# I1 GitHub Required-Check Gates — 2026-08-23

Status: complete and live-verified.

This ledger closes the I1 gap where MergeGate could accept coder-supplied `required=true` evidence without proving the repository's actual required GitHub checks for the immutable published candidate.

## Constraints

- Do not initiate FactoryRun/AgentRun.
- Do not initiate Subrouter/account login.
- Do not provision or copy a GitHub publication credential.
- Agent workloads never receive reusable GitHub credentials.
- GitHub remains CI executor/provider; AWP owns required policy, normalized evidence, and MergeGate.
- Build/test only on debian1/debian2/debian3.

## Gates

- [x] **G1 — Durable project policy:** `Project.requiredChecks` is first-class domain/persistence state; dogfood bootstrap sets `CI`; API can create/update policy. Migration `0011_hesitant_mojo.sql` adds durable `projects.required_checks`. PGlite round-trip proof passes.
- [x] **G2 — Provider requirement reconciliation:** GitHub branch-protection required contexts/checks are read and unioned with AWP Project policy. Provider-required checks cannot be omitted by Project policy.
- [x] **G3 — Exact publication revision:** GitHub check observations are read for `ChangeSet.publicationReference.nativeRevision` (trusted publication commit SHA), while persisted `VerificationEvidence.candidateDigest` remains the immutable candidate tree digest. Tests deliberately use distinct tree (`2…`) and publication (`4…`) SHAs.
- [x] **G4 — Fail-closed normalized evidence:** every required check gets candidate-bound provider evidence; missing/pending/failed checks remain non-passing. Provider read failure persists a required missing policy receipt plus missing Project-required checks.
- [x] **G5 — No coder self-certification:** coder/reviewer callback evidence cannot use the reserved `repository-required-checks:*` source namespace; only the trusted CI provider boundary can create those receipts. Published ChangeSets require a passing provider policy receipt before `verificationSatisfied()` can succeed.
- [x] **G6 — Reconciliation progression:** required checks refresh after trusted publication, after independent Review submission, via explicit canonical refresh command, and immediately before Merge. Latest observation wins; ChangeSet repository/candidate/publication/target identity is revalidated before persistence.
- [x] **G7 — Dogfood workflow trigger/UI:** `.github/workflows/ci.yml` runs on `awp/**` trusted publication branches without handing a GitHub credential to Agent workloads. U4/U5 represent reviewing vs verifying vs changes-requested vs ready-to-merge; verifying exposes `Refresh required checks` and does not expose Merge/correction. Focused UI test proves this.
- [x] **G8 — Focused/full remote gates:** on debian2, focused CI/provider/MergeGate/read-model/persistence tests passed; final exact-tree `pnpm check` passed with 41 test files passed / 2 skipped, 154 tests passed / 5 skipped, build green, architecture 6/6, dependency-cruiser zero violations (111 modules / 195 dependencies), and Prettier clean.
- [x] **G9 — Zero-run live deploy:** exact source commit `90642520a3f253208bba2256eb239df398392349` deployed to debian3. Control-plane/web/Postgres are active; health is 12/12 migrations with pending=0 and drift=[]; self Project persists `required_checks=["CI"]`; FactoryRun/AgentRun/ChangeSet/Review/evidence/finding counts remain zero; Subrouter accounts remain empty; both the GitHub publication token file and control-plane env binding are absent; Subrouter/model-gateway/Fabro remain 1/1 Ready on their immutable registry digests. No owner action was initiated.

## Source evidence

Buildbox: `debian2` (`100.79.69.43:2222`). Scratch tree: `/home/user/runs/awp-i1-required-checks`.

Focused proof after reconciliation:

- `tests/integration/arc/ci-github.test.ts`
- `tests/integration/arc/ci-github-http.test.ts`
- `tests/integration/verification-merge-gate.test.ts`
- `tests/application/i1-detail-read-models.test.ts`
- `tests/integration/persistence.test.ts`
- `tests/persistence/schema.test.ts`
- `tests/integration/arc/arc-manifests.test.ts`
- `tests/e2e/ui/lifecycle-render.test.ts`

Final full command: `pnpm check` under Node 22 + repository-pinned pnpm 9.7.0 via `/tmp/awp-corepack-bin`.

Final result: PASS.

## Live deployment evidence

- deployed source: `90642520a3f253208bba2256eb239df398392349` from a clean worktree synced to debian3;
- deployment command: existing `infra/dogfood/deploy-debian3.sh` with `/home/user/.local/bin` explicitly on non-interactive SSH PATH;
- first invocation exited before mutation because `mise` was absent from SSH PATH; second invocation completed successfully;
- live URL emitted by deploy script: `http://100.101.104.41:4173`;
- health: `applied=12`, `expected=12`, `pending=0`, `drift=[]`;
- persisted dogfood Project policy: `required_checks=["CI"]`;
- execution/review/evidence/finding tables: all zero; account inventory: empty;
- GitHub publication authority: token file absent and `AWP_GITHUB_PUBLICATION_TOKEN_FILE` absent from generated control-plane env;
- immutable K3s system images remain Ready: Subrouter `ad546a6…`, model gateway `1e572c0…`, Fabro `94e65f3…`.