Split the OSV SARIF upload into a tool-free job; fix the blind comparison's confirmed defects and file its evidence - #121

…rivate horizon repository (#1194)

* tools(landing): add horizon_land.sh, the local-first lander for the private horizon repository

horizon_land.sh lands pull requests of seathatflowsinourveins/horizon, which has no hosted CI,
no scripts/validate.py, no evidence manifest and no Codex connector. Its main ruleset requires
the commit statuses lander/local-ci, lander/verdict-claude and lander/verdict-gpt (strict), so
the lander is the only merge path: it checks the local evidence, posts the three statuses at the
exact head and squash-merges pinned with --match-head-commit.

Checks, in order: the arguments and inputs (HORIZON_CLAUDE_VERDICT, HORIZON_GPT_VERDICT,
HORIZON_MUSE_VERDICT as a TRIAL, LOCAL_CI_RECEIPTS), with the other landers' inputs refused
before any call; its own horizon.lock; the pull request's head must equal the read head (no
head-following); origin/main must be an ancestor of the head and GitHub must report neither
BEHIND nor DIRTY (the branch is never updated here); the verdicts (nas_land.sh's acceptance plus
a last Gate/Verdict line naming the full 40-hex head, the right Family line, two different
files); the receipts (CI: exit <code> at <head>: <command>, the last line per command counts,
sh tests/hooks_test.sh required, every command exit 0); main's CODEOWNERS owned by the merging
account alone, and GitHub's codeowners/errors at that main reporting none; then a draft is
marked ready, after the local refusals.

Correction #121 is carried as nas_land.sh carries it (the CC's ruling of 2026-10-15): a verdict
of any family whose text states a landing gate (nas's four phrases, any letter case) needs
GATES_DONE, a receipt that names the full 40-hex head (the shared block's lg_receipt_ok given the
full head, so the 8-digit prefix alone is refused), or exit 2 before any change on GitHub; it is
read again at the final gate (exit 7 when its bytes changed) and recorded as Lander-gates-done.

Statuses: each success carries "<file name> sha256 <digest>" (local-ci: one digest over the
receipt files). An EXIT trap, with HUP, INT and TERM trapped, posts failure for all three unless
the merge succeeded. The merge state is polled until CLEAN. The squash body ends in a trailer
paragraph (Lander-head, Lander-local-ci with one Lander-local-ci-receipt line per file,
Lander-verdict-claude, Lander-verdict-gpt, Lander-verdict-muse when set, Lander-gates-done when
a verdict states a landing gate, Lander-codeowners). final_gate re-reads the head, the verdicts,
GATES_DONE and the receipts and their digests, the combined status
(exact descriptions, contexts compared case-insensitively), CODEOWNERS, origin/main and the
merge state, with nothing but the merge after it.

Exit codes: 2 inputs, verdicts or a stated landing gate without GATES_DONE, 3 head moved, 5
receipts or statuses, 6 merge state not settled, 7 ready, body or merge failed, or a verdict,
receipt or GATES_DONE changed after its post, 8 BLOCKED or
CODEOWNERS, 11, 12 and 14 as in the other landers, 13 not up to date or main unreadable or
moved, 15 (new) a status POST failed, 129, 130 and 143 a signal.

The shared land-gate-fns block is nas_land.sh's byte for byte (now a three-way test);
nas_land.sh and uet_land.sh are unchanged. Tests: HorizonEndToEndTests with its own scratch
repository, the fake gh's status POST and codeowners/errors branches, and horizon joining the
existing script-text checks. README, its digest row and the manifest rows updated.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* Fold the #1194 reviews: names-only statuses and trailers, base binding, PROPOSAL labels

The GPT read (CHANGES_REQUESTED at 34add43) and the CC's read (PASS with items), each finding
and its fix:

- GPT P1, private digests published: the statuses and the trailers named each private file's
  sha256. Now the three descriptions are file names (local-ci: the receipt names, one space
  apart) and every Lander-* trailer names files only; CODEOWNERS keeps its sha256, its preimage
  being main's own file. The digests stay local: compared at the final gate and kept in a
  landing receipt, $LANDING_COORD/horizon-landings/<pr>-<head12>.json, written once after the
  merge with mode 0400 (exclusive create; its place checked before ready and the posts, exit 7;
  a failed write after the merge, new exit 16).
- GPT P2, base not bound: the head and baseRefName are read together; the base must be main
  before ready and the posts and again at the final gate (exit 13, the name withheld). Cites
  github/docs about-code-owners.md:44 and cli v2.102.0 pkg/cmd/pr/merge/http.go:47-50, :77-80.
- GPT P3, terminator: the full head must be a whole word (no letter, digit or _ after it), in a
  verdict and in GATES_DONE; head+A is refused.
- GPT P3, post-merge report: the merge commit is read with its exit checked and printed in its
  typed shape only; a failed read is exit 12 (the receipt then records no merge commit).
- GPT P3, body guard: #1194's base, main at the first reads and its first head registered in
  PUBLIC_COMMITS with their URLs (each read on GitHub), and the first head's horizon_land.sh
  digest in PUBLIC_DIGESTS.
- CC P2, "the only merge path": labelled PROPOSAL, pointing to #1195's decision record, with the
  residual stated: GitHub checks only the contexts' states and anyone with write access can set
  one (available-rules-for-rulesets.md:176, :178), so a web-UI merge after the posts is not
  refused.
- CC P2, ruleset mechanics: strict cited at available-rules-for-rulesets.md:188-193 and the
  checks at :172-178; what those lines do not say is labelled PROPOSAL.
- CC P3, the merge-state lag: "measured on us-equities-trading #58, not documented by GitHub".
- CC P3, UNSTABLE: MergeStateStatus cited at schema.docs.graphql:26511-26554 (:26551-26553).
- CC P3, a second signal during revocation: trap '' HUP INT TERM is hz_revoke's first statement.

Tests, each failing at 34add43 (9 tests, 34 failures) and against single-rule mutants: no
digest or 7-digit prefix of a private file in a description or the body, the receipt keeping
them; the receipt's place and its write; a base other than main, at the start and as a late
retarget flip; head+A, G, 0 or _; the post-merge read with a stdout sentinel; a TERM during the
first revocation POST. The shared block stays nas_land.sh's byte for byte; nas_land.sh and
uet_land.sh are unchanged. README, its digest row and the manifest rows refreshed.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* Fold the #1194 delta reads: required local workflow wording, signal-safe merge finalisation, fail-closed CODEOWNERS and receipt lists

The command center's delta read at b4489b1 (PASS with micro items), the GPT delta read
(ACK with four P3s) and the local review (three P2s), in one commit:
- Wording matches #1195's Decision 4: the lander is "the required local workflow" (GitHub
  enforces three contexts and freshness; the web-UI residual), and the self-audit is "the
  PROPOSAL self-audit", never "planned" (CC P2-1).
- The merge is finalised whole: HUP, INT and TERM are ignored from just before the merge
  call until the landing receipt is written and the merge reported, so a signal neither
  revokes a merged head's statuses nor loses the receipt (CC P3-3, local review P2-2);
  when exits 12 and 16 both apply, 12 is the exit (documented and tested).
- CODEOWNERS fails closed: a git ls-tree or read that fails is exit 8, and the next
  location is tried only after a successful lookup with no entry (local review P2-1).
- LOCAL_CI_RECEIPTS with a leading, trailing or doubled ':' is exit 2 before any call;
  read -a dropped a trailing empty field (local review P2-3).
- uet#58's lag is worded as measured there, not documented by GitHub (CC P3-1); the
  noclobber and trap '' texts cite the installed bash 5.3 bash(1) (CC P3-2).
- Comments no longer describe a posted digest (GPT P3-4).
- The README digest row and the published-digest list follow the new script bytes;
  b4489b1's script digest is registered with its URL.

Fail-first: the four new tests fail 7 times against b4489b1. Follow-ups, not taken here:
GPT P3-1 (the shared author check, in the block that stays byte-identical to nas), P3-2
(a late local symlink swap after the receipt check) and P3-3 (a documentation assertion
for the recovery limits).

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* Reconcile a failed merge call before revoking; cite bash for the receipt split and pipefail

The command center stopped the auto-land at 4fad273 on the local review's P2, and the
GPT micro read there was an ACK with five P3s; one commit:
- A failed merge call is reconciled before anything is revoked (local review P2): GitHub
  can commit the merge and the reply be lost, so the state is read three times, two
  seconds apart. MERGED at the read head continues as a landing (HZ_MERGED, the receipt,
  the report); OPEN or CLOSED there on all three reads is exit 7 and the EXIT trap
  revokes; anything else is the new exit 17: the outcome is unknown, the statuses are kept
  (HZ_KEEP), nothing is revoked, and the pull request is checked by hand. README exit
  codes and step list updated; the old merge-failure test now serves an OPEN pull
  request. Fail-first: the new test fails against 4fad273.
- GPT P3-4: the empty-field comment cites bash(1) EXPANSION, Word Splitting ("field
  terminators"; adjacent delimiters "produce a null field"), and the pipefail comment
  quotes SHELL GRAMMAR, Pipelines (the rightmost non-zero status), both from the
  installed bash 5.3 (5.3-2ubuntu1).
- GPT P3-5 is the PR body's wording (aligned there); P3-1, P3-2 and P3-3 stay Follow-ups.
- The README digest row and the published-digest list follow the new bytes; 4fad273 and
  its script digest are registered with their URLs.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

---------

Co-authored-by: Claude Opus 5.5 <[email protected]>