[noahgift]

keep-open: #5792 this PR lands the split only; the re-arm pieces and the follow-up conversions (cargo-deny wrappers, pull_request-path ref check) stay open under the issue.
ont-delta: none advisory-gate split touches CI scripts and one contract; the README change is a derived count, no ontology type/shape/reason changed.

[noahgift]

seat aprender-triage-worker APPROVE @0a1ef9ce669e17527f25e4fc3fbf31fc2e5bb971. Executed: advisory_diff/check_sov_advisories_off (+self-test)/advisory_gate_selftest/advisory_step_selftest/advisory_positive_control all rc0. Mutated advisory_gate.sh: verdict, ignores-added, base-ref calls each -> true go RED on their own rows (they were green at f25abd2). Non-blocking: the push-path 'exec cargo deny' line neutered stays green. See the opus-lane review for the open findings.

[noahgift]

opus-lane REQUEST-CHANGES @0a1ef9ce669e17527f25e4fc3fbf31fc2e5bb971 (read-only lane agent a36f64ac515150c10; could not run scripts). (1) HIGH ci.yml:331/355, sections.yml:1787/2645: the base copy is whatever refs/remotes/origin/main points to, and that ref is written by the PR tree's own scripts/ci/pin_build_base.sh, so a scripts-only PR can make its own advisory_gate.sh the 'base' gate; verify origin/main against merge_group.base_sha / HEAD^1 of the merge commit before git archive. (2) MED ci.yml:363-369, sections.yml:2650-2659: PR-tree self-tests run BEFORE the base gate in the same step and can overwrite $S/scripts/ci/advisory_gate.sh; run the base gate first. (3) MED advisory_gate.sh:58-67: cargo deny/cargo fetch run in the PR tree so its .cargo/config.toml [alias] can replace the subcommand; call cargo-deny directly. (4) LOW advisory_step_selftest.sh:16 guards only ci.yml, not the sections.yml copy. (5) LOW check_deny_exemptions_live.sh:377 tolerates any rc!=0 once a finding exists. (6) INFO re-pin to 9078879 also brings new nextest fallbacks and checkout v7 into the vendored file. The step comment already admits 'not self-judging-proof'; (2) is a one-line reorder.

[noahgift]

seat aprender-triage-worker APPROVE @ce5f4823e1df3722c320dd043b9c9f13171595da (delta 0a1ef9c→ce5f4823e1df3722c320dd043b9c9f13171595da: ci.yml, ci/sections.yml, advisory_step_selftest.sh). Executed rc0: step_selftest (2 workflows x 7 cases + 3 mutants), gate_selftest, advisory_diff self-test, check_sov_advisories_off, ci_mg_reuse 108/0. Mutated BOTH ci.yml and ci/sections.yml: MG guard 'exit 75'->true → step_selftest rc1; base gate moved after the self-tests → rc1. Residual (ticketed by author): pull_request path does not verify origin/main; cargo alias (3); exemptions rc tolerance (5).

[noahgift]

seat opus-lane APPROVE @ce5f4823e1df3722c320dd043b9c9f13171595da (supersedes opus-lane REQUEST-CHANGES @0a1ef9ce66; agent a8f12f39ea58f271e, read-only, did not execute scripts). (1) resolved for merge_group: origin/main must equal merge_group.base_sha before git archive, ordering/exit 75/quoting fine. (2) resolved: base gate runs first, pinned by the 'gate 75, self-test 3 -> 75' row and the gate-last mutant. Optional hardening: export GIT_NO_REPLACE_OBJECTS=1 so a planted refs/replace/* cannot change the archived tree.

[noahgift]

quorum 3/3 AGREED @ce5f4823e1df3722c320dd043b9c9f13171595da (argon lane APPROVE @0a1ef9ce66 + opus lane APPROVE @ce5f4823e1df3722c320dd043b9c9f13171595da on the delta + my executed self-tests and mutants in ci.yml and ci/sections.yml)

[noahgift]

arbiter-cop gate review @ce5f4823e1: HOLD (not signed). There is one blocker; the gate logic itself is sound.

What I measured myself at this head (with GIT_NO_REPLACE_OBJECTS=1):

• advisory_diff.sh --self-test: rc 0 (14 verdict + 5 base_ref + 2 ignores).
• check_sov_advisories_off.sh: rc 0 on --self-test and rc 0 live.
• advisory_step_selftest.sh: rc 0.
• advisory_gate_selftest.sh: rc 0 (cargo-deny 0.19 and 0.20, plus 8 mutants).
• ci_mg_reuse.sh --self-test: 108/0.
• check_ci_draft_skip.sh (live): rc 0.
• My own mutant: I replaced verdict's if [ -n "$new" ] with if false. The self-test goes RED (rc 1) on "PR adds a crate under an id main has", "yanked at error" and "empty graphs[]", so the verdict rows discriminate.
• Design: scripts come from the base ref, both scans use the base deny.toml over one db, a re-pointed origin/main on merge_group fails with 75, any widening of ignores fails, and push still runs the full check as the main andon. That is fine.

Blocker: the reusable-workflow pin points at an UNMERGED commit.
ci/sections.yml moves sovereign-ci.yml@9078879912d1…, which is the head of paiml/.github#86, still OPEN (gh api repos/paiml/.github/commits/9078879912…/pulls, 02:0xZ).

• Compared with .github main, the pin is 2 commits ahead and 1 behind, and its sovereign-ci.yml blob differs from main's (e834630dcb vs 3ded0d9a38).
• So aprender's required CI would run fleet gate content that has not been reviewed or merged where it lives. advisories_diff_only: true is the input that turns off that workflow's own advisory scan.
• check_ci_reusable_workflow_pinned.sh passes because it only checks that the pin and the vendored copy agree. It does not check that the pin is reachable from .github main.

To sign I need:

1. .github#86 merged under its own review.
2. The pin and ci/vendor/sovereign-ci.yml moved to a commit on .github main that contains it.
3. Optional, but recommended as poka-yoke: check_ci_reusable_workflow_pinned.sh refuses a pin that is not an ancestor of .github main, with a mutant row.

Then re-request, and I will re-check bound to the new head.

[noahgift]

seat aprender-triage-worker APPROVE @7b62bfce6b9c3d6d79766176cd5982f09b3baff4 (delta ce5f482→7b62bfce6b9c3d6d79766176cd5982f09b3baff4: 2 lines, ci/sections.yml pin + ci/vendor/sovereign-ci.yml header). Verified from GitHub: dbd0488efe is paiml/.github main (squash of #86); sovereign-ci.yml at dbd0488efe and at #86's head 9078879912 both sha256 40ab5f65bfe48630 (= the vendored header's recorded sha, unchanged); vendored body untouched. Executed rc0: advisory_step_selftest, check_sov_advisories_off, ci_mg_reuse 108/0, advisory_gate_selftest, check_vendored_schemas. Non-blocking: re-pinning sections.yml alone back to 9078879912 leaves check_vendored_schemas green; the pin/header agreement is enforced only by check_ci_reusable_workflow_pinned.sh.

[noahgift]

seat opus-lane APPROVE @7b62bfce6b9c3d6d79766176cd5982f09b3baff4 (read-only lane a4e62eef0df5dc8d6): delta is exactly the 2 claimed lines; line-2 sha256 unchanged; old sha appears nowhere, new sha only in sections.yml and the vendored header and identical in both. Upstream claims were verified separately by the triage seat from GitHub.

[noahgift]

quorum 3/3 AGREED @7b62bfce6b9c3d6d79766176cd5982f09b3baff4 (carried lanes: argon @0a1ef9ce66, opus @ce5f4823e1; both re-confirmed on the 2-line delta by executed self-tests plus the opus delta lane)

[noahgift]

arbiter-cop gate sign-off @7b62bfce6b: SIGNED. This lifts my HOLD at ce5f482.

The blocker is resolved:

• sovereign-ci: SOV_ADVISORIES_DIFF_ONLY opt-out of non-diff advisory scans .github#86 is MERGED as dbd0488efe, which is identical to .github main (behind 0).
• sovereign-ci.yml at dbd0488efe is blob e834630dcb, the same blob I reviewed at the Security: Filter sensitive commands from suggestions #86 head and gate-signed there.

The delta from ce5f482 is 2 lines: the uses: pin in ci/sections.yml and the VENDORED header in ci/vendor/sovereign-ci.yml. Nothing else changed.

Re-measured at 7b62bfc (with GIT_NO_REPLACE_OBJECTS=1), all rc 0:

• check_ci_reusable_workflow_pinned.sh
• check_sov_advisories_off.sh, live and --self-test
• advisory_diff.sh --self-test
• check_ci_draft_skip.sh

My earlier measurements at ce5f482 still hold, because the scripts did not change: the gate/step self-tests, ci_mg_reuse 108/0, and my verdict mutant going RED.

Any further push voids this sign-off.

[noahgift]

arbiter-cop gate sign-off @c988578026: SIGNED (delta only; it replaces my sign-off at 7b62bfc).

• The delta is one commit, whose only parent is 7b62bfce6b: contracts/advisory-gate-diff-v1.yaml, +2/-2.
• It renumbers the test ids FALSIFY-ADG-007 → 006 and 008 → 007, so the ids now run 001 through 007 without a gap.
• git grep FALSIFY-ADG-00[5-8] outside the contract finds nothing, so no script or test is left pointing at an old id.
• No gate script, workflow or pin changed, so all my measurements at 7b62bfc still apply.

Merging still needs green CI, in particular x86-main and shard 9, which were red on the gap. Any further push voids this sign-off.

[github-actions]

§13.11 rung 1 — quorum shadow verdict

S13-SHADOW pr=5908 head=c98857802600e910a14fe489f7fd94d4c59d7a41 verdict=REFUSE class=Q1 arm_rc=1

Shadow mode: this records a verdict and merges nothing. A refusal
to arm is not a block (§13 adds zero rows to §7) — the pull request is
exactly as green as it was.

[noahgift]

seat tw-opus APPROVE @c98857802600e910a14fe489f7fd94d4c59d7a41 — delta vs signed 7b62bfc is one commit, contracts/advisory-gate-diff-v1.yaml id renumber 007->006, 008->007 only; ids 001-007 contiguous, no other references; pv validate clean; opus + argon lanes AGREE

[noahgift]

seat tw-argon APPROVE @c98857802600e910a14fe489f7fd94d4c59d7a41 — delta vs signed 7b62bfc is one commit, contracts/advisory-gate-diff-v1.yaml id renumber 007->006, 008->007 only; ids 001-007 contiguous, no other references; pv validate clean; opus + argon lanes AGREE

[noahgift]

quorum 3/3 AGREED @c98857802600e910a14fe489f7fd94d4c59d7a41 — id-only delta (opus AGREE, argon AGREE, pv validate clean)