The GitHub ruleset stops being a web setting and becomes a converged .dag authority

[gunbai-bot]

DESIGN's Building & checks bullet states, as the fact the whole two-lane
split turns on, that this repository's passing CI ruleset is active,
carries no bypass actors, and names exactly ONE required status check --
witnesses. Until now that sentence was the only place the fact lived on
our side of the boundary. Nothing declared it, nothing read it back, and
nothing in the tree went red if it changed: specification without
execution, at the outermost boundary the project has.

extdeps.github.rulesets models the upstream interface -- rulesets,
enforcement, targets, rule types, bypass standing, and the whole-ruleset
PUT -- and nothing about what this repository wants. gunbc.repo_ruleset
owns the policy and follows gunbc.repo_local_git_config's binding
pattern exactly: desired -> observe -> reconcile -> apply -> READ BACK ->
verify, with convergence claimed only from the post-apply read and never
from the apply's own 200.

The §3 win is that the required context's name is IMPORTED from
gunbc.witness_floor_workflow witness_floor_workflow_job_id -- the row
the emitted workflow names its aggregation job with -- so renaming the job
can no longer leave the ruleset naming a context nothing publishes, which
is the failure that shows up as a check stuck pending rather than red.

Every observation and verdict is typed rather than a Bool: three ways a
read can fail (status refusal / transport refusal / undecodable body,
never collapsed into an empty ruleset), three states for the status-check
rule (absent / exactly these / more than one, so "no rule" and "no
contexts" cannot render alike), and fourteen named divergences.
Ownership is Owned rather than Ensured -- the opposite of
repo_local_git_config's choice -- because "witnesses is the ONE required
context" is a claim about the roster, so an extra context must plan a
removal rather than be refused.

EXECUTED, not typechecked. verify runs green against the live ruleset,
and RED with a planted extra desired context (required context missing: a-context-nothing-publishes, exit 1). All ten witness bodies execute
true, including a positive control that a desired-shaped observation
diverges in nothing. converge was NOT executed: it writes to GitHub and
the live ruleset already converges, so there was nothing to apply.

NOT CLAIMED: neither entry point is enrolled in CI. verify is a route
somebody runs, so the class climbs from unobservable to mitigatable --
drift is detectable, not detected. Enrolling it as a required phase is a
separate change under its own operator agreement, and is named as this
row's next-rung trigger.

The DESIGN bullet and two notes in gunbc.witness_floor_workflow said
the ruleset is not a .dag fact. It is one now, so those are corrected in
place rather than left as knowingly-false recitals -- while keeping what
did not change: a converged authority actuates and detects, it does not
gate, so the aggregation job's window argument stands untouched.

Co-Authored-By: Claude Opus 5 (1M context) noreply@anthropic.com

[gunbai-bot]

Fixed in the pushed commit — review 56496 was right on every point.

bypass_divergences now has four named arms, no wildcard: BypassNever → no divergence; BypassPullRequestsOnly and BypassAlways each emit RulesetBypassGranted carrying the observed label (via a new ruleset_bypass_standing_wire_label in extdeps, beside the other wire-label projections, rather than spelled in the policy module); and UnrecognizedBypassStanding { raw } gets its own divergence variant RulesetBypassStandingUnrecognized { raw }, so "the read is no longer established" is never reported as "a bypass role was granted" — different rung, different remedy, and the raw is what says what to extend the parser with.

One thing worth flagging beyond the fix: the existing witness did not catch this, and the reason is instructive. w_RED_a_reader_that_may_bypass_is_a_divergence counted divergences, and counting is exactly what a wildcard defeats — it returned true under both shapes. The new w_RED_the_three_non_never_bypass_standings_render_differently discriminates instead, and I ran it against both: false against the pre-fix collapsed form, true against the split. So the finding is now covered by an assertion that actually flips, not just by the repair.

All 11 witness bodies execute true on the fixed tree; live verify still exits 0 against the real ruleset.