ci: bind product qualification and DCO to trusted evidence

[mfethe1]

Summary

Product branches can currently inherit successful aggregate jobs even when a required underlying lane failed. Add an unconditional Product Qualification evaluator that checks the real lane outcomes and expected path scope. Add Product DCO with a trusted-base evaluator, exact base/head binding, complete commit pagination, author-matched sign-offs, and an explicit check on the candidate commit.

The DCO workflow does not execute candidate code with its check-writing token. Missing evaluator files, stale pull-request identity, missing receipts, and failed receipt upload deny qualification. Include the final product ruleset specification; activating it remains a separate bootstrap step after the trusted evaluators land and an eligible reviewer is established.

Base: adeec6eb5c4ff425aa03d8a744a295da4429f67f
Head: 687f53ff5722a98571e9b857c96bdca08d048759

Draft #25 prepares the evaluator prerequisite. The qualification evaluator is absent on the current PR base, so this combined candidate cannot qualify itself. The DCO workflow definition must also be installed on the repository default branch, main; its evaluator is separately pinned to the PR base. The default-branch trigger is absent, and an eligible non-author reviewer remains a prerequisite.

Related issue

Related release foundations: #15 and #17. This change does not repair their commits missing author sign-offs or waive their failed checks.

Testing

Thirteen DCO tests and nine qualification tests passed. Four DCO trust mutations and three qualification mutations were caught. The six changed workflows passed actionlint and the existing CI context contract. Replaying a real GitHub run correctly denied failed desktop and integration work despite successful wrapper jobs. Live commit evaluation correctly denied PRs 15 and 17 for missing author sign-offs. Independent source review passed at 687f53ff5722a98571e9b857c96bdca08d048759.

Full local just ci completed at this exact head and failed the same eight mobile golden comparisons reproduced on the unchanged base; 2,241 mobile tests and 6,583 desktop JavaScript tests passed. Expected images and tolerances were not changed. Hosted trusted-base bootstrap remains pending. This is not a completed release approval.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}