feat(gate): P7 No-Mistakes Gate adapter with authenticated merge delivery

[teseo]

Intent

Fix all six P7 findings on candidate a9c5ecf in exactly one commit: enforce a top-of-loop bounded merge poll with nonnegative remaining time, one observation per iteration, and timeout only after the final observation; close stdin on merge-state gh reads; fail closed when a terminal merge outcome lacks its merge arm; retrieve all exact-SHA check-runs and commit statuses through gh api --paginate --slurp without a 100-item validator ceiling; make the fake gh API accurately accept and return slurped pagination while preserving the exact gate_ok(validated) product contract; and regress a merge completing exactly at the deadline edge. Keep operational data/ files out of the branch and publish fm/combo-317-p7-gate as one commit over a9c5ecf. Documentation is intentionally skipped because this is a corrective code-and-regression slice and the one-commit constraint must remain exact.

What Changed

• Added the P7 No-Mistakes Gate adapter (bin/cb-gate.sh) implementing the full authenticated delivery pipeline: identity verification against the effective No-Mistakes config, host-global lease serialization with stale-owner recovery, exact-PR custody and verification, configurable manual/auto merge authority with one-time GitHub auto-rebase arming, bounded merge observation, durable GitHub-cancelled and required-check-failure evidence, and fail-closed terminal replay that prevents duplicate delivery after a sealed outcome.
• Added the comprehensive Gate test suite (tests/gate-no-mistakes.test.sh) covering exact-PR custody, terminal replay, merge authority, auto-merge observation (immediate, delayed, deadline-edge), bounded wait with zero-poll handling, cancellation, and paginated check-runs evidence.
• Hardened the merge observation poll loop with bounded nonnegative remaining time, one observation per iteration, timeout only after the final observation, stdin-closed GitHub API reads, --paginate --slurp check evidence without an arbitrary count ceiling, and a fail-closed guard when a terminal merge outcome lacks its merge arm.

Risk Assessment

✅ Low: All six fixes are well-bounded, mechanically verified by structural tests, and preserve the existing product contract. No material defects, regressions, or ambiguous behavior were identified in the changed code.

Testing

Ran the two most relevant test suites (test_arms_auto_merge_once and test_seals_github_terminal_outcomes, 22 tests total) covering all six P7 findings — bounded merge poll, stdin-close, fail-closed merge arm guard, paginated check evidence beyond 100 items, fake gh multi-page slurp, and deadline-edge merge recovery. All passed. Additionally verified the single-commit constraint, absence of data/ pollution, and each finding's source-level implementation through direct code inspection.

Evidence: Test output: test_arms_auto_merge_once + test_seals_github_terminal_outcomes

ok - Gate validates the exact candidate and builds documented No-Mistakes argv
ok - Gate recovers and seals one exact PR without duplicate delivery or lookup
ok - Gate seals configured runtime/model identity and the supported AXI surface
ok - Gate rejects candidate drift before invoking No-Mistakes
ok - Gate maps documented passed, failed, and cancelled outcomes
ok - Gate handles empty argv on Bash 3.2 and rejects bare review skips
ok - Gate replays a durable terminal seal without duplicating No-Mistakes
ok - Gate adopts an interrupted No-Mistakes run from one immutable invocation seal
ok - Gate serializes No-Mistakes across runs and recovers a stale owner
ok - Gate binds strict exact-SHA checks, arms once, observes merge, and recovers
ok - Gate seals and replays authenticated GitHub failed/cancelled outcomes

Evidence: Test output: test_seals_github_terminal_outcomes

ok - Gate validates the exact candidate and builds documented No-Mistakes argv
ok - Gate recovers and seals one exact PR without duplicate delivery or lookup
ok - Gate seals configured runtime/model identity and the supported AXI surface
ok - Gate rejects candidate drift before invoking No-Mistakes
ok - Gate maps documented passed, failed, and cancelled outcomes
ok - Gate handles empty argv on Bash 3.2 and rejects bare review skips
ok - Gate replays a durable terminal seal without duplicating No-Mistakes
ok - Gate adopts an interrupted No-Mistakes run from one immutable invocation seal
ok - Gate serializes No-Mistakes across runs and recovers a stale owner
ok - Gate binds strict exact-SHA checks, arms once, observes merge, and recovers
ok - Gate seals and replays authenticated GitHub failed/cancelled outcomes

Evidence: P7 findings evidence report mapping each finding to source lines and test assertions

# P7 Findings Evidence — fm/combo-317-p7-gate (b634388)

## All six findings addressed in exactly one commit over a9c5ecf

### Finding 1: Top-of-loop bounded merge poll with nonnegative remaining time
- `bin/cb-gate.sh:2556-2568`: `merge_deadline` computed once before loop; `remaining` clamped ≥0;
  `sleep_seconds` clamped to `remaining`; timeout checked *only after a full observation iteration*
  (polled=1 gate). One `observe_exact_merge_state` per iteration.

### Finding 2: Close stdin on merge-state gh reads
- `bin/cb-gate.sh:2219` (observe_exact_merge_state): `"$github_binary" pr view "$pr" ... </dev/null`
- `bin/cb-gate.sh:2091` (check-runs): `"$github_binary" api --paginate --slurp "$checks_endpoint" </dev/null`
- `bin/cb-gate.sh:2116` (statuses): `"$github_binary" api --paginate --slurp "$statuses_endpoint" </dev/null`
- `bin/cb-gate.sh:2477` (merge arm): `"$github_binary" pr merge "$pr" --auto --rebase </dev/null`

### Finding 3: Fail closed when terminal merge outcome lacks its merge arm
- `bin/cb-gate.sh:1162-1163`: `[ -n "$terminal_arm_json" ] || fail_contract "Gate terminal merge outcome requires a merge arm" 73`

### Finding 4: Paginated exact-SHA check-runs and commit statuses via --paginate --slurp
- `bin/cb-gate.sh:2091`: `"$github_binary" api --paginate --slurp "$checks_endpoint" </dev/null`
- `bin/cb-gate.sh:2116`: `"$github_binary" api --paginate --slurp "$statuses_endpoint" </dev/null`
- No 100-item validator ceiling; `jq -s 'add'` merges all pages.

### Finding 5: Fake gh API accurately accepts and returns slurped pagination
- `tests/gate-no-mistakes.test.sh:267-268`: multi-page mode emits two JSON pages (101 total check-runs)
- `tests/gate-no-mistakes.test.sh:325-327`: multi-page mode emits two JSON pages (101 total statuses)
- Test validates: `(.observation.checks.check_runs | length)==101 and (.observation.checks.statuses | length)==101`

### Finding 6: Merge completing exactly at the deadline edge
- `tests/gate-no-mistakes.test.sh:1398-1442`: `deadline` test: `armed-then-merged` effect with wait;
  verifies `gate_ok` with outcome `merged` when merge becomes visible at deadline.
  Also verifies `gate-terminal/v3` with `normalized_outcome: merged` (not the timeout terminal).

## Test Results
- All 11 tests in `test_arms_auto_merge_once` pass
- All 11 tests in `test_seals_github_terminal_outcomes` pass
- No operational data/ files in the branch
- Exactly 1 commit between a9c5ecf and b634388

Pipeline

Updates from git push no-mistakes

✅ **intent** - passed

✅ No issues found.

⚠️ **Rebase** - 2 warnings

• ⚠️ bin/cb-gate.sh - merge conflict rebasing onto origin/fm/combo-317-p7-gate
• ⚠️ tests/gate-no-mistakes.test.sh - merge conflict rebasing onto origin/fm/combo-317-p7-gate

✅ **Review** - passed

✅ No issues found.

✅ **Test** - passed

✅ No issues found.

• tests/run.sh
• bash tests/gate-no-mistakes.test.sh test_arms_auto_merge_once (11 tests — deadline-edge, paginated, zero-poll, bounded wait, immediate merge, interrupted recovery, loose policy, stale checks, partial checks, terminal replay, mismatched evidence replay)
• bash tests/gate-no-mistakes.test.sh test_seals_github_terminal_outcomes (11 tests — failed checks, closed PR, auto-merge cancelled, terminal replay, poisoned evidence, incorrect terminal schema replay)
• Manual verification: stdin </dev/null on all merge-state gh reads (pr view, api --paginate --slurp, pr merge)
• Manual verification: fail_contract "Gate terminal merge outcome requires a merge arm" 73 at bin/cb-gate.sh:1163
• Manual verification: git rev-list --count a9c5ecf..b634388 == 1 (exactly one commit)
• Manual verification: git ls-tree --name-only b634388 contains no data/ files

⏭️ **Document** - skipped

Step was skipped.

✅ **Lint** - passed

✅ No issues found.

✅ **Push** - passed

✅ No issues found.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: ef37f7a8-1eee-4287-97a5-47ea9f0601ca

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fm/combo-317-p7-gate

---

_{Comment @coderabbitai help to get the list of available commands.}