Gate-change PRs: refuse merge without a recorded sign-off bound to the head sha #4815

Problem

The rule: a PR that changes what a check accepts, stricter included, needs two reviewers who are not its author plus the maintainer's sign-off before it merges.
Nothing enforces it.

• Between 2026-10-04 07:40Z and 2026-10-05 16:00Z, 17 such PRs merged: fold(B2): five nightly root-cause fixes in one PR (#4705 #4706 #4707 #4708 #4713) + one roadmap regen #4777 feat(nightly): producers for deep-doctests, deep-nodefault, deep-bins-smoke (#4718) #4722 fix(ci): pin jq 1.8.2 at the start of x86-main, sha256-verified, fail closed #4784 fix(ci): mutants PR gate keeps .git in the scratch copy (--copy-vcs true) #4782 fix(ci): mg-reuse wiring rows read the job text from a here-string, not a pipe into grep -q (FLAKE-0) #4775 fix(serve): KV caches committed every byte at construction; re-enable the three FLAKE-0 memory-bound tests (#4769) #4778 fix(ont): example walk admitted every package under a non-workspace root — ont4d extract was not byte-identical twice #4773 fix(guard): FLAKE-0 #4759 the EXIT-trap row waits for the trap to be armed and is measured again #4772 test(serve): FLAKE-0 ignore the three StreamingKVCache memory-bound tests that OOM on a 30 GB runner (#4769) #4771 fix(guard): FLAKE-0 #4759 quarantine the EXIT-trap row of check_guard_steps_run_all.sh's self-test #4762 fix(guard): the pv pin probes a snapshot taken under cargo's build lock (#4768) #4770 fix(release): coverage gate reads the nightly's sha-keyed receipt; version-only bumps accepted; checked before the tag (#4734, #4735, #4691) #4738 ci(tier): a push to main reuses the merge queue's workspace-test result on the same sha (T36) #4763 ci(merge_group): reuse x86-main, determinism and mac-check when the PR head already passed them on the same tree (T43) #4753 fix(ci): the determinism job waits for x86-main instead of holding an ARM64 runner for an hour (T42) #4755 ci(pr-review-quorum): run present on its own review-light runner (#4729) #4730 BLD-002 PR-A: nightly train, its helpers, the step baseline (R0, R7a, R7b, R4) #4731. None has a sign-off recorded against its merged commit.
• Two of them made a check looser (test(serve): FLAKE-0 ignore the three StreamingKVCache memory-bound tests that OOM on a 30 GB runner (#4769) #4771, fix(guard): FLAKE-0 #4759 quarantine the EXIT-trap row of check_guard_steps_run_all.sh's self-test #4762). Both were undone within 7 hours, by fix(serve): KV caches committed every byte at construction; re-enable the three FLAKE-0 memory-bound tests (#4769) #4778 and fix(guard): FLAKE-0 #4759 the EXIT-trap row waits for the trap to be armed and is measured again #4772.

Plan

1. Case table. Write down what counts as a gate change, by path and by content. Examples: contract thresholds, ratchet baselines, check scripts, workflow if: and needs: lines, release scripts.
   • Give it must-match and must-not-match rows.
   • Build the rows from the 17 PRs above and from known code-only PRs.
2. The check. Classify a PR's three-dot diff with the table. For a gate change, refuse unless both of these hold:
   • a sign-off record names the PR's head sha;
   • two non-author review receipts are bound to that same sha.
3. Red proof. Give each classifier row a planted mutant that turns it RED.
4. Landing. It lands as a ratchet: non-blocking at first, blocking only after three green nights. Making it a required check is a ruleset change, which is the maintainer's call.