SECURITY-169-API-37: close train state

[fermatmind]

What changed

• Marked SECURITY-169-API-37 merged in the PR-train state ledger.
• Recorded implementation commit, PR merge evidence, and local/remote cleanup completion.

Why

The implementation PR is merged and post-merge revalidation is complete; the train ledger must be durable before API38 starts.

Validation

• python3 -m json.tool docs/codex/pr-train-state.json
• single-file ledger scope validation
• git diff --check

Deferred items

• Runtime route, migration, curl, and MBTI commands are not applicable to this docs-only closeout.
• No staging wait, CMS/search write, production import, manual deploy, or production deploy was executed.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 99d1a7b9c2

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Record the closed item's commit SHA

This closure marks SECURITY-169-API-37 as merged and adds merge evidence, but the same object still has commit_sha: null just above. The repository ledger rules require commit_sha to be updated for state transitions, and leaving the merged item without durable SHA evidence makes the API-38 dependency appear closed with incomplete audit data. Please populate commit_sha with the implementation or squash-merge SHA when closing this item.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Remove the unrelated Enneagram SHA update

This SECURITY-169 closeout also writes a concrete SHA into ENNEAGRAM-EN13-BILINGUAL-PRODUCTION-REVALIDATION-01 even though that item remains pending_dependency with no PR URL, checks, or transitions. Because the Enneagram revalidation is outside this closeout scope, the ledger now contains unexplained execution evidence for a still-blocked task, which can mislead future train handoff or audit work. Please revert this line or move it to the scoped Enneagram state update.

Useful? React with 👍 / 👎.