[WRONG BRANCH] Require trusted GitHub Actions ci check before marking contributor PRs ready

.github/scripts/pr-quality-messages.cjs

@@ -259,10 +259,14 @@ function failureSummary(failures, { pr }) {
 }
 
 /** The notice shown when the gate's own claim check disproves a ticked box. */
-function buildClaimCheckNotice(violations, _liveHeadSha) {
+function buildClaimCheckNotice(violations, liveHeadSha) {
   const lines = [];
   for (const code of violations) {
-    if (code === "latest_dev") {
+    if (code === "ci_green") {
+      lines.push(
+        `GitHub CI is not green on the current head ${inlineCode(liveHeadSha.slice(0, 7))}; the **CI green** box has been unticked.`
+      );
+    } else if (code === "latest_dev") {
       lines.push(
         `The PR is more than ${READINESS_LATEST_DEV_BEHIND_MAX} commits behind ${inlineCode("dev")}; the **latest dev** box has been unticked.`
       );

.github/scripts/pr-quality-messages.test.cjs

@@ -213,21 +213,23 @@ describe("buildStaleNotice", () => {
 });
 
 describe("buildClaimCheckNotice", () => {
-  it("names the latest-dev violation and the reset action", () => {
+  it("names each violated claim and the reset action", () => {
     const notice = buildClaimCheckNotice(
-      ["latest_dev"],
+      ["ci_green", "latest_dev"],
       "3f1c0de0a6a4d0a3f9a1b2c3d4e5f60718293a4b",
     );
-    assert.match(notice[0], /more than 10 commits behind `dev`/);
-    assert.match(notice[0], /\*\*latest dev\*\* box has been unticked/);
-    assert.match(notice[1], /reset: re-test against the latest code/);
+    assert.match(notice[0], /CI is not green on the current head `3f1c0de`/);
+    assert.match(notice[0], /\*\*CI green\*\* box has been unticked/);
+    assert.match(notice[1], /more than 10 commits behind `dev`/);
+    assert.match(notice[1], /\*\*latest dev\*\* box has been unticked/);
+    assert.match(notice[2], /reset: re-test against the latest code/);
   });
 
-  it("ignores a stale ci_green code without inventing GitHub-CI copy", () => {
+  it("handles a single violation", () => {
     const notice = buildClaimCheckNotice(["ci_green"], "a".repeat(40));
-    assert.equal(notice.length, 1);
-    assert.match(notice[0], /has been reset/);
-    assert.doesNotMatch(notice[0], /CI is not green/);
+    assert.equal(notice.length, 2);
+    assert.match(notice[0], /CI is not green/);
+    assert.match(notice[1], /has been reset/);
   });
 
   it("returns only the reset line for an empty violation list", () => {

.github/scripts/pr-quality-state.cjs

@@ -201,21 +201,23 @@ function migrateLegacyGateState(enforcerState, readinessState) {
  */
 
 /**
- * Bot-side verification of the checklist claim the gate can check itself for
- * ancestry. The local-CI box is an author attestation only (fork contributors
- * cannot start repository CI; a maintainer has to), so it is never disproved
- * here — head-drift still resets every box after a new push. The latest-dev
- * box only holds while the head is at most READINESS_LATEST_DEV_BEHIND_MAX
- * commits behind the base. Unknown state (compare lookup failed) fails closed:
- * an unverifiable claim is a violation, because an attestation must not ride
- * on missing evidence.
+ * Bot-side verification of the two checklist claims the gate can check itself.
+ * The CI box only holds when the head's `ci` check is green, and the
+ * latest-dev box only holds while the head is at most
+ * READINESS_LATEST_DEV_BEHIND_MAX commits behind the base. Unknown state
+ * (compare or checks lookup failed) fails closed: an unverifiable claim is a
+ * violation, because an attestation must not ride on missing evidence.
  */
 function readinessClaimViolations({
+  ciGreen,
   behindBase,
   behindUnknown = false,
   behindMax = READINESS_LATEST_DEV_BEHIND_MAX
 }) {
   const violations = [];
+  if (!ciGreen) {
+    violations.push("ci_green");
+  }
   if (behindUnknown || behindBase > behindMax) {
     violations.push("latest_dev");
   }

.github/scripts/pr-quality-state.test.cjs

@@ -229,31 +229,48 @@ describe("completionIsStale", () => {
 });
 
 describe("readinessClaimViolations", () => {
-  it("passes when the head is current enough", () => {
-    assert.deepEqual(readinessClaimViolations({ behindBase: 0 }), []);
-    assert.deepEqual(readinessClaimViolations({ behindBase: 10 }), []);
+  it("passes when CI is green and the head is current", () => {
+    assert.deepEqual(
+      readinessClaimViolations({ ciGreen: true, behindBase: 0 }),
+      [],
+    );
+    assert.deepEqual(
+      readinessClaimViolations({ ciGreen: true, behindBase: 10 }),
+      [],
+    );
   });
 
-  it("never treats local CI as a bot-verifiable claim", () => {
-    // Fork contributors attest local green; repository CI is maintainer-started.
+  it("flags red CI", () => {
     assert.deepEqual(
-      readinessClaimViolations({ behindBase: 0, ciGreen: false }),
-      [],
+      readinessClaimViolations({ ciGreen: false, behindBase: 0 }),
+      ["ci_green"],
     );
   });
 
   it("flags a head more than the threshold behind the base", () => {
     assert.deepEqual(
       readinessClaimViolations({
+        ciGreen: true,
         behindBase: READINESS_LATEST_DEV_BEHIND_MAX + 1,
       }),
       ["latest_dev"],
     );
   });
 
+  it("flags both when both claims fail", () => {
+    assert.deepEqual(
+      readinessClaimViolations({
+        ciGreen: false,
+        behindBase: READINESS_LATEST_DEV_BEHIND_MAX + 20,
+      }),
+      ["ci_green", "latest_dev"],
+    );
+  });
+
   it("fails closed when the behind count is unknown", () => {
     assert.deepEqual(
       readinessClaimViolations({
+        ciGreen: true,
         behindBase: 0,
         behindUnknown: true,
       }),
@@ -263,7 +280,7 @@ describe("readinessClaimViolations", () => {
 
   it("honours a custom threshold", () => {
     assert.deepEqual(
-      readinessClaimViolations({ behindBase: 5, behindMax: 4 }),
+      readinessClaimViolations({ ciGreen: true, behindBase: 5, behindMax: 4 }),
       ["latest_dev"],
     );
   });

.github/scripts/pr-quality.cjs

@@ -33,12 +33,11 @@ const REVIEW_READINESS_ITEMS = [
 
 /**
  * Which checklist box each bot-verifiable claim maps to. The order must stay
- * in sync with REVIEW_READINESS_ITEMS: index 1 is the latest-dev claim and
- * index 2 is the Codex/CodeRabbit findings claim. Index 0 (local CI) is an
- * author attestation only — fork contributors cannot start repository CI — so
- * the gate never disproves it; head-drift still resets every box.
+ * in sync with REVIEW_READINESS_ITEMS: index 0 is the CI claim, index 1 is
+ * the latest-dev claim, and index 2 is the Codex/CodeRabbit findings claim.
  */
 const REVIEW_READINESS_CLAIM_INDEX = {
+  ci_green: 0,
   latest_dev: 1,
   review_findings: 2
 };

.github/scripts/pr-quality.test.cjs

@@ -586,16 +586,16 @@ describe("uncheckReviewReadinessBoxes", () => {
 
   it("unchecks only the requested boxes", () => {
     const body = uncheckReviewReadinessBoxes(checkedBody, [
-      REVIEW_READINESS_CLAIM_INDEX.latest_dev,
+      REVIEW_READINESS_CLAIM_INDEX.ci_green,
     ]);
-    assert.ok(body.includes("- [x] All CI tests are green on my local testing."));
-    assert.ok(body.includes("- [ ] I pushed my PR to the latest dev commit."));
+    assert.ok(body.includes("- [ ] All CI tests are green on my local testing."));
+    assert.ok(body.includes("- [x] I pushed my PR to the latest dev commit."));
     assert.ok(body.includes("- [x] My PR is ready for review."));
   });
 
   it("can uncheck several boxes at once", () => {
     const body = uncheckReviewReadinessBoxes(checkedBody, [
-      0,
+      REVIEW_READINESS_CLAIM_INDEX.ci_green,
       REVIEW_READINESS_CLAIM_INDEX.latest_dev,
     ]);
     assert.ok(body.includes("- [ ] All CI tests are green on my local testing."));

.github/workflows/enforce-pr-target.yml

@@ -841,16 +841,14 @@ jobs:
               checklistComplete = readiness.present && readiness.complete;
             }
 
-            // The bot verifies the checklist claims it can check itself. The
-            // local-CI box is an author attestation only — fork contributors
-            // cannot start repository CI (a maintainer has to) — so the gate
-            // never disproves it; head-drift still resets every box after a
-            // new push. The latest-dev box only counts while the head is at
-            // most READINESS_LATEST_DEV_BEHIND_MAX commits behind the base;
-            // the findings box only counts while every Codex/CodeRabbit
-            // review thread on the PR is resolved. A disproved claim unchecks
-            // that box and keeps the PR a draft, exactly like a head-drift
-            // reset.
+            // The bot verifies the three checklist claims it can check itself.
+            // The CI box only counts when the head's `ci` check (the repo's
+            // documented "CI passed" signal) is green; the latest-dev box only
+            // counts while the head is at most READINESS_LATEST_DEV_BEHIND_MAX
+            // commits behind the base; the findings box only counts while every
+            // Codex/CodeRabbit review thread on the PR is resolved. A disproved
+            // claim unchecks that box and keeps the PR a draft, exactly like a
+            // head-drift reset.
             let claimViolations = [];
             let claimNotice = [];
             if (
@@ -859,7 +857,52 @@ jobs:
               !headDrifted &&
               failures.length === 0
             ) {
+              let ciGreen = false;
+              try {
+                // GitHub Actions' immutable App ID. Name alone is not evidence:
+                // any installed app can publish a check called `ci`.
+                const githubActionsAppId = 15368;
+                const { data: checksData } =
+                  await github.rest.checks.listForRef({
+                    owner,
+                    repo,
+                    ref: pr.head.sha,
+                    app_id: githubActionsAppId,
+                    check_name: "ci",
+                    filter: "latest",
+                    per_page: 100
+                  });
+                const checkRuns = Array.isArray(checksData.check_runs)
+                  ? checksData.check_runs
+                  : [];
+                const ciChecks = checkRuns.filter(
+                  check =>
+                    check.name === "ci" &&
+                    check.app?.id === githubActionsAppId
+                );
+                // The readiness claim requires positive CI evidence. A missing,
+                // pending, unsuccessful, foreign, or conflicting aggregate
+                // check must fail closed. The exact app/name/latest query should
+                // be tiny; if GitHub reports more rows than this response holds,
+                // treat the truncated evidence as unreadable rather than paging
+                // through an endpoint whose filters already select the latest run.
+                ciGreen =
+                  Number.isSafeInteger(checksData.total_count) &&
+                  checksData.total_count === checkRuns.length &&
+                  ciChecks.length > 0 &&
+                  ciChecks.every(
+                    check =>
+                      check.status === "completed" &&
+                      check.conclusion === "success"
+                  );
+              } catch (error) {
+                core.warning(
+                  `Could not list checks for the readiness claim check: ${error.message}`
+                );
+                ciGreen = false;
+              }
               claimViolations = readinessClaimViolations({
+                ciGreen,
                 behindBase,
                 behindUnknown: ancestryLookupFailed
               });

AGENTS.md

@@ -192,13 +192,10 @@ listed in `MAINTAINERS.md` (excluding the author). Completion is bound to the
 exact commit the PR head pointed at: if new commits are pushed afterwards, the
 gate moves the PR back to draft, resets the checklist and the notification,
 and asks the author to test and tick the boxes again against the latest code.
-Before a completion is accepted, the gate verifies the checklist claims it
-can check itself: the branch must be on the latest `dev` commit or at most
-10 commits behind it, and Codex/CodeRabbit findings must be resolved. The
-local-CI box is an author attestation only — fork contributors cannot start
-repository CI; a maintainer has to — so the gate never disproves it; a new
-push still resets every box. A disproved claim unticks the matching box and
-keeps the PR a draft.
+Before a completion is accepted, the gate verifies the two checklist claims it
+can check itself: the head's `ci` check must be green, and the branch must be
+on the latest `dev` commit or at most 10 commits behind it. A disproved claim
+unticks the matching box and keeps the PR a draft.
 Authors with repository push permission skip the ancestry heuristic only. As with approval requirements in
 [`MAINTAINERS.md`](./MAINTAINERS.md), this is enforced by convention until
 branch protection is configured.

MAINTAINERS.md

@@ -35,13 +35,10 @@ see [The retired `dev2-go` line](#the-retired-dev2-go-line).
   commits are pushed afterwards, the gate moves the PR back to draft, resets
   the checklist and the notification, and asks the author to test and tick the
   boxes again against the latest code.
-  Before a completion is accepted, the gate verifies the checklist claims
-  it can check itself: the branch must be on the latest `dev` commit or at
-  most 10 commits behind it, and Codex/CodeRabbit findings must be resolved.
-  The local-CI box is an author attestation only — fork contributors cannot
-  start repository CI; a maintainer has to — so the gate never disproves it;
-  a new push still resets every box. A disproved claim unticks the matching
-  box and keeps the PR a draft.
+  Before a completion is accepted, the gate verifies the two checklist claims
+  it can check itself: the head's `ci` check must be green, and the branch
+  must be on the latest `dev` commit or at most 10 commits behind it. A
+  disproved claim unticks the matching box and keeps the PR a draft.
   Authors with repository push permission skip the ancestry heuristic only. As
   with the approval requirement above, this is enforced by convention until
   branch protection is configured (see the note under the change log).

docs-site/src/content/docs/contributing/pr-quality.md

@@ -64,12 +64,10 @@ tells you exactly what to change:
   `dev` clears the wrong-branch message automatically and is remembered by the
   gate; the draft stays until the checklist is complete.
   Before a completion is accepted, the gate verifies the checklist claims it
-  can check itself: the branch must be on the latest `dev` commit or at most
-  10 commits behind it, and every Codex and CodeRabbit review thread authored
-  by a review bot on the current head must be resolved (unresolved threads
-  from other authors do not block). The local-CI box is an author attestation
-  only — fork contributors cannot start repository CI; a maintainer has to —
-  so the gate never disproves it; a new push still resets every box. CodeRabbit
+  can check itself: the head's `ci` check must be green, the branch must be on
+  the latest `dev` commit or at most 10 commits behind it, and every Codex and
+  CodeRabbit review thread authored by a review bot on the current head must be
+  resolved (unresolved threads from other authors do not block). CodeRabbit
   findings that fall outside the diff range and are reported only in a review
   body on the current head add to the unresolved count while a bot review
   thread is open; resolving every bot thread clears the box. A disproved claim