fix(deploy): let the shadow gate policy accept disabled legacy health admission

[proerror77]

Change contract

polymarket-shadow-gate-policy.jq accepts baseline_health_start_required == false (skipping only the legacy health chain) when baseline_mode == legacy_python, and decouples comparison_mode == rust_self from the admission flag. All identity, parity, coverage, and evidence checks are unchanged.

Root cause (the real gate killer since #554)

Every #554-era gate failed at the final policy evaluation with 'combined gate evidence failed the production policy' even with all 15 parity checks true. #554 disabled the admission in the gate script, but the policy still required baseline_health_start_required == true + the full legacy health chain — verified against the actual gate.json of invocation 305c158c (policy returns false before, true after). The 404 readback noise each time was the shadow's own upload service racing its in-flight multipart, not the gate's death cause.

Focused validation

• Policy returns true on the real gate.json; false on: flag=true without the health chain, forged trade parity, bad comparison_mode
• control-plane + stage suites PASS (fixtures updated: flag-false moved from forged list to positive assertions)

Out of scope

• Restoring legacy health (the lane is being retired)

Dependency / merge order

None. Note for the in-flight candidate: its staged control copy needs this policy (host patch + hash recompute, controller-authorized) or the next official release.

Rollout / rollback impact

Gate policy only. Rollback = revert.

Issue relationship

Refs #553

Summary by CodeRabbit

• Bug Fixes
  • Updated deployment validation to support legacy baselines that omit health-start requirements.
  • Health evidence is now checked only when health-start validation is enabled.
  • Improved Rust self-comparison and legacy gate handling when health evidence is unavailable or disabled.
  • Preserved rejection of missing or inconsistent required health information.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 5a07f268-e57d-41f8-8a32-94e174bfcea4

📥 Commits

Reviewing files that changed from the base of the PR and between dc26acd and 3bcc462.

📒 Files selected for processing (2)

• deployment/aliyun/polymarket-shadow-gate-policy.jq
• deployment/aliyun/test-polymarket-raw-ops-control-plane.sh

---

📝 Walkthrough

Walkthrough

The shadow-gate policy now permits disabled legacy health-start admission. Health snapshots remain validated when required. Contract tests cover Rust-self and legacy gates with disabled health admission.

Changes

Legacy health admission

Layer / File(s)	Summary
Conditional policy validation deployment/aliyun/polymarket-shadow-gate-policy.jq	Legacy health snapshots are validated only when baseline_health_start_required is enabled. Rust self-comparison no longer requires that setting.
Admission contract coverage deployment/aliyun/test-polymarket-raw-ops-control-plane.sh	Tests accept disabled health admission for Rust-self and legacy gates while retaining rejection checks for missing or inconsistent required fields.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related issues

• proerror77/monday issue 553: Covers the same change to allow LEGACY_HEALTH_START_REQUIRED to be disabled.

Possibly related PRs

• proerror77/monday#487: Modifies the same shadow-gate policy and contract tests for conditional baseline health evidence.
• proerror77/monday#516: Directly relates to baseline_health_start_required handling in the same policy and tests.
• proerror77/monday#554: Covers the same legacy health-start admission behavior and contract tests.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely describes the policy change that accepts disabled legacy health admission.
Description check	✅ Passed	The description covers the change, issue, validation, scope, dependencies, and rollback, but it omits the template's Scope exception section.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/policy-baseline-optional

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}