tools(landing): add horizon_land.sh, the local-first lander for the private horizon repository - #1194

Scope

• What this PR changes: adds tools/landing/horizon_land.sh, the command center's lander for the private seathatflowsinourveins/horizon repository, which has no hosted CI. It replaces the hosted validate check with local CI receipts, requires a Claude-family and a GPT-family verdict file naming the full head SHA, posts the three commit statuses the horizon ruleset requires, and records the landing as trailers in the squash commit (file names only) and in a local landing receipt (the digests). It is the required local workflow, as docs: record horizon, the private runtime-ecosystem repository with local-first enforcement #1195's Decision 4 (landed) records: GitHub enforces the three contexts and freshness, a writer can still post them and merge in the web interface (Known gaps), and the self-audit that would detect such a merge is a PROPOSAL. nas_land.sh, uet_land.sh, codex_gate.py and review_normalize.py do not change by a byte.
• Base commit: 8053f14e7e0817d2502dff2bb284bfb7e1b0152f; git merge-tree --write-tree against main a93ba0b8c is clean.
• Lane: lane:foundation.
• Owned paths touched: tools/landing/horizon_land.sh (new), tools/landing/README.md, tests/test_landing_scripts.py, manifests/evidence.json (three rows refreshed, one added).
• Authorization: the command center's ruling of 2026-10-15 (Option A: build the horizon mode as one pull request, with the normal reads), and its addenda 08 and 10 to the 19:12Z direction (the ruleset backstop; R1, full-lifecycle automation with a receipt at each step). Private records are cited by name only.

SOTA sources

• The existing lander, reused unchanged: tools/landing/nas_land.sh at 8053f14e7, lines 124-342, the block shared with uet_land.sh (lines 43-270 apart from lg_ci_state). horizon_land.sh carries it byte for byte (cmp); the test's shared-block check is now three-way. The verdict grammar it narrows is nas's (nas_land.sh:174-176, :197), the GATES_DONE rule is nas's correction Split the OSV SARIF upload into a tool-free job; fix the blind comparison's confirmed defects and file its evidence #121 (nas_land.sh:452, :461-466), and the receipt check reuses the shared block's lg_receipt_ok.
• GitHub REST, at github/rest-api-description@58b1e0c0: commit statuses POST /repos/{owner}/{repo}/statuses/{sha} (descriptions/api.github.com/api.github.com.json:79201-79208: description is "A short description of the status." with no maxLength; context is case-insensitive); GET /repos/{owner}/{repo}/codeowners/errors with ref (:53272-53329). The combined status is read on every page, as tcc_read_gate does (nas_land.sh:365-372).
• The merge pin: gh pr merge --match-head-commit, as cited in tools/landing/README.md for cli v2.102.0 (pkg/cmd/pr/merge/merge.go).
• Trailers: git 2.53.0, git interpret-trailers --parse ([email protected] Documentation/git-interpret-trailers.adoc); a test parses the logged squash body with it.
• The EXIT trap: the installed bash 5.3 (Ubuntu bash 5.3-2ubuntu1) bash(1), exit: "Any trap on EXIT is executed before the shell terminates"; measured on bash 5.3.9: the trap keeps the exit status, does not run in a $(...) subshell, and runs on SIGTERM (rc 143).
• Identity model: the review-verdict App record, Interim: a status is advisory and the lander re-reads its own records. horizon's required contexts move to the App's check runs after that record's Transition.
• The repository it lands: horizon's ruleset (id 25195996) requires lander/local-ci, lander/verdict-claude and lander/verdict-gpt with the strict up-to-date policy; GitHub's rule refused a direct push to main on 2026-10-15T20:40:27Z (GH013).

What the lander does, in order

1. Arguments and inputs before any call (exit 2): HORIZON_CLAUDE_VERDICT, HORIZON_GPT_VERDICT, optional HORIZON_MUSE_VERDICT (TRIAL: recorded, never gates), LOCAL_CI_RECEIPTS; it refuses the nas- and uet-only inputs when set.
2. Its own lock (horizon.lock, exit 14), fetch, and the read head (exit 3; no head-following).
3. The PR must target main (baseRefName, read with the head; CODEOWNERS comes from the base, github/docs@be38ec5d about-code-owners.md:44, and gh pr merge --match-head-commit binds the head, not the base, cli/[email protected] pkg/cmd/pr/merge/http.go:47-50); strict: main from git ls-remote must be an ancestor of the head and the merge state not BEHIND or DIRTY (exit 13 for either). It never calls gh pr update-branch, because a server-side update makes a head no verdict names.
4. Local checks: each verdict's last Verdict: line names the FULL head (an 8-hex prefix alone is refused) and its Family: line matches its slot; the two required files differ; a stated landing gate needs GATES_DONE naming the full head; receipts in the CI: exit <rc> at <40-hex>: <command> grammar, with sh tests/hooks_test.sh required and every command's last line at this head exit 0 (exit 5); CODEOWNERS read from main, with GitHub's codeowners/errors empty and every rule naming only the merging account (exit 8).
5. Only then: ready, and the three statuses POSTed at the head, each describing its files by name (exit 15 if one fails). From the first POST an EXIT trap posts failure for every context unless the merge succeeded; the revocation ignores further HUP, INT and TERM.
6. The final gate, right before the merge: head and base, the local digests of the verdict, receipt and gate files unchanged (exit 7), the three statuses success with the lander's exact descriptions and no other lander/ context (exit 5), CODEOWNERS, ancestry (exit 13), merge state.
7. The squash merge pinned with --match-head-commit, its body ending in trailers that name files only: Lander-head, Lander-local-ci, Lander-verdict-claude, Lander-verdict-gpt, Lander-verdict-muse (when set), Lander-gates-done (when a gate is stated), and Lander-codeowners with the sha256 of main's own CODEOWNERS. The digests of the private files go to a local receipt, $LANDING_COORD/horizon-landings/<pr>-<head12>.json (0400), after the merge (exit 16 if that write fails; exit 12 if the merge commit cannot be read). The PROPOSAL self-audit would bind main's trailers to that receipt.

Evidence-class table

README digest row: horizon_land.sh 7ba9a06aacbff4e50111266891ac9d2f7ae8c305824a65f4181045fa04f22ee2 (772 lines); at b4489b15 it was 133dab4cfd8da99a695753c9aea2e40f9f1c582bda6d2ee158cbb39c8d96a9a2 (749 lines), at 34add438 3320c5ab0a312307fa47487a8d154f3fb138b32db41d1bcf1f54bf25f8582ce3 (659 lines).

Local commands run

python3 -m unittest tests.test_landing_scripts                      exit 0; Ran 210 tests; OK (skipped=1)
python3 -m unittest $(ls tests/test_local_pages*.py | ...)           exit 0; Ran 547 tests; OK
python3 scripts/validate.py                                          exit 0; 71 components / 12140 hashed files / 240 receipts
python3 scripts/evidence_manifest.py --check                         exit 0; 12140 files
git diff --check 8053f14e7 HEAD; bash -n tools/landing/horizon_land.sh   exit 0
python3 -m unittest tests.test_pre_push_gate   (after the commit)    exit 0; Ran 29 tests; OK
shellcheck                                                           not installed; not run

R1 (full-lifecycle automation) in this PR

• Land: this lander, with its receipt in the squash commit.
• Reads: both families' verdict files are inputs bound to the full head.
• Post-merge audit: the PROPOSAL self-audit (docs: record horizon, the private runtime-ecosystem repository with local-first enforcement #1195's Decision 4) would read main's trailers and the local landing receipt; it is not built, here or in horizon.
• Plan and PR steps: carried by the access manifest and the decision record (separate pull requests, per the CC's order).

Known gaps

• The web-UI residual. GitHub checks only that the three contexts report success at the head, and any person or integration with write access can set a status (github/docs@be38ec5d available-rules-for-rulesets.md:178); a writer can post three successes and merge in the web interface without these local checks. Statuses carry no App identity (the App record's Interim). Detection is the PROPOSAL self-audit.
• Revocation can fail on an ordinary exit, for example when the failure POSTs themselves fail; the successes then stay and are revoked by hand (README, manual revocation).
• The final reads are not atomic with the merge; --match-head-commit pins only the head.
• The private digests live only in the host's LANDING_COORD; after a host loss the trailers bind only names and the head.
• The clone path must contain no whitespace.
• Receipts are claims; the lander re-runs no test.
• A SIGKILL or host loss between the first POST and the merge leaves successes standing; they need revoking by hand.
• The live description limit and codeowners/errors have not been exercised against GitHub (no POST was made); the lander caps descriptions at 140 characters and compares them exactly at the final gate.
• An UNSTABLE merge state is refused, and the merge-state poll gives up after two minutes.
• The squash body is bounded by one argument's length limit.

Review rounds

• Round 1 at 34add438: the command center's full read (PASS, with two P2 and three P3; MICRO-full-34add438.md, by name) and the GPT full read (CHANGES_REQUESTED: one P1, one P2, four P3; GPT-VERDICT-34add4382.md, by name). Fold 1, b4489b15, answered all of them in one commit:

  • GPT P1: statuses and trailers published digests of unpublished verdict and receipt files; they now carry file names only, the digests stay local for the final gate and go to the local landing receipt. Regression: a landing whose every input holds a synthetic home path publishes no digest or 7-hex prefix of them;
  • GPT P2: the base is bound (baseRefName == main before ready and at the final gate, exit 13); a late retarget after the posts refuses and posts the failures; a main-based control lands;
  • GPT P3s: the head must end at a word boundary (A, G, 0, _ after it refused); the post-merge read is checked and prints only the typed id (exit 12); public commit IDs registered for the body guard; the gaps above;
  • CC P2s: the enforcement design is a PROPOSAL pointing to docs: record horizon, the private runtime-ecosystem repository with local-first enforcement #1195, with the residual stated; strict freshness and status checks cited at available-rules-for-rulesets.md:172-178, :188-193, and what those lines do not say is labelled PROPOSAL;
  • CC P3s: the merge-state lag is labelled as measured on us-equities-trading SOTA repository convergence 2026-09-22: per-layer list, manifest, newcomer dispositions, engine reconciliation #58, not documented by GitHub; UNSTABLE cited at github/docs@be38ec5d src/graphql/data/fpt/schema.docs.graphql:26511-26554; trap '' HUP INT TERM opens the revocation (a second TERM during it still posts all three failures).
  • Fail-first: the 9 new tests fail 34 times against 34add438; 8 more single-rule mutants each fail at least one test.

• Round 2 at b4489b15: the command center's delta read (PASS with micro items; MICRO-delta-b4489b15.md, by name), the GPT delta read (ACK with four P3s; GPT-VERDICT-b4489b15b.md, by name) and the local review (three P2s). The fold commit (this PR's head) answers them in one commit:

  • wording matches docs: record horizon, the private runtime-ecosystem repository with local-first enforcement #1195's Decision 4: "the required local workflow", and "the PROPOSAL self-audit", never "planned";
  • the merge is finalised whole: HUP, INT and TERM are ignored from just before the merge call until the landing receipt is written and reported, so a signal neither revokes a merged head's statuses nor loses the receipt (CC P3-3, local review P2-2); when exits 12 and 16 both apply, 12 is the exit;
  • CODEOWNERS fails closed: a lookup or read that fails is exit 8 (local review P2-1);
  • a leading, trailing or doubled : in LOCAL_CI_RECEIPTS is exit 2 before any call (local review P2-3);
  • the uet#58 lag wording, and the noclobber and trap '' texts cited to the installed bash 5.3 bash(1) (CC P3-1, P3-2); comments no longer describe a posted digest (GPT P3-4);
  • fail-first: the four new tests fail 7 times against b4489b15.

• Round 3 at 4fad2736: the command center stopped the auto-land on the local review's P2 (a failed merge call revoked without checking whether GitHub had merged), and the GPT micro read was an ACK with five P3s (GPT-VERDICT-4fad2736c.md, by name). The fold commit (this PR's head):

  • reconciles a failed merge call before anything is revoked: the state is read three times, two seconds apart; MERGED at the head continues as a landing with its receipt; OPEN or CLOSED there on all three is exit 7 and revokes; anything else is the new exit 17, with the statuses kept and nothing revoked. Fail-first: the new test fails against 4fad2736;
  • GPT P3-4: the empty-field and pipefail comments cite the installed bash 5.3 bash(1) (EXPANSION, Word Splitting; SHELL GRAMMAR, Pipelines), and pipefail is described as the rightmost non-zero status;
  • GPT P3-5: this body's current-state sentences now match the script, the README and docs: record horizon, the private runtime-ecosystem repository with local-first enforcement #1195;
  • GPT P3-1, P3-2 and P3-3 stay Follow-ups (below).

Follow-ups

• GPT delta P3-1: the shared block's author check accepts an unvalidated merge-commit reply. The block stays byte-identical to nas_land.sh, so the fix belongs to all three landers in one change.
• GPT delta P3-2: a local symlink swapped in after the receipt-location check could still let the receipt write report success.
• GPT delta P3-3 (and round 3's P3-3): the recovery-limit wording and the documentation corrections have no focused documentation assertion with a fail-first run.

Decision record

The horizon repository record (docs/decisions/2026-10-15-horizon-runtime-ecosystem-repository.md) follows as its own pull request, after this one, per the CC's order.

Checklist

• No workflow change.
• No secrets are printed, logged or committed; the lander prints no text that gh or its API returned.
• No new paid hosting, subscription or billing surface.
• Peer-owned files and worktrees preserved.

🤖 Generated with Claude Code