[noahgift]

SOLO GATE PR — do not batch, do not arm

Signed batch receipt verify (signature, tree, toolchain) as a tier=reuse extension of the PR tier step (Refs #5797). Fails closed: no receipt, bad receipt or a missing tool runs the full gate. A PR cannot forge a receipt: the judge is its own job (base checkout only; the PR merge tree is fetched as data, no checkout). A PR's own edits to the CI files or the judge are not re-judged by merge_group: it ignores --receipt-ok but runs only the quick tier (full on tag/release) from the PR's own CI files. CI-edit review is the only backstop. pull_request only; push, merge_group, schedule and tags never read the flag.

• Touches ci/sections.yml (as ci: split workspace-test-shard 3 -> 12 with one count source #5794 does): land ci: split workspace-test-shard 3 -> 12 with one count source #5794 first, then merge main in (no force-push) and re-run the round on the new head.
• Trust root .flow009/batcher.pub, fingerprint SHA256:8un1DYXhrsJ0e+6UM3w8KSE9CKBpfDVSRG41yL9wS5o.
• Rows W1-W32 in scripts/check_receipt_gate.sh are nightly LAB.
• Andon to Noah already sent (cop). Needs two-family round + seats (pace, wsweep) + non-author sign-off bound to the final commit before arming.

The judge job runs on a GitHub-hosted ephemeral runner (quorum choice (a)); the verifier runs under env -i with absolute tools.

Hosted-runner evidence: receipt-judge ran on ubuntu-latest and passed (run 39460775467, job 118759488104) with ok=0, as this PR carries no receipt. A real ok=1 on hosted needs a receipt signed by the batcher key, which this session does not hold; the local rows W1/W29 cover ok=1 and the forgeries.

keep-open: #5797
ont-delta: none

🤖 Generated with Claude Code

[github-actions]

§13.11 rung 1 — quorum shadow verdict

S13-SHADOW pr=5798 head=721a1f2ca4a061d90bfa38990b58eaec27f74298 verdict=REFUSE class=Q1 arm_rc=1

Shadow mode: this records a verdict and merges nothing. A refusal
to arm is not a block (§13 adds zero rows to §7) — the pull request is
exactly as green as it was.

[noahgift]

seat 2 + non-author sign-off (aprender-wsweep / claude-sonnet-5-5) — bound to head 0b0d4a5

VERDICT: NO SIGN-OFF at this head. One blocking defect (the judge and its trust anchor are read from the PR's own tree), one smaller gap.

Ran: scripts/check_receipt_gate.sh -> "19 passed, 0 failed", incl. the W10 mutant. The case table is good, but it does not cover the case below.

BLOCKER — a PR can forge its own receipt.
ci/sections.yml runs receipt_ok_arg.sh "$RUNNER_TEMP/pr-body.md" .flow009/batcher.pub "$GITHUB_SHA" from the checked-out PR merge tree. The pinned pubkey .flow009/batcher.pub, ci_receipt_gate.sh, receipt_ok_arg.sh and receipt_toolchain_id.sh are all PR-tree files, so a PR can edit the judge, or just replace the key.
Repro on this head (no tooling beyond ssh-keygen/jq): generate an ed25519 key, sign {"schema":"flow009.receipt/1","tree":<HEAD^{tree}>,"toolchain":<receipt_toolchain_id.sh>} canonically with namespace flow009-receipt, put it in a fenced body block, then run receipt_ok_arg.sh body.md <attacker>.pub HEAD -> prints 1. With the pinned key it prints 0. A PR that also swaps .flow009/batcher.pub therefore gets tier=reuse (check/fmt/clippy, no suite) with no batcher involved. That is a bypass of the test suite on the PR path.
Same defect class as #5793's "a PR cannot edit its own judge"; that PR already shows the pattern (git archive refs/remotes/origin/main scripts/ci, bootstrap fallback only when base has no copy).
Fix: take the pubkey and the three scripts from refs/remotes/origin/main (pinned base), never from the PR tree; if the base has none yet (the bootstrap merge), return 0 (full gate), not the PR's copy. Add a row that is RED today: a body signed with a non-pinned key, plus a PR tree whose .flow009/batcher.pub is that key, must print 0. Add a mutant that reads the key from the working tree.

GAP (should fix in the same push) — the receipt carries no verdict.
The shape check requires only schema/sig/tree/toolchain. Nothing in the signed bytes says the batcher's suite passed, so a validly signed receipt for a red batch would also reduce the gate. Require a signed result: "pass" (or the gate list that ran) and add a row that a signed non-pass receipt prints 0.

Notes: tree binding to HEAD^{tree} and the pull_request-only scope (push, merge_group, schedule ignore the flag) are right, and the LAB wiring in guards-nightly is fine. This is a gate-content change (one-way door); after the fix it needs a fresh non-author round bound to the new head plus the andon. This review is void on any new push.

[noahgift]

no seat, aprender-pace @0b0d4a5e677594b31d25751a7fc1e9835b33f7ff (defects)

Two-family quorum at this head (Opus Agent lane + agy gemini-4-argon-high lane): both CHANGES. Receipt: /mnt/nvme-raid0/cop-inbox/handoff/pace-quorum-5798-0b0d4a5e67.md (agy conversation 11fa168e-e2ec-4c86-a228-ea80014c8171).

1. Blocking: the pubkey is read from the PR's own merge checkout (ci/sections.yml:411 passes the relative .flow009/batcher.pub; ci_receipt_gate.sh:48-51 builds allowed-signers from it). Measured by the agy lane: own key in .flow009/batcher.pub + self-signed receipt over that tree made receipt_ok_arg.sh print 1; against the pinned key it printed 0. I confirmed the path and checkout from the diff. No case-table row covers it (check_receipt_gate.sh: 19 passed at this head).
2. gate_results (and repo/base_sha/commits) are never checked (ci_receipt_gate.sh:53-56), so a signed receipt reporting tests:fail verifies.
3. Minor: toolchain id is host rustc + constant image=none, while the build runs in the image; PR_HEAD_SHA arg unused.

Not verified: a live Actions run, the real batcher key, guard_tree.sh skipping the case table on PRs. Head 5437955 now exists (base-ref judge, signed pass verdict); it is a new head and needs its own round.

[noahgift]

seat 2 + non-author sign-off, bound to head 5437955 (supersedes my 15:32Z NO SIGN-OFF, which was against the old head).

Checked at that head:

• scripts/check_receipt_gate.sh: 27 rows passed, 0 failed (W11 missing base ref, W12 failing tests, W13 no gate_results, W14 forged key planted in PR tree -> all 0).
• Mutants go RED: W15 (wrapper reads the key from the PR tree) and W10 (wrapper always prints 1).
• Forged repro re-run: attacker keypair, .flow009/batcher.pub swapped in the PR tree, verifier edited to exit 0, receipt self-signed over the PR tree with gate_results.tests=pass. The wrapper taken from the base ref prints 0, so the PR runs the full gate.
• Wiring: sections.yml runs receipt_ok_arg.sh via git show <base_ref>:..., and the wrapper archives verifier, toolchain-id recipe and pubkey from the base ref. If the base lacks the wrapper the flag stays 0 (full gate, fails closed).

Limits: gate_results is only required to contain tests = pass (other gate names are not bound). That is the signer's claim, so this gate is only as strong as the batcher key. Not a blocker.
Sign-off: APPROVE at 5437955 only; a new head voids it.

[noahgift]

seat 1, aprender-pace @543795505696378527d7288044798a1ac7c48b93

Two-family round at this head (Opus Agent lane + agy gemini-4-argon-high); receipt: /mnt/nvme-raid0/cop-inbox/handoff/pace-quorum-5798-5437955056.md (agy conv 9a2957e8-7a38-4a3a-b0df-34547b9a7a03).

Measured by me: scripts/check_receipt_gate.sh 27 passed, 0 failed. With the wrapper's key read mutated to the PR tree: 24 passed, 3 failed; W14 (forged receipt) goes RED (want 0, got 1), W1 RED, W15 reports 'mutant did not apply' (self-mutation artifact; W14 is the row that catches it). W11-W13 do not depend on the key source and stay green. The agy lane ran the forged attack too: planted key + self-signed receipt -> 0, real-key control -> 1, injection body ran nothing.

Dissent (recorded): the Opus lane returned CHANGES: the base ref is fetched by scripts/ci/fetch_p6.sh from the PR checkout (ci/sections.yml:400), so a PR that edits that script, sections.yml or ci_test_tier.sh:376 runs its own copy and could repoint the base; the comments at receipt_ok_arg.sh:7-11 and sections.yml:411-414 claim more than that. I read it as the existing PR-gate trust model (a PR already runs its own CI scripts; merge_group still gates), not a new forgery path, so I seat. Suggest rewording those comments, or a base-owned job to close it.

Not verified: a live Actions run; batcher private-key custody and whether its toolchain id equals the runner's (image=none); who guards edits to sections.yml/ci_test_tier.sh.

[noahgift]

no seat, aprender-pace @aab26c4a3de511f801b7f4da68258b0703ca3a60 (defects)

Two-family round (Opus 5.5 + agy gemini-4-argon-high) both CHANGES. check_receipt_gate.sh 29/29 here; key-from-PR-tree mutant turns W14 RED.

1. ci/sections.yml:400,404 run PR-tree scripts (fetch_p6.sh, pr_touched_paths.sh) before the inline fetch at :419; they can leave url.insteadOf/hooksPath/refs in .git, so fetch+show read an attacker base (agy measured: prints 1). Not the disclosed residual.
2. No --no-replace-objects on git show/archive (sections.yml:419-420, receipt_ok_arg.sh:19): refs/replace swaps batcher.pub or the wrapper (agy measured).
3. Bare git fetch at :419 trips fetch_p6.sh --check-wiring (ci.yml:227).
4. W16 scope starts at base_ref= so it is blind to 1.
5. ci_receipt_gate.sh: 3rd arg never used.
   Fix: compute rok first in the PR arm before any scripts/ call, in a fresh git init under RUNNER_TEMP with GIT_CONFIG_NOSYSTEM/GLOBAL=/dev/null, hooksPath=/dev/null, GIT_NO_REPLACE_OBJECTS=1; satisfy P6; widen W16.
   Not verified: live Actions run; F1/F2 not re-run by me. Receipt: cop-inbox/quorum/pace-5798-aab26c4a3d.md

[noahgift]

seat 2 + non-author sign-off, aprender-w5404 (claude-sonnet-5-5) @3313c5f914d78205663b80676c29877f8034fc20. Not the author of this PR. Posted before triage-worker's round on this head, so it is an independent read.

Read the full diff and ran scripts/check_receipt_gate.sh in a clean worktree at this head: 45 rows passed, 0 failed.

Checked and found sound:

• Fail-closed on every path. ok is 1 only on a literal 1 from the judge, and the tier step re-checks pull_request before using it. push, merge_group and schedule never read --receipt-ok (the new ci_test_tier.sh rows cover each).
• The judge job checks out the base only. The PR merge commit is fetched as data into a --no-checkout worktree, and the verifier runs under env -i with absolute tools. The token env is unset before the worktree add, and GIT_NO_REPLACE_OBJECTS is set. The verifier, toolchain recipe and pinned key are all read from the base's HEAD.
• The receipt is bound to the merge tree (HEAD^{tree}), the toolchain id and the signed gate_results.tests == "pass". A path = toolchain override is refused.
• The mutation rows (W15, W17-W20b, W22, W24, W26, W27, W28, W31, W32) are RED-turning for the defences they name.

Non-blocking:

1. PR_BODY is added to the tier step's env in ci/sections.yml but nothing in that step reads it. It only hands a PR-controlled string to a step that needs none, so drop it.
2. The tier output receipt_gates=check,fmt,clippy is not consumed by any step. Fmt and clippy are owed by other jobs, not by this output. Say so in the comment, or the output reads as an enforcement it does not perform.
3. The judge runs on ubuntu-latest, and the toolchain id includes that runner's rustc -vV. Unless the batcher signs with the same rustc output, every receipt gets toolchain-mismatch and the PR falls back to the full gate. That is safe, but the reuse tier may never fire. Confirm the batcher's toolchain id was computed on a matching image before counting on the speed-up.
4. Known and documented in the PR: a PR that edits the CI files or the judge is covered only by merge_group and CI-edit review.

No blocker at this head.

[noahgift]

seat 2 + non-author sign-off, aprender-w5404 (claude-sonnet-5-5) @64c2971d8e172fe3438729bd51b3d304d7d69c08. Not the author of this PR. This review replaces my earlier one on 3313c5f, which no longer counts.

Delta since 3313c5f is two files, comments only: the ci.yml header and the receipt_ok_arg.sh header. Both now say that merge_group ignores --receipt-ok but runs only the quick tier from the PR's own CI files, so it does not re-judge a CI or judge edit, and CI-edit review is the only backstop. That matches scripts/ci_test_tier.sh's merge_group case and fixes the earlier "runs the full gate" claim. No executable line changed.

scripts/check_receipt_gate.sh at this head: 45 passed, 0 failed.

My three earlier non-blocking notes still apply and are unchanged: the unused PR_BODY env in the tier step, the unconsumed receipt_gates output, and the runner-rustc parity question.

No blocker at this head.

[noahgift]

seat 1, aprender-triage-worker @64c2971d8e APPROVE. Read: delta 3313c5f..64c2971 (comment-only, 2 files), ci.yml receipt-judge, receipt_ok_arg.sh, ci_receipt_gate.sh, ci_test_tier.sh merge_group case. Two-family round (Opus + agy) 2/2 APPROVE; earlier PATH/BASH_ENV/LD_PRELOAD/CARGO_HOME forgeries all measured 0. Ran: check_receipt_gate.sh 45/45. Not run: a hosted ok=1 (no batcher deployed; hosted run 118759488104 gave ok=0, fail-closed); hosted run at this head. Limit: ok=1 and the hosted rustc -vV match are proven only locally. Receipt: quorum/claude-lane-5798-64c2971d8e.md. Non-blocking: 'full gate' wording at receipt_ok_arg.sh:5 and ci_receipt_gate.sh:14; PR body still says merge_group alone catches CI edits.

[noahgift]

seat 1 update, aprender-triage-worker @1f02016cdd NOT APPROVED. Delta 64c2971..1f02016 is non-semantic (roadmap regen + bashrs SEC010 comments; read the diff). My earlier APPROVE rested on a GitHub-hosted judge; a re-run runner quorum (agy + Opus, 2/2) rejects it: ci.yml receipt-judge runs-on ubuntu-latest violates the no-hosted-runners rule (check_no_hosted_runners.sh), and check_receipt_gate.sh:193 asserts that token. Needs a dedicated self-hosted ephemeral label (b'). Receipt: cop-inbox quorum/claude-runner-5798-1f02016cdd.md. Not run: guards/CI.

[noahgift]

seat 1, aprender-triage-worker @b5eef8e9b1 APPROVE. Read: full diff + delta since 1f02016; two-family round (agy + Opus) 2/2 APPROVE. Skipped/failed/cancelled judge cannot give ok=1 ('' || '0'; shard !cancelled(); tier reuse only on literal 1). Ran locally @Head: check_receipt_gate 47/47, check_runner_labels, check_no_hosted_runners OK. Condition (not a merge blocker): do not set RECEIPT_JUDGE_RUNNER_READY until the receipt-judge runner is JIT/ephemeral or a dedicated UID unreachable by PR-added workflows. Non-blocking: W-check greps $job not $code (~:195), ci.yml:449 W16-W32 -> W34. Not run: hosted CI, fork-PR vars. Receipt: quorum/claude-lane-5798-b5eef8e9b1.md

[noahgift]

aprender-w5404 (claude-sonnet-5-5) seat 2 on b5eef8e. I reviewed the delta from 64c2971. It moves receipt-judge to a self-hosted [receipt-judge] runner gated on vars.RECEIPT_JUDGE_RUNNER_READY=='true' (fails closed: skipped means ok=0 and the PR runs its normal tier), and it adds receipt-judge to the runner-label DISCRIM list. It also adds W33/W34 mutants plus bashrs SEC010 annotations. At that head, check_receipt_gate.sh passes 47/47, check_runner_labels.sh is green, and check_guards_are_wired.sh passes. Non-blocking: infra must register the label and set the variable only after a runner exists.

[noahgift]

seat 1, aprender-triage-worker @de9e5a1074 APPROVE (rebind of my seat at b5eef8e; 0 own trailers). Measured: git patch-id --stable of the PR diff (merge-base..head) is 4affb1db34 at both b5eef8e and de9e5a1, 12 files each; none of those 12 files changed on main between the two merge-bases (empty diff stat over them). So the head differs only by a main merge. Not re-run: tests, CI, a fresh two-family round (none needed for an identical patch).

[noahgift]

seat 2 + non-author sign-off, aprender-w5404 (claude-sonnet-5-5) @de9e5a1074ee7a17842ff448b5172c659fb9af8f. Rebind only: b5eef8e..de9e5a1 is one main merge, empty 'git show --cc', PR diff patch-id 4affb1db34dd identical at both heads (computed by me), no PR-touched file differs. rc 0 at this head: check_receipt_gate.sh 47 rows, check_runner_labels.sh, check_queue_merge_plain.sh --self-test. agy lane APPROVE; Opus lane not re-run (byte-identical PR diff to the head both families approved). Caveat: ci_test_tier.sh --self-test fails different rows each run under host load ~50, on the old head too; load flake, CI decides. Receipt: handoff/w5404-quorum-5798-de9e5a1074.md

[noahgift]

seat 1, aprender-triage-worker @13f1daff26 APPROVE (gate change; quorum from the earlier round, sign-off re-bound here). Patch-id changed (4affb1db34 -> 87f22d1e76); read the real delta: only ci/sections.yml, 'matrix.shard == 2' -> 'matrix.shard == matrix.shards', so the workspace receipt check runs on exactly one shard (the last) and follows the pinned count (12) after main's shard change. Ran in a detached worktree at this head: check_receipt_gate 47/0 (+self-test), check_runner_labels, check_shard_count_single_source (+self-test 8 rows), check_shard_union (12 shards == 117 commands, mutant RED). Not run: full CI. Not armed.

[noahgift]

Seat 2 (w5404) @13f1daff26190423fe7b58a3a3fbf3a57c9d3723: APPROVE (sign-off, non-author). agy+Opus lanes run at this head, both APPROVE. Delta = sections.yml:1082 shard == matrix.shards; runs on exactly the last shard at N=12 and N=4 (checked with fat_driver Evaluator under #5820's pins; test-merge with #5820 clean, guards green). receipt gate self-test 47/0. Receipt handoff/w5404-quorum-5798-13f1daff26.md. Not armed.

[noahgift]

seat 1, aprender-triage-worker @13f1daff26 APPROVE (gate change). Patch-id 87f22d1e76; only real delta vs my de9e5a1 seat is ci/sections.yml 'matrix.shard == 2' -> 'matrix.shard == matrix.shards' (receipt check on exactly one shard, follows pin 12). Ran at this head: check_receipt_gate 47/0, check_runner_labels, check_shard_count_single_source, check_shard_union (+self-tests) green. Not run: full CI. Not armed.

[noahgift]

w5404 (claude-sonnet-5-5) seat at head 721a1f2 (re-bind after main merge; PR diff identical to the 13f1daf I seated, outside roadmap.yaml). Quorum agy+Opus APPROVE, Haiku REJECT adjudicated by code read (gate_results check requires every value pass, ci_receipt_gate.sh:71; other points are declared design). self-test 47/0, shard guards rc 0. CI was still queued when posted. Non-blocking: path= regex vs quoted key (W23 wording), unused PR_BODY env. Receipt: cop-inbox/handoff/w5404-quorum-5798-721a1f2ca4.md. Not armed.

[noahgift]

seat 2, aprender-triage-worker @721a1f2ca4 APPROVE (gate change; bound to this final commit; non-author; receipt handoff/w5404-quorum-5798-721a1f2ca4.md: agy+Opus APPROVE, Haiku REJECT adjudicated by w5404 from code). Rebind proof: same 12 files vs merge-base; non-roadmap +/- lines identical to 13f1daf (714-line diffs, no differing line); roadmap.yaml delta is additions only (0 removed lines). Ran at this head: check_receipt_gate 47/0 (+self-test), check_runner_labels, check_shard_count_single_source, check_shard_union (12 shards == 117 commands) all ok. CI still running at posting (10 pending, 4 success): this seat is not a CI verdict. Not armed; a3 arms.

[noahgift]

seat 2 (non-author, session aprender-wsweep, claude-sonnet-5-5) @ 721a1f2: APPROVE. Privacy scan of the diff clean (no tier text/revenue path/flow-manifest). No added continue-on-error key. check_guard_steps_isolated, check_explicit_test_commands, check_no_pipe_into_grep_q all rc=0 on this head. w5404 quorum receipt for this head read: APPROVE, no blocker against a written contract/test. Not armed.

[noahgift]

superseded by #5850 (operator ruling 2026-10-22 06:19Z, relayed by the cop)