ci: prevent merges when exact-head verification has failed

[reprewindai-dev]

Merge-gate defect

PR #31 (fix(ops): fail closed on unmeasured CAPPO validation) was merged into main on 2026-08-08 at merge commit b2d1f8c53e7b5047eca7a85d93587a7b186d1808 while its exact head b57012fd6069de77fa4af183ccf0ef6229a2ccf7 still had cAPI CI run 31248064648 concluded failure.

The source correction itself is directionally correct, but this violates the required merge policy: merge only when exact-head tests/lint/build/security checks have actually passed with no blocking review.

Required correction

1. Protect main so required exact-head CI checks must succeed before merge.
2. Do not allow draft PRs to be merged through the normal remediation flow.
3. Require current-head status after the final push/rebase; stale green checks must not satisfy the gate.
4. Require the focused test, full test suite, lint/type/build, dependency/security checks, and CodeQL as appropriate to this repository.
5. Diagnose the recurring workflow-start/zero-step failures separately; infrastructure failure must remain a failed/unverified gate, not be treated as a source pass.
6. Re-run the merged fix(ops): fail closed on unmeasured CAPPO validation #31 source on merge commit/current main; record the actual test results. Do not infer runtime verification from source tests.

Truth boundary

• observed_current_responsibilities: cAPI is canonical Interlink and now contains the fail-closed CAPPO measurement source correction from fix(ops): fail closed on unmeasured CAPPO validation #31.
• target_responsibilities: protected default branch with exact-head verification required for remediation merges.
• reported_runtime_state: cAPI 3003.
• verified_runtime_state: none established here.
• unverified_claims: deployed SHA, listener 3003, HTTP/protocol identity, Traefik route, CAPPO reachability, and Gnomledger registration.

[reprewindai-dev]

Foundation-wide CI evidence update: cAPI #36 exact-head run 31312868021 fails with job verify exposing zero steps and no retrievable log blob (BlobNotFound). uacpv3 #4 exact-head run 31305435816 shows the same failed-job/zero-step pattern. BYOS #175 exact-head run 31264959405 also reports a failed build/import job with no step data. Treat these as failed/unverified merge gates, but do not attribute them to source tests unless a runner actually starts and produces steps/logs. This now looks like a shared Actions/runner/configuration problem across repositories and should be fixed at the foundation CI layer; until then no affected PR should be merged under the exact-head policy.

[reprewindai-dev]

Additional CI classification evidence: .github/workflows/ci.yml on current main explicitly defines a five-step verify job (checkout, setup-node, npm ci, npm test, npm run build). PR #36 exact-head run 31312868021 still returns a completed failed verify job with steps: null. That strengthens the classification as a pre-step runner/Actions failure rather than evidence that npm ci, tests, or build actually failed. Separately, current main commit 5d228475e4b381fae66deb4846a0ee6f6013511b has both attached Vercel contexts failing. Keep #36 draft/unmerged until a runner produces executable exact-head steps and the repository/deployment status checks are reconciled; do not promote source or runtime verification from these failures.

[reprewindai-dev]

Fresh reproduction on an unrelated one-file docs/config cleanup confirms the Actions blocker is still pre-step and repository-wide rather than specific to #36 source logic.

• PR fix(security): remove concrete Redis topology from env example #37 exact head: 95b1879e1b9a21ca5292a2cb3a9ef9e261b20d7d
• cAPI CI run: 31328821908
• job verify id: 93283591545
• job result: failure
• returned steps: null

#37 only removes a concrete Redis hostname from .env.example; the workflow still fails before exposing any checkout/test/build step. Keep CI failure classified as infrastructure/pre-step until GitHub exposes an executable failing step or runner/log evidence. Do not attribute this failure to application tests without that evidence.

[reprewindai-dev]

Fresh exact-head evidence: cAPI PR #40 head d90dd9c57629a93364519b5f8ee5c8a58dd8006e triggered cAPI CI run 31347015571; job verify failed with steps: null. This is the same pre-step Actions/runner failure pattern seen on unrelated cAPI heads. It does not establish a source-test failure, but it remains a blocking merge gate.