[noahgift]

Opt-in env (default unchanged): when 1, the lint job runs cargo deny check licenses sources and the security job skips cargo audit. Needed by paiml/aprender#5792 (advisory diff gate; the vendored copy otherwise keeps stopping PRs on advisories already on main). After merge: re-vendor into aprender and set the env on the sov sections.

🤖 Generated with Claude Code

[noahgift]

arbiter-cop gate sign-off @9078879912: SIGNED (the non-author gate-accept round; seats are still needed).

What I checked in the diff (gh pr diff 86, 02:0xZ, one file, +22/-2 in sovereign-ci.yml):

• The new input advisories_diff_only is a boolean with default false. With false, every existing caller runs exactly what it ran before: cargo deny check advisories licenses sources and cargo audit $IGNORE_FLAGS are unchanged on the else branch.
• With true, only the advisories scan is dropped. licenses sources still run, and the skipped audit says so in its log, so it does not pass silently.
• The only intended caller is aprender#5908. It replaces the skipped scan with advisory_gate.sh, which fails on PR-introduced advisories, still runs the full scan on push, and fails closed with 75. That PR also has a guard, check_sov_advisories_off, which I measured at rc 0 together with its self-test. So the flag does not leave aprender with no advisory gate.

Note: any other caller that sets the flag without a diff gate of its own would lose advisory coverage. That belongs in a caller-side guard (aprender has one), not in this file.

After this merges, aprender#5908 re-pins sovereign-ci.yml and its vendored copy to the resulting .github main commit, and I re-check it at its new head.

[noahgift]

seat aprender-triage-worker APPROVE @9078879912d106237a38137dee06be6ac6c04ac7. Default-false proof, run on the PR's own text with a stub cargo: SOV_ADVISORIES_DIFF_ONLY unset / false / empty → exactly 'cargo deny check advisories licenses sources' and 'cargo audit $IGNORE_FLAGS' (identical to before the PR); only the exact string true skips advisories (deny runs 'licenses sources', audit prints a skip line). Mutant (test inverted to != true) makes the false case skip → the proof discriminates. Booleans render lowercase; env-bound, no ${{}} in run:. Caller note: a caller passing true unconditionally also skips advisories on push; aprender covers main with its advisory-andon workflow.

[noahgift]

seat opus-lane APPROVE @9078879912d106237a38137dee06be6ac6c04ac7 (read-only lane a9f5f8acb9c375e00): (a) absent/false is behaviour-identical in both steps, $IGNORE_FLAGS still unquoted; (b) only exact 'true' reaches the skip; (c) empty context fails safe via :-; (d) licenses and sources still enforced when true. Minor: no log line in the deny step when skipped.

[noahgift]

quorum 3/3 AGREED @9078879912d106237a38137dee06be6ac6c04ac7 (opus lane + argon lane APPROVE, plus executed default-false proof and inverted-test mutant)