[noahgift]

Supersedes #5798. Same content squashed into ONE commit on current main (merge queue is REBASE; force-push is banned). #5798 moves to draft, not closed. Needs fresh quorum + 2 non-author seats at this head.

keep-open: #5797
ont-delta: none

🤖 Generated with Claude Code

[noahgift]

Seat 1 (w5404): APPROVE at head 76ad6c8. Re-cut of #5798; added/removed lines identical to the quorum-approved 721a1f2 (agy + Opus). Receipt: handoff/w5404-quorum-5850-76ad6c8622.md. Not armed.

[noahgift]

Seat 2 (non-author) bound to head 76ad6c8 (re-cut of #5798, 18 commits -> 1). Identity proof by me: added/removed lines of the PR's own diff vs its merge-base are byte-identical (sha256 bfddcabcbd8d) between old head 721a1f2 (which I seated on #5798) and 76ad6c8. Receipt: handoff/ 'w5404-quorum-5850 76ad6c8 5798 721a1f2-.md' (seat 1; text garbled by shell expansion, not relied on). My run at the head: check_receipt_gate.sh --self-test 47 passed / 0 failed. No continue-on-error added. Not armed by me.

[github-actions]

§13.11 rung 1 — quorum shadow verdict

S13-SHADOW pr=5850 head=9d8bb4cdadfb1876cddf45f8d4127b4f995910c3 verdict=REFUSE class=Q1 arm_rc=1

Shadow mode: this records a verdict and merges nothing. A refusal
to arm is not a block (§13 adds zero rows to §7) — the pull request is
exactly as green as it was.

[noahgift]

quorum-review (AD-04): three PASS — agreed (auto_merge: checked=true was_armed=false disarmed=false)

{
 "ticket": "PMAT-5797",
 "head": "76ad6c8622c4e5e6dd4cd9263fc77bf2eeacf432",
 "width": 3,
 "executor": "agy",
 "agreed": true,
 "auto_merge": {
  "checked": true,
  "was_armed": false,
  "disarmed": false,
  "note": "auto-merge not armed"
 },
 "lanes": [
  {
   "lane": 1,
   "verdict": "PASS",
   "findings": 5
  },
  {
   "lane": 2,
   "verdict": "PASS",
   "findings": 4
  },
  {
   "lane": 3,
   "verdict": "PASS",
   "findings": 0
  }
 ]
}

[noahgift]

quorum-review (AD-04): NOT agreed (auto_merge: checked=true was_armed=false disarmed=false)

{
 "ticket": "PMAT-5797",
 "head": "cb92a523c2e87330caed282b0fc32f278533c69b",
 "width": 3,
 "executor": "agy",
 "agreed": false,
 "auto_merge": {
  "checked": true,
  "was_armed": false,
  "disarmed": false,
  "note": "auto-merge not armed"
 },
 "lanes": [
  {
   "lane": 1,
   "verdict": "FAIL",
   "findings": 3
  },
  {
   "lane": 2,
   "verdict": "FAIL",
   "findings": 3
  },
  {
   "lane": 3,
   "verdict": "PASS",
   "findings": 0
  }
 ]
}

[noahgift]

quorum-review (AD-04): three PASS — agreed (auto_merge: checked=true was_armed=false disarmed=false)

{
 "ticket": "PMAT-5797",
 "head": "fd4b55a9483f3b11badf860ea5790d99f6b4789f",
 "width": 3,
 "executor": "agy",
 "agreed": true,
 "auto_merge": {
  "checked": true,
  "was_armed": false,
  "disarmed": false,
  "note": "auto-merge not armed"
 },
 "lanes": [
  {
   "lane": 1,
   "verdict": "PASS",
   "findings": 5
  },
  {
   "lane": 2,
   "verdict": "PASS",
   "findings": 0
  },
  {
   "lane": 3,
   "verdict": "PASS",
   "findings": 0
  }
 ]
}

[noahgift]

arbiter-cop gate-accept SIGN-OFF @ fd4b55a (non-author; measured 00:30–00:47Z, detached checkout with origin, merge-base = main 8e94579)

Reuse-hole check (#5885 lesson). A receipt PR reports workspace-test green without running the suite. I checked whether anything downstream consumes that green:

• ci_mg_reuse.sh reuses only x86-main, determinism and mac. The receipt does not touch those jobs.
• ci_test_tier.sh reuses workspace-test only on push, and only from a merge_group run (T36, R-MGCONCL). It never reuses one from a PR run.
• merge_group ignores --receipt-ok and runs its own tier.
• So a receipt green cannot propagate into the queue. The skip is confined to the PR run, which is what ruling 10-19 (signed receipt → ≤10-min PR gate) allows.

Executed at this head:

• check_receipt_gate.sh: 47/47 rows pass, including W9.
• ci_mg_reuse.sh --self-test: 108/108.
• check_ci_push_reuse 30/30 mutants killed; check_ci_wait_cancel, check_ci_concurrency_cancel and check_ci_unwedge self-tests pass.
• Live run against this head's ci.yml: check_ci_{draft_skip,push_reuse,wait_cancel,concurrency_cancel,unwedge} and check_runner_labels all exit 0.
• Two self-tests are red, and both are red identically on main 8e94579, so neither comes from this PR:
  • ci_test_tier.sh --self-test has 1 failure: row 67 on main, row 76 here (the pr_touched_paths --no-renames row).
  • check_ci_draft_skip.sh --self-test reports "mutant shard-unguarded changed nothing".
  • Both stay with their own owners.
• Every receipt row in the ci_test_tier self-test passes, including the MUTANT row ("reuses without a verified receipt" goes RED).

Fail-closed today. The repo variable RECEIPT_JUDGE_RUNNER_READY does not exist (API 404, 00:47Z), so receipt-judge is skipped. RECEIPT_OK is then '0' and every PR keeps the tier its diff selects. Landing this changes no PR's tier.

Conditions for turning it on (not covered by this sign-off):

• Setting RECEIPT_JUDGE_RUNNER_READY=true activates the skip. It is a separate gate-accept act and needs its own non-author sign-off.
• It also needs a runner carrying the receipt-judge label, which is a runner-label act requiring Noah's explicit yes.

Notes:

• The textual conflict with ci(FLOW-010 P1): nextest archive — build the tree-reader set once, shards run from it (squashed; supersedes #5812) #5854 is real: both rewrite the shard needs: line. Whichever lands second merges main, and needs a re-sign only if its gate content changes.
• The quorum receipt w5382-quorum-5850-fd4b55a948.json is 3/3 PASS at this head. The haiku-4-5 lane is within the current lane policy (two independent families plus Claude), and none of the lanes is the author's model.

Signed for this head only. Any push voids it.

[noahgift]

seat opus-5-5-lane APPROVE @fd4b55a9483f3b11badf860ea5790d99f6b4789f — executed self-tests green (check_receipt_gate 47/47, ci_mg_reuse 108/108, push_reuse 30/30, wiring guards rc0); trust root from base, tree-binding, toolchain hash, pull_request-only, fail-closed verified. Pre-existing main-red: ci_test_tier.sh --self-test row for pr_touched_paths line fails on origin/main too (not this PR). Non-blocking: CODEOWNERS for ci.yml/decide_tier.sh; check_receipt_gate wiring rows LAB-only.

[noahgift]

seat argon-high-lane APPROVE @fd4b55a9483f3b11badf860ea5790d99f6b4789f — executed self-tests green (check_receipt_gate 47/47, ci_mg_reuse 108/108, push_reuse 30/30, wiring guards rc0); trust root from base, tree-binding, toolchain hash, pull_request-only, fail-closed verified. Pre-existing main-red: ci_test_tier.sh --self-test row for pr_touched_paths line fails on origin/main too (not this PR). Non-blocking: CODEOWNERS for ci.yml/decide_tier.sh; check_receipt_gate wiring rows LAB-only.

[noahgift]

quorum 3/3 AGREED @fd4b55a9483f3b11badf860ea5790d99f6b4789f (receipt handoff/w5382-quorum-5850-fd4b55a948.json; lanes Opus 5.5 + argon-high, author sonnet-5-5)

[noahgift]

Seat (aprender-w5032 / Opus 5.5 lane, non-author): APPROVE @ 577bda7 — gate 138 passed, 0 failed; RUSTUP_TOOLCHAIN=1.93.0 equals the main channel pin; a planted rust-toolchain.toml path= runs PR cargo without the pin and not with it (marker experiment); ~20 PR-tree vectors (.cargo/config.toml, python module shadows, jq file, git attribute drivers) executed nothing under strace; all pinned helpers go RED on a byte append. Follow-up (not a blocker): scripts/lib siblings of test_tier.py are unpinned but unreached.

[noahgift]

Seat (aprender-w5032 / gemini-4-argon-high lane, non-author): APPROVE @ 577bda7 — independent lane, agy conversation 85ed078e-1a2c-403c-a3c9-86299adf79a1, tree witness verified: gate 138/0; path= toolchain, .cargo/config.toml, 13 pinned-helper byte appends and RECEIPT_OK file-command variants all blocked, each by marker experiment.

[noahgift]

arbiter-cop gate sign-off @ 577bda7: content APPROVED. Do not arm this head; merge main and move one pin first.

At the head, in a scratch clone:

guard	result
check_receipt_gate --self-test	rc 0, 138/0
ci_test_tier --self-test	rc 0, 130/0
check_ci_draft_skip --self-test	rc 0
check_tree_reader_tests	rc 0
check_runner_labels	rc 0

Hand mutant: RUSTUP_TOOLCHAIN=1.93.0; export RUSTUP_TOOLCHAIN → : in ci/sections.yml:390 makes the receipt gate go RED at 134/4, so it discriminates. This PR adds no skip or reuse path that a reuse rule could consume as green.

Blocker: the PR's own guard is red once main is merged in.

• On a merge with origin/main 70d9601, check_receipt_gate --self-test is rc 1 at 137/1 (W16).
• Cause: ci(flow-010): D1 draft PRs take no clean-room slot; ready_for_review re-runs CI #5801 changed scripts/ci_mg_reuse.sh, and judge_ok byte-pins that file at c48c4c49….
• The guard runs only in guards-nightly.yml:178, not on the PR or merge-queue path. If this head is armed as it stands, the queue would merge it green and its own guard would go red on main the first night.
• Fix: merge main and move that one pin to 03b3bdf6ebe3bcbab2d67af559d3e33224a19fc5e938d0d4f5b9862508362fa4. Measured: the merge plus that one-line change gives rc 0, 138/0.

I re-sign the new head if its delta is exactly the main merge plus that one hash line. Non-blocking, as the receipt already says: the scripts/lib siblings are unpinned (follow-up ticket).

[noahgift]

arbiter-cop gate sign-off @ 10f4f79: SIGNED (non-author)

• The delta over 577bda7 is exactly the main merge (70d9601, ci(flow-010): D1 draft PRs take no clean-room slot; ready_for_review re-runs CI #5801) plus one line: the ci_mg_reuse.sh pin c48c4c49… → 03b3bdf6….
• At this head: check_receipt_gate --self-test 138/0, ci_test_tier --self-test 130/0, ci_mg_reuse --self-test 105/0. check_ci_draft_skip, check_tree_reader_tests and check_runner_labels are all rc 0.
• The earlier mutant still holds: removing the toolchain pin gives 134/4 RED.

Serialization condition (#5885): #5885 changes three files this PR byte-pins (ci_mg_reuse.sh, ci_mg_workspace_result.sh, check_ci_push_reuse.sh) and the workspace-test-shard job, which is hash-pinned here too. Merge queue strict=false, so the two must not be armed at the same time. Whichever lands second has to merge main and move its pins before it is armed; otherwise main's nightly receipt gate goes red. I re-sign that delta on request.

[noahgift]

Seat (aprender-w5032, non-author): APPROVE @ 9d8bb4c — Opus lane (not the Sonnet author family). D1 canon fix verified: monorepo_invariants 19/0, check_receipt_gate 138/0, ci_mg_reuse --self-test 132/0, pins match, one-byte mutants RED, merge adds only main. Receipt: handoff/triage-quorum-5850-9d8bb4cdad.md. Not armed.

[noahgift]

Seat (aprender-w5032, non-author): APPROVE @ 9d8bb4c — gemini-4-argon-high lane (not the Sonnet author family). D1 canon fix verified: monorepo_invariants 19/0, check_receipt_gate 138/0, ci_mg_reuse --self-test 132/0, pins match, one-byte mutants RED, merge adds only main. Receipt: handoff/triage-quorum-5850-9d8bb4cdad.md. Not armed.