US-45.6: a thread-mode merge requires green CI on the checkpoint's exact commit

[mkreyman]

US-45.6 (Epic 45, change threads): CI evidence by exact SHA. The review gate is still running.

What

A thread has no pull request, and the loopctl App pushes the squash itself (US-45.5), so no forge rule holds a thread merge to green CI. The merge gate now does:

• intake_sources.required_checks (migration 20260927100000, text array, default empty). A thread source must name at least one, judged over the source as it will be on every write; local-gate is refused. POST/PATCH /api/v1/intake/sources and the MCP tools take it; a change is audited as intake_source_required_checks_set.
• PullRequestSource.check_evidence/3 reads, for the checkpoint's OWN sha, the check runs under each required name (check_name, filter=latest) and the combined commit statuses. Both APIs, because the combined status never lists check runs (Actions). A truncated list is an error, never a partial answer.
• Loopctl.Delivery.CiEvidence (pure) judges it. Failed -> required_check_failed (refuse). Running -> required_check_pending, not reported -> required_check_missing, both unevaluated with Retry-After: 60. Only a MISSING check counts toward the unevaluated bound, so a slow CI never escalates while a workflow that does not run on the thread branch does. No requirement -> required_checks_unset. Failed read -> ci_evidence_unavailable. local-gate is recorded and never counted (AC-45.6.2).
• enforce/3 copies the evidence onto the checkpoint's gate_evidence["ci"] (AC-45.6.1) for every decision; for an allow the copy happens BEFORE the allow is recorded, and a copy that does not land refuses ci_evidence_not_recorded.
• Verdict and API answer carry ci_evidence; OpenAPI, MCP (2.108.0), README, CHANGELOG, FLY_SECRETS (checks: read, commit statuses: read on GITHUB_TOKEN) and the delivery-loop doc updated.

Design choices:

• Required checks come from the SOURCE, not a branch ruleset: in thread mode master's ruleset admits only the App, which pushes the squash before any CI ran on it, so a ruleset cannot carry the requirement.
• The policy is read CURRENT (like the gate triggers), not bound at placement: tightening what a thread must pass applies to the next evaluation.
• Operator impact: a thread-mode source enrolled before this migration has no checks and every story is refused required_checks_unset until one is named (in CHANGELOG).

Tests

TC-45.6.1 (green on the parent, pending on the checkpoint -> not allowed), TC-45.6.2 (local-gate alone -> not allowed), CiEvidence table tests, judge tests for every reason, the bound exemption for running checks, evidence copy on allow and refusal, intake validation, adapter parsing/truncation, record_gate_evidence isolation, MCP tool tests.

Mutations (all exit 0 = caught)

id	mutation	check
M01	failed checks produce no refusal	judge test
M02	CI waits dropped from unevaluated	judge test
M03	every unevaluated counted	integration
M04	local-gate looked up as a required check	ci_evidence test
M05	required_checks_unset dropped	judge test
M06	gather never reads CI (wiring)	integration
M08	enforce never copies evidence	integration
M09	allow skips the evidence copy	integration
M10	thread source may require nothing	intake test
M11	local-gate accepted as required	intake test
M12	enrolment drops required_checks	intake test
M13	update ignores required_checks	intake test
M14	truncated check-run list accepted	adapter test
M15	filter=latest not sent	adapter test
M16	pending status read as passed	ci_evidence test
M17	neutral/skipped not passing	ci_evidence test
M18	evidence write replaces other keys	threads test
M19	evidence write ignores story_id	threads test
M20	controller ci_evidence not rendered	controller test
M22	failure precedence removed	ci_evidence test
M23	pending waits counted	judge test
M24	MCP accepts local-gate	node test
M25	MCP drops required_checks at enrolment	node test
M26	pending precedence removed	ci_evidence test
M27	CI wait carries no retry_after	judge test

M07 and M21 were withdrawn before running (malformed). The migration was not mutated (KB 346ba61e: a mutated migration leaves the test DB in its mutated state).

[mkreyman]

Superseded by #910. Round 3 on this PR still found material defects in its trust model (self-attestation through workflow files, a green suite hiding a red one, the wait's origin, placement-bound policy), so US-45.6 was rewritten on a fresh branch rather than patched a fourth time.