feat: 统一证据查询第 5 源（tickets）+ self-cloud-pool 落位注记（IR-0006 W2-C1 / ADR-0103）

[randypanding]

摘要

W2-C1（内网调度器 v0）的 .github 侧收口：

• evidence-query.sh 第 5 源：cnb-bridge @ tickets-ledger 分支的 tickets.jsonl——内网调度器短票据 grant/revoke 事件（AC-5b 统一账本口径）。404/分支未建=源缺席非红（REMOVAL 语义：源消失≠链断）；链断=fail-closed exit 3。
• providers.yaml：self-cloud-pool entry 注记 v0 落位（cnb-bridge/selfcloud）。
• test-evidence-shadow.sh：测试扩至五源——tickets fixture、gh 桩补 tickets case（含 404 变体）、W2-C1: 内网调度器 v0——Job Contract 消费+短票据签发+egress allowlist+无状态约束执法 #412 subject 查询断言（grant/revoke 2 条 source=tickets）、源缺席用例。

实测（本地 gate 等价）：五源查询 #412 by_source tickets=2（Go 发射器产出，跨语言 SHA-256 验链绿）；test-evidence-shadow: PASS。

关联：cnb-bridge PR #6（selfcloud 调度器 v0 本体）。

Card: #412

Summary by CodeRabbit

• 新功能
  • 证据查询现支持 tickets 来源，可统一读取、校验链完整性并按来源统计。
  • 支持按卡片查询 tickets 相关记录。
• 改进
  • 增强账本缺席与链断场景的处理和校验反馈。
  • 更新自托管云池能力说明，涵盖任务契约、短票据、出口限制及无状态约束。
• 维护
  • 工作区临时 scratch 目录将不再纳入版本管理。

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[qodo-code-review]

PR Summary by Qodo

Add tickets ledger to unified evidence queries

✨ Enhancement 🧪 Tests 📝 Documentation ⚙️ Configuration changes 🕐 20-40 Minutes

AI Description

• Add tickets grant/revoke ledger as the fifth verified evidence source.
• Preserve non-failing 404 absence while retaining fail-closed chain validation.
• Document self-cloud scheduler placement and test five-source query behavior.

Diagram

graph TD
  A["Existing ledgers"] --> C["Evidence query"] --> D["Chain verifier"] --> E["Unified JSONL"]
  B["Tickets ledger"] --> C

Loading

High-Level Assessment

Explicitly wiring tickets into the existing fetch, verify, merge, and summary path is the lowest-risk approach because it preserves established evidence semantics and keeps all sources under one verifier. A declarative source registry was considered, but metering's directory-based retrieval differs from the single-file ledgers, so that refactor would broaden scope without improving this delivery.

Files changed (4) +62 / -18

Enhancement (1) +10 / -5

evidence-query.shQuery tickets as the fifth evidence source +10/-5

Query tickets as the fifth evidence source

• Fetches 'tickets.jsonl' from 'cnb-bridge@tickets-ledger', verifies it with the existing hash-chain implementation, and includes ticket records in merged output and source summaries. Missing ticket branches or files remain optional 404 absences, while invalid chains still terminate with exit code 3 and no trusted output.

governance/evidence-query.sh

Tests (1) +49 / -12

test-evidence-shadow.shCover five-source evidence queries and ticket events +49/-12

Cover five-source evidence queries and ticket events

• Adds chained ticket grant/revoke fixtures, GitHub API stub responses, card-filter assertions, and source-count updates for five-source queries. It also verifies that a missing tickets ledger is skipped without failure while existing chain-break behavior remains fail-closed.

governance/tests/test-evidence-shadow.sh

Other (2) +3 / -1

.gitignoreIgnore scratch workspace clones +1/-0

Ignore scratch workspace clones

• Adds '.scratch/' to prevent independent workspace clones from being committed as accidental gitlinks and breaking CI checkout.

.gitignore

providers.yamlRecord the self-cloud scheduler v0 placement +2/-1

Record the self-cloud scheduler v0 placement

• Updates the 'self-cloud-pool' provider entry to identify 'cnb-bridge/selfcloud' as the deployed scheduler and document its job-contract, short-ticket, egress, and stateless enforcement responsibilities.

governance/providers.yaml

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: cdd5a94d-8e6d-4bd9-a03e-4d25a0b5994e

📥 Commits

Reviewing files that changed from the base of the PR and between 63e9af7 and 146992d.

📒 Files selected for processing (4)

• .gitignore
• governance/evidence-query.sh
• governance/providers.yaml
• governance/tests/test-evidence-shadow.sh

---

📝 Walkthrough

Walkthrough

概览

新增 tickets 账本源的证据查询、链校验、来源统计和测试覆盖。更新 self-cloud-pool 调度入口说明，并忽略 .scratch/ 目录。

Changes

证据查询与治理配置

Layer / File(s)	Summary
Tickets 账本查询与验证 governance/evidence-query.sh, governance/tests/test-evidence-shadow.sh	查询脚本支持 tickets 账本拉取、验证、归并和来源统计。测试覆盖 grant/revoke 事件、按卡片查询、源缺席和链断场景。
调度说明与工作区规则 governance/providers.yaml, .gitignore	self-cloud-pool 的入口更新为 cnb-bridge 仓库中的 selfcloud/ 调度器，并补充其约束能力说明。新增 .scratch/ 忽略规则。

Suggested labels: feature

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch w2c1-tickets-source

---

_{Comment @coderabbitai help to get the list of available commands.}

[randypanding]

重复 PR：同内容已由 #444 合入 main（本地分支 w2c1-tickets-source 与 #444 同源）。关闭。

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (1) 📘 Rule violations (0) 📜 Skill insights (0)

1. PAT scope omits cnb-bridge 🐞 Bug ☼ Reliability

Description

The new fetch requires GH_TOKEN to read Cloudbird-Software/cnb-bridge, while the command still
tells operators that a PAT covering the original two repositories is sufficient. A least-privilege
token provisioned according to that contract receives a non-404 authorization error and makes every
query exit 2 before returning evidence.

Code

governance/evidence-query.sh[76]

+TICKET_OK=0; fetch_file "Cloudbird-Software/cnb-bridge" "tickets-ledger" "tickets.jsonl" "$TMP/tickets.jsonl" && TICKET_OK=1 || [[ $? -eq 1 ]] || exit 2

Relevance

● Weak

Exact same-file authorization-scope finding was rejected in PR #444 on 2026-08-29.

PR-#444

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The usage contract and missing-token error both promise that two-repository contents access is
enough, but the added call reads a third repository. fetch_file exits 2 for any failure not
rendered as HTTP 404, which includes an authorization failure from a token lacking access to
cnb-bridge.

governance/evidence-query.sh[17-18]
governance/evidence-query.sh[33-55]
governance/evidence-query.sh[73-76]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
Adding the tickets ledger introduced a third private-repository read, but the documented and runtime credential guidance still requires access to only two repositories.

## Issue Context
`fetch_file` treats authorization failures as fatal non-404 errors, so a least-privilege PAT following the current guidance cannot query the new source.

## Fix Focus Areas
- governance/evidence-query.sh[17-18]
- governance/evidence-query.sh[33-33]
- governance/evidence-query.sh[76-76]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

Context sources

✅ Compliance rules (platform): 22 rules

Review mode: ⚖️ Balanced

Tip of the day

💡 Did you know, you can group findings by type and pick your Finding display, from Minimal to Full

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗