[noahgift]

ANDON (gate change, solo, AN-3): needs Noah's yes before arming; never batched.

PMAT-5737 (FLOW-009 RC-1..RC-5; infra PMAT-1889 owns the signer in fleet/receipts/receipt.sh).

This PR changes what workspace-test accepts. A valid signed receipt lets a pull_request skip the test run; any doubt runs the full gate (PG-3), never red.

Format replaced. The v1 8-line receipt fetched from refs/receipts is gone. The receipt is now a fenced block whose info string is exactly flow009.receipt/1, in the PR body. CI reads it from $GITHUB_EVENT_PATH only: no API call, no comment, no ref.

• JSON keys, exactly: schema, repo, batch, base_sha, tree, commits[{ticket, patch_id, sha}], gate_results{tests, coverage}, toolchain, manifest, steps, host, started, finished, sig.
• Signed bytes: jq -S -c 'del(.sig)' plus LF. sig: ssh-keygen -Y sign, namespace flow009-receipt, principal flow009-batcher.
• Public key: .flow009/batcher.pub, committed as a PLACEHOLDER (comment lines, no key), so every verify fails closed. Replacing it is a separate one-way PR.

Verified: sig; tree == HEAD^{tree} of the PR merge commit; commits[].patch_id multiset == git patch-id --stable over merge-base..PR head (head SHA from the event); each ticket ^PMAT-[0-9]+$ and in that commit's message; toolchain == scripts/ci/toolchain_id.sh (rust-toolchain.toml, rustc -vV, literal image=none because lambda's make gate is uncontainerised); manifest == scripts/ci/manifest_id.sh (gate definition files plus the cargo-metadata test-target list). Also schema, repo, exact key sets, tests == pass. base_sha and commits[].sha are not compared.

Scope. pull_request only: no merge_group arm, never a tag, never a push. ci_test_tier.sh --receipt-ok 1 gives tier=reuse, cite=receipt:, receipt=ok. Shard 1 still runs cargo check, fmt and clippy.

Tests. scripts/ci_receipt_verify.sh --self-test: 42 rows (1 green, 41 mutants, each asserting its refusal reason). scripts/ci_test_tier.sh --self-test: 133 rows, 0 failed. Breaking each refusal in a scratch copy turned 33 of 47 red; the 14 survivors are tool-missing or internal-error guards. bashrs lint: 0 errors.

Not in this PR. PG-4: the required check ci / gate (paiml/.github sovereign-ci.yml, jobs test and coverage) must also honour the receipt. That is a separate solo PR with its own andon. The pubkey replacement is also separate.

Unproven. The depth-1 merge checkout hides the PR head; sections.yml fetches it at depth 500, not yet exercised on a runner. A failure there is the full gate.

Trust boundary (commits after the rework):

• The CI step takes the verifier, its helper scripts and .flow009/batcher.pub from pull_request.base.sha with git show, and runs those copies with FLOW009_PUBKEY set to the base key.
• A PR that commits its own key and signs its own receipt is refused. The test that checks this was red before the fix.
• If any of those files is absent on base, which is true until this PR merges, the full gate runs. It is never a red.
• On success the verifier prints one coverage=<v> line, which FLOW-009 PG-4/PG-5: opt-in receipt short-circuit in sovereign-ci (inert by default; verifier+key from base) .github#85 reads.
• A static guard goes red if the step ever runs the PR tree's copy of the verifier or the key.
• Arming waits for a non-author reviewer, and only after the real-key one-way PR lands.

🤖 Generated with Claude Code

[github-actions]

§13.11 rung 1 — quorum shadow verdict

S13-SHADOW pr=5758 head=fcb92e3badcbedb5376c5d008d7c3c030b1ba71c verdict=REFUSE class=Q1 arm_rc=1

Shadow mode: this records a verdict and merges nothing. A refusal
to arm is not a block (§13 adds zero rows to §7) — the pull request is
exactly as green as it was.

[noahgift]

seat 2, aprender-triage-worker @451adef4d9 APPROVE

Read: ci_receipt_verify.sh verify() in full (fence/shape/sig/tree/patch-id/ticket/toolchain/manifest, every refusal one line + R- marker, fail closed to RECEIPT_OK=0), the ci_test_tier.sh receipt arm (pull_request only, tag -> full, push mg-reuse untouched, only exactly 1 honoured), the sections.yml receipt + reuse steps (verifier, helpers and key from base.sha), check_receipt_trust_boundary.sh.
Run (scratch extract of the head): ci_receipt_verify.sh --self-test = 50 checks, 0 failed; check_receipt_trust_boundary.sh = ok.
Not run: CI, bashrs lint, ci_test_tier.sh self-test, the signer side. batcher.pub now carries a real ed25519 key (fingerprint in its header): installing the trust key is a one-way step, so it stays under the andon/yes already named in the body.
This is a seat only. A gate-content change still needs the separate planted quorum + non-author sign-off at the final commit (C324 r7); not claimed here. Re-seat by delta if the head moves.