Top rule: research first, never self-write without a SOTA source; required sota-sources check

[seathatflowsinourveins]

Scope

• What this PR changes:
  • the user's top rule becomes the first line of AGENTS.md and of the portable user profile examples/claude-native/CLAUDE.md;
  • a required sota-sources check fails any PR whose description lacks a non-empty SOTA sources section.
• Base commit: 0074a0c3
• Lane: lane:shared. It touches AGENTS.md, the portable profile and .github/; the foundation and trading lanes need to acknowledge it.
• Owned paths touched: AGENTS.md, examples/claude-native/CLAUDE.md, .github/pull_request_template.md, .github/workflows/validate.yml, .github/main-ruleset.json, manifests/evidence.json, docs/decisions/2026-09-25-top-rule-sota-sources.md

SOTA sources

• actions/github-script v9.0.0, commit 3a2844b7e9c422d3c10d287c895573f7108da1b3: https://github.com/actions/github-script. It reads context.payload.pull_request.body.
• The pull_request webhook payload: https://docs.github.com/en/webhooks/webhook-events-and-payloads#pull_request
• Ruleset required status checks: https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/available-rules-for-rulesets
• step-security/harden-runner v2.21.1, pinned e14015d5…, as every job in this repository already uses (tests/test_workflow_hardening.py).
• The rule's origin: the user's instruction of 2026-09-25, quoted verbatim in the decision record. Evidence: agent-lab's docs/tasks/2026-09-24-sota-mover-strategies.md (self-written strategy arms lost $12,443.07 on paper, reconciled against 635 broker fills with a $0.00 residual).

Evidence-class table

Claim	Evidence class	Command / receipt
The full suite passes with the change	local_integration	python3 -m unittest → Ran 5591 tests, OK (skipped=648)
Manifests and catalogs are consistent	local_integration	scripts/validate.py, validate_catalogs.py, build_ecosystem.py --check and evidence_manifest.py --check all pass
The new job is safe and well formed	local_integration	zizmor --offline --strict-collection 0 findings; actionlint 1.7.12 (sha256 verified) rc 0
The body matcher accepts and rejects correctly	synthetic	Node test of 4 cases: empty section fails, filled passes, last section passes, missing fails
No secrets	local_integration	guarded gitleaks on the 7 changed files: no leaks

Local commands run

$ python3 -m unittest
Ran 5591 tests in 313.801s
OK (skipped=648)
$ python3 scripts/validate.py
{"components": 69, "hashed_files": 5612, "profiles": 4, "receipts": 147, "status": "passed"}

Decision record

docs/decisions/2026-09-25-top-rule-sota-sources.md: the evidence, the alternatives considered (template checklist only, reviewer-only, per-file automated check) and the comparison that would overturn it (filler-only sources in more than 20% of 30 merged PRs).

Checklist

• New/changed GitHub Actions are pinned to a full commit SHA with a version comment.
• Workflows keep top-level permissions: contents: read; the new job needs nothing more.
• No secrets printed, logged or committed; no new required secret.
• No new paid hosting, subscription or billing surface.
• Peer-owned untracked files and worktrees preserved.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	⚠️ Failed 2026-09-25T21:49:45.611002Z	b1a9b6b	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.