lib/pr_reach.sh
+. "$PR_REACH_LIB"
+
+SELF_GATE="hack/lint/workflow_pins_test.sh"
+
 WORK="$(mktemp -d)"
 cleanup() { rm -rf "$WORK"; }
 trap cleanup EXIT
@@ -382,81 +399,150 @@ check_ci_wiring() {
     echo "  missing $file" >&2
     return 1
   }
-  local cmds="$WORK/cmd.verify"
-  command_view "$file" >"$cmds"
 
-  # N1: the command must BEGIN with the invocation. `run: echo skipped
-  # # was: bash hack/lint/workflow_pins_test.sh` used to satisfy this.
-  local wiring="$WORK/hits.wiring"
-  grep -E '^[0-9]+:bash[[:space:]]+hack/lint/workflow_pins_test\.sh([[:space:]]|$)' "$cmds" >"$wiring" || true
-  if [[ ! -s "$wiring" ]]; then
-    echo "  verify.yaml does not RUN 'bash hack/lint/workflow_pins_test.sh' as an actual command — the workflow-pin gate would only ever run locally" >&2
-    return 1
-  fi
-
-  # Review finding N2/N5: being present is not being ENABLED. `continue-on-error:
-  # true` on this step leaves the gate and actionlint both green while the CI
-  # half is neutered — the most realistic "just unblock CI" edit there is, and
-  # the silent one (`if:` is caught by actionlint only in some forms).
-  #
-  # N5 — the first attempt at this got the EXTRACTION wrong, and worse, its two
-  # controls only ever inserted the key AFTER `run:`, so the matrix certified
-  # the one position that happened to work and never exercised the one that did
-  # not. The old awk switched `inblock` on at the marker line, which is the
-  # `run:` line, having already reset it at the preceding `- name:` — so the
-  # "step" was a single line, and everything between `- name:` and `run:` was
-  # invisible. That is the CONVENTIONAL position for `if:` and
-  # `continue-on-error:`, the ordering GitHub's own docs use. It also swallowed
-  # the file-header comment (which names this script) plus `env:`/`jobs:`/
-  # `verify:`/`runs-on:`/`steps:`, because nothing reset `inblock` until the
-  # first `^      - ` — so the non-empty control passed on a region that was
-  # mostly not the step.
+  # D-157, half one: THE WORKFLOW MUST REACH PULL REQUESTS. This gate asserted
+  # its step was present and undisarmed and never asked whether the workflow
+  # carrying that step runs on a PR at all — so `on: pull_request` deleted
+  # outright, or narrowed with `paths:`, left every assertion below green while
+  # the gate reached CI only through `task check` -> release-exitgate, whose
+  # `if: github.event_name != 'pull_request'` is RELSE-08. The two sibling
+  # gates DID ask, with `grep -qE '^[[:space:]]+pull_request:'`, which a
+  # reviewer defeated with a paths-filtered trigger (rc=0, measured). The check
+  # is now one shared reader, hack/lib/pr_reach.sh, for all three.
+  local reach=0
+  assent_pr_reach "$file" "$WORK" || reach=$?
+  case "$reach" in
+    0) : ;;
+    2)
+      echo "  verify.yaml has no top-level 'pull_request:' trigger — this gate would reach CI only through release-exitgate, which skips pull requests (RELSE-08), so a PR that unpins a workflow merges green and reddens main afterwards" >&2
+      return 1
+      ;;
+    10)
+      echo "  verify.yaml's 'on:' block uses a shape hack/lib/pr_reach.sh refuses to evaluate (a flow mapping, an anchor or an alias) — a paths:/types: filter hidden there would disarm this gate silently, so it fails closed rather than guessing" >&2
+      return 1
+      ;;
+    11)
+      echo "  verify.yaml's pull_request trigger carries a 'paths:' or 'paths-ignore:' filter — the trigger is PRESENT and the gate still loses every PR that does not touch the listed paths. A PR editing only .github/workflows/** could then unpin an action with this gate never running" >&2
+      return 1
+      ;;
+    12)
+      echo "  verify.yaml's pull_request trigger carries a 'types:' filter that omits one of GitHub's defaults (opened, synchronize, reopened) — 'types: [closed]' satisfies a presence grep and never fires on an open PR" >&2
+      return 1
+      ;;
+    13)
+      echo "  verify.yaml's pull_request trigger carries a branch filter that excludes 'main' — PRs onto the branch this gate protects would not run it" >&2
+      return 1
+      ;;
+    *)
+      echo "  assent_pr_reach returned an unmapped code $reach" >&2
+      return 1
+      ;;
+  esac
+
+  # D-157, half two: the STEP. The extraction, the disarm scan and the
+  # comment-vs-command anchor all moved into assent_step_wired, which is the
+  # strongest of the three gates' versions (N1/N2/N5 below were the findings
+  # that shaped it) plus two the local copy never had: a job-level `needs:`,
+  # and the one-`run:`-key/no-`uses:`-key isolation invariant that replaced the
+  # 1..6 LINE cap. The cap could not survive cross-pinning: the aud2 and
+  # dogfood steps carry comment blocks a dozen lines long, so no cap admits an
+  # honest step of theirs while rejecting a merged one.
   #
-  # Correct extraction: start from the line the command was actually FOUND on,
-  # walk BACK to the nearest preceding step start, then forward to the next one.
-  local lineno
-  lineno="$(awk -F: 'NR == 1 { print $1 }' "$wiring")"
-  local step="$WORK/step.wiring"
-  awk -v target="$lineno" '
-    { lines[NR] = $0 }
-    /^      - / { starts[NR] = 1 }
-    END {
-      start = 0
-      for (i = target; i >= 1; i--) if (i in starts) { start = i; break }
-      if (start == 0) exit 1
-      end = NR
-      for (i = start + 1; i <= NR; i++) if (i in starts) { end = i - 1; break }
-      for (i = start; i <= end; i++) print lines[i]
-    }
-  ' "$file" >"$step" || true
-
-  # Positive controls on the isolation itself. The previous version had only a
-  # non-empty check, which an 11-line slab of file header satisfied happily.
-  local n_step
-  n_step="$(wc -l <"$step" | tr -d '[:space:]')"
-  if [[ ! -s "$step" ]] || ((n_step > 6)); then
-    echo "  could not isolate the workflow-pin gate step in verify.yaml (got $n_step lines, expected 1..6) — the extraction broke, so the assertions below would be vacuous" >&2
+  # N1 is preserved by the anchor: the command must BEGIN with the invocation.
+  # `run: echo skipped  # was: bash hack/lint/workflow_pins_test.sh` is a
+  # finding, not a pass.
+  # N2/N5 are preserved by the disarm scan over the WHOLE isolated step, so
+  # `continue-on-error:`/`if:` are caught in the conventional position (between
+  # `- name:` and `run:`) as well as after `run:`.
+  local wired=0
+  assent_step_wired "$file" "$ASSENT_PR_JOB" "$SELF_GATE" "$WORK" || wired=$?
+  case "$wired" in
+    0) : ;;
+    3)
+      echo "  the '$ASSENT_PR_JOB' job block extracted empty or without a 'steps:' key — the extraction broke, so every assertion about this gate's step would be vacuous" >&2
+      rc=1
+      ;;
+    4)
+      echo "  the '$ASSENT_PR_JOB' job carries a JOB-LEVEL if: — if it skips pull requests this gate is push-only exactly like release-exitgate, and RELSE-08 is reproduced with the step still in place" >&2
+      rc=1
+      ;;
+    5)
+      echo "  verify.yaml does not RUN 'bash $SELF_GATE' as an actual command — the workflow-pin gate would only ever run locally" >&2
+      rc=1
+      ;;
+    6)
+      echo "  could not isolate the workflow-pin gate step in verify.yaml (its region is not exactly one step: either two 'run:' keys or a stray 'uses:' key, the shape a deleted '- name:' produces) — the extraction broke, so the assertions here would be vacuous" >&2
+      rc=1
+      ;;
+    7)
+      echo "  the workflow-pin gate step invokes $SELF_GATE WITH ARGUMENTS — this gate takes none, and an argument-carrying invocation is how a wired-looking step is hollowed out" >&2
+      rc=1
+      ;;
+    8)
+      echo "  the workflow-pin gate step is present but DISARMED — 'continue-on-error' or 'if:' means a red gate does not fail the job" >&2
+      rc=1
+      ;;
+    9)
+      echo "  the '$ASSENT_PR_JOB' job carries a JOB-LEVEL needs: — a dependency that skips on pull requests skips this job with it, so the gate is push-only by proxy while the step still looks wired" >&2
+      rc=1
+      ;;
+    *)
+      echo "  assent_step_wired returned an unmapped code $wired" >&2
+      rc=1
+      ;;
+  esac
+  return "$rc"
+}
+
+# D-157 residual 2 — CROSS-PINNING. Until now each of the three PR-visible text
+# gates pinned only its OWN step (this one section 5, hack/audit/
+# aud2_exitgate_test.sh's check_pr_wiring, hack/examples/
+# dogfood_wiring_test.sh section 7); a reviewer grepped and confirmed none
+# named another. So a PR that deleted one of those three steps was invisible to
+# the gate still running on that PR — caught locally by `task check` and on
+# push by release-exitgate, which is why it was a gap and not a hole. Each gate
+# now asserts all three steps, so deleting ANY ONE reds on the pull request
+# that does it, twice over.
+check_pr_gate_cross_pins() {
+  local dir="$1"
+  local file="$dir/verify.yaml"
+  local rc=0
+  [[ -f "$file" ]] || {
+    echo "  missing $file" >&2
+    return 1
+  }
+  local others="$WORK/cross.others"
+  if ! assent_pr_gate_others "$SELF_GATE" >"$others"; then
+    echo "  $SELF_GATE is not listed in ASSENT_PR_GATES (hack/lib/pr_reach.sh) — the cross-pin set is not the set this gate belongs to, so this check would grade an unrelated pair" >&2
     return 1
   fi
-  grep -Eq '^      - ' "$step" || {
-    echo "  the isolated region does not START with a step marker — it is not a step, so the assertions below would be vacuous" >&2
+  if ((${#ASSENT_PR_GATES[@]} != 3)); then
+    echo "  ASSENT_PR_GATES holds ${#ASSENT_PR_GATES[@]} entries, expected the 3 PR-visible text gates — a fourth needs its own cross-pin, not a silently widened one" >&2
     return 1
-  }
-  grep -Fq 'workflow_pins_test.sh' "$step" || {
-    echo "  the isolated step does not contain the gate invocation — the wrong step was isolated" >&2
+  fi
+  local n
+  n="$(wc -l <"$others" | tr -d '[:space:]')"
+  if [[ "$n" != "2" ]]; then
+    echo "  expected exactly 2 sibling gates to cross-pin, got $n — the positive control on the shared list failed, so the assertions below would be vacuous" >&2
     return 1
-  }
-
-  local disabled="$WORK/hits.step_disabled"
-  grep -En '^[[:space:]]*(continue-on-error|if):' "$step" >"$disabled" || true
-  if [[ -s "$disabled" ]]; then
-    echo "  the workflow-pin gate step is present but DISARMED — 'continue-on-error' or 'if:' means a red gate does not fail the job:" >&2
-    sed 's/^/    /' "$disabled" >&2
-    rc=1
   fi
+  local g w
+  while IFS= read -r g; do
+    [[ -n "$g" ]] || continue
+    if [[ ! -f "$ROOT/$g" ]]; then
+      echo "  cross-pinned gate $g does not exist on disk — the pin would assert a step that runs nothing" >&2
+      rc=1
+      continue
+    fi
+    w=0
+    assent_step_wired "$file" "$ASSENT_PR_JOB" "$g" "$WORK" || w=$?
+    if ((w != 0)); then
+      echo "  the sibling PR-visible gate $g is NOT wired undisarmed into the '$ASSENT_PR_JOB' job (assent_step_wired rc=$w: 3 job unextractable, 4 job-level if:, 5 no run: command, 6 step unisolatable, 7 arguments, 8 disarmed, 9 job-level needs:) — deleting one of the three gate steps must redden the PR that does it, and this is the half of that guarantee this script owns" >&2
+      rc=1
+    fi
+  done <"$others"
   return "$rc"
 }
-
 # Review finding N6 — `command_view` strips from the leftmost ` #`, which is
 # exactly YAML's rule for a PLAIN scalar (verified: `run: echo "step # 1" && …`
 # really is truncated by YAML too, and actionlint reds it with SC1072). It is
@@ -926,9 +1012,174 @@ m="$(mutant wiring-name-removed)"
 mutate "$m/verify.yaml" \
   '/^      - name: workflow supply-chain pins/d' \
   'run: bash hack/lint/workflow_pins_test.sh'
-expect_red check_ci_wiring "$m" "the step's own '- name:' line is gone, so no step start precedes the command (N5)" \
+expect_red check_ci_wiring "$m" "the step's own '- name:' line is gone, so it merged into the checkout step above (N5)" \
   'the extraction broke'
 
+m="$(mutant wiring-arguments)"
+mutate "$m/verify.yaml" \
+  's|^        run: bash hack/lint/workflow_pins_test.sh$|        run: bash hack/lint/workflow_pins_test.sh --quick|' \
+  'workflow_pins_test.sh --quick'
+expect_red check_ci_wiring "$m" "the step still names the gate but passes it an argument" \
+  'WITH ARGUMENTS'
+
+# ---- D-157: the job-level routes that leave the step untouched --------------
+m="$(mutant wiring-job-if)"
+mutate_awk "$m/verify.yaml" \
+  '{ print; if ($0 == "  verify:") print "    if: github.event_name != '"'"'pull_request'"'"'" }' \
+  "if: github.event_name != 'pull_request'"
+expect_red check_ci_wiring "$m" "the verify JOB was given release-exitgate's push-only guard, step untouched" \
+  'JOB-LEVEL if:'
+
+# A job that `needs:` a job which skips on pull requests is itself skipped —
+# every other assertion here stays green and the gate never runs on a PR.
+m="$(mutant wiring-job-needs)"
+mutate_awk "$m/verify.yaml" \
+  '{ print; if ($0 == "  verify:") print "    needs: release-exitgate" }' \
+  'needs: release-exitgate'
+expect_red check_ci_wiring "$m" "the verify JOB was made to depend on the push-only release-exitgate job" \
+  'JOB-LEVEL needs:'
+
+m="$(mutant wiring-job-renamed)"
+mutate "$m/verify.yaml" \
+  's|^  verify:$|  verify-all:|' \
+  'verify-all:'
+expect_red check_ci_wiring "$m" "the 'verify' job was renamed, so the job extraction finds nothing" \
+  'the extraction broke'
+
+# ------------------- 5b. D-157: the workflow must REACH pull requests --------
+#
+# This gate never asked. The two sibling gates did, with
+# `grep -qE '^[[:space:]]+pull_request:'`, and a reviewer defeated that grep
+# with a paths-filtered trigger and measured rc=0. Both halves are controlled
+# here now: the ones that satisfy the old grep are marked, because they are the
+# whole reason hack/lib/pr_reach.sh exists.
+
+echo "== 5b. verify.yaml reaches EVERY pull request, unfiltered =="
+
+# Insert a filter directly under the `pull_request:` trigger key.
+pr_filter_mutant() { # <name> <yaml line…>
+  local name="$1"
+  shift
+  local d payload
+  d="$(mutant "$name")"
+  payload="$(printf '%s\n' "$@")"
+  mutate_awk "$d/verify.yaml" \
+    "{ print } \$0 == \"  pull_request:\" { print \"$payload\" }" \
+    "$payload"
+  local kept="$WORK/hits.pr_still_present.$name"
+  grep -nE '^[[:space:]]+pull_request:' "$d/verify.yaml" >"$kept" || true
+  [[ -s "$kept" ]] ||
+    fail "mutation control '$name' is not the intended one: the mutant no longer satisfies even the OLD '^[[:space:]]+pull_request:' grep, so it does not demonstrate the bypass"
+  printf '%s' "$d"
+}
+
+m="$(pr_filter_mutant pr-paths "    paths: [internal/**]")"
+expect_red check_ci_wiring "$m" "the pull_request trigger grew a paths: filter — SATISFIES the old grep, disarms the gate for a PR touching only .github/workflows/**" \
+  "carries a 'paths:' or 'paths-ignore:' filter"
+
+m="$(pr_filter_mutant pr-paths-ignore "    paths-ignore: [docs/**]")"
+expect_red check_ci_wiring "$m" "the pull_request trigger grew a paths-ignore: filter — SATISFIES the old grep" \
+  "carries a 'paths:' or 'paths-ignore:' filter"
+
+m="$(pr_filter_mutant pr-types-closed "    types: [closed]")"
+expect_red check_ci_wiring "$m" "the pull_request trigger was narrowed to types: [closed] — SATISFIES the old grep, never fires on an open PR" \
+  "omits one of GitHub's defaults"
+
+m="$(pr_filter_mutant pr-types-partial "    types: [opened, reopened]")"
+expect_red check_ci_wiring "$m" "the pull_request types: list dropped 'synchronize', so the gate would not re-run when a PR is updated" \
+  "omits one of GitHub's defaults"
+
+m="$(pr_filter_mutant pr-branches "    branches: [release]")"
+expect_red check_ci_wiring "$m" "the pull_request trigger was restricted to base branches that exclude main" \
+  "branch filter that excludes 'main'"
+
+m="$(mutant pr-flow-mapping)"
+mutate "$m/verify.yaml" \
+  's|^  pull_request:$|  pull_request: {paths: [internal/**]}|' \
+  'pull_request: {paths:'
+expect_red check_ci_wiring "$m" "the paths: filter was hidden inside a YAML flow mapping — refused, not guessed at" \
+  'refuses to evaluate'
+
+m="$(mutant pr-deleted)"
+mutate "$m/verify.yaml" \
+  '/^  pull_request:$/d' \
+  'push:'
+expect_red check_ci_wiring "$m" "verify.yaml stopped triggering on pull_request at all (RELSE-08 by another route)" \
+  "no top-level 'pull_request:' trigger"
+
+# The indent-scoping half: the ONLY `pull_request:` left is an input NAME nested
+# under another trigger. `grep -qE '^[[:space:]]+pull_request:'` says yes.
+m="$(mutant pr-nested-elsewhere)"
+mutate_awk "$m/verify.yaml" \
+  '{ if ($0 == "  pull_request:") { print "  workflow_call:"; print "    inputs:"; print "      pull_request:"; print "        type: string" } else print }' \
+  '      pull_request:'
+nested_hits="$WORK/hits.pr_nested"
+grep -nE '^[[:space:]]+pull_request:' "$m/verify.yaml" >"$nested_hits" || true
+[[ -s "$nested_hits" ]] ||
+  fail "mutation control 'pr-nested-elsewhere' is not the intended one: no 'pull_request:' line survives, so it does not test indent scoping"
+expect_red check_ci_wiring "$m" "the only 'pull_request:' left is a workflow_call INPUT NAME — SATISFIES the old indent-blind grep, and GitHub never runs the workflow on a PR" \
+  "no top-level 'pull_request:' trigger"
+
+# The other polarity, so this is not a gate that reds on any filter at all: the
+# legitimate shapes must still PASS. Without these, the six controls above are
+# equally satisfied by a check that always fails.
+echo "== 5b2. legitimate trigger shapes still PASS (the anti-overreach control) =="
+m="$(pr_filter_mutant pr-types-superset "    types: [opened, synchronize, reopened, ready_for_review]")"
+expect_green check_ci_wiring "$m" "a types: list that SUPERSETS GitHub's defaults is accepted"
+m="$(pr_filter_mutant pr-branches-main "    branches: [main]")"
+expect_green check_ci_wiring "$m" "branches: [main] — the branch this gate protects — is accepted"
+m="$(pr_filter_mutant pr-branches-ignore-other "    branches-ignore: [gh-pages]")"
+expect_green check_ci_wiring "$m" "branches-ignore: on a branch that is not main is accepted"
+m="$(mutant pr-inline-seq)"
+mutate_awk "$m/verify.yaml" \
+  '{ if ($0 == "on:") { print "on: [push, pull_request]"; skip = 1; next } if (skip && $0 ~ /^  /) next; skip = 0; print }' \
+  'on: [push, pull_request]'
+expect_green check_ci_wiring "$m" "the inline 'on: [push, pull_request]' form — which cannot carry a filter at all — is accepted"
+m="$(mutant pr-quoted-on)"
+mutate "$m/verify.yaml" \
+  's|^on:$|"on":|' \
+  '"on":'
+expect_green check_ci_wiring "$m" "the quoted '\"on\":' key (YAML 1.1 truthiness) is accepted"
+# A fail-open found by building the mutant, not by reasoning: the block-scalar
+# form below is accepted on purpose, and accepting it naively makes a BARE
+# `bash <script>` line anywhere in the job satisfy the check — including inside
+# another step's multi-command `run: |` body, where `echo skip && exit 0` a line
+# above would mean this gate never runs. Measured at rc=0 before the
+# restriction; the block form now counts only as a block's SOLE command.
+m="$(mutant wiring-block-bleed)"
+mutate_awk "$m/verify.yaml" \
+  '{ if ($0 == "        run: bash hack/lint/workflow_pins_test.sh") next; print; if ($0 ~ /go test -count=2 \.\/internal\/render/) print "          bash hack/lint/workflow_pins_test.sh" }' \
+  '          bash hack/lint/workflow_pins_test.sh'
+bleed_real="$WORK/hits.bleed_real"
+grep -nF -- '        run: bash hack/lint/workflow_pins_test.sh' "$m/verify.yaml" >"$bleed_real" || true
+[[ -s "$bleed_real" ]] && fail "mutation control 'wiring-block-bleed' is not the intended one: the real step's run: line survived"
+expect_red check_ci_wiring "$m" "the gate's own step was deleted and its invocation smuggled into ANOTHER step's multi-command 'run: |' body" \
+  'the workflow-pin gate would only ever run locally'
+
+m="$(mutant wiring-block-scalar)"
+mutate_awk "$m/verify.yaml" \
+  '{ if ($0 == "        run: bash hack/lint/workflow_pins_test.sh") { print "        run: |"; print "          bash hack/lint/workflow_pins_test.sh" } else print }' \
+  '          bash hack/lint/workflow_pins_test.sh'
+expect_green check_ci_wiring "$m" "a block-scalar 'run: |' invocation of this gate is accepted"
+
+# ---------------- 5c. D-157 residual 2: the other two PR-visible gates -------
+
+echo "== 5c. the other two PR-visible text gates are wired in the same job =="
+expect_green check_pr_gate_cross_pins "$WORKFLOWS" \
+  "verify.yaml also runs hack/audit/aud2_exitgate_test.sh and hack/examples/dogfood_wiring_test.sh, undisarmed"
+
+# Six rows across the three gates, two of them here: deleting a sibling's step
+# must red THIS gate, because on that PR this gate is the one still running.
+while IFS= read -r sibling_gate; do
+  [[ -n "$sibling_gate" ]] || continue
+  m="$(mutant "cross-pin-$(basename "$sibling_gate" .sh)")"
+  mutate "$m/verify.yaml" \
+    "\\|^        run: bash ${sibling_gate}\$|d" \
+    "run: bash $SELF_GATE"
+  expect_red check_pr_gate_cross_pins "$m" "the step running the sibling gate $sibling_gate was deleted from the verify job" \
+    "the sibling PR-visible gate $sibling_gate is NOT wired"
+done < <(assent_pr_gate_others "$SELF_GATE")
+
 # ------------------------------ 6. N6: quoted-scalar precondition enforced --
 
 echo "== 6. N6: no ' #' inside a quoted scalar (command_view's precondition) =="
diff --git a/openspec/specs/backlog.md b/openspec/specs/backlog.md
index 39d74b74..e61bbbfe 100644
--- a/openspec/specs/backlog.md
+++ b/openspec/specs/backlog.md
@@ -754,6 +754,7 @@ that claim).
 | CI-TOOLCHAIN-F01 | The linter/toolchain coupling has **no early detector**: dependabot's `github-actions` ecosystem updates `uses:` refs, not `env:` literals, so `GOLANGCI_LINT_VERSION` rots silently until the next Go minor reds every PR at once (~6-monthly). Candidate: a text gate comparing the pinned linter release's go.mod `go 1.N` directive against the toolchain CI resolves, or an updater that watches the literal | **[autonomous]** | D-158 | deliberately out of scope of the fix lane: three lanes were parked behind it, and a new gate belongs with `hack/lint/**`, which was owned by a concurrent lane |
 | BASH32-F01 | **DONE** — three `hack/**` gate scripts used bash 4+ features with no version guard; under stock macOS `/bin/bash` 3.2 `hack/docs/truthlag_pins_test.sh` died at its `declare -A`, skipped its final `OK:` banner and **exited 0**, so `task docs-gates` (and `task check`) read a gate that certified almost nothing as green. Fixed by a shared, per-script-parameterised `hack/lib/require-bash.sh` floor (4.0 / 4.0 / 4.4), enforced by a new `hack/lint/bash_version_guard_test.sh` wired as `task check` stage 20 (D-154) | **[autonomous]** | — | found *by* the AUD2 wave's macOS runs, not by any audit: CI is ubuntu/bash 5, so the hole is LOCAL-only and no CI lane could have surfaced it |
 | UNIV-COSIGN | **DONE (D-160)** — `hack/release/install_cosign_pin_test.sh` graded the D-153 signer pin **existentially** ("*some* `cosign verify-blob` in this file is pinned") where the published guarantee is **universal**, so a **second, unpinned** invocation passed: measured before the fix on scratch copies of all three graded files, rc=**0**/**0**/**0**. `has_flag` grepped the whole folded extraction so a pinned sibling satisfied it, `one_value`'s `sort -u` collapsed the agreeing values, §0 printed the invocation count without asserting it, and 4b/5d's stub-log greps were positive-only — the same shape at runtime. `SECURITY.md` had **no invocation-level grading at all**, only the drift comparison. Closed by one predicate (`pin_violations`) applied to **every** invocation in **all three** files plus its runtime twin, with fail-CLOSED classification of anything it cannot place, mutation-proven by eight mutants per file chosen for **branch** coverage (second-unpinned / second-pinned / off-command-position / no-candidates / fold-broken / no-invocations / empty-identity-regexp / foreign-issuer) plus a prose-exemption control. The check compares each invocation's **value** against SECURITY.md's published pair, not just flag presence: `--certificate-identity-regexp ''` carries the flag, matches every Fulcio identity, and slips past `one_value`'s `sort -u` because an empty capture is not a line. **CORRECTION TO THE RECORDED REMEDY — do not implement it:** the filed remedy "assert the extracted invocation count is exactly 1 per graded file" is **factually wrong and would red `main` on landing**, because `SECURITY.md` legitimately publishes **two** invocations (`SECURITY.md:86` over the archive and `:93` over `checksums.txt`, which is what covers the SBOMs listed inside it). The property is universal, not a count. **Second round (UC-01..UC-04), caught by independent review:** the first fix reproduced the same existential defect one scope down — per **line** instead of per **file** — so an unpinned call CHAINED onto a pinned one (`&&`, `;`, a pipe, or backslash-folded) passed, and the **full gate exited 0** on `SECURITY.md`, which has no runtime twin. Closed by per-**occurrence** grading (`MULTI-OCCURRENCE`), by comparing **every** value of every flag rather than the greedy-last (an empty regexp placed first was masked by a correct one placed second), and by diagnosing quote style separately (`UNQUOTED-VALUE`) so a correctly pinned double-quoted call is accepted instead of being refused with a false "empty regexp" reason. **Third round (UC-05..UC-09):** `occurrence_count` read *absence of a second token* as *proof of singularity*, so `cosign "verify-blob"` / `cosign 'verify-blob'` / `cosign verify-blob""` hid a chained unpinned call — **rc=0 on all three files at whole-gate level** against the round-2 gate (`A && B` short-circuits, so `set -e` never fires and even the runtime twin missed it). Fixed by stripping shell quotes before the compare, **explicitly a spelling patch, not a terminator**: a structural terminator was ruled out with evidence, because both scripts legitimately end their real invocation with an or-else `die` tail, so separator-based refusal would red the real files. Since completeness is unavailable, **the `PASS:` banner no longer claims it** — it now reports OBSERVED counts per file, lists only ASSERTED properties (each mutation-proven), and states the NOT-ASSERTED residual in the same breath, so an unknown fifth spelling leaves the gate *incomplete* rather than *wrong*. **R3-01, found by review in the very paragraph that added that banner:** the backticked-mention exemption keys on the substring appearing **anywhere on the line** and is tested first, so a line carrying a backticked mention AND live calls is exempted — `pin_violations` empty, whole gate rc=0. Not patched (narrowing it needs the markdown/quote parsing that produced UC-01/02/03); **disclosed as the FIRST and most reachable residual in the banner**, with exempted lines no longer described as "prose". Also: MULTI-OCCURRENCE now says TOKENS and names trailing comments as a cause (it was false as printed), and SC1087 silenced | **[autonomous]** | AUD2-F01, D-153 (the pinned value) | demonstrated by a reviewer *on* the AUD2-F01 lane and out of its scope — F01 added a third graded file to a gate whose quantifier was already wrong, so fixing the quantifier is a change to the checker, not to any checked file (all three are byte-unchanged) |
+| GATES3 | **DONE** (D-157) — the three PR-visible text gates (`hack/lint/workflow_pins_test.sh`, `hack/audit/aud2_exitgate_test.sh`, `hack/examples/dogfood_wiring_test.sh`) now share `hack/lib/pr_reach.sh`: PR reach is graded structurally (a `paths:`/`paths-ignore:`/narrowing-`types:`/main-excluding-branch filter, a `pull_request:` nested under another key, or a job-level `if:`/`needs:` all red), each gate **cross-pins the other two's steps**, and aud2's fixed-string step check is replaced by the anchored `run:`-command form | **[autonomous]** | — | three reviewer-demonstrated residuals, all in the same three files, all deliberately left unfixed on their own lanes because fixing one of three identical checks would have been misleading |
 
 Sizing, from the S03 implementer's reading of the call site: `verify_cosign()`
 (`hack/release/verify-artifacts.sh:118–125`) has the byte-identical unpinned

From 73a9b5f89b0ef68375547e008579fb4bdd84e9c3 Mon Sep 17 00:00:00 2001
From: Konrad Heimel <konrad.heimel@gmail.com>
Date: Sun, 23 Aug 2026 18:57:38 +0200
Subject: [PATCH 2/8] :white_check_mark: test(ci): grade the shared PR-reach
 helper itself, on fixtures (D-157)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Every mutation control so far mutates verify.yaml and asks
hack/lib/pr_reach.sh about it, which cannot tell a working helper from a
stubbed one — and the helper is now a single point of failure for all
three PR-visible gates, so `assent_pr_reach() { return 0; }` would turn
them green at once. workflow_pins_test.sh and dogfood_wiring_test.sh now
also drive both helper functions against workflows written FROM SCRATCH,
whose expected answer depends on nothing under .github/workflows/**.
Verified: the stub reds them by name.

Also removes the last external anchors from the block-scalar bleed
mutants. They appended the invocation to the determinism gate's existing
`run: |` body; they now inject a self-contained `- name: unrelated` step
after `steps:`, so the control cannot red for a sibling lane's reason
when verify.yaml's toolchain steps change.
---
 CHANGELOG.md                         |   1 +
 docs/decisions/decisions.md          |   2 +-
 hack/audit/aud2_exitgate_test.sh     |  15 +++-
 hack/examples/dogfood_wiring_test.sh | 111 ++++++++++++++++++++++++++-
 hack/lint/workflow_pins_test.sh      | 101 +++++++++++++++++++++++-
 5 files changed, 226 insertions(+), 4 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6bf325dc..bb4beb97 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -134,6 +134,7 @@ repository still gets a decision, never by following the link; no release carrie
 - :white_check_mark: test(hack): close two gate fail-opens found by review (BASH32-F01)
 - :white_check_mark: test(ci): wire release-verify-test into task check (D-159)
 - :white_check_mark: test(ci): share PR-reach and cross-pin the three PR-visible gates (D-157)
+- :white_check_mark: test(ci): grade the shared PR-reach helper itself, on fixtures (D-157)
 ## [0.3.0] - 2026-08-18
 
 ### Chores
diff --git a/docs/decisions/decisions.md b/docs/decisions/decisions.md
index 2aa9a683..a35e7d8b 100644
--- a/docs/decisions/decisions.md
+++ b/docs/decisions/decisions.md
@@ -160,7 +160,7 @@ project/process decisions.
 | D-153 | 2026-08-19 | **The cosign signer-identity pin published in `SECURITY.md` was WRONG, not merely missing from `hack/install.sh`: the identity regexp is widened to `^https://github\.com/PlatformRelay/[Aa]ssent/` in both files (AUD2-S03 / SEC-03).** Substance first: `SECURITY.md`'s "Verify a tagged release" instructions pinned `--certificate-identity-regexp '^https://github.com/PlatformRelay/assent/'`, and an adopter who followed them on **v0.2.0 or v0.3.0 got a verification FAILURE on a genuine, correctly signed artifact** — the published recipe has been broken for every release since v0.2.0, and the natural reading of that failure is "this release was tampered with". Cause: the repository was renamed `PlatformRelay/assent` → `PlatformRelay/Assent` between v0.1.0 and v0.2.0; the keyless signing certificate's Subject Alternative Name carries GitHub's canonical casing; cosign compiles `--certificate-identity-regexp` as a Go RE2 pattern and matches it **case-sensitively**. Decoded from the published bundles: v0.3.0 and v0.2.0 sign as `https://github.com/PlatformRelay/Assent/.github/workflows/release.yaml@refs/tags/vX.Y.Z`, v0.1.0 as `https://github.com/PlatformRelay/assent/.github/workflows/release.yaml@refs/heads/main`. All three verify under the new value; independently re-confirmed with real cosign against the real v0.3.0 artifact (`Verified OK` under the new pin, exit 1 "expected SAN value to match regex" under the old). Options considered: **(a)** ship the pin byte-identical to the published-but-broken value and file the breakage as a follow-up (rejected — it would land a green gate asserting a guarantee that fails closed on this project's own releases, D-124's defect one level up); **(b)** case-insensitive `(?i)` (rejected — wider than the defect and it silently accepts casings GitHub never issues); **(c)** an explicit `[Aa]` class in both files, dots escaped (chosen). Not widened otherwise: the `^` anchor and the owner/repo scope stand, so another owner, an `assent-mirror` typosquat, another forge and an unescaped-dot host all still fail. Enforcement, per D-128: **one** published truth — `hack/release/install_cosign_pin_test.sh` extracts the pair from `hack/install.sh` and `SECURITY.md`, requires exactly one distinct value per file, reddens on drift, and (this is the assertion that would have caught the defect) matches the pin against the three **real** SANs above, committed as offline fixtures, plus six negatives. Extends D-110 (bundles beside archives) and D-109; the maintainer-path twin at `hack/release/verify-artifacts.sh:124` is still unpinned and is tracked in the backlog, not fixed here. Revert: restore `'^https://github.com/PlatformRelay/assent/'` in both files — which re-breaks verification of v0.2.0 and every later release, so revert only together with a repo rename back to lowercase. |
 | D-154 | 2026-08-23 | **Every `hack/**` script that uses a bash 4+ feature declares a PER-SCRIPT version floor via the shared `hack/lib/require-bash.sh`, because one of them was a silent local FAIL-OPEN under stock macOS bash 3.2 (BASH32-F01).** Substance first: `/bin/bash hack/docs/truthlag_pins_test.sh` on macOS printed 20 `PASS` lines, died at its `declare -A ex_s09_prefix_hint=(…)`, never printed its final `OK: all truth-lag pins green` banner — and **exited 0**. Its caller `task docs-gates`, and therefore `task check`, read that as a green gate, and AGENTS.md rule 4 makes a green local `task check` a per-commit precondition; CI is ubuntu/bash 5, so nothing merges through this path, which is precisely why it survived. Mechanism, measured on bash 3.2.57: 3.2 has no associative arrays, so under `set -u` it re-reads `declare -A x=([k]=v)` as an INDEXED array assignment and evaluates the subscript `k` **arithmetically**, hitting "unbound variable"; the shell terminates the script and the exit status is 0. Two theories were disproved en route and are recorded so they are not re-explored: the `trap … EXIT` status-swallow (3.2 propagates 1 through an EXIT trap correctly) and `set -e` (the script runs `set -uo pipefail`). The other two affected scripts fail CLOSED, but only incidentally: `hack/release/verify-artifacts.sh:202`'s literal is EMPTY, so there is no subscript to evaluate and it degrades to `declare: -A: invalid option`, which its `set -e` turns into exit 2 (measured with a `--dist` that reaches line 202 — an unreachable dist exits 1 much earlier); `hack/validate-schemas-stock.sh`'s `mapfile` degrades to "command not found" and it exits 1. Populating an empty literal or dropping `-e` silently converts a closed failure into the open one, so "how this construct happens to degrade" is not a guarantee worth depending on. Options considered: **(a)** one blanket repo-wide floor (rejected — the binding minimum differs per feature: `declare -A` 4.0, `local -n` 4.3, `mapfile -d ''` 4.4; a blanket floor both refuses shells that could run the 4.0 gates and hides which feature actually binds); **(b)** rewrite the three scripts to be 3.2-compatible (rejected — associative arrays and `mapfile` are the right tools here, a rewrite is a large risky change to scripts whose correctness IS the product, and it does nothing about the next gate author); **(c)** copy the existing inline `BASH_VERSINFO` guard from `hack/audit/aud2_exitgate_test.sh:71` into each script (rejected as the *only* measure — it duplicates the explanation three more times and still leaves the next author to rediscover the hazard); **(d) chosen** — a shared `require_bash <major>[.<minor>] <feature>` helper, called with each script's own correct floor (4.0 / 4.0 / 4.4), plus a meta-gate. Enforcement, per D-128, is one place: `hack/lint/bash_version_guard_test.sh`, wired as `task check` stage **20** and pinned in `hack/audit/exitgate_test.sh`'s `CHECK_STAGES` in the same commit. It scans every `hack/**/*.sh` for command-position bash 4+ constructs, requires a guard on each, requires the declared floor to be at least the feature's own minimum, and — the assertion that makes the rest non-vacuous — requires the scan to still find all four known feature-using files, so a typo in a detection pattern reds instead of quietly matching nothing. Its own negative control mutates real copies of the three scripts with the guard lines stripped and asserts they are flagged. `hack/audit/aud2_exitgate_test.sh` keeps its inline guard and is accepted by the gate as guarded; adopting the helper there is a follow-up, not this lane. Stated limits: the gate sees only command-position constructs in `hack/**/*.sh` (not `eval`, dynamically built command names, case-modification expansions, or scripts outside `hack/`), and the exit-0 control needs a real bash 3.2 — present on macOS, absent on CI ubuntu, where it SKIPs **loudly** rather than passing silently. Accepted behaviour change: under 3.2, `hack/release/verify-artifacts.sh --help` now refuses instead of printing usage. Revert: delete the guard calls — `task check` then silently stops certifying the docs truth-lag pins for every contributor whose `bash` is 3.2. |
 | D-156 | 2026-08-23 | **The tier-1 (CEL) ceiling is recorded (`docs/planning/rego-tier-ceiling.md`, E11-S01 / REQ-E11-S01-01+02) and it NARROWS E11: two of the four named shapes are struck outright and a third in part.** Substance first: of multi-pass / cross-manifest / set-difference / graph-relationship (`openspec/specs/later-phases.md:284`), **cross-manifest and set-difference are struck, the "named intermediate" half of multi-pass is struck, and only fold/aggregate-over-a-collection and in-input graph reasoning survive as justification for a second backend.** Measured against the surface this repo actually binds — `internal/core/aggregate/evaluate.go` `newEvalEnv`, eleven frozen predicate-scope variables, **zero extension libraries** — reproduced in a nested throwaway module pinned to the repo's `cel-go v0.31.0` (root `go.mod`/`go.sum` byte-unchanged; nothing added to the dependency graph, which judgment call (d) has not authorised). **What exceeds tier 1: (1) folds.** `sum`, `reduce`, `math.*` and `lists.*` are all `undeclared reference`; `size()` is the only aggregate in the surface, so a rule counting matched changes is expressible and a rule summing a numeric delta across them is not. **(2) Graph reasoning** — the iteration count of a CEL expression cannot be made data-dependent, so depth is syntactic and **unbounded** reachability has no spelling; a bounded `k`-hop form *is* writable and answers a fixed-depth question, not the rule (detailed below, with the refutations of two sharper claims this row previously made). **What is struck, with the CEL that does the job:** registry membership — `string(new) in facts.registry.topics.value` over a `cardinality: set` fact, already shipped green at `examples/packs/service-catalog/.assent/packs/catalog/rules/ownership.yaml:21`; keyed attribute lookup — either a purpose-built provider (`builtin/resource-owner`, exercised in both polarities by `examples/archetypes/referenced-resource-ownership/`) or `facts.<p>.<n>.value[key].field`, which compiles and is lint-clean because `internal/lint/facts_ref.go`'s D-051 shape check permits arbitrary navigation past `.value` and only forbids indexing `facts` itself; set difference — `oldEntry.acls.filter(a, !(a in entry.acls)).size() == 0`; named intermediates — no `cel.bind`, but re-deriving the sub-expression inside each leaf is semantically identical and compiles. **The sharpest finding is a distinction, not a rule:** same-changeset **cross-file** reasoning fails for **input availability**, not expressiveness — the evaluation unit is one file (`change.ChangeSet` is documented "for one file", `internal/change/diff.go:129`; `assent run` strips one `--subject file:<path>`, `cmd/assent/run.go:266`, and diffs it alone, `:293`) and **REQ-E11-S05-01 pins the Rego module to the identical `EvaluationInput`** with the tier fenced to "declared data, no I/O". **A Rego module therefore fails that rule identically, so it is struck from E11's justification too** — the fix is an input decision, which E11's non-goals fence, not a backend decision. Corroborating: the one committed illustration of the escape hatch, `examples/policies/rego/bounded_change.rego`, is **entirely tier-1 expressible** — both `violations` rules are per-change predicates and `examples/policies/declarative/bounded-change.yaml` is the same rule already in the envelope. **The strongest single piece of evidence, and the one that sizes the epic, is the graph shape.** On the `assent run` path document-mode `walkNode` emits a Change **only where two scalars differ** — a sequence on either side makes the whole ChangeSet **opaque → REVIEW** before any rule runs (`internal/change/diff.go`) — and collection-mode `DiffEntries` is reached only from `internal/adoptertest`, so `old`/`new`/`entry`/`oldEntry` and every `changes[i].old`/`.new` bind **scalars**. That does **not** starve a graph rule, because a flat `set` fact still carries structure: `edges: {type: string, cardinality: set}` returning `["orders|billing","billing|ledger"]` is a **fully declarable, in-contract adjacency inside `EvaluationInput` today** — the declaration is legal (`schemas/provider/v1alpha1/response.schema.json`), `fact.value` carries no JSON-Schema type constraint and `ResolveFactsChecked` cross-checks the *declaration* not the value (`internal/provider/resolve.go`), outputs are operator-authored (`internal/provider/config.go`), the `http` transport is live on the plain run path with **no `--checkout`** (`cmd/assent/provider_host.go` `providerCallFor`), and a set fact binds as a CEL list. Tier-1 CEL nonetheless cannot answer the actual question over it: **CEL has no recursion, fixpoint, fold or user-defined function, so unbounded reachability has no spelling** (`transitiveClosure` → `undeclared reference`; the four comprehension macros iterate one level and cannot call themselves). **Stated precisely, because two drafts of this record overreached and both were caught by independent review:** a *bounded* `k`-hop check **is** expressible and does **not** need the string decomposition CEL lacks — over a finite in-input candidate set (a `nodes` set fact, the same construction as `edges`), decode is replaceable by **encode-and-compare**: `nodes.value.exists(m, nodes.value.exists(n, (string(new)+"|"+m) in edges.value && (m+"|"+n) in edges.value && (n+"|"+string(new)) in edges.value))` compiles **and evaluates** under the real `cel.CostLimit(1_000_000)` to `true/true/true/false` over the fixture above, and `nodes.value.filter(m, (string(new)+"|"+m) in edges.value)` recovers an edge's far end as `[billing]`. Both primitives (`+` on strings, `in`) were already in this record's own function census, so the claim that decoding was a second independent barrier was internally inconsistent as well as false. **The real ceiling is `k`, and a third draft got its cost wrong too** — it claimed `O(|N|^(k-1)·|E|)` "exhausts the cost budget on any real graph". Wrong complexity class and wrong conclusion, because the census had omitted the surface's only value binder, `[expr].all(v, …)`: binding each BFS frontier once per level makes cost additive across levels, and measured under the real `cel.CostLimit(1_000_000)` a ring `|N|=50, deg 5` costs 89,551 at `k=10`, 235,297 at `k=20` and 686,317 at `k=50` — roughly linear in `k`, and at `k=50 ≥ |N|` CEL is **not approximating at all, it decides reachability exactly**, in 69% of budget. The practical `k` collapses around `|N|≈200` (`k=10` at 46% of budget, `k=20` exceeds). Recorded because a reader sizing this epic is entitled to ask "would CEL suffice for *our* graph?" and the previous sentence foreclosed that question with an assertion measurement refutes; it is **not** offered as a second reason. **What carries the verdict is one property, now measured rather than recalled: the iteration count of a tier-1 CEL expression cannot be made data-dependent.** `reduce`, `transformList`, `transformMap`, two-var `all(i,x,…)`, `range`/`lists.range` and `cel.bind` are all `undeclared reference`; `for` is a `reserved identifier`; there is no fold, self-reference or generator; so depth is a **syntactic** property, hard-capped by cel-go's parser recursion limit of 250 (`expression recursion limit exceeded: 250` at depth 260, depth 200 still compiles). That a fixed `k` really is an approximation when the data outruns it is measured too: on a 4-cycle the `k=3` form evaluates `false` and the `k=4` form `true`. **Rego answers the unbounded question with `graph.reachable` — pure and deterministic — and that single gap is the whole justification.** **An input that is in contract and available today, over which CEL can only approximate and Rego decides, is exactly the per-rule evidence D-017's gate demanded — so E11 has TWO unconditional justifications (folds and graphs), neither waiting on any open question.** Deliverability caveat, stated because this row makes the same distinction for sub-shape B1: **no provider in the corpus ships an encoded adjacency today** — that one *can* follows from the provider contract, the same inference used to strike B1, not from a shipped example. Options considered: **(a)** record all four shapes as exceeding, the reading D-141's unlock invites (rejected — three are demonstrably expressible and an unfalsifiable ceiling claim is the defect this story exists to prevent); **(b)** strike set-difference **conditionally**, so that a narrowing answer to OQ-35 would return it to the ceiling (rejected on the second pass — both resolutions strike it: extending the entry binding makes CEL express it, narrowing makes it an input-availability failure that REQ-E11-S05-01 hands to Rego unchanged, so a conditional would have left a downstream story waiting on an answer that cannot change the verdict); **(c)** strike cross-manifest and set-difference **unconditionally**, strike half of multi-pass, keep folds and in-input graphs **both unconditionally** **(chosen)**. **Two rejected drafts are recorded because the same failure produced both, with the sign flipped, and only independent review caught either.** Draft 1 made the graph shape *contingent* on OQ-35/OQ-36 on the premise that "an adjacency needs a mapping-valued fact" — it does not; a set of encoded strings carries one inside the frozen declaration — which came from conflating a *provider-supplied catalog* (sub-shapes B1/B2, struck here as working and shipped) with **B3, which is specifically same-changeset cross-file *diffs***. It would have advised the operator to defer a 14-story epic on a premise that does not hold. Draft 2 replaced that with a second "independent reason" — that CEL cannot decode an edge, killing even a bounded two-hop check — **refuted by execution** (the encode-and-compare leaf above). Draft 3 replaced *that* with the exponential-cost claim above — **refuted by measurement**. The common cause across all three is one habit: **reaching for a second independent reason when one sufficient reason was already in hand**, and then applying an **asymmetric evidentiary standard** to protect it — accepting awkward-but-working spellings when they *struck* a shape (A2's re-derivation, B2's dynamic index) and rejecting them when they would have *narrowed* one this record wanted to keep. The verdict was right in all four drafts; the supporting argument was wrong in three. It now rests on one measured property and no supporting argument at all, which is the form it should have taken first. The correction to A2 runs the same way: the value binder `[expr].all(v, …)` removes the evaluation-cost half of A2's residual, so **A2 is struck more firmly than the first draft struck it**. Binds later stories: **S05** must not be widened to carry cross-manifest data; **S07**'s violation shape must support a fold result and a path/cycle witness, not a cross-manifest reference; **S12** must correct ADR-0002's `rego` bullet, which calls the tier an "escape hatch for **cross-entry checks**" — inaccurate for the shipped input contract; **S11** must label the unquarantined example a shape illustration, never evidence of need. **Binds E11-S04, whose denylist is not yet written: `graph.reachable` MUST be allowed**, with `split` alongside it — both pure and deterministic. `graph.reachable` is the one that carries the justification (it closes the graph at any depth); `split` is a convenience for rebuilding the adjacency. A capability set drafted from "deny anything unfamiliar" would strike out the epic's own strongest justification. Recorded in the S04 section of the epic spec, not only S01's. **That floor is held by REVIEW, not by a gate, and this row says so rather than inventing an enforcement path:** REQ-E11-S04-02's committed golden detects a *change* to the allowed set (so the sandbox cannot silently widen) and cannot detect an *omission* — a golden written without `graph.reachable` stays green forever. It says nothing about judgment call (d), since *which* builtins are callable is orthogonal to *where* the evaluator lives. Two residuals raised, neither decided, **neither gating any verdict here**, and neither the escalated rule-7 (d1)/(d2) question: **OQ-35** (the `entry`/`oldEntry` binding asymmetry — a silent `assent test` / `assent run` divergence; set-difference is struck either way and the graph shape needs no entry tree) and **OQ-36** (the frozen provider declaration has no object/map type, yet the authoring surface and `builtin/repo-file` together permit a mapping-valued fact). Also flagged, not edited (out of lane): `REQ-DEM-S05-04` calls the provider-visible tree the "merged-result checkout"; the code reads `<root>/head`, documented at `cmd/assent/checkout.go:44` as "the MERGE-REQUEST HEAD". This lane writes no Go, adds no dependency and touches no schema. Revert: delete `docs/planning/rego-tier-ceiling.md` and the D-156 narrowing text from the E11 spec — which restores an epic justified by four shapes, three of which this record shows are not real. |
-| D-157 | 2026-08-23 | **"Reaches pull requests" is now a SHARED, structural check (`hack/lib/pr_reach.sh`), the three PR-visible text gates CROSS-PIN each other's steps, and the fixed-string step check is replaced by an anchored `run:`-command match (GATES3).** Three residuals, each *demonstrated* by an independent reviewer on an earlier lane and each deliberately left unfixed there, all living in the same three files — `hack/lint/workflow_pins_test.sh`, `hack/audit/aud2_exitgate_test.sh`, `hack/examples/dogfood_wiring_test.sh`. **(1) The substantive one.** Two of the three answered "am I reachable on a PR?" with `grep -qE '^[[:space:]]+pull_request:'` over the workflow's `on:` block; a reviewer added `paths: ['internal/**']` under the trigger and measured **rc=0** — the trigger is present, the grep is satisfied, and the gate is disarmed for every PR that touches only `Taskfile.yml` or `.github/workflows/**`, which is exactly the class of PR these gates exist to grade. `types: [closed]` is the same defect by another route, and the grep's `[[:space:]]+` is indent-blind, so a `pull_request:` nested under `workflow_call.inputs` satisfied it too. **The third gate did not answer the question at all** — `workflow_pins_test.sh` asserted its step was present and undisarmed and never that the workflow carrying it runs on a PR; this is new coverage there, not a strengthening, and the brief that commissioned this lane assumed otherwise. **Decision on meaning:** a workflow "reaches PRs" when it has a top-level `pull_request:` trigger carrying **no** `paths:`/`paths-ignore:`, a `types:` list that is absent or a **superset** of GitHub's defaults (`opened`, `synchronize`, `reopened`), and no branch filter excluding `main` — and when the target job carries neither a job-level `if:` **nor a job-level `needs:`** (a dependency that skips on PRs skips its dependents, defeating all three gates at once while every other assertion stays green). **Deliberately still accepted**, stated so a reviewer does not read the narrowing as wider than it is: `on: pull_request` and `on: [push, pull_request]` (the inline forms cannot carry a filter, so they are strictly safer than the block form), the quoted `"on":` key, a `types:` superset, `branches:` listing the literal `main`, `branches-ignore:` sparing `main`, block-scalar `run: |` invocations, arbitrarily long comment blocks inside a gate step, and step-level `if:` on *other* steps (`verify.yaml`'s changelog gate is legitimately PR-excluded). **Deliberately narrower than GitHub:** a `branches:` glob covering main without the literal token (`['ma*']`) reds, because a bash gate cannot honestly evaluate GitHub's glob semantics, and a flow mapping or anchor in the `on:` block is **refused** (distinct code) rather than guessed at. **(2)** Each gate pinned only its OWN step, so a PR deleting one of the other two was invisible to the gate that still ran — caught locally by `task check` and on push by `release-exitgate`, hence a gap and not a hole. Each gate now asserts all three steps; the mutation matrix is the full cross-product (3 deleted steps × the 2 observers that still run) rather than a diagonal. **(3)** `aud2_exitgate_test.sh`'s `check_pr_wiring` located its step with `grep -nF -- "$SELF"` — a search for the script *name*, which the step's own comments satisfy. Measured by the reviewer: with the `run:` line commented out it still failed, but reported **"WITH ARGUMENTS"** instead of "does not invoke", sending an operator to look for an argument that does not exist. The anchored form from `dogfood_wiring_test.sh` is ported back and shared. **Why one lane and one helper, not three fixes:** the INBOX residual explicitly asked for a single shared helper so the next gate author inherits the strong check rather than copying the weak one; fixing one of three identical checks would have been misleading. **Judgment calls.** (a) The helper is **codes-only and prints nothing** — every caller owns its wording, because roughly twenty existing `expect_red` controls pin stderr fragments. (b) The 1..6 **line cap** `workflow_pins_test.sh` used to bound step isolation is replaced by a structural invariant — exactly one `run:` key and no `uses:` key, both of which actionlint itself flags — because cross-pinning made the helper isolate the aud2 and dogfood steps, whose comment blocks are a dozen lines long, and no cap admits an honest step of theirs while rejecting a merged one. (c) The helper is held to `workflow_pins_test.sh`'s preamble rules (**bash 3.2**, portable ERE, no `git`, no `grep -q` on a pipe) rather than aud2's ≥4.3 floor: that gate runs first in CI before any toolchain, and the other two callers do not refuse bash 3.2, so a bash-4 construct here would silently weaken them on a maintainer's machine. (d) It is a **line-oriented reader with a structural bias, not a YAML parser** — it says so in its own header and fails closed on anchors, aliases and flow mappings, because an honest narrow gate beats an overreaching one. (e) No new `check:` stage and `CHECK_STAGES` untouched: all three gates were already wired. **Evidence:** 44 helper-level probes plus, in the gates themselves, 13 new red controls in aud2 (`CONTROL_FLOOR` 38→51, text-only 32→45, both floors met exactly), 15 in `workflow_pins_test.sh` and 12 in `dogfood_wiring_test.sh` — each pinned to its own finding text or rc — and, in every gate, **green** controls for the legitimate shapes above, so the new checks are provably not always-red. **One fail-open was found by building a mutant rather than by reasoning, and it was in this lane's own widening:** accepting a block-scalar `run: |` invocation naively means a bare `bash <script>` line anywhere in the job satisfies the step check, including inside another step's multi-command `run: |` body where `echo skip && exit 0` a line above would mean the gate never runs — measured rc=0. The block form now counts only as a block's **sole** command, and all three gates carry that mutant. Revert: delete `hack/lib/pr_reach.sh` and restore the three gates' local readers — which restores the `paths:`-filtered bypass, the self-only pinning, and the misreport. |
+| D-157 | 2026-08-23 | **"Reaches pull requests" is now a SHARED, structural check (`hack/lib/pr_reach.sh`), the three PR-visible text gates CROSS-PIN each other's steps, and the fixed-string step check is replaced by an anchored `run:`-command match (GATES3).** Three residuals, each *demonstrated* by an independent reviewer on an earlier lane and each deliberately left unfixed there, all living in the same three files — `hack/lint/workflow_pins_test.sh`, `hack/audit/aud2_exitgate_test.sh`, `hack/examples/dogfood_wiring_test.sh`. **(1) The substantive one.** Two of the three answered "am I reachable on a PR?" with `grep -qE '^[[:space:]]+pull_request:'` over the workflow's `on:` block; a reviewer added `paths: ['internal/**']` under the trigger and measured **rc=0** — the trigger is present, the grep is satisfied, and the gate is disarmed for every PR that touches only `Taskfile.yml` or `.github/workflows/**`, which is exactly the class of PR these gates exist to grade. `types: [closed]` is the same defect by another route, and the grep's `[[:space:]]+` is indent-blind, so a `pull_request:` nested under `workflow_call.inputs` satisfied it too. **The third gate did not answer the question at all** — `workflow_pins_test.sh` asserted its step was present and undisarmed and never that the workflow carrying it runs on a PR; this is new coverage there, not a strengthening, and the brief that commissioned this lane assumed otherwise. **Decision on meaning:** a workflow "reaches PRs" when it has a top-level `pull_request:` trigger carrying **no** `paths:`/`paths-ignore:`, a `types:` list that is absent or a **superset** of GitHub's defaults (`opened`, `synchronize`, `reopened`), and no branch filter excluding `main` — and when the target job carries neither a job-level `if:` **nor a job-level `needs:`** (a dependency that skips on PRs skips its dependents, defeating all three gates at once while every other assertion stays green). **Deliberately still accepted**, stated so a reviewer does not read the narrowing as wider than it is: `on: pull_request` and `on: [push, pull_request]` (the inline forms cannot carry a filter, so they are strictly safer than the block form), the quoted `"on":` key, a `types:` superset, `branches:` listing the literal `main`, `branches-ignore:` sparing `main`, block-scalar `run: |` invocations, arbitrarily long comment blocks inside a gate step, and step-level `if:` on *other* steps (`verify.yaml`'s changelog gate is legitimately PR-excluded). **Deliberately narrower than GitHub:** a `branches:` glob covering main without the literal token (`['ma*']`) reds, because a bash gate cannot honestly evaluate GitHub's glob semantics, and a flow mapping or anchor in the `on:` block is **refused** (distinct code) rather than guessed at. **(2)** Each gate pinned only its OWN step, so a PR deleting one of the other two was invisible to the gate that still ran — caught locally by `task check` and on push by `release-exitgate`, hence a gap and not a hole. Each gate now asserts all three steps; the mutation matrix is the full cross-product (3 deleted steps × the 2 observers that still run) rather than a diagonal. **(3)** `aud2_exitgate_test.sh`'s `check_pr_wiring` located its step with `grep -nF -- "$SELF"` — a search for the script *name*, which the step's own comments satisfy. Measured by the reviewer: with the `run:` line commented out it still failed, but reported **"WITH ARGUMENTS"** instead of "does not invoke", sending an operator to look for an argument that does not exist. The anchored form from `dogfood_wiring_test.sh` is ported back and shared. **Why one lane and one helper, not three fixes:** the INBOX residual explicitly asked for a single shared helper so the next gate author inherits the strong check rather than copying the weak one; fixing one of three identical checks would have been misleading. **Judgment calls.** (a) The helper is **codes-only and prints nothing** — every caller owns its wording, because roughly twenty existing `expect_red` controls pin stderr fragments. (b) The 1..6 **line cap** `workflow_pins_test.sh` used to bound step isolation is replaced by a structural invariant — exactly one `run:` key and no `uses:` key, both of which actionlint itself flags — because cross-pinning made the helper isolate the aud2 and dogfood steps, whose comment blocks are a dozen lines long, and no cap admits an honest step of theirs while rejecting a merged one. (c) The helper is held to `workflow_pins_test.sh`'s preamble rules (**bash 3.2**, portable ERE, no `git`, no `grep -q` on a pipe) rather than aud2's ≥4.3 floor: that gate runs first in CI before any toolchain, and the other two callers do not refuse bash 3.2, so a bash-4 construct here would silently weaken them on a maintainer's machine. (d) It is a **line-oriented reader with a structural bias, not a YAML parser** — it says so in its own header and fails closed on anchors, aliases and flow mappings, because an honest narrow gate beats an overreaching one. (e) No new `check:` stage and `CHECK_STAGES` untouched: all three gates were already wired. **Evidence:** 44 helper-level probes plus, in the gates themselves, 13 new red controls in aud2 (`CONTROL_FLOOR` 38→51, text-only 32→45, both floors met exactly), 15 in `workflow_pins_test.sh` and 12 in `dogfood_wiring_test.sh` — each pinned to its own finding text or rc — and, in every gate, **green** controls for the legitimate shapes above, so the new checks are provably not always-red. **One fail-open was found by building a mutant rather than by reasoning, and it was in this lane's own widening:** accepting a block-scalar `run: |` invocation naively means a bare `bash <script>` line anywhere in the job satisfies the step check, including inside another step's multi-command `run: |` body where `echo skip && exit 0` a line above would mean the gate never runs — measured rc=0. The block form now counts only as a block's **sole** command, and all three gates carry that mutant. **The helper is graded too, not only the workflows it reads:** every mutation control mutates `verify.yaml` and asks the helper about it, which cannot tell a working helper from a stubbed one — with the helper now a single point of failure for all three gates, replacing `assent_pr_reach` with `return 0` would turn them all green at once. Two of the gates therefore also drive it against **from-scratch fixture workflows** whose right answer depends on nothing under `.github/workflows/**` (verified: the stub reds them by name). Revert: delete `hack/lib/pr_reach.sh` and restore the three gates' local readers — which restores the `paths:`-filtered bypass, the self-only pinning, and the misreport. |
 | D-158 | 2026-08-23 | **CI-TOOLCHAIN — `verify` was red on every PR from a golangci-lint/Go skew; the remedy is to bump `GOLANGCI_LINT_VERSION` v2.12.2 → v2.13.1 and KEEP `go-version: stable`.** Symptom: PR #85, a six-file Markdown diff with **zero Go bytes**, failed `verify` with `/opt/hostedtoolcache/go/1.27.0/x64/src/crypto/internal/randutil/randutil.go:11:2: could not import math/rand/v2 (… method must have no type parameters) (typecheck)` — the failing path is inside the **Go toolchain's own source tree**, so no author change can fix it and re-running cannot clear it. `Analyze (go)`, `Analyze (actions)` and `CodeQL` all passed on the same run: the tree compiles clean under Go 1.27, only the linter chokes. **Mechanism**: golangci-lint typechecks the standard library with the `go/types` it was **compiled with**, not the `go` on `PATH`. GitHub's `stable` rolled 1.26 → 1.27.0 between this repo's last green `main` run (2026-08-19) and 2026-08-23; the v2.12.2 release binary is built with go1.26.x and cannot read the 1.27 stdlib. **Reproduced locally, not reasoned** (Go 1.27.0 SDK on `PATH`, `GOTOOLCHAIN=local`, whole tree): v2.12.2 → **panic** in `pkg/goanalysis/runner_loadingpackage.go:335` inside `go/types.(*Checker).Files`, exit 2; official v2.13.1 asset (`built with go1.27.0`) → **0 issues**, exit 0; `golangci-lint config verify` → exit 0, so the v2 config schema in `.golangci.yml` needs no migration; v2.13.1 also → **0 issues** against local Go 1.26.6, so the bump is safe for contributors who have not moved; and `go install …@v2.13.1` under Go 1.27.0 → 0 issues, which is the **`release-exitgate`** path (that job builds the binary rather than using the action, and `if: github.event_name != 'pull_request'` / RELSE-08 means no PR ever exercises it). **Diagnosis heuristic worth keeping**: golangci-lint's `go.mod` carries the comment *"the minimum Go version must always be latest-1"*, so its `go` directive is a machine-readable "supports Go 1.N+1" signal — v2.12.2 says `go 1.25.0` (supports ≤1.26), v2.13.1 says `go 1.26.0` (supports ≤1.27), and upstream commit `42a0530` in v2.13.0 is literally "go1.27 support". **Options considered.** (A) *bump the linter* — CHOSEN: treats the root cause, is a **one-line** diff because the version is single-sourced at workflow scope (D-128), fixes BOTH exposed sites (the `golangci-lint-action` in `verify` and the `go install` in `release-exitgate`) at once, and the risk it carried — new findings from a newer linter blocking every merge, since `golangci-lint` runs inside `task lint` inside `task check` — was **measured at zero** on the whole tree under both Go versions. (B) *pin `go-version: 1.26.x`* — REJECTED as the primary: it needs two pins (`verify.yaml:56` and `:171`), leaves the class of bug live, undercuts the stated reason `stable` is there (`# govulncheck needs it`, with `setup-go` exporting `GOTOOLCHAIN=local` so a pinned toolchain can fail to `go run` a tool whose module requires a newer Go — unverified, and moot under (A)), and trades a loud recurrence for **silent indefinite drift onto an unsupported Go** in a repo whose posture is govulncheck + cosign + SLSA + Scorecard. (C) *both* — REJECTED as gold-plating: (A) alone is measured green, and a second simultaneous remedy would make a still-red PR ambiguous. **Per-file sweep of `go-version: stable`, stated rather than silently skipped:** `verify.yaml:56` and `:171` were the only exposed sites and are fixed by the env bump without touching either line; `schemas.yml:57` (runs `go test` + ajv, no linter), `vulncheck.yaml:30` (govulncheck only — `stable` is actively *desirable* there) and `codeql.yaml:45` (CodeQL, which passed on 1.27.0) carry no golangci-lint and are NOT exposed; `release.yaml` uses `go-version-file: go.mod` and is unaffected. `hack/lint/workflow_pins_test.sh` asserts `TASK_VERSION`, action SHA pins and step wiring but **not** `go-version` or `GOLANGCI_LINT_VERSION`; it passes on this change. **Revert is (B), not bare v2.12.2** — reverting the env line alone restores a known-red state: revert = `GOLANGCI_LINT_VERSION` back to `v2.12.2` **and** pin `verify.yaml:56` + `:171` to `go-version: 1.26.x`. **Residual risk, stated plainly:** when `stable` rolls to Go 1.28, v2.13.1 breaks identically. The repo finds out because `verify` reds on **every** PR including zero-Go diffs — loud and immediate, with the signature recorded in `verify.yaml`'s env comment and the fix being one env line. Nothing detects it *earlier*: dependabot's `github-actions` ecosystem updates `uses:` refs, not `env:` literals (backlog `CI-TOOLCHAIN-F01`). Accepted on purpose over (B)'s failure mode. Note also the pre-existing local/CI linter skew — `Taskfile.yml`'s `lint` task is bare `golangci-lint run ./...` against whatever binary a contributor has installed, so this pin has never governed local `task check`; deliberately not changed here (that file was owned by a concurrent lane). |
 | D-159 | 2026-08-23 | **ORPHAN — `release-verify-test` was a gate invoked by nothing (D-124 again), and it is wired into `task check` in its three OFFLINE modes, not its default `all`.** Finding: `Taskfile.yml` defined `release-verify-test` — the **only** test of `hack/release/verify-artifacts.sh` — and no caller existed anywhere: not `check:`, not `CHECK_STAGES` in `hack/audit/exitgate_test.sh`, not `.github/workflows/**`, not the push-only `release-exitgate`. That script is not incidental: **`SECURITY.md:61` publishes it as the procedure release consumers run** to check artifact checksums, the stamped `assent version` and cosign signatures, and D-153/AUD2-F01 had just proved that published verification instructions rot silently. Measured before fixing, as the lane required: the gate was **green**, so this is a wiring defect only — nothing was being papered over. **Why not the `all` default.** `verify_test.sh` with no argument adds `test_snapshot_pass`, which shells out to `task release-snapshot`: `go install github.com/goreleaser/goreleaser/v2@…` on any machine without it (**network**, in a gate that runs before every commit), a `before: hooks: go mod tidy` that **rewrites `go.mod`/`go.sum` in the middle of `task check`**, `--clean` on the developer's `dist/`, and a five-target cross-compile (10s here with warm caches and goreleaser already installed; minutes cold). A flaky or network-bound stage is worse than a missing one, so `check:` runs `negative`, `cosign-skip-when-absent` and `readme` — REQ-E9-S12-02/03/04, all offline, together well under a second. **Consequence, stated precisely: REQ-E9-S12-01 (the real snapshot→verify round trip) is not gated per-commit in `task check`; it runs in push-only CI via `hack/release/exitgate_test.sh:33-34` (the `release-exitgate` job, `if: github.event_name != 'pull_request'`) — automated but not PR-visible, i.e. the RELSE-08 blind spot.** Those two lines are literally `task release-snapshot` then `task release-verify`, which is the `Verify:` string the spec gives the requirement (`openspec/specs/p5-e9-distribution/spec.md:441-442`), so nothing here needs a new gate built — an earlier draft of this row claimed the requirement was covered by no automation at all, which was false, and acting on it would have meant a future lane duplicating `exitgate_test.sh:33-34`. What this lane declines to do is move that L1 round trip into a per-commit gate: it cannot be, for the network/`go mod tidy`/`--clean` reasons above. Narrowing the RELSE-08 exposure for this requirement is a separate question from D-159. **Pinning.** `CHECK_STAGES` goes 20 → 21 in the same commit as the `check:` line (the AUD-S18/RELSE-08 lockstep), and `STAGE_BODY_PINS` pins the body **per mode** rather than by the bare script path — a single `bash hack/release/verify_test.sh` pin would stay green if two modes were dropped *and* if the stage were reverted to the unrunnable-in-check default. Three mutation controls prove it: deleting the `check:` line reds `check_check_wiring` by stage name, gutting one of the three modes reds `check_stage_bodies` while the other two still run, and the same deletion applied to the real tree reds the real gate at rc=1. **Also fixed, minimally, because wiring made it matter:** `verify_test.sh` wrote its captured stdout/stderr to fixed `/tmp/verify-{tamper,nosig}.{out,err}` and then **grepped** them; harmless while nothing ran it, but this repo runs several lane worktrees whose `task check` invocations overlap, and a concurrent run truncating `/tmp/verify-nosig.err` at open would fail the other run's `skip.*cosign` grep spuriously. Scratch files now live in each run's own `mktemp -d` (invisible to `verify-artifacts.sh`, which globs only `*.tar.gz`/`*.zip`) and are removed by the existing `RETURN` trap. |
 | D-160 | 2026-08-23 | **UNIV-COSIGN — the cosign signer-pin gate asserted an EXISTENTIAL property where the guarantee it publishes is UNIVERSAL, so it certified nothing about a file's second `cosign verify-blob`; `hack/release/install_cosign_pin_test.sh` now grades EVERY invocation in ALL THREE published files, statically and at runtime.** Substance first, and measured before anything was written: a scratch copy of each graded file with a **second, unpinned** `cosign verify-blob` spliced IN-BODY next to its real invocation (the splice shape matters — see UC-04 below) ran the gate to **exit 0** — `hack/install.sh` rc=0, `SECURITY.md` rc=0, `hack/release/verify-artifacts.sh` rc=0, the last of these being the shape a reviewer had already demonstrated on an earlier lane. **Every individual assertion in that gate was sound.** `has_flag` grepped the whole folded extraction, so a pinned sibling satisfied it; `one_value`'s `sort -u` collapsed two agreeing values to one, so the D-153 drift comparison saw a consistent file; section 0 **printed** the extracted invocation count and asserted nothing about it; and 4b/5d's stub-log checks were positive-only greps, i.e. the same existential shape at runtime, where a second unpinned call leaves the pinned call's log line intact. The conjunction of sound existential assertions is still an existential assertion. **This is the AUD2-S05 quorum defect one layer out: not a wrong assertion, a wrong quantifier**, and it predates both AUD2-S03 and AUD2-F01. **`SECURITY.md` was worse than the other two** — it fed only the drift comparison and had **no invocation-level grading at all**, so an unpinned recipe published to adopters was invisible to the gate that exists to police the recipe. **Property chosen: "every `cosign verify-blob` invocation in every graded file carries `--certificate-oidc-issuer`, `--certificate-identity-regexp` and `--bundle`, EACH WITH SECURITY.md's published value".** The value half is not decoration: `--certificate-identity-regexp ''` carries the flag and matches every Fulcio identity ever issued, and `one_value`'s `sort -u` does not catch it either, because an empty capture is not a line and the file still reports exactly one distinct value — a presence-only universal check would be the same defect one level down, so each invocation's own extracted value is compared against the published pair (reported `WRONG-VALUE[...]`, distinct from `UNPINNED[...]`). Options considered: **(a)** the remedy recorded when the finding was filed — assert the extracted invocation count is **exactly 1** per file (**REJECTED AS FACTUALLY WRONG — do not implement it in a later lane; it would red `main` on the day it lands.** `SECURITY.md` legitimately publishes **two** — one over the archive, one over `checksums.txt`, which is what covers the SBOMs listed inside it — so that assertion reds `main` on the day it lands, and the natural repair is to weaken it again); **(b)** universal quantification over invocations **(chosen)** — strictly stronger than (a) where (a) is true, and it keeps holding when a file legitimately grows a third correctly-pinned call. **Enforcement, per D-128, is one predicate**: `pin_violations <file>` prints one line per problem and nothing when the file is clean, so callers grade its OUTPUT and the identical function is asserted empty against the tree and non-empty against a mutant with no `set -e` games; `assert_all_pinned` is the thin failing wrapper; `log_unpinned_lines` is its runtime twin over the stub-cosign argv log. **Classification is fail-CLOSED, which is the part that carries the guarantee.** The candidate extractor is deliberately left un-narrowed (every non-comment line mentioning `cosign verify-blob`, continuations folded), because anything the *denominator* drops is a hole. A candidate is an invocation when the folded text begins with `cosign verify-blob`; the ONE waved-through non-invocation shape is a markdown inline-code mention (`` `cosign verify-blob` ``, which is how `SECURITY.md`'s capability table names it); **on a line carrying NO backticked mention, anything else — `foo && cosign verify-blob …`, a here-doc line, an un-backticked prose sentence — is reported UNCLASSIFIABLE rather than skipped**, because "this gate cannot tell whether that call is pinned" must never read as "that call is fine". **That scoping is not cosmetic, and the unscoped version of this sentence was FALSE (R3-01, caught by review on the round that added the honest banner).** The exemption tests whether the substring `` `cosign verify-blob` `` appears **anywhere on the line**, not whether the line is prose, and it is tested BEFORE the command-position and multi-token checks. So a line carrying a backticked mention AND one or more LIVE calls is exempted, neither graded nor refused: measured by splicing ``See `cosign verify-blob`: cosign verify-blob --bundle A.json a && cosign verify-blob --bundle EVIL.json evil`` into `SECURITY.md` — `occurrence_count` = 2 by the definition the banner itself states, `pin_violations` EMPTY, **whole gate rc=0**, while the banner reported that line among those "exempted as backticked prose". The **static** defect is not markdown-specific — splicing a live unpinned call with a trailing backticked mention into `hack/install.sh` gives candidates=2, invocations=1, `pin_violations` EMPTY — but the **whole-gate green is** markdown-specific, and the distinction is stated because a looser sentence here would itself be falsifiable: in that shell script the run reds at §4b for an unrelated RUNTIME reason (the spliced call executes and its bundle is absent), whereas `SECURITY.md` is a document with no runtime twin, which is why rc=0 survives there. Measured both ways rather than inferred from either. **Narrowing the exemption needs quote- and markdown-aware parsing — the machinery that produced UC-01/02/03 — so it is deliberately NOT patched here.** It is instead disclosed as residual (1) in the PASS banner, ahead of the variable/`eval`/fragment spellings, because it is the residual that is actually REACHABLE in these three files while those are not present in any of them. The banner also no longer labels an exempted line "prose": the branch it took is a fact, "prose" was an inference, and R3-01 is the case where that inference is wrong. **This is UC-07 doing its job on its own author:** the claim was falsifiable, it was checked, and the gate is now incomplete-and-honest rather than complete-and-wrong. Accepted cost, stated rather than discovered later: a *correctly pinned* invocation written off command position also reds. That is the intended direction of error for a security gate over three files carrying four invocations in one canonical style, and the message names the fix. **Anti-vacuity, because a lane whose entire deliverable is "make a gate stricter" is maximally exposed** (this repo's #1 review finding is an assertion that cannot fail — D-124, AUD-S18): section 2b runs **eight** mutants against **each** of the three files and 2c runs a ninth, and they were chosen for **branch** coverage of the new predicate rather than for variety of shape — (a) a second **unpinned** invocation must red, name the file, quote the offending command, and produce **exactly two** violations so the pinned siblings are provably not flagged; (b) a second **correctly pinned** invocation must stay green **and** must raise the extractor's invocation count by one, without which (b)'s green could mean "the extractor never saw it"; (c) an occurrence off command position, appended **fully pinned on purpose** so the only thing that can redden it is the classifier itself; (d) every invocation deleted → `NO-CANDIDATES`; (e) the continuation fold broken → `FOLD-BROKEN`, asserted **not** to also report `UNPINNED`, because conflating "the extractor truncated this" with "the pin is missing" sends the next maintainer to the wrong file; (f) every invocation displaced off command position → `NO-INVOCATIONS`; (g) a second invocation carrying both flags with an **empty** identity regexp → `WRONG-VALUE`, the hostile shape a presence-only check waves through; (h) a second invocation carrying both flags with a **foreign OIDC issuer** → `WRONG-VALUE` on the issuer half; and 2c strips the backticks from `SECURITY.md`'s prose mention and requires the same row to fail closed, proving the exemption keys on the backticks and is not a blanket bypass. The runtime twin has its own vacuity control (an unpinned line appended to a copy of the stub log must be seen). **One real defect was caught by this section during the lane and is recorded because it is a trap for the next author**: `log_unpinned_lines` was first written with `awk -v id="identity_re=${sec_identity}"`, and **awk processes escape sequences in a `-v` assignment**, so the pin's `github\.com` arrived as `github.com` and matched nothing; the values now reach awk through `ENVIRON`. **Stated limit, same posture as D-154's**: the denominator is the literal string `cosign verify-blob`, so an invocation spelled through a variable (`"$COSIGN" verify-blob …`), built by `eval`, or assembled from fragments is invisible to this gate. Widening the trigger to bare `verify-blob` was considered and **rejected** — it buys one hypothetical no file uses, and turns any future `SECURITY.md` sentence saying "verify-blob" outside backticks into a red gate, whose repair would be to loosen the classifier. **Nothing outside the gate changed**: `hack/install.sh`, `SECURITY.md` and `hack/release/verify-artifacts.sh` are byte-unchanged, and all four of their invocations were already pinned — this row closes a hole in the *checker*, not in the checked. The stage `release-install-cosign-pin-test` was already wired into `task check` and pinned in `hack/audit/exitgate_test.sh`'s `CHECK_STAGES`, so no wiring changed either. **SECOND ROUND — the first version of this fix REPRODUCED the very defect it closes, one level down, and independent review caught it before merge.** `has_flag` grepped the whole FILE; the replacement grepped the whole LINE. Both are existential; only the scope shrank. **UC-01**: one folded line was graded as at most ONE invocation, so `cosign verify-blob <both pins> --bundle a.json a && cosign verify-blob --bundle EVIL.json evil` began with `cosign verify-blob` (not UNCLASSIFIABLE), carried `--bundle` (not FOLD-BROKEN), carried both flag strings (not UNPINNED) and yielded the published values (not WRONG-VALUE) — **green**, in same-line, `;`-separated and backslash-folded forms, on all three graded files. Worse, the **full gate exited 0** for `SECURITY.md`: the two shell scripts were incidentally caught by the runtime twin (`log_unpinned_lines` at §5d), but **SECURITY.md is a document and has no runtime twin**, so the hole was unmitigated precisely on the file this row calls "the copy-paste recipe adopters run by hand" — D-153's exact incident class — while the gate printed "EVERY cosign verify-blob invocation ... is pinned", false as printed. The stated-limit paragraph did not cover it: it enumerated `$COSIGN`, `eval` and fragments, not `&&` chaining, and **leading** `&&` was explicitly handled (mutant (c) → UNCLASSIFIABLE), so the operator had been considered and only one side handled. Closed by grading per **OCCURRENCE** (`occurrence_count` + a new `MULTI-OCCURRENCE` violation that fails closed on any line carrying two calls) rather than per line; counting inside an already-triggered line uses the shorter `verify-blob`, so a second call spelled `cosign  verify-blob` or `"$COSIGN" verify-blob` and chained onto a pinned one is caught too, which the literal file-level trigger would miss. **UC-02**: `extract_issuer`/`extract_identity` anchor on a greedy `.*`, so the LAST value on a line wins — a hostile `--certificate-identity-regexp ''` placed FIRST was masked by a correct value placed second, **the extraction direction favoured the attacker**. Closed by `flag_value_tokens`, which returns EVERY value of every flag on the occurrence; each must equal the published one, so a repeated flag with an empty value first now reds. **UC-03 (P2, the erosion path)**: a CORRECTLY pinned call written with **double quotes** was refused as `WRONG-VALUE ... identity=<empty/unparsable> ... (an empty regexp matches every Fulcio identity)` — a true refusal with a **false reason**, and the repair a maintainer reaches for on that message is widening the extractor. Both quote styles are now accepted (double quotes are correct shell for this value: it contains no `$` and no backtick), and a **bare** value is diagnosed as `UNQUOTED-VALUE`, a QUOTING defect, never as a wrong or empty one — a gate that misdiagnoses erodes faster than one that refuses. **UC-04**: this row's "rc=0, rc=0, rc=0" reproduction figure is **splice-shape-sensitive** and is stated as measured: it holds for a second unpinned call spliced **in-body** next to the real one. An EOF-appended mutant reds the two shell scripts for an unrelated runtime reason, so the figure should not be read as holding for any second unpinned call. The same sensitivity is why the UC-03 double-quoted mutant reds the two scripts through the full gate (the spliced call actually RUNS and its fixture bundle is absent) while `SECURITY.md`, having no runtime, is the clean end-to-end proof at rc=0. The classifier's fail-closed posture on off-command-position occurrences was independently adjudicated KEEP, since §2c proves the prose exemption keys on the backticks and cannot be widened silently. **The lesson, recorded because it is the whole point of the lane:** a fix for an existential-where-universal defect is itself maximally exposed to the same defect at the next scope down — file, then line, then occurrence — and the only thing that caught it was a reviewer building the chained-call mutant that neither the 20-row external matrix nor the 25 in-gate mutants contained. **THIRD ROUND (UC-05..UC-09), and the reason this row now reads the way it does.** **UC-05**: `occurrence_count` compared whitespace-delimited fields to `verify-blob`, found one, and concluded **singularity** — when all it had established is that it did not find a second. `cosign "verify-blob"`, `cosign 'verify-blob'` and `cosign verify-blob""` are the same command to the shell, and each hid a chained unpinned call from the count. Measured against the round-2 gate on **all three** files at whole-gate level: **rc=0, rc=0, rc=0** — worse than first reported, because `A && B` short-circuits and `set -e` does **not** fire on a non-final member of an AND-list, so even the two shell scripts' runtime twin missed it. Closed by stripping shell quotes before the field compare, which is **a spelling patch, not a terminator, and is labelled as one in the code**. A structural terminator was sought and **ruled out with evidence**: refusing any graded line carrying a command separator would red the REAL files, since `hack/install.sh` and `hack/release/verify-artifacts.sh` both legitimately end their genuine invocation with an or-else `die` tail. **No structural terminator exists for this gate**, so completeness is not available and must not be claimed. **UC-07 is therefore the durable fix, and it is a change of posture rather than of logic.** The `PASS:` banner was printed unconditionally and asserted "EVERY cosign verify-blob OCCURRENCE ... is pinned" plus "a second unpinned call reddens whether it sits on its own line or is chained onto a pinned one" — a **universal claim bound to no assertion**. Under UC-05 that banner did not merely overstate: on a green run it printed something **false**, which is strictly worse than printing nothing, and it is this repo's #1 defect class (an assertion that cannot fail) wearing a different hat. The banner now reports **OBSERVED** counts per file (occurrences found, classified-and-graded, prose-exempt, refused), lists **ASSERTED** properties each of which is shown to fail on a mutant, and states the **NOT ASSERTED** residual in the same breath: this gate finds calls by a literal string and counts quote-stripped words, so a call spelled through a variable, `eval`, or fragments is not seen and not graded, and the counts are what was classified — **not a proof that nothing else exists**. When a fifth spelling turns up, the gate is then **incomplete rather than wrong**, and incomplete is recoverable. **UC-06**: a TRAILING comment mentioning `verify-blob` fired `MULTI-OCCURRENCE: … has 2 verify-blob calls chained on ONE line` — fail-closed but **false as printed**, since `cosign_candidates` only drops lines whose FIRST non-space character is `#`. That is the UC-03 misdiagnosis shape recurring **inside the UC-01 fix**. The message now says TOKENS, names both possible causes, and names the correct repair; excluding trailing comments was rejected as it needs quote-aware parsing, which is the machinery that produced UC-01/02/03. **UC-08**: `shellcheck` SC1087 ×2 (error severity) on `flag_value_tokens` — `"$flag[[:space:]]…"` parses as an array subscript; `${flag}` silences it. Cosmetic: no shellcheck gate exists in this repo. **UC-09**: two stage-count figures reported during this lane ("25", then "28") were **both wrong** and neither came from a committed file — they counted `task: [` lines in a run LOG, which includes nested task invocations. Measured: the Taskfile `check:` block has **21** `- task:` entries and `CHECK_STAGES` has **21** stage names; they agree, and both files are byte-identical to `origin/main`. There is no stage-count mismatch and this lane could not have caused one. **THE PATTERN, recorded because it is the lane's most transferable output:** four P1s, three of them the same scope error at successively finer scopes — file (`has_flag`), line (round 1), then occurrence-spelling (round 2) — each found by review and none by the author's own mutant matrix, because each matrix was built from the shape the previous round had just learned. The general lesson is not "add another spelling": it is that **when a gate's denominator cannot be made provably complete, the gate must report what it classified instead of asserting what exists.** That is now enforced where it is hardest to ignore, in the banner the gate prints on every green run. Revert: restore `has_flag`, drop the per-occurrence grading and the per-invocation value comparison, and restore the two positive-only stub-log greps — which returns the gate to certifying that *some* cosign call in each file is pinned, a property that is compatible with an unpinned one sitting beside it. |
diff --git a/hack/audit/aud2_exitgate_test.sh b/hack/audit/aud2_exitgate_test.sh
index 3884f86f..2baf6cad 100755
--- a/hack/audit/aud2_exitgate_test.sh
+++ b/hack/audit/aud2_exitgate_test.sh
@@ -2264,9 +2264,22 @@ done < <(assent_pr_gate_others "$SELF")
 # body, where `echo skip && exit 0` a line above would mean this gate never
 # runs. Measured at rc=0 before the restriction; the block form now counts only
 # as a block's SOLE command.
+# The injected step is written here rather than appended to an existing one, so
+# this control depends on NO other step's contents — sibling lanes edit
+# verify.yaml's toolchain steps, and a mutation harness anchored on their text
+# would red for their reason instead of its own.
 m="$WORK/verify.blockbleed.yaml"
 grep -vF "run: bash $SELF" "$WORKFLOW" \
-  | awk -v s="$SELF" '{ print } /go test -count=2 \.\/internal\/render/ { print "          bash " s }' >"$m"
+  | awk -v s="$SELF" '
+      { print }
+      $0 == "    steps:" && !done {
+        print "      - name: unrelated"
+        print "        run: |"
+        print "          echo skip \&\& exit 0"
+        print "          bash " s
+        done = 1
+      }
+    ' >"$m"
 assert_changed "$WORKFLOW" "$m"
 [[ "$(grep -cF "bash $SELF" "$m")" == "1" ]] ||
   fail "mutation harness: expected exactly one 'bash $SELF' occurrence in the bleed mutant"
diff --git a/hack/examples/dogfood_wiring_test.sh b/hack/examples/dogfood_wiring_test.sh
index 8304556b..551cee8e 100755
--- a/hack/examples/dogfood_wiring_test.sh
+++ b/hack/examples/dogfood_wiring_test.sh
@@ -390,6 +390,102 @@ pr_step_pinned() {
   return "$rc"
 }
 
+# --------------------------- 7a. the SHARED HELPER itself, against fixtures --
+#
+# Everything else in sections 7..7d mutates verify.yaml and asks the helper
+# about it. None of that can tell a working helper from a stubbed one: replace
+# `assent_pr_reach` with `return 0` and every assertion here — and in both
+# sibling gates — goes green at once, because hack/lib/pr_reach.sh is now a
+# single point of failure for all three. So the helper is also driven against
+# workflows written FROM SCRATCH here, minimal and self-evidently
+# reaching/not-reaching, where the expected answer does not depend on anything
+# in .github/workflows/**. hack/lint/workflow_pins_test.sh carries the same
+# fixtures, so deleting this section alone does not remove the property.
+helper_fixture() { # <name> <heredoc on stdin> -> prints the path
+  local f="$WORK/fixture.$1.yaml"
+  cat >"$f"
+  printf '%s' "$f"
+}
+
+helper_reach_is() { # <want-rc> <file> <label>
+  local want="$1" f="$2" label="$3" got=0
+  assent_pr_reach "$f" "$WORK" || got=$?
+  ((got == want)) ||
+    fail "helper self-check '$label': assent_pr_reach returned $got, want $want — hack/lib/pr_reach.sh does not do what every assertion in this script and in both sibling gates delegates to it"
+  echo "OK: helper self-check — $label (rc=$want)"
+}
+
+echo "== 7a. hack/lib/pr_reach.sh answers correctly on from-scratch fixtures =="
+m="$(helper_fixture reach-min <<'FIX'
+name: f
+on:
+  pull_request:
+jobs: {}
+FIX
+)"
+helper_reach_is 0 "$m" "a bare 'on: pull_request:' reaches every PR"
+
+m="$(helper_fixture reach-paths <<'FIX'
+name: f
+on:
+  push:
+    branches: [main]
+  pull_request:
+    paths: [internal/**]
+jobs: {}
+FIX
+)"
+helper_reach_is 11 "$m" "a paths:-filtered pull_request does NOT — and it is the LAST key in on:, so the filter is not read from a sibling trigger"
+
+m="$(helper_fixture reach-none <<'FIX'
+name: f
+on:
+  push:
+    branches: [main]
+jobs: {}
+FIX
+)"
+helper_reach_is 2 "$m" "a push-only workflow reaches no PR"
+
+helper_wired_is() { # <want-rc> <file> <script> <label>
+  local want="$1" f="$2" s="$3" label="$4" got=0
+  assent_step_wired "$f" verify "$s" "$WORK" || got=$?
+  ((got == want)) ||
+    fail "helper self-check '$label': assent_step_wired returned $got, want $want — the shared step reader does not do what all three gates delegate to it"
+  echo "OK: helper self-check — $label (rc=$want)"
+}
+
+m="$(helper_fixture wired-min <<'FIX'
+name: f
+on:
+  pull_request:
+jobs:
+  verify:
+    runs-on: ubuntu-latest
+    steps:
+      - name: gate
+        run: bash hack/examples/dogfood_wiring_test.sh
+FIX
+)"
+helper_wired_is 0 "$m" "$SELF_REL" "a minimal wired step is accepted"
+helper_wired_is 5 "$m" "hack/lint/workflow_pins_test.sh" "a script the fixture does not run is reported absent"
+
+m="$(helper_fixture wired-comment <<'FIX'
+name: f
+on:
+  pull_request:
+jobs:
+  verify:
+    runs-on: ubuntu-latest
+    steps:
+      # bash hack/examples/dogfood_wiring_test.sh
+      - name: gate
+        # run: bash hack/examples/dogfood_wiring_test.sh
+        run: echo hi
+FIX
+)"
+helper_wired_is 5 "$m" "$SELF_REL" "a step that only MENTIONS the script in comments is reported absent (the residual-3 property, on a fixture)"
+
 echo "== 7. this gate runs in the pull-request-visible verify job, undisarmed =="
 rc=0; pr_step_pinned "$WORKFLOW" || rc=$?
 case "$rc" in
@@ -542,9 +638,22 @@ expect_rc 2 "$m" "the only 'pull_request:' left is an INPUT NAME nested under wo
 # `run: |` body, where `echo skip && exit 0` on the line above would mean this
 # gate never runs. Measured at rc=0 before the restriction; the block form is
 # now accepted only when it is the block's SOLE command.
+# The injected step is written here rather than appended to an existing one, so
+# this control depends on NO other step's contents — sibling lanes edit
+# verify.yaml's toolchain steps, and a mutation harness that anchors on their
+# text reds for their reason instead of its own.
 m="$WORK/verify.blockbleed.yaml"
 grep -vF "run: bash $SELF_REL" "$WORKFLOW" \
-  | awk -v s="$SELF_REL" '{ print } /go test -count=2 \.\/internal\/render/ { print "          bash " s }' >"$m"
+  | awk -v s="$SELF_REL" '
+      { print }
+      $0 == "    steps:" && !done {
+        print "      - name: unrelated"
+        print "        run: |"
+        print "          echo skip \&\& exit 0"
+        print "          bash " s
+        done = 1
+      }
+    ' >"$m"
 [[ "$(grep -cF "bash $SELF_REL" "$m")" == "1" ]] ||
   fail "mutation did not land: expected exactly one 'bash $SELF_REL' occurrence in the bleed mutant"
 grep -qF -- "run: bash $SELF_REL" "$m" && fail "mutation did not land: the real step's run: line survived in the bleed mutant"
diff --git a/hack/lint/workflow_pins_test.sh b/hack/lint/workflow_pins_test.sh
index e479c7da..bb35ffa0 100755
--- a/hack/lint/workflow_pins_test.sh
+++ b/hack/lint/workflow_pins_test.sh
@@ -1054,6 +1054,101 @@ expect_red check_ci_wiring "$m" "the 'verify' job was renamed, so the job extrac
 # here now: the ones that satisfy the old grep are marked, because they are the
 # whole reason hack/lib/pr_reach.sh exists.
 
+# ---------------- 5a. the SHARED HELPER itself, against fixtures -------------
+#
+# Every other assertion in sections 5..5c mutates verify.yaml and asks
+# hack/lib/pr_reach.sh about it. None of that can tell a working helper from a
+# stubbed one: replace `assent_pr_reach` with `return 0` and this gate AND both
+# sibling gates go green at once, because the helper is now a single point of
+# failure for all three. So it is also driven against workflows written FROM
+# SCRATCH, minimal and self-evidently reaching or not, where the right answer
+# depends on nothing under .github/workflows/**.
+# hack/examples/dogfood_wiring_test.sh carries the same fixtures, so deleting
+# either section alone does not remove the property.
+
+echo "== 5a. hack/lib/pr_reach.sh answers correctly on from-scratch fixtures =="
+helper_fixture() { # <name> <heredoc on stdin> -> prints the path
+  local f="$WORK/fixture.$1.yaml"
+  cat >"$f"
+  printf '%s' "$f"
+}
+helper_reach_is() { # <want-rc> <file> <label>
+  local want="$1" f="$2" label="$3" got=0
+  assent_pr_reach "$f" "$WORK" || got=$?
+  ((got == want)) ||
+    fail "helper self-check '$label': assent_pr_reach returned $got, want $want — hack/lib/pr_reach.sh does not do what this gate and both sibling gates delegate to it"
+  echo "OK: helper self-check — $label (rc=$want)"
+}
+helper_wired_is() { # <want-rc> <file> <script> <label>
+  local want="$1" f="$2" s="$3" label="$4" got=0
+  assent_step_wired "$f" "$ASSENT_PR_JOB" "$s" "$WORK" || got=$?
+  ((got == want)) ||
+    fail "helper self-check '$label': assent_step_wired returned $got, want $want — the shared step reader does not do what all three gates delegate to it"
+  echo "OK: helper self-check — $label (rc=$want)"
+}
+
+f="$(helper_fixture reach-min <<'FIX'
+name: f
+on:
+  pull_request:
+jobs: {}
+FIX
+)"
+helper_reach_is 0 "$f" "a bare 'on: pull_request:' reaches every PR"
+
+f="$(helper_fixture reach-paths <<'FIX'
+name: f
+on:
+  push:
+    branches: [main]
+  pull_request:
+    paths: [internal/**]
+jobs: {}
+FIX
+)"
+helper_reach_is 11 "$f" "a paths:-filtered pull_request does NOT — and it is the LAST key in on:, so the filter is not read from a sibling trigger"
+
+f="$(helper_fixture reach-none <<'FIX'
+name: f
+on:
+  push:
+    branches: [main]
+jobs: {}
+FIX
+)"
+helper_reach_is 2 "$f" "a push-only workflow reaches no PR"
+
+f="$(helper_fixture wired-min <<'FIX'
+name: f
+on:
+  pull_request:
+jobs:
+  verify:
+    runs-on: ubuntu-latest
+    steps:
+      - name: gate
+        run: bash hack/lint/workflow_pins_test.sh
+FIX
+)"
+helper_wired_is 0 "$f" "$SELF_GATE" "a minimal wired step is accepted"
+helper_wired_is 5 "$f" "hack/audit/aud2_exitgate_test.sh" "a script the fixture does not run is reported absent"
+
+f="$(helper_fixture wired-comment <<'FIX'
+name: f
+on:
+  pull_request:
+jobs:
+  verify:
+    runs-on: ubuntu-latest
+    steps:
+      # bash hack/lint/workflow_pins_test.sh
+      - name: gate
+        # run: bash hack/lint/workflow_pins_test.sh
+        run: echo hi
+FIX
+)"
+helper_wired_is 5 "$f" "$SELF_GATE" "a step that only MENTIONS the script in comments is reported absent"
+
 echo "== 5b. verify.yaml reaches EVERY pull request, unfiltered =="
 
 # Insert a filter directly under the `pull_request:` trigger key.
@@ -1146,9 +1241,13 @@ expect_green check_ci_wiring "$m" "the quoted '\"on\":' key (YAML 1.1 truthiness
 # another step's multi-command `run: |` body, where `echo skip && exit 0` a line
 # above would mean this gate never runs. Measured at rc=0 before the
 # restriction; the block form now counts only as a block's SOLE command.
+# The injected step is written here rather than appended to an existing one, so
+# this control depends on NO other step's contents — sibling lanes edit
+# verify.yaml's toolchain steps, and a mutation harness anchored on their text
+# would red for their reason instead of its own.
 m="$(mutant wiring-block-bleed)"
 mutate_awk "$m/verify.yaml" \
-  '{ if ($0 == "        run: bash hack/lint/workflow_pins_test.sh") next; print; if ($0 ~ /go test -count=2 \.\/internal\/render/) print "          bash hack/lint/workflow_pins_test.sh" }' \
+  '{ if ($0 == "        run: bash hack/lint/workflow_pins_test.sh") next; print; if ($0 == "    steps:" && !done) { print "      - name: unrelated"; print "        run: |"; print "          echo skip \&\& exit 0"; print "          bash hack/lint/workflow_pins_test.sh"; done = 1 } }' \
   '          bash hack/lint/workflow_pins_test.sh'
 bleed_real="$WORK/hits.bleed_real"
 grep -nF -- '        run: bash hack/lint/workflow_pins_test.sh' "$m/verify.yaml" >"$bleed_real" || true

From d185d9db8b71e300e381049bfbdac807f01a2525 Mon Sep 17 00:00:00 2001
From: Konrad Heimel <konrad.heimel@gmail.com>
Date: Sun, 23 Aug 2026 19:46:23 +0200
Subject: [PATCH 3/8] :bug: fix(ci): close two PR-reach fail-opens the review
 found end-to-end (D-157)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Both were found by mutating the REAL .github/workflows/verify.yaml and
running the three real gate scripts against it — not by fixtures. Both
returned rc=0 before this commit; each now returns its own code.

G3-01 (P1) — the filter greps were pinned to EXACTLY four spaces
(`^    (paths|paths-ignore):`). Six-space indent is valid YAML resolving
to the identical mapping, the grep missed it, and control fell through
to `return 0`: all three gates went green on a paths-filtered trigger,
the exact shape D-157 says they refuse. It was also the one place the
helper broke its own stated rule — refusing an unevaluable SHAPE while
silently accepting an unrecognised INDENT. Matching is now
indent-agnostic within the trigger sub-block, which is safe because that
block is already scoped and exits at the next 2-space key, so a sibling
trigger's filter cannot bleed in (measured, not assumed). The sub-block's
own keys are allowlisted to GitHub's five, so an unknown key is refused
(rc=10) rather than accepted.

G3-02 (P1, inherited from main, not introduced) — the step disarm grep
lacked the `(-[[:space:]]+)?` alternative its run:/uses: siblings in the
same function had, so a step whose FIRST key is the disarm
(`      - if: …`, a sequence item) graded "wired, argument-free and
undisarmed". That hollowed out the cross-pinning this lane delivers.

G3-03 — the wiring-name-removed mutation was coupled to the literal text
of the step's `- name:` line, so an unrelated edit made the sed a no-op
and `mutate` reported a BROKEN HARNESS for a workflow that was merely
different. The step start is now derived from the gate's own run line.

G3-04 — `_assent_strip_comment`'s claim that its effect was "safe in
both directions" was false for `branches-ignore:`: stripping removes
tokens from a must-NOT-contain test, so a quoted ` #` before `main` hid
it. Stripping is now per-key and off there; the comment says why.

Why a 28-row mutant matrix missed all of this: it was broad in mutant
SHAPES and narrow in CODE coverage — 3 of 6 assent_pr_reach codes and 2
of 8 assent_step_wired codes had a fixture. Every code now has one, the
filter fixtures written at a NON-4-space indent on purpose.

CONTROL_FLOOR 51 -> 57 (text-only 45 -> 51), both met exactly.
---
 docs/decisions/decisions.md          |   2 +-
 hack/audit/aud2_exitgate_test.sh     | 103 +++++++++++++++++--
 hack/examples/dogfood_wiring_test.sh | 125 ++++++++++++++++++++++-
 hack/lib/pr_reach.sh                 | 118 +++++++++++++++++-----
 hack/lint/workflow_pins_test.sh      | 143 ++++++++++++++++++++++++++-
 openspec/specs/backlog.md            |   2 +-
 6 files changed, 455 insertions(+), 38 deletions(-)

diff --git a/docs/decisions/decisions.md b/docs/decisions/decisions.md
index a35e7d8b..43eb196d 100644
--- a/docs/decisions/decisions.md
+++ b/docs/decisions/decisions.md
@@ -160,7 +160,7 @@ project/process decisions.
 | D-153 | 2026-08-19 | **The cosign signer-identity pin published in `SECURITY.md` was WRONG, not merely missing from `hack/install.sh`: the identity regexp is widened to `^https://github\.com/PlatformRelay/[Aa]ssent/` in both files (AUD2-S03 / SEC-03).** Substance first: `SECURITY.md`'s "Verify a tagged release" instructions pinned `--certificate-identity-regexp '^https://github.com/PlatformRelay/assent/'`, and an adopter who followed them on **v0.2.0 or v0.3.0 got a verification FAILURE on a genuine, correctly signed artifact** — the published recipe has been broken for every release since v0.2.0, and the natural reading of that failure is "this release was tampered with". Cause: the repository was renamed `PlatformRelay/assent` → `PlatformRelay/Assent` between v0.1.0 and v0.2.0; the keyless signing certificate's Subject Alternative Name carries GitHub's canonical casing; cosign compiles `--certificate-identity-regexp` as a Go RE2 pattern and matches it **case-sensitively**. Decoded from the published bundles: v0.3.0 and v0.2.0 sign as `https://github.com/PlatformRelay/Assent/.github/workflows/release.yaml@refs/tags/vX.Y.Z`, v0.1.0 as `https://github.com/PlatformRelay/assent/.github/workflows/release.yaml@refs/heads/main`. All three verify under the new value; independently re-confirmed with real cosign against the real v0.3.0 artifact (`Verified OK` under the new pin, exit 1 "expected SAN value to match regex" under the old). Options considered: **(a)** ship the pin byte-identical to the published-but-broken value and file the breakage as a follow-up (rejected — it would land a green gate asserting a guarantee that fails closed on this project's own releases, D-124's defect one level up); **(b)** case-insensitive `(?i)` (rejected — wider than the defect and it silently accepts casings GitHub never issues); **(c)** an explicit `[Aa]` class in both files, dots escaped (chosen). Not widened otherwise: the `^` anchor and the owner/repo scope stand, so another owner, an `assent-mirror` typosquat, another forge and an unescaped-dot host all still fail. Enforcement, per D-128: **one** published truth — `hack/release/install_cosign_pin_test.sh` extracts the pair from `hack/install.sh` and `SECURITY.md`, requires exactly one distinct value per file, reddens on drift, and (this is the assertion that would have caught the defect) matches the pin against the three **real** SANs above, committed as offline fixtures, plus six negatives. Extends D-110 (bundles beside archives) and D-109; the maintainer-path twin at `hack/release/verify-artifacts.sh:124` is still unpinned and is tracked in the backlog, not fixed here. Revert: restore `'^https://github.com/PlatformRelay/assent/'` in both files — which re-breaks verification of v0.2.0 and every later release, so revert only together with a repo rename back to lowercase. |
 | D-154 | 2026-08-23 | **Every `hack/**` script that uses a bash 4+ feature declares a PER-SCRIPT version floor via the shared `hack/lib/require-bash.sh`, because one of them was a silent local FAIL-OPEN under stock macOS bash 3.2 (BASH32-F01).** Substance first: `/bin/bash hack/docs/truthlag_pins_test.sh` on macOS printed 20 `PASS` lines, died at its `declare -A ex_s09_prefix_hint=(…)`, never printed its final `OK: all truth-lag pins green` banner — and **exited 0**. Its caller `task docs-gates`, and therefore `task check`, read that as a green gate, and AGENTS.md rule 4 makes a green local `task check` a per-commit precondition; CI is ubuntu/bash 5, so nothing merges through this path, which is precisely why it survived. Mechanism, measured on bash 3.2.57: 3.2 has no associative arrays, so under `set -u` it re-reads `declare -A x=([k]=v)` as an INDEXED array assignment and evaluates the subscript `k` **arithmetically**, hitting "unbound variable"; the shell terminates the script and the exit status is 0. Two theories were disproved en route and are recorded so they are not re-explored: the `trap … EXIT` status-swallow (3.2 propagates 1 through an EXIT trap correctly) and `set -e` (the script runs `set -uo pipefail`). The other two affected scripts fail CLOSED, but only incidentally: `hack/release/verify-artifacts.sh:202`'s literal is EMPTY, so there is no subscript to evaluate and it degrades to `declare: -A: invalid option`, which its `set -e` turns into exit 2 (measured with a `--dist` that reaches line 202 — an unreachable dist exits 1 much earlier); `hack/validate-schemas-stock.sh`'s `mapfile` degrades to "command not found" and it exits 1. Populating an empty literal or dropping `-e` silently converts a closed failure into the open one, so "how this construct happens to degrade" is not a guarantee worth depending on. Options considered: **(a)** one blanket repo-wide floor (rejected — the binding minimum differs per feature: `declare -A` 4.0, `local -n` 4.3, `mapfile -d ''` 4.4; a blanket floor both refuses shells that could run the 4.0 gates and hides which feature actually binds); **(b)** rewrite the three scripts to be 3.2-compatible (rejected — associative arrays and `mapfile` are the right tools here, a rewrite is a large risky change to scripts whose correctness IS the product, and it does nothing about the next gate author); **(c)** copy the existing inline `BASH_VERSINFO` guard from `hack/audit/aud2_exitgate_test.sh:71` into each script (rejected as the *only* measure — it duplicates the explanation three more times and still leaves the next author to rediscover the hazard); **(d) chosen** — a shared `require_bash <major>[.<minor>] <feature>` helper, called with each script's own correct floor (4.0 / 4.0 / 4.4), plus a meta-gate. Enforcement, per D-128, is one place: `hack/lint/bash_version_guard_test.sh`, wired as `task check` stage **20** and pinned in `hack/audit/exitgate_test.sh`'s `CHECK_STAGES` in the same commit. It scans every `hack/**/*.sh` for command-position bash 4+ constructs, requires a guard on each, requires the declared floor to be at least the feature's own minimum, and — the assertion that makes the rest non-vacuous — requires the scan to still find all four known feature-using files, so a typo in a detection pattern reds instead of quietly matching nothing. Its own negative control mutates real copies of the three scripts with the guard lines stripped and asserts they are flagged. `hack/audit/aud2_exitgate_test.sh` keeps its inline guard and is accepted by the gate as guarded; adopting the helper there is a follow-up, not this lane. Stated limits: the gate sees only command-position constructs in `hack/**/*.sh` (not `eval`, dynamically built command names, case-modification expansions, or scripts outside `hack/`), and the exit-0 control needs a real bash 3.2 — present on macOS, absent on CI ubuntu, where it SKIPs **loudly** rather than passing silently. Accepted behaviour change: under 3.2, `hack/release/verify-artifacts.sh --help` now refuses instead of printing usage. Revert: delete the guard calls — `task check` then silently stops certifying the docs truth-lag pins for every contributor whose `bash` is 3.2. |
 | D-156 | 2026-08-23 | **The tier-1 (CEL) ceiling is recorded (`docs/planning/rego-tier-ceiling.md`, E11-S01 / REQ-E11-S01-01+02) and it NARROWS E11: two of the four named shapes are struck outright and a third in part.** Substance first: of multi-pass / cross-manifest / set-difference / graph-relationship (`openspec/specs/later-phases.md:284`), **cross-manifest and set-difference are struck, the "named intermediate" half of multi-pass is struck, and only fold/aggregate-over-a-collection and in-input graph reasoning survive as justification for a second backend.** Measured against the surface this repo actually binds — `internal/core/aggregate/evaluate.go` `newEvalEnv`, eleven frozen predicate-scope variables, **zero extension libraries** — reproduced in a nested throwaway module pinned to the repo's `cel-go v0.31.0` (root `go.mod`/`go.sum` byte-unchanged; nothing added to the dependency graph, which judgment call (d) has not authorised). **What exceeds tier 1: (1) folds.** `sum`, `reduce`, `math.*` and `lists.*` are all `undeclared reference`; `size()` is the only aggregate in the surface, so a rule counting matched changes is expressible and a rule summing a numeric delta across them is not. **(2) Graph reasoning** — the iteration count of a CEL expression cannot be made data-dependent, so depth is syntactic and **unbounded** reachability has no spelling; a bounded `k`-hop form *is* writable and answers a fixed-depth question, not the rule (detailed below, with the refutations of two sharper claims this row previously made). **What is struck, with the CEL that does the job:** registry membership — `string(new) in facts.registry.topics.value` over a `cardinality: set` fact, already shipped green at `examples/packs/service-catalog/.assent/packs/catalog/rules/ownership.yaml:21`; keyed attribute lookup — either a purpose-built provider (`builtin/resource-owner`, exercised in both polarities by `examples/archetypes/referenced-resource-ownership/`) or `facts.<p>.<n>.value[key].field`, which compiles and is lint-clean because `internal/lint/facts_ref.go`'s D-051 shape check permits arbitrary navigation past `.value` and only forbids indexing `facts` itself; set difference — `oldEntry.acls.filter(a, !(a in entry.acls)).size() == 0`; named intermediates — no `cel.bind`, but re-deriving the sub-expression inside each leaf is semantically identical and compiles. **The sharpest finding is a distinction, not a rule:** same-changeset **cross-file** reasoning fails for **input availability**, not expressiveness — the evaluation unit is one file (`change.ChangeSet` is documented "for one file", `internal/change/diff.go:129`; `assent run` strips one `--subject file:<path>`, `cmd/assent/run.go:266`, and diffs it alone, `:293`) and **REQ-E11-S05-01 pins the Rego module to the identical `EvaluationInput`** with the tier fenced to "declared data, no I/O". **A Rego module therefore fails that rule identically, so it is struck from E11's justification too** — the fix is an input decision, which E11's non-goals fence, not a backend decision. Corroborating: the one committed illustration of the escape hatch, `examples/policies/rego/bounded_change.rego`, is **entirely tier-1 expressible** — both `violations` rules are per-change predicates and `examples/policies/declarative/bounded-change.yaml` is the same rule already in the envelope. **The strongest single piece of evidence, and the one that sizes the epic, is the graph shape.** On the `assent run` path document-mode `walkNode` emits a Change **only where two scalars differ** — a sequence on either side makes the whole ChangeSet **opaque → REVIEW** before any rule runs (`internal/change/diff.go`) — and collection-mode `DiffEntries` is reached only from `internal/adoptertest`, so `old`/`new`/`entry`/`oldEntry` and every `changes[i].old`/`.new` bind **scalars**. That does **not** starve a graph rule, because a flat `set` fact still carries structure: `edges: {type: string, cardinality: set}` returning `["orders|billing","billing|ledger"]` is a **fully declarable, in-contract adjacency inside `EvaluationInput` today** — the declaration is legal (`schemas/provider/v1alpha1/response.schema.json`), `fact.value` carries no JSON-Schema type constraint and `ResolveFactsChecked` cross-checks the *declaration* not the value (`internal/provider/resolve.go`), outputs are operator-authored (`internal/provider/config.go`), the `http` transport is live on the plain run path with **no `--checkout`** (`cmd/assent/provider_host.go` `providerCallFor`), and a set fact binds as a CEL list. Tier-1 CEL nonetheless cannot answer the actual question over it: **CEL has no recursion, fixpoint, fold or user-defined function, so unbounded reachability has no spelling** (`transitiveClosure` → `undeclared reference`; the four comprehension macros iterate one level and cannot call themselves). **Stated precisely, because two drafts of this record overreached and both were caught by independent review:** a *bounded* `k`-hop check **is** expressible and does **not** need the string decomposition CEL lacks — over a finite in-input candidate set (a `nodes` set fact, the same construction as `edges`), decode is replaceable by **encode-and-compare**: `nodes.value.exists(m, nodes.value.exists(n, (string(new)+"|"+m) in edges.value && (m+"|"+n) in edges.value && (n+"|"+string(new)) in edges.value))` compiles **and evaluates** under the real `cel.CostLimit(1_000_000)` to `true/true/true/false` over the fixture above, and `nodes.value.filter(m, (string(new)+"|"+m) in edges.value)` recovers an edge's far end as `[billing]`. Both primitives (`+` on strings, `in`) were already in this record's own function census, so the claim that decoding was a second independent barrier was internally inconsistent as well as false. **The real ceiling is `k`, and a third draft got its cost wrong too** — it claimed `O(|N|^(k-1)·|E|)` "exhausts the cost budget on any real graph". Wrong complexity class and wrong conclusion, because the census had omitted the surface's only value binder, `[expr].all(v, …)`: binding each BFS frontier once per level makes cost additive across levels, and measured under the real `cel.CostLimit(1_000_000)` a ring `|N|=50, deg 5` costs 89,551 at `k=10`, 235,297 at `k=20` and 686,317 at `k=50` — roughly linear in `k`, and at `k=50 ≥ |N|` CEL is **not approximating at all, it decides reachability exactly**, in 69% of budget. The practical `k` collapses around `|N|≈200` (`k=10` at 46% of budget, `k=20` exceeds). Recorded because a reader sizing this epic is entitled to ask "would CEL suffice for *our* graph?" and the previous sentence foreclosed that question with an assertion measurement refutes; it is **not** offered as a second reason. **What carries the verdict is one property, now measured rather than recalled: the iteration count of a tier-1 CEL expression cannot be made data-dependent.** `reduce`, `transformList`, `transformMap`, two-var `all(i,x,…)`, `range`/`lists.range` and `cel.bind` are all `undeclared reference`; `for` is a `reserved identifier`; there is no fold, self-reference or generator; so depth is a **syntactic** property, hard-capped by cel-go's parser recursion limit of 250 (`expression recursion limit exceeded: 250` at depth 260, depth 200 still compiles). That a fixed `k` really is an approximation when the data outruns it is measured too: on a 4-cycle the `k=3` form evaluates `false` and the `k=4` form `true`. **Rego answers the unbounded question with `graph.reachable` — pure and deterministic — and that single gap is the whole justification.** **An input that is in contract and available today, over which CEL can only approximate and Rego decides, is exactly the per-rule evidence D-017's gate demanded — so E11 has TWO unconditional justifications (folds and graphs), neither waiting on any open question.** Deliverability caveat, stated because this row makes the same distinction for sub-shape B1: **no provider in the corpus ships an encoded adjacency today** — that one *can* follows from the provider contract, the same inference used to strike B1, not from a shipped example. Options considered: **(a)** record all four shapes as exceeding, the reading D-141's unlock invites (rejected — three are demonstrably expressible and an unfalsifiable ceiling claim is the defect this story exists to prevent); **(b)** strike set-difference **conditionally**, so that a narrowing answer to OQ-35 would return it to the ceiling (rejected on the second pass — both resolutions strike it: extending the entry binding makes CEL express it, narrowing makes it an input-availability failure that REQ-E11-S05-01 hands to Rego unchanged, so a conditional would have left a downstream story waiting on an answer that cannot change the verdict); **(c)** strike cross-manifest and set-difference **unconditionally**, strike half of multi-pass, keep folds and in-input graphs **both unconditionally** **(chosen)**. **Two rejected drafts are recorded because the same failure produced both, with the sign flipped, and only independent review caught either.** Draft 1 made the graph shape *contingent* on OQ-35/OQ-36 on the premise that "an adjacency needs a mapping-valued fact" — it does not; a set of encoded strings carries one inside the frozen declaration — which came from conflating a *provider-supplied catalog* (sub-shapes B1/B2, struck here as working and shipped) with **B3, which is specifically same-changeset cross-file *diffs***. It would have advised the operator to defer a 14-story epic on a premise that does not hold. Draft 2 replaced that with a second "independent reason" — that CEL cannot decode an edge, killing even a bounded two-hop check — **refuted by execution** (the encode-and-compare leaf above). Draft 3 replaced *that* with the exponential-cost claim above — **refuted by measurement**. The common cause across all three is one habit: **reaching for a second independent reason when one sufficient reason was already in hand**, and then applying an **asymmetric evidentiary standard** to protect it — accepting awkward-but-working spellings when they *struck* a shape (A2's re-derivation, B2's dynamic index) and rejecting them when they would have *narrowed* one this record wanted to keep. The verdict was right in all four drafts; the supporting argument was wrong in three. It now rests on one measured property and no supporting argument at all, which is the form it should have taken first. The correction to A2 runs the same way: the value binder `[expr].all(v, …)` removes the evaluation-cost half of A2's residual, so **A2 is struck more firmly than the first draft struck it**. Binds later stories: **S05** must not be widened to carry cross-manifest data; **S07**'s violation shape must support a fold result and a path/cycle witness, not a cross-manifest reference; **S12** must correct ADR-0002's `rego` bullet, which calls the tier an "escape hatch for **cross-entry checks**" — inaccurate for the shipped input contract; **S11** must label the unquarantined example a shape illustration, never evidence of need. **Binds E11-S04, whose denylist is not yet written: `graph.reachable` MUST be allowed**, with `split` alongside it — both pure and deterministic. `graph.reachable` is the one that carries the justification (it closes the graph at any depth); `split` is a convenience for rebuilding the adjacency. A capability set drafted from "deny anything unfamiliar" would strike out the epic's own strongest justification. Recorded in the S04 section of the epic spec, not only S01's. **That floor is held by REVIEW, not by a gate, and this row says so rather than inventing an enforcement path:** REQ-E11-S04-02's committed golden detects a *change* to the allowed set (so the sandbox cannot silently widen) and cannot detect an *omission* — a golden written without `graph.reachable` stays green forever. It says nothing about judgment call (d), since *which* builtins are callable is orthogonal to *where* the evaluator lives. Two residuals raised, neither decided, **neither gating any verdict here**, and neither the escalated rule-7 (d1)/(d2) question: **OQ-35** (the `entry`/`oldEntry` binding asymmetry — a silent `assent test` / `assent run` divergence; set-difference is struck either way and the graph shape needs no entry tree) and **OQ-36** (the frozen provider declaration has no object/map type, yet the authoring surface and `builtin/repo-file` together permit a mapping-valued fact). Also flagged, not edited (out of lane): `REQ-DEM-S05-04` calls the provider-visible tree the "merged-result checkout"; the code reads `<root>/head`, documented at `cmd/assent/checkout.go:44` as "the MERGE-REQUEST HEAD". This lane writes no Go, adds no dependency and touches no schema. Revert: delete `docs/planning/rego-tier-ceiling.md` and the D-156 narrowing text from the E11 spec — which restores an epic justified by four shapes, three of which this record shows are not real. |
-| D-157 | 2026-08-23 | **"Reaches pull requests" is now a SHARED, structural check (`hack/lib/pr_reach.sh`), the three PR-visible text gates CROSS-PIN each other's steps, and the fixed-string step check is replaced by an anchored `run:`-command match (GATES3).** Three residuals, each *demonstrated* by an independent reviewer on an earlier lane and each deliberately left unfixed there, all living in the same three files — `hack/lint/workflow_pins_test.sh`, `hack/audit/aud2_exitgate_test.sh`, `hack/examples/dogfood_wiring_test.sh`. **(1) The substantive one.** Two of the three answered "am I reachable on a PR?" with `grep -qE '^[[:space:]]+pull_request:'` over the workflow's `on:` block; a reviewer added `paths: ['internal/**']` under the trigger and measured **rc=0** — the trigger is present, the grep is satisfied, and the gate is disarmed for every PR that touches only `Taskfile.yml` or `.github/workflows/**`, which is exactly the class of PR these gates exist to grade. `types: [closed]` is the same defect by another route, and the grep's `[[:space:]]+` is indent-blind, so a `pull_request:` nested under `workflow_call.inputs` satisfied it too. **The third gate did not answer the question at all** — `workflow_pins_test.sh` asserted its step was present and undisarmed and never that the workflow carrying it runs on a PR; this is new coverage there, not a strengthening, and the brief that commissioned this lane assumed otherwise. **Decision on meaning:** a workflow "reaches PRs" when it has a top-level `pull_request:` trigger carrying **no** `paths:`/`paths-ignore:`, a `types:` list that is absent or a **superset** of GitHub's defaults (`opened`, `synchronize`, `reopened`), and no branch filter excluding `main` — and when the target job carries neither a job-level `if:` **nor a job-level `needs:`** (a dependency that skips on PRs skips its dependents, defeating all three gates at once while every other assertion stays green). **Deliberately still accepted**, stated so a reviewer does not read the narrowing as wider than it is: `on: pull_request` and `on: [push, pull_request]` (the inline forms cannot carry a filter, so they are strictly safer than the block form), the quoted `"on":` key, a `types:` superset, `branches:` listing the literal `main`, `branches-ignore:` sparing `main`, block-scalar `run: |` invocations, arbitrarily long comment blocks inside a gate step, and step-level `if:` on *other* steps (`verify.yaml`'s changelog gate is legitimately PR-excluded). **Deliberately narrower than GitHub:** a `branches:` glob covering main without the literal token (`['ma*']`) reds, because a bash gate cannot honestly evaluate GitHub's glob semantics, and a flow mapping or anchor in the `on:` block is **refused** (distinct code) rather than guessed at. **(2)** Each gate pinned only its OWN step, so a PR deleting one of the other two was invisible to the gate that still ran — caught locally by `task check` and on push by `release-exitgate`, hence a gap and not a hole. Each gate now asserts all three steps; the mutation matrix is the full cross-product (3 deleted steps × the 2 observers that still run) rather than a diagonal. **(3)** `aud2_exitgate_test.sh`'s `check_pr_wiring` located its step with `grep -nF -- "$SELF"` — a search for the script *name*, which the step's own comments satisfy. Measured by the reviewer: with the `run:` line commented out it still failed, but reported **"WITH ARGUMENTS"** instead of "does not invoke", sending an operator to look for an argument that does not exist. The anchored form from `dogfood_wiring_test.sh` is ported back and shared. **Why one lane and one helper, not three fixes:** the INBOX residual explicitly asked for a single shared helper so the next gate author inherits the strong check rather than copying the weak one; fixing one of three identical checks would have been misleading. **Judgment calls.** (a) The helper is **codes-only and prints nothing** — every caller owns its wording, because roughly twenty existing `expect_red` controls pin stderr fragments. (b) The 1..6 **line cap** `workflow_pins_test.sh` used to bound step isolation is replaced by a structural invariant — exactly one `run:` key and no `uses:` key, both of which actionlint itself flags — because cross-pinning made the helper isolate the aud2 and dogfood steps, whose comment blocks are a dozen lines long, and no cap admits an honest step of theirs while rejecting a merged one. (c) The helper is held to `workflow_pins_test.sh`'s preamble rules (**bash 3.2**, portable ERE, no `git`, no `grep -q` on a pipe) rather than aud2's ≥4.3 floor: that gate runs first in CI before any toolchain, and the other two callers do not refuse bash 3.2, so a bash-4 construct here would silently weaken them on a maintainer's machine. (d) It is a **line-oriented reader with a structural bias, not a YAML parser** — it says so in its own header and fails closed on anchors, aliases and flow mappings, because an honest narrow gate beats an overreaching one. (e) No new `check:` stage and `CHECK_STAGES` untouched: all three gates were already wired. **Evidence:** 44 helper-level probes plus, in the gates themselves, 13 new red controls in aud2 (`CONTROL_FLOOR` 38→51, text-only 32→45, both floors met exactly), 15 in `workflow_pins_test.sh` and 12 in `dogfood_wiring_test.sh` — each pinned to its own finding text or rc — and, in every gate, **green** controls for the legitimate shapes above, so the new checks are provably not always-red. **One fail-open was found by building a mutant rather than by reasoning, and it was in this lane's own widening:** accepting a block-scalar `run: |` invocation naively means a bare `bash <script>` line anywhere in the job satisfies the step check, including inside another step's multi-command `run: |` body where `echo skip && exit 0` a line above would mean the gate never runs — measured rc=0. The block form now counts only as a block's **sole** command, and all three gates carry that mutant. **The helper is graded too, not only the workflows it reads:** every mutation control mutates `verify.yaml` and asks the helper about it, which cannot tell a working helper from a stubbed one — with the helper now a single point of failure for all three gates, replacing `assent_pr_reach` with `return 0` would turn them all green at once. Two of the gates therefore also drive it against **from-scratch fixture workflows** whose right answer depends on nothing under `.github/workflows/**` (verified: the stub reds them by name). Revert: delete `hack/lib/pr_reach.sh` and restore the three gates' local readers — which restores the `paths:`-filtered bypass, the self-only pinning, and the misreport. |
+| D-157 | 2026-08-23 | **"Reaches pull requests" is now a SHARED, structural check (`hack/lib/pr_reach.sh`), the three PR-visible text gates CROSS-PIN each other's steps, and the fixed-string step check is replaced by an anchored `run:`-command match (GATES3).** Three residuals, each *demonstrated* by an independent reviewer on an earlier lane and each deliberately left unfixed there, all living in the same three files — `hack/lint/workflow_pins_test.sh`, `hack/audit/aud2_exitgate_test.sh`, `hack/examples/dogfood_wiring_test.sh`. **(1) The substantive one.** Two of the three answered "am I reachable on a PR?" with `grep -qE '^[[:space:]]+pull_request:'` over the workflow's `on:` block; a reviewer added `paths: ['internal/**']` under the trigger and measured **rc=0** — the trigger is present, the grep is satisfied, and the gate is disarmed for every PR that touches only `Taskfile.yml` or `.github/workflows/**`, which is exactly the class of PR these gates exist to grade. `types: [closed]` is the same defect by another route, and the grep's `[[:space:]]+` is indent-blind, so a `pull_request:` nested under `workflow_call.inputs` satisfied it too. **The third gate did not answer the question at all** — `workflow_pins_test.sh` asserted its step was present and undisarmed and never that the workflow carrying it runs on a PR; this is new coverage there, not a strengthening, and the brief that commissioned this lane assumed otherwise. **Decision on meaning:** a workflow "reaches PRs" when it has a top-level `pull_request:` trigger — a key of `on:` itself, at 2-space indent — whose sub-block carries **only keys from GitHub's five** (`types`, `branches`, `branches-ignore`, `paths`, `paths-ignore`; a sixth is **refused**, not guessed at), with **no** `paths:`/`paths-ignore:`, a `types:` list that is absent or a **superset** of GitHub's defaults (`opened`, `synchronize`, `reopened`), and no branch filter excluding `main` — **each read at whatever indent it is written at**, because the sub-block extraction is already scoped to the trigger and an indent pin bought no isolation the scoping did not already provide — and when the target job carries neither a job-level `if:` **nor a job-level `needs:`** (a dependency that skips on PRs skips its dependents, defeating all three gates at once while every other assertion stays green), and the gate's own step carries no `if:`/`continue-on-error:` **in either the mapping-key or the sequence-item position** (`      - if:` is the step's first key and is a sequence item). **Deliberately still accepted**, stated so a reviewer does not read the narrowing as wider than it is: `on: pull_request` and `on: [push, pull_request]` (the inline forms cannot carry a filter, so they are strictly safer than the block form), the quoted `"on":` key, a `types:` superset, `branches:` listing the literal `main`, `branches-ignore:` sparing `main`, block-scalar `run: |` invocations, arbitrarily long comment blocks inside a gate step, and step-level `if:` on *other* steps (`verify.yaml`'s changelog gate is legitimately PR-excluded). **Deliberately narrower than GitHub:** a `branches:` glob covering main without the literal token (`['ma*']`) reds, because a bash gate cannot honestly evaluate GitHub's glob semantics, and a flow mapping or anchor in the `on:` block is **refused** (distinct code) rather than guessed at. **(2)** Each gate pinned only its OWN step, so a PR deleting one of the other two was invisible to the gate that still ran — caught locally by `task check` and on push by `release-exitgate`, hence a gap and not a hole. Each gate now asserts all three steps; the mutation matrix is the full cross-product (3 deleted steps × the 2 observers that still run) rather than a diagonal. **(3)** `aud2_exitgate_test.sh`'s `check_pr_wiring` located its step with `grep -nF -- "$SELF"` — a search for the script *name*, which the step's own comments satisfy. Measured by the reviewer: with the `run:` line commented out it still failed, but reported **"WITH ARGUMENTS"** instead of "does not invoke", sending an operator to look for an argument that does not exist. The anchored form from `dogfood_wiring_test.sh` is ported back and shared. **Why one lane and one helper, not three fixes:** the INBOX residual explicitly asked for a single shared helper so the next gate author inherits the strong check rather than copying the weak one; fixing one of three identical checks would have been misleading. **Judgment calls.** (a) The helper is **codes-only and prints nothing** — every caller owns its wording, because roughly twenty existing `expect_red` controls pin stderr fragments. (b) The 1..6 **line cap** `workflow_pins_test.sh` used to bound step isolation is replaced by a structural invariant — exactly one `run:` key and no `uses:` key, both of which actionlint itself flags — because cross-pinning made the helper isolate the aud2 and dogfood steps, whose comment blocks are a dozen lines long, and no cap admits an honest step of theirs while rejecting a merged one. (c) The helper is held to `workflow_pins_test.sh`'s preamble rules (**bash 3.2**, portable ERE, no `git`, no `grep -q` on a pipe) rather than aud2's ≥4.3 floor: that gate runs first in CI before any toolchain, and the other two callers do not refuse bash 3.2, so a bash-4 construct here would silently weaken them on a maintainer's machine. (d) It is a **line-oriented reader with a structural bias, not a YAML parser** — it says so in its own header and fails closed on anchors, aliases and flow mappings, because an honest narrow gate beats an overreaching one. (e) No new `check:` stage and `CHECK_STAGES` untouched: all three gates were already wired. **Evidence:** 44 helper-level probes, 20 host-independent fixture self-checks carried inside two of the gates, and end-to-end mutation of a scratch copy of the REAL `verify.yaml` driven through all three real gate scripts (the layer that found (ii) and (iii); fixtures alone did not) plus, in the gates themselves, 13 new red controls in aud2 (`CONTROL_FLOOR` 38→51, text-only 32→45, both floors met exactly), 15 in `workflow_pins_test.sh` and 12 in `dogfood_wiring_test.sh` — each pinned to its own finding text or rc — and, in every gate, **green** controls for the legitimate shapes above, so the new checks are provably not always-red. **Three fail-opens were found by building mutants rather than by reasoning, and the record names them because the lane's value is the mutants, not the prose.** (i) *This lane's own widening:* accepting a block-scalar `run: |` invocation naively means a bare `bash <script>` line anywhere in the job satisfies the step check, including inside another step's multi-command `run: |` body where `echo skip && exit 0` a line above would mean the gate never runs — measured rc=0. The block form now counts only as a block's **sole** command, and all three gates carry that mutant. (ii) *The residual this lane exists to close, still open at any indent but four:* the filter greps were pinned to exactly four spaces, six-space indent is valid YAML resolving to the identical mapping, and the miss fell through to `return 0` — so on the real `verify.yaml` all three gates returned **rc=0** on a `paths:`-filtered trigger written one level deeper, the exact shape this row says they refuse. It was also the one place the helper broke its own stated rule, refusing an unevaluable *shape* while silently accepting an unrecognised *indent*. Matching is now indent-agnostic within the trigger sub-block, plus the five-key allowlist above. (iii) *Inherited, not introduced:* the step disarm grep lacked the `(-[[:space:]]+)?` alternative its `run:`/`uses:` siblings in the same function had, so a step whose FIRST key is the disarm (`      - if: …`) graded **wired, argument-free and undisarmed** — measured rc=0 on the real workflow, and it hollowed out the cross-pinning this row delivers. The byte-identical regex is in `main`'s `dogfood_wiring_test.sh`, so this is a pre-existing hole closed here, not a regression. **Why a 28-row mutant matrix missed (ii) and (iii):** it was broad in mutant SHAPES and narrow in CODE coverage — 3 of 6 `assent_pr_reach` codes and 2 of 8 `assent_step_wired` codes had a host-independent fixture, and both defects lived in the uncovered ones. Every code now has one, the filter fixtures deliberately written at a non-4-space indent. **The helper is graded too, not only the workflows it reads:** every mutation control mutates `verify.yaml` and asks the helper about it, which cannot tell a working helper from a stubbed one — with the helper now a single point of failure for all three gates, replacing `assent_pr_reach` with `return 0` would turn them all green at once. Two of the gates therefore also drive it against **from-scratch fixture workflows** whose right answer depends on nothing under `.github/workflows/**` (verified: the stub reds them by name). Revert: delete `hack/lib/pr_reach.sh` and restore the three gates' local readers — which restores the `paths:`-filtered bypass, the self-only pinning, and the misreport. |
 | D-158 | 2026-08-23 | **CI-TOOLCHAIN — `verify` was red on every PR from a golangci-lint/Go skew; the remedy is to bump `GOLANGCI_LINT_VERSION` v2.12.2 → v2.13.1 and KEEP `go-version: stable`.** Symptom: PR #85, a six-file Markdown diff with **zero Go bytes**, failed `verify` with `/opt/hostedtoolcache/go/1.27.0/x64/src/crypto/internal/randutil/randutil.go:11:2: could not import math/rand/v2 (… method must have no type parameters) (typecheck)` — the failing path is inside the **Go toolchain's own source tree**, so no author change can fix it and re-running cannot clear it. `Analyze (go)`, `Analyze (actions)` and `CodeQL` all passed on the same run: the tree compiles clean under Go 1.27, only the linter chokes. **Mechanism**: golangci-lint typechecks the standard library with the `go/types` it was **compiled with**, not the `go` on `PATH`. GitHub's `stable` rolled 1.26 → 1.27.0 between this repo's last green `main` run (2026-08-19) and 2026-08-23; the v2.12.2 release binary is built with go1.26.x and cannot read the 1.27 stdlib. **Reproduced locally, not reasoned** (Go 1.27.0 SDK on `PATH`, `GOTOOLCHAIN=local`, whole tree): v2.12.2 → **panic** in `pkg/goanalysis/runner_loadingpackage.go:335` inside `go/types.(*Checker).Files`, exit 2; official v2.13.1 asset (`built with go1.27.0`) → **0 issues**, exit 0; `golangci-lint config verify` → exit 0, so the v2 config schema in `.golangci.yml` needs no migration; v2.13.1 also → **0 issues** against local Go 1.26.6, so the bump is safe for contributors who have not moved; and `go install …@v2.13.1` under Go 1.27.0 → 0 issues, which is the **`release-exitgate`** path (that job builds the binary rather than using the action, and `if: github.event_name != 'pull_request'` / RELSE-08 means no PR ever exercises it). **Diagnosis heuristic worth keeping**: golangci-lint's `go.mod` carries the comment *"the minimum Go version must always be latest-1"*, so its `go` directive is a machine-readable "supports Go 1.N+1" signal — v2.12.2 says `go 1.25.0` (supports ≤1.26), v2.13.1 says `go 1.26.0` (supports ≤1.27), and upstream commit `42a0530` in v2.13.0 is literally "go1.27 support". **Options considered.** (A) *bump the linter* — CHOSEN: treats the root cause, is a **one-line** diff because the version is single-sourced at workflow scope (D-128), fixes BOTH exposed sites (the `golangci-lint-action` in `verify` and the `go install` in `release-exitgate`) at once, and the risk it carried — new findings from a newer linter blocking every merge, since `golangci-lint` runs inside `task lint` inside `task check` — was **measured at zero** on the whole tree under both Go versions. (B) *pin `go-version: 1.26.x`* — REJECTED as the primary: it needs two pins (`verify.yaml:56` and `:171`), leaves the class of bug live, undercuts the stated reason `stable` is there (`# govulncheck needs it`, with `setup-go` exporting `GOTOOLCHAIN=local` so a pinned toolchain can fail to `go run` a tool whose module requires a newer Go — unverified, and moot under (A)), and trades a loud recurrence for **silent indefinite drift onto an unsupported Go** in a repo whose posture is govulncheck + cosign + SLSA + Scorecard. (C) *both* — REJECTED as gold-plating: (A) alone is measured green, and a second simultaneous remedy would make a still-red PR ambiguous. **Per-file sweep of `go-version: stable`, stated rather than silently skipped:** `verify.yaml:56` and `:171` were the only exposed sites and are fixed by the env bump without touching either line; `schemas.yml:57` (runs `go test` + ajv, no linter), `vulncheck.yaml:30` (govulncheck only — `stable` is actively *desirable* there) and `codeql.yaml:45` (CodeQL, which passed on 1.27.0) carry no golangci-lint and are NOT exposed; `release.yaml` uses `go-version-file: go.mod` and is unaffected. `hack/lint/workflow_pins_test.sh` asserts `TASK_VERSION`, action SHA pins and step wiring but **not** `go-version` or `GOLANGCI_LINT_VERSION`; it passes on this change. **Revert is (B), not bare v2.12.2** — reverting the env line alone restores a known-red state: revert = `GOLANGCI_LINT_VERSION` back to `v2.12.2` **and** pin `verify.yaml:56` + `:171` to `go-version: 1.26.x`. **Residual risk, stated plainly:** when `stable` rolls to Go 1.28, v2.13.1 breaks identically. The repo finds out because `verify` reds on **every** PR including zero-Go diffs — loud and immediate, with the signature recorded in `verify.yaml`'s env comment and the fix being one env line. Nothing detects it *earlier*: dependabot's `github-actions` ecosystem updates `uses:` refs, not `env:` literals (backlog `CI-TOOLCHAIN-F01`). Accepted on purpose over (B)'s failure mode. Note also the pre-existing local/CI linter skew — `Taskfile.yml`'s `lint` task is bare `golangci-lint run ./...` against whatever binary a contributor has installed, so this pin has never governed local `task check`; deliberately not changed here (that file was owned by a concurrent lane). |
 | D-159 | 2026-08-23 | **ORPHAN — `release-verify-test` was a gate invoked by nothing (D-124 again), and it is wired into `task check` in its three OFFLINE modes, not its default `all`.** Finding: `Taskfile.yml` defined `release-verify-test` — the **only** test of `hack/release/verify-artifacts.sh` — and no caller existed anywhere: not `check:`, not `CHECK_STAGES` in `hack/audit/exitgate_test.sh`, not `.github/workflows/**`, not the push-only `release-exitgate`. That script is not incidental: **`SECURITY.md:61` publishes it as the procedure release consumers run** to check artifact checksums, the stamped `assent version` and cosign signatures, and D-153/AUD2-F01 had just proved that published verification instructions rot silently. Measured before fixing, as the lane required: the gate was **green**, so this is a wiring defect only — nothing was being papered over. **Why not the `all` default.** `verify_test.sh` with no argument adds `test_snapshot_pass`, which shells out to `task release-snapshot`: `go install github.com/goreleaser/goreleaser/v2@…` on any machine without it (**network**, in a gate that runs before every commit), a `before: hooks: go mod tidy` that **rewrites `go.mod`/`go.sum` in the middle of `task check`**, `--clean` on the developer's `dist/`, and a five-target cross-compile (10s here with warm caches and goreleaser already installed; minutes cold). A flaky or network-bound stage is worse than a missing one, so `check:` runs `negative`, `cosign-skip-when-absent` and `readme` — REQ-E9-S12-02/03/04, all offline, together well under a second. **Consequence, stated precisely: REQ-E9-S12-01 (the real snapshot→verify round trip) is not gated per-commit in `task check`; it runs in push-only CI via `hack/release/exitgate_test.sh:33-34` (the `release-exitgate` job, `if: github.event_name != 'pull_request'`) — automated but not PR-visible, i.e. the RELSE-08 blind spot.** Those two lines are literally `task release-snapshot` then `task release-verify`, which is the `Verify:` string the spec gives the requirement (`openspec/specs/p5-e9-distribution/spec.md:441-442`), so nothing here needs a new gate built — an earlier draft of this row claimed the requirement was covered by no automation at all, which was false, and acting on it would have meant a future lane duplicating `exitgate_test.sh:33-34`. What this lane declines to do is move that L1 round trip into a per-commit gate: it cannot be, for the network/`go mod tidy`/`--clean` reasons above. Narrowing the RELSE-08 exposure for this requirement is a separate question from D-159. **Pinning.** `CHECK_STAGES` goes 20 → 21 in the same commit as the `check:` line (the AUD-S18/RELSE-08 lockstep), and `STAGE_BODY_PINS` pins the body **per mode** rather than by the bare script path — a single `bash hack/release/verify_test.sh` pin would stay green if two modes were dropped *and* if the stage were reverted to the unrunnable-in-check default. Three mutation controls prove it: deleting the `check:` line reds `check_check_wiring` by stage name, gutting one of the three modes reds `check_stage_bodies` while the other two still run, and the same deletion applied to the real tree reds the real gate at rc=1. **Also fixed, minimally, because wiring made it matter:** `verify_test.sh` wrote its captured stdout/stderr to fixed `/tmp/verify-{tamper,nosig}.{out,err}` and then **grepped** them; harmless while nothing ran it, but this repo runs several lane worktrees whose `task check` invocations overlap, and a concurrent run truncating `/tmp/verify-nosig.err` at open would fail the other run's `skip.*cosign` grep spuriously. Scratch files now live in each run's own `mktemp -d` (invisible to `verify-artifacts.sh`, which globs only `*.tar.gz`/`*.zip`) and are removed by the existing `RETURN` trap. |
 | D-160 | 2026-08-23 | **UNIV-COSIGN — the cosign signer-pin gate asserted an EXISTENTIAL property where the guarantee it publishes is UNIVERSAL, so it certified nothing about a file's second `cosign verify-blob`; `hack/release/install_cosign_pin_test.sh` now grades EVERY invocation in ALL THREE published files, statically and at runtime.** Substance first, and measured before anything was written: a scratch copy of each graded file with a **second, unpinned** `cosign verify-blob` spliced IN-BODY next to its real invocation (the splice shape matters — see UC-04 below) ran the gate to **exit 0** — `hack/install.sh` rc=0, `SECURITY.md` rc=0, `hack/release/verify-artifacts.sh` rc=0, the last of these being the shape a reviewer had already demonstrated on an earlier lane. **Every individual assertion in that gate was sound.** `has_flag` grepped the whole folded extraction, so a pinned sibling satisfied it; `one_value`'s `sort -u` collapsed two agreeing values to one, so the D-153 drift comparison saw a consistent file; section 0 **printed** the extracted invocation count and asserted nothing about it; and 4b/5d's stub-log checks were positive-only greps, i.e. the same existential shape at runtime, where a second unpinned call leaves the pinned call's log line intact. The conjunction of sound existential assertions is still an existential assertion. **This is the AUD2-S05 quorum defect one layer out: not a wrong assertion, a wrong quantifier**, and it predates both AUD2-S03 and AUD2-F01. **`SECURITY.md` was worse than the other two** — it fed only the drift comparison and had **no invocation-level grading at all**, so an unpinned recipe published to adopters was invisible to the gate that exists to police the recipe. **Property chosen: "every `cosign verify-blob` invocation in every graded file carries `--certificate-oidc-issuer`, `--certificate-identity-regexp` and `--bundle`, EACH WITH SECURITY.md's published value".** The value half is not decoration: `--certificate-identity-regexp ''` carries the flag and matches every Fulcio identity ever issued, and `one_value`'s `sort -u` does not catch it either, because an empty capture is not a line and the file still reports exactly one distinct value — a presence-only universal check would be the same defect one level down, so each invocation's own extracted value is compared against the published pair (reported `WRONG-VALUE[...]`, distinct from `UNPINNED[...]`). Options considered: **(a)** the remedy recorded when the finding was filed — assert the extracted invocation count is **exactly 1** per file (**REJECTED AS FACTUALLY WRONG — do not implement it in a later lane; it would red `main` on the day it lands.** `SECURITY.md` legitimately publishes **two** — one over the archive, one over `checksums.txt`, which is what covers the SBOMs listed inside it — so that assertion reds `main` on the day it lands, and the natural repair is to weaken it again); **(b)** universal quantification over invocations **(chosen)** — strictly stronger than (a) where (a) is true, and it keeps holding when a file legitimately grows a third correctly-pinned call. **Enforcement, per D-128, is one predicate**: `pin_violations <file>` prints one line per problem and nothing when the file is clean, so callers grade its OUTPUT and the identical function is asserted empty against the tree and non-empty against a mutant with no `set -e` games; `assert_all_pinned` is the thin failing wrapper; `log_unpinned_lines` is its runtime twin over the stub-cosign argv log. **Classification is fail-CLOSED, which is the part that carries the guarantee.** The candidate extractor is deliberately left un-narrowed (every non-comment line mentioning `cosign verify-blob`, continuations folded), because anything the *denominator* drops is a hole. A candidate is an invocation when the folded text begins with `cosign verify-blob`; the ONE waved-through non-invocation shape is a markdown inline-code mention (`` `cosign verify-blob` ``, which is how `SECURITY.md`'s capability table names it); **on a line carrying NO backticked mention, anything else — `foo && cosign verify-blob …`, a here-doc line, an un-backticked prose sentence — is reported UNCLASSIFIABLE rather than skipped**, because "this gate cannot tell whether that call is pinned" must never read as "that call is fine". **That scoping is not cosmetic, and the unscoped version of this sentence was FALSE (R3-01, caught by review on the round that added the honest banner).** The exemption tests whether the substring `` `cosign verify-blob` `` appears **anywhere on the line**, not whether the line is prose, and it is tested BEFORE the command-position and multi-token checks. So a line carrying a backticked mention AND one or more LIVE calls is exempted, neither graded nor refused: measured by splicing ``See `cosign verify-blob`: cosign verify-blob --bundle A.json a && cosign verify-blob --bundle EVIL.json evil`` into `SECURITY.md` — `occurrence_count` = 2 by the definition the banner itself states, `pin_violations` EMPTY, **whole gate rc=0**, while the banner reported that line among those "exempted as backticked prose". The **static** defect is not markdown-specific — splicing a live unpinned call with a trailing backticked mention into `hack/install.sh` gives candidates=2, invocations=1, `pin_violations` EMPTY — but the **whole-gate green is** markdown-specific, and the distinction is stated because a looser sentence here would itself be falsifiable: in that shell script the run reds at §4b for an unrelated RUNTIME reason (the spliced call executes and its bundle is absent), whereas `SECURITY.md` is a document with no runtime twin, which is why rc=0 survives there. Measured both ways rather than inferred from either. **Narrowing the exemption needs quote- and markdown-aware parsing — the machinery that produced UC-01/02/03 — so it is deliberately NOT patched here.** It is instead disclosed as residual (1) in the PASS banner, ahead of the variable/`eval`/fragment spellings, because it is the residual that is actually REACHABLE in these three files while those are not present in any of them. The banner also no longer labels an exempted line "prose": the branch it took is a fact, "prose" was an inference, and R3-01 is the case where that inference is wrong. **This is UC-07 doing its job on its own author:** the claim was falsifiable, it was checked, and the gate is now incomplete-and-honest rather than complete-and-wrong. Accepted cost, stated rather than discovered later: a *correctly pinned* invocation written off command position also reds. That is the intended direction of error for a security gate over three files carrying four invocations in one canonical style, and the message names the fix. **Anti-vacuity, because a lane whose entire deliverable is "make a gate stricter" is maximally exposed** (this repo's #1 review finding is an assertion that cannot fail — D-124, AUD-S18): section 2b runs **eight** mutants against **each** of the three files and 2c runs a ninth, and they were chosen for **branch** coverage of the new predicate rather than for variety of shape — (a) a second **unpinned** invocation must red, name the file, quote the offending command, and produce **exactly two** violations so the pinned siblings are provably not flagged; (b) a second **correctly pinned** invocation must stay green **and** must raise the extractor's invocation count by one, without which (b)'s green could mean "the extractor never saw it"; (c) an occurrence off command position, appended **fully pinned on purpose** so the only thing that can redden it is the classifier itself; (d) every invocation deleted → `NO-CANDIDATES`; (e) the continuation fold broken → `FOLD-BROKEN`, asserted **not** to also report `UNPINNED`, because conflating "the extractor truncated this" with "the pin is missing" sends the next maintainer to the wrong file; (f) every invocation displaced off command position → `NO-INVOCATIONS`; (g) a second invocation carrying both flags with an **empty** identity regexp → `WRONG-VALUE`, the hostile shape a presence-only check waves through; (h) a second invocation carrying both flags with a **foreign OIDC issuer** → `WRONG-VALUE` on the issuer half; and 2c strips the backticks from `SECURITY.md`'s prose mention and requires the same row to fail closed, proving the exemption keys on the backticks and is not a blanket bypass. The runtime twin has its own vacuity control (an unpinned line appended to a copy of the stub log must be seen). **One real defect was caught by this section during the lane and is recorded because it is a trap for the next author**: `log_unpinned_lines` was first written with `awk -v id="identity_re=${sec_identity}"`, and **awk processes escape sequences in a `-v` assignment**, so the pin's `github\.com` arrived as `github.com` and matched nothing; the values now reach awk through `ENVIRON`. **Stated limit, same posture as D-154's**: the denominator is the literal string `cosign verify-blob`, so an invocation spelled through a variable (`"$COSIGN" verify-blob …`), built by `eval`, or assembled from fragments is invisible to this gate. Widening the trigger to bare `verify-blob` was considered and **rejected** — it buys one hypothetical no file uses, and turns any future `SECURITY.md` sentence saying "verify-blob" outside backticks into a red gate, whose repair would be to loosen the classifier. **Nothing outside the gate changed**: `hack/install.sh`, `SECURITY.md` and `hack/release/verify-artifacts.sh` are byte-unchanged, and all four of their invocations were already pinned — this row closes a hole in the *checker*, not in the checked. The stage `release-install-cosign-pin-test` was already wired into `task check` and pinned in `hack/audit/exitgate_test.sh`'s `CHECK_STAGES`, so no wiring changed either. **SECOND ROUND — the first version of this fix REPRODUCED the very defect it closes, one level down, and independent review caught it before merge.** `has_flag` grepped the whole FILE; the replacement grepped the whole LINE. Both are existential; only the scope shrank. **UC-01**: one folded line was graded as at most ONE invocation, so `cosign verify-blob <both pins> --bundle a.json a && cosign verify-blob --bundle EVIL.json evil` began with `cosign verify-blob` (not UNCLASSIFIABLE), carried `--bundle` (not FOLD-BROKEN), carried both flag strings (not UNPINNED) and yielded the published values (not WRONG-VALUE) — **green**, in same-line, `;`-separated and backslash-folded forms, on all three graded files. Worse, the **full gate exited 0** for `SECURITY.md`: the two shell scripts were incidentally caught by the runtime twin (`log_unpinned_lines` at §5d), but **SECURITY.md is a document and has no runtime twin**, so the hole was unmitigated precisely on the file this row calls "the copy-paste recipe adopters run by hand" — D-153's exact incident class — while the gate printed "EVERY cosign verify-blob invocation ... is pinned", false as printed. The stated-limit paragraph did not cover it: it enumerated `$COSIGN`, `eval` and fragments, not `&&` chaining, and **leading** `&&` was explicitly handled (mutant (c) → UNCLASSIFIABLE), so the operator had been considered and only one side handled. Closed by grading per **OCCURRENCE** (`occurrence_count` + a new `MULTI-OCCURRENCE` violation that fails closed on any line carrying two calls) rather than per line; counting inside an already-triggered line uses the shorter `verify-blob`, so a second call spelled `cosign  verify-blob` or `"$COSIGN" verify-blob` and chained onto a pinned one is caught too, which the literal file-level trigger would miss. **UC-02**: `extract_issuer`/`extract_identity` anchor on a greedy `.*`, so the LAST value on a line wins — a hostile `--certificate-identity-regexp ''` placed FIRST was masked by a correct value placed second, **the extraction direction favoured the attacker**. Closed by `flag_value_tokens`, which returns EVERY value of every flag on the occurrence; each must equal the published one, so a repeated flag with an empty value first now reds. **UC-03 (P2, the erosion path)**: a CORRECTLY pinned call written with **double quotes** was refused as `WRONG-VALUE ... identity=<empty/unparsable> ... (an empty regexp matches every Fulcio identity)` — a true refusal with a **false reason**, and the repair a maintainer reaches for on that message is widening the extractor. Both quote styles are now accepted (double quotes are correct shell for this value: it contains no `$` and no backtick), and a **bare** value is diagnosed as `UNQUOTED-VALUE`, a QUOTING defect, never as a wrong or empty one — a gate that misdiagnoses erodes faster than one that refuses. **UC-04**: this row's "rc=0, rc=0, rc=0" reproduction figure is **splice-shape-sensitive** and is stated as measured: it holds for a second unpinned call spliced **in-body** next to the real one. An EOF-appended mutant reds the two shell scripts for an unrelated runtime reason, so the figure should not be read as holding for any second unpinned call. The same sensitivity is why the UC-03 double-quoted mutant reds the two scripts through the full gate (the spliced call actually RUNS and its fixture bundle is absent) while `SECURITY.md`, having no runtime, is the clean end-to-end proof at rc=0. The classifier's fail-closed posture on off-command-position occurrences was independently adjudicated KEEP, since §2c proves the prose exemption keys on the backticks and cannot be widened silently. **The lesson, recorded because it is the whole point of the lane:** a fix for an existential-where-universal defect is itself maximally exposed to the same defect at the next scope down — file, then line, then occurrence — and the only thing that caught it was a reviewer building the chained-call mutant that neither the 20-row external matrix nor the 25 in-gate mutants contained. **THIRD ROUND (UC-05..UC-09), and the reason this row now reads the way it does.** **UC-05**: `occurrence_count` compared whitespace-delimited fields to `verify-blob`, found one, and concluded **singularity** — when all it had established is that it did not find a second. `cosign "verify-blob"`, `cosign 'verify-blob'` and `cosign verify-blob""` are the same command to the shell, and each hid a chained unpinned call from the count. Measured against the round-2 gate on **all three** files at whole-gate level: **rc=0, rc=0, rc=0** — worse than first reported, because `A && B` short-circuits and `set -e` does **not** fire on a non-final member of an AND-list, so even the two shell scripts' runtime twin missed it. Closed by stripping shell quotes before the field compare, which is **a spelling patch, not a terminator, and is labelled as one in the code**. A structural terminator was sought and **ruled out with evidence**: refusing any graded line carrying a command separator would red the REAL files, since `hack/install.sh` and `hack/release/verify-artifacts.sh` both legitimately end their genuine invocation with an or-else `die` tail. **No structural terminator exists for this gate**, so completeness is not available and must not be claimed. **UC-07 is therefore the durable fix, and it is a change of posture rather than of logic.** The `PASS:` banner was printed unconditionally and asserted "EVERY cosign verify-blob OCCURRENCE ... is pinned" plus "a second unpinned call reddens whether it sits on its own line or is chained onto a pinned one" — a **universal claim bound to no assertion**. Under UC-05 that banner did not merely overstate: on a green run it printed something **false**, which is strictly worse than printing nothing, and it is this repo's #1 defect class (an assertion that cannot fail) wearing a different hat. The banner now reports **OBSERVED** counts per file (occurrences found, classified-and-graded, prose-exempt, refused), lists **ASSERTED** properties each of which is shown to fail on a mutant, and states the **NOT ASSERTED** residual in the same breath: this gate finds calls by a literal string and counts quote-stripped words, so a call spelled through a variable, `eval`, or fragments is not seen and not graded, and the counts are what was classified — **not a proof that nothing else exists**. When a fifth spelling turns up, the gate is then **incomplete rather than wrong**, and incomplete is recoverable. **UC-06**: a TRAILING comment mentioning `verify-blob` fired `MULTI-OCCURRENCE: … has 2 verify-blob calls chained on ONE line` — fail-closed but **false as printed**, since `cosign_candidates` only drops lines whose FIRST non-space character is `#`. That is the UC-03 misdiagnosis shape recurring **inside the UC-01 fix**. The message now says TOKENS, names both possible causes, and names the correct repair; excluding trailing comments was rejected as it needs quote-aware parsing, which is the machinery that produced UC-01/02/03. **UC-08**: `shellcheck` SC1087 ×2 (error severity) on `flag_value_tokens` — `"$flag[[:space:]]…"` parses as an array subscript; `${flag}` silences it. Cosmetic: no shellcheck gate exists in this repo. **UC-09**: two stage-count figures reported during this lane ("25", then "28") were **both wrong** and neither came from a committed file — they counted `task: [` lines in a run LOG, which includes nested task invocations. Measured: the Taskfile `check:` block has **21** `- task:` entries and `CHECK_STAGES` has **21** stage names; they agree, and both files are byte-identical to `origin/main`. There is no stage-count mismatch and this lane could not have caused one. **THE PATTERN, recorded because it is the lane's most transferable output:** four P1s, three of them the same scope error at successively finer scopes — file (`has_flag`), line (round 1), then occurrence-spelling (round 2) — each found by review and none by the author's own mutant matrix, because each matrix was built from the shape the previous round had just learned. The general lesson is not "add another spelling": it is that **when a gate's denominator cannot be made provably complete, the gate must report what it classified instead of asserting what exists.** That is now enforced where it is hardest to ignore, in the banner the gate prints on every green run. Revert: restore `has_flag`, drop the per-occurrence grading and the per-invocation value comparison, and restore the two positive-only stub-log greps — which returns the gate to certifying that *some* cosign call in each file is pinned, a property that is compatible with an unpinned one sitting beside it. |
diff --git a/hack/audit/aud2_exitgate_test.sh b/hack/audit/aud2_exitgate_test.sh
index 2baf6cad..42341b6d 100755
--- a/hack/audit/aud2_exitgate_test.sh
+++ b/hack/audit/aud2_exitgate_test.sh
@@ -1321,7 +1321,7 @@ check_pr_wiring() { # <verify.yaml>
       return 1
       ;;
     10)
-      echo "  REQ-AUD2-S05-05: verify.yaml's 'on:' block uses a shape hack/lib/pr_reach.sh refuses to evaluate (a flow mapping, an anchor or an alias). A paths:/types: filter hidden in there would disarm this gate silently, so the reader fails closed instead of guessing" >&2
+      echo "  REQ-AUD2-S05-05: verify.yaml's pull_request trigger is something hack/lib/pr_reach.sh refuses to evaluate: either a shape it cannot read (a flow mapping, an anchor or an alias) or a filter key outside GitHub's five (types, branches, branches-ignore, paths, paths-ignore). A narrowing hidden in either would disarm this gate silently, so the reader fails closed instead of guessing" >&2
       return 1
       ;;
     11)
@@ -2253,6 +2253,94 @@ while IFS= read -r sibling; do
     "the sibling PR-visible gate $sibling is NOT wired" "$m"
 done < <(assent_pr_gate_others "$SELF")
 
+# ---- G3-01/G3-02: two defects an independent review found by mutating the
+# REAL verify.yaml end-to-end, after a 28-row fixture matrix missed both.
+# Controlled HERE, on the real workflow, for the same reason they were found
+# there: a fixture cannot tell you what your own gate does to your own file.
+
+# G3-01. The filter greps were pinned to EXACTLY four spaces. Six-space indent
+# is valid YAML resolving to the identical mapping, the grep missed it, and
+# control fell through to `return 0` — this gate returned rc=0 on a
+# paths:-filtered trigger, the exact shape REQ-AUD2-S05-05 says it refuses.
+m="$(pr_filter_mutant prpaths6sp "      paths: [internal/**]")"
+expect_red check_pr_wiring "the pull_request paths: filter is written at SIX spaces instead of four — valid YAML, identical mapping, and the 4-space grep fell through to 0 (G3-01)" \
+  "carries a 'paths:' or 'paths-ignore:' filter" "$m"
+
+m="$(pr_filter_mutant prtypes6sp "      types: [closed]")"
+expect_red check_pr_wiring "the pull_request types: filter is written at SIX spaces (G3-01)" \
+  "omits one of GitHub's defaults" "$m"
+
+# …and the counterpart, so the fix is indent-AGNOSTIC, not indent-hostile.
+m="$(pr_filter_mutant prlegit6sp "      types: [opened, synchronize, reopened, ready_for_review]")"
+expect_green check_pr_wiring "a legitimate types: superset written at SIX spaces is still accepted (G3-01 widened the match; it did not start refusing indents)" "$m"
+
+# An unknown key under pull_request: is refused rather than accepted. GitHub
+# defines exactly five filter keys; a sixth is a narrowing this gate has never
+# evaluated, or a typo. Guessing is the wrong answer to both.
+m="$(pr_filter_mutant prunknownkey "    only-when: [tuesday]")"
+expect_red check_pr_wiring "an UNKNOWN filter key appeared under pull_request: — refused, not accepted (G3-01)" \
+  "refuses to evaluate" "$m"
+
+# G3-02. A step whose FIRST key is the disarm is a sequence ITEM, so the key
+# carries the `- ` marker and `^[[:space:]]*if:` never matched it. Measured on
+# this very workflow: rc=0, "wired, argument-free and undisarmed", for a step
+# that does not run on pull requests at all. The regex was inherited verbatim
+# from the local copy this gate's check replaced, so it is a pre-existing hole
+# closed here rather than a regression — but until it was closed, the
+# cross-pinning below reported WIRED for a disarmed step.
+disarm_first_mutant() { # <name> <key: value> -> prints the mutant path
+  local name="$1" kv="$2"
+  local out="$WORK/verify.${name}.yaml"
+  awk -v self="run: bash $SELF" -v kv="$kv" '
+    { lines[NR] = $0; if ($0 ~ /^      - /) starts[NR] = 1; if (index($0, self) > 0 && $0 !~ /^[[:space:]]*#/) target = NR }
+    END {
+      s = 0
+      for (i = target; i >= 1; i--) if (i in starts) { s = i; break }
+      for (i = 1; i <= NR; i++) {
+        if (i == s) {
+          rest = substr(lines[i], 9)
+          print "      - " kv
+          print "        " rest
+        } else print lines[i]
+      }
+    }
+  ' "$WORKFLOW" >"$out"
+  assert_changed "$WORKFLOW" "$out"
+  grep -qF -- "run: bash $SELF" "$out" ||
+    fail "mutation harness: the ${name} mutant lost the ${SELF} invocation — it must stay PRESENT, or the control grades absence instead of disarmament"
+  grep -qE "^      - ${kv%%:*}:" "$out" ||
+    fail "mutation harness: the ${name} mutant does not carry '${kv%%:*}:' as a step's FIRST key, which is the whole shape it exists to exercise"
+  printf '%s' "$out"
+}
+
+m="$(disarm_first_mutant iffirst "if: \${{ github.event_name != 'pull_request' }}")"
+expect_red check_pr_wiring "the gate's step was disarmed with 'if:' as its FIRST key — the sequence-item form the disarm grep could not see (G3-02)" \
+  "DISARMED" "$m"
+
+m="$(disarm_first_mutant coefirst "continue-on-error: true")"
+expect_red check_pr_wiring "the gate's step was disarmed with 'continue-on-error:' as its FIRST key (G3-02)" \
+  "DISARMED" "$m"
+
+# The same shape applied to a SIBLING gate's step must red the cross-pin, or
+# residual 2 delivers a check that says WIRED for a step that will not run.
+m="$WORK/verify.siblingdisarmed.yaml"
+sibling_first="$(assent_pr_gate_others "$SELF" | head -1)"
+awk -v self="run: bash $sibling_first" '
+  { lines[NR] = $0; if ($0 ~ /^      - /) starts[NR] = 1; if (index($0, self) > 0 && $0 !~ /^[[:space:]]*#/) target = NR }
+  END {
+    s = 0
+    for (i = target; i >= 1; i--) if (i in starts) { s = i; break }
+    for (i = 1; i <= NR; i++) {
+      if (i == s) { print "      - continue-on-error: true"; print "        " substr(lines[i], 9) } else print lines[i]
+    }
+  }
+' "$WORKFLOW" >"$m"
+assert_changed "$WORKFLOW" "$m"
+grep -qF -- "run: bash $sibling_first" "$m" ||
+  fail "mutation harness: the sibling-disarm mutant lost ${sibling_first}'s invocation"
+expect_red check_cross_pins "the SIBLING gate ${sibling_first} was disarmed with 'continue-on-error:' as its step's first key — present, and it will not run on the PR (G3-02 x residual 2)" \
+  "is NOT wired" "$m"
+
 # ---- the other polarity: D-157 must not have made this a gate that reds on
 # any workflow structure at all. Without these, the eleven red controls above
 # are equally satisfied by a check that always fails. Each of these is a shape
@@ -2308,16 +2396,19 @@ expect_green check_pr_wiring "a block-scalar 'run: |' invocation of this gate is
 # Mode-aware floor: --text-only legitimately skips the four behavioural
 # controls, and a single number would either pass a truncated full run or red
 # every text-only run. Both floors are pinned so neither mode can quietly shrink.
-# D-157 raised both floors by 13: eleven new red controls over check_pr_wiring
+# D-157 raised both floors by 19: eleven new red controls over check_pr_wiring
 # (the residual-3 comment-out, six pull_request-filter bypasses, the nested
-# input name, the job-level needs:, the job rename, the block-scalar bleed)
-# plus one over the new check_cross_pins per sibling gate. All are pure text,
+# input name, the job-level needs:, the job rename, the block-scalar bleed),
+# one over the new check_cross_pins per sibling gate, and six more from the
+# independent review's two P1s — the 6-space filter indents, the unknown filter
+# key, and the disarm-as-a-step's-FIRST-key shape (G3-01/G3-02), each of which
+# returned rc=0 on the real workflow before its fix. All are pure text,
 # so they run in BOTH
 # modes and both floors move together. Not bumping would not have reddened —
 # the floor is `>=` — which is exactly why it has to be bumped: an unbumped
 # floor stops pinning the sections it was raised for.
-CONTROL_FLOOR=51
-((TEXT_ONLY == 0)) || CONTROL_FLOOR=45
+CONTROL_FLOOR=57
+((TEXT_ONLY == 0)) || CONTROL_FLOOR=51
 ((MUTATIONS_PROVED >= CONTROL_FLOOR)) ||
   fail "only ${MUTATIONS_PROVED} mutation controls ran in $([[ $TEXT_ONLY == 1 ]] && echo --text-only || echo full) mode, fewer than the pinned floor of ${CONTROL_FLOOR} — a section was skipped, so REQ-AUD2-S05-02's evidence is incomplete"
 
diff --git a/hack/examples/dogfood_wiring_test.sh b/hack/examples/dogfood_wiring_test.sh
index 551cee8e..5eb0b0a0 100755
--- a/hack/examples/dogfood_wiring_test.sh
+++ b/hack/examples/dogfood_wiring_test.sh
@@ -470,6 +470,129 @@ FIX
 helper_wired_is 0 "$m" "$SELF_REL" "a minimal wired step is accepted"
 helper_wired_is 5 "$m" "hack/lint/workflow_pins_test.sh" "a script the fixture does not run is reported absent"
 
+# G3-01/G3-02 — the codes the original fixture set did NOT cover, which is why
+# both P1s survived a 28-row mutant matrix: it was broad in mutant SHAPES and
+# narrow in CODE coverage. Every filter code and the disarm code now have a
+# host-independent fixture, and the filter ones are written at a NON-4-space
+# indent on purpose — the bypass was a grep pinned to exactly four spaces, and
+# 6-space is valid YAML resolving to the identical mapping.
+m="$(helper_fixture reach-paths-6sp <<'FIX'
+name: f
+on:
+  pull_request:
+      paths: [internal/**]
+jobs: {}
+FIX
+)"
+helper_reach_is 11 "$m" "paths: at SIX spaces is still a paths: filter (G3-01 — the 4-space grep fell through to 0 here)"
+
+m="$(helper_fixture reach-types-6sp <<'FIX'
+name: f
+on:
+  pull_request:
+      types: [closed]
+jobs: {}
+FIX
+)"
+helper_reach_is 12 "$m" "types: [closed] at SIX spaces still omits the defaults (G3-01)"
+
+m="$(helper_fixture reach-branches-6sp <<'FIX'
+name: f
+on:
+  pull_request:
+      branches: [release]
+jobs: {}
+FIX
+)"
+helper_reach_is 13 "$m" "branches: at SIX spaces still excludes main (G3-01)"
+
+m="$(helper_fixture reach-bi-6sp <<'FIX'
+name: f
+on:
+  pull_request:
+      branches-ignore: [main]
+jobs: {}
+FIX
+)"
+helper_reach_is 13 "$m" "branches-ignore: [main] at SIX spaces still excludes main (G3-01)"
+
+m="$(helper_fixture reach-bi-quoted-hash <<'FIX'
+name: f
+on:
+  pull_request:
+    branches-ignore: ['x #y', 'main']
+jobs: {}
+FIX
+)"
+helper_reach_is 13 "$m" "a quoted ' #' before 'main' in branches-ignore does not hide it (G3-04 — comment stripping is fail-OPEN for a must-NOT-contain test, so it is off for this key)"
+
+# The property that keeps G3-01's indent-agnostic widening honest, MEASURED
+# rather than reasoned: a key's value region must stop at a SAME-INDENT sibling
+# key. If it swallowed the sibling, `branches: [release]` followed by
+# `branches-ignore: [main]` would merge into one token set, `main` would appear
+# among the `branches:` tokens, and a main-excluding filter would look fine.
+m="$(helper_fixture reach-sibling-scope <<'FIX'
+name: f
+on:
+  pull_request:
+    branches: [release]
+    branches-ignore: [main]
+jobs: {}
+FIX
+)"
+helper_reach_is 13 "$m" "a key's value region stops at a SAME-INDENT sibling — 'main' in branches-ignore does not leak into the branches: token set (the bound G3-01's widening rests on)"
+
+m="$(helper_fixture reach-legit-6sp <<'FIX'
+name: f
+on:
+  pull_request:
+      types: [opened, synchronize, reopened, ready_for_review]
+      branches: [main]
+jobs: {}
+FIX
+)"
+helper_reach_is 0 "$m" "the legitimate shapes are still accepted at SIX spaces — G3-01's fix widened the match, it did not make the check indent-hostile"
+
+m="$(helper_fixture reach-unknown-key <<'FIX'
+name: f
+on:
+  pull_request:
+    only-when: [tuesday]
+jobs: {}
+FIX
+)"
+helper_reach_is 10 "$m" "an UNKNOWN key under pull_request: is REFUSED, not accepted — the header's own rule, now honoured for a key it cannot evaluate as well as for an unparseable shape"
+
+m="$(helper_fixture wired-if-first <<'FIX'
+name: f
+on:
+  pull_request:
+jobs:
+  verify:
+    runs-on: ubuntu-latest
+    steps:
+      - if: ${{ github.event_name != 'pull_request' }}
+        name: gate
+        run: bash hack/examples/dogfood_wiring_test.sh
+FIX
+)"
+helper_wired_is 8 "$m" "$SELF_REL" "a step whose FIRST key is 'if:' is DISARMED (G3-02 — the sequence-item form '      - if:' was never matched, and this graded WIRED)"
+
+m="$(helper_fixture wired-coe-first <<'FIX'
+name: f
+on:
+  pull_request:
+jobs:
+  verify:
+    runs-on: ubuntu-latest
+    steps:
+      - continue-on-error: true
+        name: gate
+        run: bash hack/examples/dogfood_wiring_test.sh
+FIX
+)"
+helper_wired_is 8 "$m" "$SELF_REL" "a step whose FIRST key is 'continue-on-error:' is DISARMED (G3-02)"
+
 m="$(helper_fixture wired-comment <<'FIX'
 name: f
 on:
@@ -498,7 +621,7 @@ case "$rc" in
   7) fail "the step invokes $SELF_REL WITH ARGUMENTS — an argument-carrying invocation is how a wired-looking step is hollowed out" ;;
   8) fail "the step is present but DISARMED — an 'if:' or 'continue-on-error:' means a red gate does not fail the PR" ;;
   9) fail "the 'verify' job carries a JOB-LEVEL needs: — a dependency that skips on pull requests skips this job with it, so the gate is push-only by proxy while the step still looks wired (RELSE-08 through the back door)" ;;
-  10) fail "verify.yaml's 'on:' block uses a shape hack/lib/pr_reach.sh cannot evaluate (a flow mapping, an anchor or an alias) — it refuses rather than guess, because a hidden paths:/types: filter there would disarm this gate silently" ;;
+  10) fail "verify.yaml's pull_request trigger is something hack/lib/pr_reach.sh REFUSES to grade: either a shape it cannot read (a flow mapping, an anchor, an alias) or a filter key outside GitHub's five (types, branches, branches-ignore, paths, paths-ignore). It refuses rather than guess, because a narrowing hidden in either would disarm this gate silently" ;;
   11) fail "verify.yaml's pull_request trigger carries a 'paths:' or 'paths-ignore:' filter — the trigger is present and the gate still loses every PR that does not touch the listed paths, which includes PRs to Taskfile.yml and .github/workflows/** (the two files this gate reads)" ;;
   12) fail "verify.yaml's pull_request trigger carries a 'types:' filter that omits one of GitHub's defaults (opened, synchronize, reopened) — e.g. 'types: [closed]' satisfies a presence grep while the gate never runs on an open PR" ;;
   13) fail "verify.yaml's pull_request trigger carries a branch filter that excludes 'main' — PRs onto the branch this gate protects would not run it" ;;
diff --git a/hack/lib/pr_reach.sh b/hack/lib/pr_reach.sh
index d8ec464f..d02b96d3 100644
--- a/hack/lib/pr_reach.sh
+++ b/hack/lib/pr_reach.sh
@@ -95,10 +95,14 @@ _assent_ere_escape() {
 # That is YAML's rule for a PLAIN scalar. It is NOT the rule inside a quoted or
 # block scalar (hack/lint/workflow_pins_test.sh's N6 note), which is why it is
 # applied ONLY to `on:`/`types:`/`branches:` values, where a quoted ` #` would
-# be absurd. Its effect on the membership tests is asymmetric and both
-# directions are safe: for `types:`/`branches:` (must CONTAIN a token) stripping
-# removes a way to satisfy the check with prose; for `branches-ignore:` (must
-# NOT contain `main`) a leftover comment can only cause a false RED.
+# be absurd. Its effect on a membership test is ASYMMETRIC and only ONE
+# direction is safe (G3-04 — an earlier version of this comment claimed both
+# were, confidently and wrongly): for a "must CONTAIN token X" test
+# (`types:`, `branches:`) stripping can only remove a way to satisfy the check
+# with prose, which is fail-closed. For a "must NOT contain `main`" test
+# (`branches-ignore:`) stripping removes tokens from the very thing being
+# searched, so a quoted ` #` before `main` HIDES it — fail-OPEN. That call site
+# therefore passes strip=0.
 _assent_strip_comment() {
   sed -e 's/[[:space:]]#.*$//' -e 's/^#.*$//'
 }
@@ -225,17 +229,49 @@ assent_pr_reach() {
     return 0
   fi
 
+  # G3-01. These greps used to be pinned to EXACTLY four spaces
+  # (`^    (paths|paths-ignore):`). Six-space indent is valid YAML resolving to
+  # the identical mapping, the grep missed it, and control fell through to
+  # `return 0` — so a `paths:`-at-6-spaces mutant made all three gates green on
+  # the exact shape D-157 says they refuse. That was the one place this file
+  # broke the rule its own header states: it refuses (rc=10) an anchor, an
+  # alias and a flow mapping, and it silently ACCEPTED an unrecognised indent.
+  #
+  # Matching is now indent-agnostic, which is safe precisely because `prblk`
+  # above is already scoped to the `pull_request:` sub-block and exits at the
+  # next 2-space key — a sibling trigger's `paths:` cannot bleed in. The
+  # 4-space pin bought no isolation the scoping did not already provide.
+  #
+  # And the sub-block's own keys are ALLOWLISTED first, so this now fails
+  # closed on a key it does not know rather than on an indent it does not know.
+  # GitHub defines exactly five filter keys for `pull_request`; a sixth is
+  # either a new narrowing this gate has never evaluated or a typo actionlint
+  # flags. Guessing is the wrong answer to both.
+  local prkeys="$work/pr_reach.pr_keys"
+  awk '
+    { if ($0 ~ /^[[:space:]]*$/ || $0 ~ /^[[:space:]]*#/) next
+      match($0, /^[ ]*/)
+      if (min == 0 || RLENGTH < min) min = RLENGTH
+      ind[NR] = RLENGTH; line[NR] = $0 }
+    END { for (i = 1; i <= NR; i++) if (i in ind && ind[i] == min) print line[i] }
+  ' "$prblk" >"$prkeys"
+  local unknown="$work/pr_reach.pr_unknown"
+  grep -vE '^[[:space:]]*(types|branches|branches-ignore|paths|paths-ignore):' "$prkeys" >"$unknown" || true
+  if [[ -s "$unknown" ]]; then
+    return 10
+  fi
+
   local pathhits="$work/pr_reach.paths"
-  grep -nE '^    (paths|paths-ignore):' "$prblk" >"$pathhits" || true
+  grep -nE '^[[:space:]]+(paths|paths-ignore):' "$prblk" >"$pathhits" || true
   if [[ -s "$pathhits" ]]; then
     return 11
   fi
 
   local typehits="$work/pr_reach.types"
-  grep -nE '^    types:' "$prblk" >"$typehits" || true
+  grep -nE '^[[:space:]]+types:' "$prblk" >"$typehits" || true
   if [[ -s "$typehits" ]]; then
     local toks="$work/pr_reach.types.tok" t
-    _assent_key_tokens "$prblk" types >"$toks"
+    _assent_key_tokens "$prblk" types 1 >"$toks"
     for t in opened synchronize reopened; do
       if ! grep -qx "$t" "$toks"; then
         return 12
@@ -244,20 +280,29 @@ assent_pr_reach() {
   fi
 
   local brhits="$work/pr_reach.branches"
-  grep -nE '^    branches:' "$prblk" >"$brhits" || true
+  grep -nE '^[[:space:]]+branches:' "$prblk" >"$brhits" || true
   if [[ -s "$brhits" ]]; then
     local btoks="$work/pr_reach.branches.tok"
-    _assent_key_tokens "$prblk" branches >"$btoks"
+    _assent_key_tokens "$prblk" branches 1 >"$btoks"
     if ! grep -qx 'main' "$btoks"; then
       return 13
     fi
   fi
 
   local bihits="$work/pr_reach.branches_ignore"
-  grep -nE '^    branches-ignore:' "$prblk" >"$bihits" || true
+  grep -nE '^[[:space:]]+branches-ignore:' "$prblk" >"$bihits" || true
   if [[ -s "$bihits" ]]; then
     local bitoks="$work/pr_reach.branches_ignore.tok"
-    _assent_key_tokens "$prblk" branches-ignore >"$bitoks"
+    # G3-04: comment stripping is DISABLED for this key, and the reason is the
+    # one the old comment got backwards. Every other membership test asks "does
+    # the list CONTAIN token X", and stripping can only remove a way to satisfy
+    # that with prose. This test asks "does the list NOT contain `main`", so
+    # stripping removes tokens from the very thing being searched: with the
+    # tail dropped, `branches-ignore: ['x #y', 'main']` lost `main` and
+    # returned 0 — fail-OPEN, not the "false RED" the comment claimed.
+    # Unstripped, a comment that merely mentions main reds, which is the
+    # harmless direction.
+    _assent_key_tokens "$prblk" branches-ignore 0 >"$bitoks"
     if grep -qx 'main' "$bitoks"; then
       return 13
     fi
@@ -266,20 +311,37 @@ assent_pr_reach() {
   return 0
 }
 
-# _assent_key_tokens <pull_request-block> <key> — every token of a 4-space
-# `key:` whose value is an inline flow sequence, a block sequence, or a plain
-# scalar. One token per line, quotes and punctuation removed.
+# _assent_key_tokens <pull_request-block> <key> <strip-comments 0|1> — every
+# token of `key:` at ANY indent (G3-01), whose value is an inline flow
+# sequence, a block sequence, or a plain scalar. The value region is bounded by
+# INDENTATION — lines strictly more indented than the key line — rather than by
+# a fixed column, so a 6-space sub-block reads the same as a 4-space one. One
+# token per line, quotes and punctuation removed.
+#
+# <strip-comments> is per-key on purpose; see the `branches-ignore` call site.
+# Stripping is the fail-CLOSED direction only for the "must CONTAIN" tests.
 _assent_key_tokens() {
-  local blk="$1" key="$2"
+  local blk="$1" key="$2" strip="$3"
+  local raw="$blk.$key.raw"
   awk -v key="$key" '
-    BEGIN { re = "^    " key ":" }
-    $0 ~ re { ink = 1; v = $0; sub(re, "", v); print v; next }
-    ink && /^    [^[:space:]#]/ { ink = 0 }
-    ink { print }
-  ' "$blk" \
-    | _assent_strip_comment \
-    | tr -c 'A-Za-z0-9_' '\n' \
-    | grep -v '^$' || true
+    BEGIN { re = "^[[:space:]]+" key ":" }
+    !ink && $0 ~ re {
+      ink = 1
+      match($0, /^[ ]*/); ind = RLENGTH
+      v = $0; sub(re, "", v); print v; next
+    }
+    ink {
+      if ($0 ~ /^[[:space:]]*$/) next
+      match($0, /^[ ]*/)
+      if (RLENGTH <= ind) { ink = 0; next }
+      print
+    }
+  ' "$blk" >"$raw"
+  if [[ "$strip" == "1" ]]; then
+    _assent_strip_comment <"$raw" | tr -c 'A-Za-z0-9_' '\n' | grep -v '^$' || true
+  else
+    tr -c 'A-Za-z0-9_' '\n' <"$raw" | grep -v '^$' || true
+  fi
 }
 
 # ---------------------------------------------------------------------------
@@ -471,8 +533,16 @@ assent_step_wired() {
     return 7
   fi
 
+  # G3-02: the `(-[[:space:]]+)?` alternative is NOT optional here, and its
+  # absence was inherited verbatim from the local copy this replaced. A step
+  # whose FIRST key is the disarm — `      - if: ${{ … }}` / `- name:` /
+  # `run:` — is a sequence ITEM, so the key is preceded by the `- ` marker and
+  # `^[[:space:]]*if:` never matches it. Measured on the real verify.yaml:
+  # rc=0, "wired, argument-free and undisarmed", for a step that does not run
+  # on pull requests at all. Same idiom as the run:/uses: counters above, which
+  # had it; this key list did not.
   local disarmed="$work/step_wired.disarmed"
-  grep -nE '^[[:space:]]*(if|continue-on-error):' "$step" >"$disarmed" || true
+  grep -nE '^[[:space:]]*(-[[:space:]]+)?(if|continue-on-error):' "$step" >"$disarmed" || true
   if [[ -s "$disarmed" ]]; then
     return 8
   fi
diff --git a/hack/lint/workflow_pins_test.sh b/hack/lint/workflow_pins_test.sh
index bb35ffa0..222fdc4a 100755
--- a/hack/lint/workflow_pins_test.sh
+++ b/hack/lint/workflow_pins_test.sh
@@ -418,7 +418,7 @@ check_ci_wiring() {
       return 1
       ;;
     10)
-      echo "  verify.yaml's 'on:' block uses a shape hack/lib/pr_reach.sh refuses to evaluate (a flow mapping, an anchor or an alias) — a paths:/types: filter hidden there would disarm this gate silently, so it fails closed rather than guessing" >&2
+      echo "  verify.yaml's pull_request trigger is something hack/lib/pr_reach.sh refuses to evaluate: either a shape it cannot read (a flow mapping, an anchor or an alias) or a filter key outside GitHub's five (types, branches, branches-ignore, paths, paths-ignore). A narrowing hidden in either would disarm this gate silently, so it fails closed rather than guessing" >&2
       return 1
       ;;
     11)
@@ -1007,12 +1007,35 @@ expect_red check_ci_wiring "$m" "if: inserted BEFORE run:, the conventional posi
   'present but DISARMED'
 
 # N5 secondary: the extraction must isolate a STEP, not a slab of file header.
-# The old one swallowed lines 13..24 of verify.yaml and still reported non-empty.
+# The old one swallowed a slab of the file header and still reported non-empty.
+#
+# G3-03: this mutation used to be `sed '/^      - name: workflow supply-chain
+# pins/d'` — coupled to the literal TEXT of the step's name line. Any unrelated
+# edit that stops that line starting with `      - ` (renaming the step, or
+# giving the step a different first key, which is exactly the G3-02 disarm
+# shape) made the sed a no-op, and `mutate` then reported "mutation harness:
+# sed program … did not change" — a BROKEN-HARNESS message for a workflow that
+# was merely different. A real finding elsewhere in the family was masked by
+# that misreport once already. The step start is now DERIVED: find the line
+# that runs this gate, walk back to the nearest `      - ` step marker, delete
+# that marker line. No step name, and no other step's text, appears here.
 m="$(mutant wiring-name-removed)"
-mutate "$m/verify.yaml" \
-  '/^      - name: workflow supply-chain pins/d' \
+mutate_awk "$m/verify.yaml" \
+  '{ lines[NR] = $0; if ($0 ~ /^      - /) starts[NR] = 1; if ($0 ~ /^[[:space:]]*run: bash hack\/lint\/workflow_pins_test\.sh[[:space:]]*$/) target = NR }
+   END { s = 0; for (i = target; i >= 1; i--) if (i in starts) { s = i; break }
+         for (i = 1; i <= NR; i++) if (i != s) print lines[i] }' \
   'run: bash hack/lint/workflow_pins_test.sh'
-expect_red check_ci_wiring "$m" "the step's own '- name:' line is gone, so it merged into the checkout step above (N5)" \
+# Positive control on the mutation itself: exactly one step marker fewer, and
+# the gate's own run line untouched. Without this the derived deletion could
+# silently remove the wrong line (or none) and the expect_red below would be
+# grading something else.
+before_starts="$WORK/hits.starts_before"
+after_starts="$WORK/hits.starts_after"
+grep -cE '^      - ' "$WORKFLOWS/verify.yaml" >"$before_starts" || true
+grep -cE '^      - ' "$m/verify.yaml" >"$after_starts" || true
+[[ "$(cat "$after_starts")" -eq "$(($(cat "$before_starts") - 1))" ]] ||
+  fail "mutation control 'wiring-name-removed': expected exactly one fewer step marker, got $(cat "$before_starts") -> $(cat "$after_starts") — the derived step-start deletion did not land"
+expect_red check_ci_wiring "$m" "the step's own start marker is gone, so it merged into the checkout step above (N5)" \
   'the extraction broke'
 
 m="$(mutant wiring-arguments)"
@@ -1133,6 +1156,116 @@ FIX
 helper_wired_is 0 "$f" "$SELF_GATE" "a minimal wired step is accepted"
 helper_wired_is 5 "$f" "hack/audit/aud2_exitgate_test.sh" "a script the fixture does not run is reported absent"
 
+# G3-01/G3-02 — the codes the original fixture set did not cover. Both P1s
+# lived in uncovered codes; the matrix was broad in mutant shapes and narrow in
+# code coverage. Filter fixtures are written at a NON-4-space indent on purpose.
+f="$(helper_fixture reach-paths-6sp <<'FIX'
+name: f
+on:
+  pull_request:
+      paths: [internal/**]
+jobs: {}
+FIX
+)"
+helper_reach_is 11 "$f" "paths: at SIX spaces is still a paths: filter (G3-01 — the 4-space grep fell through to 0 here)"
+
+f="$(helper_fixture reach-types-6sp <<'FIX'
+name: f
+on:
+  pull_request:
+      types: [closed]
+jobs: {}
+FIX
+)"
+helper_reach_is 12 "$f" "types: [closed] at SIX spaces still omits the defaults (G3-01)"
+
+f="$(helper_fixture reach-bi-6sp <<'FIX'
+name: f
+on:
+  pull_request:
+      branches-ignore: [main]
+jobs: {}
+FIX
+)"
+helper_reach_is 13 "$f" "branches-ignore: [main] at SIX spaces still excludes main (G3-01)"
+
+f="$(helper_fixture reach-bi-quoted-hash <<'FIX'
+name: f
+on:
+  pull_request:
+    branches-ignore: ['x #y', 'main']
+jobs: {}
+FIX
+)"
+helper_reach_is 13 "$f" "a quoted ' #' before 'main' in branches-ignore does not hide it (G3-04)"
+
+# The property that keeps G3-01's indent-agnostic widening honest, MEASURED
+# rather than reasoned: a key's value region must stop at a SAME-INDENT sibling
+# key. If it swallowed the sibling, `branches: [release]` followed by
+# `branches-ignore: [main]` would merge into one token set, `main` would appear
+# among the `branches:` tokens, and a main-excluding filter would look fine.
+f="$(helper_fixture reach-sibling-scope <<'FIX'
+name: f
+on:
+  pull_request:
+    branches: [release]
+    branches-ignore: [main]
+jobs: {}
+FIX
+)"
+helper_reach_is 13 "$f" "a key's value region stops at a SAME-INDENT sibling — 'main' in branches-ignore does not leak into the branches: token set (the bound G3-01's widening rests on)"
+
+f="$(helper_fixture reach-legit-6sp <<'FIX'
+name: f
+on:
+  pull_request:
+      types: [opened, synchronize, reopened, ready_for_review]
+      branches: [main]
+jobs: {}
+FIX
+)"
+helper_reach_is 0 "$f" "the legitimate shapes are still accepted at SIX spaces — the fix widened the match, it did not make the check indent-hostile"
+
+f="$(helper_fixture reach-unknown-key <<'FIX'
+name: f
+on:
+  pull_request:
+    only-when: [tuesday]
+jobs: {}
+FIX
+)"
+helper_reach_is 10 "$f" "an UNKNOWN key under pull_request: is REFUSED rather than accepted"
+
+f="$(helper_fixture wired-if-first <<'FIX'
+name: f
+on:
+  pull_request:
+jobs:
+  verify:
+    runs-on: ubuntu-latest
+    steps:
+      - if: ${{ github.event_name != 'pull_request' }}
+        name: gate
+        run: bash hack/lint/workflow_pins_test.sh
+FIX
+)"
+helper_wired_is 8 "$f" "$SELF_GATE" "a step whose FIRST key is 'if:' is DISARMED (G3-02 — the sequence-item form was never matched and this graded WIRED)"
+
+f="$(helper_fixture wired-coe-first <<'FIX'
+name: f
+on:
+  pull_request:
+jobs:
+  verify:
+    runs-on: ubuntu-latest
+    steps:
+      - continue-on-error: true
+        name: gate
+        run: bash hack/lint/workflow_pins_test.sh
+FIX
+)"
+helper_wired_is 8 "$f" "$SELF_GATE" "a step whose FIRST key is 'continue-on-error:' is DISARMED (G3-02)"
+
 f="$(helper_fixture wired-comment <<'FIX'
 name: f
 on:
diff --git a/openspec/specs/backlog.md b/openspec/specs/backlog.md
index e61bbbfe..a58579ff 100644
--- a/openspec/specs/backlog.md
+++ b/openspec/specs/backlog.md
@@ -754,7 +754,7 @@ that claim).
 | CI-TOOLCHAIN-F01 | The linter/toolchain coupling has **no early detector**: dependabot's `github-actions` ecosystem updates `uses:` refs, not `env:` literals, so `GOLANGCI_LINT_VERSION` rots silently until the next Go minor reds every PR at once (~6-monthly). Candidate: a text gate comparing the pinned linter release's go.mod `go 1.N` directive against the toolchain CI resolves, or an updater that watches the literal | **[autonomous]** | D-158 | deliberately out of scope of the fix lane: three lanes were parked behind it, and a new gate belongs with `hack/lint/**`, which was owned by a concurrent lane |
 | BASH32-F01 | **DONE** — three `hack/**` gate scripts used bash 4+ features with no version guard; under stock macOS `/bin/bash` 3.2 `hack/docs/truthlag_pins_test.sh` died at its `declare -A`, skipped its final `OK:` banner and **exited 0**, so `task docs-gates` (and `task check`) read a gate that certified almost nothing as green. Fixed by a shared, per-script-parameterised `hack/lib/require-bash.sh` floor (4.0 / 4.0 / 4.4), enforced by a new `hack/lint/bash_version_guard_test.sh` wired as `task check` stage 20 (D-154) | **[autonomous]** | — | found *by* the AUD2 wave's macOS runs, not by any audit: CI is ubuntu/bash 5, so the hole is LOCAL-only and no CI lane could have surfaced it |
 | UNIV-COSIGN | **DONE (D-160)** — `hack/release/install_cosign_pin_test.sh` graded the D-153 signer pin **existentially** ("*some* `cosign verify-blob` in this file is pinned") where the published guarantee is **universal**, so a **second, unpinned** invocation passed: measured before the fix on scratch copies of all three graded files, rc=**0**/**0**/**0**. `has_flag` grepped the whole folded extraction so a pinned sibling satisfied it, `one_value`'s `sort -u` collapsed the agreeing values, §0 printed the invocation count without asserting it, and 4b/5d's stub-log greps were positive-only — the same shape at runtime. `SECURITY.md` had **no invocation-level grading at all**, only the drift comparison. Closed by one predicate (`pin_violations`) applied to **every** invocation in **all three** files plus its runtime twin, with fail-CLOSED classification of anything it cannot place, mutation-proven by eight mutants per file chosen for **branch** coverage (second-unpinned / second-pinned / off-command-position / no-candidates / fold-broken / no-invocations / empty-identity-regexp / foreign-issuer) plus a prose-exemption control. The check compares each invocation's **value** against SECURITY.md's published pair, not just flag presence: `--certificate-identity-regexp ''` carries the flag, matches every Fulcio identity, and slips past `one_value`'s `sort -u` because an empty capture is not a line. **CORRECTION TO THE RECORDED REMEDY — do not implement it:** the filed remedy "assert the extracted invocation count is exactly 1 per graded file" is **factually wrong and would red `main` on landing**, because `SECURITY.md` legitimately publishes **two** invocations (`SECURITY.md:86` over the archive and `:93` over `checksums.txt`, which is what covers the SBOMs listed inside it). The property is universal, not a count. **Second round (UC-01..UC-04), caught by independent review:** the first fix reproduced the same existential defect one scope down — per **line** instead of per **file** — so an unpinned call CHAINED onto a pinned one (`&&`, `;`, a pipe, or backslash-folded) passed, and the **full gate exited 0** on `SECURITY.md`, which has no runtime twin. Closed by per-**occurrence** grading (`MULTI-OCCURRENCE`), by comparing **every** value of every flag rather than the greedy-last (an empty regexp placed first was masked by a correct one placed second), and by diagnosing quote style separately (`UNQUOTED-VALUE`) so a correctly pinned double-quoted call is accepted instead of being refused with a false "empty regexp" reason. **Third round (UC-05..UC-09):** `occurrence_count` read *absence of a second token* as *proof of singularity*, so `cosign "verify-blob"` / `cosign 'verify-blob'` / `cosign verify-blob""` hid a chained unpinned call — **rc=0 on all three files at whole-gate level** against the round-2 gate (`A && B` short-circuits, so `set -e` never fires and even the runtime twin missed it). Fixed by stripping shell quotes before the compare, **explicitly a spelling patch, not a terminator**: a structural terminator was ruled out with evidence, because both scripts legitimately end their real invocation with an or-else `die` tail, so separator-based refusal would red the real files. Since completeness is unavailable, **the `PASS:` banner no longer claims it** — it now reports OBSERVED counts per file, lists only ASSERTED properties (each mutation-proven), and states the NOT-ASSERTED residual in the same breath, so an unknown fifth spelling leaves the gate *incomplete* rather than *wrong*. **R3-01, found by review in the very paragraph that added that banner:** the backticked-mention exemption keys on the substring appearing **anywhere on the line** and is tested first, so a line carrying a backticked mention AND live calls is exempted — `pin_violations` empty, whole gate rc=0. Not patched (narrowing it needs the markdown/quote parsing that produced UC-01/02/03); **disclosed as the FIRST and most reachable residual in the banner**, with exempted lines no longer described as "prose". Also: MULTI-OCCURRENCE now says TOKENS and names trailing comments as a cause (it was false as printed), and SC1087 silenced | **[autonomous]** | AUD2-F01, D-153 (the pinned value) | demonstrated by a reviewer *on* the AUD2-F01 lane and out of its scope — F01 added a third graded file to a gate whose quantifier was already wrong, so fixing the quantifier is a change to the checker, not to any checked file (all three are byte-unchanged) |
-| GATES3 | **DONE** (D-157) — the three PR-visible text gates (`hack/lint/workflow_pins_test.sh`, `hack/audit/aud2_exitgate_test.sh`, `hack/examples/dogfood_wiring_test.sh`) now share `hack/lib/pr_reach.sh`: PR reach is graded structurally (a `paths:`/`paths-ignore:`/narrowing-`types:`/main-excluding-branch filter, a `pull_request:` nested under another key, or a job-level `if:`/`needs:` all red), each gate **cross-pins the other two's steps**, and aud2's fixed-string step check is replaced by the anchored `run:`-command form | **[autonomous]** | — | three reviewer-demonstrated residuals, all in the same three files, all deliberately left unfixed on their own lanes because fixing one of three identical checks would have been misleading |
+| GATES3 | **DONE** (D-157) — the three PR-visible text gates (`hack/lint/workflow_pins_test.sh`, `hack/audit/aud2_exitgate_test.sh`, `hack/examples/dogfood_wiring_test.sh`) now share `hack/lib/pr_reach.sh`: PR reach is graded structurally (a `paths:`/`paths-ignore:`/narrowing-`types:`/main-excluding-branch filter, a `pull_request:` nested under another key, or a job-level `if:`/`needs:` all red), each gate **cross-pins the other two's steps**, and aud2's fixed-string step check is replaced by the anchored `run:`-command form. Independent review then found two P1s by mutating the REAL `verify.yaml` end-to-end (both fixed here): the filter greps were pinned to **exactly four spaces**, so a 6-space `paths:` — valid YAML, identical mapping — made all three gates green on the very shape the lane closes; and the step disarm grep lacked the sequence-item alternative, so `      - if: …` as a step's **first** key graded WIRED (that regex was inherited from `main`, not introduced) | **[autonomous]** | — | three reviewer-demonstrated residuals, all in the same three files, all deliberately left unfixed on their own lanes because fixing one of three identical checks would have been misleading |
 
 Sizing, from the S03 implementer's reading of the call site: `verify_cosign()`
 (`hack/release/verify-artifacts.sh:118–125`) has the byte-identical unpinned

From 182d3a8c6ab3ffe5ee9a00aab532133cc85602f0 Mon Sep 17 00:00:00 2001
From: Konrad Heimel <konrad.heimel@gmail.com>
Date: Sun, 23 Aug 2026 20:43:31 +0200
Subject: [PATCH 4/8] :bug: fix(ci): read flush block sequences and whole
 branch names (D-157)

Three fixes, all measured before and after against the two prior tips.

G3R-01 (P1) - a block sequence written FLUSH with its key, the canonical
GitHub Actions style, was misgraded, and round two's key allowlist made
one case worse. Two stacked defects, fixed separately because fixing
either alone would have looked like a close:

  * _assent_key_tokens' indent bound stopped at `RLENGTH <= ind`, so an
    item at the key's own indent was never read. Measurable at 4d592fe,
    i.e. independently of the allowlist: `branches:` + `- main` returned
    13, "excludes main", on a filter that includes it.
  * the allowlist enumerated `- main` as a sub-block KEY, so it failed
    the five-key check and returned 10 - refusing valid structure. That
    turned `branches-ignore: - gh-pages` from a correct 0 into a red.

  flush `branches: - main`            13 -> 10 -> 0
  flush `types:` superset             12 -> 10 -> 0
  flush `branches-ignore: - gh-pages`  0 -> 10 -> 0
  full legit trigger, both flush      12 -> 10 -> 0
  and the bad polarities still red:   flush `- release` -> 13,
  flush branches-ignore `- main` -> 13, flush types missing one -> 12.

G3R-02 (P1, pre-existing across both earlier commits) - branch and type
names were tokenised with `tr -c 'A-Za-z0-9_'`, which splits on `-` and
`/`. So `main-next` yielded a `main` token and a filter under which NO
pull request onto main runs the workflow reported "runs on every PR".

  branches: [main-next]        0 -> 0 -> 13
  branches: ['release/main']   0 -> 0 -> 13
  branches: seq `- main-v2`    0 -> 0 -> 13
  branches: [maintenance]     13 -> 13 -> 13  (the control that hid it:
    only values containing `main` as a SUBSTRING were broken)
  branches: [main]             0 -> 0 -> 0    (not made hostile)
  branches-ignore: [main-next] 13 -> 13 -> 0  (the false RED it also fixes)

Tokenising now splits on YAML's own separators - flow brackets, commas,
quotes, the `- ` marker, whitespace - and on nothing else. Applied to the
inline `on: [push, pull_request]` membership test too, which had the same
defect in the same direction.

G3R-03 (P2) - the `(-[[:space:]]+)?` alternative was added to the disarm
grep last round but not to the two COMMAND-matching sites, so a step
written as a bare `- run: bash <gate>` reported rc=5, "no run: COMMAND
invokes the script: deleted, commented out" - a false red with a wrong
diagnosis, for an idiom verify.yaml itself already uses three times.
Bare `- run:` 5 -> 5 -> 0, and with an argument 5 -> 5 -> 7, so the form
is graded rather than merely admitted.

Root cause of (i) and the reason it hid inside the fix for the previous
round: round two closed the CODE-coverage complaint - every reach and
wired code got a host-independent fixture - but wrote all of them at 4 or
6 spaces with sequence items indented deeper than their key, reproducing
the same indentation blind spot somewhere cheaper. Both gates that carry
the fixture set now cover flush style in both polarities.

24 before/after rows, 0 mismatches. CONTROL_FLOOR unchanged at 57/51.
---
 docs/decisions/decisions.md          |   2 +-
 hack/examples/dogfood_wiring_test.sh | 111 +++++++++++++++++++++++++++
 hack/lib/pr_reach.sh                 |  60 +++++++++++++--
 hack/lint/workflow_pins_test.sh      | 111 +++++++++++++++++++++++++++
 4 files changed, 275 insertions(+), 9 deletions(-)

diff --git a/docs/decisions/decisions.md b/docs/decisions/decisions.md
index 43eb196d..0c6951c2 100644
--- a/docs/decisions/decisions.md
+++ b/docs/decisions/decisions.md
@@ -160,7 +160,7 @@ project/process decisions.
 | D-153 | 2026-08-19 | **The cosign signer-identity pin published in `SECURITY.md` was WRONG, not merely missing from `hack/install.sh`: the identity regexp is widened to `^https://github\.com/PlatformRelay/[Aa]ssent/` in both files (AUD2-S03 / SEC-03).** Substance first: `SECURITY.md`'s "Verify a tagged release" instructions pinned `--certificate-identity-regexp '^https://github.com/PlatformRelay/assent/'`, and an adopter who followed them on **v0.2.0 or v0.3.0 got a verification FAILURE on a genuine, correctly signed artifact** — the published recipe has been broken for every release since v0.2.0, and the natural reading of that failure is "this release was tampered with". Cause: the repository was renamed `PlatformRelay/assent` → `PlatformRelay/Assent` between v0.1.0 and v0.2.0; the keyless signing certificate's Subject Alternative Name carries GitHub's canonical casing; cosign compiles `--certificate-identity-regexp` as a Go RE2 pattern and matches it **case-sensitively**. Decoded from the published bundles: v0.3.0 and v0.2.0 sign as `https://github.com/PlatformRelay/Assent/.github/workflows/release.yaml@refs/tags/vX.Y.Z`, v0.1.0 as `https://github.com/PlatformRelay/assent/.github/workflows/release.yaml@refs/heads/main`. All three verify under the new value; independently re-confirmed with real cosign against the real v0.3.0 artifact (`Verified OK` under the new pin, exit 1 "expected SAN value to match regex" under the old). Options considered: **(a)** ship the pin byte-identical to the published-but-broken value and file the breakage as a follow-up (rejected — it would land a green gate asserting a guarantee that fails closed on this project's own releases, D-124's defect one level up); **(b)** case-insensitive `(?i)` (rejected — wider than the defect and it silently accepts casings GitHub never issues); **(c)** an explicit `[Aa]` class in both files, dots escaped (chosen). Not widened otherwise: the `^` anchor and the owner/repo scope stand, so another owner, an `assent-mirror` typosquat, another forge and an unescaped-dot host all still fail. Enforcement, per D-128: **one** published truth — `hack/release/install_cosign_pin_test.sh` extracts the pair from `hack/install.sh` and `SECURITY.md`, requires exactly one distinct value per file, reddens on drift, and (this is the assertion that would have caught the defect) matches the pin against the three **real** SANs above, committed as offline fixtures, plus six negatives. Extends D-110 (bundles beside archives) and D-109; the maintainer-path twin at `hack/release/verify-artifacts.sh:124` is still unpinned and is tracked in the backlog, not fixed here. Revert: restore `'^https://github.com/PlatformRelay/assent/'` in both files — which re-breaks verification of v0.2.0 and every later release, so revert only together with a repo rename back to lowercase. |
 | D-154 | 2026-08-23 | **Every `hack/**` script that uses a bash 4+ feature declares a PER-SCRIPT version floor via the shared `hack/lib/require-bash.sh`, because one of them was a silent local FAIL-OPEN under stock macOS bash 3.2 (BASH32-F01).** Substance first: `/bin/bash hack/docs/truthlag_pins_test.sh` on macOS printed 20 `PASS` lines, died at its `declare -A ex_s09_prefix_hint=(…)`, never printed its final `OK: all truth-lag pins green` banner — and **exited 0**. Its caller `task docs-gates`, and therefore `task check`, read that as a green gate, and AGENTS.md rule 4 makes a green local `task check` a per-commit precondition; CI is ubuntu/bash 5, so nothing merges through this path, which is precisely why it survived. Mechanism, measured on bash 3.2.57: 3.2 has no associative arrays, so under `set -u` it re-reads `declare -A x=([k]=v)` as an INDEXED array assignment and evaluates the subscript `k` **arithmetically**, hitting "unbound variable"; the shell terminates the script and the exit status is 0. Two theories were disproved en route and are recorded so they are not re-explored: the `trap … EXIT` status-swallow (3.2 propagates 1 through an EXIT trap correctly) and `set -e` (the script runs `set -uo pipefail`). The other two affected scripts fail CLOSED, but only incidentally: `hack/release/verify-artifacts.sh:202`'s literal is EMPTY, so there is no subscript to evaluate and it degrades to `declare: -A: invalid option`, which its `set -e` turns into exit 2 (measured with a `--dist` that reaches line 202 — an unreachable dist exits 1 much earlier); `hack/validate-schemas-stock.sh`'s `mapfile` degrades to "command not found" and it exits 1. Populating an empty literal or dropping `-e` silently converts a closed failure into the open one, so "how this construct happens to degrade" is not a guarantee worth depending on. Options considered: **(a)** one blanket repo-wide floor (rejected — the binding minimum differs per feature: `declare -A` 4.0, `local -n` 4.3, `mapfile -d ''` 4.4; a blanket floor both refuses shells that could run the 4.0 gates and hides which feature actually binds); **(b)** rewrite the three scripts to be 3.2-compatible (rejected — associative arrays and `mapfile` are the right tools here, a rewrite is a large risky change to scripts whose correctness IS the product, and it does nothing about the next gate author); **(c)** copy the existing inline `BASH_VERSINFO` guard from `hack/audit/aud2_exitgate_test.sh:71` into each script (rejected as the *only* measure — it duplicates the explanation three more times and still leaves the next author to rediscover the hazard); **(d) chosen** — a shared `require_bash <major>[.<minor>] <feature>` helper, called with each script's own correct floor (4.0 / 4.0 / 4.4), plus a meta-gate. Enforcement, per D-128, is one place: `hack/lint/bash_version_guard_test.sh`, wired as `task check` stage **20** and pinned in `hack/audit/exitgate_test.sh`'s `CHECK_STAGES` in the same commit. It scans every `hack/**/*.sh` for command-position bash 4+ constructs, requires a guard on each, requires the declared floor to be at least the feature's own minimum, and — the assertion that makes the rest non-vacuous — requires the scan to still find all four known feature-using files, so a typo in a detection pattern reds instead of quietly matching nothing. Its own negative control mutates real copies of the three scripts with the guard lines stripped and asserts they are flagged. `hack/audit/aud2_exitgate_test.sh` keeps its inline guard and is accepted by the gate as guarded; adopting the helper there is a follow-up, not this lane. Stated limits: the gate sees only command-position constructs in `hack/**/*.sh` (not `eval`, dynamically built command names, case-modification expansions, or scripts outside `hack/`), and the exit-0 control needs a real bash 3.2 — present on macOS, absent on CI ubuntu, where it SKIPs **loudly** rather than passing silently. Accepted behaviour change: under 3.2, `hack/release/verify-artifacts.sh --help` now refuses instead of printing usage. Revert: delete the guard calls — `task check` then silently stops certifying the docs truth-lag pins for every contributor whose `bash` is 3.2. |
 | D-156 | 2026-08-23 | **The tier-1 (CEL) ceiling is recorded (`docs/planning/rego-tier-ceiling.md`, E11-S01 / REQ-E11-S01-01+02) and it NARROWS E11: two of the four named shapes are struck outright and a third in part.** Substance first: of multi-pass / cross-manifest / set-difference / graph-relationship (`openspec/specs/later-phases.md:284`), **cross-manifest and set-difference are struck, the "named intermediate" half of multi-pass is struck, and only fold/aggregate-over-a-collection and in-input graph reasoning survive as justification for a second backend.** Measured against the surface this repo actually binds — `internal/core/aggregate/evaluate.go` `newEvalEnv`, eleven frozen predicate-scope variables, **zero extension libraries** — reproduced in a nested throwaway module pinned to the repo's `cel-go v0.31.0` (root `go.mod`/`go.sum` byte-unchanged; nothing added to the dependency graph, which judgment call (d) has not authorised). **What exceeds tier 1: (1) folds.** `sum`, `reduce`, `math.*` and `lists.*` are all `undeclared reference`; `size()` is the only aggregate in the surface, so a rule counting matched changes is expressible and a rule summing a numeric delta across them is not. **(2) Graph reasoning** — the iteration count of a CEL expression cannot be made data-dependent, so depth is syntactic and **unbounded** reachability has no spelling; a bounded `k`-hop form *is* writable and answers a fixed-depth question, not the rule (detailed below, with the refutations of two sharper claims this row previously made). **What is struck, with the CEL that does the job:** registry membership — `string(new) in facts.registry.topics.value` over a `cardinality: set` fact, already shipped green at `examples/packs/service-catalog/.assent/packs/catalog/rules/ownership.yaml:21`; keyed attribute lookup — either a purpose-built provider (`builtin/resource-owner`, exercised in both polarities by `examples/archetypes/referenced-resource-ownership/`) or `facts.<p>.<n>.value[key].field`, which compiles and is lint-clean because `internal/lint/facts_ref.go`'s D-051 shape check permits arbitrary navigation past `.value` and only forbids indexing `facts` itself; set difference — `oldEntry.acls.filter(a, !(a in entry.acls)).size() == 0`; named intermediates — no `cel.bind`, but re-deriving the sub-expression inside each leaf is semantically identical and compiles. **The sharpest finding is a distinction, not a rule:** same-changeset **cross-file** reasoning fails for **input availability**, not expressiveness — the evaluation unit is one file (`change.ChangeSet` is documented "for one file", `internal/change/diff.go:129`; `assent run` strips one `--subject file:<path>`, `cmd/assent/run.go:266`, and diffs it alone, `:293`) and **REQ-E11-S05-01 pins the Rego module to the identical `EvaluationInput`** with the tier fenced to "declared data, no I/O". **A Rego module therefore fails that rule identically, so it is struck from E11's justification too** — the fix is an input decision, which E11's non-goals fence, not a backend decision. Corroborating: the one committed illustration of the escape hatch, `examples/policies/rego/bounded_change.rego`, is **entirely tier-1 expressible** — both `violations` rules are per-change predicates and `examples/policies/declarative/bounded-change.yaml` is the same rule already in the envelope. **The strongest single piece of evidence, and the one that sizes the epic, is the graph shape.** On the `assent run` path document-mode `walkNode` emits a Change **only where two scalars differ** — a sequence on either side makes the whole ChangeSet **opaque → REVIEW** before any rule runs (`internal/change/diff.go`) — and collection-mode `DiffEntries` is reached only from `internal/adoptertest`, so `old`/`new`/`entry`/`oldEntry` and every `changes[i].old`/`.new` bind **scalars**. That does **not** starve a graph rule, because a flat `set` fact still carries structure: `edges: {type: string, cardinality: set}` returning `["orders|billing","billing|ledger"]` is a **fully declarable, in-contract adjacency inside `EvaluationInput` today** — the declaration is legal (`schemas/provider/v1alpha1/response.schema.json`), `fact.value` carries no JSON-Schema type constraint and `ResolveFactsChecked` cross-checks the *declaration* not the value (`internal/provider/resolve.go`), outputs are operator-authored (`internal/provider/config.go`), the `http` transport is live on the plain run path with **no `--checkout`** (`cmd/assent/provider_host.go` `providerCallFor`), and a set fact binds as a CEL list. Tier-1 CEL nonetheless cannot answer the actual question over it: **CEL has no recursion, fixpoint, fold or user-defined function, so unbounded reachability has no spelling** (`transitiveClosure` → `undeclared reference`; the four comprehension macros iterate one level and cannot call themselves). **Stated precisely, because two drafts of this record overreached and both were caught by independent review:** a *bounded* `k`-hop check **is** expressible and does **not** need the string decomposition CEL lacks — over a finite in-input candidate set (a `nodes` set fact, the same construction as `edges`), decode is replaceable by **encode-and-compare**: `nodes.value.exists(m, nodes.value.exists(n, (string(new)+"|"+m) in edges.value && (m+"|"+n) in edges.value && (n+"|"+string(new)) in edges.value))` compiles **and evaluates** under the real `cel.CostLimit(1_000_000)` to `true/true/true/false` over the fixture above, and `nodes.value.filter(m, (string(new)+"|"+m) in edges.value)` recovers an edge's far end as `[billing]`. Both primitives (`+` on strings, `in`) were already in this record's own function census, so the claim that decoding was a second independent barrier was internally inconsistent as well as false. **The real ceiling is `k`, and a third draft got its cost wrong too** — it claimed `O(|N|^(k-1)·|E|)` "exhausts the cost budget on any real graph". Wrong complexity class and wrong conclusion, because the census had omitted the surface's only value binder, `[expr].all(v, …)`: binding each BFS frontier once per level makes cost additive across levels, and measured under the real `cel.CostLimit(1_000_000)` a ring `|N|=50, deg 5` costs 89,551 at `k=10`, 235,297 at `k=20` and 686,317 at `k=50` — roughly linear in `k`, and at `k=50 ≥ |N|` CEL is **not approximating at all, it decides reachability exactly**, in 69% of budget. The practical `k` collapses around `|N|≈200` (`k=10` at 46% of budget, `k=20` exceeds). Recorded because a reader sizing this epic is entitled to ask "would CEL suffice for *our* graph?" and the previous sentence foreclosed that question with an assertion measurement refutes; it is **not** offered as a second reason. **What carries the verdict is one property, now measured rather than recalled: the iteration count of a tier-1 CEL expression cannot be made data-dependent.** `reduce`, `transformList`, `transformMap`, two-var `all(i,x,…)`, `range`/`lists.range` and `cel.bind` are all `undeclared reference`; `for` is a `reserved identifier`; there is no fold, self-reference or generator; so depth is a **syntactic** property, hard-capped by cel-go's parser recursion limit of 250 (`expression recursion limit exceeded: 250` at depth 260, depth 200 still compiles). That a fixed `k` really is an approximation when the data outruns it is measured too: on a 4-cycle the `k=3` form evaluates `false` and the `k=4` form `true`. **Rego answers the unbounded question with `graph.reachable` — pure and deterministic — and that single gap is the whole justification.** **An input that is in contract and available today, over which CEL can only approximate and Rego decides, is exactly the per-rule evidence D-017's gate demanded — so E11 has TWO unconditional justifications (folds and graphs), neither waiting on any open question.** Deliverability caveat, stated because this row makes the same distinction for sub-shape B1: **no provider in the corpus ships an encoded adjacency today** — that one *can* follows from the provider contract, the same inference used to strike B1, not from a shipped example. Options considered: **(a)** record all four shapes as exceeding, the reading D-141's unlock invites (rejected — three are demonstrably expressible and an unfalsifiable ceiling claim is the defect this story exists to prevent); **(b)** strike set-difference **conditionally**, so that a narrowing answer to OQ-35 would return it to the ceiling (rejected on the second pass — both resolutions strike it: extending the entry binding makes CEL express it, narrowing makes it an input-availability failure that REQ-E11-S05-01 hands to Rego unchanged, so a conditional would have left a downstream story waiting on an answer that cannot change the verdict); **(c)** strike cross-manifest and set-difference **unconditionally**, strike half of multi-pass, keep folds and in-input graphs **both unconditionally** **(chosen)**. **Two rejected drafts are recorded because the same failure produced both, with the sign flipped, and only independent review caught either.** Draft 1 made the graph shape *contingent* on OQ-35/OQ-36 on the premise that "an adjacency needs a mapping-valued fact" — it does not; a set of encoded strings carries one inside the frozen declaration — which came from conflating a *provider-supplied catalog* (sub-shapes B1/B2, struck here as working and shipped) with **B3, which is specifically same-changeset cross-file *diffs***. It would have advised the operator to defer a 14-story epic on a premise that does not hold. Draft 2 replaced that with a second "independent reason" — that CEL cannot decode an edge, killing even a bounded two-hop check — **refuted by execution** (the encode-and-compare leaf above). Draft 3 replaced *that* with the exponential-cost claim above — **refuted by measurement**. The common cause across all three is one habit: **reaching for a second independent reason when one sufficient reason was already in hand**, and then applying an **asymmetric evidentiary standard** to protect it — accepting awkward-but-working spellings when they *struck* a shape (A2's re-derivation, B2's dynamic index) and rejecting them when they would have *narrowed* one this record wanted to keep. The verdict was right in all four drafts; the supporting argument was wrong in three. It now rests on one measured property and no supporting argument at all, which is the form it should have taken first. The correction to A2 runs the same way: the value binder `[expr].all(v, …)` removes the evaluation-cost half of A2's residual, so **A2 is struck more firmly than the first draft struck it**. Binds later stories: **S05** must not be widened to carry cross-manifest data; **S07**'s violation shape must support a fold result and a path/cycle witness, not a cross-manifest reference; **S12** must correct ADR-0002's `rego` bullet, which calls the tier an "escape hatch for **cross-entry checks**" — inaccurate for the shipped input contract; **S11** must label the unquarantined example a shape illustration, never evidence of need. **Binds E11-S04, whose denylist is not yet written: `graph.reachable` MUST be allowed**, with `split` alongside it — both pure and deterministic. `graph.reachable` is the one that carries the justification (it closes the graph at any depth); `split` is a convenience for rebuilding the adjacency. A capability set drafted from "deny anything unfamiliar" would strike out the epic's own strongest justification. Recorded in the S04 section of the epic spec, not only S01's. **That floor is held by REVIEW, not by a gate, and this row says so rather than inventing an enforcement path:** REQ-E11-S04-02's committed golden detects a *change* to the allowed set (so the sandbox cannot silently widen) and cannot detect an *omission* — a golden written without `graph.reachable` stays green forever. It says nothing about judgment call (d), since *which* builtins are callable is orthogonal to *where* the evaluator lives. Two residuals raised, neither decided, **neither gating any verdict here**, and neither the escalated rule-7 (d1)/(d2) question: **OQ-35** (the `entry`/`oldEntry` binding asymmetry — a silent `assent test` / `assent run` divergence; set-difference is struck either way and the graph shape needs no entry tree) and **OQ-36** (the frozen provider declaration has no object/map type, yet the authoring surface and `builtin/repo-file` together permit a mapping-valued fact). Also flagged, not edited (out of lane): `REQ-DEM-S05-04` calls the provider-visible tree the "merged-result checkout"; the code reads `<root>/head`, documented at `cmd/assent/checkout.go:44` as "the MERGE-REQUEST HEAD". This lane writes no Go, adds no dependency and touches no schema. Revert: delete `docs/planning/rego-tier-ceiling.md` and the D-156 narrowing text from the E11 spec — which restores an epic justified by four shapes, three of which this record shows are not real. |
-| D-157 | 2026-08-23 | **"Reaches pull requests" is now a SHARED, structural check (`hack/lib/pr_reach.sh`), the three PR-visible text gates CROSS-PIN each other's steps, and the fixed-string step check is replaced by an anchored `run:`-command match (GATES3).** Three residuals, each *demonstrated* by an independent reviewer on an earlier lane and each deliberately left unfixed there, all living in the same three files — `hack/lint/workflow_pins_test.sh`, `hack/audit/aud2_exitgate_test.sh`, `hack/examples/dogfood_wiring_test.sh`. **(1) The substantive one.** Two of the three answered "am I reachable on a PR?" with `grep -qE '^[[:space:]]+pull_request:'` over the workflow's `on:` block; a reviewer added `paths: ['internal/**']` under the trigger and measured **rc=0** — the trigger is present, the grep is satisfied, and the gate is disarmed for every PR that touches only `Taskfile.yml` or `.github/workflows/**`, which is exactly the class of PR these gates exist to grade. `types: [closed]` is the same defect by another route, and the grep's `[[:space:]]+` is indent-blind, so a `pull_request:` nested under `workflow_call.inputs` satisfied it too. **The third gate did not answer the question at all** — `workflow_pins_test.sh` asserted its step was present and undisarmed and never that the workflow carrying it runs on a PR; this is new coverage there, not a strengthening, and the brief that commissioned this lane assumed otherwise. **Decision on meaning:** a workflow "reaches PRs" when it has a top-level `pull_request:` trigger — a key of `on:` itself, at 2-space indent — whose sub-block carries **only keys from GitHub's five** (`types`, `branches`, `branches-ignore`, `paths`, `paths-ignore`; a sixth is **refused**, not guessed at), with **no** `paths:`/`paths-ignore:`, a `types:` list that is absent or a **superset** of GitHub's defaults (`opened`, `synchronize`, `reopened`), and no branch filter excluding `main` — **each read at whatever indent it is written at**, because the sub-block extraction is already scoped to the trigger and an indent pin bought no isolation the scoping did not already provide — and when the target job carries neither a job-level `if:` **nor a job-level `needs:`** (a dependency that skips on PRs skips its dependents, defeating all three gates at once while every other assertion stays green), and the gate's own step carries no `if:`/`continue-on-error:` **in either the mapping-key or the sequence-item position** (`      - if:` is the step's first key and is a sequence item). **Deliberately still accepted**, stated so a reviewer does not read the narrowing as wider than it is: `on: pull_request` and `on: [push, pull_request]` (the inline forms cannot carry a filter, so they are strictly safer than the block form), the quoted `"on":` key, a `types:` superset, `branches:` listing the literal `main`, `branches-ignore:` sparing `main`, block-scalar `run: |` invocations, arbitrarily long comment blocks inside a gate step, and step-level `if:` on *other* steps (`verify.yaml`'s changelog gate is legitimately PR-excluded). **Deliberately narrower than GitHub:** a `branches:` glob covering main without the literal token (`['ma*']`) reds, because a bash gate cannot honestly evaluate GitHub's glob semantics, and a flow mapping or anchor in the `on:` block is **refused** (distinct code) rather than guessed at. **(2)** Each gate pinned only its OWN step, so a PR deleting one of the other two was invisible to the gate that still ran — caught locally by `task check` and on push by `release-exitgate`, hence a gap and not a hole. Each gate now asserts all three steps; the mutation matrix is the full cross-product (3 deleted steps × the 2 observers that still run) rather than a diagonal. **(3)** `aud2_exitgate_test.sh`'s `check_pr_wiring` located its step with `grep -nF -- "$SELF"` — a search for the script *name*, which the step's own comments satisfy. Measured by the reviewer: with the `run:` line commented out it still failed, but reported **"WITH ARGUMENTS"** instead of "does not invoke", sending an operator to look for an argument that does not exist. The anchored form from `dogfood_wiring_test.sh` is ported back and shared. **Why one lane and one helper, not three fixes:** the INBOX residual explicitly asked for a single shared helper so the next gate author inherits the strong check rather than copying the weak one; fixing one of three identical checks would have been misleading. **Judgment calls.** (a) The helper is **codes-only and prints nothing** — every caller owns its wording, because roughly twenty existing `expect_red` controls pin stderr fragments. (b) The 1..6 **line cap** `workflow_pins_test.sh` used to bound step isolation is replaced by a structural invariant — exactly one `run:` key and no `uses:` key, both of which actionlint itself flags — because cross-pinning made the helper isolate the aud2 and dogfood steps, whose comment blocks are a dozen lines long, and no cap admits an honest step of theirs while rejecting a merged one. (c) The helper is held to `workflow_pins_test.sh`'s preamble rules (**bash 3.2**, portable ERE, no `git`, no `grep -q` on a pipe) rather than aud2's ≥4.3 floor: that gate runs first in CI before any toolchain, and the other two callers do not refuse bash 3.2, so a bash-4 construct here would silently weaken them on a maintainer's machine. (d) It is a **line-oriented reader with a structural bias, not a YAML parser** — it says so in its own header and fails closed on anchors, aliases and flow mappings, because an honest narrow gate beats an overreaching one. (e) No new `check:` stage and `CHECK_STAGES` untouched: all three gates were already wired. **Evidence:** 44 helper-level probes, 20 host-independent fixture self-checks carried inside two of the gates, and end-to-end mutation of a scratch copy of the REAL `verify.yaml` driven through all three real gate scripts (the layer that found (ii) and (iii); fixtures alone did not) plus, in the gates themselves, 13 new red controls in aud2 (`CONTROL_FLOOR` 38→51, text-only 32→45, both floors met exactly), 15 in `workflow_pins_test.sh` and 12 in `dogfood_wiring_test.sh` — each pinned to its own finding text or rc — and, in every gate, **green** controls for the legitimate shapes above, so the new checks are provably not always-red. **Three fail-opens were found by building mutants rather than by reasoning, and the record names them because the lane's value is the mutants, not the prose.** (i) *This lane's own widening:* accepting a block-scalar `run: |` invocation naively means a bare `bash <script>` line anywhere in the job satisfies the step check, including inside another step's multi-command `run: |` body where `echo skip && exit 0` a line above would mean the gate never runs — measured rc=0. The block form now counts only as a block's **sole** command, and all three gates carry that mutant. (ii) *The residual this lane exists to close, still open at any indent but four:* the filter greps were pinned to exactly four spaces, six-space indent is valid YAML resolving to the identical mapping, and the miss fell through to `return 0` — so on the real `verify.yaml` all three gates returned **rc=0** on a `paths:`-filtered trigger written one level deeper, the exact shape this row says they refuse. It was also the one place the helper broke its own stated rule, refusing an unevaluable *shape* while silently accepting an unrecognised *indent*. Matching is now indent-agnostic within the trigger sub-block, plus the five-key allowlist above. (iii) *Inherited, not introduced:* the step disarm grep lacked the `(-[[:space:]]+)?` alternative its `run:`/`uses:` siblings in the same function had, so a step whose FIRST key is the disarm (`      - if: …`) graded **wired, argument-free and undisarmed** — measured rc=0 on the real workflow, and it hollowed out the cross-pinning this row delivers. The byte-identical regex is in `main`'s `dogfood_wiring_test.sh`, so this is a pre-existing hole closed here, not a regression. **Why a 28-row mutant matrix missed (ii) and (iii):** it was broad in mutant SHAPES and narrow in CODE coverage — 3 of 6 `assent_pr_reach` codes and 2 of 8 `assent_step_wired` codes had a host-independent fixture, and both defects lived in the uncovered ones. Every code now has one, the filter fixtures deliberately written at a non-4-space indent. **The helper is graded too, not only the workflows it reads:** every mutation control mutates `verify.yaml` and asks the helper about it, which cannot tell a working helper from a stubbed one — with the helper now a single point of failure for all three gates, replacing `assent_pr_reach` with `return 0` would turn them all green at once. Two of the gates therefore also drive it against **from-scratch fixture workflows** whose right answer depends on nothing under `.github/workflows/**` (verified: the stub reds them by name). Revert: delete `hack/lib/pr_reach.sh` and restore the three gates' local readers — which restores the `paths:`-filtered bypass, the self-only pinning, and the misreport. |
+| D-157 | 2026-08-23 | **"Reaches pull requests" is now a SHARED, structural check (`hack/lib/pr_reach.sh`), the three PR-visible text gates CROSS-PIN each other's steps, and the fixed-string step check is replaced by an anchored `run:`-command match (GATES3).** Three residuals, each *demonstrated* by an independent reviewer on an earlier lane and each deliberately left unfixed there, all living in the same three files — `hack/lint/workflow_pins_test.sh`, `hack/audit/aud2_exitgate_test.sh`, `hack/examples/dogfood_wiring_test.sh`. **(1) The substantive one.** Two of the three answered "am I reachable on a PR?" with `grep -qE '^[[:space:]]+pull_request:'` over the workflow's `on:` block; a reviewer added `paths: ['internal/**']` under the trigger and measured **rc=0** — the trigger is present, the grep is satisfied, and the gate is disarmed for every PR that touches only `Taskfile.yml` or `.github/workflows/**`, which is exactly the class of PR these gates exist to grade. `types: [closed]` is the same defect by another route, and the grep's `[[:space:]]+` is indent-blind, so a `pull_request:` nested under `workflow_call.inputs` satisfied it too. **The third gate did not answer the question at all** — `workflow_pins_test.sh` asserted its step was present and undisarmed and never that the workflow carrying it runs on a PR; this is new coverage there, not a strengthening, and the brief that commissioned this lane assumed otherwise. **Decision on meaning:** a workflow "reaches PRs" when it has a top-level `pull_request:` trigger — a key of `on:` itself, at 2-space indent — whose sub-block carries **only keys from GitHub's five** (`types`, `branches`, `branches-ignore`, `paths`, `paths-ignore`; a sixth is **refused**, not guessed at), with **no** `paths:`/`paths-ignore:`, a `types:` list that is absent or a **superset** of GitHub's defaults (`opened`, `synchronize`, `reopened`), and no branch filter excluding `main` — **each read at whatever indent it is written at, and with its block sequence read whether the items are indented under the key or written FLUSH with it**, because the sub-block extraction is already scoped to the trigger and an indent pin bought no isolation the scoping did not already provide; branch and type names are compared as WHOLE tokens split on YAML's own separators, so `main-next` and `release/main` are not `main` — and when the target job carries neither a job-level `if:` **nor a job-level `needs:`** (a dependency that skips on PRs skips its dependents, defeating all three gates at once while every other assertion stays green), and the gate's own step carries no `if:`/`continue-on-error:` **in either the mapping-key or the sequence-item position** (`      - if:` is the step's first key and is a sequence item). **Deliberately still accepted**, stated so a reviewer does not read the narrowing as wider than it is: `on: pull_request` and `on: [push, pull_request]` (the inline forms cannot carry a filter, so they are strictly safer than the block form), the quoted `"on":` key, a `types:` superset, `branches:` listing the literal `main`, `branches-ignore:` sparing `main`, block-scalar `run: |` invocations, arbitrarily long comment blocks inside a gate step, and step-level `if:` on *other* steps (`verify.yaml`'s changelog gate is legitimately PR-excluded). **Deliberately narrower than GitHub:** a `branches:` glob covering main without the literal token (`['ma*']`) reds, because a bash gate cannot honestly evaluate GitHub's glob semantics, and a flow mapping or anchor in the `on:` block is **refused** (distinct code) rather than guessed at. **(2)** Each gate pinned only its OWN step, so a PR deleting one of the other two was invisible to the gate that still ran — caught locally by `task check` and on push by `release-exitgate`, hence a gap and not a hole. Each gate now asserts all three steps; the mutation matrix is the full cross-product (3 deleted steps × the 2 observers that still run) rather than a diagonal. **(3)** `aud2_exitgate_test.sh`'s `check_pr_wiring` located its step with `grep -nF -- "$SELF"` — a search for the script *name*, which the step's own comments satisfy. Measured by the reviewer: with the `run:` line commented out it still failed, but reported **"WITH ARGUMENTS"** instead of "does not invoke", sending an operator to look for an argument that does not exist. The anchored form from `dogfood_wiring_test.sh` is ported back and shared. **Why one lane and one helper, not three fixes:** the INBOX residual explicitly asked for a single shared helper so the next gate author inherits the strong check rather than copying the weak one; fixing one of three identical checks would have been misleading. **Judgment calls.** (a) The helper is **codes-only and prints nothing** — every caller owns its wording, because roughly twenty existing `expect_red` controls pin stderr fragments. (b) The 1..6 **line cap** `workflow_pins_test.sh` used to bound step isolation is replaced by a structural invariant — exactly one `run:` key and no `uses:` key, both of which actionlint itself flags — because cross-pinning made the helper isolate the aud2 and dogfood steps, whose comment blocks are a dozen lines long, and no cap admits an honest step of theirs while rejecting a merged one. (c) The helper is held to `workflow_pins_test.sh`'s preamble rules (**bash 3.2**, portable ERE, no `git`, no `grep -q` on a pipe) rather than aud2's ≥4.3 floor: that gate runs first in CI before any toolchain, and the other two callers do not refuse bash 3.2, so a bash-4 construct here would silently weaken them on a maintainer's machine. (d) It is a **line-oriented reader with a structural bias, not a YAML parser** — it says so in its own header and fails closed on anchors, aliases and flow mappings, because an honest narrow gate beats an overreaching one. (e) No new `check:` stage and `CHECK_STAGES` untouched: all three gates were already wired. **Evidence:** 44 helper-level probes, 20 host-independent fixture self-checks carried inside two of the gates, and end-to-end mutation of a scratch copy of the REAL `verify.yaml` driven through all three real gate scripts (the layer that found (ii) and (iii); fixtures alone did not) plus, in the gates themselves, 13 new red controls in aud2 (`CONTROL_FLOOR` 38→51, text-only 32→45, both floors met exactly), 15 in `workflow_pins_test.sh` and 12 in `dogfood_wiring_test.sh` — each pinned to its own finding text or rc — and, in every gate, **green** controls for the legitimate shapes above, so the new checks are provably not always-red. **Five fail-opens were found by building mutants rather than by reasoning — three of them in this lane's own code, across three review rounds — and the record names every one, because the lane's value is the mutants, not the prose.** (i) *This lane's own widening:* accepting a block-scalar `run: |` invocation naively means a bare `bash <script>` line anywhere in the job satisfies the step check, including inside another step's multi-command `run: |` body where `echo skip && exit 0` a line above would mean the gate never runs — measured rc=0. The block form now counts only as a block's **sole** command, and all three gates carry that mutant. (ii) *The residual this lane exists to close, still open at any indent but four:* the filter greps were pinned to exactly four spaces, six-space indent is valid YAML resolving to the identical mapping, and the miss fell through to `return 0` — so on the real `verify.yaml` all three gates returned **rc=0** on a `paths:`-filtered trigger written one level deeper, the exact shape this row says they refuse. It was also the one place the helper broke its own stated rule, refusing an unevaluable *shape* while silently accepting an unrecognised *indent*. Matching is now indent-agnostic within the trigger sub-block, plus the five-key allowlist above. (iii) *Inherited, not introduced:* the step disarm grep lacked the `(-[[:space:]]+)?` alternative its `run:`/`uses:` siblings in the same function had, so a step whose FIRST key is the disarm (`      - if: …`) graded **wired, argument-free and undisarmed** — measured rc=0 on the real workflow, and it hollowed out the cross-pinning this row delivers. The byte-identical regex is in `main`'s `dogfood_wiring_test.sh`, so this is a pre-existing hole closed here, not a regression. (iv) *A tokenizer that split on the wrong characters:* branch and type names were tokenised with `tr -c 'A-Za-z0-9_'`, which splits on `-` and `/`, so `branches: [main-next]`, `branches: ['release/main']` and a `- main-v2` item each yielded a `main` token and were reported as **reaching every pull request** when no PR onto main runs the workflow at all (measured rc=0 on all three). `branches: [maintenance]` reddened correctly throughout, which is precisely why this survived two reviews: only the values that contain `main` as a **substring** — the ones that look right — were broken. Tokenising on YAML's own separators fixed it in both directions (`branches-ignore: [main-next]` had been a false RED). (v) *A blind spot reproduced while fixing the complaint about it:* a block sequence written FLUSH with its key — `branches:` then `    - main`, the canonical GitHub Actions style — was misgraded, and the key allowlist added in round two turned one such case from a correct 0 into a refusal, **reddening valid structure**. Two stacked defects: the value region's indent bound never admitted an item at the key's own indent (measurable independently of the allowlist), and the allowlist counted `- main` as an unknown key. **Why a 28-row mutant matrix missed (ii) and (iii), and why the fixture set added to close that missed (v):** the round-two fixtures gave every reach and wired code a host-independent case — a real improvement — but wrote all of them at 4 or 6 spaces with sequence items indented deeper than their key, so the substitution reproduced the same indentation blind spot somewhere cheaper. Breadth of mutant SHAPES is not breadth of coverage, and neither is breadth of return CODES if every case shares one incidental style. it was broad in mutant SHAPES and narrow in CODE coverage — 3 of 6 `assent_pr_reach` codes and 2 of 8 `assent_step_wired` codes had a host-independent fixture, and both defects lived in the uncovered ones. Every code now has one, the filter fixtures deliberately written at a non-4-space indent, and in flush block-sequence style as well after (v). **The helper is graded too, not only the workflows it reads:** every mutation control mutates `verify.yaml` and asks the helper about it, which cannot tell a working helper from a stubbed one — with the helper now a single point of failure for all three gates, replacing `assent_pr_reach` with `return 0` would turn them all green at once. Two of the gates therefore also drive it against **from-scratch fixture workflows** whose right answer depends on nothing under `.github/workflows/**` (verified: the stub reds them by name). Revert: delete `hack/lib/pr_reach.sh` and restore the three gates' local readers — which restores the `paths:`-filtered bypass, the self-only pinning, and the misreport. |
 | D-158 | 2026-08-23 | **CI-TOOLCHAIN — `verify` was red on every PR from a golangci-lint/Go skew; the remedy is to bump `GOLANGCI_LINT_VERSION` v2.12.2 → v2.13.1 and KEEP `go-version: stable`.** Symptom: PR #85, a six-file Markdown diff with **zero Go bytes**, failed `verify` with `/opt/hostedtoolcache/go/1.27.0/x64/src/crypto/internal/randutil/randutil.go:11:2: could not import math/rand/v2 (… method must have no type parameters) (typecheck)` — the failing path is inside the **Go toolchain's own source tree**, so no author change can fix it and re-running cannot clear it. `Analyze (go)`, `Analyze (actions)` and `CodeQL` all passed on the same run: the tree compiles clean under Go 1.27, only the linter chokes. **Mechanism**: golangci-lint typechecks the standard library with the `go/types` it was **compiled with**, not the `go` on `PATH`. GitHub's `stable` rolled 1.26 → 1.27.0 between this repo's last green `main` run (2026-08-19) and 2026-08-23; the v2.12.2 release binary is built with go1.26.x and cannot read the 1.27 stdlib. **Reproduced locally, not reasoned** (Go 1.27.0 SDK on `PATH`, `GOTOOLCHAIN=local`, whole tree): v2.12.2 → **panic** in `pkg/goanalysis/runner_loadingpackage.go:335` inside `go/types.(*Checker).Files`, exit 2; official v2.13.1 asset (`built with go1.27.0`) → **0 issues**, exit 0; `golangci-lint config verify` → exit 0, so the v2 config schema in `.golangci.yml` needs no migration; v2.13.1 also → **0 issues** against local Go 1.26.6, so the bump is safe for contributors who have not moved; and `go install …@v2.13.1` under Go 1.27.0 → 0 issues, which is the **`release-exitgate`** path (that job builds the binary rather than using the action, and `if: github.event_name != 'pull_request'` / RELSE-08 means no PR ever exercises it). **Diagnosis heuristic worth keeping**: golangci-lint's `go.mod` carries the comment *"the minimum Go version must always be latest-1"*, so its `go` directive is a machine-readable "supports Go 1.N+1" signal — v2.12.2 says `go 1.25.0` (supports ≤1.26), v2.13.1 says `go 1.26.0` (supports ≤1.27), and upstream commit `42a0530` in v2.13.0 is literally "go1.27 support". **Options considered.** (A) *bump the linter* — CHOSEN: treats the root cause, is a **one-line** diff because the version is single-sourced at workflow scope (D-128), fixes BOTH exposed sites (the `golangci-lint-action` in `verify` and the `go install` in `release-exitgate`) at once, and the risk it carried — new findings from a newer linter blocking every merge, since `golangci-lint` runs inside `task lint` inside `task check` — was **measured at zero** on the whole tree under both Go versions. (B) *pin `go-version: 1.26.x`* — REJECTED as the primary: it needs two pins (`verify.yaml:56` and `:171`), leaves the class of bug live, undercuts the stated reason `stable` is there (`# govulncheck needs it`, with `setup-go` exporting `GOTOOLCHAIN=local` so a pinned toolchain can fail to `go run` a tool whose module requires a newer Go — unverified, and moot under (A)), and trades a loud recurrence for **silent indefinite drift onto an unsupported Go** in a repo whose posture is govulncheck + cosign + SLSA + Scorecard. (C) *both* — REJECTED as gold-plating: (A) alone is measured green, and a second simultaneous remedy would make a still-red PR ambiguous. **Per-file sweep of `go-version: stable`, stated rather than silently skipped:** `verify.yaml:56` and `:171` were the only exposed sites and are fixed by the env bump without touching either line; `schemas.yml:57` (runs `go test` + ajv, no linter), `vulncheck.yaml:30` (govulncheck only — `stable` is actively *desirable* there) and `codeql.yaml:45` (CodeQL, which passed on 1.27.0) carry no golangci-lint and are NOT exposed; `release.yaml` uses `go-version-file: go.mod` and is unaffected. `hack/lint/workflow_pins_test.sh` asserts `TASK_VERSION`, action SHA pins and step wiring but **not** `go-version` or `GOLANGCI_LINT_VERSION`; it passes on this change. **Revert is (B), not bare v2.12.2** — reverting the env line alone restores a known-red state: revert = `GOLANGCI_LINT_VERSION` back to `v2.12.2` **and** pin `verify.yaml:56` + `:171` to `go-version: 1.26.x`. **Residual risk, stated plainly:** when `stable` rolls to Go 1.28, v2.13.1 breaks identically. The repo finds out because `verify` reds on **every** PR including zero-Go diffs — loud and immediate, with the signature recorded in `verify.yaml`'s env comment and the fix being one env line. Nothing detects it *earlier*: dependabot's `github-actions` ecosystem updates `uses:` refs, not `env:` literals (backlog `CI-TOOLCHAIN-F01`). Accepted on purpose over (B)'s failure mode. Note also the pre-existing local/CI linter skew — `Taskfile.yml`'s `lint` task is bare `golangci-lint run ./...` against whatever binary a contributor has installed, so this pin has never governed local `task check`; deliberately not changed here (that file was owned by a concurrent lane). |
 | D-159 | 2026-08-23 | **ORPHAN — `release-verify-test` was a gate invoked by nothing (D-124 again), and it is wired into `task check` in its three OFFLINE modes, not its default `all`.** Finding: `Taskfile.yml` defined `release-verify-test` — the **only** test of `hack/release/verify-artifacts.sh` — and no caller existed anywhere: not `check:`, not `CHECK_STAGES` in `hack/audit/exitgate_test.sh`, not `.github/workflows/**`, not the push-only `release-exitgate`. That script is not incidental: **`SECURITY.md:61` publishes it as the procedure release consumers run** to check artifact checksums, the stamped `assent version` and cosign signatures, and D-153/AUD2-F01 had just proved that published verification instructions rot silently. Measured before fixing, as the lane required: the gate was **green**, so this is a wiring defect only — nothing was being papered over. **Why not the `all` default.** `verify_test.sh` with no argument adds `test_snapshot_pass`, which shells out to `task release-snapshot`: `go install github.com/goreleaser/goreleaser/v2@…` on any machine without it (**network**, in a gate that runs before every commit), a `before: hooks: go mod tidy` that **rewrites `go.mod`/`go.sum` in the middle of `task check`**, `--clean` on the developer's `dist/`, and a five-target cross-compile (10s here with warm caches and goreleaser already installed; minutes cold). A flaky or network-bound stage is worse than a missing one, so `check:` runs `negative`, `cosign-skip-when-absent` and `readme` — REQ-E9-S12-02/03/04, all offline, together well under a second. **Consequence, stated precisely: REQ-E9-S12-01 (the real snapshot→verify round trip) is not gated per-commit in `task check`; it runs in push-only CI via `hack/release/exitgate_test.sh:33-34` (the `release-exitgate` job, `if: github.event_name != 'pull_request'`) — automated but not PR-visible, i.e. the RELSE-08 blind spot.** Those two lines are literally `task release-snapshot` then `task release-verify`, which is the `Verify:` string the spec gives the requirement (`openspec/specs/p5-e9-distribution/spec.md:441-442`), so nothing here needs a new gate built — an earlier draft of this row claimed the requirement was covered by no automation at all, which was false, and acting on it would have meant a future lane duplicating `exitgate_test.sh:33-34`. What this lane declines to do is move that L1 round trip into a per-commit gate: it cannot be, for the network/`go mod tidy`/`--clean` reasons above. Narrowing the RELSE-08 exposure for this requirement is a separate question from D-159. **Pinning.** `CHECK_STAGES` goes 20 → 21 in the same commit as the `check:` line (the AUD-S18/RELSE-08 lockstep), and `STAGE_BODY_PINS` pins the body **per mode** rather than by the bare script path — a single `bash hack/release/verify_test.sh` pin would stay green if two modes were dropped *and* if the stage were reverted to the unrunnable-in-check default. Three mutation controls prove it: deleting the `check:` line reds `check_check_wiring` by stage name, gutting one of the three modes reds `check_stage_bodies` while the other two still run, and the same deletion applied to the real tree reds the real gate at rc=1. **Also fixed, minimally, because wiring made it matter:** `verify_test.sh` wrote its captured stdout/stderr to fixed `/tmp/verify-{tamper,nosig}.{out,err}` and then **grepped** them; harmless while nothing ran it, but this repo runs several lane worktrees whose `task check` invocations overlap, and a concurrent run truncating `/tmp/verify-nosig.err` at open would fail the other run's `skip.*cosign` grep spuriously. Scratch files now live in each run's own `mktemp -d` (invisible to `verify-artifacts.sh`, which globs only `*.tar.gz`/`*.zip`) and are removed by the existing `RETURN` trap. |
 | D-160 | 2026-08-23 | **UNIV-COSIGN — the cosign signer-pin gate asserted an EXISTENTIAL property where the guarantee it publishes is UNIVERSAL, so it certified nothing about a file's second `cosign verify-blob`; `hack/release/install_cosign_pin_test.sh` now grades EVERY invocation in ALL THREE published files, statically and at runtime.** Substance first, and measured before anything was written: a scratch copy of each graded file with a **second, unpinned** `cosign verify-blob` spliced IN-BODY next to its real invocation (the splice shape matters — see UC-04 below) ran the gate to **exit 0** — `hack/install.sh` rc=0, `SECURITY.md` rc=0, `hack/release/verify-artifacts.sh` rc=0, the last of these being the shape a reviewer had already demonstrated on an earlier lane. **Every individual assertion in that gate was sound.** `has_flag` grepped the whole folded extraction, so a pinned sibling satisfied it; `one_value`'s `sort -u` collapsed two agreeing values to one, so the D-153 drift comparison saw a consistent file; section 0 **printed** the extracted invocation count and asserted nothing about it; and 4b/5d's stub-log checks were positive-only greps, i.e. the same existential shape at runtime, where a second unpinned call leaves the pinned call's log line intact. The conjunction of sound existential assertions is still an existential assertion. **This is the AUD2-S05 quorum defect one layer out: not a wrong assertion, a wrong quantifier**, and it predates both AUD2-S03 and AUD2-F01. **`SECURITY.md` was worse than the other two** — it fed only the drift comparison and had **no invocation-level grading at all**, so an unpinned recipe published to adopters was invisible to the gate that exists to police the recipe. **Property chosen: "every `cosign verify-blob` invocation in every graded file carries `--certificate-oidc-issuer`, `--certificate-identity-regexp` and `--bundle`, EACH WITH SECURITY.md's published value".** The value half is not decoration: `--certificate-identity-regexp ''` carries the flag and matches every Fulcio identity ever issued, and `one_value`'s `sort -u` does not catch it either, because an empty capture is not a line and the file still reports exactly one distinct value — a presence-only universal check would be the same defect one level down, so each invocation's own extracted value is compared against the published pair (reported `WRONG-VALUE[...]`, distinct from `UNPINNED[...]`). Options considered: **(a)** the remedy recorded when the finding was filed — assert the extracted invocation count is **exactly 1** per file (**REJECTED AS FACTUALLY WRONG — do not implement it in a later lane; it would red `main` on the day it lands.** `SECURITY.md` legitimately publishes **two** — one over the archive, one over `checksums.txt`, which is what covers the SBOMs listed inside it — so that assertion reds `main` on the day it lands, and the natural repair is to weaken it again); **(b)** universal quantification over invocations **(chosen)** — strictly stronger than (a) where (a) is true, and it keeps holding when a file legitimately grows a third correctly-pinned call. **Enforcement, per D-128, is one predicate**: `pin_violations <file>` prints one line per problem and nothing when the file is clean, so callers grade its OUTPUT and the identical function is asserted empty against the tree and non-empty against a mutant with no `set -e` games; `assert_all_pinned` is the thin failing wrapper; `log_unpinned_lines` is its runtime twin over the stub-cosign argv log. **Classification is fail-CLOSED, which is the part that carries the guarantee.** The candidate extractor is deliberately left un-narrowed (every non-comment line mentioning `cosign verify-blob`, continuations folded), because anything the *denominator* drops is a hole. A candidate is an invocation when the folded text begins with `cosign verify-blob`; the ONE waved-through non-invocation shape is a markdown inline-code mention (`` `cosign verify-blob` ``, which is how `SECURITY.md`'s capability table names it); **on a line carrying NO backticked mention, anything else — `foo && cosign verify-blob …`, a here-doc line, an un-backticked prose sentence — is reported UNCLASSIFIABLE rather than skipped**, because "this gate cannot tell whether that call is pinned" must never read as "that call is fine". **That scoping is not cosmetic, and the unscoped version of this sentence was FALSE (R3-01, caught by review on the round that added the honest banner).** The exemption tests whether the substring `` `cosign verify-blob` `` appears **anywhere on the line**, not whether the line is prose, and it is tested BEFORE the command-position and multi-token checks. So a line carrying a backticked mention AND one or more LIVE calls is exempted, neither graded nor refused: measured by splicing ``See `cosign verify-blob`: cosign verify-blob --bundle A.json a && cosign verify-blob --bundle EVIL.json evil`` into `SECURITY.md` — `occurrence_count` = 2 by the definition the banner itself states, `pin_violations` EMPTY, **whole gate rc=0**, while the banner reported that line among those "exempted as backticked prose". The **static** defect is not markdown-specific — splicing a live unpinned call with a trailing backticked mention into `hack/install.sh` gives candidates=2, invocations=1, `pin_violations` EMPTY — but the **whole-gate green is** markdown-specific, and the distinction is stated because a looser sentence here would itself be falsifiable: in that shell script the run reds at §4b for an unrelated RUNTIME reason (the spliced call executes and its bundle is absent), whereas `SECURITY.md` is a document with no runtime twin, which is why rc=0 survives there. Measured both ways rather than inferred from either. **Narrowing the exemption needs quote- and markdown-aware parsing — the machinery that produced UC-01/02/03 — so it is deliberately NOT patched here.** It is instead disclosed as residual (1) in the PASS banner, ahead of the variable/`eval`/fragment spellings, because it is the residual that is actually REACHABLE in these three files while those are not present in any of them. The banner also no longer labels an exempted line "prose": the branch it took is a fact, "prose" was an inference, and R3-01 is the case where that inference is wrong. **This is UC-07 doing its job on its own author:** the claim was falsifiable, it was checked, and the gate is now incomplete-and-honest rather than complete-and-wrong. Accepted cost, stated rather than discovered later: a *correctly pinned* invocation written off command position also reds. That is the intended direction of error for a security gate over three files carrying four invocations in one canonical style, and the message names the fix. **Anti-vacuity, because a lane whose entire deliverable is "make a gate stricter" is maximally exposed** (this repo's #1 review finding is an assertion that cannot fail — D-124, AUD-S18): section 2b runs **eight** mutants against **each** of the three files and 2c runs a ninth, and they were chosen for **branch** coverage of the new predicate rather than for variety of shape — (a) a second **unpinned** invocation must red, name the file, quote the offending command, and produce **exactly two** violations so the pinned siblings are provably not flagged; (b) a second **correctly pinned** invocation must stay green **and** must raise the extractor's invocation count by one, without which (b)'s green could mean "the extractor never saw it"; (c) an occurrence off command position, appended **fully pinned on purpose** so the only thing that can redden it is the classifier itself; (d) every invocation deleted → `NO-CANDIDATES`; (e) the continuation fold broken → `FOLD-BROKEN`, asserted **not** to also report `UNPINNED`, because conflating "the extractor truncated this" with "the pin is missing" sends the next maintainer to the wrong file; (f) every invocation displaced off command position → `NO-INVOCATIONS`; (g) a second invocation carrying both flags with an **empty** identity regexp → `WRONG-VALUE`, the hostile shape a presence-only check waves through; (h) a second invocation carrying both flags with a **foreign OIDC issuer** → `WRONG-VALUE` on the issuer half; and 2c strips the backticks from `SECURITY.md`'s prose mention and requires the same row to fail closed, proving the exemption keys on the backticks and is not a blanket bypass. The runtime twin has its own vacuity control (an unpinned line appended to a copy of the stub log must be seen). **One real defect was caught by this section during the lane and is recorded because it is a trap for the next author**: `log_unpinned_lines` was first written with `awk -v id="identity_re=${sec_identity}"`, and **awk processes escape sequences in a `-v` assignment**, so the pin's `github\.com` arrived as `github.com` and matched nothing; the values now reach awk through `ENVIRON`. **Stated limit, same posture as D-154's**: the denominator is the literal string `cosign verify-blob`, so an invocation spelled through a variable (`"$COSIGN" verify-blob …`), built by `eval`, or assembled from fragments is invisible to this gate. Widening the trigger to bare `verify-blob` was considered and **rejected** — it buys one hypothetical no file uses, and turns any future `SECURITY.md` sentence saying "verify-blob" outside backticks into a red gate, whose repair would be to loosen the classifier. **Nothing outside the gate changed**: `hack/install.sh`, `SECURITY.md` and `hack/release/verify-artifacts.sh` are byte-unchanged, and all four of their invocations were already pinned — this row closes a hole in the *checker*, not in the checked. The stage `release-install-cosign-pin-test` was already wired into `task check` and pinned in `hack/audit/exitgate_test.sh`'s `CHECK_STAGES`, so no wiring changed either. **SECOND ROUND — the first version of this fix REPRODUCED the very defect it closes, one level down, and independent review caught it before merge.** `has_flag` grepped the whole FILE; the replacement grepped the whole LINE. Both are existential; only the scope shrank. **UC-01**: one folded line was graded as at most ONE invocation, so `cosign verify-blob <both pins> --bundle a.json a && cosign verify-blob --bundle EVIL.json evil` began with `cosign verify-blob` (not UNCLASSIFIABLE), carried `--bundle` (not FOLD-BROKEN), carried both flag strings (not UNPINNED) and yielded the published values (not WRONG-VALUE) — **green**, in same-line, `;`-separated and backslash-folded forms, on all three graded files. Worse, the **full gate exited 0** for `SECURITY.md`: the two shell scripts were incidentally caught by the runtime twin (`log_unpinned_lines` at §5d), but **SECURITY.md is a document and has no runtime twin**, so the hole was unmitigated precisely on the file this row calls "the copy-paste recipe adopters run by hand" — D-153's exact incident class — while the gate printed "EVERY cosign verify-blob invocation ... is pinned", false as printed. The stated-limit paragraph did not cover it: it enumerated `$COSIGN`, `eval` and fragments, not `&&` chaining, and **leading** `&&` was explicitly handled (mutant (c) → UNCLASSIFIABLE), so the operator had been considered and only one side handled. Closed by grading per **OCCURRENCE** (`occurrence_count` + a new `MULTI-OCCURRENCE` violation that fails closed on any line carrying two calls) rather than per line; counting inside an already-triggered line uses the shorter `verify-blob`, so a second call spelled `cosign  verify-blob` or `"$COSIGN" verify-blob` and chained onto a pinned one is caught too, which the literal file-level trigger would miss. **UC-02**: `extract_issuer`/`extract_identity` anchor on a greedy `.*`, so the LAST value on a line wins — a hostile `--certificate-identity-regexp ''` placed FIRST was masked by a correct value placed second, **the extraction direction favoured the attacker**. Closed by `flag_value_tokens`, which returns EVERY value of every flag on the occurrence; each must equal the published one, so a repeated flag with an empty value first now reds. **UC-03 (P2, the erosion path)**: a CORRECTLY pinned call written with **double quotes** was refused as `WRONG-VALUE ... identity=<empty/unparsable> ... (an empty regexp matches every Fulcio identity)` — a true refusal with a **false reason**, and the repair a maintainer reaches for on that message is widening the extractor. Both quote styles are now accepted (double quotes are correct shell for this value: it contains no `$` and no backtick), and a **bare** value is diagnosed as `UNQUOTED-VALUE`, a QUOTING defect, never as a wrong or empty one — a gate that misdiagnoses erodes faster than one that refuses. **UC-04**: this row's "rc=0, rc=0, rc=0" reproduction figure is **splice-shape-sensitive** and is stated as measured: it holds for a second unpinned call spliced **in-body** next to the real one. An EOF-appended mutant reds the two shell scripts for an unrelated runtime reason, so the figure should not be read as holding for any second unpinned call. The same sensitivity is why the UC-03 double-quoted mutant reds the two scripts through the full gate (the spliced call actually RUNS and its fixture bundle is absent) while `SECURITY.md`, having no runtime, is the clean end-to-end proof at rc=0. The classifier's fail-closed posture on off-command-position occurrences was independently adjudicated KEEP, since §2c proves the prose exemption keys on the backticks and cannot be widened silently. **The lesson, recorded because it is the whole point of the lane:** a fix for an existential-where-universal defect is itself maximally exposed to the same defect at the next scope down — file, then line, then occurrence — and the only thing that caught it was a reviewer building the chained-call mutant that neither the 20-row external matrix nor the 25 in-gate mutants contained. **THIRD ROUND (UC-05..UC-09), and the reason this row now reads the way it does.** **UC-05**: `occurrence_count` compared whitespace-delimited fields to `verify-blob`, found one, and concluded **singularity** — when all it had established is that it did not find a second. `cosign "verify-blob"`, `cosign 'verify-blob'` and `cosign verify-blob""` are the same command to the shell, and each hid a chained unpinned call from the count. Measured against the round-2 gate on **all three** files at whole-gate level: **rc=0, rc=0, rc=0** — worse than first reported, because `A && B` short-circuits and `set -e` does **not** fire on a non-final member of an AND-list, so even the two shell scripts' runtime twin missed it. Closed by stripping shell quotes before the field compare, which is **a spelling patch, not a terminator, and is labelled as one in the code**. A structural terminator was sought and **ruled out with evidence**: refusing any graded line carrying a command separator would red the REAL files, since `hack/install.sh` and `hack/release/verify-artifacts.sh` both legitimately end their genuine invocation with an or-else `die` tail. **No structural terminator exists for this gate**, so completeness is not available and must not be claimed. **UC-07 is therefore the durable fix, and it is a change of posture rather than of logic.** The `PASS:` banner was printed unconditionally and asserted "EVERY cosign verify-blob OCCURRENCE ... is pinned" plus "a second unpinned call reddens whether it sits on its own line or is chained onto a pinned one" — a **universal claim bound to no assertion**. Under UC-05 that banner did not merely overstate: on a green run it printed something **false**, which is strictly worse than printing nothing, and it is this repo's #1 defect class (an assertion that cannot fail) wearing a different hat. The banner now reports **OBSERVED** counts per file (occurrences found, classified-and-graded, prose-exempt, refused), lists **ASSERTED** properties each of which is shown to fail on a mutant, and states the **NOT ASSERTED** residual in the same breath: this gate finds calls by a literal string and counts quote-stripped words, so a call spelled through a variable, `eval`, or fragments is not seen and not graded, and the counts are what was classified — **not a proof that nothing else exists**. When a fifth spelling turns up, the gate is then **incomplete rather than wrong**, and incomplete is recoverable. **UC-06**: a TRAILING comment mentioning `verify-blob` fired `MULTI-OCCURRENCE: … has 2 verify-blob calls chained on ONE line` — fail-closed but **false as printed**, since `cosign_candidates` only drops lines whose FIRST non-space character is `#`. That is the UC-03 misdiagnosis shape recurring **inside the UC-01 fix**. The message now says TOKENS, names both possible causes, and names the correct repair; excluding trailing comments was rejected as it needs quote-aware parsing, which is the machinery that produced UC-01/02/03. **UC-08**: `shellcheck` SC1087 ×2 (error severity) on `flag_value_tokens` — `"$flag[[:space:]]…"` parses as an array subscript; `${flag}` silences it. Cosmetic: no shellcheck gate exists in this repo. **UC-09**: two stage-count figures reported during this lane ("25", then "28") were **both wrong** and neither came from a committed file — they counted `task: [` lines in a run LOG, which includes nested task invocations. Measured: the Taskfile `check:` block has **21** `- task:` entries and `CHECK_STAGES` has **21** stage names; they agree, and both files are byte-identical to `origin/main`. There is no stage-count mismatch and this lane could not have caused one. **THE PATTERN, recorded because it is the lane's most transferable output:** four P1s, three of them the same scope error at successively finer scopes — file (`has_flag`), line (round 1), then occurrence-spelling (round 2) — each found by review and none by the author's own mutant matrix, because each matrix was built from the shape the previous round had just learned. The general lesson is not "add another spelling": it is that **when a gate's denominator cannot be made provably complete, the gate must report what it classified instead of asserting what exists.** That is now enforced where it is hardest to ignore, in the banner the gate prints on every green run. Revert: restore `has_flag`, drop the per-occurrence grading and the per-invocation value comparison, and restore the two positive-only stub-log greps — which returns the gate to certifying that *some* cosign call in each file is pinned, a property that is compatible with an unpinned one sitting beside it. |
diff --git a/hack/examples/dogfood_wiring_test.sh b/hack/examples/dogfood_wiring_test.sh
index 5eb0b0a0..9a46f108 100755
--- a/hack/examples/dogfood_wiring_test.sh
+++ b/hack/examples/dogfood_wiring_test.sh
@@ -593,6 +593,117 @@ FIX
 )"
 helper_wired_is 8 "$m" "$SELF_REL" "a step whose FIRST key is 'continue-on-error:' is DISARMED (G3-02)"
 
+# G3R-01/G3R-02/G3R-03 — the shapes the round-2 fixture set still could not
+# see. Round 2 closed the CODE-coverage complaint (every reach and wired code
+# got a fixture) but wrote every one of them at 4 or 6 spaces with sequence
+# items indented DEEPER than their key, so it reproduced the same indentation
+# blind spot somewhere cheaper. FLUSH block sequences — the canonical GitHub
+# Actions style, item at the same indent as the key — are covered here, in both
+# polarities, because that is the style a maintainer is most likely to write.
+V="$(helper_fixture reach-flush-legit <<'FIX'
+name: f
+on:
+  pull_request:
+    types:
+    - opened
+    - synchronize
+    - reopened
+    - ready_for_review
+    branches:
+    - main
+jobs: {}
+FIX
+)"
+helper_reach_is 0 "$V" "a FULLY legitimate trigger with both filters as FLUSH block sequences is accepted (G3R-01 — this returned 10, refusing valid structure, and 12 before the allowlist existed)"
+
+V="$(helper_fixture reach-flush-bi-legit <<'FIX'
+name: f
+on:
+  pull_request:
+    branches-ignore:
+    - gh-pages
+jobs: {}
+FIX
+)"
+helper_reach_is 0 "$V" "branches-ignore: as a FLUSH block sequence sparing main is accepted (G3R-01 — the case the key allowlist actively BROKE: 0 before it, 10 after)"
+
+V="$(helper_fixture reach-flush-bad <<'FIX'
+name: f
+on:
+  pull_request:
+    branches:
+    - release
+jobs: {}
+FIX
+)"
+helper_reach_is 13 "$V" "a FLUSH branches: that excludes main still reds — the fix reads flush sequences, it does not wave them through"
+
+V="$(helper_fixture reach-substring-branch <<'FIX'
+name: f
+on:
+  pull_request:
+    branches: [main-next]
+jobs: {}
+FIX
+)"
+helper_reach_is 13 "$V" "branches: [main-next] excludes main (G3R-02 — the tokenizer split on '-', yielded a 'main' token, and reported 'runs on every PR' for a filter under which no PR onto main runs it)"
+
+V="$(helper_fixture reach-substring-path <<'FIX'
+name: f
+on:
+  pull_request:
+    branches: ['release/main']
+jobs: {}
+FIX
+)"
+helper_reach_is 13 "$V" "branches: ['release/main'] excludes main — same defect through '/' (G3R-02)"
+
+V="$(helper_fixture reach-maintenance <<'FIX'
+name: f
+on:
+  pull_request:
+    branches: [maintenance]
+jobs: {}
+FIX
+)"
+helper_reach_is 13 "$V" "the control that kept G3R-02 hidden: [maintenance] reddened correctly all along, because only values containing 'main' as a SUBSTRING broke"
+
+V="$(helper_fixture reach-main-exact <<'FIX'
+name: f
+on:
+  pull_request:
+    branches: [main]
+jobs: {}
+FIX
+)"
+helper_reach_is 0 "$V" "…and the tokenizer fix did not make the match hostile: an exact [main] is still accepted"
+
+V="$(helper_fixture wired-bare-run <<'FIX'
+name: f
+on:
+  pull_request:
+jobs:
+  verify:
+    runs-on: ubuntu-latest
+    steps:
+      - run: bash hack/examples/dogfood_wiring_test.sh
+FIX
+)"
+helper_wired_is 0 "$V" "$SELF_REL" "a step written as a bare '- run:' with no name: is WIRED (G3R-03 — the sequence-item form verify.yaml already uses three times, which reported rc=5 'deleted, commented out': a false red with a wrong diagnosis)"
+
+V="$(helper_fixture wired-bare-run-args <<'FIX'
+name: f
+on:
+  pull_request:
+jobs:
+  verify:
+    runs-on: ubuntu-latest
+    steps:
+      - run: bash hack/examples/dogfood_wiring_test.sh --quick
+FIX
+)"
+helper_wired_is 7 "$V" "$SELF_REL" "…and the bare '- run:' form is still graded for ARGUMENTS, not merely admitted (G3R-03)"
+
 m="$(helper_fixture wired-comment <<'FIX'
 name: f
 on:
diff --git a/hack/lib/pr_reach.sh b/hack/lib/pr_reach.sh
index d02b96d3..329ca0aa 100644
--- a/hack/lib/pr_reach.sh
+++ b/hack/lib/pr_reach.sh
@@ -107,6 +107,27 @@ _assent_strip_comment() {
   sed -e 's/[[:space:]]#.*$//' -e 's/^#.*$//'
 }
 
+# _assent_yaml_tokens — split a value region into tokens on the YAML separators
+# separators (flow brackets/braces, commas, quotes, the `- ` sequence marker,
+# whitespace) and on nothing else.
+#
+# G3R-02: this replaced `tr -c 'A-Za-z0-9_' '\n'`, which ALSO split on `-` and
+# `/`. `branches: [main-next]` therefore yielded a `main` token, and a filter
+# under which NO pull request onto main runs the workflow was reported as
+# "runs on every pull request" — measured rc=0, and likewise for
+# `branches: ['release/main']` and a `- main-v2` item. `branches:
+# [maintenance]` reddened correctly the whole time, which is exactly why the
+# defect survived review: only the values that contain `main` as a SUBSTRING
+# broke, and those are the ones that look right.
+_assent_yaml_tokens() {
+  sed -e 's/^[[:space:]]*-[[:space:]]*/ /' \
+    -e 's/[][{},]/ /g' \
+    -e 's/["'"'"']/ /g' \
+    | tr '\t' ' ' \
+    | tr ' ' '\n' \
+    | grep -v '^$' || true
+}
+
 # ---------------------------------------------------------------------------
 # assent_pr_reach <workflow-file> <scratch-dir>
 #
@@ -162,7 +183,9 @@ assent_pr_reach() {
         # A flow SEQUENCE of event names. It cannot carry paths/types/branches,
         # so membership is the whole question.
         local seq
-        seq="$(printf '%s' "$onvalue" | tr -c 'A-Za-z0-9_' '\n' | grep -x 'pull_request' || true)"
+        # Same tokenizer, same reason (G3R-02): splitting on `-` would let a
+        # value that merely CONTAINS the event name satisfy an exact match.
+        seq="$(printf '%s' "$onvalue" | _assent_yaml_tokens | grep -x 'pull_request' || true)"
         if [[ -n "$seq" ]]; then
           return 0
         fi
@@ -249,7 +272,12 @@ assent_pr_reach() {
   # flags. Guessing is the wrong answer to both.
   local prkeys="$work/pr_reach.pr_keys"
   awk '
-    { if ($0 ~ /^[[:space:]]*$/ || $0 ~ /^[[:space:]]*#/) next
+    # G3R-01: a `- item` line is never a KEY, whatever its indent. A flush
+    # block sequence puts its items at the same indent as the key, so without this
+    # they were enumerated as sub-block keys, failed the allowlist and returned
+    # 10 — refusing valid, legitimate structure (and turning a pre-existing
+    # rc=0 into a red, the one case the allowlist made worse).
+    { if ($0 ~ /^[[:space:]]*$/ || $0 ~ /^[[:space:]]*#/ || $0 ~ /^[[:space:]]*-[[:space:]]/) next
       match($0, /^[ ]*/)
       if (min == 0 || RLENGTH < min) min = RLENGTH
       ind[NR] = RLENGTH; line[NR] = $0 }
@@ -333,14 +361,24 @@ _assent_key_tokens() {
     ink {
       if ($0 ~ /^[[:space:]]*$/) next
       match($0, /^[ ]*/)
-      if (RLENGTH <= ind) { ink = 0; next }
-      print
+      if (RLENGTH > ind) { print; next }
+      # G3R-01: a block sequence item may sit at the SAME INDENT as its key — the
+      # canonical GitHub Actions style, and the one every fixture in this repo
+      # happened not to use:
+      #     branches:
+      #     - main
+      # The old bound was `RLENGTH <= ind -> stop`, so the items were never
+      # read: `branches: / - main` yielded no `main` token and returned 13,
+      # "excludes main", on a filter that includes it. Measured on this file at
+      # 4d592fe, i.e. INDEPENDENTLY of the key allowlist added later.
+      if (RLENGTH == ind && $0 ~ /^[[:space:]]*-[[:space:]]/) { print; next }
+      ink = 0
     }
   ' "$blk" >"$raw"
   if [[ "$strip" == "1" ]]; then
-    _assent_strip_comment <"$raw" | tr -c 'A-Za-z0-9_' '\n' | grep -v '^$' || true
+    _assent_strip_comment <"$raw" | _assent_yaml_tokens
   else
-    tr -c 'A-Za-z0-9_' '\n' <"$raw" | grep -v '^$' || true
+    _assent_yaml_tokens <"$raw"
   fi
 }
 
@@ -431,7 +469,13 @@ assent_step_wired() {
   local re
   re="$(_assent_ere_escape "$script")"
   local cmdhits="$work/step_wired.cmd" cmdform="plain"
-  grep -nE "^[[:space:]]*run:[[:space:]]*bash[[:space:]]+${re}([[:space:]]|\$)" "$jb" >"$cmdhits" || true
+  # G3R-03: the `(-[[:space:]]+)?` alternative belongs at EVERY key-matching
+  # site, not only the disarm one. `      - run: bash <script>` — a step with no
+  # `name:`, the sequence-item form — is already the idiom used three times in
+  # the very workflow these gates read, and without this it reported rc=5,
+  # "no run: COMMAND invokes the script: deleted, commented out": a false red
+  # carrying a wrong diagnosis.
+  grep -nE "^[[:space:]]*(-[[:space:]]+)?run:[[:space:]]*bash[[:space:]]+${re}([[:space:]]|\$)" "$jb" >"$cmdhits" || true
   if [[ ! -s "$cmdhits" ]]; then
     cmdform="block"
     grep -nE "^[[:space:]]*bash[[:space:]]+${re}([[:space:]]|\$)" "$jb" >"$cmdhits" || true
@@ -528,7 +572,7 @@ assent_step_wired() {
   fi
 
   local argfree="$work/step_wired.argfree"
-  grep -nE "^[[:space:]]*(run:[[:space:]]*)?bash[[:space:]]+${re}[[:space:]]*\$" "$step" >"$argfree" || true
+  grep -nE "^[[:space:]]*(-[[:space:]]+)?(run:[[:space:]]*)?bash[[:space:]]+${re}[[:space:]]*\$" "$step" >"$argfree" || true
   if [[ ! -s "$argfree" ]]; then
     return 7
   fi
diff --git a/hack/lint/workflow_pins_test.sh b/hack/lint/workflow_pins_test.sh
index 222fdc4a..eef7e975 100755
--- a/hack/lint/workflow_pins_test.sh
+++ b/hack/lint/workflow_pins_test.sh
@@ -1266,6 +1266,117 @@ FIX
 )"
 helper_wired_is 8 "$f" "$SELF_GATE" "a step whose FIRST key is 'continue-on-error:' is DISARMED (G3-02)"
 
+# G3R-01/G3R-02/G3R-03 — the shapes the round-2 fixture set still could not
+# see. Round 2 closed the CODE-coverage complaint (every reach and wired code
+# got a fixture) but wrote every one of them at 4 or 6 spaces with sequence
+# items indented DEEPER than their key, so it reproduced the same indentation
+# blind spot somewhere cheaper. FLUSH block sequences — the canonical GitHub
+# Actions style, item at the same indent as the key — are covered here, in both
+# polarities, because that is the style a maintainer is most likely to write.
+V="$(helper_fixture reach-flush-legit <<'FIX'
+name: f
+on:
+  pull_request:
+    types:
+    - opened
+    - synchronize
+    - reopened
+    - ready_for_review
+    branches:
+    - main
+jobs: {}
+FIX
+)"
+helper_reach_is 0 "$V" "a FULLY legitimate trigger with both filters as FLUSH block sequences is accepted (G3R-01 — this returned 10, refusing valid structure, and 12 before the allowlist existed)"
+
+V="$(helper_fixture reach-flush-bi-legit <<'FIX'
+name: f
+on:
+  pull_request:
+    branches-ignore:
+    - gh-pages
+jobs: {}
+FIX
+)"
+helper_reach_is 0 "$V" "branches-ignore: as a FLUSH block sequence sparing main is accepted (G3R-01 — the case the key allowlist actively BROKE: 0 before it, 10 after)"
+
+V="$(helper_fixture reach-flush-bad <<'FIX'
+name: f
+on:
+  pull_request:
+    branches:
+    - release
+jobs: {}
+FIX
+)"
+helper_reach_is 13 "$V" "a FLUSH branches: that excludes main still reds — the fix reads flush sequences, it does not wave them through"
+
+V="$(helper_fixture reach-substring-branch <<'FIX'
+name: f
+on:
+  pull_request:
+    branches: [main-next]
+jobs: {}
+FIX
+)"
+helper_reach_is 13 "$V" "branches: [main-next] excludes main (G3R-02 — the tokenizer split on '-', yielded a 'main' token, and reported 'runs on every PR' for a filter under which no PR onto main runs it)"
+
+V="$(helper_fixture reach-substring-path <<'FIX'
+name: f
+on:
+  pull_request:
+    branches: ['release/main']
+jobs: {}
+FIX
+)"
+helper_reach_is 13 "$V" "branches: ['release/main'] excludes main — same defect through '/' (G3R-02)"
+
+V="$(helper_fixture reach-maintenance <<'FIX'
+name: f
+on:
+  pull_request:
+    branches: [maintenance]
+jobs: {}
+FIX
+)"
+helper_reach_is 13 "$V" "the control that kept G3R-02 hidden: [maintenance] reddened correctly all along, because only values containing 'main' as a SUBSTRING broke"
+
+V="$(helper_fixture reach-main-exact <<'FIX'
+name: f
+on:
+  pull_request:
+    branches: [main]
+jobs: {}
+FIX
+)"
+helper_reach_is 0 "$V" "…and the tokenizer fix did not make the match hostile: an exact [main] is still accepted"
+
+V="$(helper_fixture wired-bare-run <<'FIX'
+name: f
+on:
+  pull_request:
+jobs:
+  verify:
+    runs-on: ubuntu-latest
+    steps:
+      - run: bash hack/lint/workflow_pins_test.sh
+FIX
+)"
+helper_wired_is 0 "$V" "$SELF_GATE" "a step written as a bare '- run:' with no name: is WIRED (G3R-03 — the sequence-item form verify.yaml already uses three times, which reported rc=5 'deleted, commented out': a false red with a wrong diagnosis)"
+
+V="$(helper_fixture wired-bare-run-args <<'FIX'
+name: f
+on:
+  pull_request:
+jobs:
+  verify:
+    runs-on: ubuntu-latest
+    steps:
+      - run: bash hack/lint/workflow_pins_test.sh --quick
+FIX
+)"
+helper_wired_is 7 "$V" "$SELF_GATE" "…and the bare '- run:' form is still graded for ARGUMENTS, not merely admitted (G3R-03)"
+
 f="$(helper_fixture wired-comment <<'FIX'
 name: f
 on:

From c47887b9368daa93d8bfd361b00c563e39e9fc64 Mon Sep 17 00:00:00 2001
From: Konrad Heimel <konrad.heimel@gmail.com>
Date: Sun, 23 Aug 2026 21:44:56 +0200
Subject: [PATCH 5/8] :bug: fix(ci): strip CR, and close the one fail-open
 direction by construction (D-157)

G4-01 (P1, a regression the round-3 tokenizer introduced). A single stray
CR on one `branches-ignore:` sequence item made the tokenizer emit
`main<CR>` as a whole token; `grep -qx main` missed it and the reader
returned 0, "runs on every pull request", for a trigger that EXCLUDES
main. One committed CR is enough: no .gitattributes here,
core.autocrlf=false preserves it, no gate scans workflows for CR, and a
GitHub diff renders it invisibly. CR is a YAML break character, so
`main<CR>` was never a whole token - the reader was wrong by D-157's own
"compared as WHOLE tokens" rule.

  branches-ignore: - main<CR>       13 -> 13 -> 0  -> 13   (the fail-open)
  branches: - main<CR>  (LEGIT)      0 ->  0 -> 13 ->  0   (false red)
  types: defaults, one item <CR>     0 ->  0 -> 12 ->  0   (false red)
  and every LF control unchanged.

BUT THE INSTANCE IS NOT THE POINT. Four rounds have produced six defects
of one family: a line-oriented reader inferring YAML structure from
indentation and character classes. Patching bytes one at a time was
visibly not converging, so the direction that can actually hurt is closed
structurally instead.

Every filter test here is "must CONTAIN token X" - types must carry
GitHub's defaults, branches must carry main - except ONE:
`branches-ignore:` is "must NOT contain". A misread drops or mangles a
token, so every must-CONTAIN test goes RED; the CR bug's other two
symptoms were exactly that. Only the must-NOT-contain test turns a
mangled token into a silent PASS. So the burden is inverted there: a
token carrying any byte outside the git-ref/glob set (plus `#`, since
that key alone keeps comment residue by G3-04's design) is now REFUSED
rather than searched. A future tokenizer defect on that key yields a red
or a refusal, never a silent accept - by construction, not enumeration.

A real YAML parse was evaluated and rejected on MEASURED evidence, not
assumed. python3 is an established dependency but
hack/validate-schemas-stock.sh uses `json` only, which is stdlib; PyYAML
is established nowhere here. Decisively, hack/audit/README.md publishes
`docker run ... debian:stable-slim bash hack/audit/aud2_exitgate_test.sh
--text-only` as the offline verification path, and that image measures
NO python3 and NO yq - while both that gate (51 controls) and
workflow_pins_test.sh were measured green inside it with this helper
sourced. A PyYAML reader would break a published operator path and
violate this file's no-toolchain contract (it runs before setup-go). Go
is absent from that image for the same reason.

So the reader stays a heuristic and its bound is now written into the
header rather than implied: what it reads, what it refuses, what it does
not read - and the argument that the safety property does not depend on
that list being complete.

Fixtures: CR cases at every _assent_key_tokens consumer in BOTH
polarities, built with printf so the CR is a real byte, plus the
unreadable-token refusal. 20 before/after rows across four tips, 0
mismatches. G4-06: the GATES3 backlog row now narrates rounds 3-4.
CONTROL_FLOOR unchanged at 57/51.
---
 docs/decisions/decisions.md          |   2 +-
 hack/examples/dogfood_wiring_test.sh |  56 +++++++++++++++
 hack/lib/pr_reach.sh                 | 102 ++++++++++++++++++++++++---
 hack/lint/workflow_pins_test.sh      |  56 +++++++++++++++
 openspec/specs/backlog.md            |   1 +
 5 files changed, 205 insertions(+), 12 deletions(-)

diff --git a/docs/decisions/decisions.md b/docs/decisions/decisions.md
index 0c6951c2..035e6709 100644
--- a/docs/decisions/decisions.md
+++ b/docs/decisions/decisions.md
@@ -160,7 +160,7 @@ project/process decisions.
 | D-153 | 2026-08-19 | **The cosign signer-identity pin published in `SECURITY.md` was WRONG, not merely missing from `hack/install.sh`: the identity regexp is widened to `^https://github\.com/PlatformRelay/[Aa]ssent/` in both files (AUD2-S03 / SEC-03).** Substance first: `SECURITY.md`'s "Verify a tagged release" instructions pinned `--certificate-identity-regexp '^https://github.com/PlatformRelay/assent/'`, and an adopter who followed them on **v0.2.0 or v0.3.0 got a verification FAILURE on a genuine, correctly signed artifact** — the published recipe has been broken for every release since v0.2.0, and the natural reading of that failure is "this release was tampered with". Cause: the repository was renamed `PlatformRelay/assent` → `PlatformRelay/Assent` between v0.1.0 and v0.2.0; the keyless signing certificate's Subject Alternative Name carries GitHub's canonical casing; cosign compiles `--certificate-identity-regexp` as a Go RE2 pattern and matches it **case-sensitively**. Decoded from the published bundles: v0.3.0 and v0.2.0 sign as `https://github.com/PlatformRelay/Assent/.github/workflows/release.yaml@refs/tags/vX.Y.Z`, v0.1.0 as `https://github.com/PlatformRelay/assent/.github/workflows/release.yaml@refs/heads/main`. All three verify under the new value; independently re-confirmed with real cosign against the real v0.3.0 artifact (`Verified OK` under the new pin, exit 1 "expected SAN value to match regex" under the old). Options considered: **(a)** ship the pin byte-identical to the published-but-broken value and file the breakage as a follow-up (rejected — it would land a green gate asserting a guarantee that fails closed on this project's own releases, D-124's defect one level up); **(b)** case-insensitive `(?i)` (rejected — wider than the defect and it silently accepts casings GitHub never issues); **(c)** an explicit `[Aa]` class in both files, dots escaped (chosen). Not widened otherwise: the `^` anchor and the owner/repo scope stand, so another owner, an `assent-mirror` typosquat, another forge and an unescaped-dot host all still fail. Enforcement, per D-128: **one** published truth — `hack/release/install_cosign_pin_test.sh` extracts the pair from `hack/install.sh` and `SECURITY.md`, requires exactly one distinct value per file, reddens on drift, and (this is the assertion that would have caught the defect) matches the pin against the three **real** SANs above, committed as offline fixtures, plus six negatives. Extends D-110 (bundles beside archives) and D-109; the maintainer-path twin at `hack/release/verify-artifacts.sh:124` is still unpinned and is tracked in the backlog, not fixed here. Revert: restore `'^https://github.com/PlatformRelay/assent/'` in both files — which re-breaks verification of v0.2.0 and every later release, so revert only together with a repo rename back to lowercase. |
 | D-154 | 2026-08-23 | **Every `hack/**` script that uses a bash 4+ feature declares a PER-SCRIPT version floor via the shared `hack/lib/require-bash.sh`, because one of them was a silent local FAIL-OPEN under stock macOS bash 3.2 (BASH32-F01).** Substance first: `/bin/bash hack/docs/truthlag_pins_test.sh` on macOS printed 20 `PASS` lines, died at its `declare -A ex_s09_prefix_hint=(…)`, never printed its final `OK: all truth-lag pins green` banner — and **exited 0**. Its caller `task docs-gates`, and therefore `task check`, read that as a green gate, and AGENTS.md rule 4 makes a green local `task check` a per-commit precondition; CI is ubuntu/bash 5, so nothing merges through this path, which is precisely why it survived. Mechanism, measured on bash 3.2.57: 3.2 has no associative arrays, so under `set -u` it re-reads `declare -A x=([k]=v)` as an INDEXED array assignment and evaluates the subscript `k` **arithmetically**, hitting "unbound variable"; the shell terminates the script and the exit status is 0. Two theories were disproved en route and are recorded so they are not re-explored: the `trap … EXIT` status-swallow (3.2 propagates 1 through an EXIT trap correctly) and `set -e` (the script runs `set -uo pipefail`). The other two affected scripts fail CLOSED, but only incidentally: `hack/release/verify-artifacts.sh:202`'s literal is EMPTY, so there is no subscript to evaluate and it degrades to `declare: -A: invalid option`, which its `set -e` turns into exit 2 (measured with a `--dist` that reaches line 202 — an unreachable dist exits 1 much earlier); `hack/validate-schemas-stock.sh`'s `mapfile` degrades to "command not found" and it exits 1. Populating an empty literal or dropping `-e` silently converts a closed failure into the open one, so "how this construct happens to degrade" is not a guarantee worth depending on. Options considered: **(a)** one blanket repo-wide floor (rejected — the binding minimum differs per feature: `declare -A` 4.0, `local -n` 4.3, `mapfile -d ''` 4.4; a blanket floor both refuses shells that could run the 4.0 gates and hides which feature actually binds); **(b)** rewrite the three scripts to be 3.2-compatible (rejected — associative arrays and `mapfile` are the right tools here, a rewrite is a large risky change to scripts whose correctness IS the product, and it does nothing about the next gate author); **(c)** copy the existing inline `BASH_VERSINFO` guard from `hack/audit/aud2_exitgate_test.sh:71` into each script (rejected as the *only* measure — it duplicates the explanation three more times and still leaves the next author to rediscover the hazard); **(d) chosen** — a shared `require_bash <major>[.<minor>] <feature>` helper, called with each script's own correct floor (4.0 / 4.0 / 4.4), plus a meta-gate. Enforcement, per D-128, is one place: `hack/lint/bash_version_guard_test.sh`, wired as `task check` stage **20** and pinned in `hack/audit/exitgate_test.sh`'s `CHECK_STAGES` in the same commit. It scans every `hack/**/*.sh` for command-position bash 4+ constructs, requires a guard on each, requires the declared floor to be at least the feature's own minimum, and — the assertion that makes the rest non-vacuous — requires the scan to still find all four known feature-using files, so a typo in a detection pattern reds instead of quietly matching nothing. Its own negative control mutates real copies of the three scripts with the guard lines stripped and asserts they are flagged. `hack/audit/aud2_exitgate_test.sh` keeps its inline guard and is accepted by the gate as guarded; adopting the helper there is a follow-up, not this lane. Stated limits: the gate sees only command-position constructs in `hack/**/*.sh` (not `eval`, dynamically built command names, case-modification expansions, or scripts outside `hack/`), and the exit-0 control needs a real bash 3.2 — present on macOS, absent on CI ubuntu, where it SKIPs **loudly** rather than passing silently. Accepted behaviour change: under 3.2, `hack/release/verify-artifacts.sh --help` now refuses instead of printing usage. Revert: delete the guard calls — `task check` then silently stops certifying the docs truth-lag pins for every contributor whose `bash` is 3.2. |
 | D-156 | 2026-08-23 | **The tier-1 (CEL) ceiling is recorded (`docs/planning/rego-tier-ceiling.md`, E11-S01 / REQ-E11-S01-01+02) and it NARROWS E11: two of the four named shapes are struck outright and a third in part.** Substance first: of multi-pass / cross-manifest / set-difference / graph-relationship (`openspec/specs/later-phases.md:284`), **cross-manifest and set-difference are struck, the "named intermediate" half of multi-pass is struck, and only fold/aggregate-over-a-collection and in-input graph reasoning survive as justification for a second backend.** Measured against the surface this repo actually binds — `internal/core/aggregate/evaluate.go` `newEvalEnv`, eleven frozen predicate-scope variables, **zero extension libraries** — reproduced in a nested throwaway module pinned to the repo's `cel-go v0.31.0` (root `go.mod`/`go.sum` byte-unchanged; nothing added to the dependency graph, which judgment call (d) has not authorised). **What exceeds tier 1: (1) folds.** `sum`, `reduce`, `math.*` and `lists.*` are all `undeclared reference`; `size()` is the only aggregate in the surface, so a rule counting matched changes is expressible and a rule summing a numeric delta across them is not. **(2) Graph reasoning** — the iteration count of a CEL expression cannot be made data-dependent, so depth is syntactic and **unbounded** reachability has no spelling; a bounded `k`-hop form *is* writable and answers a fixed-depth question, not the rule (detailed below, with the refutations of two sharper claims this row previously made). **What is struck, with the CEL that does the job:** registry membership — `string(new) in facts.registry.topics.value` over a `cardinality: set` fact, already shipped green at `examples/packs/service-catalog/.assent/packs/catalog/rules/ownership.yaml:21`; keyed attribute lookup — either a purpose-built provider (`builtin/resource-owner`, exercised in both polarities by `examples/archetypes/referenced-resource-ownership/`) or `facts.<p>.<n>.value[key].field`, which compiles and is lint-clean because `internal/lint/facts_ref.go`'s D-051 shape check permits arbitrary navigation past `.value` and only forbids indexing `facts` itself; set difference — `oldEntry.acls.filter(a, !(a in entry.acls)).size() == 0`; named intermediates — no `cel.bind`, but re-deriving the sub-expression inside each leaf is semantically identical and compiles. **The sharpest finding is a distinction, not a rule:** same-changeset **cross-file** reasoning fails for **input availability**, not expressiveness — the evaluation unit is one file (`change.ChangeSet` is documented "for one file", `internal/change/diff.go:129`; `assent run` strips one `--subject file:<path>`, `cmd/assent/run.go:266`, and diffs it alone, `:293`) and **REQ-E11-S05-01 pins the Rego module to the identical `EvaluationInput`** with the tier fenced to "declared data, no I/O". **A Rego module therefore fails that rule identically, so it is struck from E11's justification too** — the fix is an input decision, which E11's non-goals fence, not a backend decision. Corroborating: the one committed illustration of the escape hatch, `examples/policies/rego/bounded_change.rego`, is **entirely tier-1 expressible** — both `violations` rules are per-change predicates and `examples/policies/declarative/bounded-change.yaml` is the same rule already in the envelope. **The strongest single piece of evidence, and the one that sizes the epic, is the graph shape.** On the `assent run` path document-mode `walkNode` emits a Change **only where two scalars differ** — a sequence on either side makes the whole ChangeSet **opaque → REVIEW** before any rule runs (`internal/change/diff.go`) — and collection-mode `DiffEntries` is reached only from `internal/adoptertest`, so `old`/`new`/`entry`/`oldEntry` and every `changes[i].old`/`.new` bind **scalars**. That does **not** starve a graph rule, because a flat `set` fact still carries structure: `edges: {type: string, cardinality: set}` returning `["orders|billing","billing|ledger"]` is a **fully declarable, in-contract adjacency inside `EvaluationInput` today** — the declaration is legal (`schemas/provider/v1alpha1/response.schema.json`), `fact.value` carries no JSON-Schema type constraint and `ResolveFactsChecked` cross-checks the *declaration* not the value (`internal/provider/resolve.go`), outputs are operator-authored (`internal/provider/config.go`), the `http` transport is live on the plain run path with **no `--checkout`** (`cmd/assent/provider_host.go` `providerCallFor`), and a set fact binds as a CEL list. Tier-1 CEL nonetheless cannot answer the actual question over it: **CEL has no recursion, fixpoint, fold or user-defined function, so unbounded reachability has no spelling** (`transitiveClosure` → `undeclared reference`; the four comprehension macros iterate one level and cannot call themselves). **Stated precisely, because two drafts of this record overreached and both were caught by independent review:** a *bounded* `k`-hop check **is** expressible and does **not** need the string decomposition CEL lacks — over a finite in-input candidate set (a `nodes` set fact, the same construction as `edges`), decode is replaceable by **encode-and-compare**: `nodes.value.exists(m, nodes.value.exists(n, (string(new)+"|"+m) in edges.value && (m+"|"+n) in edges.value && (n+"|"+string(new)) in edges.value))` compiles **and evaluates** under the real `cel.CostLimit(1_000_000)` to `true/true/true/false` over the fixture above, and `nodes.value.filter(m, (string(new)+"|"+m) in edges.value)` recovers an edge's far end as `[billing]`. Both primitives (`+` on strings, `in`) were already in this record's own function census, so the claim that decoding was a second independent barrier was internally inconsistent as well as false. **The real ceiling is `k`, and a third draft got its cost wrong too** — it claimed `O(|N|^(k-1)·|E|)` "exhausts the cost budget on any real graph". Wrong complexity class and wrong conclusion, because the census had omitted the surface's only value binder, `[expr].all(v, …)`: binding each BFS frontier once per level makes cost additive across levels, and measured under the real `cel.CostLimit(1_000_000)` a ring `|N|=50, deg 5` costs 89,551 at `k=10`, 235,297 at `k=20` and 686,317 at `k=50` — roughly linear in `k`, and at `k=50 ≥ |N|` CEL is **not approximating at all, it decides reachability exactly**, in 69% of budget. The practical `k` collapses around `|N|≈200` (`k=10` at 46% of budget, `k=20` exceeds). Recorded because a reader sizing this epic is entitled to ask "would CEL suffice for *our* graph?" and the previous sentence foreclosed that question with an assertion measurement refutes; it is **not** offered as a second reason. **What carries the verdict is one property, now measured rather than recalled: the iteration count of a tier-1 CEL expression cannot be made data-dependent.** `reduce`, `transformList`, `transformMap`, two-var `all(i,x,…)`, `range`/`lists.range` and `cel.bind` are all `undeclared reference`; `for` is a `reserved identifier`; there is no fold, self-reference or generator; so depth is a **syntactic** property, hard-capped by cel-go's parser recursion limit of 250 (`expression recursion limit exceeded: 250` at depth 260, depth 200 still compiles). That a fixed `k` really is an approximation when the data outruns it is measured too: on a 4-cycle the `k=3` form evaluates `false` and the `k=4` form `true`. **Rego answers the unbounded question with `graph.reachable` — pure and deterministic — and that single gap is the whole justification.** **An input that is in contract and available today, over which CEL can only approximate and Rego decides, is exactly the per-rule evidence D-017's gate demanded — so E11 has TWO unconditional justifications (folds and graphs), neither waiting on any open question.** Deliverability caveat, stated because this row makes the same distinction for sub-shape B1: **no provider in the corpus ships an encoded adjacency today** — that one *can* follows from the provider contract, the same inference used to strike B1, not from a shipped example. Options considered: **(a)** record all four shapes as exceeding, the reading D-141's unlock invites (rejected — three are demonstrably expressible and an unfalsifiable ceiling claim is the defect this story exists to prevent); **(b)** strike set-difference **conditionally**, so that a narrowing answer to OQ-35 would return it to the ceiling (rejected on the second pass — both resolutions strike it: extending the entry binding makes CEL express it, narrowing makes it an input-availability failure that REQ-E11-S05-01 hands to Rego unchanged, so a conditional would have left a downstream story waiting on an answer that cannot change the verdict); **(c)** strike cross-manifest and set-difference **unconditionally**, strike half of multi-pass, keep folds and in-input graphs **both unconditionally** **(chosen)**. **Two rejected drafts are recorded because the same failure produced both, with the sign flipped, and only independent review caught either.** Draft 1 made the graph shape *contingent* on OQ-35/OQ-36 on the premise that "an adjacency needs a mapping-valued fact" — it does not; a set of encoded strings carries one inside the frozen declaration — which came from conflating a *provider-supplied catalog* (sub-shapes B1/B2, struck here as working and shipped) with **B3, which is specifically same-changeset cross-file *diffs***. It would have advised the operator to defer a 14-story epic on a premise that does not hold. Draft 2 replaced that with a second "independent reason" — that CEL cannot decode an edge, killing even a bounded two-hop check — **refuted by execution** (the encode-and-compare leaf above). Draft 3 replaced *that* with the exponential-cost claim above — **refuted by measurement**. The common cause across all three is one habit: **reaching for a second independent reason when one sufficient reason was already in hand**, and then applying an **asymmetric evidentiary standard** to protect it — accepting awkward-but-working spellings when they *struck* a shape (A2's re-derivation, B2's dynamic index) and rejecting them when they would have *narrowed* one this record wanted to keep. The verdict was right in all four drafts; the supporting argument was wrong in three. It now rests on one measured property and no supporting argument at all, which is the form it should have taken first. The correction to A2 runs the same way: the value binder `[expr].all(v, …)` removes the evaluation-cost half of A2's residual, so **A2 is struck more firmly than the first draft struck it**. Binds later stories: **S05** must not be widened to carry cross-manifest data; **S07**'s violation shape must support a fold result and a path/cycle witness, not a cross-manifest reference; **S12** must correct ADR-0002's `rego` bullet, which calls the tier an "escape hatch for **cross-entry checks**" — inaccurate for the shipped input contract; **S11** must label the unquarantined example a shape illustration, never evidence of need. **Binds E11-S04, whose denylist is not yet written: `graph.reachable` MUST be allowed**, with `split` alongside it — both pure and deterministic. `graph.reachable` is the one that carries the justification (it closes the graph at any depth); `split` is a convenience for rebuilding the adjacency. A capability set drafted from "deny anything unfamiliar" would strike out the epic's own strongest justification. Recorded in the S04 section of the epic spec, not only S01's. **That floor is held by REVIEW, not by a gate, and this row says so rather than inventing an enforcement path:** REQ-E11-S04-02's committed golden detects a *change* to the allowed set (so the sandbox cannot silently widen) and cannot detect an *omission* — a golden written without `graph.reachable` stays green forever. It says nothing about judgment call (d), since *which* builtins are callable is orthogonal to *where* the evaluator lives. Two residuals raised, neither decided, **neither gating any verdict here**, and neither the escalated rule-7 (d1)/(d2) question: **OQ-35** (the `entry`/`oldEntry` binding asymmetry — a silent `assent test` / `assent run` divergence; set-difference is struck either way and the graph shape needs no entry tree) and **OQ-36** (the frozen provider declaration has no object/map type, yet the authoring surface and `builtin/repo-file` together permit a mapping-valued fact). Also flagged, not edited (out of lane): `REQ-DEM-S05-04` calls the provider-visible tree the "merged-result checkout"; the code reads `<root>/head`, documented at `cmd/assent/checkout.go:44` as "the MERGE-REQUEST HEAD". This lane writes no Go, adds no dependency and touches no schema. Revert: delete `docs/planning/rego-tier-ceiling.md` and the D-156 narrowing text from the E11 spec — which restores an epic justified by four shapes, three of which this record shows are not real. |
-| D-157 | 2026-08-23 | **"Reaches pull requests" is now a SHARED, structural check (`hack/lib/pr_reach.sh`), the three PR-visible text gates CROSS-PIN each other's steps, and the fixed-string step check is replaced by an anchored `run:`-command match (GATES3).** Three residuals, each *demonstrated* by an independent reviewer on an earlier lane and each deliberately left unfixed there, all living in the same three files — `hack/lint/workflow_pins_test.sh`, `hack/audit/aud2_exitgate_test.sh`, `hack/examples/dogfood_wiring_test.sh`. **(1) The substantive one.** Two of the three answered "am I reachable on a PR?" with `grep -qE '^[[:space:]]+pull_request:'` over the workflow's `on:` block; a reviewer added `paths: ['internal/**']` under the trigger and measured **rc=0** — the trigger is present, the grep is satisfied, and the gate is disarmed for every PR that touches only `Taskfile.yml` or `.github/workflows/**`, which is exactly the class of PR these gates exist to grade. `types: [closed]` is the same defect by another route, and the grep's `[[:space:]]+` is indent-blind, so a `pull_request:` nested under `workflow_call.inputs` satisfied it too. **The third gate did not answer the question at all** — `workflow_pins_test.sh` asserted its step was present and undisarmed and never that the workflow carrying it runs on a PR; this is new coverage there, not a strengthening, and the brief that commissioned this lane assumed otherwise. **Decision on meaning:** a workflow "reaches PRs" when it has a top-level `pull_request:` trigger — a key of `on:` itself, at 2-space indent — whose sub-block carries **only keys from GitHub's five** (`types`, `branches`, `branches-ignore`, `paths`, `paths-ignore`; a sixth is **refused**, not guessed at), with **no** `paths:`/`paths-ignore:`, a `types:` list that is absent or a **superset** of GitHub's defaults (`opened`, `synchronize`, `reopened`), and no branch filter excluding `main` — **each read at whatever indent it is written at, and with its block sequence read whether the items are indented under the key or written FLUSH with it**, because the sub-block extraction is already scoped to the trigger and an indent pin bought no isolation the scoping did not already provide; branch and type names are compared as WHOLE tokens split on YAML's own separators, so `main-next` and `release/main` are not `main` — and when the target job carries neither a job-level `if:` **nor a job-level `needs:`** (a dependency that skips on PRs skips its dependents, defeating all three gates at once while every other assertion stays green), and the gate's own step carries no `if:`/`continue-on-error:` **in either the mapping-key or the sequence-item position** (`      - if:` is the step's first key and is a sequence item). **Deliberately still accepted**, stated so a reviewer does not read the narrowing as wider than it is: `on: pull_request` and `on: [push, pull_request]` (the inline forms cannot carry a filter, so they are strictly safer than the block form), the quoted `"on":` key, a `types:` superset, `branches:` listing the literal `main`, `branches-ignore:` sparing `main`, block-scalar `run: |` invocations, arbitrarily long comment blocks inside a gate step, and step-level `if:` on *other* steps (`verify.yaml`'s changelog gate is legitimately PR-excluded). **Deliberately narrower than GitHub:** a `branches:` glob covering main without the literal token (`['ma*']`) reds, because a bash gate cannot honestly evaluate GitHub's glob semantics, and a flow mapping or anchor in the `on:` block is **refused** (distinct code) rather than guessed at. **(2)** Each gate pinned only its OWN step, so a PR deleting one of the other two was invisible to the gate that still ran — caught locally by `task check` and on push by `release-exitgate`, hence a gap and not a hole. Each gate now asserts all three steps; the mutation matrix is the full cross-product (3 deleted steps × the 2 observers that still run) rather than a diagonal. **(3)** `aud2_exitgate_test.sh`'s `check_pr_wiring` located its step with `grep -nF -- "$SELF"` — a search for the script *name*, which the step's own comments satisfy. Measured by the reviewer: with the `run:` line commented out it still failed, but reported **"WITH ARGUMENTS"** instead of "does not invoke", sending an operator to look for an argument that does not exist. The anchored form from `dogfood_wiring_test.sh` is ported back and shared. **Why one lane and one helper, not three fixes:** the INBOX residual explicitly asked for a single shared helper so the next gate author inherits the strong check rather than copying the weak one; fixing one of three identical checks would have been misleading. **Judgment calls.** (a) The helper is **codes-only and prints nothing** — every caller owns its wording, because roughly twenty existing `expect_red` controls pin stderr fragments. (b) The 1..6 **line cap** `workflow_pins_test.sh` used to bound step isolation is replaced by a structural invariant — exactly one `run:` key and no `uses:` key, both of which actionlint itself flags — because cross-pinning made the helper isolate the aud2 and dogfood steps, whose comment blocks are a dozen lines long, and no cap admits an honest step of theirs while rejecting a merged one. (c) The helper is held to `workflow_pins_test.sh`'s preamble rules (**bash 3.2**, portable ERE, no `git`, no `grep -q` on a pipe) rather than aud2's ≥4.3 floor: that gate runs first in CI before any toolchain, and the other two callers do not refuse bash 3.2, so a bash-4 construct here would silently weaken them on a maintainer's machine. (d) It is a **line-oriented reader with a structural bias, not a YAML parser** — it says so in its own header and fails closed on anchors, aliases and flow mappings, because an honest narrow gate beats an overreaching one. (e) No new `check:` stage and `CHECK_STAGES` untouched: all three gates were already wired. **Evidence:** 44 helper-level probes, 20 host-independent fixture self-checks carried inside two of the gates, and end-to-end mutation of a scratch copy of the REAL `verify.yaml` driven through all three real gate scripts (the layer that found (ii) and (iii); fixtures alone did not) plus, in the gates themselves, 13 new red controls in aud2 (`CONTROL_FLOOR` 38→51, text-only 32→45, both floors met exactly), 15 in `workflow_pins_test.sh` and 12 in `dogfood_wiring_test.sh` — each pinned to its own finding text or rc — and, in every gate, **green** controls for the legitimate shapes above, so the new checks are provably not always-red. **Five fail-opens were found by building mutants rather than by reasoning — three of them in this lane's own code, across three review rounds — and the record names every one, because the lane's value is the mutants, not the prose.** (i) *This lane's own widening:* accepting a block-scalar `run: |` invocation naively means a bare `bash <script>` line anywhere in the job satisfies the step check, including inside another step's multi-command `run: |` body where `echo skip && exit 0` a line above would mean the gate never runs — measured rc=0. The block form now counts only as a block's **sole** command, and all three gates carry that mutant. (ii) *The residual this lane exists to close, still open at any indent but four:* the filter greps were pinned to exactly four spaces, six-space indent is valid YAML resolving to the identical mapping, and the miss fell through to `return 0` — so on the real `verify.yaml` all three gates returned **rc=0** on a `paths:`-filtered trigger written one level deeper, the exact shape this row says they refuse. It was also the one place the helper broke its own stated rule, refusing an unevaluable *shape* while silently accepting an unrecognised *indent*. Matching is now indent-agnostic within the trigger sub-block, plus the five-key allowlist above. (iii) *Inherited, not introduced:* the step disarm grep lacked the `(-[[:space:]]+)?` alternative its `run:`/`uses:` siblings in the same function had, so a step whose FIRST key is the disarm (`      - if: …`) graded **wired, argument-free and undisarmed** — measured rc=0 on the real workflow, and it hollowed out the cross-pinning this row delivers. The byte-identical regex is in `main`'s `dogfood_wiring_test.sh`, so this is a pre-existing hole closed here, not a regression. (iv) *A tokenizer that split on the wrong characters:* branch and type names were tokenised with `tr -c 'A-Za-z0-9_'`, which splits on `-` and `/`, so `branches: [main-next]`, `branches: ['release/main']` and a `- main-v2` item each yielded a `main` token and were reported as **reaching every pull request** when no PR onto main runs the workflow at all (measured rc=0 on all three). `branches: [maintenance]` reddened correctly throughout, which is precisely why this survived two reviews: only the values that contain `main` as a **substring** — the ones that look right — were broken. Tokenising on YAML's own separators fixed it in both directions (`branches-ignore: [main-next]` had been a false RED). (v) *A blind spot reproduced while fixing the complaint about it:* a block sequence written FLUSH with its key — `branches:` then `    - main`, the canonical GitHub Actions style — was misgraded, and the key allowlist added in round two turned one such case from a correct 0 into a refusal, **reddening valid structure**. Two stacked defects: the value region's indent bound never admitted an item at the key's own indent (measurable independently of the allowlist), and the allowlist counted `- main` as an unknown key. **Why a 28-row mutant matrix missed (ii) and (iii), and why the fixture set added to close that missed (v):** the round-two fixtures gave every reach and wired code a host-independent case — a real improvement — but wrote all of them at 4 or 6 spaces with sequence items indented deeper than their key, so the substitution reproduced the same indentation blind spot somewhere cheaper. Breadth of mutant SHAPES is not breadth of coverage, and neither is breadth of return CODES if every case shares one incidental style. it was broad in mutant SHAPES and narrow in CODE coverage — 3 of 6 `assent_pr_reach` codes and 2 of 8 `assent_step_wired` codes had a host-independent fixture, and both defects lived in the uncovered ones. Every code now has one, the filter fixtures deliberately written at a non-4-space indent, and in flush block-sequence style as well after (v). **The helper is graded too, not only the workflows it reads:** every mutation control mutates `verify.yaml` and asks the helper about it, which cannot tell a working helper from a stubbed one — with the helper now a single point of failure for all three gates, replacing `assent_pr_reach` with `return 0` would turn them all green at once. Two of the gates therefore also drive it against **from-scratch fixture workflows** whose right answer depends on nothing under `.github/workflows/**` (verified: the stub reds them by name). Revert: delete `hack/lib/pr_reach.sh` and restore the three gates' local readers — which restores the `paths:`-filtered bypass, the self-only pinning, and the misreport. |
+| D-157 | 2026-08-23 | **"Reaches pull requests" is now a SHARED, structural check (`hack/lib/pr_reach.sh`), the three PR-visible text gates CROSS-PIN each other's steps, and the fixed-string step check is replaced by an anchored `run:`-command match (GATES3).** Three residuals, each *demonstrated* by an independent reviewer on an earlier lane and each deliberately left unfixed there, all living in the same three files — `hack/lint/workflow_pins_test.sh`, `hack/audit/aud2_exitgate_test.sh`, `hack/examples/dogfood_wiring_test.sh`. **(1) The substantive one.** Two of the three answered "am I reachable on a PR?" with `grep -qE '^[[:space:]]+pull_request:'` over the workflow's `on:` block; a reviewer added `paths: ['internal/**']` under the trigger and measured **rc=0** — the trigger is present, the grep is satisfied, and the gate is disarmed for every PR that touches only `Taskfile.yml` or `.github/workflows/**`, which is exactly the class of PR these gates exist to grade. `types: [closed]` is the same defect by another route, and the grep's `[[:space:]]+` is indent-blind, so a `pull_request:` nested under `workflow_call.inputs` satisfied it too. **The third gate did not answer the question at all** — `workflow_pins_test.sh` asserted its step was present and undisarmed and never that the workflow carrying it runs on a PR; this is new coverage there, not a strengthening, and the brief that commissioned this lane assumed otherwise. **Decision on meaning:** a workflow "reaches PRs" when it has a top-level `pull_request:` trigger — a key of `on:` itself, at 2-space indent — whose sub-block carries **only keys from GitHub's five** (`types`, `branches`, `branches-ignore`, `paths`, `paths-ignore`; a sixth is **refused**, not guessed at), with **no** `paths:`/`paths-ignore:`, a `types:` list that is absent or a **superset** of GitHub's defaults (`opened`, `synchronize`, `reopened`), and no branch filter excluding `main` — **each read at whatever indent it is written at, and with its block sequence read whether the items are indented under the key or written FLUSH with it**, because the sub-block extraction is already scoped to the trigger and an indent pin bought no isolation the scoping did not already provide; branch and type names are compared as WHOLE tokens split on YAML's own separators, so `main-next` and `release/main` are not `main` — and when the target job carries neither a job-level `if:` **nor a job-level `needs:`** (a dependency that skips on PRs skips its dependents, defeating all three gates at once while every other assertion stays green), and the gate's own step carries no `if:`/`continue-on-error:` **in either the mapping-key or the sequence-item position** (`      - if:` is the step's first key and is a sequence item). **Deliberately still accepted**, stated so a reviewer does not read the narrowing as wider than it is: `on: pull_request` and `on: [push, pull_request]` (the inline forms cannot carry a filter, so they are strictly safer than the block form), the quoted `"on":` key, a `types:` superset, `branches:` listing the literal `main`, `branches-ignore:` sparing `main`, block-scalar `run: |` invocations, arbitrarily long comment blocks inside a gate step, and step-level `if:` on *other* steps (`verify.yaml`'s changelog gate is legitimately PR-excluded). **Deliberately narrower than GitHub:** a `branches:` glob covering main without the literal token (`['ma*']`) reds, because a bash gate cannot honestly evaluate GitHub's glob semantics, and a flow mapping or anchor in the `on:` block is **refused** (distinct code) rather than guessed at. **(2)** Each gate pinned only its OWN step, so a PR deleting one of the other two was invisible to the gate that still ran — caught locally by `task check` and on push by `release-exitgate`, hence a gap and not a hole. Each gate now asserts all three steps; the mutation matrix is the full cross-product (3 deleted steps × the 2 observers that still run) rather than a diagonal. **(3)** `aud2_exitgate_test.sh`'s `check_pr_wiring` located its step with `grep -nF -- "$SELF"` — a search for the script *name*, which the step's own comments satisfy. Measured by the reviewer: with the `run:` line commented out it still failed, but reported **"WITH ARGUMENTS"** instead of "does not invoke", sending an operator to look for an argument that does not exist. The anchored form from `dogfood_wiring_test.sh` is ported back and shared. **Why one lane and one helper, not three fixes:** the INBOX residual explicitly asked for a single shared helper so the next gate author inherits the strong check rather than copying the weak one; fixing one of three identical checks would have been misleading. **Judgment calls.** (a) The helper is **codes-only and prints nothing** — every caller owns its wording, because roughly twenty existing `expect_red` controls pin stderr fragments. (b) The 1..6 **line cap** `workflow_pins_test.sh` used to bound step isolation is replaced by a structural invariant — exactly one `run:` key and no `uses:` key, both of which actionlint itself flags — because cross-pinning made the helper isolate the aud2 and dogfood steps, whose comment blocks are a dozen lines long, and no cap admits an honest step of theirs while rejecting a merged one. (c) The helper is held to `workflow_pins_test.sh`'s preamble rules (**bash 3.2**, portable ERE, no `git`, no `grep -q` on a pipe) rather than aud2's ≥4.3 floor: that gate runs first in CI before any toolchain, and the other two callers do not refuse bash 3.2, so a bash-4 construct here would silently weaken them on a maintainer's machine. (d) It is a **line-oriented reader with a structural bias, not a YAML parser** — it says so in its own header and fails closed on anchors, aliases and flow mappings, because an honest narrow gate beats an overreaching one. (e) No new `check:` stage and `CHECK_STAGES` untouched: all three gates were already wired. **Evidence:** 44 helper-level probes, 20 host-independent fixture self-checks carried inside two of the gates, and end-to-end mutation of a scratch copy of the REAL `verify.yaml` driven through all three real gate scripts (the layer that found (ii) and (iii); fixtures alone did not) plus, in the gates themselves, 13 new red controls in aud2 (`CONTROL_FLOOR` 38→51, text-only 32→45, both floors met exactly), 15 in `workflow_pins_test.sh` and 12 in `dogfood_wiring_test.sh` — each pinned to its own finding text or rc — and, in every gate, **green** controls for the legitimate shapes above, so the new checks are provably not always-red. **Six fail-opens were found by building mutants rather than by reasoning — four of them in this lane's own code, across four review rounds — and the record names every one, because the lane's value is the mutants, not the prose.** (i) *This lane's own widening:* accepting a block-scalar `run: |` invocation naively means a bare `bash <script>` line anywhere in the job satisfies the step check, including inside another step's multi-command `run: |` body where `echo skip && exit 0` a line above would mean the gate never runs — measured rc=0. The block form now counts only as a block's **sole** command, and all three gates carry that mutant. (ii) *The residual this lane exists to close, still open at any indent but four:* the filter greps were pinned to exactly four spaces, six-space indent is valid YAML resolving to the identical mapping, and the miss fell through to `return 0` — so on the real `verify.yaml` all three gates returned **rc=0** on a `paths:`-filtered trigger written one level deeper, the exact shape this row says they refuse. It was also the one place the helper broke its own stated rule, refusing an unevaluable *shape* while silently accepting an unrecognised *indent*. Matching is now indent-agnostic within the trigger sub-block, plus the five-key allowlist above. (iii) *Inherited, not introduced:* the step disarm grep lacked the `(-[[:space:]]+)?` alternative its `run:`/`uses:` siblings in the same function had, so a step whose FIRST key is the disarm (`      - if: …`) graded **wired, argument-free and undisarmed** — measured rc=0 on the real workflow, and it hollowed out the cross-pinning this row delivers. The byte-identical regex is in `main`'s `dogfood_wiring_test.sh`, so this is a pre-existing hole closed here, not a regression. (iv) *A tokenizer that split on the wrong characters:* branch and type names were tokenised with `tr -c 'A-Za-z0-9_'`, which splits on `-` and `/`, so `branches: [main-next]`, `branches: ['release/main']` and a `- main-v2` item each yielded a `main` token and were reported as **reaching every pull request** when no PR onto main runs the workflow at all (measured rc=0 on all three). `branches: [maintenance]` reddened correctly throughout, which is precisely why this survived two reviews: only the values that contain `main` as a **substring** — the ones that look right — were broken. Tokenising on YAML's own separators fixed it in both directions (`branches-ignore: [main-next]` had been a false RED). (v) *A blind spot reproduced while fixing the complaint about it:* a block sequence written FLUSH with its key — `branches:` then `    - main`, the canonical GitHub Actions style — was misgraded, and the key allowlist added in round two turned one such case from a correct 0 into a refusal, **reddening valid structure**. Two stacked defects: the value region's indent bound never admitted an item at the key's own indent (measurable independently of the allowlist), and the allowlist counted `- main` as an unknown key. **Why a 28-row mutant matrix missed (ii) and (iii), and why the fixture set added to close that missed (v):** the round-two fixtures gave every reach and wired code a host-independent case — a real improvement — but wrote all of them at 4 or 6 spaces with sequence items indented deeper than their key, so the substitution reproduced the same indentation blind spot somewhere cheaper. Breadth of mutant SHAPES is not breadth of coverage, and neither is breadth of return CODES if every case shares one incidental style. it was broad in mutant SHAPES and narrow in CODE coverage — 3 of 6 `assent_pr_reach` codes and 2 of 8 `assent_step_wired` codes had a host-independent fixture, and both defects lived in the uncovered ones. Every code now has one, the filter fixtures deliberately written at a non-4-space indent, and in flush block-sequence style as well after (v). (vi) *And then a line ending.* A single stray **CR** on one `branches-ignore:` sequence item made the tokenizer emit `main<CR>` as a whole token; `grep -qx main` missed it and the reader returned **0**, "runs on every pull request", for a trigger that EXCLUDES main (measured; both earlier readers said 13, so the round-3 tokenizer introduced it). One committed CR suffices: there is no `.gitattributes` here, `core.autocrlf=false` preserves it, no gate scans workflows for CR, and a GitHub diff renders it invisibly. CR is a YAML break character, so `main<CR>` was never a whole token and the reader was wrong by this row's own "compared as WHOLE tokens" rule. **THE CLASS IS NOW CLOSED WHERE IT CAN HURT, not merely the instance.** Four rounds produced six defects of one family — a line-oriented reader inferring YAML structure from indentation and character classes — and patching bytes one at a time was visibly not converging. The direction that can hurt, however, is narrow and structural: every filter test here is *must CONTAIN token X* (types must carry GitHub's defaults, branches must carry `main`) except **one**, `branches-ignore:`, which is *must NOT contain*. A misread drops or mangles a token, so every must-CONTAIN test goes RED — the CR bug's other two symptoms were exactly that, false reds on `branches:` and `types:`. Only the must-NOT-contain test converts a mangled token into a silent PASS. So the burden is inverted there: a token carrying any byte outside the git-ref/glob set (plus `#`, since that key alone keeps comment residue by G3-04's design) is now **REFUSED** rather than searched. A future tokenizer defect on that key can produce a red or a refusal, never a silent accept — by construction, not by enumeration. **A real YAML parse was evaluated and REJECTED on measured evidence, not assumed either way.** `python3` is an established dependency (`hack/validate-schemas-stock.sh`), but it uses **`json` only — stdlib**; PyYAML is nowhere established in this repo. Decisively: `hack/audit/README.md` publishes `docker run --rm -v "$PWD:$PWD" -w "$PWD" debian:stable-slim bash hack/audit/aud2_exitgate_test.sh --text-only` as the offline verification path, and that image was measured to contain **no python3 and no yq** — while the gate itself, which sources this helper, was measured GREEN in it (51 mutation controls), as was `workflow_pins_test.sh`. A PyYAML reader would break a published operator path and would also violate this file's stated no-toolchain contract (it runs first in CI, before `setup-go`). Go is unavailable in that image for the same reason. So the reader stays a heuristic, and the honest bound is written into its header rather than implied: it reads block mappings at any indent, block sequences indented or flush, inline flow sequences and quoted scalars; it REFUSES flow mappings, anchors, aliases, merge keys, unknown filter keys and unreadable tokens; and its one must-NOT-contain test now refuses instead of guessing. Recorded so a future lane does not re-litigate: if PyYAML ever becomes a committed dependency of the verification image, replacing this reader wholesale is the right move and would dissolve the remaining bounds. **The helper is graded too, not only the workflows it reads:** every mutation control mutates `verify.yaml` and asks the helper about it, which cannot tell a working helper from a stubbed one — with the helper now a single point of failure for all three gates, replacing `assent_pr_reach` with `return 0` would turn them all green at once. Two of the gates therefore also drive it against **from-scratch fixture workflows** whose right answer depends on nothing under `.github/workflows/**` (verified: the stub reds them by name). Revert: delete `hack/lib/pr_reach.sh` and restore the three gates' local readers — which restores the `paths:`-filtered bypass, the self-only pinning, and the misreport. |
 | D-158 | 2026-08-23 | **CI-TOOLCHAIN — `verify` was red on every PR from a golangci-lint/Go skew; the remedy is to bump `GOLANGCI_LINT_VERSION` v2.12.2 → v2.13.1 and KEEP `go-version: stable`.** Symptom: PR #85, a six-file Markdown diff with **zero Go bytes**, failed `verify` with `/opt/hostedtoolcache/go/1.27.0/x64/src/crypto/internal/randutil/randutil.go:11:2: could not import math/rand/v2 (… method must have no type parameters) (typecheck)` — the failing path is inside the **Go toolchain's own source tree**, so no author change can fix it and re-running cannot clear it. `Analyze (go)`, `Analyze (actions)` and `CodeQL` all passed on the same run: the tree compiles clean under Go 1.27, only the linter chokes. **Mechanism**: golangci-lint typechecks the standard library with the `go/types` it was **compiled with**, not the `go` on `PATH`. GitHub's `stable` rolled 1.26 → 1.27.0 between this repo's last green `main` run (2026-08-19) and 2026-08-23; the v2.12.2 release binary is built with go1.26.x and cannot read the 1.27 stdlib. **Reproduced locally, not reasoned** (Go 1.27.0 SDK on `PATH`, `GOTOOLCHAIN=local`, whole tree): v2.12.2 → **panic** in `pkg/goanalysis/runner_loadingpackage.go:335` inside `go/types.(*Checker).Files`, exit 2; official v2.13.1 asset (`built with go1.27.0`) → **0 issues**, exit 0; `golangci-lint config verify` → exit 0, so the v2 config schema in `.golangci.yml` needs no migration; v2.13.1 also → **0 issues** against local Go 1.26.6, so the bump is safe for contributors who have not moved; and `go install …@v2.13.1` under Go 1.27.0 → 0 issues, which is the **`release-exitgate`** path (that job builds the binary rather than using the action, and `if: github.event_name != 'pull_request'` / RELSE-08 means no PR ever exercises it). **Diagnosis heuristic worth keeping**: golangci-lint's `go.mod` carries the comment *"the minimum Go version must always be latest-1"*, so its `go` directive is a machine-readable "supports Go 1.N+1" signal — v2.12.2 says `go 1.25.0` (supports ≤1.26), v2.13.1 says `go 1.26.0` (supports ≤1.27), and upstream commit `42a0530` in v2.13.0 is literally "go1.27 support". **Options considered.** (A) *bump the linter* — CHOSEN: treats the root cause, is a **one-line** diff because the version is single-sourced at workflow scope (D-128), fixes BOTH exposed sites (the `golangci-lint-action` in `verify` and the `go install` in `release-exitgate`) at once, and the risk it carried — new findings from a newer linter blocking every merge, since `golangci-lint` runs inside `task lint` inside `task check` — was **measured at zero** on the whole tree under both Go versions. (B) *pin `go-version: 1.26.x`* — REJECTED as the primary: it needs two pins (`verify.yaml:56` and `:171`), leaves the class of bug live, undercuts the stated reason `stable` is there (`# govulncheck needs it`, with `setup-go` exporting `GOTOOLCHAIN=local` so a pinned toolchain can fail to `go run` a tool whose module requires a newer Go — unverified, and moot under (A)), and trades a loud recurrence for **silent indefinite drift onto an unsupported Go** in a repo whose posture is govulncheck + cosign + SLSA + Scorecard. (C) *both* — REJECTED as gold-plating: (A) alone is measured green, and a second simultaneous remedy would make a still-red PR ambiguous. **Per-file sweep of `go-version: stable`, stated rather than silently skipped:** `verify.yaml:56` and `:171` were the only exposed sites and are fixed by the env bump without touching either line; `schemas.yml:57` (runs `go test` + ajv, no linter), `vulncheck.yaml:30` (govulncheck only — `stable` is actively *desirable* there) and `codeql.yaml:45` (CodeQL, which passed on 1.27.0) carry no golangci-lint and are NOT exposed; `release.yaml` uses `go-version-file: go.mod` and is unaffected. `hack/lint/workflow_pins_test.sh` asserts `TASK_VERSION`, action SHA pins and step wiring but **not** `go-version` or `GOLANGCI_LINT_VERSION`; it passes on this change. **Revert is (B), not bare v2.12.2** — reverting the env line alone restores a known-red state: revert = `GOLANGCI_LINT_VERSION` back to `v2.12.2` **and** pin `verify.yaml:56` + `:171` to `go-version: 1.26.x`. **Residual risk, stated plainly:** when `stable` rolls to Go 1.28, v2.13.1 breaks identically. The repo finds out because `verify` reds on **every** PR including zero-Go diffs — loud and immediate, with the signature recorded in `verify.yaml`'s env comment and the fix being one env line. Nothing detects it *earlier*: dependabot's `github-actions` ecosystem updates `uses:` refs, not `env:` literals (backlog `CI-TOOLCHAIN-F01`). Accepted on purpose over (B)'s failure mode. Note also the pre-existing local/CI linter skew — `Taskfile.yml`'s `lint` task is bare `golangci-lint run ./...` against whatever binary a contributor has installed, so this pin has never governed local `task check`; deliberately not changed here (that file was owned by a concurrent lane). |
 | D-159 | 2026-08-23 | **ORPHAN — `release-verify-test` was a gate invoked by nothing (D-124 again), and it is wired into `task check` in its three OFFLINE modes, not its default `all`.** Finding: `Taskfile.yml` defined `release-verify-test` — the **only** test of `hack/release/verify-artifacts.sh` — and no caller existed anywhere: not `check:`, not `CHECK_STAGES` in `hack/audit/exitgate_test.sh`, not `.github/workflows/**`, not the push-only `release-exitgate`. That script is not incidental: **`SECURITY.md:61` publishes it as the procedure release consumers run** to check artifact checksums, the stamped `assent version` and cosign signatures, and D-153/AUD2-F01 had just proved that published verification instructions rot silently. Measured before fixing, as the lane required: the gate was **green**, so this is a wiring defect only — nothing was being papered over. **Why not the `all` default.** `verify_test.sh` with no argument adds `test_snapshot_pass`, which shells out to `task release-snapshot`: `go install github.com/goreleaser/goreleaser/v2@…` on any machine without it (**network**, in a gate that runs before every commit), a `before: hooks: go mod tidy` that **rewrites `go.mod`/`go.sum` in the middle of `task check`**, `--clean` on the developer's `dist/`, and a five-target cross-compile (10s here with warm caches and goreleaser already installed; minutes cold). A flaky or network-bound stage is worse than a missing one, so `check:` runs `negative`, `cosign-skip-when-absent` and `readme` — REQ-E9-S12-02/03/04, all offline, together well under a second. **Consequence, stated precisely: REQ-E9-S12-01 (the real snapshot→verify round trip) is not gated per-commit in `task check`; it runs in push-only CI via `hack/release/exitgate_test.sh:33-34` (the `release-exitgate` job, `if: github.event_name != 'pull_request'`) — automated but not PR-visible, i.e. the RELSE-08 blind spot.** Those two lines are literally `task release-snapshot` then `task release-verify`, which is the `Verify:` string the spec gives the requirement (`openspec/specs/p5-e9-distribution/spec.md:441-442`), so nothing here needs a new gate built — an earlier draft of this row claimed the requirement was covered by no automation at all, which was false, and acting on it would have meant a future lane duplicating `exitgate_test.sh:33-34`. What this lane declines to do is move that L1 round trip into a per-commit gate: it cannot be, for the network/`go mod tidy`/`--clean` reasons above. Narrowing the RELSE-08 exposure for this requirement is a separate question from D-159. **Pinning.** `CHECK_STAGES` goes 20 → 21 in the same commit as the `check:` line (the AUD-S18/RELSE-08 lockstep), and `STAGE_BODY_PINS` pins the body **per mode** rather than by the bare script path — a single `bash hack/release/verify_test.sh` pin would stay green if two modes were dropped *and* if the stage were reverted to the unrunnable-in-check default. Three mutation controls prove it: deleting the `check:` line reds `check_check_wiring` by stage name, gutting one of the three modes reds `check_stage_bodies` while the other two still run, and the same deletion applied to the real tree reds the real gate at rc=1. **Also fixed, minimally, because wiring made it matter:** `verify_test.sh` wrote its captured stdout/stderr to fixed `/tmp/verify-{tamper,nosig}.{out,err}` and then **grepped** them; harmless while nothing ran it, but this repo runs several lane worktrees whose `task check` invocations overlap, and a concurrent run truncating `/tmp/verify-nosig.err` at open would fail the other run's `skip.*cosign` grep spuriously. Scratch files now live in each run's own `mktemp -d` (invisible to `verify-artifacts.sh`, which globs only `*.tar.gz`/`*.zip`) and are removed by the existing `RETURN` trap. |
 | D-160 | 2026-08-23 | **UNIV-COSIGN — the cosign signer-pin gate asserted an EXISTENTIAL property where the guarantee it publishes is UNIVERSAL, so it certified nothing about a file's second `cosign verify-blob`; `hack/release/install_cosign_pin_test.sh` now grades EVERY invocation in ALL THREE published files, statically and at runtime.** Substance first, and measured before anything was written: a scratch copy of each graded file with a **second, unpinned** `cosign verify-blob` spliced IN-BODY next to its real invocation (the splice shape matters — see UC-04 below) ran the gate to **exit 0** — `hack/install.sh` rc=0, `SECURITY.md` rc=0, `hack/release/verify-artifacts.sh` rc=0, the last of these being the shape a reviewer had already demonstrated on an earlier lane. **Every individual assertion in that gate was sound.** `has_flag` grepped the whole folded extraction, so a pinned sibling satisfied it; `one_value`'s `sort -u` collapsed two agreeing values to one, so the D-153 drift comparison saw a consistent file; section 0 **printed** the extracted invocation count and asserted nothing about it; and 4b/5d's stub-log checks were positive-only greps, i.e. the same existential shape at runtime, where a second unpinned call leaves the pinned call's log line intact. The conjunction of sound existential assertions is still an existential assertion. **This is the AUD2-S05 quorum defect one layer out: not a wrong assertion, a wrong quantifier**, and it predates both AUD2-S03 and AUD2-F01. **`SECURITY.md` was worse than the other two** — it fed only the drift comparison and had **no invocation-level grading at all**, so an unpinned recipe published to adopters was invisible to the gate that exists to police the recipe. **Property chosen: "every `cosign verify-blob` invocation in every graded file carries `--certificate-oidc-issuer`, `--certificate-identity-regexp` and `--bundle`, EACH WITH SECURITY.md's published value".** The value half is not decoration: `--certificate-identity-regexp ''` carries the flag and matches every Fulcio identity ever issued, and `one_value`'s `sort -u` does not catch it either, because an empty capture is not a line and the file still reports exactly one distinct value — a presence-only universal check would be the same defect one level down, so each invocation's own extracted value is compared against the published pair (reported `WRONG-VALUE[...]`, distinct from `UNPINNED[...]`). Options considered: **(a)** the remedy recorded when the finding was filed — assert the extracted invocation count is **exactly 1** per file (**REJECTED AS FACTUALLY WRONG — do not implement it in a later lane; it would red `main` on the day it lands.** `SECURITY.md` legitimately publishes **two** — one over the archive, one over `checksums.txt`, which is what covers the SBOMs listed inside it — so that assertion reds `main` on the day it lands, and the natural repair is to weaken it again); **(b)** universal quantification over invocations **(chosen)** — strictly stronger than (a) where (a) is true, and it keeps holding when a file legitimately grows a third correctly-pinned call. **Enforcement, per D-128, is one predicate**: `pin_violations <file>` prints one line per problem and nothing when the file is clean, so callers grade its OUTPUT and the identical function is asserted empty against the tree and non-empty against a mutant with no `set -e` games; `assert_all_pinned` is the thin failing wrapper; `log_unpinned_lines` is its runtime twin over the stub-cosign argv log. **Classification is fail-CLOSED, which is the part that carries the guarantee.** The candidate extractor is deliberately left un-narrowed (every non-comment line mentioning `cosign verify-blob`, continuations folded), because anything the *denominator* drops is a hole. A candidate is an invocation when the folded text begins with `cosign verify-blob`; the ONE waved-through non-invocation shape is a markdown inline-code mention (`` `cosign verify-blob` ``, which is how `SECURITY.md`'s capability table names it); **on a line carrying NO backticked mention, anything else — `foo && cosign verify-blob …`, a here-doc line, an un-backticked prose sentence — is reported UNCLASSIFIABLE rather than skipped**, because "this gate cannot tell whether that call is pinned" must never read as "that call is fine". **That scoping is not cosmetic, and the unscoped version of this sentence was FALSE (R3-01, caught by review on the round that added the honest banner).** The exemption tests whether the substring `` `cosign verify-blob` `` appears **anywhere on the line**, not whether the line is prose, and it is tested BEFORE the command-position and multi-token checks. So a line carrying a backticked mention AND one or more LIVE calls is exempted, neither graded nor refused: measured by splicing ``See `cosign verify-blob`: cosign verify-blob --bundle A.json a && cosign verify-blob --bundle EVIL.json evil`` into `SECURITY.md` — `occurrence_count` = 2 by the definition the banner itself states, `pin_violations` EMPTY, **whole gate rc=0**, while the banner reported that line among those "exempted as backticked prose". The **static** defect is not markdown-specific — splicing a live unpinned call with a trailing backticked mention into `hack/install.sh` gives candidates=2, invocations=1, `pin_violations` EMPTY — but the **whole-gate green is** markdown-specific, and the distinction is stated because a looser sentence here would itself be falsifiable: in that shell script the run reds at §4b for an unrelated RUNTIME reason (the spliced call executes and its bundle is absent), whereas `SECURITY.md` is a document with no runtime twin, which is why rc=0 survives there. Measured both ways rather than inferred from either. **Narrowing the exemption needs quote- and markdown-aware parsing — the machinery that produced UC-01/02/03 — so it is deliberately NOT patched here.** It is instead disclosed as residual (1) in the PASS banner, ahead of the variable/`eval`/fragment spellings, because it is the residual that is actually REACHABLE in these three files while those are not present in any of them. The banner also no longer labels an exempted line "prose": the branch it took is a fact, "prose" was an inference, and R3-01 is the case where that inference is wrong. **This is UC-07 doing its job on its own author:** the claim was falsifiable, it was checked, and the gate is now incomplete-and-honest rather than complete-and-wrong. Accepted cost, stated rather than discovered later: a *correctly pinned* invocation written off command position also reds. That is the intended direction of error for a security gate over three files carrying four invocations in one canonical style, and the message names the fix. **Anti-vacuity, because a lane whose entire deliverable is "make a gate stricter" is maximally exposed** (this repo's #1 review finding is an assertion that cannot fail — D-124, AUD-S18): section 2b runs **eight** mutants against **each** of the three files and 2c runs a ninth, and they were chosen for **branch** coverage of the new predicate rather than for variety of shape — (a) a second **unpinned** invocation must red, name the file, quote the offending command, and produce **exactly two** violations so the pinned siblings are provably not flagged; (b) a second **correctly pinned** invocation must stay green **and** must raise the extractor's invocation count by one, without which (b)'s green could mean "the extractor never saw it"; (c) an occurrence off command position, appended **fully pinned on purpose** so the only thing that can redden it is the classifier itself; (d) every invocation deleted → `NO-CANDIDATES`; (e) the continuation fold broken → `FOLD-BROKEN`, asserted **not** to also report `UNPINNED`, because conflating "the extractor truncated this" with "the pin is missing" sends the next maintainer to the wrong file; (f) every invocation displaced off command position → `NO-INVOCATIONS`; (g) a second invocation carrying both flags with an **empty** identity regexp → `WRONG-VALUE`, the hostile shape a presence-only check waves through; (h) a second invocation carrying both flags with a **foreign OIDC issuer** → `WRONG-VALUE` on the issuer half; and 2c strips the backticks from `SECURITY.md`'s prose mention and requires the same row to fail closed, proving the exemption keys on the backticks and is not a blanket bypass. The runtime twin has its own vacuity control (an unpinned line appended to a copy of the stub log must be seen). **One real defect was caught by this section during the lane and is recorded because it is a trap for the next author**: `log_unpinned_lines` was first written with `awk -v id="identity_re=${sec_identity}"`, and **awk processes escape sequences in a `-v` assignment**, so the pin's `github\.com` arrived as `github.com` and matched nothing; the values now reach awk through `ENVIRON`. **Stated limit, same posture as D-154's**: the denominator is the literal string `cosign verify-blob`, so an invocation spelled through a variable (`"$COSIGN" verify-blob …`), built by `eval`, or assembled from fragments is invisible to this gate. Widening the trigger to bare `verify-blob` was considered and **rejected** — it buys one hypothetical no file uses, and turns any future `SECURITY.md` sentence saying "verify-blob" outside backticks into a red gate, whose repair would be to loosen the classifier. **Nothing outside the gate changed**: `hack/install.sh`, `SECURITY.md` and `hack/release/verify-artifacts.sh` are byte-unchanged, and all four of their invocations were already pinned — this row closes a hole in the *checker*, not in the checked. The stage `release-install-cosign-pin-test` was already wired into `task check` and pinned in `hack/audit/exitgate_test.sh`'s `CHECK_STAGES`, so no wiring changed either. **SECOND ROUND — the first version of this fix REPRODUCED the very defect it closes, one level down, and independent review caught it before merge.** `has_flag` grepped the whole FILE; the replacement grepped the whole LINE. Both are existential; only the scope shrank. **UC-01**: one folded line was graded as at most ONE invocation, so `cosign verify-blob <both pins> --bundle a.json a && cosign verify-blob --bundle EVIL.json evil` began with `cosign verify-blob` (not UNCLASSIFIABLE), carried `--bundle` (not FOLD-BROKEN), carried both flag strings (not UNPINNED) and yielded the published values (not WRONG-VALUE) — **green**, in same-line, `;`-separated and backslash-folded forms, on all three graded files. Worse, the **full gate exited 0** for `SECURITY.md`: the two shell scripts were incidentally caught by the runtime twin (`log_unpinned_lines` at §5d), but **SECURITY.md is a document and has no runtime twin**, so the hole was unmitigated precisely on the file this row calls "the copy-paste recipe adopters run by hand" — D-153's exact incident class — while the gate printed "EVERY cosign verify-blob invocation ... is pinned", false as printed. The stated-limit paragraph did not cover it: it enumerated `$COSIGN`, `eval` and fragments, not `&&` chaining, and **leading** `&&` was explicitly handled (mutant (c) → UNCLASSIFIABLE), so the operator had been considered and only one side handled. Closed by grading per **OCCURRENCE** (`occurrence_count` + a new `MULTI-OCCURRENCE` violation that fails closed on any line carrying two calls) rather than per line; counting inside an already-triggered line uses the shorter `verify-blob`, so a second call spelled `cosign  verify-blob` or `"$COSIGN" verify-blob` and chained onto a pinned one is caught too, which the literal file-level trigger would miss. **UC-02**: `extract_issuer`/`extract_identity` anchor on a greedy `.*`, so the LAST value on a line wins — a hostile `--certificate-identity-regexp ''` placed FIRST was masked by a correct value placed second, **the extraction direction favoured the attacker**. Closed by `flag_value_tokens`, which returns EVERY value of every flag on the occurrence; each must equal the published one, so a repeated flag with an empty value first now reds. **UC-03 (P2, the erosion path)**: a CORRECTLY pinned call written with **double quotes** was refused as `WRONG-VALUE ... identity=<empty/unparsable> ... (an empty regexp matches every Fulcio identity)` — a true refusal with a **false reason**, and the repair a maintainer reaches for on that message is widening the extractor. Both quote styles are now accepted (double quotes are correct shell for this value: it contains no `$` and no backtick), and a **bare** value is diagnosed as `UNQUOTED-VALUE`, a QUOTING defect, never as a wrong or empty one — a gate that misdiagnoses erodes faster than one that refuses. **UC-04**: this row's "rc=0, rc=0, rc=0" reproduction figure is **splice-shape-sensitive** and is stated as measured: it holds for a second unpinned call spliced **in-body** next to the real one. An EOF-appended mutant reds the two shell scripts for an unrelated runtime reason, so the figure should not be read as holding for any second unpinned call. The same sensitivity is why the UC-03 double-quoted mutant reds the two scripts through the full gate (the spliced call actually RUNS and its fixture bundle is absent) while `SECURITY.md`, having no runtime, is the clean end-to-end proof at rc=0. The classifier's fail-closed posture on off-command-position occurrences was independently adjudicated KEEP, since §2c proves the prose exemption keys on the backticks and cannot be widened silently. **The lesson, recorded because it is the whole point of the lane:** a fix for an existential-where-universal defect is itself maximally exposed to the same defect at the next scope down — file, then line, then occurrence — and the only thing that caught it was a reviewer building the chained-call mutant that neither the 20-row external matrix nor the 25 in-gate mutants contained. **THIRD ROUND (UC-05..UC-09), and the reason this row now reads the way it does.** **UC-05**: `occurrence_count` compared whitespace-delimited fields to `verify-blob`, found one, and concluded **singularity** — when all it had established is that it did not find a second. `cosign "verify-blob"`, `cosign 'verify-blob'` and `cosign verify-blob""` are the same command to the shell, and each hid a chained unpinned call from the count. Measured against the round-2 gate on **all three** files at whole-gate level: **rc=0, rc=0, rc=0** — worse than first reported, because `A && B` short-circuits and `set -e` does **not** fire on a non-final member of an AND-list, so even the two shell scripts' runtime twin missed it. Closed by stripping shell quotes before the field compare, which is **a spelling patch, not a terminator, and is labelled as one in the code**. A structural terminator was sought and **ruled out with evidence**: refusing any graded line carrying a command separator would red the REAL files, since `hack/install.sh` and `hack/release/verify-artifacts.sh` both legitimately end their genuine invocation with an or-else `die` tail. **No structural terminator exists for this gate**, so completeness is not available and must not be claimed. **UC-07 is therefore the durable fix, and it is a change of posture rather than of logic.** The `PASS:` banner was printed unconditionally and asserted "EVERY cosign verify-blob OCCURRENCE ... is pinned" plus "a second unpinned call reddens whether it sits on its own line or is chained onto a pinned one" — a **universal claim bound to no assertion**. Under UC-05 that banner did not merely overstate: on a green run it printed something **false**, which is strictly worse than printing nothing, and it is this repo's #1 defect class (an assertion that cannot fail) wearing a different hat. The banner now reports **OBSERVED** counts per file (occurrences found, classified-and-graded, prose-exempt, refused), lists **ASSERTED** properties each of which is shown to fail on a mutant, and states the **NOT ASSERTED** residual in the same breath: this gate finds calls by a literal string and counts quote-stripped words, so a call spelled through a variable, `eval`, or fragments is not seen and not graded, and the counts are what was classified — **not a proof that nothing else exists**. When a fifth spelling turns up, the gate is then **incomplete rather than wrong**, and incomplete is recoverable. **UC-06**: a TRAILING comment mentioning `verify-blob` fired `MULTI-OCCURRENCE: … has 2 verify-blob calls chained on ONE line` — fail-closed but **false as printed**, since `cosign_candidates` only drops lines whose FIRST non-space character is `#`. That is the UC-03 misdiagnosis shape recurring **inside the UC-01 fix**. The message now says TOKENS, names both possible causes, and names the correct repair; excluding trailing comments was rejected as it needs quote-aware parsing, which is the machinery that produced UC-01/02/03. **UC-08**: `shellcheck` SC1087 ×2 (error severity) on `flag_value_tokens` — `"$flag[[:space:]]…"` parses as an array subscript; `${flag}` silences it. Cosmetic: no shellcheck gate exists in this repo. **UC-09**: two stage-count figures reported during this lane ("25", then "28") were **both wrong** and neither came from a committed file — they counted `task: [` lines in a run LOG, which includes nested task invocations. Measured: the Taskfile `check:` block has **21** `- task:` entries and `CHECK_STAGES` has **21** stage names; they agree, and both files are byte-identical to `origin/main`. There is no stage-count mismatch and this lane could not have caused one. **THE PATTERN, recorded because it is the lane's most transferable output:** four P1s, three of them the same scope error at successively finer scopes — file (`has_flag`), line (round 1), then occurrence-spelling (round 2) — each found by review and none by the author's own mutant matrix, because each matrix was built from the shape the previous round had just learned. The general lesson is not "add another spelling": it is that **when a gate's denominator cannot be made provably complete, the gate must report what it classified instead of asserting what exists.** That is now enforced where it is hardest to ignore, in the banner the gate prints on every green run. Revert: restore `has_flag`, drop the per-occurrence grading and the per-invocation value comparison, and restore the two positive-only stub-log greps — which returns the gate to certifying that *some* cosign call in each file is pinned, a property that is compatible with an unpinned one sitting beside it. |
diff --git a/hack/examples/dogfood_wiring_test.sh b/hack/examples/dogfood_wiring_test.sh
index 9a46f108..07d18227 100755
--- a/hack/examples/dogfood_wiring_test.sh
+++ b/hack/examples/dogfood_wiring_test.sh
@@ -704,6 +704,62 @@ FIX
 )"
 helper_wired_is 7 "$V" "$SELF_REL" "…and the bare '- run:' form is still graded for ARGUMENTS, not merely admitted (G3R-03)"
 
+# G4-01 — a stray CR on a sequence-item line. These fixtures are built with
+# printf rather than a heredoc because the CR has to be a REAL byte: that is
+# the whole point of the defect. A single committed CR was enough (no
+# .gitattributes here, core.autocrlf=false preserves it, no gate scans for it,
+# and a GitHub diff renders it invisibly), and it made `branches-ignore:` — the
+# ONE must-NOT-contain test in this reader — report "runs on every pull
+# request" for a trigger that EXCLUDES main. Measured rc=0 at 54de1a4; both
+# earlier readers said 13, so it was a regression the round-3 tokenizer
+# introduced. Both polarities are pinned at every consumer, because the CR also
+# caused FALSE REDS on `branches:` and `types:` and a fix for one direction is
+# not a fix for the other.
+cr_fixture() { # <name> <key> <item> — the item line carries a CR
+  local f="$WORK/fixture.$1.yaml"
+  {
+    printf 'name: f\non:\n  pull_request:\n    %s:\n' "$2"
+    printf '      - %s\r\n' "$3"
+    printf 'jobs: {}\n'
+  } >"$f"
+  grep -q "$(printf '\r')" "$f" ||
+    fail "fixture $1 carries no CR — the case it exists to cover is not present, so the assertion below would be vacuous"
+  printf '%s' "$f"
+}
+
+V="$(cr_fixture bi-cr-bad branches-ignore main)"
+helper_reach_is 13 "$V" "branches-ignore: '- main' with a CR still EXCLUDES main (G4-01 — THE fail-open: rc=0 at 54de1a4, on a trigger under which no PR onto main runs the workflow)"
+
+V="$(cr_fixture bi-cr-legit branches-ignore gh-pages)"
+helper_reach_is 0 "$V" "branches-ignore: '- gh-pages' with a CR is still accepted — the CR fix is not comment-hostile in the other direction (G4-01)"
+
+V="$(cr_fixture br-cr-legit branches main)"
+helper_reach_is 0 "$V" "branches: '- main' with a CR is still accepted (G4-01 — this was a FALSE RED at 54de1a4, the fail-closed half of the same defect)"
+
+V="$(cr_fixture br-cr-bad branches release)"
+helper_reach_is 13 "$V" "branches: '- release' with a CR still excludes main (G4-01, bad polarity)"
+
+V="$WORK/fixture.types-cr.yaml"
+{
+  printf 'name: f\non:\n  pull_request:\n    types:\n'
+  printf '      - opened\r\n'
+  printf '      - synchronize\n      - reopened\n'
+  printf 'jobs: {}\n'
+} >"$V"
+helper_reach_is 0 "$V" "types: with a CR on one item still reads the full default set (G4-01 — a false red at 54de1a4)"
+
+# The structural half, and the reason this round is not a third character-class
+# patch: on the ONE must-NOT-contain key, a token carrying a byte the reader
+# does not understand is REFUSED rather than searched. A future tokenizer
+# defect there can then produce a red or a refusal, never a silent accept.
+V="$WORK/fixture.bi-unreadable.yaml"
+{
+  printf 'name: f\non:\n  pull_request:\n    branches-ignore:\n'
+  printf '      - ma\001in\n'
+  printf 'jobs: {}\n'
+} >"$V"
+helper_reach_is 10 "$V" "a branches-ignore: token carrying an unreadable byte is REFUSED, not searched — the fail-open direction is now closed by construction rather than by enumerating bytes (G4-01)"
+
 m="$(helper_fixture wired-comment <<'FIX'
 name: f
 on:
diff --git a/hack/lib/pr_reach.sh b/hack/lib/pr_reach.sh
index 329ca0aa..8de7610a 100644
--- a/hack/lib/pr_reach.sh
+++ b/hack/lib/pr_reach.sh
@@ -47,12 +47,40 @@
 #     under `set -o pipefail`); matches go to a file, the file is inspected.
 #   * `set -e` safe: no bare `[[ ... ]] && return N` tails.
 #
-# WHAT THIS IS NOT. It is a line-oriented reader with a structural bias, not a
-# YAML parser. It understands block mappings at 2/4/6-space indent, block
-# sequences, and inline flow SEQUENCES. It does NOT understand anchors, aliases,
-# merge keys, or flow MAPPINGS, and it refuses (fails closed, with a distinct
-# code) rather than guessing when it meets one. Stated here rather than
-# discovered later: an honest narrow gate beats an overreaching one.
+# WHAT THIS IS NOT, and WHY IT STAYS THAT WAY. It is a line-oriented reader
+# with a structural bias, not a YAML parser. Four review rounds produced six
+# defects of one family — structure inferred from indentation and character
+# classes — so a real parse was evaluated rather than assumed. It was REJECTED
+# on measurement:
+#
+#   * `python3` is an established dependency of this repo
+#     (hack/validate-schemas-stock.sh) but it uses `json` ONLY, which is stdlib.
+#     PyYAML is established nowhere here.
+#   * hack/audit/README.md PUBLISHES `docker run --rm -v "$PWD:$PWD" -w "$PWD"
+#     debian:stable-slim bash hack/audit/aud2_exitgate_test.sh --text-only` as
+#     the offline verification path. That image was measured to contain no
+#     python3 and no yq — and both that gate (51 controls) and
+#     workflow_pins_test.sh were measured GREEN inside it with this file
+#     sourced. A PyYAML reader would break a published operator path.
+#   * Go is absent from that image too, and this reader runs in the CI step
+#     BEFORE actions/setup-go, by design.
+#
+# So the bound is stated here rather than discovered in a sixth round.
+#
+# READS: block mappings at any indent; block sequences whether their items are
+# indented under the key or written FLUSH with it; inline flow SEQUENCES;
+# quoted scalars; CRLF line endings.
+# REFUSES (distinct code, never a guess): flow MAPPINGS, anchors, aliases,
+# merge keys, filter keys outside GitHub's five, and — on the one
+# must-NOT-contain test — any token carrying a byte outside the ref/glob set.
+# DOES NOT READ: multi-line flow sequences (refused), and `strategy:`/matrix,
+# reusable-workflow `uses:` jobs and container entrypoints in the step reader.
+#
+# The safety argument does NOT rest on that list being complete. Every filter
+# test here is "must CONTAIN token X" except `branches-ignore:`, so a misread
+# yields a RED everywhere but there — and there, an unreadable token is refused
+# rather than searched. Unknown shapes therefore cost false reds, not silent
+# passes. An honest narrow gate beats an overreaching one.
 
 # The three PR-visible text gates, single-sourced so each can cross-pin the
 # others (D-157 residual 2: before this, each gate pinned only its OWN step, so
@@ -108,8 +136,8 @@ _assent_strip_comment() {
 }
 
 # _assent_yaml_tokens — split a value region into tokens on the YAML separators
-# separators (flow brackets/braces, commas, quotes, the `- ` sequence marker,
-# whitespace) and on nothing else.
+# (flow brackets/braces, commas, quotes, the `- ` sequence marker, whitespace)
+# and on nothing else.
 #
 # G3R-02: this replaced `tr -c 'A-Za-z0-9_' '\n'`, which ALSO split on `-` and
 # `/`. `branches: [main-next]` therefore yielded a `main` token, and a filter
@@ -119,15 +147,61 @@ _assent_strip_comment() {
 # [maintenance]` reddened correctly the whole time, which is exactly why the
 # defect survived review: only the values that contain `main` as a SUBSTRING
 # broke, and those are the ones that look right.
+#
+# G4-01: CR is stripped FIRST. It is a YAML break character, so `main<CR>` is
+# not a whole token — but the round-3 tokenizer emitted it as one, `grep -qx
+# main` missed it, and a `branches-ignore:` that EXCLUDES main reported "runs
+# on every pull request" (measured rc=0; the round-1 and round-2 readers both
+# said 13, so this was a regression introduced by the round-3 fix). One stray
+# CR on one committed line is enough: there is no `.gitattributes` here,
+# `core.autocrlf=false` preserves a committed CR, no gate scans workflows for
+# CR, and a GitHub diff renders it invisibly.
 _assent_yaml_tokens() {
-  sed -e 's/^[[:space:]]*-[[:space:]]*/ /' \
-    -e 's/[][{},]/ /g' \
-    -e 's/["'"'"']/ /g' \
+  tr -d '\r' \
+    | sed -e 's/^[[:space:]]*-[[:space:]]*/ /' \
+      -e 's/[][{},]/ /g' \
+      -e 's/["'"'"']/ /g' \
     | tr '\t' ' ' \
     | tr ' ' '\n' \
     | grep -v '^$' || true
 }
 
+# _assent_tokens_readable <token-file> — 0 when every token is built only from
+# characters this reader claims to understand, 1 otherwise.
+#
+# THE STRUCTURAL POINT, and the reason this exists instead of a third
+# character-class patch. Two of this lane's five P1s (G3R-02's `-`//` split,
+# G4-01's CR) are one defect wearing two costumes: a byte the tokenizer had not
+# been taught about silently CHANGED a token rather than stopping the reader.
+# Patching the byte closes the instance and leaves the class, and the next
+# unenumerated byte is another review round.
+#
+# The direction that can actually hurt is narrow and known. Every filter test
+# here is "must CONTAIN token X" — types must carry GitHub's defaults, branches
+# must carry main — EXCEPT one: `branches-ignore:` must NOT contain main. A
+# misread drops or mangles a token, so a must-CONTAIN test goes RED: annoying,
+# and fail-closed. Only the must-NOT-contain test turns a mangled token into a
+# silent PASS. That is the same asymmetry G3-04 records for comment stripping,
+# and it is structural rather than incidental.
+#
+# So the burden is inverted exactly there: a token carrying any byte outside the
+# git-ref/glob set is not graded at all, it is REFUSED. A future tokenizer
+# defect on that key can then yield a red or a refusal, never a silent accept —
+# by construction rather than by enumeration.
+# The set: what a git ref name or a glob can be built from, plus `#`. The `#`
+# is not an oversight — this key alone passes strip=0 (G3-04), so ordinary
+# comment text is EXPECTED to survive into its tokens and is not evidence of a
+# misread. Comment residue carrying anything more exotic than `#` refuses
+# rather than grades, which is the safe direction and the deliberate bound.
+_assent_tokens_readable() {
+  local bad="$1.unreadable"
+  grep -vE '^[A-Za-z0-9_./*+#-]+$' "$1" >"$bad" || true
+  if [[ -s "$bad" ]]; then
+    return 1
+  fi
+  return 0
+}
+
 # ---------------------------------------------------------------------------
 # assent_pr_reach <workflow-file> <scratch-dir>
 #
@@ -331,6 +405,12 @@ assent_pr_reach() {
     # Unstripped, a comment that merely mentions main reds, which is the
     # harmless direction.
     _assent_key_tokens "$prblk" branches-ignore 0 >"$bitoks"
+    # G4-01, the structural half: this is the reader's ONLY must-NOT-contain
+    # test, hence the only place a mangled token can become a silent accept.
+    # An unreadable token set is refused, never searched.
+    if ! _assent_tokens_readable "$bitoks"; then
+      return 10
+    fi
     if grep -qx 'main' "$bitoks"; then
       return 13
     fi
diff --git a/hack/lint/workflow_pins_test.sh b/hack/lint/workflow_pins_test.sh
index eef7e975..955aec8d 100755
--- a/hack/lint/workflow_pins_test.sh
+++ b/hack/lint/workflow_pins_test.sh
@@ -1377,6 +1377,62 @@ FIX
 )"
 helper_wired_is 7 "$V" "$SELF_GATE" "…and the bare '- run:' form is still graded for ARGUMENTS, not merely admitted (G3R-03)"
 
+# G4-01 — a stray CR on a sequence-item line. These fixtures are built with
+# printf rather than a heredoc because the CR has to be a REAL byte: that is
+# the whole point of the defect. A single committed CR was enough (no
+# .gitattributes here, core.autocrlf=false preserves it, no gate scans for it,
+# and a GitHub diff renders it invisibly), and it made `branches-ignore:` — the
+# ONE must-NOT-contain test in this reader — report "runs on every pull
+# request" for a trigger that EXCLUDES main. Measured rc=0 at 54de1a4; both
+# earlier readers said 13, so it was a regression the round-3 tokenizer
+# introduced. Both polarities are pinned at every consumer, because the CR also
+# caused FALSE REDS on `branches:` and `types:` and a fix for one direction is
+# not a fix for the other.
+cr_fixture() { # <name> <key> <item> — the item line carries a CR
+  local f="$WORK/fixture.$1.yaml"
+  {
+    printf 'name: f\non:\n  pull_request:\n    %s:\n' "$2"
+    printf '      - %s\r\n' "$3"
+    printf 'jobs: {}\n'
+  } >"$f"
+  grep -q "$(printf '\r')" "$f" ||
+    fail "fixture $1 carries no CR — the case it exists to cover is not present, so the assertion below would be vacuous"
+  printf '%s' "$f"
+}
+
+V="$(cr_fixture bi-cr-bad branches-ignore main)"
+helper_reach_is 13 "$V" "branches-ignore: '- main' with a CR still EXCLUDES main (G4-01 — THE fail-open: rc=0 at 54de1a4, on a trigger under which no PR onto main runs the workflow)"
+
+V="$(cr_fixture bi-cr-legit branches-ignore gh-pages)"
+helper_reach_is 0 "$V" "branches-ignore: '- gh-pages' with a CR is still accepted — the CR fix is not comment-hostile in the other direction (G4-01)"
+
+V="$(cr_fixture br-cr-legit branches main)"
+helper_reach_is 0 "$V" "branches: '- main' with a CR is still accepted (G4-01 — this was a FALSE RED at 54de1a4, the fail-closed half of the same defect)"
+
+V="$(cr_fixture br-cr-bad branches release)"
+helper_reach_is 13 "$V" "branches: '- release' with a CR still excludes main (G4-01, bad polarity)"
+
+V="$WORK/fixture.types-cr.yaml"
+{
+  printf 'name: f\non:\n  pull_request:\n    types:\n'
+  printf '      - opened\r\n'
+  printf '      - synchronize\n      - reopened\n'
+  printf 'jobs: {}\n'
+} >"$V"
+helper_reach_is 0 "$V" "types: with a CR on one item still reads the full default set (G4-01 — a false red at 54de1a4)"
+
+# The structural half, and the reason this round is not a third character-class
+# patch: on the ONE must-NOT-contain key, a token carrying a byte the reader
+# does not understand is REFUSED rather than searched. A future tokenizer
+# defect there can then produce a red or a refusal, never a silent accept.
+V="$WORK/fixture.bi-unreadable.yaml"
+{
+  printf 'name: f\non:\n  pull_request:\n    branches-ignore:\n'
+  printf '      - ma\001in\n'
+  printf 'jobs: {}\n'
+} >"$V"
+helper_reach_is 10 "$V" "a branches-ignore: token carrying an unreadable byte is REFUSED, not searched — the fail-open direction is now closed by construction rather than by enumerating bytes (G4-01)"
+
 f="$(helper_fixture wired-comment <<'FIX'
 name: f
 on:
diff --git a/openspec/specs/backlog.md b/openspec/specs/backlog.md
index a58579ff..9c4661de 100644
--- a/openspec/specs/backlog.md
+++ b/openspec/specs/backlog.md
@@ -749,6 +749,7 @@ that claim).
 | --- | --- | --- | --- | --- |
 | AUD2-F01 | **DONE** — SEC-03's twin: `hack/release/verify-artifacts.sh:124` ran the same **unpinned** `cosign verify-blob --bundle` on the maintainer/CI path; `verify_cosign()` now pins the D-153 issuer/identity pair and `hack/release/install_cosign_pin_test.sh` grades it as the **third** file of the one drift gate | **[autonomous]** | AUD2-S03 (D-153's value) | found *by* S03, deliberately left alone there — not an owned path, and out of that story's stated scope |
 | COUNT1-F01 | Two `go test` cache blind spots left inside `task test` / `task coverage` (`./...` and `./internal/...`): `internal/schemadrift` compares local `schemas/` against `git show origin/main:…` in a **subprocess**, and `internal/provider/isolation_test.go:29` `go build`s `./testdata/maliciousexec` at runtime | **[autonomous]** | — | found *by* the `-count=1` lane, deliberately left alone there: fixing them means carving packages out of `test`/`coverage` and losing an otherwise-honest whole-tree cache |
+| GATES3 | **DONE** (D-157) — the three PR-visible text gates (`hack/lint/workflow_pins_test.sh`, `hack/audit/aud2_exitgate_test.sh`, `hack/examples/dogfood_wiring_test.sh`) now share `hack/lib/pr_reach.sh`: PR reach is graded structurally (a `paths:`/`paths-ignore:`/narrowing-`types:`/main-excluding-branch filter, a `pull_request:` nested under another key, or a job-level `if:`/`needs:` all red), each gate **cross-pins the other two's steps**, and aud2's fixed-string step check is replaced by the anchored `run:`-command form. Independent review then found two P1s by mutating the REAL `verify.yaml` end-to-end (both fixed here): the filter greps were pinned to **exactly four spaces**, so a 6-space `paths:` — valid YAML, identical mapping — made all three gates green on the very shape the lane closes; and the step disarm grep lacked the sequence-item alternative, so `      - if: …` as a step's **first** key graded WIRED (that regex was inherited from `main`, not introduced). Two further review rounds each found one more P1 **in the previous round's fix**: a block sequence written FLUSH with its key was misgraded and the new key allowlist turned one such legitimate case into a red, and branch names were tokenised on `-`/`/` so `branches: [main-next]` yielded a `main` token and a main-EXCLUDING filter reported "runs on every PR"; then a stray **CR** on one sequence item made the same key report the same thing again. Five P1s total, three of them introduced by a fix — all one family: a line-oriented reader inferring YAML structure from indentation and character classes. Closed at the **class** level for the one direction that can fail open (`branches-ignore:`, the reader's only must-NOT-contain test): a token carrying a byte outside the ref/glob set is now REFUSED rather than searched, so a future tokenizer defect there yields a red or a refusal, never a silent accept. A real YAML parse was evaluated and rejected on measured evidence — see D-157 | **[autonomous]** | — | three reviewer-demonstrated residuals, all in the same three files, all deliberately left unfixed on their own lanes because fixing one of three identical checks would have been misleading |
 | CI-TOOLCHAIN | **DONE (D-158)** — `verify` was red on **every** PR, including a six-file Markdown diff with zero Go bytes, because `go-version: stable` rolled Go 1.26 → 1.27.0 while `GOLANGCI_LINT_VERSION` sat at `v2.12.2` (built with go1.26.x, so its `go/types` cannot read the 1.27 stdlib); pin bumped to `v2.13.1`, whose "go1.27 support" commit and `go 1.26.0` go.mod directive make it the first release that can | **[autonomous]** | — | not owned by any in-flight lane — the pin is a CI-only workflow env var, and the break blocked all of them |
 | ORPHAN | **DONE (D-159)** — `Taskfile.yml`'s `release-verify-test`, the only test of `hack/release/verify-artifacts.sh` (the procedure **`SECURITY.md:61` publishes to release consumers**), was invoked by nothing: absent from `check:`, from `CHECK_STAGES`, and from every workflow — D-124's "a gate invoked by nothing is not a gate", one epic on from AUD2-F01's published-instructions-rot finding. It was **green**, so the defect was wiring only. Now the 14th of 21 `check:` stages, in its three **offline** modes (`negative`, `cosign-skip-when-absent`, `readme` = REQ-E9-S12-02/03/04); the `all` default is deliberately NOT wired — it shells out to `task release-snapshot`, i.e. a networked `go install goreleaser`, a `go mod tidy` before-hook that rewrites tracked files mid-check, and `--clean` on `dist/`. **Not a gap to fill: REQ-E9-S12-01 (snapshot → verify round trip) is already automated** — `hack/release/exitgate_test.sh:33-34` runs exactly `task release-snapshot` then `task release-verify`, the spec's own `Verify:` string, in the `release-exitgate` job. It is push-only (`if: github.event_name != 'pull_request'`), so the exposure is **RELSE-08 visibility, not absence**; do NOT open a lane to build a gate that exists. `CHECK_STAGES` 20 → 21 in the same commit; body pinned **per mode** so dropping two modes or reverting to the bare default reds | **[autonomous]** | — | not owned by any in-flight lane; `Taskfile.yml` + `hack/audit/exitgate_test.sh` are the one `CHECK_STAGES` slot, which only one lane may hold at a time |
 | CI-TOOLCHAIN-F01 | The linter/toolchain coupling has **no early detector**: dependabot's `github-actions` ecosystem updates `uses:` refs, not `env:` literals, so `GOLANGCI_LINT_VERSION` rots silently until the next Go minor reds every PR at once (~6-monthly). Candidate: a text gate comparing the pinned linter release's go.mod `go 1.N` directive against the toolchain CI resolves, or an updater that watches the literal | **[autonomous]** | D-158 | deliberately out of scope of the fix lane: three lanes were parked behind it, and a new gate belongs with `hack/lint/**`, which was owned by a concurrent lane |

From c6df4245391499e785dac8f3eec4ebd430935c33 Mon Sep 17 00:00:00 2001
From: Konrad Heimel <konrad.heimel@gmail.com>
Date: Sun, 23 Aug 2026 22:36:06 +0200
Subject: [PATCH 6/8] :bug: fix(ci): refuse globs on branches-ignore, grade
 disarm keys by name (D-157)

Two P1s, both measured at GATE level on a scratch copy of the real
verify.yaml, not only at helper level - helper fixtures are what missed
them. All three gates PASSED each mutant before and red after; the
unmutated control stays rc=0 on all three.

G5-01 - a glob on `branches-ignore:` was a silent accept. `['**']`,
`['*']`, `['ma*']`, `[main*]`, `['*ain']`, flow and block form, all
returned 0 - "runs on EVERY pull request" - and every one of them
EXCLUDES main, so no PR onto main runs the workflow at all.

_assent_tokens_readable cannot catch this and must not: `*` is a legal
filter character, so the pattern tokenises perfectly, nothing is dropped
or mangled, and the burden inversion never engages. The defect was an
exact-token predicate applied to a PATTERN list. The header had already
reasoned this out one key over - a `branches:` glob reds because "a bash
gate cannot honestly evaluate GitHub's glob semantics, and refusing is
the fail-closed direction" - where the same un-evaluability is
fail-closed by polarity. On the one must-NOT-contain key it was
fail-open, so patterns are now refused there explicitly, never searched.
Literal lists still grade: [main] -> 13, [gh-pages] -> 0.

G5-02 - the disarm check matched a SPELLING, not a key. `if : `,
`"if":` and `'if' :` resolve identically to `if:` in a conformant parser
(checked against ruby/psych), so actionlint has nothing to flag - and a
step or job carrying release-exitgate's exact push-only guard graded
"wired, argument-free and undisarmed". At job level that is 0 where it
must be 4: the RELSE-08 shape this lane exists to catch.

The remedy is deliberately NOT a wider pattern. `[[:space:]]*:` would
have been the fifth spelling patch on this lane and would still miss the
sixth. Step and job keys are graded by NORMALISED NAME against an
allowlist, mirroring assent_pr_reach's filter-key allowlist, which was
measured immune to every one of these evasions. Normalisation is the
immunity. The literal greps are kept beside it as a union that can only
add detections, and a key that will not normalise to an identifier is
refused (3 at job level, 6 at step level) rather than skipped.

  step  if : / "if": / 'if' : / continue-on-error : / "c-o-e":  0 -> 8
  job   if : / "if":                                            0 -> 4
  job   needs : / "needs":                                      0 -> 9
  and the other polarity holds: a step with id:/shell:/env: in a job
  with timeout-minutes: is still 0.

G5-03/G5-04 - the guarantee sentence was an overclaim and is narrowed to
what is true. "Unknown shapes cost false reds, not silent passes" had
counterexamples INSIDE the surface documented as READ, which is the
D-124 species and worse than a documented hole. What actually holds: a
misread that DROPS or MANGLES a token fails closed everywhere (red on
the must-CONTAIN tests, refused on the must-NOT-contain one); a misread
that FABRICATES a token is not covered - `branches: ["main,next"]` is
shredded into `main` + `next` and grades 0. Measured, recorded in
DOES-NOT-READ, and left unfixed this round on purpose: the claim is
corrected to match the code rather than the code trusted to match the
claim.

25 helper-level before/after rows and 15 gate-level ones, 0 mismatches
in the after column. CONTROL_FLOOR unchanged at 57/51.
---
 CHANGELOG.md                         |   3 +
 docs/decisions/decisions.md          |   2 +-
 hack/examples/dogfood_wiring_test.sh |  94 +++++++++++++++++
 hack/lib/pr_reach.sh                 | 144 +++++++++++++++++++++++++--
 hack/lint/workflow_pins_test.sh      |  94 +++++++++++++++++
 5 files changed, 325 insertions(+), 12 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index bb4beb97..e026d6df 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -109,6 +109,9 @@ repository still gets a decision, never by following the link; no release carrie
 - :bug: fix(ci): run the -count=1 wiring pin in the PR-visible verify job
 - :bug: fix(ci): pin COUNT1-F01 and refuse a merged gate step
 - :bug: fix(ci): bump golangci-lint to v2.13.1 for Go 1.27 (D-158)
+- :bug: fix(ci): read flush block sequences and whole branch names (D-157)
+- :bug: fix(ci): strip CR, and close the one fail-open direction by construction (D-157)
+- :bug: fix(ci): refuse globs on branches-ignore, grade disarm keys by name (D-157)
 
 ### Refactoring
 - :recycle: refactor(audit): pin REL-03 and REL-07 by test name, demote source shape
diff --git a/docs/decisions/decisions.md b/docs/decisions/decisions.md
index 035e6709..a2e52d57 100644
--- a/docs/decisions/decisions.md
+++ b/docs/decisions/decisions.md
@@ -160,7 +160,7 @@ project/process decisions.
 | D-153 | 2026-08-19 | **The cosign signer-identity pin published in `SECURITY.md` was WRONG, not merely missing from `hack/install.sh`: the identity regexp is widened to `^https://github\.com/PlatformRelay/[Aa]ssent/` in both files (AUD2-S03 / SEC-03).** Substance first: `SECURITY.md`'s "Verify a tagged release" instructions pinned `--certificate-identity-regexp '^https://github.com/PlatformRelay/assent/'`, and an adopter who followed them on **v0.2.0 or v0.3.0 got a verification FAILURE on a genuine, correctly signed artifact** — the published recipe has been broken for every release since v0.2.0, and the natural reading of that failure is "this release was tampered with". Cause: the repository was renamed `PlatformRelay/assent` → `PlatformRelay/Assent` between v0.1.0 and v0.2.0; the keyless signing certificate's Subject Alternative Name carries GitHub's canonical casing; cosign compiles `--certificate-identity-regexp` as a Go RE2 pattern and matches it **case-sensitively**. Decoded from the published bundles: v0.3.0 and v0.2.0 sign as `https://github.com/PlatformRelay/Assent/.github/workflows/release.yaml@refs/tags/vX.Y.Z`, v0.1.0 as `https://github.com/PlatformRelay/assent/.github/workflows/release.yaml@refs/heads/main`. All three verify under the new value; independently re-confirmed with real cosign against the real v0.3.0 artifact (`Verified OK` under the new pin, exit 1 "expected SAN value to match regex" under the old). Options considered: **(a)** ship the pin byte-identical to the published-but-broken value and file the breakage as a follow-up (rejected — it would land a green gate asserting a guarantee that fails closed on this project's own releases, D-124's defect one level up); **(b)** case-insensitive `(?i)` (rejected — wider than the defect and it silently accepts casings GitHub never issues); **(c)** an explicit `[Aa]` class in both files, dots escaped (chosen). Not widened otherwise: the `^` anchor and the owner/repo scope stand, so another owner, an `assent-mirror` typosquat, another forge and an unescaped-dot host all still fail. Enforcement, per D-128: **one** published truth — `hack/release/install_cosign_pin_test.sh` extracts the pair from `hack/install.sh` and `SECURITY.md`, requires exactly one distinct value per file, reddens on drift, and (this is the assertion that would have caught the defect) matches the pin against the three **real** SANs above, committed as offline fixtures, plus six negatives. Extends D-110 (bundles beside archives) and D-109; the maintainer-path twin at `hack/release/verify-artifacts.sh:124` is still unpinned and is tracked in the backlog, not fixed here. Revert: restore `'^https://github.com/PlatformRelay/assent/'` in both files — which re-breaks verification of v0.2.0 and every later release, so revert only together with a repo rename back to lowercase. |
 | D-154 | 2026-08-23 | **Every `hack/**` script that uses a bash 4+ feature declares a PER-SCRIPT version floor via the shared `hack/lib/require-bash.sh`, because one of them was a silent local FAIL-OPEN under stock macOS bash 3.2 (BASH32-F01).** Substance first: `/bin/bash hack/docs/truthlag_pins_test.sh` on macOS printed 20 `PASS` lines, died at its `declare -A ex_s09_prefix_hint=(…)`, never printed its final `OK: all truth-lag pins green` banner — and **exited 0**. Its caller `task docs-gates`, and therefore `task check`, read that as a green gate, and AGENTS.md rule 4 makes a green local `task check` a per-commit precondition; CI is ubuntu/bash 5, so nothing merges through this path, which is precisely why it survived. Mechanism, measured on bash 3.2.57: 3.2 has no associative arrays, so under `set -u` it re-reads `declare -A x=([k]=v)` as an INDEXED array assignment and evaluates the subscript `k` **arithmetically**, hitting "unbound variable"; the shell terminates the script and the exit status is 0. Two theories were disproved en route and are recorded so they are not re-explored: the `trap … EXIT` status-swallow (3.2 propagates 1 through an EXIT trap correctly) and `set -e` (the script runs `set -uo pipefail`). The other two affected scripts fail CLOSED, but only incidentally: `hack/release/verify-artifacts.sh:202`'s literal is EMPTY, so there is no subscript to evaluate and it degrades to `declare: -A: invalid option`, which its `set -e` turns into exit 2 (measured with a `--dist` that reaches line 202 — an unreachable dist exits 1 much earlier); `hack/validate-schemas-stock.sh`'s `mapfile` degrades to "command not found" and it exits 1. Populating an empty literal or dropping `-e` silently converts a closed failure into the open one, so "how this construct happens to degrade" is not a guarantee worth depending on. Options considered: **(a)** one blanket repo-wide floor (rejected — the binding minimum differs per feature: `declare -A` 4.0, `local -n` 4.3, `mapfile -d ''` 4.4; a blanket floor both refuses shells that could run the 4.0 gates and hides which feature actually binds); **(b)** rewrite the three scripts to be 3.2-compatible (rejected — associative arrays and `mapfile` are the right tools here, a rewrite is a large risky change to scripts whose correctness IS the product, and it does nothing about the next gate author); **(c)** copy the existing inline `BASH_VERSINFO` guard from `hack/audit/aud2_exitgate_test.sh:71` into each script (rejected as the *only* measure — it duplicates the explanation three more times and still leaves the next author to rediscover the hazard); **(d) chosen** — a shared `require_bash <major>[.<minor>] <feature>` helper, called with each script's own correct floor (4.0 / 4.0 / 4.4), plus a meta-gate. Enforcement, per D-128, is one place: `hack/lint/bash_version_guard_test.sh`, wired as `task check` stage **20** and pinned in `hack/audit/exitgate_test.sh`'s `CHECK_STAGES` in the same commit. It scans every `hack/**/*.sh` for command-position bash 4+ constructs, requires a guard on each, requires the declared floor to be at least the feature's own minimum, and — the assertion that makes the rest non-vacuous — requires the scan to still find all four known feature-using files, so a typo in a detection pattern reds instead of quietly matching nothing. Its own negative control mutates real copies of the three scripts with the guard lines stripped and asserts they are flagged. `hack/audit/aud2_exitgate_test.sh` keeps its inline guard and is accepted by the gate as guarded; adopting the helper there is a follow-up, not this lane. Stated limits: the gate sees only command-position constructs in `hack/**/*.sh` (not `eval`, dynamically built command names, case-modification expansions, or scripts outside `hack/`), and the exit-0 control needs a real bash 3.2 — present on macOS, absent on CI ubuntu, where it SKIPs **loudly** rather than passing silently. Accepted behaviour change: under 3.2, `hack/release/verify-artifacts.sh --help` now refuses instead of printing usage. Revert: delete the guard calls — `task check` then silently stops certifying the docs truth-lag pins for every contributor whose `bash` is 3.2. |
 | D-156 | 2026-08-23 | **The tier-1 (CEL) ceiling is recorded (`docs/planning/rego-tier-ceiling.md`, E11-S01 / REQ-E11-S01-01+02) and it NARROWS E11: two of the four named shapes are struck outright and a third in part.** Substance first: of multi-pass / cross-manifest / set-difference / graph-relationship (`openspec/specs/later-phases.md:284`), **cross-manifest and set-difference are struck, the "named intermediate" half of multi-pass is struck, and only fold/aggregate-over-a-collection and in-input graph reasoning survive as justification for a second backend.** Measured against the surface this repo actually binds — `internal/core/aggregate/evaluate.go` `newEvalEnv`, eleven frozen predicate-scope variables, **zero extension libraries** — reproduced in a nested throwaway module pinned to the repo's `cel-go v0.31.0` (root `go.mod`/`go.sum` byte-unchanged; nothing added to the dependency graph, which judgment call (d) has not authorised). **What exceeds tier 1: (1) folds.** `sum`, `reduce`, `math.*` and `lists.*` are all `undeclared reference`; `size()` is the only aggregate in the surface, so a rule counting matched changes is expressible and a rule summing a numeric delta across them is not. **(2) Graph reasoning** — the iteration count of a CEL expression cannot be made data-dependent, so depth is syntactic and **unbounded** reachability has no spelling; a bounded `k`-hop form *is* writable and answers a fixed-depth question, not the rule (detailed below, with the refutations of two sharper claims this row previously made). **What is struck, with the CEL that does the job:** registry membership — `string(new) in facts.registry.topics.value` over a `cardinality: set` fact, already shipped green at `examples/packs/service-catalog/.assent/packs/catalog/rules/ownership.yaml:21`; keyed attribute lookup — either a purpose-built provider (`builtin/resource-owner`, exercised in both polarities by `examples/archetypes/referenced-resource-ownership/`) or `facts.<p>.<n>.value[key].field`, which compiles and is lint-clean because `internal/lint/facts_ref.go`'s D-051 shape check permits arbitrary navigation past `.value` and only forbids indexing `facts` itself; set difference — `oldEntry.acls.filter(a, !(a in entry.acls)).size() == 0`; named intermediates — no `cel.bind`, but re-deriving the sub-expression inside each leaf is semantically identical and compiles. **The sharpest finding is a distinction, not a rule:** same-changeset **cross-file** reasoning fails for **input availability**, not expressiveness — the evaluation unit is one file (`change.ChangeSet` is documented "for one file", `internal/change/diff.go:129`; `assent run` strips one `--subject file:<path>`, `cmd/assent/run.go:266`, and diffs it alone, `:293`) and **REQ-E11-S05-01 pins the Rego module to the identical `EvaluationInput`** with the tier fenced to "declared data, no I/O". **A Rego module therefore fails that rule identically, so it is struck from E11's justification too** — the fix is an input decision, which E11's non-goals fence, not a backend decision. Corroborating: the one committed illustration of the escape hatch, `examples/policies/rego/bounded_change.rego`, is **entirely tier-1 expressible** — both `violations` rules are per-change predicates and `examples/policies/declarative/bounded-change.yaml` is the same rule already in the envelope. **The strongest single piece of evidence, and the one that sizes the epic, is the graph shape.** On the `assent run` path document-mode `walkNode` emits a Change **only where two scalars differ** — a sequence on either side makes the whole ChangeSet **opaque → REVIEW** before any rule runs (`internal/change/diff.go`) — and collection-mode `DiffEntries` is reached only from `internal/adoptertest`, so `old`/`new`/`entry`/`oldEntry` and every `changes[i].old`/`.new` bind **scalars**. That does **not** starve a graph rule, because a flat `set` fact still carries structure: `edges: {type: string, cardinality: set}` returning `["orders|billing","billing|ledger"]` is a **fully declarable, in-contract adjacency inside `EvaluationInput` today** — the declaration is legal (`schemas/provider/v1alpha1/response.schema.json`), `fact.value` carries no JSON-Schema type constraint and `ResolveFactsChecked` cross-checks the *declaration* not the value (`internal/provider/resolve.go`), outputs are operator-authored (`internal/provider/config.go`), the `http` transport is live on the plain run path with **no `--checkout`** (`cmd/assent/provider_host.go` `providerCallFor`), and a set fact binds as a CEL list. Tier-1 CEL nonetheless cannot answer the actual question over it: **CEL has no recursion, fixpoint, fold or user-defined function, so unbounded reachability has no spelling** (`transitiveClosure` → `undeclared reference`; the four comprehension macros iterate one level and cannot call themselves). **Stated precisely, because two drafts of this record overreached and both were caught by independent review:** a *bounded* `k`-hop check **is** expressible and does **not** need the string decomposition CEL lacks — over a finite in-input candidate set (a `nodes` set fact, the same construction as `edges`), decode is replaceable by **encode-and-compare**: `nodes.value.exists(m, nodes.value.exists(n, (string(new)+"|"+m) in edges.value && (m+"|"+n) in edges.value && (n+"|"+string(new)) in edges.value))` compiles **and evaluates** under the real `cel.CostLimit(1_000_000)` to `true/true/true/false` over the fixture above, and `nodes.value.filter(m, (string(new)+"|"+m) in edges.value)` recovers an edge's far end as `[billing]`. Both primitives (`+` on strings, `in`) were already in this record's own function census, so the claim that decoding was a second independent barrier was internally inconsistent as well as false. **The real ceiling is `k`, and a third draft got its cost wrong too** — it claimed `O(|N|^(k-1)·|E|)` "exhausts the cost budget on any real graph". Wrong complexity class and wrong conclusion, because the census had omitted the surface's only value binder, `[expr].all(v, …)`: binding each BFS frontier once per level makes cost additive across levels, and measured under the real `cel.CostLimit(1_000_000)` a ring `|N|=50, deg 5` costs 89,551 at `k=10`, 235,297 at `k=20` and 686,317 at `k=50` — roughly linear in `k`, and at `k=50 ≥ |N|` CEL is **not approximating at all, it decides reachability exactly**, in 69% of budget. The practical `k` collapses around `|N|≈200` (`k=10` at 46% of budget, `k=20` exceeds). Recorded because a reader sizing this epic is entitled to ask "would CEL suffice for *our* graph?" and the previous sentence foreclosed that question with an assertion measurement refutes; it is **not** offered as a second reason. **What carries the verdict is one property, now measured rather than recalled: the iteration count of a tier-1 CEL expression cannot be made data-dependent.** `reduce`, `transformList`, `transformMap`, two-var `all(i,x,…)`, `range`/`lists.range` and `cel.bind` are all `undeclared reference`; `for` is a `reserved identifier`; there is no fold, self-reference or generator; so depth is a **syntactic** property, hard-capped by cel-go's parser recursion limit of 250 (`expression recursion limit exceeded: 250` at depth 260, depth 200 still compiles). That a fixed `k` really is an approximation when the data outruns it is measured too: on a 4-cycle the `k=3` form evaluates `false` and the `k=4` form `true`. **Rego answers the unbounded question with `graph.reachable` — pure and deterministic — and that single gap is the whole justification.** **An input that is in contract and available today, over which CEL can only approximate and Rego decides, is exactly the per-rule evidence D-017's gate demanded — so E11 has TWO unconditional justifications (folds and graphs), neither waiting on any open question.** Deliverability caveat, stated because this row makes the same distinction for sub-shape B1: **no provider in the corpus ships an encoded adjacency today** — that one *can* follows from the provider contract, the same inference used to strike B1, not from a shipped example. Options considered: **(a)** record all four shapes as exceeding, the reading D-141's unlock invites (rejected — three are demonstrably expressible and an unfalsifiable ceiling claim is the defect this story exists to prevent); **(b)** strike set-difference **conditionally**, so that a narrowing answer to OQ-35 would return it to the ceiling (rejected on the second pass — both resolutions strike it: extending the entry binding makes CEL express it, narrowing makes it an input-availability failure that REQ-E11-S05-01 hands to Rego unchanged, so a conditional would have left a downstream story waiting on an answer that cannot change the verdict); **(c)** strike cross-manifest and set-difference **unconditionally**, strike half of multi-pass, keep folds and in-input graphs **both unconditionally** **(chosen)**. **Two rejected drafts are recorded because the same failure produced both, with the sign flipped, and only independent review caught either.** Draft 1 made the graph shape *contingent* on OQ-35/OQ-36 on the premise that "an adjacency needs a mapping-valued fact" — it does not; a set of encoded strings carries one inside the frozen declaration — which came from conflating a *provider-supplied catalog* (sub-shapes B1/B2, struck here as working and shipped) with **B3, which is specifically same-changeset cross-file *diffs***. It would have advised the operator to defer a 14-story epic on a premise that does not hold. Draft 2 replaced that with a second "independent reason" — that CEL cannot decode an edge, killing even a bounded two-hop check — **refuted by execution** (the encode-and-compare leaf above). Draft 3 replaced *that* with the exponential-cost claim above — **refuted by measurement**. The common cause across all three is one habit: **reaching for a second independent reason when one sufficient reason was already in hand**, and then applying an **asymmetric evidentiary standard** to protect it — accepting awkward-but-working spellings when they *struck* a shape (A2's re-derivation, B2's dynamic index) and rejecting them when they would have *narrowed* one this record wanted to keep. The verdict was right in all four drafts; the supporting argument was wrong in three. It now rests on one measured property and no supporting argument at all, which is the form it should have taken first. The correction to A2 runs the same way: the value binder `[expr].all(v, …)` removes the evaluation-cost half of A2's residual, so **A2 is struck more firmly than the first draft struck it**. Binds later stories: **S05** must not be widened to carry cross-manifest data; **S07**'s violation shape must support a fold result and a path/cycle witness, not a cross-manifest reference; **S12** must correct ADR-0002's `rego` bullet, which calls the tier an "escape hatch for **cross-entry checks**" — inaccurate for the shipped input contract; **S11** must label the unquarantined example a shape illustration, never evidence of need. **Binds E11-S04, whose denylist is not yet written: `graph.reachable` MUST be allowed**, with `split` alongside it — both pure and deterministic. `graph.reachable` is the one that carries the justification (it closes the graph at any depth); `split` is a convenience for rebuilding the adjacency. A capability set drafted from "deny anything unfamiliar" would strike out the epic's own strongest justification. Recorded in the S04 section of the epic spec, not only S01's. **That floor is held by REVIEW, not by a gate, and this row says so rather than inventing an enforcement path:** REQ-E11-S04-02's committed golden detects a *change* to the allowed set (so the sandbox cannot silently widen) and cannot detect an *omission* — a golden written without `graph.reachable` stays green forever. It says nothing about judgment call (d), since *which* builtins are callable is orthogonal to *where* the evaluator lives. Two residuals raised, neither decided, **neither gating any verdict here**, and neither the escalated rule-7 (d1)/(d2) question: **OQ-35** (the `entry`/`oldEntry` binding asymmetry — a silent `assent test` / `assent run` divergence; set-difference is struck either way and the graph shape needs no entry tree) and **OQ-36** (the frozen provider declaration has no object/map type, yet the authoring surface and `builtin/repo-file` together permit a mapping-valued fact). Also flagged, not edited (out of lane): `REQ-DEM-S05-04` calls the provider-visible tree the "merged-result checkout"; the code reads `<root>/head`, documented at `cmd/assent/checkout.go:44` as "the MERGE-REQUEST HEAD". This lane writes no Go, adds no dependency and touches no schema. Revert: delete `docs/planning/rego-tier-ceiling.md` and the D-156 narrowing text from the E11 spec — which restores an epic justified by four shapes, three of which this record shows are not real. |
-| D-157 | 2026-08-23 | **"Reaches pull requests" is now a SHARED, structural check (`hack/lib/pr_reach.sh`), the three PR-visible text gates CROSS-PIN each other's steps, and the fixed-string step check is replaced by an anchored `run:`-command match (GATES3).** Three residuals, each *demonstrated* by an independent reviewer on an earlier lane and each deliberately left unfixed there, all living in the same three files — `hack/lint/workflow_pins_test.sh`, `hack/audit/aud2_exitgate_test.sh`, `hack/examples/dogfood_wiring_test.sh`. **(1) The substantive one.** Two of the three answered "am I reachable on a PR?" with `grep -qE '^[[:space:]]+pull_request:'` over the workflow's `on:` block; a reviewer added `paths: ['internal/**']` under the trigger and measured **rc=0** — the trigger is present, the grep is satisfied, and the gate is disarmed for every PR that touches only `Taskfile.yml` or `.github/workflows/**`, which is exactly the class of PR these gates exist to grade. `types: [closed]` is the same defect by another route, and the grep's `[[:space:]]+` is indent-blind, so a `pull_request:` nested under `workflow_call.inputs` satisfied it too. **The third gate did not answer the question at all** — `workflow_pins_test.sh` asserted its step was present and undisarmed and never that the workflow carrying it runs on a PR; this is new coverage there, not a strengthening, and the brief that commissioned this lane assumed otherwise. **Decision on meaning:** a workflow "reaches PRs" when it has a top-level `pull_request:` trigger — a key of `on:` itself, at 2-space indent — whose sub-block carries **only keys from GitHub's five** (`types`, `branches`, `branches-ignore`, `paths`, `paths-ignore`; a sixth is **refused**, not guessed at), with **no** `paths:`/`paths-ignore:`, a `types:` list that is absent or a **superset** of GitHub's defaults (`opened`, `synchronize`, `reopened`), and no branch filter excluding `main` — **each read at whatever indent it is written at, and with its block sequence read whether the items are indented under the key or written FLUSH with it**, because the sub-block extraction is already scoped to the trigger and an indent pin bought no isolation the scoping did not already provide; branch and type names are compared as WHOLE tokens split on YAML's own separators, so `main-next` and `release/main` are not `main` — and when the target job carries neither a job-level `if:` **nor a job-level `needs:`** (a dependency that skips on PRs skips its dependents, defeating all three gates at once while every other assertion stays green), and the gate's own step carries no `if:`/`continue-on-error:` **in either the mapping-key or the sequence-item position** (`      - if:` is the step's first key and is a sequence item). **Deliberately still accepted**, stated so a reviewer does not read the narrowing as wider than it is: `on: pull_request` and `on: [push, pull_request]` (the inline forms cannot carry a filter, so they are strictly safer than the block form), the quoted `"on":` key, a `types:` superset, `branches:` listing the literal `main`, `branches-ignore:` sparing `main`, block-scalar `run: |` invocations, arbitrarily long comment blocks inside a gate step, and step-level `if:` on *other* steps (`verify.yaml`'s changelog gate is legitimately PR-excluded). **Deliberately narrower than GitHub:** a `branches:` glob covering main without the literal token (`['ma*']`) reds, because a bash gate cannot honestly evaluate GitHub's glob semantics, and a flow mapping or anchor in the `on:` block is **refused** (distinct code) rather than guessed at. **(2)** Each gate pinned only its OWN step, so a PR deleting one of the other two was invisible to the gate that still ran — caught locally by `task check` and on push by `release-exitgate`, hence a gap and not a hole. Each gate now asserts all three steps; the mutation matrix is the full cross-product (3 deleted steps × the 2 observers that still run) rather than a diagonal. **(3)** `aud2_exitgate_test.sh`'s `check_pr_wiring` located its step with `grep -nF -- "$SELF"` — a search for the script *name*, which the step's own comments satisfy. Measured by the reviewer: with the `run:` line commented out it still failed, but reported **"WITH ARGUMENTS"** instead of "does not invoke", sending an operator to look for an argument that does not exist. The anchored form from `dogfood_wiring_test.sh` is ported back and shared. **Why one lane and one helper, not three fixes:** the INBOX residual explicitly asked for a single shared helper so the next gate author inherits the strong check rather than copying the weak one; fixing one of three identical checks would have been misleading. **Judgment calls.** (a) The helper is **codes-only and prints nothing** — every caller owns its wording, because roughly twenty existing `expect_red` controls pin stderr fragments. (b) The 1..6 **line cap** `workflow_pins_test.sh` used to bound step isolation is replaced by a structural invariant — exactly one `run:` key and no `uses:` key, both of which actionlint itself flags — because cross-pinning made the helper isolate the aud2 and dogfood steps, whose comment blocks are a dozen lines long, and no cap admits an honest step of theirs while rejecting a merged one. (c) The helper is held to `workflow_pins_test.sh`'s preamble rules (**bash 3.2**, portable ERE, no `git`, no `grep -q` on a pipe) rather than aud2's ≥4.3 floor: that gate runs first in CI before any toolchain, and the other two callers do not refuse bash 3.2, so a bash-4 construct here would silently weaken them on a maintainer's machine. (d) It is a **line-oriented reader with a structural bias, not a YAML parser** — it says so in its own header and fails closed on anchors, aliases and flow mappings, because an honest narrow gate beats an overreaching one. (e) No new `check:` stage and `CHECK_STAGES` untouched: all three gates were already wired. **Evidence:** 44 helper-level probes, 20 host-independent fixture self-checks carried inside two of the gates, and end-to-end mutation of a scratch copy of the REAL `verify.yaml` driven through all three real gate scripts (the layer that found (ii) and (iii); fixtures alone did not) plus, in the gates themselves, 13 new red controls in aud2 (`CONTROL_FLOOR` 38→51, text-only 32→45, both floors met exactly), 15 in `workflow_pins_test.sh` and 12 in `dogfood_wiring_test.sh` — each pinned to its own finding text or rc — and, in every gate, **green** controls for the legitimate shapes above, so the new checks are provably not always-red. **Six fail-opens were found by building mutants rather than by reasoning — four of them in this lane's own code, across four review rounds — and the record names every one, because the lane's value is the mutants, not the prose.** (i) *This lane's own widening:* accepting a block-scalar `run: |` invocation naively means a bare `bash <script>` line anywhere in the job satisfies the step check, including inside another step's multi-command `run: |` body where `echo skip && exit 0` a line above would mean the gate never runs — measured rc=0. The block form now counts only as a block's **sole** command, and all three gates carry that mutant. (ii) *The residual this lane exists to close, still open at any indent but four:* the filter greps were pinned to exactly four spaces, six-space indent is valid YAML resolving to the identical mapping, and the miss fell through to `return 0` — so on the real `verify.yaml` all three gates returned **rc=0** on a `paths:`-filtered trigger written one level deeper, the exact shape this row says they refuse. It was also the one place the helper broke its own stated rule, refusing an unevaluable *shape* while silently accepting an unrecognised *indent*. Matching is now indent-agnostic within the trigger sub-block, plus the five-key allowlist above. (iii) *Inherited, not introduced:* the step disarm grep lacked the `(-[[:space:]]+)?` alternative its `run:`/`uses:` siblings in the same function had, so a step whose FIRST key is the disarm (`      - if: …`) graded **wired, argument-free and undisarmed** — measured rc=0 on the real workflow, and it hollowed out the cross-pinning this row delivers. The byte-identical regex is in `main`'s `dogfood_wiring_test.sh`, so this is a pre-existing hole closed here, not a regression. (iv) *A tokenizer that split on the wrong characters:* branch and type names were tokenised with `tr -c 'A-Za-z0-9_'`, which splits on `-` and `/`, so `branches: [main-next]`, `branches: ['release/main']` and a `- main-v2` item each yielded a `main` token and were reported as **reaching every pull request** when no PR onto main runs the workflow at all (measured rc=0 on all three). `branches: [maintenance]` reddened correctly throughout, which is precisely why this survived two reviews: only the values that contain `main` as a **substring** — the ones that look right — were broken. Tokenising on YAML's own separators fixed it in both directions (`branches-ignore: [main-next]` had been a false RED). (v) *A blind spot reproduced while fixing the complaint about it:* a block sequence written FLUSH with its key — `branches:` then `    - main`, the canonical GitHub Actions style — was misgraded, and the key allowlist added in round two turned one such case from a correct 0 into a refusal, **reddening valid structure**. Two stacked defects: the value region's indent bound never admitted an item at the key's own indent (measurable independently of the allowlist), and the allowlist counted `- main` as an unknown key. **Why a 28-row mutant matrix missed (ii) and (iii), and why the fixture set added to close that missed (v):** the round-two fixtures gave every reach and wired code a host-independent case — a real improvement — but wrote all of them at 4 or 6 spaces with sequence items indented deeper than their key, so the substitution reproduced the same indentation blind spot somewhere cheaper. Breadth of mutant SHAPES is not breadth of coverage, and neither is breadth of return CODES if every case shares one incidental style. it was broad in mutant SHAPES and narrow in CODE coverage — 3 of 6 `assent_pr_reach` codes and 2 of 8 `assent_step_wired` codes had a host-independent fixture, and both defects lived in the uncovered ones. Every code now has one, the filter fixtures deliberately written at a non-4-space indent, and in flush block-sequence style as well after (v). (vi) *And then a line ending.* A single stray **CR** on one `branches-ignore:` sequence item made the tokenizer emit `main<CR>` as a whole token; `grep -qx main` missed it and the reader returned **0**, "runs on every pull request", for a trigger that EXCLUDES main (measured; both earlier readers said 13, so the round-3 tokenizer introduced it). One committed CR suffices: there is no `.gitattributes` here, `core.autocrlf=false` preserves it, no gate scans workflows for CR, and a GitHub diff renders it invisibly. CR is a YAML break character, so `main<CR>` was never a whole token and the reader was wrong by this row's own "compared as WHOLE tokens" rule. **THE CLASS IS NOW CLOSED WHERE IT CAN HURT, not merely the instance.** Four rounds produced six defects of one family — a line-oriented reader inferring YAML structure from indentation and character classes — and patching bytes one at a time was visibly not converging. The direction that can hurt, however, is narrow and structural: every filter test here is *must CONTAIN token X* (types must carry GitHub's defaults, branches must carry `main`) except **one**, `branches-ignore:`, which is *must NOT contain*. A misread drops or mangles a token, so every must-CONTAIN test goes RED — the CR bug's other two symptoms were exactly that, false reds on `branches:` and `types:`. Only the must-NOT-contain test converts a mangled token into a silent PASS. So the burden is inverted there: a token carrying any byte outside the git-ref/glob set (plus `#`, since that key alone keeps comment residue by G3-04's design) is now **REFUSED** rather than searched. A future tokenizer defect on that key can produce a red or a refusal, never a silent accept — by construction, not by enumeration. **A real YAML parse was evaluated and REJECTED on measured evidence, not assumed either way.** `python3` is an established dependency (`hack/validate-schemas-stock.sh`), but it uses **`json` only — stdlib**; PyYAML is nowhere established in this repo. Decisively: `hack/audit/README.md` publishes `docker run --rm -v "$PWD:$PWD" -w "$PWD" debian:stable-slim bash hack/audit/aud2_exitgate_test.sh --text-only` as the offline verification path, and that image was measured to contain **no python3 and no yq** — while the gate itself, which sources this helper, was measured GREEN in it (51 mutation controls), as was `workflow_pins_test.sh`. A PyYAML reader would break a published operator path and would also violate this file's stated no-toolchain contract (it runs first in CI, before `setup-go`). Go is unavailable in that image for the same reason. So the reader stays a heuristic, and the honest bound is written into its header rather than implied: it reads block mappings at any indent, block sequences indented or flush, inline flow sequences and quoted scalars; it REFUSES flow mappings, anchors, aliases, merge keys, unknown filter keys and unreadable tokens; and its one must-NOT-contain test now refuses instead of guessing. Recorded so a future lane does not re-litigate: if PyYAML ever becomes a committed dependency of the verification image, replacing this reader wholesale is the right move and would dissolve the remaining bounds. **The helper is graded too, not only the workflows it reads:** every mutation control mutates `verify.yaml` and asks the helper about it, which cannot tell a working helper from a stubbed one — with the helper now a single point of failure for all three gates, replacing `assent_pr_reach` with `return 0` would turn them all green at once. Two of the gates therefore also drive it against **from-scratch fixture workflows** whose right answer depends on nothing under `.github/workflows/**` (verified: the stub reds them by name). Revert: delete `hack/lib/pr_reach.sh` and restore the three gates' local readers — which restores the `paths:`-filtered bypass, the self-only pinning, and the misreport. |
+| D-157 | 2026-08-23 | **"Reaches pull requests" is now a SHARED, structural check (`hack/lib/pr_reach.sh`), the three PR-visible text gates CROSS-PIN each other's steps, and the fixed-string step check is replaced by an anchored `run:`-command match (GATES3).** Three residuals, each *demonstrated* by an independent reviewer on an earlier lane and each deliberately left unfixed there, all living in the same three files — `hack/lint/workflow_pins_test.sh`, `hack/audit/aud2_exitgate_test.sh`, `hack/examples/dogfood_wiring_test.sh`. **(1) The substantive one.** Two of the three answered "am I reachable on a PR?" with `grep -qE '^[[:space:]]+pull_request:'` over the workflow's `on:` block; a reviewer added `paths: ['internal/**']` under the trigger and measured **rc=0** — the trigger is present, the grep is satisfied, and the gate is disarmed for every PR that touches only `Taskfile.yml` or `.github/workflows/**`, which is exactly the class of PR these gates exist to grade. `types: [closed]` is the same defect by another route, and the grep's `[[:space:]]+` is indent-blind, so a `pull_request:` nested under `workflow_call.inputs` satisfied it too. **The third gate did not answer the question at all** — `workflow_pins_test.sh` asserted its step was present and undisarmed and never that the workflow carrying it runs on a PR; this is new coverage there, not a strengthening, and the brief that commissioned this lane assumed otherwise. **Decision on meaning:** a workflow "reaches PRs" when it has a top-level `pull_request:` trigger — a key of `on:` itself, at 2-space indent — whose sub-block carries **only keys from GitHub's five** (`types`, `branches`, `branches-ignore`, `paths`, `paths-ignore`; a sixth is **refused**, not guessed at), with **no** `paths:`/`paths-ignore:`, a `types:` list that is absent or a **superset** of GitHub's defaults (`opened`, `synchronize`, `reopened`), and no branch filter excluding `main` — **each read at whatever indent it is written at, and with its block sequence read whether the items are indented under the key or written FLUSH with it**, because the sub-block extraction is already scoped to the trigger and an indent pin bought no isolation the scoping did not already provide; branch and type names are compared as WHOLE tokens split on YAML's own separators, so `main-next` and `release/main` are not `main` — and when the target job carries neither a job-level `if:` **nor a job-level `needs:`** (a dependency that skips on PRs skips its dependents, defeating all three gates at once while every other assertion stays green), and the gate's own step carries no `if:`/`continue-on-error:` **in either the mapping-key or the sequence-item position** (`      - if:` is the step's first key and is a sequence item). **Deliberately still accepted**, stated so a reviewer does not read the narrowing as wider than it is: `on: pull_request` and `on: [push, pull_request]` (the inline forms cannot carry a filter, so they are strictly safer than the block form), the quoted `"on":` key, a `types:` superset, `branches:` listing the literal `main`, `branches-ignore:` sparing `main`, block-scalar `run: |` invocations, arbitrarily long comment blocks inside a gate step, and step-level `if:` on *other* steps (`verify.yaml`'s changelog gate is legitimately PR-excluded). **Deliberately narrower than GitHub:** a `branches:` glob covering main without the literal token (`['ma*']`) reds, because a bash gate cannot honestly evaluate GitHub's glob semantics, and a flow mapping or anchor in the `on:` block is **refused** (distinct code) rather than guessed at. **(2)** Each gate pinned only its OWN step, so a PR deleting one of the other two was invisible to the gate that still ran — caught locally by `task check` and on push by `release-exitgate`, hence a gap and not a hole. Each gate now asserts all three steps; the mutation matrix is the full cross-product (3 deleted steps × the 2 observers that still run) rather than a diagonal. **(3)** `aud2_exitgate_test.sh`'s `check_pr_wiring` located its step with `grep -nF -- "$SELF"` — a search for the script *name*, which the step's own comments satisfy. Measured by the reviewer: with the `run:` line commented out it still failed, but reported **"WITH ARGUMENTS"** instead of "does not invoke", sending an operator to look for an argument that does not exist. The anchored form from `dogfood_wiring_test.sh` is ported back and shared. **Why one lane and one helper, not three fixes:** the INBOX residual explicitly asked for a single shared helper so the next gate author inherits the strong check rather than copying the weak one; fixing one of three identical checks would have been misleading. **Judgment calls.** (a) The helper is **codes-only and prints nothing** — every caller owns its wording, because roughly twenty existing `expect_red` controls pin stderr fragments. (b) The 1..6 **line cap** `workflow_pins_test.sh` used to bound step isolation is replaced by a structural invariant — exactly one `run:` key and no `uses:` key, both of which actionlint itself flags — because cross-pinning made the helper isolate the aud2 and dogfood steps, whose comment blocks are a dozen lines long, and no cap admits an honest step of theirs while rejecting a merged one. (c) The helper is held to `workflow_pins_test.sh`'s preamble rules (**bash 3.2**, portable ERE, no `git`, no `grep -q` on a pipe) rather than aud2's ≥4.3 floor: that gate runs first in CI before any toolchain, and the other two callers do not refuse bash 3.2, so a bash-4 construct here would silently weaken them on a maintainer's machine. (d) It is a **line-oriented reader with a structural bias, not a YAML parser** — it says so in its own header and fails closed on anchors, aliases and flow mappings, because an honest narrow gate beats an overreaching one. (e) No new `check:` stage and `CHECK_STAGES` untouched: all three gates were already wired. **Evidence:** 44 helper-level probes, 20 host-independent fixture self-checks carried inside two of the gates, and end-to-end mutation of a scratch copy of the REAL `verify.yaml` driven through all three real gate scripts (the layer that found (ii) and (iii); fixtures alone did not) plus, in the gates themselves, 13 new red controls in aud2 (`CONTROL_FLOOR` 38→51, text-only 32→45, both floors met exactly), 15 in `workflow_pins_test.sh` and 12 in `dogfood_wiring_test.sh` — each pinned to its own finding text or rc — and, in every gate, **green** controls for the legitimate shapes above, so the new checks are provably not always-red. **Eight fail-opens were found by building mutants rather than by reasoning — six of them in this lane's own code, across five review rounds — and the record names every one, because the lane's value is the mutants, not the prose.** (i) *This lane's own widening:* accepting a block-scalar `run: |` invocation naively means a bare `bash <script>` line anywhere in the job satisfies the step check, including inside another step's multi-command `run: |` body where `echo skip && exit 0` a line above would mean the gate never runs — measured rc=0. The block form now counts only as a block's **sole** command, and all three gates carry that mutant. (ii) *The residual this lane exists to close, still open at any indent but four:* the filter greps were pinned to exactly four spaces, six-space indent is valid YAML resolving to the identical mapping, and the miss fell through to `return 0` — so on the real `verify.yaml` all three gates returned **rc=0** on a `paths:`-filtered trigger written one level deeper, the exact shape this row says they refuse. It was also the one place the helper broke its own stated rule, refusing an unevaluable *shape* while silently accepting an unrecognised *indent*. Matching is now indent-agnostic within the trigger sub-block, plus the five-key allowlist above. (iii) *Inherited, not introduced:* the step disarm grep lacked the `(-[[:space:]]+)?` alternative its `run:`/`uses:` siblings in the same function had, so a step whose FIRST key is the disarm (`      - if: …`) graded **wired, argument-free and undisarmed** — measured rc=0 on the real workflow, and it hollowed out the cross-pinning this row delivers. The byte-identical regex is in `main`'s `dogfood_wiring_test.sh`, so this is a pre-existing hole closed here, not a regression. (iv) *A tokenizer that split on the wrong characters:* branch and type names were tokenised with `tr -c 'A-Za-z0-9_'`, which splits on `-` and `/`, so `branches: [main-next]`, `branches: ['release/main']` and a `- main-v2` item each yielded a `main` token and were reported as **reaching every pull request** when no PR onto main runs the workflow at all (measured rc=0 on all three). `branches: [maintenance]` reddened correctly throughout, which is precisely why this survived two reviews: only the values that contain `main` as a **substring** — the ones that look right — were broken. Tokenising on YAML's own separators fixed it in both directions (`branches-ignore: [main-next]` had been a false RED). (v) *A blind spot reproduced while fixing the complaint about it:* a block sequence written FLUSH with its key — `branches:` then `    - main`, the canonical GitHub Actions style — was misgraded, and the key allowlist added in round two turned one such case from a correct 0 into a refusal, **reddening valid structure**. Two stacked defects: the value region's indent bound never admitted an item at the key's own indent (measurable independently of the allowlist), and the allowlist counted `- main` as an unknown key. **Why a 28-row mutant matrix missed (ii) and (iii), and why the fixture set added to close that missed (v):** the round-two fixtures gave every reach and wired code a host-independent case — a real improvement — but wrote all of them at 4 or 6 spaces with sequence items indented deeper than their key, so the substitution reproduced the same indentation blind spot somewhere cheaper. Breadth of mutant SHAPES is not breadth of coverage, and neither is breadth of return CODES if every case shares one incidental style. it was broad in mutant SHAPES and narrow in CODE coverage — 3 of 6 `assent_pr_reach` codes and 2 of 8 `assent_step_wired` codes had a host-independent fixture, and both defects lived in the uncovered ones. Every code now has one, the filter fixtures deliberately written at a non-4-space indent, and in flush block-sequence style as well after (v). (vi) *And then a line ending.* A single stray **CR** on one `branches-ignore:` sequence item made the tokenizer emit `main<CR>` as a whole token; `grep -qx main` missed it and the reader returned **0**, "runs on every pull request", for a trigger that EXCLUDES main (measured; both earlier readers said 13, so the round-3 tokenizer introduced it). One committed CR suffices: there is no `.gitattributes` here, `core.autocrlf=false` preserves it, no gate scans workflows for CR, and a GitHub diff renders it invisibly. CR is a YAML break character, so `main<CR>` was never a whole token and the reader was wrong by this row's own "compared as WHOLE tokens" rule. **THE CLASS IS NOW CLOSED WHERE IT CAN HURT, not merely the instance.** Four rounds produced six defects of one family — a line-oriented reader inferring YAML structure from indentation and character classes — and patching bytes one at a time was visibly not converging. The direction that can hurt, however, is narrow and structural: every filter test here is *must CONTAIN token X* (types must carry GitHub's defaults, branches must carry `main`) except **one**, `branches-ignore:`, which is *must NOT contain*. A misread drops or mangles a token, so every must-CONTAIN test goes RED — the CR bug's other two symptoms were exactly that, false reds on `branches:` and `types:`. Only the must-NOT-contain test converts a mangled token into a silent PASS. So the burden is inverted there: a token carrying any byte outside the git-ref/glob set (plus `#`, since that key alone keeps comment residue by G3-04's design) is now **REFUSED** rather than searched. A future tokenizer defect on that key can produce a red or a refusal, never a silent accept — by construction, not by enumeration. **A real YAML parse was evaluated and REJECTED on measured evidence, not assumed either way.** `python3` is an established dependency (`hack/validate-schemas-stock.sh`), but it uses **`json` only — stdlib**; PyYAML is nowhere established in this repo. Decisively: `hack/audit/README.md` publishes `docker run --rm -v "$PWD:$PWD" -w "$PWD" debian:stable-slim bash hack/audit/aud2_exitgate_test.sh --text-only` as the offline verification path, and that image was measured to contain **no python3 and no yq** — while the gate itself, which sources this helper, was measured GREEN in it (51 mutation controls), as was `workflow_pins_test.sh`. A PyYAML reader would break a published operator path and would also violate this file's stated no-toolchain contract (it runs first in CI, before `setup-go`). Go is unavailable in that image for the same reason. So the reader stays a heuristic, and the honest bound is written into its header rather than implied: it reads block mappings at any indent, block sequences indented or flush, inline flow sequences and quoted scalars; it REFUSES flow mappings, anchors, aliases, merge keys, unknown filter keys and unreadable tokens; and its one must-NOT-contain test now refuses instead of guessing. Recorded so a future lane does not re-litigate: if PyYAML ever becomes a committed dependency of the verification image, replacing this reader wholesale is the right move and would dissolve the remaining bounds. (vii) *A glob is not a misread, and the burden inversion did not cover it.* `branches-ignore: ['**']` — which excludes every branch, so no pull request runs the workflow at all — returned **0**, and so did `['*']`, `['ma*']`, `[main*]` and `['*ain']`, in flow and block form alike. `_assent_tokens_readable` cannot catch this and must not: `*` is a legal filter character, so a pattern tokenises perfectly, nothing is dropped or mangled, and the inverted burden never engages. The defect was an **exact-token predicate applied to a pattern list** — and this row had already reasoned it out one key over, where the identical un-evaluability is fail-CLOSED by polarity. Patterns are now REFUSED on the must-NOT-contain key, never searched. Lifted to gate level on the real workflow, all three gates PASSED that mutant before the fix and all three red after. (viii) *And the disarm check was matching a spelling, not a key.* `if : `, `"if":` and `'if' :` are resolved identically to `if:` by a conformant parser (checked against ruby/psych), so actionlint has nothing to flag — and a step or job carrying release-exitgate's exact push-only guard graded "wired, argument-free and undisarmed": **0** where the job-level cases should have been **4**, the RELSE-08 shape this whole lane exists to catch. The remedy deliberately was NOT a wider pattern — `[[:space:]]*:` would have been the fifth spelling patch here and would still miss the sixth. Step and job keys are now graded by **normalised name against an allowlist**, mirroring the filter-key allowlist in `assent_pr_reach` that was measured immune to all of those evasions; normalisation is the immunity, the literal greps are kept beside it as a union that can only add detections, and a key that will not normalise to an identifier is refused rather than skipped. **The guarantee sentence is narrowed to what is true**: this reader fails closed against a misread that DROPS or MANGLES a token, and against shapes it refuses; it does **not** claim immunity against a misread that FABRICATES one — `branches: ["main,next"]` is shredded into `main` + `next` and grades 0, measured, and left unfixed on purpose this round with the claim corrected to match the code rather than the code trusted to match the claim. The earlier "unknown shapes cost false reds, not silent passes" was an overclaim whose counterexamples sat inside the surface listed as READ, which is the D-124 species and worse than a documented hole. **The helper is graded too, not only the workflows it reads:** every mutation control mutates `verify.yaml` and asks the helper about it, which cannot tell a working helper from a stubbed one — with the helper now a single point of failure for all three gates, replacing `assent_pr_reach` with `return 0` would turn them all green at once. Two of the gates therefore also drive it against **from-scratch fixture workflows** whose right answer depends on nothing under `.github/workflows/**` (verified: the stub reds them by name). Revert: delete `hack/lib/pr_reach.sh` and restore the three gates' local readers — which restores the `paths:`-filtered bypass, the self-only pinning, and the misreport. |
 | D-158 | 2026-08-23 | **CI-TOOLCHAIN — `verify` was red on every PR from a golangci-lint/Go skew; the remedy is to bump `GOLANGCI_LINT_VERSION` v2.12.2 → v2.13.1 and KEEP `go-version: stable`.** Symptom: PR #85, a six-file Markdown diff with **zero Go bytes**, failed `verify` with `/opt/hostedtoolcache/go/1.27.0/x64/src/crypto/internal/randutil/randutil.go:11:2: could not import math/rand/v2 (… method must have no type parameters) (typecheck)` — the failing path is inside the **Go toolchain's own source tree**, so no author change can fix it and re-running cannot clear it. `Analyze (go)`, `Analyze (actions)` and `CodeQL` all passed on the same run: the tree compiles clean under Go 1.27, only the linter chokes. **Mechanism**: golangci-lint typechecks the standard library with the `go/types` it was **compiled with**, not the `go` on `PATH`. GitHub's `stable` rolled 1.26 → 1.27.0 between this repo's last green `main` run (2026-08-19) and 2026-08-23; the v2.12.2 release binary is built with go1.26.x and cannot read the 1.27 stdlib. **Reproduced locally, not reasoned** (Go 1.27.0 SDK on `PATH`, `GOTOOLCHAIN=local`, whole tree): v2.12.2 → **panic** in `pkg/goanalysis/runner_loadingpackage.go:335` inside `go/types.(*Checker).Files`, exit 2; official v2.13.1 asset (`built with go1.27.0`) → **0 issues**, exit 0; `golangci-lint config verify` → exit 0, so the v2 config schema in `.golangci.yml` needs no migration; v2.13.1 also → **0 issues** against local Go 1.26.6, so the bump is safe for contributors who have not moved; and `go install …@v2.13.1` under Go 1.27.0 → 0 issues, which is the **`release-exitgate`** path (that job builds the binary rather than using the action, and `if: github.event_name != 'pull_request'` / RELSE-08 means no PR ever exercises it). **Diagnosis heuristic worth keeping**: golangci-lint's `go.mod` carries the comment *"the minimum Go version must always be latest-1"*, so its `go` directive is a machine-readable "supports Go 1.N+1" signal — v2.12.2 says `go 1.25.0` (supports ≤1.26), v2.13.1 says `go 1.26.0` (supports ≤1.27), and upstream commit `42a0530` in v2.13.0 is literally "go1.27 support". **Options considered.** (A) *bump the linter* — CHOSEN: treats the root cause, is a **one-line** diff because the version is single-sourced at workflow scope (D-128), fixes BOTH exposed sites (the `golangci-lint-action` in `verify` and the `go install` in `release-exitgate`) at once, and the risk it carried — new findings from a newer linter blocking every merge, since `golangci-lint` runs inside `task lint` inside `task check` — was **measured at zero** on the whole tree under both Go versions. (B) *pin `go-version: 1.26.x`* — REJECTED as the primary: it needs two pins (`verify.yaml:56` and `:171`), leaves the class of bug live, undercuts the stated reason `stable` is there (`# govulncheck needs it`, with `setup-go` exporting `GOTOOLCHAIN=local` so a pinned toolchain can fail to `go run` a tool whose module requires a newer Go — unverified, and moot under (A)), and trades a loud recurrence for **silent indefinite drift onto an unsupported Go** in a repo whose posture is govulncheck + cosign + SLSA + Scorecard. (C) *both* — REJECTED as gold-plating: (A) alone is measured green, and a second simultaneous remedy would make a still-red PR ambiguous. **Per-file sweep of `go-version: stable`, stated rather than silently skipped:** `verify.yaml:56` and `:171` were the only exposed sites and are fixed by the env bump without touching either line; `schemas.yml:57` (runs `go test` + ajv, no linter), `vulncheck.yaml:30` (govulncheck only — `stable` is actively *desirable* there) and `codeql.yaml:45` (CodeQL, which passed on 1.27.0) carry no golangci-lint and are NOT exposed; `release.yaml` uses `go-version-file: go.mod` and is unaffected. `hack/lint/workflow_pins_test.sh` asserts `TASK_VERSION`, action SHA pins and step wiring but **not** `go-version` or `GOLANGCI_LINT_VERSION`; it passes on this change. **Revert is (B), not bare v2.12.2** — reverting the env line alone restores a known-red state: revert = `GOLANGCI_LINT_VERSION` back to `v2.12.2` **and** pin `verify.yaml:56` + `:171` to `go-version: 1.26.x`. **Residual risk, stated plainly:** when `stable` rolls to Go 1.28, v2.13.1 breaks identically. The repo finds out because `verify` reds on **every** PR including zero-Go diffs — loud and immediate, with the signature recorded in `verify.yaml`'s env comment and the fix being one env line. Nothing detects it *earlier*: dependabot's `github-actions` ecosystem updates `uses:` refs, not `env:` literals (backlog `CI-TOOLCHAIN-F01`). Accepted on purpose over (B)'s failure mode. Note also the pre-existing local/CI linter skew — `Taskfile.yml`'s `lint` task is bare `golangci-lint run ./...` against whatever binary a contributor has installed, so this pin has never governed local `task check`; deliberately not changed here (that file was owned by a concurrent lane). |
 | D-159 | 2026-08-23 | **ORPHAN — `release-verify-test` was a gate invoked by nothing (D-124 again), and it is wired into `task check` in its three OFFLINE modes, not its default `all`.** Finding: `Taskfile.yml` defined `release-verify-test` — the **only** test of `hack/release/verify-artifacts.sh` — and no caller existed anywhere: not `check:`, not `CHECK_STAGES` in `hack/audit/exitgate_test.sh`, not `.github/workflows/**`, not the push-only `release-exitgate`. That script is not incidental: **`SECURITY.md:61` publishes it as the procedure release consumers run** to check artifact checksums, the stamped `assent version` and cosign signatures, and D-153/AUD2-F01 had just proved that published verification instructions rot silently. Measured before fixing, as the lane required: the gate was **green**, so this is a wiring defect only — nothing was being papered over. **Why not the `all` default.** `verify_test.sh` with no argument adds `test_snapshot_pass`, which shells out to `task release-snapshot`: `go install github.com/goreleaser/goreleaser/v2@…` on any machine without it (**network**, in a gate that runs before every commit), a `before: hooks: go mod tidy` that **rewrites `go.mod`/`go.sum` in the middle of `task check`**, `--clean` on the developer's `dist/`, and a five-target cross-compile (10s here with warm caches and goreleaser already installed; minutes cold). A flaky or network-bound stage is worse than a missing one, so `check:` runs `negative`, `cosign-skip-when-absent` and `readme` — REQ-E9-S12-02/03/04, all offline, together well under a second. **Consequence, stated precisely: REQ-E9-S12-01 (the real snapshot→verify round trip) is not gated per-commit in `task check`; it runs in push-only CI via `hack/release/exitgate_test.sh:33-34` (the `release-exitgate` job, `if: github.event_name != 'pull_request'`) — automated but not PR-visible, i.e. the RELSE-08 blind spot.** Those two lines are literally `task release-snapshot` then `task release-verify`, which is the `Verify:` string the spec gives the requirement (`openspec/specs/p5-e9-distribution/spec.md:441-442`), so nothing here needs a new gate built — an earlier draft of this row claimed the requirement was covered by no automation at all, which was false, and acting on it would have meant a future lane duplicating `exitgate_test.sh:33-34`. What this lane declines to do is move that L1 round trip into a per-commit gate: it cannot be, for the network/`go mod tidy`/`--clean` reasons above. Narrowing the RELSE-08 exposure for this requirement is a separate question from D-159. **Pinning.** `CHECK_STAGES` goes 20 → 21 in the same commit as the `check:` line (the AUD-S18/RELSE-08 lockstep), and `STAGE_BODY_PINS` pins the body **per mode** rather than by the bare script path — a single `bash hack/release/verify_test.sh` pin would stay green if two modes were dropped *and* if the stage were reverted to the unrunnable-in-check default. Three mutation controls prove it: deleting the `check:` line reds `check_check_wiring` by stage name, gutting one of the three modes reds `check_stage_bodies` while the other two still run, and the same deletion applied to the real tree reds the real gate at rc=1. **Also fixed, minimally, because wiring made it matter:** `verify_test.sh` wrote its captured stdout/stderr to fixed `/tmp/verify-{tamper,nosig}.{out,err}` and then **grepped** them; harmless while nothing ran it, but this repo runs several lane worktrees whose `task check` invocations overlap, and a concurrent run truncating `/tmp/verify-nosig.err` at open would fail the other run's `skip.*cosign` grep spuriously. Scratch files now live in each run's own `mktemp -d` (invisible to `verify-artifacts.sh`, which globs only `*.tar.gz`/`*.zip`) and are removed by the existing `RETURN` trap. |
 | D-160 | 2026-08-23 | **UNIV-COSIGN — the cosign signer-pin gate asserted an EXISTENTIAL property where the guarantee it publishes is UNIVERSAL, so it certified nothing about a file's second `cosign verify-blob`; `hack/release/install_cosign_pin_test.sh` now grades EVERY invocation in ALL THREE published files, statically and at runtime.** Substance first, and measured before anything was written: a scratch copy of each graded file with a **second, unpinned** `cosign verify-blob` spliced IN-BODY next to its real invocation (the splice shape matters — see UC-04 below) ran the gate to **exit 0** — `hack/install.sh` rc=0, `SECURITY.md` rc=0, `hack/release/verify-artifacts.sh` rc=0, the last of these being the shape a reviewer had already demonstrated on an earlier lane. **Every individual assertion in that gate was sound.** `has_flag` grepped the whole folded extraction, so a pinned sibling satisfied it; `one_value`'s `sort -u` collapsed two agreeing values to one, so the D-153 drift comparison saw a consistent file; section 0 **printed** the extracted invocation count and asserted nothing about it; and 4b/5d's stub-log checks were positive-only greps, i.e. the same existential shape at runtime, where a second unpinned call leaves the pinned call's log line intact. The conjunction of sound existential assertions is still an existential assertion. **This is the AUD2-S05 quorum defect one layer out: not a wrong assertion, a wrong quantifier**, and it predates both AUD2-S03 and AUD2-F01. **`SECURITY.md` was worse than the other two** — it fed only the drift comparison and had **no invocation-level grading at all**, so an unpinned recipe published to adopters was invisible to the gate that exists to police the recipe. **Property chosen: "every `cosign verify-blob` invocation in every graded file carries `--certificate-oidc-issuer`, `--certificate-identity-regexp` and `--bundle`, EACH WITH SECURITY.md's published value".** The value half is not decoration: `--certificate-identity-regexp ''` carries the flag and matches every Fulcio identity ever issued, and `one_value`'s `sort -u` does not catch it either, because an empty capture is not a line and the file still reports exactly one distinct value — a presence-only universal check would be the same defect one level down, so each invocation's own extracted value is compared against the published pair (reported `WRONG-VALUE[...]`, distinct from `UNPINNED[...]`). Options considered: **(a)** the remedy recorded when the finding was filed — assert the extracted invocation count is **exactly 1** per file (**REJECTED AS FACTUALLY WRONG — do not implement it in a later lane; it would red `main` on the day it lands.** `SECURITY.md` legitimately publishes **two** — one over the archive, one over `checksums.txt`, which is what covers the SBOMs listed inside it — so that assertion reds `main` on the day it lands, and the natural repair is to weaken it again); **(b)** universal quantification over invocations **(chosen)** — strictly stronger than (a) where (a) is true, and it keeps holding when a file legitimately grows a third correctly-pinned call. **Enforcement, per D-128, is one predicate**: `pin_violations <file>` prints one line per problem and nothing when the file is clean, so callers grade its OUTPUT and the identical function is asserted empty against the tree and non-empty against a mutant with no `set -e` games; `assert_all_pinned` is the thin failing wrapper; `log_unpinned_lines` is its runtime twin over the stub-cosign argv log. **Classification is fail-CLOSED, which is the part that carries the guarantee.** The candidate extractor is deliberately left un-narrowed (every non-comment line mentioning `cosign verify-blob`, continuations folded), because anything the *denominator* drops is a hole. A candidate is an invocation when the folded text begins with `cosign verify-blob`; the ONE waved-through non-invocation shape is a markdown inline-code mention (`` `cosign verify-blob` ``, which is how `SECURITY.md`'s capability table names it); **on a line carrying NO backticked mention, anything else — `foo && cosign verify-blob …`, a here-doc line, an un-backticked prose sentence — is reported UNCLASSIFIABLE rather than skipped**, because "this gate cannot tell whether that call is pinned" must never read as "that call is fine". **That scoping is not cosmetic, and the unscoped version of this sentence was FALSE (R3-01, caught by review on the round that added the honest banner).** The exemption tests whether the substring `` `cosign verify-blob` `` appears **anywhere on the line**, not whether the line is prose, and it is tested BEFORE the command-position and multi-token checks. So a line carrying a backticked mention AND one or more LIVE calls is exempted, neither graded nor refused: measured by splicing ``See `cosign verify-blob`: cosign verify-blob --bundle A.json a && cosign verify-blob --bundle EVIL.json evil`` into `SECURITY.md` — `occurrence_count` = 2 by the definition the banner itself states, `pin_violations` EMPTY, **whole gate rc=0**, while the banner reported that line among those "exempted as backticked prose". The **static** defect is not markdown-specific — splicing a live unpinned call with a trailing backticked mention into `hack/install.sh` gives candidates=2, invocations=1, `pin_violations` EMPTY — but the **whole-gate green is** markdown-specific, and the distinction is stated because a looser sentence here would itself be falsifiable: in that shell script the run reds at §4b for an unrelated RUNTIME reason (the spliced call executes and its bundle is absent), whereas `SECURITY.md` is a document with no runtime twin, which is why rc=0 survives there. Measured both ways rather than inferred from either. **Narrowing the exemption needs quote- and markdown-aware parsing — the machinery that produced UC-01/02/03 — so it is deliberately NOT patched here.** It is instead disclosed as residual (1) in the PASS banner, ahead of the variable/`eval`/fragment spellings, because it is the residual that is actually REACHABLE in these three files while those are not present in any of them. The banner also no longer labels an exempted line "prose": the branch it took is a fact, "prose" was an inference, and R3-01 is the case where that inference is wrong. **This is UC-07 doing its job on its own author:** the claim was falsifiable, it was checked, and the gate is now incomplete-and-honest rather than complete-and-wrong. Accepted cost, stated rather than discovered later: a *correctly pinned* invocation written off command position also reds. That is the intended direction of error for a security gate over three files carrying four invocations in one canonical style, and the message names the fix. **Anti-vacuity, because a lane whose entire deliverable is "make a gate stricter" is maximally exposed** (this repo's #1 review finding is an assertion that cannot fail — D-124, AUD-S18): section 2b runs **eight** mutants against **each** of the three files and 2c runs a ninth, and they were chosen for **branch** coverage of the new predicate rather than for variety of shape — (a) a second **unpinned** invocation must red, name the file, quote the offending command, and produce **exactly two** violations so the pinned siblings are provably not flagged; (b) a second **correctly pinned** invocation must stay green **and** must raise the extractor's invocation count by one, without which (b)'s green could mean "the extractor never saw it"; (c) an occurrence off command position, appended **fully pinned on purpose** so the only thing that can redden it is the classifier itself; (d) every invocation deleted → `NO-CANDIDATES`; (e) the continuation fold broken → `FOLD-BROKEN`, asserted **not** to also report `UNPINNED`, because conflating "the extractor truncated this" with "the pin is missing" sends the next maintainer to the wrong file; (f) every invocation displaced off command position → `NO-INVOCATIONS`; (g) a second invocation carrying both flags with an **empty** identity regexp → `WRONG-VALUE`, the hostile shape a presence-only check waves through; (h) a second invocation carrying both flags with a **foreign OIDC issuer** → `WRONG-VALUE` on the issuer half; and 2c strips the backticks from `SECURITY.md`'s prose mention and requires the same row to fail closed, proving the exemption keys on the backticks and is not a blanket bypass. The runtime twin has its own vacuity control (an unpinned line appended to a copy of the stub log must be seen). **One real defect was caught by this section during the lane and is recorded because it is a trap for the next author**: `log_unpinned_lines` was first written with `awk -v id="identity_re=${sec_identity}"`, and **awk processes escape sequences in a `-v` assignment**, so the pin's `github\.com` arrived as `github.com` and matched nothing; the values now reach awk through `ENVIRON`. **Stated limit, same posture as D-154's**: the denominator is the literal string `cosign verify-blob`, so an invocation spelled through a variable (`"$COSIGN" verify-blob …`), built by `eval`, or assembled from fragments is invisible to this gate. Widening the trigger to bare `verify-blob` was considered and **rejected** — it buys one hypothetical no file uses, and turns any future `SECURITY.md` sentence saying "verify-blob" outside backticks into a red gate, whose repair would be to loosen the classifier. **Nothing outside the gate changed**: `hack/install.sh`, `SECURITY.md` and `hack/release/verify-artifacts.sh` are byte-unchanged, and all four of their invocations were already pinned — this row closes a hole in the *checker*, not in the checked. The stage `release-install-cosign-pin-test` was already wired into `task check` and pinned in `hack/audit/exitgate_test.sh`'s `CHECK_STAGES`, so no wiring changed either. **SECOND ROUND — the first version of this fix REPRODUCED the very defect it closes, one level down, and independent review caught it before merge.** `has_flag` grepped the whole FILE; the replacement grepped the whole LINE. Both are existential; only the scope shrank. **UC-01**: one folded line was graded as at most ONE invocation, so `cosign verify-blob <both pins> --bundle a.json a && cosign verify-blob --bundle EVIL.json evil` began with `cosign verify-blob` (not UNCLASSIFIABLE), carried `--bundle` (not FOLD-BROKEN), carried both flag strings (not UNPINNED) and yielded the published values (not WRONG-VALUE) — **green**, in same-line, `;`-separated and backslash-folded forms, on all three graded files. Worse, the **full gate exited 0** for `SECURITY.md`: the two shell scripts were incidentally caught by the runtime twin (`log_unpinned_lines` at §5d), but **SECURITY.md is a document and has no runtime twin**, so the hole was unmitigated precisely on the file this row calls "the copy-paste recipe adopters run by hand" — D-153's exact incident class — while the gate printed "EVERY cosign verify-blob invocation ... is pinned", false as printed. The stated-limit paragraph did not cover it: it enumerated `$COSIGN`, `eval` and fragments, not `&&` chaining, and **leading** `&&` was explicitly handled (mutant (c) → UNCLASSIFIABLE), so the operator had been considered and only one side handled. Closed by grading per **OCCURRENCE** (`occurrence_count` + a new `MULTI-OCCURRENCE` violation that fails closed on any line carrying two calls) rather than per line; counting inside an already-triggered line uses the shorter `verify-blob`, so a second call spelled `cosign  verify-blob` or `"$COSIGN" verify-blob` and chained onto a pinned one is caught too, which the literal file-level trigger would miss. **UC-02**: `extract_issuer`/`extract_identity` anchor on a greedy `.*`, so the LAST value on a line wins — a hostile `--certificate-identity-regexp ''` placed FIRST was masked by a correct value placed second, **the extraction direction favoured the attacker**. Closed by `flag_value_tokens`, which returns EVERY value of every flag on the occurrence; each must equal the published one, so a repeated flag with an empty value first now reds. **UC-03 (P2, the erosion path)**: a CORRECTLY pinned call written with **double quotes** was refused as `WRONG-VALUE ... identity=<empty/unparsable> ... (an empty regexp matches every Fulcio identity)` — a true refusal with a **false reason**, and the repair a maintainer reaches for on that message is widening the extractor. Both quote styles are now accepted (double quotes are correct shell for this value: it contains no `$` and no backtick), and a **bare** value is diagnosed as `UNQUOTED-VALUE`, a QUOTING defect, never as a wrong or empty one — a gate that misdiagnoses erodes faster than one that refuses. **UC-04**: this row's "rc=0, rc=0, rc=0" reproduction figure is **splice-shape-sensitive** and is stated as measured: it holds for a second unpinned call spliced **in-body** next to the real one. An EOF-appended mutant reds the two shell scripts for an unrelated runtime reason, so the figure should not be read as holding for any second unpinned call. The same sensitivity is why the UC-03 double-quoted mutant reds the two scripts through the full gate (the spliced call actually RUNS and its fixture bundle is absent) while `SECURITY.md`, having no runtime, is the clean end-to-end proof at rc=0. The classifier's fail-closed posture on off-command-position occurrences was independently adjudicated KEEP, since §2c proves the prose exemption keys on the backticks and cannot be widened silently. **The lesson, recorded because it is the whole point of the lane:** a fix for an existential-where-universal defect is itself maximally exposed to the same defect at the next scope down — file, then line, then occurrence — and the only thing that caught it was a reviewer building the chained-call mutant that neither the 20-row external matrix nor the 25 in-gate mutants contained. **THIRD ROUND (UC-05..UC-09), and the reason this row now reads the way it does.** **UC-05**: `occurrence_count` compared whitespace-delimited fields to `verify-blob`, found one, and concluded **singularity** — when all it had established is that it did not find a second. `cosign "verify-blob"`, `cosign 'verify-blob'` and `cosign verify-blob""` are the same command to the shell, and each hid a chained unpinned call from the count. Measured against the round-2 gate on **all three** files at whole-gate level: **rc=0, rc=0, rc=0** — worse than first reported, because `A && B` short-circuits and `set -e` does **not** fire on a non-final member of an AND-list, so even the two shell scripts' runtime twin missed it. Closed by stripping shell quotes before the field compare, which is **a spelling patch, not a terminator, and is labelled as one in the code**. A structural terminator was sought and **ruled out with evidence**: refusing any graded line carrying a command separator would red the REAL files, since `hack/install.sh` and `hack/release/verify-artifacts.sh` both legitimately end their genuine invocation with an or-else `die` tail. **No structural terminator exists for this gate**, so completeness is not available and must not be claimed. **UC-07 is therefore the durable fix, and it is a change of posture rather than of logic.** The `PASS:` banner was printed unconditionally and asserted "EVERY cosign verify-blob OCCURRENCE ... is pinned" plus "a second unpinned call reddens whether it sits on its own line or is chained onto a pinned one" — a **universal claim bound to no assertion**. Under UC-05 that banner did not merely overstate: on a green run it printed something **false**, which is strictly worse than printing nothing, and it is this repo's #1 defect class (an assertion that cannot fail) wearing a different hat. The banner now reports **OBSERVED** counts per file (occurrences found, classified-and-graded, prose-exempt, refused), lists **ASSERTED** properties each of which is shown to fail on a mutant, and states the **NOT ASSERTED** residual in the same breath: this gate finds calls by a literal string and counts quote-stripped words, so a call spelled through a variable, `eval`, or fragments is not seen and not graded, and the counts are what was classified — **not a proof that nothing else exists**. When a fifth spelling turns up, the gate is then **incomplete rather than wrong**, and incomplete is recoverable. **UC-06**: a TRAILING comment mentioning `verify-blob` fired `MULTI-OCCURRENCE: … has 2 verify-blob calls chained on ONE line` — fail-closed but **false as printed**, since `cosign_candidates` only drops lines whose FIRST non-space character is `#`. That is the UC-03 misdiagnosis shape recurring **inside the UC-01 fix**. The message now says TOKENS, names both possible causes, and names the correct repair; excluding trailing comments was rejected as it needs quote-aware parsing, which is the machinery that produced UC-01/02/03. **UC-08**: `shellcheck` SC1087 ×2 (error severity) on `flag_value_tokens` — `"$flag[[:space:]]…"` parses as an array subscript; `${flag}` silences it. Cosmetic: no shellcheck gate exists in this repo. **UC-09**: two stage-count figures reported during this lane ("25", then "28") were **both wrong** and neither came from a committed file — they counted `task: [` lines in a run LOG, which includes nested task invocations. Measured: the Taskfile `check:` block has **21** `- task:` entries and `CHECK_STAGES` has **21** stage names; they agree, and both files are byte-identical to `origin/main`. There is no stage-count mismatch and this lane could not have caused one. **THE PATTERN, recorded because it is the lane's most transferable output:** four P1s, three of them the same scope error at successively finer scopes — file (`has_flag`), line (round 1), then occurrence-spelling (round 2) — each found by review and none by the author's own mutant matrix, because each matrix was built from the shape the previous round had just learned. The general lesson is not "add another spelling": it is that **when a gate's denominator cannot be made provably complete, the gate must report what it classified instead of asserting what exists.** That is now enforced where it is hardest to ignore, in the banner the gate prints on every green run. Revert: restore `has_flag`, drop the per-occurrence grading and the per-invocation value comparison, and restore the two positive-only stub-log greps — which returns the gate to certifying that *some* cosign call in each file is pinned, a property that is compatible with an unpinned one sitting beside it. |
diff --git a/hack/examples/dogfood_wiring_test.sh b/hack/examples/dogfood_wiring_test.sh
index 07d18227..9049a628 100755
--- a/hack/examples/dogfood_wiring_test.sh
+++ b/hack/examples/dogfood_wiring_test.sh
@@ -760,6 +760,100 @@ V="$WORK/fixture.bi-unreadable.yaml"
 } >"$V"
 helper_reach_is 10 "$V" "a branches-ignore: token carrying an unreadable byte is REFUSED, not searched — the fail-open direction is now closed by construction rather than by enumerating bytes (G4-01)"
 
+# G5-01 — a GLOB on `branches-ignore:`. Every pattern below EXCLUDES main, so
+# no pull request onto main runs the workflow; the reader returned 0, "runs on
+# every pull request", for all of them. `_assent_tokens_readable` does not
+# catch it and must not: `*` is a legal filter character, so the pattern
+# tokenises perfectly and nothing is dropped or mangled. The defect was an
+# EXACT-TOKEN predicate applied to a PATTERN list — and the header had already
+# reasoned it out one key over, where the same un-evaluability is fail-CLOSED.
+bi_fixture() { # <name> <yaml value or block> — branches-ignore in flow form
+  local f="$WORK/fixture.$1.yaml"
+  printf 'name: f\non:\n  pull_request:\n    branches-ignore: %s\njobs: {}\n' "$2" >"$f"
+  printf '%s' "$f"
+}
+bi_seq_fixture() { # <name> <item> — branches-ignore as a block sequence
+  local f="$WORK/fixture.$1.yaml"
+  printf 'name: f\non:\n  pull_request:\n    branches-ignore:\n      - %s\njobs: {}\n' "$2" >"$f"
+  printf '%s' "$f"
+}
+
+V="$(bi_fixture bi-glob-star2 "['**']")"
+helper_reach_is 10 "$V" "branches-ignore: ['**'] is REFUSED — it excludes every branch, main included, and an exact-token search finds no literal 'main' (G5-01: rc=0 at 01b2322, on a workflow that runs on NO pull request)"
+
+V="$(bi_fixture bi-glob-prefix "[main*]")"
+helper_reach_is 10 "$V" "branches-ignore: [main*] is REFUSED — a pattern that covers main without being the token 'main' (G5-01)"
+
+V="$(bi_fixture bi-glob-suffix "['*ain']")"
+helper_reach_is 10 "$V" "branches-ignore: ['*ain'] is REFUSED — glob semantics are not evaluable by a text gate, and refusing is the direction this reader already claims for branches: (G5-01)"
+
+V="$(bi_seq_fixture bi-glob-seq "'**'")"
+helper_reach_is 10 "$V" "…and in BLOCK SEQUENCE form too, not only flow form (G5-01)"
+
+V="$(bi_fixture bi-literal-bad "[main]")"
+helper_reach_is 13 "$V" "a LITERAL branches-ignore: [main] still reds as excluding main — the refusal is scoped to patterns, it did not swallow the real finding (G5-01, other polarity)"
+
+V="$(bi_fixture bi-literal-legit "[gh-pages]")"
+helper_reach_is 0 "$V" "a LITERAL branches-ignore: [gh-pages] is still accepted — not made refusal-happy (G5-01, other polarity)"
+
+# G5-02 — a disarm key that is not spelled bare. `if : `, `"if":` and `'if' :`
+# are resolved identically to `if:` by a conformant parser (checked against
+# ruby/psych), so actionlint has nothing to flag and the step or job carries
+# release-exitgate's exact push-only guard while grading "wired, argument-free
+# and undisarmed". Graded now by NORMALISED KEY NAME, mirroring the filter-key
+# allowlist in assent_pr_reach that is measurably immune to the same evasions —
+# normalisation is the immunity, not a wider pattern.
+step_key_fixture() { # <name> <extra key line, 8-space indent assumed>
+  local f="$WORK/fixture.$1.yaml"
+  {
+    printf 'name: f\non:\n  pull_request:\njobs:\n  verify:\n    runs-on: ubuntu-latest\n    steps:\n'
+    printf '      - name: gate\n'
+    printf '        %s\n' "$2"
+    printf '        run: bash %s\n' "$3"
+  } >"$f"
+  printf '%s' "$f"
+}
+job_key_fixture() { # <name> <extra job-level key line>
+  local f="$WORK/fixture.$1.yaml"
+  {
+    printf 'name: f\non:\n  pull_request:\njobs:\n  verify:\n'
+    printf '    %s\n' "$2"
+    printf '    runs-on: ubuntu-latest\n    steps:\n'
+    printf '      - name: gate\n        run: bash %s\n' "$3"
+  } >"$f"
+  printf '%s' "$f"
+}
+
+V="$(step_key_fixture step-if-bare 'if: false' hack/examples/dogfood_wiring_test.sh)"
+helper_wired_is 8 "$V" "$SELF_REL" "a step disarmed with a BARE 'if:' is DISARMED (the control that always worked)"
+
+V="$(step_key_fixture step-if-spaced 'if : false' hack/examples/dogfood_wiring_test.sh)"
+helper_wired_is 8 "$V" "$SELF_REL" "a step disarmed with 'if : ' — a space before the colon — is DISARMED (G5-02: rc=0 at 01b2322; a conformant parser reads it as 'if')"
+
+V="$(step_key_fixture step-if-quoted '"if": false' hack/examples/dogfood_wiring_test.sh)"
+helper_wired_is 8 "$V" "$SELF_REL" "a step disarmed with a QUOTED '\"if\":' is DISARMED (G5-02)"
+
+V="$(step_key_fixture step-coe-spaced 'continue-on-error : true' hack/examples/dogfood_wiring_test.sh)"
+helper_wired_is 8 "$V" "$SELF_REL" "a step neutered with 'continue-on-error : ' is DISARMED (G5-02)"
+
+V="$(job_key_fixture job-if-spaced 'if : false' hack/examples/dogfood_wiring_test.sh)"
+helper_wired_is 4 "$V" "$SELF_REL" "a JOB carrying 'if : ' has release-exitgate's push-only guard — rc=4, not 0 (G5-02: this is the RELSE-08 shape the whole lane exists to catch)"
+
+V="$(job_key_fixture job-if-quoted '"if": false' hack/examples/dogfood_wiring_test.sh)"
+helper_wired_is 4 "$V" "$SELF_REL" "a JOB carrying a quoted '\"if\":' is likewise rc=4 (G5-02)"
+
+V="$(job_key_fixture job-needs-quoted '"needs": release-exitgate' hack/examples/dogfood_wiring_test.sh)"
+helper_wired_is 9 "$V" "$SELF_REL" "a JOB carrying a quoted '\"needs\":' is rc=9 — skipped dependency, skipped job (G5-02)"
+
+# Both polarities: normalisation must not turn ordinary step/job keys into a red.
+V="$WORK/fixture.step-ordinary-keys.yaml"
+{
+  printf 'name: f\non:\n  pull_request:\njobs:\n  verify:\n    runs-on: ubuntu-latest\n    timeout-minutes: 60\n    steps:\n'
+  printf '      - name: gate\n        id: g\n        shell: bash\n        env:\n          FOO: bar\n'
+  printf '        run: bash hack/examples/dogfood_wiring_test.sh\n'
+} >"$V"
+helper_wired_is 0 "$V" "$SELF_REL" "a step carrying ordinary keys (id:, shell:, env:) in a job with timeout-minutes: is still WIRED — the key allowlist grades disarms, it does not refuse normal structure (G5-02, other polarity)"
+
 m="$(helper_fixture wired-comment <<'FIX'
 name: f
 on:
diff --git a/hack/lib/pr_reach.sh b/hack/lib/pr_reach.sh
index 8de7610a..e688d475 100644
--- a/hack/lib/pr_reach.sh
+++ b/hack/lib/pr_reach.sh
@@ -73,14 +73,35 @@
 # REFUSES (distinct code, never a guess): flow MAPPINGS, anchors, aliases,
 # merge keys, filter keys outside GitHub's five, and — on the one
 # must-NOT-contain test — any token carrying a byte outside the ref/glob set.
-# DOES NOT READ: multi-line flow sequences (refused), and `strategy:`/matrix,
-# reusable-workflow `uses:` jobs and container entrypoints in the step reader.
+# DOES NOT READ: multi-line flow sequences (refused); `strategy:`/matrix,
+# reusable-workflow `uses:` jobs and container entrypoints in the step reader;
+# and a QUOTED SCALAR's interior — `,` and whitespace are separators here even
+# inside quotes, so `branches: ["main,next"]` is shredded into `main` + `next`
+# and grades 0 though it excludes main (G5-03, measured, unfixed on purpose:
+# see the claim below, which is now written to match the code rather than the
+# other way round).
 #
-# The safety argument does NOT rest on that list being complete. Every filter
-# test here is "must CONTAIN token X" except `branches-ignore:`, so a misread
-# yields a RED everywhere but there — and there, an unreadable token is refused
-# rather than searched. Unknown shapes therefore cost false reds, not silent
-# passes. An honest narrow gate beats an overreaching one.
+# THE SAFETY CLAIM, NARROWED TO WHAT IS TRUE (G5-04). An earlier version of
+# this header said "unknown shapes cost false reds, not silent passes". That
+# was an overclaim, and two round-5 findings were counterexamples INSIDE the
+# surface listed as READ — which is worse than a documented hole, because the
+# next author trusts the sentence. What actually holds:
+#
+#   * A misread that DROPS or MANGLES a token yields a RED on every
+#     must-CONTAIN test (`types:`, `branches:`), and on the one
+#     must-NOT-contain test (`branches-ignore:`) an unreadable token is
+#     REFUSED rather than searched. That direction is closed by construction.
+#   * A misread that CREATES a token is NOT covered: shredding a quoted scalar
+#     manufactures `main` out of `"main,next"` and yields a silent 0.
+#   * Un-evaluability is not a misread at all. A glob tokenises perfectly and
+#     an exact-token predicate simply cannot answer it — fail-closed on
+#     `branches:` by polarity, and on `branches-ignore:` only because it is now
+#     refused explicitly (G5-01).
+#
+# So: the reader fails closed against dropped and mangled tokens, and against
+# shapes it refuses. It does not claim immunity against a misread that
+# fabricates a token. An honest narrow gate beats an overreaching one, and an
+# honestly narrow CLAIM beats a reassuring one.
 
 # The three PR-visible text gates, single-sourced so each can cross-pin the
 # others (D-157 residual 2: before this, each gate pinned only its OWN step, so
@@ -202,6 +223,86 @@ _assent_tokens_readable() {
   return 0
 }
 
+# _assent_tokens_globfree <token-file> — 0 when no token carries a glob
+# metacharacter, 1 otherwise.
+#
+# G5-01. `_assent_tokens_readable` deliberately ADMITS `*` and `+` — a glob is
+# a legal branch filter, so a pattern tokenises perfectly, nothing is dropped or
+# mangled, and the burden inversion above never engages. The residual defect is
+# not a tokenizer defect at all: it is an EXACT-TOKEN predicate (`grep -qx
+# main`) applied to a PATTERN list. `branches-ignore: ['**']` excludes every
+# branch including main, and `grep -qx main` finds no literal `main`, so the
+# reader returned 0 — "runs on every pull request" — for a workflow that runs on
+# no pull request at all. Measured for `**`, `*`, `ma*`, `main*` and `*ain`, in
+# both flow and block-sequence form.
+#
+# The header already reasoned this out ONE KEY OVER: a `branches:` glob that
+# covers main without the literal token reds, because "a bash gate cannot
+# honestly evaluate GitHub's glob semantics, and refusing is the fail-closed
+# direction". That is exactly right, and on `branches:` it happens for free —
+# the must-CONTAIN predicate fails on a pattern. On `branches-ignore:`, the one
+# must-NOT-contain test, the identical un-evaluability is fail-OPEN. So it is
+# made explicit here rather than left to the polarity: a pattern is refused,
+# never searched, on the key where searching it would be a silent accept.
+_assent_tokens_globfree() {
+  local globby="$1.globby"
+  grep -E '[][*?!+]' "$1" >"$globby" || true
+  if [[ -s "$globby" ]]; then
+    return 1
+  fi
+  return 0
+}
+
+# _assent_map_keys <file> <indent> — the NORMALISED name of every mapping key at
+# exactly <indent> spaces, one per line. A key whose name cannot be normalised
+# to a plain YAML identifier is printed as the literal `?unreadable`.
+#
+# G5-02, and the mechanism matters more than the fix. `if:` was matched by a
+# LITERAL pattern, so `if : `, `"if":` and `'if' :` — which a conformant parser
+# resolves identically (checked against ruby/psych) — all evaded it, and a step
+# or job carrying release-exitgate's exact push-only guard graded "wired,
+# argument-free and undisarmed". Adding `[[:space:]]*:` would have been the
+# fifth spelling patch on this lane and would still miss the sixth.
+#
+# The immune design was already in this file: `assent_pr_reach` normalises and
+# ALLOWLISTS the filter keys, and is measurably immune to every one of those
+# spellings. This mirrors it. Normalisation — not pattern breadth — is what
+# makes it immune, and anything normalisation cannot reduce to an identifier is
+# refused rather than skipped, so the unknown-spelling direction costs a red.
+_assent_map_keys() {
+  awk -v want="$2" '
+    { if ($0 ~ /^[[:space:]]*$/ || $0 ~ /^[[:space:]]*#/) next
+      match($0, /^[ ]*/)
+      if (RLENGTH != want) next
+      rest = substr($0, want + 1)
+      c = index(rest, ":")
+      if (c == 0) next                     # not a mapping entry; cannot be a key
+      k = substr(rest, 1, c - 1)
+      sub(/[[:space:]]+$/, "", k)          # `if :`
+      sub(/^[[:space:]]+/, "", k)
+      if (k ~ /^".*"$/ || k ~ /^\x27.*\x27$/) k = substr(k, 2, length(k) - 2)
+      sub(/[[:space:]]+$/, "", k)          # `" if " :`
+      sub(/^[[:space:]]+/, "", k)
+      if (k ~ /^[A-Za-z0-9_-]+$/) print k; else print "?unreadable"
+    }
+  ' "$1"
+}
+
+# _assent_step_keys <isolated-step-file> — the same, for a sequence ITEM: the
+# first key rides on the `- ` marker line and the rest sit two columns in.
+_assent_step_keys() {
+  local step="$1" first ind
+  first="$(head -1 "$step")"
+  ind="$(printf '%s' "$first" | awk '{ match($0, /^[ ]*- /); print RLENGTH }')"
+  if [[ -z "$ind" || "$ind" == "0" ]]; then
+    printf '%s\n' '?unreadable'
+    return 0
+  fi
+  printf '%s\n' "$(printf '%s' "$first" | cut -c$((ind + 1))-)" \
+    | _assent_map_keys /dev/stdin 0
+  sed -n '2,$p' "$step" | _assent_map_keys /dev/stdin "$ind"
+}
+
 # ---------------------------------------------------------------------------
 # assent_pr_reach <workflow-file> <scratch-dir>
 #
@@ -411,6 +512,10 @@ assent_pr_reach() {
     if ! _assent_tokens_readable "$bitoks"; then
       return 10
     fi
+    # G5-01: a glob is readable and un-evaluable. Refused, never searched.
+    if ! _assent_tokens_globfree "$bitoks"; then
+      return 10
+    fi
     if grep -qx 'main' "$bitoks"; then
       return 13
     fi
@@ -519,15 +624,25 @@ assent_step_wired() {
     return 3
   fi
 
-  # Job-level keys sit at 4 spaces; step-level ones at 8.
+  # Job-level keys sit at 4 spaces; step-level ones at 8. Graded by NORMALISED
+  # NAME (G5-02) rather than by literal pattern, so `if : `, `"if":` and
+  # `'if' :` — which a conformant parser resolves identically to `if:` — cannot
+  # walk past it. The literal greps are kept BESIDE the allowlist, not replaced
+  # by it: their union can only add detections, and they still catch a key at an
+  # indent the enumeration does not visit.
+  local jobkeys="$work/step_wired.jobkeys"
+  _assent_map_keys "$jb" 4 >"$jobkeys"
+  if grep -qx '?unreadable' "$jobkeys"; then
+    return 3
+  fi
   local jobif="$work/step_wired.jobif"
   grep -nE '^    if:' "$jb" >"$jobif" || true
-  if [[ -s "$jobif" ]]; then
+  if [[ -s "$jobif" ]] || grep -qx 'if' "$jobkeys"; then
     return 4
   fi
   local jobneeds="$work/step_wired.jobneeds"
   grep -nE '^    needs:' "$jb" >"$jobneeds" || true
-  if [[ -s "$jobneeds" ]]; then
+  if [[ -s "$jobneeds" ]] || grep -qx 'needs' "$jobkeys"; then
     return 9
   fi
 
@@ -665,9 +780,16 @@ assent_step_wired() {
   # rc=0, "wired, argument-free and undisarmed", for a step that does not run
   # on pull requests at all. Same idiom as the run:/uses: counters above, which
   # had it; this key list did not.
+  # G5-02, step level: same normalised allowlist, same union with the literal
+  # grep. An unreadable step key is an isolation failure (6), not a pass.
+  local stepkeys="$work/step_wired.stepkeys"
+  _assent_step_keys "$step" >"$stepkeys"
+  if grep -qx '?unreadable' "$stepkeys"; then
+    return 6
+  fi
   local disarmed="$work/step_wired.disarmed"
   grep -nE '^[[:space:]]*(-[[:space:]]+)?(if|continue-on-error):' "$step" >"$disarmed" || true
-  if [[ -s "$disarmed" ]]; then
+  if [[ -s "$disarmed" ]] || grep -qx 'if' "$stepkeys" || grep -qx 'continue-on-error' "$stepkeys"; then
     return 8
   fi
 
diff --git a/hack/lint/workflow_pins_test.sh b/hack/lint/workflow_pins_test.sh
index 955aec8d..dc8e3875 100755
--- a/hack/lint/workflow_pins_test.sh
+++ b/hack/lint/workflow_pins_test.sh
@@ -1433,6 +1433,100 @@ V="$WORK/fixture.bi-unreadable.yaml"
 } >"$V"
 helper_reach_is 10 "$V" "a branches-ignore: token carrying an unreadable byte is REFUSED, not searched — the fail-open direction is now closed by construction rather than by enumerating bytes (G4-01)"
 
+# G5-01 — a GLOB on `branches-ignore:`. Every pattern below EXCLUDES main, so
+# no pull request onto main runs the workflow; the reader returned 0, "runs on
+# every pull request", for all of them. `_assent_tokens_readable` does not
+# catch it and must not: `*` is a legal filter character, so the pattern
+# tokenises perfectly and nothing is dropped or mangled. The defect was an
+# EXACT-TOKEN predicate applied to a PATTERN list — and the header had already
+# reasoned it out one key over, where the same un-evaluability is fail-CLOSED.
+bi_fixture() { # <name> <yaml value or block> — branches-ignore in flow form
+  local f="$WORK/fixture.$1.yaml"
+  printf 'name: f\non:\n  pull_request:\n    branches-ignore: %s\njobs: {}\n' "$2" >"$f"
+  printf '%s' "$f"
+}
+bi_seq_fixture() { # <name> <item> — branches-ignore as a block sequence
+  local f="$WORK/fixture.$1.yaml"
+  printf 'name: f\non:\n  pull_request:\n    branches-ignore:\n      - %s\njobs: {}\n' "$2" >"$f"
+  printf '%s' "$f"
+}
+
+V="$(bi_fixture bi-glob-star2 "['**']")"
+helper_reach_is 10 "$V" "branches-ignore: ['**'] is REFUSED — it excludes every branch, main included, and an exact-token search finds no literal 'main' (G5-01: rc=0 at 01b2322, on a workflow that runs on NO pull request)"
+
+V="$(bi_fixture bi-glob-prefix "[main*]")"
+helper_reach_is 10 "$V" "branches-ignore: [main*] is REFUSED — a pattern that covers main without being the token 'main' (G5-01)"
+
+V="$(bi_fixture bi-glob-suffix "['*ain']")"
+helper_reach_is 10 "$V" "branches-ignore: ['*ain'] is REFUSED — glob semantics are not evaluable by a text gate, and refusing is the direction this reader already claims for branches: (G5-01)"
+
+V="$(bi_seq_fixture bi-glob-seq "'**'")"
+helper_reach_is 10 "$V" "…and in BLOCK SEQUENCE form too, not only flow form (G5-01)"
+
+V="$(bi_fixture bi-literal-bad "[main]")"
+helper_reach_is 13 "$V" "a LITERAL branches-ignore: [main] still reds as excluding main — the refusal is scoped to patterns, it did not swallow the real finding (G5-01, other polarity)"
+
+V="$(bi_fixture bi-literal-legit "[gh-pages]")"
+helper_reach_is 0 "$V" "a LITERAL branches-ignore: [gh-pages] is still accepted — not made refusal-happy (G5-01, other polarity)"
+
+# G5-02 — a disarm key that is not spelled bare. `if : `, `"if":` and `'if' :`
+# are resolved identically to `if:` by a conformant parser (checked against
+# ruby/psych), so actionlint has nothing to flag and the step or job carries
+# release-exitgate's exact push-only guard while grading "wired, argument-free
+# and undisarmed". Graded now by NORMALISED KEY NAME, mirroring the filter-key
+# allowlist in assent_pr_reach that is measurably immune to the same evasions —
+# normalisation is the immunity, not a wider pattern.
+step_key_fixture() { # <name> <extra key line, 8-space indent assumed>
+  local f="$WORK/fixture.$1.yaml"
+  {
+    printf 'name: f\non:\n  pull_request:\njobs:\n  verify:\n    runs-on: ubuntu-latest\n    steps:\n'
+    printf '      - name: gate\n'
+    printf '        %s\n' "$2"
+    printf '        run: bash %s\n' "$3"
+  } >"$f"
+  printf '%s' "$f"
+}
+job_key_fixture() { # <name> <extra job-level key line>
+  local f="$WORK/fixture.$1.yaml"
+  {
+    printf 'name: f\non:\n  pull_request:\njobs:\n  verify:\n'
+    printf '    %s\n' "$2"
+    printf '    runs-on: ubuntu-latest\n    steps:\n'
+    printf '      - name: gate\n        run: bash %s\n' "$3"
+  } >"$f"
+  printf '%s' "$f"
+}
+
+V="$(step_key_fixture step-if-bare 'if: false' hack/lint/workflow_pins_test.sh)"
+helper_wired_is 8 "$V" "$SELF_GATE" "a step disarmed with a BARE 'if:' is DISARMED (the control that always worked)"
+
+V="$(step_key_fixture step-if-spaced 'if : false' hack/lint/workflow_pins_test.sh)"
+helper_wired_is 8 "$V" "$SELF_GATE" "a step disarmed with 'if : ' — a space before the colon — is DISARMED (G5-02: rc=0 at 01b2322; a conformant parser reads it as 'if')"
+
+V="$(step_key_fixture step-if-quoted '"if": false' hack/lint/workflow_pins_test.sh)"
+helper_wired_is 8 "$V" "$SELF_GATE" "a step disarmed with a QUOTED '\"if\":' is DISARMED (G5-02)"
+
+V="$(step_key_fixture step-coe-spaced 'continue-on-error : true' hack/lint/workflow_pins_test.sh)"
+helper_wired_is 8 "$V" "$SELF_GATE" "a step neutered with 'continue-on-error : ' is DISARMED (G5-02)"
+
+V="$(job_key_fixture job-if-spaced 'if : false' hack/lint/workflow_pins_test.sh)"
+helper_wired_is 4 "$V" "$SELF_GATE" "a JOB carrying 'if : ' has release-exitgate's push-only guard — rc=4, not 0 (G5-02: this is the RELSE-08 shape the whole lane exists to catch)"
+
+V="$(job_key_fixture job-if-quoted '"if": false' hack/lint/workflow_pins_test.sh)"
+helper_wired_is 4 "$V" "$SELF_GATE" "a JOB carrying a quoted '\"if\":' is likewise rc=4 (G5-02)"
+
+V="$(job_key_fixture job-needs-quoted '"needs": release-exitgate' hack/lint/workflow_pins_test.sh)"
+helper_wired_is 9 "$V" "$SELF_GATE" "a JOB carrying a quoted '\"needs\":' is rc=9 — skipped dependency, skipped job (G5-02)"
+
+# Both polarities: normalisation must not turn ordinary step/job keys into a red.
+V="$WORK/fixture.step-ordinary-keys.yaml"
+{
+  printf 'name: f\non:\n  pull_request:\njobs:\n  verify:\n    runs-on: ubuntu-latest\n    timeout-minutes: 60\n    steps:\n'
+  printf '      - name: gate\n        id: g\n        shell: bash\n        env:\n          FOO: bar\n'
+  printf '        run: bash hack/lint/workflow_pins_test.sh\n'
+} >"$V"
+helper_wired_is 0 "$V" "$SELF_GATE" "a step carrying ordinary keys (id:, shell:, env:) in a job with timeout-minutes: is still WIRED — the key allowlist grades disarms, it does not refuse normal structure (G5-02, other polarity)"
+
 f="$(helper_fixture wired-comment <<'FIX'
 name: f
 on:

From 6e7d85b158e6c770d65cd561c715b90f143cd8bf Mon Sep 17 00:00:00 2001
From: Konrad Heimel <konrad.heimel@gmail.com>
Date: Sun, 23 Aug 2026 23:23:10 +0200
Subject: [PATCH 7/8] :memo: docs(ci): withdraw three falsifiable claims from
 the PR-reach reader (D-157)

Text only. Zero non-comment lines changed in hack/lib/pr_reach.sh -
verified by diffing out comment and blank lines. No predicate touched,
no mechanism added, the filter path and _assent_tokens_globfree
untouched. This is the parking edit, not a seventh round of fixes.

G6-01. Reproduced before rewording: `_assent_step_keys` derives the step
key indent with `match($0, /^[ ]*- /)`, which matches exactly one space,
so `      -   if : ${{ false }}` yields 8 while the keys sit at 10. The
enumeration visits nothing, `?unreadable` never fires, and
assent_step_wired returns 0 - WIRED - for a step carrying
release-exitgate's own push-only guard. Measured at this tip AND at
01b2322, so the shape predates the normalisation work and survives it;
with a BARE `if:` under the same wide marker it returns 8, because the
literal grep still reaches it. Two sentences were therefore false and
are withdrawn:

  * "their union can only add detections, and they still catch a key at
    an indent the enumeration does not visit" - the union covers bare
    spellings at any indent and non-bare spellings at indents the
    enumeration visits; the intersection is covered by neither and is
    SKIPPED.
  * "anything normalisation cannot reduce to an identifier is refused
    rather than skipped" - that holds for what the enumeration visits
    and says nothing about what it does not.

The shape is added to DOES NOT READ with its measurements and a
one-command reproduction.

G6-02. "DOES NOT READ: multi-line flow sequences (refused)" was wrong
twice - they are read, and the six shapes measured here
(branches:/types:/branches-ignore:, both polarities) all graded
correctly. Moved to READS, with no correctness guarantee claimed beyond
those six.

A third falsifiable claim, found while re-checking this row against
G6-01 rather than reported to me: "a future tokenizer defect on that key
can produce a red or a refusal, never a silent accept - by
construction". False for a defect that drops the token set ENTIRELY. An
empty set passes _assent_tokens_readable, passes
_assent_tokens_globfree and passes `grep -qx main`, so the consumer
falls through to 0 - measured on all three. Same shape as G6-01 on the
other layer: an enumeration that visits nothing yields an empty set, and
an empty set satisfies every must-NOT-contain check. No total-drop
defect is known on that key today; what is withdrawn is the claim that
the construction rules one out. The must-CONTAIN tests are unaffected -
an empty set cannot contain the required token, so they red (measured:
empty -> 13).

Also scoped the READS list to the filter reader, since the step reader's
bounds differ and stating them together read as unconditional.

Behaviour unchanged and re-verified: all three gates green, the round-4
and round-5 before/after matrices re-run at 0 mismatches, bash 3.2 green.
---
 CHANGELOG.md                |   1 +
 docs/decisions/decisions.md |   2 +-
 hack/lib/pr_reach.sh        | 115 ++++++++++++++++++++++++++++--------
 3 files changed, 93 insertions(+), 25 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index e026d6df..c8d4f2e8 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -94,6 +94,7 @@ repository still gets a decision, never by following the link; no release carrie
 - :memo: docs(e11): delete the false cost claim; reason 1 carries Shape D alone (F3-01)
 - :memo: docs(ci): D-159 recorded a residual that does not exist (ORPH-01..04)
 - :memo: docs(release): correct the residual the gate documents (R3-01)
+- :memo: docs(ci): withdraw three falsifiable claims from the PR-reach reader (D-157)
 
 ### Features
 - :sparkles: feat(audit): measure REL-03/REL-07 by real mutation run, not by name
diff --git a/docs/decisions/decisions.md b/docs/decisions/decisions.md
index a2e52d57..979371d3 100644
--- a/docs/decisions/decisions.md
+++ b/docs/decisions/decisions.md
@@ -160,7 +160,7 @@ project/process decisions.
 | D-153 | 2026-08-19 | **The cosign signer-identity pin published in `SECURITY.md` was WRONG, not merely missing from `hack/install.sh`: the identity regexp is widened to `^https://github\.com/PlatformRelay/[Aa]ssent/` in both files (AUD2-S03 / SEC-03).** Substance first: `SECURITY.md`'s "Verify a tagged release" instructions pinned `--certificate-identity-regexp '^https://github.com/PlatformRelay/assent/'`, and an adopter who followed them on **v0.2.0 or v0.3.0 got a verification FAILURE on a genuine, correctly signed artifact** — the published recipe has been broken for every release since v0.2.0, and the natural reading of that failure is "this release was tampered with". Cause: the repository was renamed `PlatformRelay/assent` → `PlatformRelay/Assent` between v0.1.0 and v0.2.0; the keyless signing certificate's Subject Alternative Name carries GitHub's canonical casing; cosign compiles `--certificate-identity-regexp` as a Go RE2 pattern and matches it **case-sensitively**. Decoded from the published bundles: v0.3.0 and v0.2.0 sign as `https://github.com/PlatformRelay/Assent/.github/workflows/release.yaml@refs/tags/vX.Y.Z`, v0.1.0 as `https://github.com/PlatformRelay/assent/.github/workflows/release.yaml@refs/heads/main`. All three verify under the new value; independently re-confirmed with real cosign against the real v0.3.0 artifact (`Verified OK` under the new pin, exit 1 "expected SAN value to match regex" under the old). Options considered: **(a)** ship the pin byte-identical to the published-but-broken value and file the breakage as a follow-up (rejected — it would land a green gate asserting a guarantee that fails closed on this project's own releases, D-124's defect one level up); **(b)** case-insensitive `(?i)` (rejected — wider than the defect and it silently accepts casings GitHub never issues); **(c)** an explicit `[Aa]` class in both files, dots escaped (chosen). Not widened otherwise: the `^` anchor and the owner/repo scope stand, so another owner, an `assent-mirror` typosquat, another forge and an unescaped-dot host all still fail. Enforcement, per D-128: **one** published truth — `hack/release/install_cosign_pin_test.sh` extracts the pair from `hack/install.sh` and `SECURITY.md`, requires exactly one distinct value per file, reddens on drift, and (this is the assertion that would have caught the defect) matches the pin against the three **real** SANs above, committed as offline fixtures, plus six negatives. Extends D-110 (bundles beside archives) and D-109; the maintainer-path twin at `hack/release/verify-artifacts.sh:124` is still unpinned and is tracked in the backlog, not fixed here. Revert: restore `'^https://github.com/PlatformRelay/assent/'` in both files — which re-breaks verification of v0.2.0 and every later release, so revert only together with a repo rename back to lowercase. |
 | D-154 | 2026-08-23 | **Every `hack/**` script that uses a bash 4+ feature declares a PER-SCRIPT version floor via the shared `hack/lib/require-bash.sh`, because one of them was a silent local FAIL-OPEN under stock macOS bash 3.2 (BASH32-F01).** Substance first: `/bin/bash hack/docs/truthlag_pins_test.sh` on macOS printed 20 `PASS` lines, died at its `declare -A ex_s09_prefix_hint=(…)`, never printed its final `OK: all truth-lag pins green` banner — and **exited 0**. Its caller `task docs-gates`, and therefore `task check`, read that as a green gate, and AGENTS.md rule 4 makes a green local `task check` a per-commit precondition; CI is ubuntu/bash 5, so nothing merges through this path, which is precisely why it survived. Mechanism, measured on bash 3.2.57: 3.2 has no associative arrays, so under `set -u` it re-reads `declare -A x=([k]=v)` as an INDEXED array assignment and evaluates the subscript `k` **arithmetically**, hitting "unbound variable"; the shell terminates the script and the exit status is 0. Two theories were disproved en route and are recorded so they are not re-explored: the `trap … EXIT` status-swallow (3.2 propagates 1 through an EXIT trap correctly) and `set -e` (the script runs `set -uo pipefail`). The other two affected scripts fail CLOSED, but only incidentally: `hack/release/verify-artifacts.sh:202`'s literal is EMPTY, so there is no subscript to evaluate and it degrades to `declare: -A: invalid option`, which its `set -e` turns into exit 2 (measured with a `--dist` that reaches line 202 — an unreachable dist exits 1 much earlier); `hack/validate-schemas-stock.sh`'s `mapfile` degrades to "command not found" and it exits 1. Populating an empty literal or dropping `-e` silently converts a closed failure into the open one, so "how this construct happens to degrade" is not a guarantee worth depending on. Options considered: **(a)** one blanket repo-wide floor (rejected — the binding minimum differs per feature: `declare -A` 4.0, `local -n` 4.3, `mapfile -d ''` 4.4; a blanket floor both refuses shells that could run the 4.0 gates and hides which feature actually binds); **(b)** rewrite the three scripts to be 3.2-compatible (rejected — associative arrays and `mapfile` are the right tools here, a rewrite is a large risky change to scripts whose correctness IS the product, and it does nothing about the next gate author); **(c)** copy the existing inline `BASH_VERSINFO` guard from `hack/audit/aud2_exitgate_test.sh:71` into each script (rejected as the *only* measure — it duplicates the explanation three more times and still leaves the next author to rediscover the hazard); **(d) chosen** — a shared `require_bash <major>[.<minor>] <feature>` helper, called with each script's own correct floor (4.0 / 4.0 / 4.4), plus a meta-gate. Enforcement, per D-128, is one place: `hack/lint/bash_version_guard_test.sh`, wired as `task check` stage **20** and pinned in `hack/audit/exitgate_test.sh`'s `CHECK_STAGES` in the same commit. It scans every `hack/**/*.sh` for command-position bash 4+ constructs, requires a guard on each, requires the declared floor to be at least the feature's own minimum, and — the assertion that makes the rest non-vacuous — requires the scan to still find all four known feature-using files, so a typo in a detection pattern reds instead of quietly matching nothing. Its own negative control mutates real copies of the three scripts with the guard lines stripped and asserts they are flagged. `hack/audit/aud2_exitgate_test.sh` keeps its inline guard and is accepted by the gate as guarded; adopting the helper there is a follow-up, not this lane. Stated limits: the gate sees only command-position constructs in `hack/**/*.sh` (not `eval`, dynamically built command names, case-modification expansions, or scripts outside `hack/`), and the exit-0 control needs a real bash 3.2 — present on macOS, absent on CI ubuntu, where it SKIPs **loudly** rather than passing silently. Accepted behaviour change: under 3.2, `hack/release/verify-artifacts.sh --help` now refuses instead of printing usage. Revert: delete the guard calls — `task check` then silently stops certifying the docs truth-lag pins for every contributor whose `bash` is 3.2. |
 | D-156 | 2026-08-23 | **The tier-1 (CEL) ceiling is recorded (`docs/planning/rego-tier-ceiling.md`, E11-S01 / REQ-E11-S01-01+02) and it NARROWS E11: two of the four named shapes are struck outright and a third in part.** Substance first: of multi-pass / cross-manifest / set-difference / graph-relationship (`openspec/specs/later-phases.md:284`), **cross-manifest and set-difference are struck, the "named intermediate" half of multi-pass is struck, and only fold/aggregate-over-a-collection and in-input graph reasoning survive as justification for a second backend.** Measured against the surface this repo actually binds — `internal/core/aggregate/evaluate.go` `newEvalEnv`, eleven frozen predicate-scope variables, **zero extension libraries** — reproduced in a nested throwaway module pinned to the repo's `cel-go v0.31.0` (root `go.mod`/`go.sum` byte-unchanged; nothing added to the dependency graph, which judgment call (d) has not authorised). **What exceeds tier 1: (1) folds.** `sum`, `reduce`, `math.*` and `lists.*` are all `undeclared reference`; `size()` is the only aggregate in the surface, so a rule counting matched changes is expressible and a rule summing a numeric delta across them is not. **(2) Graph reasoning** — the iteration count of a CEL expression cannot be made data-dependent, so depth is syntactic and **unbounded** reachability has no spelling; a bounded `k`-hop form *is* writable and answers a fixed-depth question, not the rule (detailed below, with the refutations of two sharper claims this row previously made). **What is struck, with the CEL that does the job:** registry membership — `string(new) in facts.registry.topics.value` over a `cardinality: set` fact, already shipped green at `examples/packs/service-catalog/.assent/packs/catalog/rules/ownership.yaml:21`; keyed attribute lookup — either a purpose-built provider (`builtin/resource-owner`, exercised in both polarities by `examples/archetypes/referenced-resource-ownership/`) or `facts.<p>.<n>.value[key].field`, which compiles and is lint-clean because `internal/lint/facts_ref.go`'s D-051 shape check permits arbitrary navigation past `.value` and only forbids indexing `facts` itself; set difference — `oldEntry.acls.filter(a, !(a in entry.acls)).size() == 0`; named intermediates — no `cel.bind`, but re-deriving the sub-expression inside each leaf is semantically identical and compiles. **The sharpest finding is a distinction, not a rule:** same-changeset **cross-file** reasoning fails for **input availability**, not expressiveness — the evaluation unit is one file (`change.ChangeSet` is documented "for one file", `internal/change/diff.go:129`; `assent run` strips one `--subject file:<path>`, `cmd/assent/run.go:266`, and diffs it alone, `:293`) and **REQ-E11-S05-01 pins the Rego module to the identical `EvaluationInput`** with the tier fenced to "declared data, no I/O". **A Rego module therefore fails that rule identically, so it is struck from E11's justification too** — the fix is an input decision, which E11's non-goals fence, not a backend decision. Corroborating: the one committed illustration of the escape hatch, `examples/policies/rego/bounded_change.rego`, is **entirely tier-1 expressible** — both `violations` rules are per-change predicates and `examples/policies/declarative/bounded-change.yaml` is the same rule already in the envelope. **The strongest single piece of evidence, and the one that sizes the epic, is the graph shape.** On the `assent run` path document-mode `walkNode` emits a Change **only where two scalars differ** — a sequence on either side makes the whole ChangeSet **opaque → REVIEW** before any rule runs (`internal/change/diff.go`) — and collection-mode `DiffEntries` is reached only from `internal/adoptertest`, so `old`/`new`/`entry`/`oldEntry` and every `changes[i].old`/`.new` bind **scalars**. That does **not** starve a graph rule, because a flat `set` fact still carries structure: `edges: {type: string, cardinality: set}` returning `["orders|billing","billing|ledger"]` is a **fully declarable, in-contract adjacency inside `EvaluationInput` today** — the declaration is legal (`schemas/provider/v1alpha1/response.schema.json`), `fact.value` carries no JSON-Schema type constraint and `ResolveFactsChecked` cross-checks the *declaration* not the value (`internal/provider/resolve.go`), outputs are operator-authored (`internal/provider/config.go`), the `http` transport is live on the plain run path with **no `--checkout`** (`cmd/assent/provider_host.go` `providerCallFor`), and a set fact binds as a CEL list. Tier-1 CEL nonetheless cannot answer the actual question over it: **CEL has no recursion, fixpoint, fold or user-defined function, so unbounded reachability has no spelling** (`transitiveClosure` → `undeclared reference`; the four comprehension macros iterate one level and cannot call themselves). **Stated precisely, because two drafts of this record overreached and both were caught by independent review:** a *bounded* `k`-hop check **is** expressible and does **not** need the string decomposition CEL lacks — over a finite in-input candidate set (a `nodes` set fact, the same construction as `edges`), decode is replaceable by **encode-and-compare**: `nodes.value.exists(m, nodes.value.exists(n, (string(new)+"|"+m) in edges.value && (m+"|"+n) in edges.value && (n+"|"+string(new)) in edges.value))` compiles **and evaluates** under the real `cel.CostLimit(1_000_000)` to `true/true/true/false` over the fixture above, and `nodes.value.filter(m, (string(new)+"|"+m) in edges.value)` recovers an edge's far end as `[billing]`. Both primitives (`+` on strings, `in`) were already in this record's own function census, so the claim that decoding was a second independent barrier was internally inconsistent as well as false. **The real ceiling is `k`, and a third draft got its cost wrong too** — it claimed `O(|N|^(k-1)·|E|)` "exhausts the cost budget on any real graph". Wrong complexity class and wrong conclusion, because the census had omitted the surface's only value binder, `[expr].all(v, …)`: binding each BFS frontier once per level makes cost additive across levels, and measured under the real `cel.CostLimit(1_000_000)` a ring `|N|=50, deg 5` costs 89,551 at `k=10`, 235,297 at `k=20` and 686,317 at `k=50` — roughly linear in `k`, and at `k=50 ≥ |N|` CEL is **not approximating at all, it decides reachability exactly**, in 69% of budget. The practical `k` collapses around `|N|≈200` (`k=10` at 46% of budget, `k=20` exceeds). Recorded because a reader sizing this epic is entitled to ask "would CEL suffice for *our* graph?" and the previous sentence foreclosed that question with an assertion measurement refutes; it is **not** offered as a second reason. **What carries the verdict is one property, now measured rather than recalled: the iteration count of a tier-1 CEL expression cannot be made data-dependent.** `reduce`, `transformList`, `transformMap`, two-var `all(i,x,…)`, `range`/`lists.range` and `cel.bind` are all `undeclared reference`; `for` is a `reserved identifier`; there is no fold, self-reference or generator; so depth is a **syntactic** property, hard-capped by cel-go's parser recursion limit of 250 (`expression recursion limit exceeded: 250` at depth 260, depth 200 still compiles). That a fixed `k` really is an approximation when the data outruns it is measured too: on a 4-cycle the `k=3` form evaluates `false` and the `k=4` form `true`. **Rego answers the unbounded question with `graph.reachable` — pure and deterministic — and that single gap is the whole justification.** **An input that is in contract and available today, over which CEL can only approximate and Rego decides, is exactly the per-rule evidence D-017's gate demanded — so E11 has TWO unconditional justifications (folds and graphs), neither waiting on any open question.** Deliverability caveat, stated because this row makes the same distinction for sub-shape B1: **no provider in the corpus ships an encoded adjacency today** — that one *can* follows from the provider contract, the same inference used to strike B1, not from a shipped example. Options considered: **(a)** record all four shapes as exceeding, the reading D-141's unlock invites (rejected — three are demonstrably expressible and an unfalsifiable ceiling claim is the defect this story exists to prevent); **(b)** strike set-difference **conditionally**, so that a narrowing answer to OQ-35 would return it to the ceiling (rejected on the second pass — both resolutions strike it: extending the entry binding makes CEL express it, narrowing makes it an input-availability failure that REQ-E11-S05-01 hands to Rego unchanged, so a conditional would have left a downstream story waiting on an answer that cannot change the verdict); **(c)** strike cross-manifest and set-difference **unconditionally**, strike half of multi-pass, keep folds and in-input graphs **both unconditionally** **(chosen)**. **Two rejected drafts are recorded because the same failure produced both, with the sign flipped, and only independent review caught either.** Draft 1 made the graph shape *contingent* on OQ-35/OQ-36 on the premise that "an adjacency needs a mapping-valued fact" — it does not; a set of encoded strings carries one inside the frozen declaration — which came from conflating a *provider-supplied catalog* (sub-shapes B1/B2, struck here as working and shipped) with **B3, which is specifically same-changeset cross-file *diffs***. It would have advised the operator to defer a 14-story epic on a premise that does not hold. Draft 2 replaced that with a second "independent reason" — that CEL cannot decode an edge, killing even a bounded two-hop check — **refuted by execution** (the encode-and-compare leaf above). Draft 3 replaced *that* with the exponential-cost claim above — **refuted by measurement**. The common cause across all three is one habit: **reaching for a second independent reason when one sufficient reason was already in hand**, and then applying an **asymmetric evidentiary standard** to protect it — accepting awkward-but-working spellings when they *struck* a shape (A2's re-derivation, B2's dynamic index) and rejecting them when they would have *narrowed* one this record wanted to keep. The verdict was right in all four drafts; the supporting argument was wrong in three. It now rests on one measured property and no supporting argument at all, which is the form it should have taken first. The correction to A2 runs the same way: the value binder `[expr].all(v, …)` removes the evaluation-cost half of A2's residual, so **A2 is struck more firmly than the first draft struck it**. Binds later stories: **S05** must not be widened to carry cross-manifest data; **S07**'s violation shape must support a fold result and a path/cycle witness, not a cross-manifest reference; **S12** must correct ADR-0002's `rego` bullet, which calls the tier an "escape hatch for **cross-entry checks**" — inaccurate for the shipped input contract; **S11** must label the unquarantined example a shape illustration, never evidence of need. **Binds E11-S04, whose denylist is not yet written: `graph.reachable` MUST be allowed**, with `split` alongside it — both pure and deterministic. `graph.reachable` is the one that carries the justification (it closes the graph at any depth); `split` is a convenience for rebuilding the adjacency. A capability set drafted from "deny anything unfamiliar" would strike out the epic's own strongest justification. Recorded in the S04 section of the epic spec, not only S01's. **That floor is held by REVIEW, not by a gate, and this row says so rather than inventing an enforcement path:** REQ-E11-S04-02's committed golden detects a *change* to the allowed set (so the sandbox cannot silently widen) and cannot detect an *omission* — a golden written without `graph.reachable` stays green forever. It says nothing about judgment call (d), since *which* builtins are callable is orthogonal to *where* the evaluator lives. Two residuals raised, neither decided, **neither gating any verdict here**, and neither the escalated rule-7 (d1)/(d2) question: **OQ-35** (the `entry`/`oldEntry` binding asymmetry — a silent `assent test` / `assent run` divergence; set-difference is struck either way and the graph shape needs no entry tree) and **OQ-36** (the frozen provider declaration has no object/map type, yet the authoring surface and `builtin/repo-file` together permit a mapping-valued fact). Also flagged, not edited (out of lane): `REQ-DEM-S05-04` calls the provider-visible tree the "merged-result checkout"; the code reads `<root>/head`, documented at `cmd/assent/checkout.go:44` as "the MERGE-REQUEST HEAD". This lane writes no Go, adds no dependency and touches no schema. Revert: delete `docs/planning/rego-tier-ceiling.md` and the D-156 narrowing text from the E11 spec — which restores an epic justified by four shapes, three of which this record shows are not real. |
-| D-157 | 2026-08-23 | **"Reaches pull requests" is now a SHARED, structural check (`hack/lib/pr_reach.sh`), the three PR-visible text gates CROSS-PIN each other's steps, and the fixed-string step check is replaced by an anchored `run:`-command match (GATES3).** Three residuals, each *demonstrated* by an independent reviewer on an earlier lane and each deliberately left unfixed there, all living in the same three files — `hack/lint/workflow_pins_test.sh`, `hack/audit/aud2_exitgate_test.sh`, `hack/examples/dogfood_wiring_test.sh`. **(1) The substantive one.** Two of the three answered "am I reachable on a PR?" with `grep -qE '^[[:space:]]+pull_request:'` over the workflow's `on:` block; a reviewer added `paths: ['internal/**']` under the trigger and measured **rc=0** — the trigger is present, the grep is satisfied, and the gate is disarmed for every PR that touches only `Taskfile.yml` or `.github/workflows/**`, which is exactly the class of PR these gates exist to grade. `types: [closed]` is the same defect by another route, and the grep's `[[:space:]]+` is indent-blind, so a `pull_request:` nested under `workflow_call.inputs` satisfied it too. **The third gate did not answer the question at all** — `workflow_pins_test.sh` asserted its step was present and undisarmed and never that the workflow carrying it runs on a PR; this is new coverage there, not a strengthening, and the brief that commissioned this lane assumed otherwise. **Decision on meaning:** a workflow "reaches PRs" when it has a top-level `pull_request:` trigger — a key of `on:` itself, at 2-space indent — whose sub-block carries **only keys from GitHub's five** (`types`, `branches`, `branches-ignore`, `paths`, `paths-ignore`; a sixth is **refused**, not guessed at), with **no** `paths:`/`paths-ignore:`, a `types:` list that is absent or a **superset** of GitHub's defaults (`opened`, `synchronize`, `reopened`), and no branch filter excluding `main` — **each read at whatever indent it is written at, and with its block sequence read whether the items are indented under the key or written FLUSH with it**, because the sub-block extraction is already scoped to the trigger and an indent pin bought no isolation the scoping did not already provide; branch and type names are compared as WHOLE tokens split on YAML's own separators, so `main-next` and `release/main` are not `main` — and when the target job carries neither a job-level `if:` **nor a job-level `needs:`** (a dependency that skips on PRs skips its dependents, defeating all three gates at once while every other assertion stays green), and the gate's own step carries no `if:`/`continue-on-error:` **in either the mapping-key or the sequence-item position** (`      - if:` is the step's first key and is a sequence item). **Deliberately still accepted**, stated so a reviewer does not read the narrowing as wider than it is: `on: pull_request` and `on: [push, pull_request]` (the inline forms cannot carry a filter, so they are strictly safer than the block form), the quoted `"on":` key, a `types:` superset, `branches:` listing the literal `main`, `branches-ignore:` sparing `main`, block-scalar `run: |` invocations, arbitrarily long comment blocks inside a gate step, and step-level `if:` on *other* steps (`verify.yaml`'s changelog gate is legitimately PR-excluded). **Deliberately narrower than GitHub:** a `branches:` glob covering main without the literal token (`['ma*']`) reds, because a bash gate cannot honestly evaluate GitHub's glob semantics, and a flow mapping or anchor in the `on:` block is **refused** (distinct code) rather than guessed at. **(2)** Each gate pinned only its OWN step, so a PR deleting one of the other two was invisible to the gate that still ran — caught locally by `task check` and on push by `release-exitgate`, hence a gap and not a hole. Each gate now asserts all three steps; the mutation matrix is the full cross-product (3 deleted steps × the 2 observers that still run) rather than a diagonal. **(3)** `aud2_exitgate_test.sh`'s `check_pr_wiring` located its step with `grep -nF -- "$SELF"` — a search for the script *name*, which the step's own comments satisfy. Measured by the reviewer: with the `run:` line commented out it still failed, but reported **"WITH ARGUMENTS"** instead of "does not invoke", sending an operator to look for an argument that does not exist. The anchored form from `dogfood_wiring_test.sh` is ported back and shared. **Why one lane and one helper, not three fixes:** the INBOX residual explicitly asked for a single shared helper so the next gate author inherits the strong check rather than copying the weak one; fixing one of three identical checks would have been misleading. **Judgment calls.** (a) The helper is **codes-only and prints nothing** — every caller owns its wording, because roughly twenty existing `expect_red` controls pin stderr fragments. (b) The 1..6 **line cap** `workflow_pins_test.sh` used to bound step isolation is replaced by a structural invariant — exactly one `run:` key and no `uses:` key, both of which actionlint itself flags — because cross-pinning made the helper isolate the aud2 and dogfood steps, whose comment blocks are a dozen lines long, and no cap admits an honest step of theirs while rejecting a merged one. (c) The helper is held to `workflow_pins_test.sh`'s preamble rules (**bash 3.2**, portable ERE, no `git`, no `grep -q` on a pipe) rather than aud2's ≥4.3 floor: that gate runs first in CI before any toolchain, and the other two callers do not refuse bash 3.2, so a bash-4 construct here would silently weaken them on a maintainer's machine. (d) It is a **line-oriented reader with a structural bias, not a YAML parser** — it says so in its own header and fails closed on anchors, aliases and flow mappings, because an honest narrow gate beats an overreaching one. (e) No new `check:` stage and `CHECK_STAGES` untouched: all three gates were already wired. **Evidence:** 44 helper-level probes, 20 host-independent fixture self-checks carried inside two of the gates, and end-to-end mutation of a scratch copy of the REAL `verify.yaml` driven through all three real gate scripts (the layer that found (ii) and (iii); fixtures alone did not) plus, in the gates themselves, 13 new red controls in aud2 (`CONTROL_FLOOR` 38→51, text-only 32→45, both floors met exactly), 15 in `workflow_pins_test.sh` and 12 in `dogfood_wiring_test.sh` — each pinned to its own finding text or rc — and, in every gate, **green** controls for the legitimate shapes above, so the new checks are provably not always-red. **Eight fail-opens were found by building mutants rather than by reasoning — six of them in this lane's own code, across five review rounds — and the record names every one, because the lane's value is the mutants, not the prose.** (i) *This lane's own widening:* accepting a block-scalar `run: |` invocation naively means a bare `bash <script>` line anywhere in the job satisfies the step check, including inside another step's multi-command `run: |` body where `echo skip && exit 0` a line above would mean the gate never runs — measured rc=0. The block form now counts only as a block's **sole** command, and all three gates carry that mutant. (ii) *The residual this lane exists to close, still open at any indent but four:* the filter greps were pinned to exactly four spaces, six-space indent is valid YAML resolving to the identical mapping, and the miss fell through to `return 0` — so on the real `verify.yaml` all three gates returned **rc=0** on a `paths:`-filtered trigger written one level deeper, the exact shape this row says they refuse. It was also the one place the helper broke its own stated rule, refusing an unevaluable *shape* while silently accepting an unrecognised *indent*. Matching is now indent-agnostic within the trigger sub-block, plus the five-key allowlist above. (iii) *Inherited, not introduced:* the step disarm grep lacked the `(-[[:space:]]+)?` alternative its `run:`/`uses:` siblings in the same function had, so a step whose FIRST key is the disarm (`      - if: …`) graded **wired, argument-free and undisarmed** — measured rc=0 on the real workflow, and it hollowed out the cross-pinning this row delivers. The byte-identical regex is in `main`'s `dogfood_wiring_test.sh`, so this is a pre-existing hole closed here, not a regression. (iv) *A tokenizer that split on the wrong characters:* branch and type names were tokenised with `tr -c 'A-Za-z0-9_'`, which splits on `-` and `/`, so `branches: [main-next]`, `branches: ['release/main']` and a `- main-v2` item each yielded a `main` token and were reported as **reaching every pull request** when no PR onto main runs the workflow at all (measured rc=0 on all three). `branches: [maintenance]` reddened correctly throughout, which is precisely why this survived two reviews: only the values that contain `main` as a **substring** — the ones that look right — were broken. Tokenising on YAML's own separators fixed it in both directions (`branches-ignore: [main-next]` had been a false RED). (v) *A blind spot reproduced while fixing the complaint about it:* a block sequence written FLUSH with its key — `branches:` then `    - main`, the canonical GitHub Actions style — was misgraded, and the key allowlist added in round two turned one such case from a correct 0 into a refusal, **reddening valid structure**. Two stacked defects: the value region's indent bound never admitted an item at the key's own indent (measurable independently of the allowlist), and the allowlist counted `- main` as an unknown key. **Why a 28-row mutant matrix missed (ii) and (iii), and why the fixture set added to close that missed (v):** the round-two fixtures gave every reach and wired code a host-independent case — a real improvement — but wrote all of them at 4 or 6 spaces with sequence items indented deeper than their key, so the substitution reproduced the same indentation blind spot somewhere cheaper. Breadth of mutant SHAPES is not breadth of coverage, and neither is breadth of return CODES if every case shares one incidental style. it was broad in mutant SHAPES and narrow in CODE coverage — 3 of 6 `assent_pr_reach` codes and 2 of 8 `assent_step_wired` codes had a host-independent fixture, and both defects lived in the uncovered ones. Every code now has one, the filter fixtures deliberately written at a non-4-space indent, and in flush block-sequence style as well after (v). (vi) *And then a line ending.* A single stray **CR** on one `branches-ignore:` sequence item made the tokenizer emit `main<CR>` as a whole token; `grep -qx main` missed it and the reader returned **0**, "runs on every pull request", for a trigger that EXCLUDES main (measured; both earlier readers said 13, so the round-3 tokenizer introduced it). One committed CR suffices: there is no `.gitattributes` here, `core.autocrlf=false` preserves it, no gate scans workflows for CR, and a GitHub diff renders it invisibly. CR is a YAML break character, so `main<CR>` was never a whole token and the reader was wrong by this row's own "compared as WHOLE tokens" rule. **THE CLASS IS NOW CLOSED WHERE IT CAN HURT, not merely the instance.** Four rounds produced six defects of one family — a line-oriented reader inferring YAML structure from indentation and character classes — and patching bytes one at a time was visibly not converging. The direction that can hurt, however, is narrow and structural: every filter test here is *must CONTAIN token X* (types must carry GitHub's defaults, branches must carry `main`) except **one**, `branches-ignore:`, which is *must NOT contain*. A misread drops or mangles a token, so every must-CONTAIN test goes RED — the CR bug's other two symptoms were exactly that, false reds on `branches:` and `types:`. Only the must-NOT-contain test converts a mangled token into a silent PASS. So the burden is inverted there: a token carrying any byte outside the git-ref/glob set (plus `#`, since that key alone keeps comment residue by G3-04's design) is now **REFUSED** rather than searched. A future tokenizer defect on that key can produce a red or a refusal, never a silent accept — by construction, not by enumeration. **A real YAML parse was evaluated and REJECTED on measured evidence, not assumed either way.** `python3` is an established dependency (`hack/validate-schemas-stock.sh`), but it uses **`json` only — stdlib**; PyYAML is nowhere established in this repo. Decisively: `hack/audit/README.md` publishes `docker run --rm -v "$PWD:$PWD" -w "$PWD" debian:stable-slim bash hack/audit/aud2_exitgate_test.sh --text-only` as the offline verification path, and that image was measured to contain **no python3 and no yq** — while the gate itself, which sources this helper, was measured GREEN in it (51 mutation controls), as was `workflow_pins_test.sh`. A PyYAML reader would break a published operator path and would also violate this file's stated no-toolchain contract (it runs first in CI, before `setup-go`). Go is unavailable in that image for the same reason. So the reader stays a heuristic, and the honest bound is written into its header rather than implied: it reads block mappings at any indent, block sequences indented or flush, inline flow sequences and quoted scalars; it REFUSES flow mappings, anchors, aliases, merge keys, unknown filter keys and unreadable tokens; and its one must-NOT-contain test now refuses instead of guessing. Recorded so a future lane does not re-litigate: if PyYAML ever becomes a committed dependency of the verification image, replacing this reader wholesale is the right move and would dissolve the remaining bounds. (vii) *A glob is not a misread, and the burden inversion did not cover it.* `branches-ignore: ['**']` — which excludes every branch, so no pull request runs the workflow at all — returned **0**, and so did `['*']`, `['ma*']`, `[main*]` and `['*ain']`, in flow and block form alike. `_assent_tokens_readable` cannot catch this and must not: `*` is a legal filter character, so a pattern tokenises perfectly, nothing is dropped or mangled, and the inverted burden never engages. The defect was an **exact-token predicate applied to a pattern list** — and this row had already reasoned it out one key over, where the identical un-evaluability is fail-CLOSED by polarity. Patterns are now REFUSED on the must-NOT-contain key, never searched. Lifted to gate level on the real workflow, all three gates PASSED that mutant before the fix and all three red after. (viii) *And the disarm check was matching a spelling, not a key.* `if : `, `"if":` and `'if' :` are resolved identically to `if:` by a conformant parser (checked against ruby/psych), so actionlint has nothing to flag — and a step or job carrying release-exitgate's exact push-only guard graded "wired, argument-free and undisarmed": **0** where the job-level cases should have been **4**, the RELSE-08 shape this whole lane exists to catch. The remedy deliberately was NOT a wider pattern — `[[:space:]]*:` would have been the fifth spelling patch here and would still miss the sixth. Step and job keys are now graded by **normalised name against an allowlist**, mirroring the filter-key allowlist in `assent_pr_reach` that was measured immune to all of those evasions; normalisation is the immunity, the literal greps are kept beside it as a union that can only add detections, and a key that will not normalise to an identifier is refused rather than skipped. **The guarantee sentence is narrowed to what is true**: this reader fails closed against a misread that DROPS or MANGLES a token, and against shapes it refuses; it does **not** claim immunity against a misread that FABRICATES one — `branches: ["main,next"]` is shredded into `main` + `next` and grades 0, measured, and left unfixed on purpose this round with the claim corrected to match the code rather than the code trusted to match the claim. The earlier "unknown shapes cost false reds, not silent passes" was an overclaim whose counterexamples sat inside the surface listed as READ, which is the D-124 species and worse than a documented hole. **The helper is graded too, not only the workflows it reads:** every mutation control mutates `verify.yaml` and asks the helper about it, which cannot tell a working helper from a stubbed one — with the helper now a single point of failure for all three gates, replacing `assent_pr_reach` with `return 0` would turn them all green at once. Two of the gates therefore also drive it against **from-scratch fixture workflows** whose right answer depends on nothing under `.github/workflows/**` (verified: the stub reds them by name). Revert: delete `hack/lib/pr_reach.sh` and restore the three gates' local readers — which restores the `paths:`-filtered bypass, the self-only pinning, and the misreport. |
+| D-157 | 2026-08-23 | **"Reaches pull requests" is now a SHARED, structural check (`hack/lib/pr_reach.sh`), the three PR-visible text gates CROSS-PIN each other's steps, and the fixed-string step check is replaced by an anchored `run:`-command match (GATES3).** Three residuals, each *demonstrated* by an independent reviewer on an earlier lane and each deliberately left unfixed there, all living in the same three files — `hack/lint/workflow_pins_test.sh`, `hack/audit/aud2_exitgate_test.sh`, `hack/examples/dogfood_wiring_test.sh`. **(1) The substantive one.** Two of the three answered "am I reachable on a PR?" with `grep -qE '^[[:space:]]+pull_request:'` over the workflow's `on:` block; a reviewer added `paths: ['internal/**']` under the trigger and measured **rc=0** — the trigger is present, the grep is satisfied, and the gate is disarmed for every PR that touches only `Taskfile.yml` or `.github/workflows/**`, which is exactly the class of PR these gates exist to grade. `types: [closed]` is the same defect by another route, and the grep's `[[:space:]]+` is indent-blind, so a `pull_request:` nested under `workflow_call.inputs` satisfied it too. **The third gate did not answer the question at all** — `workflow_pins_test.sh` asserted its step was present and undisarmed and never that the workflow carrying it runs on a PR; this is new coverage there, not a strengthening, and the brief that commissioned this lane assumed otherwise. **Decision on meaning:** a workflow "reaches PRs" when it has a top-level `pull_request:` trigger — a key of `on:` itself, at 2-space indent — whose sub-block carries **only keys from GitHub's five** (`types`, `branches`, `branches-ignore`, `paths`, `paths-ignore`; a sixth is **refused**, not guessed at), with **no** `paths:`/`paths-ignore:`, a `types:` list that is absent or a **superset** of GitHub's defaults (`opened`, `synchronize`, `reopened`), and no branch filter excluding `main` — **each read at whatever indent it is written at, and with its block sequence read whether the items are indented under the key or written FLUSH with it**, because the sub-block extraction is already scoped to the trigger and an indent pin bought no isolation the scoping did not already provide; branch and type names are compared as WHOLE tokens split on YAML's own separators, so `main-next` and `release/main` are not `main` — and when the target job carries neither a job-level `if:` **nor a job-level `needs:`** (a dependency that skips on PRs skips its dependents, defeating all three gates at once while every other assertion stays green), and the gate's own step carries no `if:`/`continue-on-error:` **in either the mapping-key or the sequence-item position** (`      - if:` is the step's first key and is a sequence item). **Deliberately still accepted**, stated so a reviewer does not read the narrowing as wider than it is: `on: pull_request` and `on: [push, pull_request]` (the inline forms cannot carry a filter, so they are strictly safer than the block form), the quoted `"on":` key, a `types:` superset, `branches:` listing the literal `main`, `branches-ignore:` sparing `main`, block-scalar `run: |` invocations, arbitrarily long comment blocks inside a gate step, and step-level `if:` on *other* steps (`verify.yaml`'s changelog gate is legitimately PR-excluded). **Deliberately narrower than GitHub:** a `branches:` glob covering main without the literal token (`['ma*']`) reds, because a bash gate cannot honestly evaluate GitHub's glob semantics, and a flow mapping or anchor in the `on:` block is **refused** (distinct code) rather than guessed at. **(2)** Each gate pinned only its OWN step, so a PR deleting one of the other two was invisible to the gate that still ran — caught locally by `task check` and on push by `release-exitgate`, hence a gap and not a hole. Each gate now asserts all three steps; the mutation matrix is the full cross-product (3 deleted steps × the 2 observers that still run) rather than a diagonal. **(3)** `aud2_exitgate_test.sh`'s `check_pr_wiring` located its step with `grep -nF -- "$SELF"` — a search for the script *name*, which the step's own comments satisfy. Measured by the reviewer: with the `run:` line commented out it still failed, but reported **"WITH ARGUMENTS"** instead of "does not invoke", sending an operator to look for an argument that does not exist. The anchored form from `dogfood_wiring_test.sh` is ported back and shared. **Why one lane and one helper, not three fixes:** the INBOX residual explicitly asked for a single shared helper so the next gate author inherits the strong check rather than copying the weak one; fixing one of three identical checks would have been misleading. **Judgment calls.** (a) The helper is **codes-only and prints nothing** — every caller owns its wording, because roughly twenty existing `expect_red` controls pin stderr fragments. (b) The 1..6 **line cap** `workflow_pins_test.sh` used to bound step isolation is replaced by a structural invariant — exactly one `run:` key and no `uses:` key, both of which actionlint itself flags — because cross-pinning made the helper isolate the aud2 and dogfood steps, whose comment blocks are a dozen lines long, and no cap admits an honest step of theirs while rejecting a merged one. (c) The helper is held to `workflow_pins_test.sh`'s preamble rules (**bash 3.2**, portable ERE, no `git`, no `grep -q` on a pipe) rather than aud2's ≥4.3 floor: that gate runs first in CI before any toolchain, and the other two callers do not refuse bash 3.2, so a bash-4 construct here would silently weaken them on a maintainer's machine. (d) It is a **line-oriented reader with a structural bias, not a YAML parser** — it says so in its own header and fails closed on anchors, aliases and flow mappings, because an honest narrow gate beats an overreaching one. (e) No new `check:` stage and `CHECK_STAGES` untouched: all three gates were already wired. **Evidence:** 44 helper-level probes, 20 host-independent fixture self-checks carried inside two of the gates, and end-to-end mutation of a scratch copy of the REAL `verify.yaml` driven through all three real gate scripts (the layer that found (ii) and (iii); fixtures alone did not) plus, in the gates themselves, 13 new red controls in aud2 (`CONTROL_FLOOR` 38→51, text-only 32→45, both floors met exactly), 15 in `workflow_pins_test.sh` and 12 in `dogfood_wiring_test.sh` — each pinned to its own finding text or rc — and, in every gate, **green** controls for the legitimate shapes above, so the new checks are provably not always-red. **Eight fail-opens were found by building mutants rather than by reasoning — six of them in this lane's own code, across five review rounds — and the record names every one, because the lane's value is the mutants, not the prose.** (i) *This lane's own widening:* accepting a block-scalar `run: |` invocation naively means a bare `bash <script>` line anywhere in the job satisfies the step check, including inside another step's multi-command `run: |` body where `echo skip && exit 0` a line above would mean the gate never runs — measured rc=0. The block form now counts only as a block's **sole** command, and all three gates carry that mutant. (ii) *The residual this lane exists to close, still open at any indent but four:* the filter greps were pinned to exactly four spaces, six-space indent is valid YAML resolving to the identical mapping, and the miss fell through to `return 0` — so on the real `verify.yaml` all three gates returned **rc=0** on a `paths:`-filtered trigger written one level deeper, the exact shape this row says they refuse. It was also the one place the helper broke its own stated rule, refusing an unevaluable *shape* while silently accepting an unrecognised *indent*. Matching is now indent-agnostic within the trigger sub-block, plus the five-key allowlist above. (iii) *Inherited, not introduced:* the step disarm grep lacked the `(-[[:space:]]+)?` alternative its `run:`/`uses:` siblings in the same function had, so a step whose FIRST key is the disarm (`      - if: …`) graded **wired, argument-free and undisarmed** — measured rc=0 on the real workflow, and it hollowed out the cross-pinning this row delivers. The byte-identical regex is in `main`'s `dogfood_wiring_test.sh`, so this is a pre-existing hole closed here, not a regression. (iv) *A tokenizer that split on the wrong characters:* branch and type names were tokenised with `tr -c 'A-Za-z0-9_'`, which splits on `-` and `/`, so `branches: [main-next]`, `branches: ['release/main']` and a `- main-v2` item each yielded a `main` token and were reported as **reaching every pull request** when no PR onto main runs the workflow at all (measured rc=0 on all three). `branches: [maintenance]` reddened correctly throughout, which is precisely why this survived two reviews: only the values that contain `main` as a **substring** — the ones that look right — were broken. Tokenising on YAML's own separators fixed it in both directions (`branches-ignore: [main-next]` had been a false RED). (v) *A blind spot reproduced while fixing the complaint about it:* a block sequence written FLUSH with its key — `branches:` then `    - main`, the canonical GitHub Actions style — was misgraded, and the key allowlist added in round two turned one such case from a correct 0 into a refusal, **reddening valid structure**. Two stacked defects: the value region's indent bound never admitted an item at the key's own indent (measurable independently of the allowlist), and the allowlist counted `- main` as an unknown key. **Why a 28-row mutant matrix missed (ii) and (iii), and why the fixture set added to close that missed (v):** the round-two fixtures gave every reach and wired code a host-independent case — a real improvement — but wrote all of them at 4 or 6 spaces with sequence items indented deeper than their key, so the substitution reproduced the same indentation blind spot somewhere cheaper. Breadth of mutant SHAPES is not breadth of coverage, and neither is breadth of return CODES if every case shares one incidental style. it was broad in mutant SHAPES and narrow in CODE coverage — 3 of 6 `assent_pr_reach` codes and 2 of 8 `assent_step_wired` codes had a host-independent fixture, and both defects lived in the uncovered ones. Every code now has one, the filter fixtures deliberately written at a non-4-space indent, and in flush block-sequence style as well after (v). (vi) *And then a line ending.* A single stray **CR** on one `branches-ignore:` sequence item made the tokenizer emit `main<CR>` as a whole token; `grep -qx main` missed it and the reader returned **0**, "runs on every pull request", for a trigger that EXCLUDES main (measured; both earlier readers said 13, so the round-3 tokenizer introduced it). One committed CR suffices: there is no `.gitattributes` here, `core.autocrlf=false` preserves it, no gate scans workflows for CR, and a GitHub diff renders it invisibly. CR is a YAML break character, so `main<CR>` was never a whole token and the reader was wrong by this row's own "compared as WHOLE tokens" rule. **THE CLASS IS NOW CLOSED WHERE IT CAN HURT, not merely the instance.** Four rounds produced six defects of one family — a line-oriented reader inferring YAML structure from indentation and character classes — and patching bytes one at a time was visibly not converging. The direction that can hurt, however, is narrow and structural: every filter test here is *must CONTAIN token X* (types must carry GitHub's defaults, branches must carry `main`) except **one**, `branches-ignore:`, which is *must NOT contain*. A misread drops or mangles a token, so every must-CONTAIN test goes RED — the CR bug's other two symptoms were exactly that, false reds on `branches:` and `types:`. Only the must-NOT-contain test converts a mangled token into a silent PASS. So the burden is inverted there: a token carrying any byte outside the git-ref/glob set (plus `#`, since that key alone keeps comment residue by G3-04's design) is now **REFUSED** rather than searched. A future tokenizer defect on that key that MANGLES a token produces a refusal rather than a silent accept. **Narrowed here rather than left standing (found while re-checking this row against G6-01):** the original wording said "never a silent accept — by construction", and that is false for a defect that drops the token set ENTIRELY. An empty set passes `_assent_tokens_readable`, passes `_assent_tokens_globfree` and passes `grep -qx main`, so the consumer falls through to 0 — measured on all three. It is the same shape as G6-01 on the other layer: an enumeration that visits nothing yields an empty set, and an empty set satisfies every must-NOT-contain check. No total-drop defect is known on that key today; what is withdrawn is the claim that the construction rules one out. The must-CONTAIN tests are unaffected — an empty set cannot contain the required token, so they red (measured: empty -> 13). **A real YAML parse was evaluated and REJECTED on measured evidence, not assumed either way.** `python3` is an established dependency (`hack/validate-schemas-stock.sh`), but it uses **`json` only — stdlib**; PyYAML is nowhere established in this repo. Decisively: `hack/audit/README.md` publishes `docker run --rm -v "$PWD:$PWD" -w "$PWD" debian:stable-slim bash hack/audit/aud2_exitgate_test.sh --text-only` as the offline verification path, and that image was measured to contain **no python3 and no yq** — while the gate itself, which sources this helper, was measured GREEN in it (51 mutation controls), as was `workflow_pins_test.sh`. A PyYAML reader would break a published operator path and would also violate this file's stated no-toolchain contract (it runs first in CI, before `setup-go`). Go is unavailable in that image for the same reason. So the reader stays a heuristic, and the honest bound is written into its header rather than implied: it reads block mappings at any indent, block sequences indented or flush, inline flow sequences and quoted scalars; it REFUSES flow mappings, anchors, aliases, merge keys, unknown filter keys and unreadable tokens; and its one must-NOT-contain test now refuses instead of guessing. Recorded so a future lane does not re-litigate: if PyYAML ever becomes a committed dependency of the verification image, replacing this reader wholesale is the right move and would dissolve the remaining bounds. (vii) *A glob is not a misread, and the burden inversion did not cover it.* `branches-ignore: ['**']` — which excludes every branch, so no pull request runs the workflow at all — returned **0**, and so did `['*']`, `['ma*']`, `[main*]` and `['*ain']`, in flow and block form alike. `_assent_tokens_readable` cannot catch this and must not: `*` is a legal filter character, so a pattern tokenises perfectly, nothing is dropped or mangled, and the inverted burden never engages. The defect was an **exact-token predicate applied to a pattern list** — and this row had already reasoned it out one key over, where the identical un-evaluability is fail-CLOSED by polarity. Patterns are now REFUSED on the must-NOT-contain key, never searched. Lifted to gate level on the real workflow, all three gates PASSED that mutant before the fix and all three red after. (viii) *And the disarm check was matching a spelling, not a key.* `if : `, `"if":` and `'if' :` are resolved identically to `if:` by a conformant parser (checked against ruby/psych), so actionlint has nothing to flag — and a step or job carrying release-exitgate's exact push-only guard graded "wired, argument-free and undisarmed": **0** where the job-level cases should have been **4**, the RELSE-08 shape this whole lane exists to catch. The remedy deliberately was NOT a wider pattern — `[[:space:]]*:` would have been the fifth spelling patch here and would still miss the sixth. Step and job keys are now graded by **normalised name against an allowlist**, mirroring the filter-key allowlist in `assent_pr_reach` that was measured immune to all of those evasions; normalisation is the immunity and the literal greps are kept beside it, so a detection from either is a detection. **That claim was then found to be too wide, and is withdrawn here rather than left standing (G6-01).** The union covers a BARE disarm spelling at any indent, and a NON-BARE spelling at an indent the enumeration visits. It does not cover the intersection: `_assent_step_keys` derives the step's key indent from the `- ` marker with `match($0, /^[ ]*- /)`, which matches exactly one space, so `      -   if : ${{ false }}` yields 8 while the keys sit at 10 — the enumeration visits nothing, `?unreadable` never fires, and `assent_step_wired` returns **0 (WIRED)** for a step carrying release-exitgate's own push-only guard. Ruby/psych resolves that mutant to `if: "${{ … }}"`, so it is valid YAML with nothing for actionlint to flag. Measured at this tip AND at the tip before the normalisation work, so the shape predates that work and survives it: marker + 2 or 3 spaces with `if : ` or `"if":` → 0 (want 8), while the same wide marker with a BARE `if:` → 8, because the literal grep still reaches it. Such a key is neither normalised nor refused — it is **SKIPPED**, and "a key that will not normalise to an identifier is refused rather than skipped" was false: it holds for what the enumeration visits and says nothing about what it does not. Recorded in the helper's DOES-NOT-READ list with a one-command reproduction. **Also corrected in the same pass (G6-02):** the header listed multi-line flow sequences under DOES NOT READ "(refused)", which was wrong twice — they are read, and the six shapes measured (`branches:`/`types:`/`branches-ignore:`, both polarities) all graded correctly; they are now listed under READS, with no correctness guarantee claimed beyond those six. **The guarantee sentence is narrowed to what is true**: this reader fails closed against a misread that drops or mangles a token on the must-CONTAIN tests, and against the shapes it refuses; on the must-NOT-contain test it fails closed against a mangled or glob token but NOT against a wholly dropped set (see the narrowing above); and it does **not** claim immunity against a misread that FABRICATES one — `branches: ["main,next"]` is shredded into `main` + `next` and grades 0, measured, and left unfixed on purpose this round with the claim corrected to match the code rather than the code trusted to match the claim. The earlier "unknown shapes cost false reds, not silent passes" was an overclaim whose counterexamples sat inside the surface listed as READ, which is the D-124 species and worse than a documented hole. **The helper is graded too, not only the workflows it reads:** every mutation control mutates `verify.yaml` and asks the helper about it, which cannot tell a working helper from a stubbed one — with the helper now a single point of failure for all three gates, replacing `assent_pr_reach` with `return 0` would turn them all green at once. Two of the gates therefore also drive it against **from-scratch fixture workflows** whose right answer depends on nothing under `.github/workflows/**` (verified: the stub reds them by name). Revert: delete `hack/lib/pr_reach.sh` and restore the three gates' local readers — which restores the `paths:`-filtered bypass, the self-only pinning, and the misreport. |
 | D-158 | 2026-08-23 | **CI-TOOLCHAIN — `verify` was red on every PR from a golangci-lint/Go skew; the remedy is to bump `GOLANGCI_LINT_VERSION` v2.12.2 → v2.13.1 and KEEP `go-version: stable`.** Symptom: PR #85, a six-file Markdown diff with **zero Go bytes**, failed `verify` with `/opt/hostedtoolcache/go/1.27.0/x64/src/crypto/internal/randutil/randutil.go:11:2: could not import math/rand/v2 (… method must have no type parameters) (typecheck)` — the failing path is inside the **Go toolchain's own source tree**, so no author change can fix it and re-running cannot clear it. `Analyze (go)`, `Analyze (actions)` and `CodeQL` all passed on the same run: the tree compiles clean under Go 1.27, only the linter chokes. **Mechanism**: golangci-lint typechecks the standard library with the `go/types` it was **compiled with**, not the `go` on `PATH`. GitHub's `stable` rolled 1.26 → 1.27.0 between this repo's last green `main` run (2026-08-19) and 2026-08-23; the v2.12.2 release binary is built with go1.26.x and cannot read the 1.27 stdlib. **Reproduced locally, not reasoned** (Go 1.27.0 SDK on `PATH`, `GOTOOLCHAIN=local`, whole tree): v2.12.2 → **panic** in `pkg/goanalysis/runner_loadingpackage.go:335` inside `go/types.(*Checker).Files`, exit 2; official v2.13.1 asset (`built with go1.27.0`) → **0 issues**, exit 0; `golangci-lint config verify` → exit 0, so the v2 config schema in `.golangci.yml` needs no migration; v2.13.1 also → **0 issues** against local Go 1.26.6, so the bump is safe for contributors who have not moved; and `go install …@v2.13.1` under Go 1.27.0 → 0 issues, which is the **`release-exitgate`** path (that job builds the binary rather than using the action, and `if: github.event_name != 'pull_request'` / RELSE-08 means no PR ever exercises it). **Diagnosis heuristic worth keeping**: golangci-lint's `go.mod` carries the comment *"the minimum Go version must always be latest-1"*, so its `go` directive is a machine-readable "supports Go 1.N+1" signal — v2.12.2 says `go 1.25.0` (supports ≤1.26), v2.13.1 says `go 1.26.0` (supports ≤1.27), and upstream commit `42a0530` in v2.13.0 is literally "go1.27 support". **Options considered.** (A) *bump the linter* — CHOSEN: treats the root cause, is a **one-line** diff because the version is single-sourced at workflow scope (D-128), fixes BOTH exposed sites (the `golangci-lint-action` in `verify` and the `go install` in `release-exitgate`) at once, and the risk it carried — new findings from a newer linter blocking every merge, since `golangci-lint` runs inside `task lint` inside `task check` — was **measured at zero** on the whole tree under both Go versions. (B) *pin `go-version: 1.26.x`* — REJECTED as the primary: it needs two pins (`verify.yaml:56` and `:171`), leaves the class of bug live, undercuts the stated reason `stable` is there (`# govulncheck needs it`, with `setup-go` exporting `GOTOOLCHAIN=local` so a pinned toolchain can fail to `go run` a tool whose module requires a newer Go — unverified, and moot under (A)), and trades a loud recurrence for **silent indefinite drift onto an unsupported Go** in a repo whose posture is govulncheck + cosign + SLSA + Scorecard. (C) *both* — REJECTED as gold-plating: (A) alone is measured green, and a second simultaneous remedy would make a still-red PR ambiguous. **Per-file sweep of `go-version: stable`, stated rather than silently skipped:** `verify.yaml:56` and `:171` were the only exposed sites and are fixed by the env bump without touching either line; `schemas.yml:57` (runs `go test` + ajv, no linter), `vulncheck.yaml:30` (govulncheck only — `stable` is actively *desirable* there) and `codeql.yaml:45` (CodeQL, which passed on 1.27.0) carry no golangci-lint and are NOT exposed; `release.yaml` uses `go-version-file: go.mod` and is unaffected. `hack/lint/workflow_pins_test.sh` asserts `TASK_VERSION`, action SHA pins and step wiring but **not** `go-version` or `GOLANGCI_LINT_VERSION`; it passes on this change. **Revert is (B), not bare v2.12.2** — reverting the env line alone restores a known-red state: revert = `GOLANGCI_LINT_VERSION` back to `v2.12.2` **and** pin `verify.yaml:56` + `:171` to `go-version: 1.26.x`. **Residual risk, stated plainly:** when `stable` rolls to Go 1.28, v2.13.1 breaks identically. The repo finds out because `verify` reds on **every** PR including zero-Go diffs — loud and immediate, with the signature recorded in `verify.yaml`'s env comment and the fix being one env line. Nothing detects it *earlier*: dependabot's `github-actions` ecosystem updates `uses:` refs, not `env:` literals (backlog `CI-TOOLCHAIN-F01`). Accepted on purpose over (B)'s failure mode. Note also the pre-existing local/CI linter skew — `Taskfile.yml`'s `lint` task is bare `golangci-lint run ./...` against whatever binary a contributor has installed, so this pin has never governed local `task check`; deliberately not changed here (that file was owned by a concurrent lane). |
 | D-159 | 2026-08-23 | **ORPHAN — `release-verify-test` was a gate invoked by nothing (D-124 again), and it is wired into `task check` in its three OFFLINE modes, not its default `all`.** Finding: `Taskfile.yml` defined `release-verify-test` — the **only** test of `hack/release/verify-artifacts.sh` — and no caller existed anywhere: not `check:`, not `CHECK_STAGES` in `hack/audit/exitgate_test.sh`, not `.github/workflows/**`, not the push-only `release-exitgate`. That script is not incidental: **`SECURITY.md:61` publishes it as the procedure release consumers run** to check artifact checksums, the stamped `assent version` and cosign signatures, and D-153/AUD2-F01 had just proved that published verification instructions rot silently. Measured before fixing, as the lane required: the gate was **green**, so this is a wiring defect only — nothing was being papered over. **Why not the `all` default.** `verify_test.sh` with no argument adds `test_snapshot_pass`, which shells out to `task release-snapshot`: `go install github.com/goreleaser/goreleaser/v2@…` on any machine without it (**network**, in a gate that runs before every commit), a `before: hooks: go mod tidy` that **rewrites `go.mod`/`go.sum` in the middle of `task check`**, `--clean` on the developer's `dist/`, and a five-target cross-compile (10s here with warm caches and goreleaser already installed; minutes cold). A flaky or network-bound stage is worse than a missing one, so `check:` runs `negative`, `cosign-skip-when-absent` and `readme` — REQ-E9-S12-02/03/04, all offline, together well under a second. **Consequence, stated precisely: REQ-E9-S12-01 (the real snapshot→verify round trip) is not gated per-commit in `task check`; it runs in push-only CI via `hack/release/exitgate_test.sh:33-34` (the `release-exitgate` job, `if: github.event_name != 'pull_request'`) — automated but not PR-visible, i.e. the RELSE-08 blind spot.** Those two lines are literally `task release-snapshot` then `task release-verify`, which is the `Verify:` string the spec gives the requirement (`openspec/specs/p5-e9-distribution/spec.md:441-442`), so nothing here needs a new gate built — an earlier draft of this row claimed the requirement was covered by no automation at all, which was false, and acting on it would have meant a future lane duplicating `exitgate_test.sh:33-34`. What this lane declines to do is move that L1 round trip into a per-commit gate: it cannot be, for the network/`go mod tidy`/`--clean` reasons above. Narrowing the RELSE-08 exposure for this requirement is a separate question from D-159. **Pinning.** `CHECK_STAGES` goes 20 → 21 in the same commit as the `check:` line (the AUD-S18/RELSE-08 lockstep), and `STAGE_BODY_PINS` pins the body **per mode** rather than by the bare script path — a single `bash hack/release/verify_test.sh` pin would stay green if two modes were dropped *and* if the stage were reverted to the unrunnable-in-check default. Three mutation controls prove it: deleting the `check:` line reds `check_check_wiring` by stage name, gutting one of the three modes reds `check_stage_bodies` while the other two still run, and the same deletion applied to the real tree reds the real gate at rc=1. **Also fixed, minimally, because wiring made it matter:** `verify_test.sh` wrote its captured stdout/stderr to fixed `/tmp/verify-{tamper,nosig}.{out,err}` and then **grepped** them; harmless while nothing ran it, but this repo runs several lane worktrees whose `task check` invocations overlap, and a concurrent run truncating `/tmp/verify-nosig.err` at open would fail the other run's `skip.*cosign` grep spuriously. Scratch files now live in each run's own `mktemp -d` (invisible to `verify-artifacts.sh`, which globs only `*.tar.gz`/`*.zip`) and are removed by the existing `RETURN` trap. |
 | D-160 | 2026-08-23 | **UNIV-COSIGN — the cosign signer-pin gate asserted an EXISTENTIAL property where the guarantee it publishes is UNIVERSAL, so it certified nothing about a file's second `cosign verify-blob`; `hack/release/install_cosign_pin_test.sh` now grades EVERY invocation in ALL THREE published files, statically and at runtime.** Substance first, and measured before anything was written: a scratch copy of each graded file with a **second, unpinned** `cosign verify-blob` spliced IN-BODY next to its real invocation (the splice shape matters — see UC-04 below) ran the gate to **exit 0** — `hack/install.sh` rc=0, `SECURITY.md` rc=0, `hack/release/verify-artifacts.sh` rc=0, the last of these being the shape a reviewer had already demonstrated on an earlier lane. **Every individual assertion in that gate was sound.** `has_flag` grepped the whole folded extraction, so a pinned sibling satisfied it; `one_value`'s `sort -u` collapsed two agreeing values to one, so the D-153 drift comparison saw a consistent file; section 0 **printed** the extracted invocation count and asserted nothing about it; and 4b/5d's stub-log checks were positive-only greps, i.e. the same existential shape at runtime, where a second unpinned call leaves the pinned call's log line intact. The conjunction of sound existential assertions is still an existential assertion. **This is the AUD2-S05 quorum defect one layer out: not a wrong assertion, a wrong quantifier**, and it predates both AUD2-S03 and AUD2-F01. **`SECURITY.md` was worse than the other two** — it fed only the drift comparison and had **no invocation-level grading at all**, so an unpinned recipe published to adopters was invisible to the gate that exists to police the recipe. **Property chosen: "every `cosign verify-blob` invocation in every graded file carries `--certificate-oidc-issuer`, `--certificate-identity-regexp` and `--bundle`, EACH WITH SECURITY.md's published value".** The value half is not decoration: `--certificate-identity-regexp ''` carries the flag and matches every Fulcio identity ever issued, and `one_value`'s `sort -u` does not catch it either, because an empty capture is not a line and the file still reports exactly one distinct value — a presence-only universal check would be the same defect one level down, so each invocation's own extracted value is compared against the published pair (reported `WRONG-VALUE[...]`, distinct from `UNPINNED[...]`). Options considered: **(a)** the remedy recorded when the finding was filed — assert the extracted invocation count is **exactly 1** per file (**REJECTED AS FACTUALLY WRONG — do not implement it in a later lane; it would red `main` on the day it lands.** `SECURITY.md` legitimately publishes **two** — one over the archive, one over `checksums.txt`, which is what covers the SBOMs listed inside it — so that assertion reds `main` on the day it lands, and the natural repair is to weaken it again); **(b)** universal quantification over invocations **(chosen)** — strictly stronger than (a) where (a) is true, and it keeps holding when a file legitimately grows a third correctly-pinned call. **Enforcement, per D-128, is one predicate**: `pin_violations <file>` prints one line per problem and nothing when the file is clean, so callers grade its OUTPUT and the identical function is asserted empty against the tree and non-empty against a mutant with no `set -e` games; `assert_all_pinned` is the thin failing wrapper; `log_unpinned_lines` is its runtime twin over the stub-cosign argv log. **Classification is fail-CLOSED, which is the part that carries the guarantee.** The candidate extractor is deliberately left un-narrowed (every non-comment line mentioning `cosign verify-blob`, continuations folded), because anything the *denominator* drops is a hole. A candidate is an invocation when the folded text begins with `cosign verify-blob`; the ONE waved-through non-invocation shape is a markdown inline-code mention (`` `cosign verify-blob` ``, which is how `SECURITY.md`'s capability table names it); **on a line carrying NO backticked mention, anything else — `foo && cosign verify-blob …`, a here-doc line, an un-backticked prose sentence — is reported UNCLASSIFIABLE rather than skipped**, because "this gate cannot tell whether that call is pinned" must never read as "that call is fine". **That scoping is not cosmetic, and the unscoped version of this sentence was FALSE (R3-01, caught by review on the round that added the honest banner).** The exemption tests whether the substring `` `cosign verify-blob` `` appears **anywhere on the line**, not whether the line is prose, and it is tested BEFORE the command-position and multi-token checks. So a line carrying a backticked mention AND one or more LIVE calls is exempted, neither graded nor refused: measured by splicing ``See `cosign verify-blob`: cosign verify-blob --bundle A.json a && cosign verify-blob --bundle EVIL.json evil`` into `SECURITY.md` — `occurrence_count` = 2 by the definition the banner itself states, `pin_violations` EMPTY, **whole gate rc=0**, while the banner reported that line among those "exempted as backticked prose". The **static** defect is not markdown-specific — splicing a live unpinned call with a trailing backticked mention into `hack/install.sh` gives candidates=2, invocations=1, `pin_violations` EMPTY — but the **whole-gate green is** markdown-specific, and the distinction is stated because a looser sentence here would itself be falsifiable: in that shell script the run reds at §4b for an unrelated RUNTIME reason (the spliced call executes and its bundle is absent), whereas `SECURITY.md` is a document with no runtime twin, which is why rc=0 survives there. Measured both ways rather than inferred from either. **Narrowing the exemption needs quote- and markdown-aware parsing — the machinery that produced UC-01/02/03 — so it is deliberately NOT patched here.** It is instead disclosed as residual (1) in the PASS banner, ahead of the variable/`eval`/fragment spellings, because it is the residual that is actually REACHABLE in these three files while those are not present in any of them. The banner also no longer labels an exempted line "prose": the branch it took is a fact, "prose" was an inference, and R3-01 is the case where that inference is wrong. **This is UC-07 doing its job on its own author:** the claim was falsifiable, it was checked, and the gate is now incomplete-and-honest rather than complete-and-wrong. Accepted cost, stated rather than discovered later: a *correctly pinned* invocation written off command position also reds. That is the intended direction of error for a security gate over three files carrying four invocations in one canonical style, and the message names the fix. **Anti-vacuity, because a lane whose entire deliverable is "make a gate stricter" is maximally exposed** (this repo's #1 review finding is an assertion that cannot fail — D-124, AUD-S18): section 2b runs **eight** mutants against **each** of the three files and 2c runs a ninth, and they were chosen for **branch** coverage of the new predicate rather than for variety of shape — (a) a second **unpinned** invocation must red, name the file, quote the offending command, and produce **exactly two** violations so the pinned siblings are provably not flagged; (b) a second **correctly pinned** invocation must stay green **and** must raise the extractor's invocation count by one, without which (b)'s green could mean "the extractor never saw it"; (c) an occurrence off command position, appended **fully pinned on purpose** so the only thing that can redden it is the classifier itself; (d) every invocation deleted → `NO-CANDIDATES`; (e) the continuation fold broken → `FOLD-BROKEN`, asserted **not** to also report `UNPINNED`, because conflating "the extractor truncated this" with "the pin is missing" sends the next maintainer to the wrong file; (f) every invocation displaced off command position → `NO-INVOCATIONS`; (g) a second invocation carrying both flags with an **empty** identity regexp → `WRONG-VALUE`, the hostile shape a presence-only check waves through; (h) a second invocation carrying both flags with a **foreign OIDC issuer** → `WRONG-VALUE` on the issuer half; and 2c strips the backticks from `SECURITY.md`'s prose mention and requires the same row to fail closed, proving the exemption keys on the backticks and is not a blanket bypass. The runtime twin has its own vacuity control (an unpinned line appended to a copy of the stub log must be seen). **One real defect was caught by this section during the lane and is recorded because it is a trap for the next author**: `log_unpinned_lines` was first written with `awk -v id="identity_re=${sec_identity}"`, and **awk processes escape sequences in a `-v` assignment**, so the pin's `github\.com` arrived as `github.com` and matched nothing; the values now reach awk through `ENVIRON`. **Stated limit, same posture as D-154's**: the denominator is the literal string `cosign verify-blob`, so an invocation spelled through a variable (`"$COSIGN" verify-blob …`), built by `eval`, or assembled from fragments is invisible to this gate. Widening the trigger to bare `verify-blob` was considered and **rejected** — it buys one hypothetical no file uses, and turns any future `SECURITY.md` sentence saying "verify-blob" outside backticks into a red gate, whose repair would be to loosen the classifier. **Nothing outside the gate changed**: `hack/install.sh`, `SECURITY.md` and `hack/release/verify-artifacts.sh` are byte-unchanged, and all four of their invocations were already pinned — this row closes a hole in the *checker*, not in the checked. The stage `release-install-cosign-pin-test` was already wired into `task check` and pinned in `hack/audit/exitgate_test.sh`'s `CHECK_STAGES`, so no wiring changed either. **SECOND ROUND — the first version of this fix REPRODUCED the very defect it closes, one level down, and independent review caught it before merge.** `has_flag` grepped the whole FILE; the replacement grepped the whole LINE. Both are existential; only the scope shrank. **UC-01**: one folded line was graded as at most ONE invocation, so `cosign verify-blob <both pins> --bundle a.json a && cosign verify-blob --bundle EVIL.json evil` began with `cosign verify-blob` (not UNCLASSIFIABLE), carried `--bundle` (not FOLD-BROKEN), carried both flag strings (not UNPINNED) and yielded the published values (not WRONG-VALUE) — **green**, in same-line, `;`-separated and backslash-folded forms, on all three graded files. Worse, the **full gate exited 0** for `SECURITY.md`: the two shell scripts were incidentally caught by the runtime twin (`log_unpinned_lines` at §5d), but **SECURITY.md is a document and has no runtime twin**, so the hole was unmitigated precisely on the file this row calls "the copy-paste recipe adopters run by hand" — D-153's exact incident class — while the gate printed "EVERY cosign verify-blob invocation ... is pinned", false as printed. The stated-limit paragraph did not cover it: it enumerated `$COSIGN`, `eval` and fragments, not `&&` chaining, and **leading** `&&` was explicitly handled (mutant (c) → UNCLASSIFIABLE), so the operator had been considered and only one side handled. Closed by grading per **OCCURRENCE** (`occurrence_count` + a new `MULTI-OCCURRENCE` violation that fails closed on any line carrying two calls) rather than per line; counting inside an already-triggered line uses the shorter `verify-blob`, so a second call spelled `cosign  verify-blob` or `"$COSIGN" verify-blob` and chained onto a pinned one is caught too, which the literal file-level trigger would miss. **UC-02**: `extract_issuer`/`extract_identity` anchor on a greedy `.*`, so the LAST value on a line wins — a hostile `--certificate-identity-regexp ''` placed FIRST was masked by a correct value placed second, **the extraction direction favoured the attacker**. Closed by `flag_value_tokens`, which returns EVERY value of every flag on the occurrence; each must equal the published one, so a repeated flag with an empty value first now reds. **UC-03 (P2, the erosion path)**: a CORRECTLY pinned call written with **double quotes** was refused as `WRONG-VALUE ... identity=<empty/unparsable> ... (an empty regexp matches every Fulcio identity)` — a true refusal with a **false reason**, and the repair a maintainer reaches for on that message is widening the extractor. Both quote styles are now accepted (double quotes are correct shell for this value: it contains no `$` and no backtick), and a **bare** value is diagnosed as `UNQUOTED-VALUE`, a QUOTING defect, never as a wrong or empty one — a gate that misdiagnoses erodes faster than one that refuses. **UC-04**: this row's "rc=0, rc=0, rc=0" reproduction figure is **splice-shape-sensitive** and is stated as measured: it holds for a second unpinned call spliced **in-body** next to the real one. An EOF-appended mutant reds the two shell scripts for an unrelated runtime reason, so the figure should not be read as holding for any second unpinned call. The same sensitivity is why the UC-03 double-quoted mutant reds the two scripts through the full gate (the spliced call actually RUNS and its fixture bundle is absent) while `SECURITY.md`, having no runtime, is the clean end-to-end proof at rc=0. The classifier's fail-closed posture on off-command-position occurrences was independently adjudicated KEEP, since §2c proves the prose exemption keys on the backticks and cannot be widened silently. **The lesson, recorded because it is the whole point of the lane:** a fix for an existential-where-universal defect is itself maximally exposed to the same defect at the next scope down — file, then line, then occurrence — and the only thing that caught it was a reviewer building the chained-call mutant that neither the 20-row external matrix nor the 25 in-gate mutants contained. **THIRD ROUND (UC-05..UC-09), and the reason this row now reads the way it does.** **UC-05**: `occurrence_count` compared whitespace-delimited fields to `verify-blob`, found one, and concluded **singularity** — when all it had established is that it did not find a second. `cosign "verify-blob"`, `cosign 'verify-blob'` and `cosign verify-blob""` are the same command to the shell, and each hid a chained unpinned call from the count. Measured against the round-2 gate on **all three** files at whole-gate level: **rc=0, rc=0, rc=0** — worse than first reported, because `A && B` short-circuits and `set -e` does **not** fire on a non-final member of an AND-list, so even the two shell scripts' runtime twin missed it. Closed by stripping shell quotes before the field compare, which is **a spelling patch, not a terminator, and is labelled as one in the code**. A structural terminator was sought and **ruled out with evidence**: refusing any graded line carrying a command separator would red the REAL files, since `hack/install.sh` and `hack/release/verify-artifacts.sh` both legitimately end their genuine invocation with an or-else `die` tail. **No structural terminator exists for this gate**, so completeness is not available and must not be claimed. **UC-07 is therefore the durable fix, and it is a change of posture rather than of logic.** The `PASS:` banner was printed unconditionally and asserted "EVERY cosign verify-blob OCCURRENCE ... is pinned" plus "a second unpinned call reddens whether it sits on its own line or is chained onto a pinned one" — a **universal claim bound to no assertion**. Under UC-05 that banner did not merely overstate: on a green run it printed something **false**, which is strictly worse than printing nothing, and it is this repo's #1 defect class (an assertion that cannot fail) wearing a different hat. The banner now reports **OBSERVED** counts per file (occurrences found, classified-and-graded, prose-exempt, refused), lists **ASSERTED** properties each of which is shown to fail on a mutant, and states the **NOT ASSERTED** residual in the same breath: this gate finds calls by a literal string and counts quote-stripped words, so a call spelled through a variable, `eval`, or fragments is not seen and not graded, and the counts are what was classified — **not a proof that nothing else exists**. When a fifth spelling turns up, the gate is then **incomplete rather than wrong**, and incomplete is recoverable. **UC-06**: a TRAILING comment mentioning `verify-blob` fired `MULTI-OCCURRENCE: … has 2 verify-blob calls chained on ONE line` — fail-closed but **false as printed**, since `cosign_candidates` only drops lines whose FIRST non-space character is `#`. That is the UC-03 misdiagnosis shape recurring **inside the UC-01 fix**. The message now says TOKENS, names both possible causes, and names the correct repair; excluding trailing comments was rejected as it needs quote-aware parsing, which is the machinery that produced UC-01/02/03. **UC-08**: `shellcheck` SC1087 ×2 (error severity) on `flag_value_tokens` — `"$flag[[:space:]]…"` parses as an array subscript; `${flag}` silences it. Cosmetic: no shellcheck gate exists in this repo. **UC-09**: two stage-count figures reported during this lane ("25", then "28") were **both wrong** and neither came from a committed file — they counted `task: [` lines in a run LOG, which includes nested task invocations. Measured: the Taskfile `check:` block has **21** `- task:` entries and `CHECK_STAGES` has **21** stage names; they agree, and both files are byte-identical to `origin/main`. There is no stage-count mismatch and this lane could not have caused one. **THE PATTERN, recorded because it is the lane's most transferable output:** four P1s, three of them the same scope error at successively finer scopes — file (`has_flag`), line (round 1), then occurrence-spelling (round 2) — each found by review and none by the author's own mutant matrix, because each matrix was built from the shape the previous round had just learned. The general lesson is not "add another spelling": it is that **when a gate's denominator cannot be made provably complete, the gate must report what it classified instead of asserting what exists.** That is now enforced where it is hardest to ignore, in the banner the gate prints on every green run. Revert: restore `has_flag`, drop the per-occurrence grading and the per-invocation value comparison, and restore the two positive-only stub-log greps — which returns the gate to certifying that *some* cosign call in each file is pinned, a property that is compatible with an unpinned one sitting beside it. |
diff --git a/hack/lib/pr_reach.sh b/hack/lib/pr_reach.sh
index e688d475..e048eb17 100644
--- a/hack/lib/pr_reach.sh
+++ b/hack/lib/pr_reach.sh
@@ -67,19 +67,47 @@
 #
 # So the bound is stated here rather than discovered in a sixth round.
 #
-# READS: block mappings at any indent; block sequences whether their items are
-# indented under the key or written FLUSH with it; inline flow SEQUENCES;
-# quoted scalars; CRLF line endings.
+# READS (the FILTER reader, `assent_pr_reach`, unless noted — the STEP reader's
+# bounds differ and are listed separately below):
+# block mappings at any indent; block sequences whether their items are
+# indented under the key or written FLUSH with it; inline flow SEQUENCES,
+# including ones spread over several lines (G6-02 — an earlier version of this
+# header listed those under DOES NOT READ "(refused)", and that was wrong twice
+# over: they are read, and the six shapes measured — `branches:`/`types:`/
+# `branches-ignore:` in both polarities — all graded correctly, because the
+# value region is bounded by indentation and a continuation line more indented
+# than its key is simply part of the value. No general guarantee is claimed for
+# them beyond those six; they are listed here because "refused" was false, not
+# because correctness has been proved); quoted scalars; CRLF line endings.
 # REFUSES (distinct code, never a guess): flow MAPPINGS, anchors, aliases,
 # merge keys, filter keys outside GitHub's five, and — on the one
-# must-NOT-contain test — any token carrying a byte outside the ref/glob set.
-# DOES NOT READ: multi-line flow sequences (refused); `strategy:`/matrix,
-# reusable-workflow `uses:` jobs and container entrypoints in the step reader;
-# and a QUOTED SCALAR's interior — `,` and whitespace are separators here even
-# inside quotes, so `branches: ["main,next"]` is shredded into `main` + `next`
-# and grades 0 though it excludes main (G5-03, measured, unfixed on purpose:
-# see the claim below, which is now written to match the code rather than the
-# other way round).
+# must-NOT-contain test — any token carrying a byte outside the ref/glob set,
+# or any token carrying a glob metacharacter.
+# DOES NOT READ:
+#   * `strategy:`/matrix, reusable-workflow `uses:` jobs and container
+#     entrypoints, in the step reader.
+#   * a QUOTED SCALAR's interior — `,` and whitespace are separators here even
+#     inside quotes, so `branches: ["main,next"]` is shredded into `main` +
+#     `next` and grades 0 though it excludes main (G5-03, measured, unfixed on
+#     purpose; the claim below is written to match the code rather than the
+#     other way round).
+#   * a step whose `- ` marker is followed by MORE THAN ONE SPACE, when the
+#     disarm key is spelled non-bare (G6-01). `_assent_step_keys` derives the
+#     key indent from the marker with `match($0, /^[ ]*- /)`, which matches
+#     exactly one space, so `      -   if : ${{ false }}` yields 8 while the
+#     keys sit at 10; the enumeration visits nothing, `?unreadable` never
+#     fires, and `assent_step_wired` returns 0 — WIRED — for a step carrying
+#     release-exitgate's own push-only guard. Ruby/psych resolves that mutant
+#     to `if: "${{ … }}"`, so it is valid YAML with nothing for actionlint to
+#     flag. Measured (both this tip and 01b2322, so the shape predates the
+#     normalisation work and survives it):
+#         '      -   ' + 'if : ${{ false }}'  -> 0   (want 8)
+#         '      -  '  + 'if : ${{ false }}'  -> 0   (want 8)
+#         '      -   ' + '"if": false'        -> 0   (want 8)
+#         '      -   ' + 'if: false'          -> 8   (bare: the literal grep
+#                                                     still catches it)
+#     Reproduce: source this file and call
+#     `assent_step_wired <that-workflow> verify <script> <tmpdir>`.
 #
 # THE SAFETY CLAIM, NARROWED TO WHAT IS TRUE (G5-04). An earlier version of
 # this header said "unknown shapes cost false reds, not silent passes". That
@@ -87,10 +115,20 @@
 # surface listed as READ — which is worse than a documented hole, because the
 # next author trusts the sentence. What actually holds:
 #
-#   * A misread that DROPS or MANGLES a token yields a RED on every
-#     must-CONTAIN test (`types:`, `branches:`), and on the one
-#     must-NOT-contain test (`branches-ignore:`) an unreadable token is
-#     REFUSED rather than searched. That direction is closed by construction.
+#   * On every must-CONTAIN test (`types:`, `branches:`) a misread that DROPS
+#     or MANGLES a token yields a RED — including a misread that drops the set
+#     ENTIRELY, since an empty set cannot contain the required token (measured:
+#     empty -> 13). That direction is closed by construction.
+#   * On the one must-NOT-contain test (`branches-ignore:`) only a token that is
+#     PRESENT and unreadable, or present and a glob, is refused. A misread that
+#     drops the token set entirely is NOT covered, and the phrase "never a
+#     silent accept, by construction" that used to sit here was false: an empty
+#     set passes `_assent_tokens_readable`, passes `_assent_tokens_globfree`,
+#     and passes `grep -qx main`, so the consumer falls through to 0 (measured,
+#     all three). This is G6-01's lesson on the filter layer — an enumeration
+#     that visits nothing yields an empty set, and an empty set satisfies every
+#     must-NOT-contain check. No total-drop defect is known here today; the
+#     point is that the construction does not rule one out.
 #   * A misread that CREATES a token is NOT covered: shredding a quoted scalar
 #     manufactures `main` out of `"main,next"` and yields a silent 0.
 #   * Un-evaluability is not a misread at all. A glob tokenises perfectly and
@@ -98,10 +136,23 @@
 #     `branches:` by polarity, and on `branches-ignore:` only because it is now
 #     refused explicitly (G5-01).
 #
-# So: the reader fails closed against dropped and mangled tokens, and against
-# shapes it refuses. It does not claim immunity against a misread that
-# fabricates a token. An honest narrow gate beats an overreaching one, and an
-# honestly narrow CLAIM beats a reassuring one.
+# Those three bullets are about the FILTER layer (`assent_pr_reach`) and its
+# tokens. The STEP layer (`assent_step_wired`) has its own bound and it is not
+# the same one: its key enumeration derives an indent from the `- ` marker
+# width, and a marker followed by more than one space moves the keys outside
+# the enumerated indent, where a non-bare disarm key is SKIPPED — not
+# normalised, not refused (G6-01, above, with measurements).
+#
+# So, precisely and no wider: the filter layer fails closed against dropped and
+# mangled tokens on the must-CONTAIN tests and against the shapes it refuses; on
+# the must-NOT-contain test it fails closed against a MANGLED or GLOB token but
+# not against a wholly dropped set; and it does not claim immunity against a
+# misread that fabricates a token. The step layer catches bare disarm
+# spellings at any indent, and non-bare spellings at the indent its enumeration
+# visits — and nothing outside that intersection. Neither layer claims to be a
+# YAML parser. An honest narrow gate beats an overreaching one, and an honestly
+# narrow CLAIM beats a reassuring one — this header has now been wrong in the
+# reassuring direction twice, which is the reason it is worded like this.
 
 # The three PR-visible text gates, single-sourced so each can cross-pin the
 # others (D-157 residual 2: before this, each gate pinned only its OWN step, so
@@ -266,9 +317,18 @@ _assent_tokens_globfree() {
 #
 # The immune design was already in this file: `assent_pr_reach` normalises and
 # ALLOWLISTS the filter keys, and is measurably immune to every one of those
-# spellings. This mirrors it. Normalisation — not pattern breadth — is what
-# makes it immune, and anything normalisation cannot reduce to an identifier is
-# refused rather than skipped, so the unknown-spelling direction costs a red.
+# spellings. This mirrors it, and normalisation — not pattern breadth — is what
+# makes it work on the lines it is given.
+#
+# THE BOUND, stated because an earlier version of this comment claimed the
+# opposite (G6-01): a key this function VISITS and cannot reduce to an
+# identifier is printed `?unreadable`, and the caller refuses it. But a key it
+# never visits is neither normalised nor refused — it is SKIPPED. `_assent_map_keys`
+# only ever looks at lines whose indent equals <indent>, and for a step that
+# indent is derived from the `- ` marker width, so a wider marker puts every
+# key out of reach. "Anything normalisation cannot reduce to an identifier is
+# refused" was false: it holds for what is enumerated, and says nothing about
+# what is not.
 _assent_map_keys() {
   awk -v want="$2" '
     { if ($0 ~ /^[[:space:]]*$/ || $0 ~ /^[[:space:]]*#/) next
@@ -628,8 +688,15 @@ assent_step_wired() {
   # NAME (G5-02) rather than by literal pattern, so `if : `, `"if":` and
   # `'if' :` — which a conformant parser resolves identically to `if:` — cannot
   # walk past it. The literal greps are kept BESIDE the allowlist, not replaced
-  # by it: their union can only add detections, and they still catch a key at an
-  # indent the enumeration does not visit.
+  # by it, so a detection from either is a detection.
+  #
+  # WHAT THE UNION DOES NOT COVER (G6-01 — an earlier version of this comment
+  # claimed it did): the literal greps catch a BARE spelling at any indent; the
+  # allowlist catches a NON-BARE spelling at an indent the enumeration visits.
+  # A non-bare spelling at an indent it does not visit falls between them and is
+  # skipped. That intersection is reachable at step level, where the enumerated
+  # indent is derived from the `- ` marker width — see DOES NOT READ in the
+  # header for the measured shapes.
   local jobkeys="$work/step_wired.jobkeys"
   _assent_map_keys "$jb" 4 >"$jobkeys"
   if grep -qx '?unreadable' "$jobkeys"; then

From 9d298d54519ae51f245c846e02cc18ad6d47071f Mon Sep 17 00:00:00 2001
From: Konrad Heimel <konrad.heimel@gmail.com>
Date: Mon, 24 Aug 2026 00:04:34 +0200
Subject: [PATCH 8/8] :memo: docs(ci): withdraw the third copy of the retracted
 claim (D-157)

R7-01. The same sentence was withdrawn in D-157 and in the header, and
left standing a third time inside _assent_tokens_readable's own doc
comment - the function whose burden inversion it exists to justify, and
the one a reader lands on without seeing the header 140 lines up. It now
says a defect that MANGLES a token yields a red or a refusal, and states
plainly that a defect dropping the token set ENTIRELY is not covered,
with a pointer to the header bullet carrying the measurements.

Free while here, neither blocking:

R7-02 - the comment claimed assent_pr_reach "normalises and ALLOWLISTS"
the filter keys. It allowlists and refuses non-matches; it does not
normalise. The immunity claim is true and measured (paths : / "paths": /
'paths' : / "types" : all refuse at 10), only the mechanism description
was loose. Both sites grade a structure rather than a spelling; the
mechanisms differ and the comment now says so.

R7-03 - "Every function returns a distinct numeric code and prints
NOTHING" was literally false: five internal helpers print to stdout by
design, which is how they compose. Narrowed to the two grading entry
points, with the property that actually matters stated separately - no
function here emits a finding or writes to stderr (verified: zero
occurrences of >&2 in the file).

Executable surface byte-identical to 8e76336: comment- and blank-
stripped renderings have the same md5.

Also adds backlog row GATES3-F01 for a drift found by the same review
and deliberately NOT fixed here - hack/audit/README.md:214 publishes the
AUD2 control floor as "38 full, 32 text-only" while the code says 57/51.
That file is outside this lane's fence, and quietly correcting a
published number is the same species as the drift.
---
 CHANGELOG.md              |  2 ++
 hack/lib/pr_reach.sh      | 28 +++++++++++++++++++++-------
 openspec/specs/backlog.md |  2 +-
 3 files changed, 24 insertions(+), 8 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index c8d4f2e8..9f6c95f6 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -95,6 +95,7 @@ repository still gets a decision, never by following the link; no release carrie
 - :memo: docs(ci): D-159 recorded a residual that does not exist (ORPH-01..04)
 - :memo: docs(release): correct the residual the gate documents (R3-01)
 - :memo: docs(ci): withdraw three falsifiable claims from the PR-reach reader (D-157)
+- :memo: docs(ci): withdraw the third copy of the retracted claim (D-157)
 
 ### Features
 - :sparkles: feat(audit): measure REL-03/REL-07 by real mutation run, not by name
@@ -110,6 +111,7 @@ repository still gets a decision, never by following the link; no release carrie
 - :bug: fix(ci): run the -count=1 wiring pin in the PR-visible verify job
 - :bug: fix(ci): pin COUNT1-F01 and refuse a merged gate step
 - :bug: fix(ci): bump golangci-lint to v2.13.1 for Go 1.27 (D-158)
+- :bug: fix(ci): close two PR-reach fail-opens the review found end-to-end (D-157)
 - :bug: fix(ci): read flush block sequences and whole branch names (D-157)
 - :bug: fix(ci): strip CR, and close the one fail-open direction by construction (D-157)
 - :bug: fix(ci): refuse globs on branches-ignore, grade disarm keys by name (D-157)
diff --git a/hack/lib/pr_reach.sh b/hack/lib/pr_reach.sh
index e048eb17..2f7edb4f 100644
--- a/hack/lib/pr_reach.sh
+++ b/hack/lib/pr_reach.sh
@@ -31,8 +31,11 @@
 # satisfied by a mere comment (it still went red, but with the wrong finding —
 # "WITH ARGUMENTS" for a step whose command had been commented out).
 #
-# CONTRACT: this file is SOURCED, never executed. Every function returns a
-# distinct numeric code and prints NOTHING. The caller owns the wording,
+# CONTRACT: this file is SOURCED, never executed. The two GRADING entry points
+# (`assent_pr_reach`, `assent_step_wired`) return a distinct numeric code and
+# print nothing at all; the internal helpers print their results to stdout by
+# design, which is how they are composed. No function here emits a FINDING or
+# writes to stderr. The caller owns the wording,
 # because each caller's mutation controls pin their own stderr fragments.
 #
 # PORTABILITY RULES, inherited from hack/lint/workflow_pins_test.sh's preamble
@@ -258,8 +261,16 @@ _assent_yaml_tokens() {
 #
 # So the burden is inverted exactly there: a token carrying any byte outside the
 # git-ref/glob set is not graded at all, it is REFUSED. A future tokenizer
-# defect on that key can then yield a red or a refusal, never a silent accept —
-# by construction rather than by enumeration.
+# defect on that key THAT MANGLES A TOKEN can then yield a red or a refusal
+# rather than a silent accept.
+#
+# NOT a defect that drops the token set ENTIRELY, and the unqualified "never a
+# silent accept — by construction" that used to end this paragraph was false
+# (G6-03). An empty set passes this check, passes _assent_tokens_globfree and
+# passes `grep -qx main`, so the consumer falls through to 0. See the
+# must-NOT-contain bullet in the header for the measurements. No total-drop
+# defect is known on this key today — what is withdrawn is the claim that the
+# construction rules one out.
 # The set: what a git ref name or a glob can be built from, plus `#`. The `#`
 # is not an oversight — this key alone passes strip=0 (G3-04), so ordinary
 # comment text is EXPECTED to survive into its tokens and is not evidence of a
@@ -315,9 +326,12 @@ _assent_tokens_globfree() {
 # argument-free and undisarmed". Adding `[[:space:]]*:` would have been the
 # fifth spelling patch on this lane and would still miss the sixth.
 #
-# The immune design was already in this file: `assent_pr_reach` normalises and
-# ALLOWLISTS the filter keys, and is measurably immune to every one of those
-# spellings. This mirrors it, and normalisation — not pattern breadth — is what
+# The immune design was already in this file: `assent_pr_reach` ALLOWLISTS the
+# filter keys — it greps each sub-block key against the five GitHub defines and
+# REFUSES anything else, so `paths : `, `"paths":`, `'paths' :` and `"types" :`
+# all land on the refusal (measured: rc=10). It does not normalise; the
+# immunity there comes from refusing non-matches, and here from normalising.
+# Both are "grade a structure, not a spelling"; the mechanisms differ. This mirrors it, and normalisation — not pattern breadth — is what
 # makes it work on the lines it is given.
 #
 # THE BOUND, stated because an earlier version of this comment claimed the
diff --git a/openspec/specs/backlog.md b/openspec/specs/backlog.md
index 9c4661de..dabc9596 100644
--- a/openspec/specs/backlog.md
+++ b/openspec/specs/backlog.md
@@ -750,12 +750,12 @@ that claim).
 | AUD2-F01 | **DONE** — SEC-03's twin: `hack/release/verify-artifacts.sh:124` ran the same **unpinned** `cosign verify-blob --bundle` on the maintainer/CI path; `verify_cosign()` now pins the D-153 issuer/identity pair and `hack/release/install_cosign_pin_test.sh` grades it as the **third** file of the one drift gate | **[autonomous]** | AUD2-S03 (D-153's value) | found *by* S03, deliberately left alone there — not an owned path, and out of that story's stated scope |
 | COUNT1-F01 | Two `go test` cache blind spots left inside `task test` / `task coverage` (`./...` and `./internal/...`): `internal/schemadrift` compares local `schemas/` against `git show origin/main:…` in a **subprocess**, and `internal/provider/isolation_test.go:29` `go build`s `./testdata/maliciousexec` at runtime | **[autonomous]** | — | found *by* the `-count=1` lane, deliberately left alone there: fixing them means carving packages out of `test`/`coverage` and losing an otherwise-honest whole-tree cache |
 | GATES3 | **DONE** (D-157) — the three PR-visible text gates (`hack/lint/workflow_pins_test.sh`, `hack/audit/aud2_exitgate_test.sh`, `hack/examples/dogfood_wiring_test.sh`) now share `hack/lib/pr_reach.sh`: PR reach is graded structurally (a `paths:`/`paths-ignore:`/narrowing-`types:`/main-excluding-branch filter, a `pull_request:` nested under another key, or a job-level `if:`/`needs:` all red), each gate **cross-pins the other two's steps**, and aud2's fixed-string step check is replaced by the anchored `run:`-command form. Independent review then found two P1s by mutating the REAL `verify.yaml` end-to-end (both fixed here): the filter greps were pinned to **exactly four spaces**, so a 6-space `paths:` — valid YAML, identical mapping — made all three gates green on the very shape the lane closes; and the step disarm grep lacked the sequence-item alternative, so `      - if: …` as a step's **first** key graded WIRED (that regex was inherited from `main`, not introduced). Two further review rounds each found one more P1 **in the previous round's fix**: a block sequence written FLUSH with its key was misgraded and the new key allowlist turned one such legitimate case into a red, and branch names were tokenised on `-`/`/` so `branches: [main-next]` yielded a `main` token and a main-EXCLUDING filter reported "runs on every PR"; then a stray **CR** on one sequence item made the same key report the same thing again. Five P1s total, three of them introduced by a fix — all one family: a line-oriented reader inferring YAML structure from indentation and character classes. Closed at the **class** level for the one direction that can fail open (`branches-ignore:`, the reader's only must-NOT-contain test): a token carrying a byte outside the ref/glob set is now REFUSED rather than searched, so a future tokenizer defect there yields a red or a refusal, never a silent accept. A real YAML parse was evaluated and rejected on measured evidence — see D-157 | **[autonomous]** | — | three reviewer-demonstrated residuals, all in the same three files, all deliberately left unfixed on their own lanes because fixing one of three identical checks would have been misleading |
+| GATES3-F01 | `hack/audit/README.md:214` publishes the AUD2 control floor as **"38 full, 32 text-only"**; the code says **57 / 51** (`hack/audit/aud2_exitgate_test.sh:2410`). The published number stopped matching the gate when D-157 raised the floor twice, and it was already stale before that (last touched in `cc25f20`) | **[autonomous]** | — | found *by* the GATES3 lane's final review, deliberately NOT fixed there: `hack/audit/README.md` is outside that lane's fence, and a silent edit to a published number is the same D-124 species as the drift itself — a doc claim nothing grades. Worth a row that also asks whether the floor should be asserted against the README rather than restated in it |
 | CI-TOOLCHAIN | **DONE (D-158)** — `verify` was red on **every** PR, including a six-file Markdown diff with zero Go bytes, because `go-version: stable` rolled Go 1.26 → 1.27.0 while `GOLANGCI_LINT_VERSION` sat at `v2.12.2` (built with go1.26.x, so its `go/types` cannot read the 1.27 stdlib); pin bumped to `v2.13.1`, whose "go1.27 support" commit and `go 1.26.0` go.mod directive make it the first release that can | **[autonomous]** | — | not owned by any in-flight lane — the pin is a CI-only workflow env var, and the break blocked all of them |
 | ORPHAN | **DONE (D-159)** — `Taskfile.yml`'s `release-verify-test`, the only test of `hack/release/verify-artifacts.sh` (the procedure **`SECURITY.md:61` publishes to release consumers**), was invoked by nothing: absent from `check:`, from `CHECK_STAGES`, and from every workflow — D-124's "a gate invoked by nothing is not a gate", one epic on from AUD2-F01's published-instructions-rot finding. It was **green**, so the defect was wiring only. Now the 14th of 21 `check:` stages, in its three **offline** modes (`negative`, `cosign-skip-when-absent`, `readme` = REQ-E9-S12-02/03/04); the `all` default is deliberately NOT wired — it shells out to `task release-snapshot`, i.e. a networked `go install goreleaser`, a `go mod tidy` before-hook that rewrites tracked files mid-check, and `--clean` on `dist/`. **Not a gap to fill: REQ-E9-S12-01 (snapshot → verify round trip) is already automated** — `hack/release/exitgate_test.sh:33-34` runs exactly `task release-snapshot` then `task release-verify`, the spec's own `Verify:` string, in the `release-exitgate` job. It is push-only (`if: github.event_name != 'pull_request'`), so the exposure is **RELSE-08 visibility, not absence**; do NOT open a lane to build a gate that exists. `CHECK_STAGES` 20 → 21 in the same commit; body pinned **per mode** so dropping two modes or reverting to the bare default reds | **[autonomous]** | — | not owned by any in-flight lane; `Taskfile.yml` + `hack/audit/exitgate_test.sh` are the one `CHECK_STAGES` slot, which only one lane may hold at a time |
 | CI-TOOLCHAIN-F01 | The linter/toolchain coupling has **no early detector**: dependabot's `github-actions` ecosystem updates `uses:` refs, not `env:` literals, so `GOLANGCI_LINT_VERSION` rots silently until the next Go minor reds every PR at once (~6-monthly). Candidate: a text gate comparing the pinned linter release's go.mod `go 1.N` directive against the toolchain CI resolves, or an updater that watches the literal | **[autonomous]** | D-158 | deliberately out of scope of the fix lane: three lanes were parked behind it, and a new gate belongs with `hack/lint/**`, which was owned by a concurrent lane |
 | BASH32-F01 | **DONE** — three `hack/**` gate scripts used bash 4+ features with no version guard; under stock macOS `/bin/bash` 3.2 `hack/docs/truthlag_pins_test.sh` died at its `declare -A`, skipped its final `OK:` banner and **exited 0**, so `task docs-gates` (and `task check`) read a gate that certified almost nothing as green. Fixed by a shared, per-script-parameterised `hack/lib/require-bash.sh` floor (4.0 / 4.0 / 4.4), enforced by a new `hack/lint/bash_version_guard_test.sh` wired as `task check` stage 20 (D-154) | **[autonomous]** | — | found *by* the AUD2 wave's macOS runs, not by any audit: CI is ubuntu/bash 5, so the hole is LOCAL-only and no CI lane could have surfaced it |
 | UNIV-COSIGN | **DONE (D-160)** — `hack/release/install_cosign_pin_test.sh` graded the D-153 signer pin **existentially** ("*some* `cosign verify-blob` in this file is pinned") where the published guarantee is **universal**, so a **second, unpinned** invocation passed: measured before the fix on scratch copies of all three graded files, rc=**0**/**0**/**0**. `has_flag` grepped the whole folded extraction so a pinned sibling satisfied it, `one_value`'s `sort -u` collapsed the agreeing values, §0 printed the invocation count without asserting it, and 4b/5d's stub-log greps were positive-only — the same shape at runtime. `SECURITY.md` had **no invocation-level grading at all**, only the drift comparison. Closed by one predicate (`pin_violations`) applied to **every** invocation in **all three** files plus its runtime twin, with fail-CLOSED classification of anything it cannot place, mutation-proven by eight mutants per file chosen for **branch** coverage (second-unpinned / second-pinned / off-command-position / no-candidates / fold-broken / no-invocations / empty-identity-regexp / foreign-issuer) plus a prose-exemption control. The check compares each invocation's **value** against SECURITY.md's published pair, not just flag presence: `--certificate-identity-regexp ''` carries the flag, matches every Fulcio identity, and slips past `one_value`'s `sort -u` because an empty capture is not a line. **CORRECTION TO THE RECORDED REMEDY — do not implement it:** the filed remedy "assert the extracted invocation count is exactly 1 per graded file" is **factually wrong and would red `main` on landing**, because `SECURITY.md` legitimately publishes **two** invocations (`SECURITY.md:86` over the archive and `:93` over `checksums.txt`, which is what covers the SBOMs listed inside it). The property is universal, not a count. **Second round (UC-01..UC-04), caught by independent review:** the first fix reproduced the same existential defect one scope down — per **line** instead of per **file** — so an unpinned call CHAINED onto a pinned one (`&&`, `;`, a pipe, or backslash-folded) passed, and the **full gate exited 0** on `SECURITY.md`, which has no runtime twin. Closed by per-**occurrence** grading (`MULTI-OCCURRENCE`), by comparing **every** value of every flag rather than the greedy-last (an empty regexp placed first was masked by a correct one placed second), and by diagnosing quote style separately (`UNQUOTED-VALUE`) so a correctly pinned double-quoted call is accepted instead of being refused with a false "empty regexp" reason. **Third round (UC-05..UC-09):** `occurrence_count` read *absence of a second token* as *proof of singularity*, so `cosign "verify-blob"` / `cosign 'verify-blob'` / `cosign verify-blob""` hid a chained unpinned call — **rc=0 on all three files at whole-gate level** against the round-2 gate (`A && B` short-circuits, so `set -e` never fires and even the runtime twin missed it). Fixed by stripping shell quotes before the compare, **explicitly a spelling patch, not a terminator**: a structural terminator was ruled out with evidence, because both scripts legitimately end their real invocation with an or-else `die` tail, so separator-based refusal would red the real files. Since completeness is unavailable, **the `PASS:` banner no longer claims it** — it now reports OBSERVED counts per file, lists only ASSERTED properties (each mutation-proven), and states the NOT-ASSERTED residual in the same breath, so an unknown fifth spelling leaves the gate *incomplete* rather than *wrong*. **R3-01, found by review in the very paragraph that added that banner:** the backticked-mention exemption keys on the substring appearing **anywhere on the line** and is tested first, so a line carrying a backticked mention AND live calls is exempted — `pin_violations` empty, whole gate rc=0. Not patched (narrowing it needs the markdown/quote parsing that produced UC-01/02/03); **disclosed as the FIRST and most reachable residual in the banner**, with exempted lines no longer described as "prose". Also: MULTI-OCCURRENCE now says TOKENS and names trailing comments as a cause (it was false as printed), and SC1087 silenced | **[autonomous]** | AUD2-F01, D-153 (the pinned value) | demonstrated by a reviewer *on* the AUD2-F01 lane and out of its scope — F01 added a third graded file to a gate whose quantifier was already wrong, so fixing the quantifier is a change to the checker, not to any checked file (all three are byte-unchanged) |
-| GATES3 | **DONE** (D-157) — the three PR-visible text gates (`hack/lint/workflow_pins_test.sh`, `hack/audit/aud2_exitgate_test.sh`, `hack/examples/dogfood_wiring_test.sh`) now share `hack/lib/pr_reach.sh`: PR reach is graded structurally (a `paths:`/`paths-ignore:`/narrowing-`types:`/main-excluding-branch filter, a `pull_request:` nested under another key, or a job-level `if:`/`needs:` all red), each gate **cross-pins the other two's steps**, and aud2's fixed-string step check is replaced by the anchored `run:`-command form. Independent review then found two P1s by mutating the REAL `verify.yaml` end-to-end (both fixed here): the filter greps were pinned to **exactly four spaces**, so a 6-space `paths:` — valid YAML, identical mapping — made all three gates green on the very shape the lane closes; and the step disarm grep lacked the sequence-item alternative, so `      - if: …` as a step's **first** key graded WIRED (that regex was inherited from `main`, not introduced) | **[autonomous]** | — | three reviewer-demonstrated residuals, all in the same three files, all deliberately left unfixed on their own lanes because fixing one of three identical checks would have been misleading |
 
 Sizing, from the S03 implementer's reading of the call site: `verify_cosign()`
 (`hack/release/verify-artifacts.sh:118–125`) has the byte-identical unpinned