[JustYannicc]

Problem

The Merge gate can't tell where a pull request comes from: signalbox.pull_request_read has no head branch, base branch or head repository. #5's upstream-sync automation needs the signalbox folder's gate to merge its own sync PRs, which touch "hard to undo" paths almost every time, without relaxing anything for a fork's PR. The repo is public, so a fork can run its own workflows and fake check names.

Fix

pull_request_read also returns headBranch, baseBranch and headRepository (another repository's is a fork):

• Cloud: the evidence query reads headRefName, baseRefName and headRepository.nameWithOwner in the same GraphQL call as before.
• Self-hosted: from the PR detail the server already reads.

The default gate doesn't use them. They're on its PullRequest type so a customized gate can, and the precompiled built-ins are regenerated.

Verification

• vp test run src/automations/mergePullRequest.test.ts (cloud): 6 passed, including a new fork case where the gate's "Read the pull request" step shows headBranch, baseBranch: "main" and headRepository: "fork/repo".
• vp test run src/workflows/builtinTools (server): 2 passed, asserting the new fields.
• packages/automations tests: 24 passed (the precompiled file is current).
• Typecheck of cloud, server and packages/automations, plus lint on the changed files, are clean.

Closes #687. Part of #5, map #384.

🤖 Generated with Claude Code

[JustYannicc]

Merged by the coordinator. CI was green on the head, with no bot findings. The builder's live proof is in this PR. A scratch merge of current main with #665, #706, #688, #693 and #651 passed: contracts 676 tests, automations 24, the api parity check 21, cloud GitHub and automations 38, mobile 17, plus server layer, compiler and upstream-sync hook tests. Typecheck was clean for contracts, cloud, server, web and mobile.