[noahgift]

FLOW-009 PG-4/PG-5 (Refs paiml/infra#1885, PMAT-1889). This is a gate change under AN-3: it goes solo, with an andon to Noah. The operator approved it via arbiter-cop with "yes to #302 and the sovereign-ci PR".

It changes nothing for any caller until that caller opts in. The new input receipt-verify defaults to "". With that default:

• the new receipt job is skipped;
• test, lint and coverage run exactly as they do today, in every repo that calls this workflow.

The one visible difference is an extra skipped receipt check on pull requests. It is not a required check.

When a caller sets receipt-verify:

• Scope: pull_request events only.
• What runs: the caller's verifier, taken from the base commit. It gets GITHUB_EVENT_PATH, FLOW009_BASE_SHA and FLOW009_PUBKEY, which is the base commit's .flow009/batcher.pub.
• Trust boundary: the verifier, the public key and the coverage baseline are never read from the PR's own tree. Otherwise a PR could short-circuit its own gate by editing the verifier or swapping the key.
• Contract: the verifier exits 0 and prints coverage=<float>, taken from the receipt's gate_results. The figure must be at least the floor, max(coverage_min, committed baseline), which is the same rule the coverage job ratchets on.
• When that holds: test, lint and coverage are skipped, and gate accepts those three skips only under valid=true.
• Anything else falls back to the full gate, never a red (PG-3): a path that is missing on base, a non-zero exit, unparsable output, no floor, or coverage below the floor.

What stays the same:

• Check names (test, lint, coverage, security, gate) are unchanged, so branch protection is unchanged (PG-5).
• security and provenance always run.

Arming is held. A reviewer other than me arms it, and only after the caller-side receipt verifiers (paiml/infra#1884, paiml/aprender#5758, being reworked to RC-1..RC-5) and a real .flow009/batcher.pub have landed.

Local checks:

• actionlint: no new findings. This repo's existing findings are unchanged.
• Verify step: the worker ran it against a fake verifier before I moved the verifier, key and baseline reads to the base commit: coverage at, below and above the floor; floor from the committed baseline; coverage_min unset; non-zero exit; unparsable output; missing verifier; absolute path. Each gave the expected valid= result. I have not re-run them since that change.

🤖 Generated with Claude Code