fix(ci): own failed checks by workflow run

Makefile

@@ -1,4 +1,4 @@
-.PHONY: build test lint skill
+.PHONY: build test lint skill release-validation
 
 build:
 	go build ./...
@@ -11,3 +11,11 @@ lint:
 
 skill:
 	go run ./cmd/genskill
+
+release-validation:
+	GIT_CONFIG_COUNT=1 GIT_CONFIG_KEY_0=commit.gpgsign GIT_CONFIG_VALUE_0=false go test -race -shuffle=on -count=1 ./...
+	@if test -n "$$MADE_GITHUB_SMOKE_REPO" && test -n "$$MADE_GITHUB_SMOKE_PR_URL"; then \
+		GIT_CONFIG_COUNT=1 GIT_CONFIG_KEY_0=commit.gpgsign GIT_CONFIG_VALUE_0=false go test -race -shuffle=on -count=1 ./internal/github -run '^TestLive_CIWorkflowOwnershipSmoke$$' -v; \
+	else \
+		echo 'release-validation: GitHub smoke skipped; set MADE_GITHUB_SMOKE_REPO and MADE_GITHUB_SMOKE_PR_URL'; \
+	fi

README.md

@@ -8,6 +8,14 @@ made is an independent synthesis, not a dependency bundle or a one-to-one copy o
 
 See `plans/made-rewrite.md` for the full design and build plan.
 
+CI check policy
+
+The trusted `.made.yml` copy may set `ci.check_scope` to `required` or `all`; the default is `required`.
+`ci.rerun_budget` counts rerun rounds, not individual checks.
+Made polls pending checks without spending a round, reruns each unique failed GitHub Actions workflow run only, and reports bounded evidence by failed check and run.
+External checks are reported by name and link and are never rerun.
+The opt-in disposable-repository smoke contract is `MADE_GITHUB_SMOKE_REPO` plus `MADE_GITHUB_SMOKE_PR_URL`, and `make release-validation` runs it when both are set.
+
 ## Versioned daemon contract
 
 `made capabilities --json` reports the public protocol and command schema.

internal/config/config.go

@@ -1,33 +1,18 @@
 package config
 
 import (
-	"bytes"
-	"errors"
 	"fmt"
-	"io"
-	"os"
-	"path/filepath"
-	"strings"
 	"time"
 
 	"github.com/douglasjarquin/made/internal/agent"
-	"gopkg.in/yaml.v3"
+	"github.com/douglasjarquin/made/internal/github"
 )
 
 const (
-	defaultCIRerunBudget     = 2
 	defaultStageTimeout      = 30 * time.Minute
-	maxStageTimeoutSeconds   = 2 * 60 * 60
 	defaultEvidenceRetention = 4 << 20
-	maxEvidenceRetention     = 64 << 20
-	maxConfigBytes           = 1 << 20
 )
 
-var validStageNames = map[string]struct{}{
-	"intent": {}, "rebase": {}, "review": {}, "test": {}, "document": {},
-	"lint": {}, "push": {}, "pr": {}, "ci": {},
-}
-
 type Config struct {
 	Version                int              `yaml:"version"`
 	Document               Document         `yaml:"document"`
@@ -99,8 +84,9 @@ type Review struct {
 }
 
 type CI struct {
-	Required    bool `yaml:"required"`
-	RerunBudget int  `yaml:"rerun_budget"`
+	Required    bool              `yaml:"required"`
+	RerunBudget int               `yaml:"rerun_budget"`
+	CheckScope  github.CheckScope `yaml:"check_scope"`
 }
 
 type Test struct {
@@ -119,55 +105,6 @@ type Commands struct {
 	Lint string `yaml:"lint"`
 }
 
-// LoadEffectiveConfig resolves a gate run's effective configuration from a
-// trusted source (the default-branch copy) and a pushed source (the branch
-// being validated). trustedPath or pushedPath may be "" to indicate that
-// source has no config at all.
-func LoadEffectiveConfig(trustedPath, pushedPath string) (Config, error) {
-	trusted, trustedExists, err := loadConfigFile(trustedPath)
-	if err != nil {
-		return Config{}, fmt.Errorf("config: trusted copy at %q could not be read: %w", trustedPath, err)
-	}
-
-	pushed, _, err := loadConfigFile(pushedPath)
-	if err != nil {
-		return Config{}, fmt.Errorf("config: pushed copy at %q could not be read: %w", pushedPath, err)
-	}
-
-	effective := Config{
-		Version:                trusted.Version,
-		Document:               trusted.Document,
-		Review:                 trusted.Review,
-		DisableProjectSettings: trusted.DisableProjectSettings,
-		NoCI:                   trusted.NoCI,
-		CI:                     trusted.CI,
-		AllowRepoCommands:      trusted.AllowRepoCommands,
-		Stages:                 trusted.Stages,
-	}
-	effective.Test.Evidence = trusted.Test.Evidence
-
-	if effective.CI.RerunBudget == 0 {
-		effective.CI.RerunBudget = defaultCIRerunBudget
-	}
-
-	// Trust boundary: Commands/Agent/Agents execute inside the gate worktree,
-	// so a pushed branch must never control them unless the trusted copy
-	// itself opted in via allow_repo_commands. Absence of a trusted copy
-	// (trustedExists == false) always resolves these to zero-value; it must
-	// never fall through to the pushed copy.
-	if trustedExists && trusted.AllowRepoCommands {
-		effective.Commands = pushed.Commands
-		effective.Agent = pushed.Agent
-		effective.Agents = pushed.Agents
-	} else {
-		effective.Commands = trusted.Commands
-		effective.Agent = trusted.Agent
-		effective.Agents = trusted.Agents
-	}
-
-	return effective, nil
-}
-
 func (c Config) TestCommand() []string {
 	return shellCommand(c.Commands.Test)
 }
@@ -193,93 +130,3 @@ func (c Config) AgentKind() (agent.Kind, error) {
 		return "", fmt.Errorf("config: invalid agent %q: must be %q or %q", c.Agent, agent.KindClaude, agent.KindCodex)
 	}
 }
-
-func loadConfigFile(path string) (cfg Config, exists bool, err error) {
-	if path == "" {
-		return Config{}, false, nil
-	}
-
-	data, exists, err := readConfigBytes(path, nil)
-	if err != nil {
-		return Config{}, exists, err
-	}
-	if !exists {
-		return Config{}, false, nil
-	}
-
-	decoder := yaml.NewDecoder(bytes.NewReader(data))
-	decoder.KnownFields(true)
-	if err := decoder.Decode(&cfg); err != nil {
-		return Config{}, true, err
-	}
-	var extra any
-	if err := decoder.Decode(&extra); err != io.EOF {
-		if err == nil {
-			return Config{}, true, fmt.Errorf("configuration must contain one YAML document")
-		}
-		return Config{}, true, err
-	}
-	if filepath.Base(path) == ".made.yml" || strings.HasSuffix(filepath.Base(path), ".made.yml") {
-		if cfg.Version != 1 {
-			return Config{}, true, fmt.Errorf("versioned .made.yml requires version: 1, got %d", cfg.Version)
-		}
-		for name := range cfg.Stages {
-			if _, ok := validStageNames[name]; !ok {
-				return Config{}, true, fmt.Errorf("versioned .made.yml has unknown stage %q", name)
-			}
-			stage := cfg.Stages[name]
-			if stage.TimeoutSeconds != nil && (*stage.TimeoutSeconds <= 0 || *stage.TimeoutSeconds > maxStageTimeoutSeconds) {
-				return Config{}, true, fmt.Errorf("versioned .made.yml stage %q timeout_seconds must be between 1 and %d", name, maxStageTimeoutSeconds)
-			}
-		}
-		if retention := cfg.Test.Evidence.RetentionBytes; retention != nil && (*retention <= 0 || *retention > maxEvidenceRetention) {
-			return Config{}, true, fmt.Errorf("versioned .made.yml test.evidence.retention_bytes must be between 1 and %d", maxEvidenceRetention)
-		}
-		if !cfg.hasConfiguredValue() {
-			return Config{}, true, fmt.Errorf("versioned .made.yml must configure at least one non-version field")
-		}
-		return cfg, true, nil
-	}
-	return cfg, true, nil
-}
-
-func readConfigBytes(path string, beforeRead func()) ([]byte, bool, error) {
-	file, err := os.Open(path)
-	if errors.Is(err, os.ErrNotExist) {
-		return nil, false, nil
-	}
-	if err != nil {
-		return nil, false, err
-	}
-	defer func() { _ = file.Close() }()
-
-	info, err := file.Stat()
-	if err != nil {
-		return nil, true, err
-	}
-	if !info.Mode().IsRegular() {
-		return nil, true, fmt.Errorf("config: %s is not a regular file", path)
-	}
-	if info.Size() > maxConfigBytes {
-		return nil, true, fmt.Errorf("config: %s exceeds %d bytes", path, maxConfigBytes)
-	}
-	if beforeRead != nil {
-		beforeRead()
-	}
-	data, err := io.ReadAll(io.LimitReader(file, maxConfigBytes+1))
-	if err != nil {
-		return nil, true, err
-	}
-	if len(data) > maxConfigBytes {
-		return nil, true, fmt.Errorf("config: %s exceeds %d bytes", path, maxConfigBytes)
-	}
-	return data, true, nil
-}
-
-func (c Config) hasConfiguredValue() bool {
-	return len(c.Document.Rules) > 0 || c.Review.Required || c.DisableProjectSettings || c.NoCI ||
-		c.CI.Required || c.CI.RerunBudget != 0 || len(c.Test.Evidence.Branch) > 0 || c.Test.Evidence.RetentionBytes != nil ||
-		c.Test.Evidence.StoreInRepo || len(c.Test.Evidence.Dir) > 0 || len(c.Commands.Test) > 0 ||
-		len(c.Commands.Lint) > 0 || len(c.Agent) > 0 || len(c.Agents) > 0 || c.AllowRepoCommands ||
-		len(c.Stages) > 0
-}

internal/config/config_extended_test.go

@@ -5,6 +5,7 @@ import (
 	"testing"
 
 	"github.com/douglasjarquin/made/internal/agent"
+	"github.com/douglasjarquin/made/internal/github"
 )
 
 const trustedFixtureWithEvidenceModeAndBudget = `
@@ -73,6 +74,36 @@ func TestCI_RerunBudgetHonorsExplicitValue(t *testing.T) {
 	}
 }
 
+func TestCI_CheckScopeCanBeConfiguredAsAll(t *testing.T) {
+	dir := t.TempDir()
+	trustedPath := writeConfigFile(t, dir, "trusted.yaml", `version: 1
+ci:
+  required: true
+  check_scope: all
+`)
+
+	cfg, err := LoadEffectiveConfig(trustedPath, "")
+	if err != nil {
+		t.Fatalf("LoadEffectiveConfig rejected configured CI check scope: %v", err)
+	}
+	if cfg.CI.CheckScope != github.CheckScopeAll {
+		t.Fatalf("CI.CheckScope = %q, want %q", cfg.CI.CheckScope, github.CheckScopeAll)
+	}
+}
+
+func TestCI_CheckScopeDefaultsToRequired(t *testing.T) {
+	dir := t.TempDir()
+	trustedPath := writeConfigFile(t, dir, "trusted.yaml", trustedFixture)
+
+	cfg, err := LoadEffectiveConfig(trustedPath, "")
+	if err != nil {
+		t.Fatalf("LoadEffectiveConfig: %v", err)
+	}
+	if cfg.CI.CheckScope != github.CheckScopeRequired {
+		t.Fatalf("CI.CheckScope = %q, want %q", cfg.CI.CheckScope, github.CheckScopeRequired)
+	}
+}
+
 func TestConfig_TestCommandTokenizesNonEmptyString(t *testing.T) {
 	cfg := Config{Commands: Commands{Test: "go test ./..."}}