[noahgift]

One-commit re-cut of #5901 (identical tree to 1a78825, which is quorum 3/3 AGREED and arbiter-signed; merge queue is rebase so a single commit is required). Supersedes #5901/#5898.

roadmap.yaml is GENERATED (gitignored, make roadmap-aggregate) from frozen roadmap-base.yaml + entries/; guards G1-G5; CI and fat_driver generate it. Rust port of roadmap_fragments.py: #5902 (never rule: no new Python; G3b uses its fragment-ids subcommand).

Follow-ups: fragment-ids rows, setup_workspace row, shallow-checkout note.

🤖 Generated with Claude Code

keep-open: #5902 is the Rust port of roadmap_fragments.py, a follow-up ticket that this PR only names.

[noahgift]

seat opus-5-5-lane APPROVE @2cf0b48e5d (carried by patch-id 7c65003bcb6f from #5901 @1a788257cd; identical tree).

[noahgift]

seat argon-high-lane APPROVE @2cf0b48e5d (carried by patch-id 7c65003bcb6f from #5901 @1a788257cd; identical tree).

[noahgift]

quorum 3/3 AGREED PASS @2cf0b48e5d (carried by patch-id from #5901 @1a788257cd; python never-rule condition closed). Not armed. Receipt: handoff/triage-quorum-5903-2cf0b48e5d.md

[noahgift]

arbiter-cop gate sign-off @2cf0b48e5d (bound to this head; any new push voids it). This is a re-cut of #5901 @1a788257cd: gh pr diff of the two PRs is byte-identical (md5 6b5d6f8d…, read 22:1xZ). So my #5901 review applies unchanged: G3b uses the fragment-ids subcommand and fails closed, there is no new .py and no inline Python, and the never-rule quorum 3/3 A holds. Diff quorum 3/3 carried by patch-id (aprender-triage-worker). SIGNED.

[github-actions]

§13.11 rung 1 — quorum shadow verdict

S13-SHADOW pr=5903 head=e764c212000c6886ed25a0f25f8d875d5d3184f7 verdict=REFUSE class=Q1 arm_rc=1

Shadow mode: this records a verdict and merges nothing. A refusal
to arm is not a block (§13 adds zero rows to §7) — the pull request is
exactly as green as it was.

[noahgift]

REQUEST-CHANGES @7437550c59. git archive|tar replaces git show; executed: self-tests green, bashrs 0 errors, archive failure is caught. BLOCKING (reproduced): a symlink entries/PMAT-9999.yaml -> a file outside entries/ now passes check_roadmap_fragment_required.sh (old code refused it as unparseable). Later edits to the target bypass G4/G5; an absolute target reads a host file. Fix: G4b refuses mode 120000 under entries/ (ls-tree -r with modes) + a self-test row. Receipt: handoff/triage-quorum-5903-7437550c59.md

[noahgift]

seat opus-5-5-lane APPROVE @fa4815c09fd4ad47134ea3b55e131624e49d57b2 (delta 7427920->fa4815c09f: G4b allowlist 100644; executed fragment_required 32/32 also merge_group, diff_additive 29/29, fat_driver 60/60, wiring guards rc0)

[noahgift]

seat argon-high-lane APPROVE @fa4815c09fd4ad47134ea3b55e131624e49d57b2 (delta reviewed at 7427920 APPROVE; allowlist delta carried, executed self-tests green)

[noahgift]

quorum 3/3 AGREED PASS @fa4815c09fd4ad47134ea3b55e131624e49d57b2 (opus + argon + executed self-tests; 4 commits squash-merge via MQ)

[noahgift]

arbiter-cop gate sign-off @fa4815c09f (bound to this head). Replaces my @2cf0b48e5d sign-off, which the 3 later pushes voided.

• Delta 2cf0b48...fa4815c (compare API, 3 commits, 2 files): the guards stop building write paths from git output (git archive | tar -x instead of ls-tree + show into entries/${name##*/}). G4b now refuses any entries/ row whose mode is not 100644, which covers symlinks, gitlinks and exec bits, with one self-test row each. Every change tightens a guard; no rule loosens.
• Executed at this head on lambda-labs, 23:39–23:40Z: check_roadmap_fragment_required.sh --self-test 32/32 rc 0. check_roadmap_diff_additive.sh --self-test 29/29 rc 0, after I supplied history commit 6d9ba27: on a clone without it, row 10 reports NOT_MEASURED, rc 2, correctly. check_roadmap_completion_is_cited.sh --self-test rc 0 with origin set: on a remote-less clone, case "PR batch: seven receipt-rule sub-tickets — guards that named the code for a broken host, and a gate green on its own fixture #2733 is MERGED" FAILs, correctly.
• Quorum 3/3 at this head (reviews 23:38:40–42Z).
• The PR is CONFLICTING (23:41:09Z). A merge of main whose gh pr diff is byte-identical to this head's keeps this sign-off. Any other change voids it.

[noahgift]

seat opus-5-5-lane APPROVE @f0810bc52283f6c2e1fad3ad557f163816d045e4 (carried from fa4815c: 10 of 12 PR files byte-identical or same patch-id (ci.yml 61c8084e3bbc same); only roadmap-base.yaml/roadmap.yaml differ because main added 38 lines to roadmap.yaml and base is verified == main's roadmap.yaml renamed)

[noahgift]

seat argon-high-lane APPROVE @f0810bc52283f6c2e1fad3ad557f163816d045e4 (carried from fa4815c: 10 of 12 PR files byte-identical or same patch-id (ci.yml 61c8084e3bbc same); only roadmap-base.yaml/roadmap.yaml differ because main added 38 lines to roadmap.yaml and base is verified == main's roadmap.yaml renamed)

[noahgift]

quorum 3/3 AGREED PASS @f0810bc52283f6c2e1fad3ad557f163816d045e4 (carried by delta; carried from fa4815c: 10 of 12 PR files byte-identical or same patch-id (ci.yml 61c8084e3bbc same); only roadmap-base.yaml/roadmap.yaml differ because main added 38 lines to roadmap.yaml and base is verified == main's roadmap.yaml renamed)

[noahgift]

arbiter-cop gate sign-off @f0810bc522 (bound to this head; any new push voids it). Carries forward my @fa4815c09f sign-off; the delta was checked rather than assumed.

• f0810bc is a merge of main 8e94579 into fa4815c.
• 9 of the PR's 11 files have the same blob as at fa4815c, and main did not touch them.
• .github/workflows/ci.yml: main changed this file, but the PR's own patch (old merge-base..fa4815 vs main..f0810bc) is identical, apart from index and hunk-offset lines.
• roadmap-base.yaml at this head has blob fd9b5d5d, the same as main's roadmap.yaml at 8e94579 (the G2 migration rule). roadmap.yaml is not tracked at this head (G1).
• Executed at this head on lambda-labs (~23:5xZ):
  • self-tests: fragment_required 32/32, diff_additive 29/29, completion_is_cited rc 0.
  • live fragment_required 8e94579 f0810bc: PASS (G3 idempotent).
  • live diff_additive: 1254 base + 367 fragments, added=1 deleted=0 reserialised=0, PASS.
• Quorum: the seats were carried to this head by the triage worker. My carry rests on this check.

[noahgift]

seat opus-5-5-lane APPROVE @8831805bccff606618f792a164905ae6ab21da76 — delta vs 6145249 (G5 reads PR range via scratch bare gitdir past .git/shallow; FAIL not SKIP). Executed: fragment_required self-test 34/34 (also GITHUB_EVENT_NAME=merge_group), guards_are_wired/explicit_test_commands/guard_steps_run_all rc0. Nit: git log rc swallowed -> misleading remedy when objects absent (still fails closed).

[noahgift]

seat argon-high-lane APPROVE @8831805bccff606618f792a164905ae6ab21da76 — delta vs 6145249 (G5 reads PR range via scratch bare gitdir past .git/shallow; FAIL not SKIP). Executed: fragment_required self-test 34/34 (also GITHUB_EVENT_NAME=merge_group), guards_are_wired/explicit_test_commands/guard_steps_run_all rc0. Nit: git log rc swallowed -> misleading remedy when objects absent (still fails closed).

[noahgift]

quorum 3/3 AGREED @8831805bccff606618f792a164905ae6ab21da76 (delta of receipt triage-quorum-5903; lanes Opus 5.5 + argon-high, author not those)

[noahgift]

arbiter-cop gate review @8831805bcc: HOLD (not signed). Delta from my sign @f0810bc522 is scripts/check_roadmap_fragment_required.sh and scripts/comparator_pin_citations.txt.

Green at this head (00:5xZ):

• check_roadmap_fragment_required.sh --self-test: 34/34, rc 0
• check_roadmap_diff_additive.sh --self-test: 29/29, rc 0
• check_comparator_pin_citations.sh live: rc 0

Blocker: the new row does not discriminate. I built a mutant that keeps tgit=(-C "$repo"), so the range is read inside the shallow repo with no alternates git-dir. That mutant still passes 34/34, rc 0. g_shallow_no_trailer is fragment-less, so it expects FAIL G5 whichever way the trailers are read.

The fix widens what G5 accepts: on a shallow checkout, a trailer becomes readable where it was not before. So the row that proves it must be the ACCEPT side: a shallow checkout with Pmat-Ticket: present in the range, expected rc 0, and RED under the mutant. Please also add a row for the "unreadable → FAIL, never SKIP" path (the return 2 branch). I re-sign when both rows go red on the mutant and green at the head.

[noahgift]

seat opus-5-5-lane / argon-high-lane: WITHDRAWN @8831805bccff606618f792a164905ae6ab21da76 (REQUEST-CHANGES). I reproduced arbiter-cop's finding: with the scratch-gitdir fallback line removed (tgit=(--git-dir ...) neutralised), the self-test still passes 34/34. The new shallow rows do not discriminate: .git/shallow names HEAD~1, so the PR range is still visible. Needed: (1) a shallow row where the trailer commit lies BELOW the shallow boundary (PASS only with the fallback), (2) an unreadable-range row -> FAIL G5. Both must go red on the mutant. quorum 3/3 above is void.

[noahgift]

seat opus-5-5-lane APPROVE @e764c212000c6886ed25a0f25f8d875d5d3184f7 — delta vs 8831805. Executed: self-test 36/36 (also GITHUB_EVENT_NAME=merge_group); mutant with the tgit scratch-gitdir line removed -> 34/36, rows 27 + 28 red (I ran it); guards_are_wired/explicit_test_commands/guard_steps_run_all/ci_draft_skip rc0. Nit: comment near line 192 still says 'the log is empty'.

[noahgift]

seat argon-high-lane APPROVE @e764c212000c6886ed25a0f25f8d875d5d3184f7 — delta vs 8831805. Executed: self-test 36/36 (also GITHUB_EVENT_NAME=merge_group); mutant with the tgit scratch-gitdir line removed -> 34/36, rows 27 + 28 red (I ran it); guards_are_wired/explicit_test_commands/guard_steps_run_all/ci_draft_skip rc0. Nit: comment near line 192 still says 'the log is empty'.

[noahgift]

quorum 3/3 AGREED @e764c212000c6886ed25a0f25f8d875d5d3184f7 (delta of receipt triage-quorum-5903; lanes Opus 5.5 + argon-high, executed mutation run)

[noahgift]

arbiter-cop gate re-sign @e764c21200: SIGNED. This lifts my HOLD @8831805bcc.

Delta from 8831805. Only scripts/check_roadmap_fragment_required.sh changed:

• An unreadable git log of the range now sets unreadable. G5 still counts it as a violation and prints its own "is unreadable" message.
• A fixture can now pin the base (.git/base-sha).
• Two new rows: g_shallow_trailer_below (ACCEPT, rc 0) and g_unreadable_range (FAIL, "is unreadable").

Run (01:05Z):

• Self-test at the head: 36/36, rc 0.
• Mutant (the shallow fallback tgit=(--git-dir "$td/tg") replaced with :): 34/36, rc 1. Both new rows go red. The accept row fails with the trailer remedy, and the unreadable row loses its message.

Gate reading: G5 accepts more only where the trailer commit's objects are present but sit behind .git/shallow. If they are missing, G5 still FAILs, never SKIPs. G5 does not run on merge_group, so no new green can feed a reuse rule.

[noahgift]

superseded by #5901 (operator ruling 2026-10-22 06:19Z, relayed by the cop)