fix(fr-gate): gate the diff, not just commit subjects

[LukasWodka]

Closes tracebloc/backend#1265. RFC-BACKEND-0008 D27-L1.

The defect

Item discovery greps commit subjects for (#N):

PRS=$(git log --format='%s'"$BASE_SHA..$HEAD_SHA"| grep -oE '\(#[0-9]+\)|Merge pull request #[0-9]+' ...)

Any commit whose subject lacks a marker — hand-written, rebase-merged, or folded inside a merge —
is invisible. design-system#70 (merged 2026-07-23) shipped 13 commits over 9 source files; one
carried (#67); the gate logged "Items in promotion: 67 → PASSED" and the other 12 commits reached
main unevaluated.

The fix

An attribution pass over every non-merge commit in BASE..HEAD. A commit is attributable if:

1. its own subject carries a (#N) / Merge pull request #N, or
2. it is reachable from the 2nd parent of a merge in range — it entered via a PR merge even if
   its own subject is bare.

Anything left is code that reached the range without a reviewed PR. It now fails the gate closed,
with a message pointing at the override for legitimate release-mechanics commits.

Normal flow is unaffected: squash- and rebase-merges to develop each produce one (#N) commit, so
they attribute by subject.

Verification

Against a git fixture — a subject-ref commit, two commits vouched for by their PR merge, and one
direct-push commit — only the direct push flags. actionlint passes.

Stacking

Based on fix/1266-fr-gate-fail-closed (#71), not develop — both edit fr-gate.yml and would
otherwise conflict. Merge #71 first, then this. After #71 merges, this PR's base auto-retargets;
if GitHub shows a conflict, rebase onto the new develop.

Together, #71 and this close the two halves of how the gate was passing things it never checked: #71
stops it passing on an unreadable item, this stops it passing over an unattributed commit.

Full end-to-end (real promotion + live kanban token) will run in CI; the attribution logic is
fixture-tested above.

---

Note

Medium Risk
Changes promotion-blocking CI logic for staging/main; incorrect merge ancestry rules could false-fail legitimate promotions, but scope is limited to fr-gate.yml with an existing override label.

Overview
The FR gate no longer relies only on PR numbers scraped from commit subjects. It now scans every non-merge commit in the promotion range and fails closed when any commit cannot be tied to a reviewed PR.

A commit counts as attributable if its subject includes (#N) / Merge pull request #N, or if it was introduced by a merge in range (ancestor of the merge’s second parent but not of the first parent, so base-branch direct pushes are not vouched). Leftover SHAs are emitted as unattributed and block the check alongside blocked/missing/unreadable kanban items, with guidance to open a PR or use skip-fr-gate for legitimate release mechanics.

Squash and rebase merges that already put (#N) in the subject should behave as before; the change targets invisible commits inside merge promotions and other paths without subject markers.

^{Reviewed by Cursor Bugbot for commit dc5466c. Bugbot is set up for automated code reviews on this repo. Configure here.}

[LukasWodka]

👋 Heads-up — Code review queue is at 42 / 30

Above the WIP limit. The team convention is to review existing PRs before opening new work.

Open PRs currently in Code review (oldest first):

• .github#64 — fix(closure-router): add GH_TOKEN to closing-PR lookup so issues mirror their closing PR's Status · author: @LukasWodka · no reviewer assigned
• .github#65 — feat(quality): shared code-quality reusable workflow + house-rules checker · author: @LukasWodka · no reviewer assigned
• .github#68 — feat(fr-gate): make the FR gate self-clearing and self-explanatory · author: @LukasWodka · no reviewer assigned
• .github#71 — fix(fr-gate): fail closed on an unreadable or absent Status · author: @LukasWodka · no reviewer assigned
• averaging-service#207 — Promote develop → staging · author: @shujaatTracebloc · no reviewer assigned
• backend#1201 — docs(rfc): Data spaces & federated dataset composition (draft) · author: @LukasWodka · no reviewer assigned
• backend#1217 — docs(rfc): Dataset integrity & score reproducibility (draft) · author: @LukasWodka · no reviewer assigned
• backend#1228 — Promote develop → staging · author: @shujaatTracebloc · reviewer: @saadqbal
• backend#1244 — fix(experiments): surface save-time failures as 5xx + guard new NOT NULL columns · author: @LukasWodka · reviewer: @saqlainsyed007
• backend#1251 — docs(bugbot): add .cursor/BUGBOT.md project context (#930) · author: @LukasWodka · no reviewer assigned

Pull from review before opening new work. (This is a nudge from the kanban WIP check, not a block.)

[LukasWodka]

Bugbot finding addressed — real false-negative. The merge-vouch path accepted any ancestor of ^2; a direct push to the base branch becomes an ancestor of ^2 once a feature branch merges the base in, so it slipped through.

Tightened to M^1..M^2 (reachable from ^2and not from ^1 — the commits the merge actually introduced). Verified on a fixture reproducing the exact pattern: old check flagged nothing, new check flags the direct push, and the normal feature-merge case still flags only its own direct push. actionlint green.

bugbot run

[LukasWodka]

bugbot run

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit dc5466c. Configure here.}