ci: bind product qualification and DCO to trusted evidence

[mfethe1]

Summary

Product branches can currently inherit successful aggregate jobs even when a required underlying lane failed. Add an unconditional Product Qualification evaluator that checks the real lane outcomes and expected path scope. Add Product DCO with a trusted-base evaluator, exact base/head binding, complete commit pagination, author-matched sign-offs, and an explicit check on the candidate commit.

The DCO workflow does not execute candidate code with its check-writing token. Missing evaluator files, stale pull-request identity, missing receipts, and failed receipt upload deny qualification. Include the final product ruleset specification; activating it remains a separate bootstrap step after the trusted evaluators land and an eligible reviewer is established.

Base: adeec6eb5c4ff425aa03d8a744a295da4429f67f
Head: 687f53ff5722a98571e9b857c96bdca08d048759

Draft #25 prepares the evaluator prerequisite. The qualification evaluator is absent on the current PR base, so this combined candidate cannot qualify itself. The DCO workflow definition must also be installed on the repository default branch, main; its evaluator is separately pinned to the PR base. The default-branch trigger is absent, and an eligible non-author reviewer remains a prerequisite.

Related issue

Related release foundations: #15 and #17. This change does not repair their commits missing author sign-offs or waive their failed checks.

Testing

Thirteen DCO tests and nine qualification tests passed. Four DCO trust mutations and three qualification mutations were caught. The six changed workflows passed actionlint and the existing CI context contract. Replaying a real GitHub run correctly denied failed desktop and integration work despite successful wrapper jobs. Live commit evaluation correctly denied PRs 15 and 17 for missing author sign-offs. Independent source review passed at 687f53ff5722a98571e9b857c96bdca08d048759.

Full local just ci completed at this exact head and failed the same eight mobile golden comparisons reproduced on the unchanged base; 2,241 mobile tests and 6,583 desktop JavaScript tests passed. Expected images and tolerances were not changed. Hosted trusted-base bootstrap remains pending. This is not a completed release approval.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: a730fab7-33ac-46b9-b800-41f6a773b4b3

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[mfethe1]

🧪 Jev PR-Triage Pilot

PR #20: ci: bind product qualification and DCO to trusted evidence — verdict: BLOCK

question	answer	confidence
sensitive_path	P(yes)=0.68	—
test_coverage	P(yes)=0.99	—
size_concern	P(yes)=0.96	—
risk	1.68/2	0.52
route	needs_review	0.77
block_reason	none	0.46

Block reason (if any): none
Pilot: Jev (System One) typed triage. Verdict thresholds in code; escalate on low confidence.

[mfethe1]

🧪 Jev PR-Triage (v3)

PR #20: ci: bind product qualification and DCO to trusted evidence — verdict: BLOCK

dimension	metric	value
Correctness	problem resolved	P(yes)=0.21
Correctness	rework needed	1.08/2
Quality	code quality	1.82/2
Quality	test coverage	P(yes)=0.98
Architecture	integration compatibility	1.88/2
Architecture	future proof	1.59/2
Governance	sensitive path	P(yes)=0.98
Governance	size concern	P(yes)=0.96
Synthesis	merge risk	1.71/2
Synthesis	route	needs_review (0.73)
Diff	security exposure	P(yes)=0.21
Diff	performance impact	0.41/2

🔍 Reviewer focus

• File: .github/scripts/product-dco.js
• Concern: security

Block reason (if any): none
Pilot: Jev (System One) typed triage, 15 metrics + reviewer focus. Verdict thresholds in code.

[mfethe1]

🧪 Jev PR-Triage (v3)

PR #20: ci: bind product qualification and DCO to trusted evidence — verdict: BLOCK

dimension	metric	value
Correctness	problem resolved	P(yes)=0.19
Correctness	rework needed	1.10/2
Quality	code quality	1.81/2
Quality	test coverage	P(yes)=0.98
Architecture	integration compatibility	1.87/2
Architecture	future proof	1.59/2
Governance	sensitive path	P(yes)=0.98
Governance	size concern	P(yes)=0.96
Synthesis	merge risk	1.69/2
Synthesis	route	needs_review (0.77)
Diff	security exposure	P(yes)=0.21
Diff	performance impact	0.39/2

🔍 Reviewer focus

• File: .github/scripts/product-dco.js
• Concern: security

Block reason (if any): none
Pilot: Jev (System One) typed triage, 15 metrics + reviewer focus. Verdict thresholds in code.

[mfethe1]

🧪 Jev PR-Triage (v3)

PR #20: ci: bind product qualification and DCO to trusted evidence — verdict: BLOCK

dimension	metric	value
Correctness	problem resolved	P(yes)=0.19
Correctness	rework needed	0.98/2
Quality	code quality	1.65/2
Quality	test coverage	P(yes)=0.97
Architecture	integration compatibility	1.91/2
Architecture	future proof	1.55/2
Governance	sensitive path	P(yes)=0.98
Governance	size concern	P(yes)=0.95
Synthesis	merge risk	1.68/2
Synthesis	route	needs_review (0.60)
Diff	security exposure	P(yes)=0.17
Diff	performance impact	0.05/2

🔍 Reviewer focus

• File: .github/workflows/product-dco.yml
• Concern: security

Block reason (if any): none
Pilot: Jev (System One) typed triage, 15 metrics + reviewer focus. Verdict thresholds in code.