[WRONG BRANCH] fix(responses): prevent cross-request reasoning replay

.github/scripts/pr-quality-messages.cjs

@@ -259,14 +259,10 @@ function failureSummary(failures, { pr }) {
 }
 
 /** The notice shown when the gate's own claim check disproves a ticked box. */
-function buildClaimCheckNotice(violations, liveHeadSha) {
+function buildClaimCheckNotice(violations, _liveHeadSha) {
   const lines = [];
   for (const code of violations) {
-    if (code === "ci_green") {
-      lines.push(
-        `GitHub CI is not green on the current head ${inlineCode(liveHeadSha.slice(0, 7))}; the **CI green** box has been unticked.`
-      );
-    } else if (code === "latest_dev") {
+    if (code === "latest_dev") {
       lines.push(
         `The PR is more than ${READINESS_LATEST_DEV_BEHIND_MAX} commits behind ${inlineCode("dev")}; the **latest dev** box has been unticked.`
       );

.github/scripts/pr-quality-messages.test.cjs

@@ -213,23 +213,21 @@ describe("buildStaleNotice", () => {
 });
 
 describe("buildClaimCheckNotice", () => {
-  it("names each violated claim and the reset action", () => {
+  it("names the latest-dev violation and the reset action", () => {
     const notice = buildClaimCheckNotice(
-      ["ci_green", "latest_dev"],
+      ["latest_dev"],
       "3f1c0de0a6a4d0a3f9a1b2c3d4e5f60718293a4b",
     );
-    assert.match(notice[0], /CI is not green on the current head `3f1c0de`/);
-    assert.match(notice[0], /\*\*CI green\*\* box has been unticked/);
-    assert.match(notice[1], /more than 10 commits behind `dev`/);
-    assert.match(notice[1], /\*\*latest dev\*\* box has been unticked/);
-    assert.match(notice[2], /reset: re-test against the latest code/);
+    assert.match(notice[0], /more than 10 commits behind `dev`/);
+    assert.match(notice[0], /\*\*latest dev\*\* box has been unticked/);
+    assert.match(notice[1], /reset: re-test against the latest code/);
   });
 
-  it("handles a single violation", () => {
+  it("ignores a stale ci_green code without inventing GitHub-CI copy", () => {
     const notice = buildClaimCheckNotice(["ci_green"], "a".repeat(40));
-    assert.equal(notice.length, 2);
-    assert.match(notice[0], /CI is not green/);
-    assert.match(notice[1], /has been reset/);
+    assert.equal(notice.length, 1);
+    assert.match(notice[0], /has been reset/);
+    assert.doesNotMatch(notice[0], /CI is not green/);
   });
 
   it("returns only the reset line for an empty violation list", () => {

.github/scripts/pr-quality-state.cjs

@@ -201,23 +201,21 @@ function migrateLegacyGateState(enforcerState, readinessState) {
  */
 
 /**
- * Bot-side verification of the two checklist claims the gate can check itself.
- * The CI box only holds when the head's `ci` check is green, and the
- * latest-dev box only holds while the head is at most
- * READINESS_LATEST_DEV_BEHIND_MAX commits behind the base. Unknown state
- * (compare or checks lookup failed) fails closed: an unverifiable claim is a
- * violation, because an attestation must not ride on missing evidence.
+ * Bot-side verification of the checklist claim the gate can check itself for
+ * ancestry. The local-CI box is an author attestation only (fork contributors
+ * cannot start repository CI; a maintainer has to), so it is never disproved
+ * here — head-drift still resets every box after a new push. The latest-dev
+ * box only holds while the head is at most READINESS_LATEST_DEV_BEHIND_MAX
+ * commits behind the base. Unknown state (compare lookup failed) fails closed:
+ * an unverifiable claim is a violation, because an attestation must not ride
+ * on missing evidence.
  */
 function readinessClaimViolations({
-  ciGreen,
   behindBase,
   behindUnknown = false,
   behindMax = READINESS_LATEST_DEV_BEHIND_MAX
 }) {
   const violations = [];
-  if (!ciGreen) {
-    violations.push("ci_green");
-  }
   if (behindUnknown || behindBase > behindMax) {
     violations.push("latest_dev");
   }

.github/scripts/pr-quality-state.test.cjs

@@ -229,48 +229,31 @@ describe("completionIsStale", () => {
 });
 
 describe("readinessClaimViolations", () => {
-  it("passes when CI is green and the head is current", () => {
-    assert.deepEqual(
-      readinessClaimViolations({ ciGreen: true, behindBase: 0 }),
-      [],
-    );
-    assert.deepEqual(
-      readinessClaimViolations({ ciGreen: true, behindBase: 10 }),
-      [],
-    );
+  it("passes when the head is current enough", () => {
+    assert.deepEqual(readinessClaimViolations({ behindBase: 0 }), []);
+    assert.deepEqual(readinessClaimViolations({ behindBase: 10 }), []);
   });
 
-  it("flags red CI", () => {
+  it("never treats local CI as a bot-verifiable claim", () => {
+    // Fork contributors attest local green; repository CI is maintainer-started.
     assert.deepEqual(
-      readinessClaimViolations({ ciGreen: false, behindBase: 0 }),
-      ["ci_green"],
+      readinessClaimViolations({ behindBase: 0, ciGreen: false }),
+      [],
     );
   });
 
   it("flags a head more than the threshold behind the base", () => {
     assert.deepEqual(
       readinessClaimViolations({
-        ciGreen: true,
         behindBase: READINESS_LATEST_DEV_BEHIND_MAX + 1,
       }),
       ["latest_dev"],
     );
   });
 
-  it("flags both when both claims fail", () => {
-    assert.deepEqual(
-      readinessClaimViolations({
-        ciGreen: false,
-        behindBase: READINESS_LATEST_DEV_BEHIND_MAX + 20,
-      }),
-      ["ci_green", "latest_dev"],
-    );
-  });
-
   it("fails closed when the behind count is unknown", () => {
     assert.deepEqual(
       readinessClaimViolations({
-        ciGreen: true,
         behindBase: 0,
         behindUnknown: true,
       }),
@@ -280,7 +263,7 @@ describe("readinessClaimViolations", () => {
 
   it("honours a custom threshold", () => {
     assert.deepEqual(
-      readinessClaimViolations({ ciGreen: true, behindBase: 5, behindMax: 4 }),
+      readinessClaimViolations({ behindBase: 5, behindMax: 4 }),
       ["latest_dev"],
     );
   });

.github/scripts/pr-quality.cjs

@@ -33,11 +33,12 @@ const REVIEW_READINESS_ITEMS = [
 
 /**
  * Which checklist box each bot-verifiable claim maps to. The order must stay
- * in sync with REVIEW_READINESS_ITEMS: index 0 is the CI claim, index 1 is
- * the latest-dev claim, and index 2 is the Codex/CodeRabbit findings claim.
+ * in sync with REVIEW_READINESS_ITEMS: index 1 is the latest-dev claim and
+ * index 2 is the Codex/CodeRabbit findings claim. Index 0 (local CI) is an
+ * author attestation only — fork contributors cannot start repository CI — so
+ * the gate never disproves it; head-drift still resets every box.
  */
 const REVIEW_READINESS_CLAIM_INDEX = {
-  ci_green: 0,
   latest_dev: 1,
   review_findings: 2
 };

.github/scripts/pr-quality.test.cjs

@@ -586,16 +586,16 @@ describe("uncheckReviewReadinessBoxes", () => {
 
   it("unchecks only the requested boxes", () => {
     const body = uncheckReviewReadinessBoxes(checkedBody, [
-      REVIEW_READINESS_CLAIM_INDEX.ci_green,
+      REVIEW_READINESS_CLAIM_INDEX.latest_dev,
     ]);
-    assert.ok(body.includes("- [ ] All CI tests are green on my local testing."));
-    assert.ok(body.includes("- [x] I pushed my PR to the latest dev commit."));
+    assert.ok(body.includes("- [x] All CI tests are green on my local testing."));
+    assert.ok(body.includes("- [ ] I pushed my PR to the latest dev commit."));
     assert.ok(body.includes("- [x] My PR is ready for review."));
   });
 
   it("can uncheck several boxes at once", () => {
     const body = uncheckReviewReadinessBoxes(checkedBody, [
-      REVIEW_READINESS_CLAIM_INDEX.ci_green,
+      0,
       REVIEW_READINESS_CLAIM_INDEX.latest_dev,
     ]);
     assert.ok(body.includes("- [ ] All CI tests are green on my local testing."));

.github/workflows/ci.yml

@@ -233,8 +233,10 @@ jobs:
 
   # The suite, split by file across four Linux runners.
   #
-  # `bun test --shard=i/N` sorts test files by path and deals them round-robin,
-  # so the split is deterministic for the files that remain in this lane.
+  # `scripts/ci/run-bun-test-batches.sh` mirrors Bun's sorted round-robin shard
+  # assignment, then runs each shard in small batches so every batch gets a fresh
+  # Bun process. The helper prints the exact files before each batch and retries
+  # only a Bun runtime crash once; ordinary test failures are never retried.
   # Storage-policy API tests and api-usage are deliberately excluded here and run
   # in dedicated jobs below. Bun 1.3.14 can corrupt the Linux isolate/epoll state
   # around those Worker-heavy harnesses; keeping them out of the general shards
@@ -293,11 +295,13 @@ jobs:
           cd gui
           bun run build
 
-      - name: Test
-        run: bun test --isolate tests --path-ignore-patterns 'tests/api-storage-policy*.test.ts' --path-ignore-patterns 'tests/api-usage.test.ts' --shard=${{ matrix.shard }}/4
+      - name: Test in fresh-process batches
+        env:
+          TEST_SHARD: ${{ matrix.shard }}/4
+        run: bash scripts/ci/run-bun-test-batches.sh "$TEST_SHARD"
 
   # Bun 1.3.14 has shown a Linux isolate/epoll race around the storage-policy
-  # harness. Keep the entire five-file family in one fresh process so a runtime
+  # harness. Keep the entire six-file family in one fresh process so a runtime
   # failure is bounded to this job instead of poisoning a general test shard.
   storage-policy:
     name: storage policy
@@ -334,7 +338,8 @@ jobs:
             ./tests/api-storage-policy-mutation-busy.test.ts \
             ./tests/api-storage-policy-put-race.test.ts \
             ./tests/api-storage-policy-run.test.ts \
-            ./tests/api-storage-policy.test.ts
+            ./tests/api-storage-policy.test.ts \
+            ./tests/api-storage.test.ts
 
   # Bun 1.3.14 has shown a Linux isolate wedge around startServer() plus the user
   # cost overlay reconciler. Keep api-usage in one fresh process so a runtime

.github/workflows/enforce-pr-target.yml

@@ -73,15 +73,56 @@ jobs:
               }
 
               const statusSha = context.payload.sha;
-              const associatedPrs = await github.paginate(
-                github.rest.repos.listPullRequestsAssociatedWithCommit,
-                { owner, repo, commit_sha: statusSha, per_page: 100 }
-              );
-              const candidates = associatedPrs.filter(
-                candidate =>
-                  candidate.state === "open" &&
-                  candidate.head?.sha === statusSha
-              );
+              // Primary authority: GitHub's commit-to-PR index. This read can
+              // lag a fresh head push, so a non-match is not proof of absence.
+              let candidates = [];
+              try {
+                const associatedPrs = await github.paginate(
+                  github.rest.repos.listPullRequestsAssociatedWithCommit,
+                  { owner, repo, commit_sha: statusSha, per_page: 100 }
+                );
+                candidates = associatedPrs.filter(
+                  candidate =>
+                    candidate.state === "open" &&
+                    candidate.head?.sha === statusSha
+                );
+              } catch (error) {
+                core.warning(
+                  `Could not list PRs associated with commit ${statusSha}: ${error.message}`
+                );
+              }
+
+              if (candidates.length !== 1) {
+                // Fallback: reconcile directly against the live head SHA. The
+                // association index can be stale or empty for a very recent
+                // head (seen on PR #1441), so an empty/ambiguous index result
+                // must not silently drop the revalidation. Matching on the
+                // head SHA is the same authoritative identity the write gate
+                // uses, and `pulls.list` is a read — compatible with this
+                // job's `pull-requests: read` permission.
+                const priorCount = candidates.length;
+                try {
+                  const openPrs = await github.paginate(github.rest.pulls.list, {
+                    owner,
+                    repo,
+                    state: "open",
+                    per_page: 100
+                  });
+                  candidates = openPrs.filter(
+                    pr =>
+                      pr.state === "open" &&
+                      pr.head?.sha === statusSha
+                  );
+                  core.info(
+                    `Associated-index fallback: ${priorCount} index match(es), ${candidates.length} open PR(s) match head ${statusSha}.`
+                  );
+                } catch (error) {
+                  core.warning(
+                    `Could not list open PRs for head-${statusSha} fallback: ${error.message}`
+                  );
+                }
+              }
+
               if (candidates.length !== 1) {
                 core.info(
                   `CodeRabbit status ${statusSha} maps to ${candidates.length} open current-head PRs; skipping ambiguous/stale revalidation.`
@@ -99,10 +140,8 @@ jobs:
     needs: resolve-pr
     if: needs.resolve-pr.outputs.pull-number != ''
     runs-on: ubuntu-latest
-    # The write job also reads the current head's aggregate check evidence.
     # Job-scoped permissions replace, rather than extend, the workflow default.
     permissions:
-      checks: read
       contents: write
       pull-requests: write
     concurrency:
@@ -802,14 +841,16 @@ jobs:
               checklistComplete = readiness.present && readiness.complete;
             }
 
-            // The bot verifies the three checklist claims it can check itself.
-            // The CI box only counts when the head's `ci` check (the repo's
-            // documented "CI passed" signal) is green; the latest-dev box only
-            // counts while the head is at most READINESS_LATEST_DEV_BEHIND_MAX
-            // commits behind the base; the findings box only counts while every
-            // Codex/CodeRabbit review thread on the PR is resolved. A disproved
-            // claim unchecks that box and keeps the PR a draft, exactly like a
-            // head-drift reset.
+            // The bot verifies the checklist claims it can check itself. The
+            // local-CI box is an author attestation only — fork contributors
+            // cannot start repository CI (a maintainer has to) — so the gate
+            // never disproves it; head-drift still resets every box after a
+            // new push. The latest-dev box only counts while the head is at
+            // most READINESS_LATEST_DEV_BEHIND_MAX commits behind the base;
+            // the findings box only counts while every Codex/CodeRabbit
+            // review thread on the PR is resolved. A disproved claim unchecks
+            // that box and keeps the PR a draft, exactly like a head-drift
+            // reset.
             let claimViolations = [];
             let claimNotice = [];
             if (
@@ -818,52 +859,7 @@ jobs:
               !headDrifted &&
               failures.length === 0
             ) {
-              let ciGreen = false;
-              try {
-                // GitHub Actions' immutable App ID. Name alone is not evidence:
-                // any installed app can publish a check called `ci`.
-                const githubActionsAppId = 15368;
-                const { data: checksData } =
-                  await github.rest.checks.listForRef({
-                    owner,
-                    repo,
-                    ref: pr.head.sha,
-                    app_id: githubActionsAppId,
-                    check_name: "ci",
-                    filter: "latest",
-                    per_page: 100
-                  });
-                const checkRuns = Array.isArray(checksData.check_runs)
-                  ? checksData.check_runs
-                  : [];
-                const ciChecks = checkRuns.filter(
-                  check =>
-                    check.name === "ci" &&
-                    check.app?.id === githubActionsAppId
-                );
-                // The readiness claim requires positive CI evidence. A missing,
-                // pending, unsuccessful, foreign, or conflicting aggregate
-                // check must fail closed. The exact app/name/latest query should
-                // be tiny; if GitHub reports more rows than this response holds,
-                // treat the truncated evidence as unreadable rather than paging
-                // through an endpoint whose filters already select the latest run.
-                ciGreen =
-                  Number.isSafeInteger(checksData.total_count) &&
-                  checksData.total_count === checkRuns.length &&
-                  ciChecks.length > 0 &&
-                  ciChecks.every(
-                    check =>
-                      check.status === "completed" &&
-                      check.conclusion === "success"
-                  );
-              } catch (error) {
-                core.warning(
-                  `Could not list checks for the readiness claim check: ${error.message}`
-                );
-                ciGreen = false;
-              }
               claimViolations = readinessClaimViolations({
-                ciGreen,
                 behindBase,
                 behindUnknown: ancestryLookupFailed
               });