Landscape sweep: fail closed when the worker profile overlays an MCP server the lane config lacks - #411

…ks --required; move merge-guard mechanics to the decision record

The round-one verifier showed the documented statusCheckRollup filter prints superseded runs, so 'none failed' could not be judged with it (merged #389, #411 and #413 each show an earlier sota-sources failure and a later success on the final head). gh pr checks --required lists only the required checks with the latest run of each; measured exit 0 (all passed), 1 (one failed, none pending) and 8 (pending). The implementation-level citations move to the decision record, the stale-approval comparison is called an analogy, and 'today' leaves the dated record.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

…uire sota-sources (#430)

* docs/lanes.md: merge with the reviewed head pinned (--match-head-commit)

Strict up-to-date checks stay off and this User-owned repository cannot use
a merge queue (docs/decisions/2026-09-22-github-automation-closure.md), so
`gh pr merge <N> --squash --match-head-commit <SHA>` is the guard against
merging a head nobody reviewed (https://cli.github.com/manual/gh_pr_merge).
It was practised but not written down: grep for match-head-commit across
docs, recipes, adoption, examples and AGENTS.md returned nothing.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

* Decision record: close the sota-sources ruleset drift with dated GETs

The live ruleset 23739774 now requires the committed eight checks. Before-GET
21:00:04Z (seven, no sota-sources); PUT of .github/main-ruleset.json at main
e82e6be at 21:00:13Z; after-GET matches the committed file. Records the open
PRs affected at PUT time and the rollback.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

* docs/lanes.md merge guard: pin the checked and reviewed head read just before merge (B1, B2)

B1: <SHA> is the full 40-character headRefOid read with gh pr view <N> --json headRefOid,statusCheckRollup immediately before the merge, on which the review completed and every required check ran with none running or failed. The hot-file protocol's rebase or merge of main comes before that read; if main changed a shared hot file after <SHA>, merge main again, wait for the checks on the new head and pin it; the review carries over only if the reviewed files are byte-identical (GitHub's stale-approval rule, available-rules-for-rulesets). Sources: gh 2.101.0 'gh pr merge --help'; cli/cli v2.101.0 pkg/cmd/pr/merge/http.go L77-80 (expectedHeadOid); GraphQL MergePullRequestInput.expectedHeadOid read by schema introspection and in github/docs src/graphql/data/fpt/schema-pulls.json.

B2: the flag guards the head, not the base: with strict up-to-date checks off and no merge queue, two PRs green against an older main can still break it together (GitHub docs, loose required status checks).

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* Drift closed entry: measured live-ruleset comparison, historical labels, executable rollback (B3, B4, B5)

B4: the before-GET, PUT, after-GET and PR-status claims are labelled historical, recorded by the PR author, output not retained. Measured today (2026-09-29T03:18:04Z, read-only): the recorded diff of the live ruleset 23739774 against origin/main (b0fb65b, GitHub's main tip then) exited 0 after stripping eight response-metadata keys and sorting rules by type; the rules order is the only other difference; the 57fb6d8 negative control exits 1 on the sota-sources context only; updated_at is still the recorded PUT second. packet.md L90-92 cited as historical corroboration.

B3: rollback is git show 57fb6d8:.github/main-ruleset.json | gh api --method PUT .../rulesets/23739774 --input - (not run); verified 57fb6d8's file equals 7bbb021's minus sota-sources (jq -S, cmp exit 0) and main still carries 7bbb021's file.

B5: a rebase is not the only way to get a sota-sources run (validate.yml L6-9 reopened/edited; docs/lanes.md merge path), GitHub starts no pull_request run while a PR conflicts, and reporting is not passing (the job reads only the description, L517-521); #205/#216 measured CONFLICTING with no sota-sources run.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* Hot-file step: re-register docs/lanes.md and the automation-closure record in manifests/evidence.json

Registered with host_receipts.register_file; component_matrix.py --write and new_host_grand_list.py --write left the four generated reports unchanged; scripts/validate.py passed.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* docs/lanes.md: read the pinned head's required checks with gh pr checks --required; move merge-guard mechanics to the decision record

The round-one verifier showed the documented statusCheckRollup filter prints superseded runs, so 'none failed' could not be judged with it (merged #389, #411 and #413 each show an earlier sota-sources failure and a later success on the final head). gh pr checks --required lists only the required checks with the latest run of each; measured exit 0 (all passed), 1 (one failed, none pending) and 8 (pending). The implementation-level citations move to the decision record, the stale-approval comparison is called an analogy, and 'today' leaves the dated record.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

---------

Co-authored-by: Scout <scout@local>
Co-authored-by: Claude Opus 5.5 (1M context) <[email protected]>