Add the required verdict-review-gate: sealed cross-family evidence for every changed verdict row

[seathatflowsinourveins]

This adds a required CI check, verdict-review-gate, as the control for a single-maintainer repository. A PR that changes any layer verdict row cannot merge without the sealed cross-family review evidence the verdict pipeline defines (#122, #124).

What it enforces for every changed (catalog, layer_id, run_id) row outside the grandfathered 20260922 wave:

• Lane returns: the sealed returns exist, are registered, and match the row's sealed_sha256. They share one packet_sha256, and they come from distinct families.
• Agreement: agreement is recomputed from the two winner_keys sets, so a relabelled row fails.
• Winners: winners must equal the chosen lane's keys resolved through the sealed packet listed in run-manifest.json.
• Packets: withheld keys are rejected recursively.
• Hash bindings: run_manifest_sha256, adjudication_sha256 and single_lane_decision_sha256 must all match.
• Disagreements: a disagree row needs both-family, both-order adjudication with no refutation.
• Single-lane rows: they need an authorization under docs/decisions/, carrying single-lane-authorization: <catalog>/<layer_id>, that is already at the base.
• platform_status: it must be the value platform_status() derives from receipts bound to the sealed pin and refs that are already at the base.
• Waves: there is no rollback, deletion or re-keying of rows. Earlier waves stay frozen.
• Trust inputs: they are derived from what the gate and validators actually read.
• Base comparison: the base is the merge commit's first parent, checked against the payload, and the job fails closed.
• Validators: landscape.py and build_verdicts --check run too.
• Pass-through: a PR that touches no verdict row passes with "no verdict rows changed".

Recorded residuals (see the decision record):

• Sealed lane returns certify themselves; the gate proves consistency, not authenticity.
• A PR can edit its own validate.yml job. pull_request_target and workflow_run are rejected by the repository's zizmor policy, and required workflows exist only for organisations.
• Two lows carry proposed fixes for the tooling owner.

Review. Five adversarial Opus review rounds plus raw reruns closed:

• a decoy ledger;
• rollback, deletion and relabelling;
• fail-open error paths and duplicate JSON keys;
• platform_status forgery;
• same-PR authorization;
• a pin change behind an unchanged status.

It has 142 gate tests, all negative controls mutation-checked, and real-checkout mutations.

Checks. At the merge with main, including #124:

• the gate reports "no verdict rows changed";
• the focused suites pass, and the Verdict integrity round 2: bind rows to sealed waves, strict single-lane authorization, immutable waves, sealed refutations, retained packets #124 name alignment now runs and passes;
• validate.py, evidence_manifest, landscape.py and build_verdicts --check pass;
• actionlint and zizmor report 0 findings;
• guarded gitleaks finds no leaks.

The target .github/main-ruleset.json adds verdict-review-gate as a required check. I'll apply it after merge, after notifying the coordinating session.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-23T18:26:32.886035Z	6bfeb24	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.