G5: define start-closure/1 and pass full-asset closure check

.gitleaks.toml

@@ -334,6 +334,18 @@ regexes = [
   '''^\s*"key":\s*"(?:ab60ca6b319cd1ae67edf7153a82dfe740358d9fe839f8e52366edfa88cf38db|ad141246c92c80672c10dba83896fe6744fc0ef5ef3a4d3ca07b27fce89aa9b0|125b939f93f32338ee87c4fe362dbc1e10237865266014573628ca6ab7d811a1|683cc56662967628cbce607d2a76a95e81eab811bf0033a167885cc243e399b9|20d12bd285ea6bd2d67a2fa02a3880d58390fbc17b4fedc2d9862f7db89e9088|a29791aae4200620764263b4e3fd1b4a383746fda9e82c30c7cb9ee59ed1a6e8|d1349458a0797550dfac40c438d35e067f8d5277deabbba283695786c20d0555)",?\s*$''',
 ]
 
+[[rules.allowlists]]
+description = "G5 population-key SHA256 digests in the two reviewed population receipts"
+condition = "AND"
+paths = [
+  '''^evidence/artifacts/g5-start-closure-1-20261009/confirmed-four-population-receipt\.json$''',
+  '''^evidence/artifacts/g5-start-closure-1-20261009/note-class-population-receipt\.json$''',
+]
+regexTarget = "match"
+regexes = [
+  '''^(?:before|after)_population_key_sha256"\s*:\s*"[0-9a-f]{64}"$''',
+]
+
 [[rules]]
 id = "sourcegraph-access-token"
 

blueprints/runtime-workers/openhands/evidence/relock-2026-09-30-litellm.review-sol-G2.json

@@ -142,7 +142,7 @@
   {
    "claim": "The requested neighboring PRs have identifiable merge overlaps.",
    "result": "confirmed",
-   "source": "Git-fetched #535 at ff79d96ad3458aa12c52327a129f28a555bb1113 conflicts with this PR's tests.py:64–70 grant/comment, pins.json:44 and requirements.lock:308 block; its digest is 38c20c899b8d7b08e03a04624daa17ba1fc353533fbff450bb0ac2bddd0832eb. #551 at 0e86cb7e7798b497a43672dc67328a12d2793964 and #555 at 8c263acebe7396c09d66d9d4f70bf144e1c4cdd3 merge the test code cleanly but conflict at manifests/evidence.json:45983, the hash for tests/test_osv_lockfile_coverage.py: this PR 31780dc60ea10f55597dbc984628fa22019a0a0c3cc63727f2a684fff2ea383e; #551 7dc3770432668f732cbffb7fbe189b6e7b63d6ac7ef91fda8c3146bf0d7a77df; #555 6ab01255f9d5395c52c6e8f5c3fa14ba3f5262a6750d9ff868bc06ab83827a5e."
+   "source": "Git-fetched #535 at ff79d96ad3458aa12c52327a129f28a555bb1113 conflicts with this PR's tests.py:64–70 grant/comment, pins.json:44 and requirements.lock:308 block; its digest is 38c20c899b8d7b08e03a04624daa17ba1fc353533fbff450bb0ac2bddd0832eb. #551 at 0e86cb7e7798b497a43672dc67328a12d2793964 and #555 at 8c263acebe7396c09d66d9d4f70bf144e1c4cdd3 merge the test code cleanly but conflict at seathatflowsinourveins/native-agent-stack@6741c554219eb7c1669b37d1c08881bc81083e62:manifests/evidence.json:45983, the hash for tests/test_osv_lockfile_coverage.py: this PR 31780dc60ea10f55597dbc984628fa22019a0a0c3cc63727f2a684fff2ea383e; #551 7dc3770432668f732cbffb7fbe189b6e7b63d6ac7ef91fda8c3146bf0d7a77df; #555 6ab01255f9d5395c52c6e8f5c3fa14ba3f5262a6750d9ff868bc06ab83827a5e."
   },
   {
    "claim": "The additional scan inputs in #535 and #551 introduce no LiteLLM pin below 1.93.2.",