wenshao · Aug 21, 2026 · Aug 16, 2026 · Aug 16, 2026 · Aug 16, 2026 · Aug 16, 2026
@@ -45,6 +45,15 @@ git config --file "${GIT_CONFIG_GLOBAL}" safe.directory "$(pwd)"
 if [ -s /etc/gitconfig ]; then
   echo "::notice::/etc/gitconfig exists but is bypassed by the gate's GIT_CONFIG_SYSTEM redirect — replicate any setting the checks need via per-job env."
 fi
+# Two more inherited knobs steer EXECUTION itself, and neither has a
+# legitimate setter: BASH_ENV names a file every non-interactive bash
+# child sources at startup — a $GITHUB_ENV plant from an earlier step
+# would run inside the trusted helpers this gate spawns, past the channel
+# strip below (it covers their environment, not bash's startup file) —
+# and BITE_RUNNER selects the bite check's runner command, which executes
+# unwrapped with the gate's full environment. Strip them with the GIT_*
+# class.
+unset BASH_ENV BITE_RUNNER
 
 # Record whether the agent left a commit FIRST — this is a ref-only
 # diff, so it runs before the failure.md early-exits and covers an
@@ -60,27 +69,6 @@ if [[ "${committed_rc}" -eq 1 ]]; then
   echo "committed=true" >> "${GITHUB_OUTPUT}"
 fi
 
-if [[ -f "${WORKDIR}/failure.md" && -n "$(git status --porcelain)" ]]; then
-  echo "❌ Agent wrote failure.md after leaving a dirty workspace:"
-  git status --short
-  cat "${WORKDIR}/failure.md"
-  echo "outcome=failed" >> "${GITHUB_OUTPUT}"
-  exit 1
-fi
-
-if [[ -f "${WORKDIR}/failure.md" ]]; then
-  echo "🛑 Agent aborted intentionally:"
-  cat "${WORKDIR}/failure.md"
-  echo "outcome=failed" >> "${GITHUB_OUTPUT}"
-  exit 1
-fi
-
-# Convention: hooks are severed at EVERY host checkout of the PR
-# branch (no secret sits in this step's env, but a post-checkout
-# hook still runs branch code on the host).
-git config core.hooksPath /dev/null
-git checkout "${BRANCH}"
-
 GATE_LOG="${WORKDIR}/gate-output.log"
 : > "${GATE_LOG}"
 rm -f "${GATE_LOG}.bite"
@@ -97,6 +85,9 @@ reject_fix() {
   # step means the gate itself crashed, so losing the detail file must not turn
   # a deterministic rejection into an infrastructure retry.
   echo "outcome=failed" >> "${GITHUB_OUTPUT}"
+  if [[ "${AUDIT_VERDICT_RECORDED:-false}" == 'true' ]]; then
+    echo "audit_verdict=${AUDIT_VERDICT}" >> "${GITHUB_OUTPUT}"
+  fi
   if [[ "${preexisting}" == 'true' ]]; then
     # NOT retryable: the repair agent is only allowed to amend this round's
     # fix, and a failure that exists without the fix is outside that boundary
@@ -129,6 +120,102 @@ reject_fix() {
     echo "::warning::could not write the gate rejection detail; the verdict stands."
   exit 1
 }
+# Last-writer binding for the audit verdict: the record below happens
+# BEFORE the branch's build/tests run, and a check can still discover the
+# step-output FILE through the inherited $RUNNER_TEMP (the strip removes
+# the variable, not the backing file) and append its own audit_verdict —
+# step outputs are last-write-wins. Every exit past the record therefore
+# re-appends the validated verdict INLINE (no function call: gate snippets
+# extracted by the contract suite must stay executable standalone), so
+# the gate's copy outwrites any forged append. The flag gates it: a
+# verdict rejected BEFORE its record (missing, malformed, or a routing
+# violation) never surfaces.
+# Growth-audit verdict gate: a round tagged KISS_AUDIT (its counting window
+# is over the growth budget) must carry the audit's machine-readable verdict
+# — the audit IS the round's judgment of the over-budget approach, and a
+# round that skipped it must not push (the rubber-stamp hole by absence).
+# Sits BEFORE the failure.md early-exits below: a conflict round stops
+# BLOCKED via failure.md, and its verdict must be validated and surfaced to
+# GITHUB_OUTPUT before that exit writes outcome=failed — otherwise the
+# conflict trail marker never posts and the idempotent park never engages.
+# Also before the build/schema/footprint checks AND the no-commit/no-op
+# exits further down: the verdict is required even for a no-op audit round
+# whose verdict is sound with nothing left to fix. Malformed is agent
+# misbehavior, not a build problem — NON-retryable, so the repair pass is
+# never invoked and the next scan simply re-runs the audit.
+if [[ "${KISS_AUDIT:-false}" == 'true' ]]; then
+  AUDIT_VERDICT=''
+  if [[ -f "${WORKDIR}/growth-audit.json" ]]; then
+    # Slurp so the document COUNT is part of validation: the per-document
+    # parse accepted a valid first document followed by one jq errors on
+    # (or shape-filters out) on the FIRST document's verdict — the gate's
+    # contract is a single JSON document, so reject every multi-document
+    # stream.
+    AUDIT_VERDICT="$(jq -rs '
+        if length != 1 then empty else .[0]
+        | select((.verdict // "") | IN("sound", "drift", "conflict"))
+        | select((.kiss.result // "") | IN("pass", "fail"))
+        | select((.minimal_change.result // "") | IN("pass", "fail"))
+        | select((.verdict != "sound")
+            or ((.kiss.result == "pass") and (.minimal_change.result == "pass")))
+        | select((.verdict != "drift")
+            or ((.kiss.result == "fail") or (.minimal_change.result == "fail")))
+        | .verdict end' "${WORKDIR}/growth-audit.json" 2> /dev/null || true)"
+  fi
+  # Anchor the parsed value (defense in depth now that slurp rejects
+  # multi-document streams outright).
+  [[ "${AUDIT_VERDICT}" =~ ^(sound|drift|conflict)$ ]] || AUDIT_VERDICT=''
+  if [[ -z "${AUDIT_VERDICT}" ]]; then
+    {
+      echo "Growth-audit round (this counting window is over its growth budget) without a valid growth-audit.json verdict."
+      echo "The audit must run BEFORE any edit this round, and the verdict file must be a single JSON document carrying verdict sound|drift|conflict plus kiss.result and minimal_change.result each pass|fail, consistent with the taxonomy (sound requires both axes pass; drift requires at least one axis fail). Re-run the audit and produce the file; do not push without it."
+    } >> "${GATE_LOG}"
+    reject_fix 'growth-audit round missing a valid growth-audit.json verdict (audit skipped or malformed)' 'false' 'false'
+  fi
+  echo "🔎 growth-audit verdict: ${AUDIT_VERDICT}"
+  # Conflict routing is enforced HERE, not by convention: a conflict verdict
+  # must STOP BLOCKED with a handoff (the only growth path to a human). A
+  # round that kept fixing and committed would otherwise clear the gate like
+  # sound/drift, push the contested code, and park the next scan on a
+  # handoff question that was never asked. NON-retryable: re-audit, don't
+  # repair.
+  if [[ "${AUDIT_VERDICT}" == 'conflict' && ! -f "${WORKDIR}/failure.md" && ! -s "${WORKDIR}/handoff.md" ]]; then
+    reject_fix 'growth-audit verdict is conflict but the round did not stop with a handoff; conflict must STOP BLOCKED (no push)' 'false' 'false'
+  fi
+  # The no-push half of this routing is enforced at the success exit
+  # below: a repair pass re-auditing to conflict LEGITIMATELY runs behind
+  # the first pass's commit (committed_rc=1), so the push shape cannot be
+  # refused here without refusing it — the refusal sits at the push
+  # boundary itself.
+  # Record the verdict the GATE validated, for the report step to consume
+  # via the step output. The report must NOT re-read the file itself: the
+  # branch's own build/tests run as the runner user after this point and
+  # WORKDIR is a predictable path they can write — the validated verdict is
+  # the only verdict that may reach the trail marker and the re-arm.
+  echo "audit_verdict=${AUDIT_VERDICT}" >> "${GITHUB_OUTPUT}"
+  AUDIT_VERDICT_RECORDED='true'
+fi
+
+if [[ -f "${WORKDIR}/failure.md" && -n "$(git status --porcelain)" ]]; then
+  echo "❌ Agent wrote failure.md after leaving a dirty workspace:"
+  git status --short
+  cat "${WORKDIR}/failure.md"
+  echo "outcome=failed" >> "${GITHUB_OUTPUT}"
+  exit 1
+fi
+
+if [[ -f "${WORKDIR}/failure.md" ]]; then
+  echo "🛑 Agent aborted intentionally:"
+  cat "${WORKDIR}/failure.md"
+  echo "outcome=failed" >> "${GITHUB_OUTPUT}"
+  exit 1
+fi
+
+# Convention: hooks are severed at EVERY host checkout of the PR
+# branch (no secret sits in this step's env, but a post-checkout
+# hook still runs branch code on the host).
+git config core.hooksPath /dev/null
+git checkout "${BRANCH}"
 baseline_also_fails() {
   # A deterministic rejection is only chargeable to this round if the same
   # check passes WITHOUT the round's commits. Measured counterexample, run
@@ -176,7 +263,7 @@ baseline_also_fails() {
   local ab_log="${GATE_LOG}.baseline"
   : > "${ab_log}"
   rc=0
-  if ! "$@" >> "${ab_log}" 2>&1; then
+  if ! strip_runner_channels "$@" >> "${ab_log}" 2>&1; then
     rc=1
   fi
   git restore -- . 2>> "${GATE_LOG}" || true
@@ -197,6 +284,9 @@ baseline_also_fails() {
       tail -c 3000 "${GATE_LOG}" 2> /dev/null
       echo '````'
     } > "${WORKDIR}/gate-rejection.md" || true
+    if [[ "${AUDIT_VERDICT_RECORDED:-false}" == 'true' ]]; then
+      echo "audit_verdict=${AUDIT_VERDICT}" >> "${GITHUB_OUTPUT}"
+    fi
     exit 1
   fi
   # Every retryable exit below hands the tree to the repair agent with
@@ -271,14 +361,28 @@ fail_signature() {
 seed_dist_note() {
   echo "⚠️ the baseline leg rebuilt dist/ from baseline sources — run npm run build before typecheck/tests" >> "${GATE_LOG}"
 }
+# Every check below runs the BRANCH's own code (npm scripts, tests, and
+# their lifecycle children) with this step's inherited environment. Strip
+# the runner injection channels first: a check appending to GITHUB_OUTPUT
+# would overwrite the gate's own outputs last-write-wins (a forged
+# audit_verdict=sound after the gate's write), GITHUB_ENV/GITHUB_PATH
+# plant environment for the PAT-bearing steps that follow, and
+# GITHUB_STEP_SUMMARY lets branch code forge the job summary styled as
+# gate output (the display-channel sibling; qwen-triage strips it when
+# running external-author branch code for the same reason). Same class the
+# deferred-upsert child closes with env -i; targeted -u here because the
+# checks need the ordinary environment (PATH, HOME, …) to run at all.
+strip_runner_channels() {
+  env -u GITHUB_OUTPUT -u GITHUB_ENV -u GITHUB_PATH -u GITHUB_STEP_SUMMARY "$@"
+}
 run_check() {
   # pipefail makes the pipeline carry the command's status, not tee's. The
   # side copy holds THIS check's transcript alone — the identity comparison
   # must not match diagnostics an earlier check left in the shared log.
   local label="${1}"
   shift
   : > "${GATE_LOG}.check"
-  if ! "$@" 2>&1 | tee -a "${GATE_LOG}" "${GATE_LOG}.check"; then
+  if ! strip_runner_channels "$@" 2>&1 | tee -a "${GATE_LOG}" "${GATE_LOG}.check"; then
     if baseline_also_fails "$@"; then
       reject_fix "${label} (pre-existing: also fails without this round's commit)" 'true'
     fi
@@ -298,7 +402,7 @@ run_check_no_ab() {
   # allowlist).
   local label="${1}"
   shift
-  if ! "$@" 2>&1 | tee -a "${GATE_LOG}"; then
+  if ! strip_runner_channels "$@" 2>&1 | tee -a "${GATE_LOG}"; then
     reject_fix "${label}"
   fi
 }
@@ -360,6 +464,9 @@ if git diff --quiet "origin/${BRANCH}...${BRANCH}"; then
     cat "${WORKDIR}/no-action.md"
     echo "verified_head=$(git rev-parse HEAD)" >> "${GITHUB_OUTPUT}"
     echo "outcome=noop" >> "${GITHUB_OUTPUT}"
+    if [[ "${AUDIT_VERDICT_RECORDED:-false}" == 'true' ]]; then
+      echo "audit_verdict=${AUDIT_VERDICT}" >> "${GITHUB_OUTPUT}"
+    fi
     exit 0
   fi
   echo "❌ Branch unchanged and no no-action.md — agent produced nothing"
@@ -839,7 +946,7 @@ bite_runner_default() {
   # $1 = workspace dir, rest = test paths relative to the workspace.
   local ws="${1}"
   shift
-  npm run test --workspace "${ws}" --if-present -- "$@"
+  strip_runner_channels npm run test --workspace "${ws}" --if-present -- "$@"
 }
 mapfile -d '' -t BITE_FILES < <(git diff --name-only -z --no-renames --diff-filter=AM "${ROUND_RANGE}" \
   -- ':(glob)**/*.test.*' ':(glob)**/*.spec.*' ':(exclude,glob)**/__snapshots__/**' \
@@ -1008,6 +1115,9 @@ if [[ "${#BITE_FILES[@]}" -gt 0 && -n "${BITE_SRC}" ]]; then
           tail -c 3000 "${GATE_LOG}" 2> /dev/null
           echo '````'
         } > "${WORKDIR}/gate-rejection.md" || true
+        if [[ "${AUDIT_VERDICT_RECORDED:-false}" == 'true' ]]; then
+          echo "audit_verdict=${AUDIT_VERDICT}" >> "${GITHUB_OUTPUT}"
+        fi
         exit 1
       }
       git reset --quiet 2>> "${GATE_LOG}" || true
@@ -1058,5 +1168,16 @@ if [[ "${#BITE_FILES[@]}" -gt 0 && -n "${BITE_SRC}" ]]; then
   fi
 fi
 assert_verification_tree
+# A conflict verdict must STOP BLOCKED: completing as fixed would push the
+# contested code under the PAT while the report posts the park marker —
+# the exact outcome the routing check above exists to prevent. The routing
+# check cannot see this shape (a planted handoff.md satisfies it), so
+# refuse at the push boundary. NON-retryable: re-audit, don't repair.
+if [[ "${AUDIT_VERDICT:-}" == 'conflict' ]]; then
+  reject_fix 'growth-audit verdict is conflict but the round completed as fixed; conflict must STOP BLOCKED (no push)' 'false' 'false'
+fi
 echo "verified_head=${VERIFICATION_HEAD}" >> "${GITHUB_OUTPUT}"
 echo "outcome=fixed" >> "${GITHUB_OUTPUT}"
+if [[ "${AUDIT_VERDICT_RECORDED:-false}" == 'true' ]]; then
+  echo "audit_verdict=${AUDIT_VERDICT}" >> "${GITHUB_OUTPUT}"
+fi