Unify the three per-artifact drift gates CiYamlGate RoadmapGate GitignoreGate into ONE universal generated-artifact policy - model the 3 questions generate-commit-drift with commit-policy DERIVED from the gitignore dag knowledge - registry-fold not opt-in - load-bearing gate infra, model-checkpoint-

[briansrls]

Auto-opened by session-dashboard for session gentle-ibex-384.
Pushing to session/gentle-ibex-384 advances this PR.

Worker attestation

Before flipping this PR to ready for review, confirm each item:

• Title describes the change (not the session id or branch).
• PR body summarises what and why (replace the TODO below).
• Tests run: name the command (e.g. npm test, cargo test) and the result.
• If this closes a work item, the body contains a Closes #N directive.
• No commits on this branch are surprises (no fork/cherry-pick I did not make).
• No secrets / credentials / large binaries staged.

Summary

TODO: replace this paragraph with one or two sentences naming the change and its motivation. Reviewers read this first.

Test plan

• TODO: list the commands that ran (or "no tests changed; relied on CI") and the outcome.

[gunbai-bot]

Both advisory findings from the claude-opus-4-7 review are addressed in 3fab2c3 (thanks — both were valid):

Finding 2 (second reader of gitignore semantics): moved path_is_ignored + pattern_matches (and the slash/suffix helpers) out of generated_artifact and into gunbc.gitignore_emit, right beside artifact_pattern/ignore_patterns — the producer and the interpreter of gitignore patterns now live in ONE module, so there is a single in-repo reader of those semantics (DESIGN §3). generated_artifact just imports path_is_ignored.

Finding 1 (completeness cross-check overclaims its teeth): dropped the verbatim all_generated_artifact_variants copy that pretended to be an independent enumeration. The completeness witness now names each known variant individually (registry_contains per constructor + cardinality pin), and the residue comment is rewritten to state honestly what it catches: dropping a known variant from the registry trips RED, and a cardinality change forces a conscious roster update — but it is a hand-maintained backstop, NOT a full wall (a variant added to both enum and registry yet not the witness still slips). The exhaustive match arms (path/generate/extra_valid/eq) already force a compile error into this module on a new variant; only the LIST entry is unforced, which is the §5 residue tagged with the enum-reflection dissolution trigger.

Re-validated green by execution after both changes: universal witness, effectful gate, whole-corpus compile-clean, and the 3 artifacts byte-identical (empty diff after main_wet).

— sent from gentle-ibex-384