fix(verify): bound the exec mirror by its own skip ceiling, not the runner's

CLAUDE.md

@@ -275,6 +275,20 @@ Do not create a second event log, model registry, or capability inventory.
   that makes CI run MORE. **Never turn a real failure into a skip**, and never add a skip without
   a reason string — a reason-less skip is indistinguishable from a pass, which is this repo's
   founding defect wearing a different hat.
+- **A CEILING BOUNDS ONE DEPRIVED SHAPE, AND THERE ARE TWO.** `skipped_max` was measured on a bare
+  GitHub runner — no agent CLIs, no `~/.codex/skills`, no app bundle, no populated ledger — and was
+  then also applied to the EXEC MIRROR, which is the opposite deprivation: every local prerequisite
+  present, but a flat file copy with no `.github/` and no `.git`, so it skips 31 tests a runner
+  skips none of. One number over two populations is the latched-gate defect in its purest form, and
+  the symptom was total: `python3 verify.py` from `~/.codex/orchestrator-mirror` was RED on every
+  input including a correct tree, for as long as it existed — while §1 above makes that run the
+  verdict. Raising the number would have been the wrong repair; it would have handed the RUNNER
+  five units of slack, where 26 is the measured bound. **Each shape carries its own agreed number,
+  measured where it is enforced**: `env_prereq.exec_mirror_shape()` detects the tree (both marks
+  required, `$CI` never consulted) and `verify.mirror_key` derives the floor key, so any ceiling may
+  carry a `mirror_` variant and an unset one falls back to the base — the strict direction. The
+  summary always prints which tree it decided it was in. When you add a ceiling, ask which shape you
+  measured it in before writing the number down.
 - **State lives behind TWO variables and they are not the same.** `ORCH_STATE_DIR` holds the audit
   cache, firing-monitor and redirect-sweep state; `ORCH_LOCAL_RUNTIME` holds the capability LEDGER
   and the Brain. Pointing only the first at an empty directory and concluding "the suite is

docs/MIRROR_SYNC_PATCH.md

@@ -77,3 +77,15 @@ bash ~/.codex/bin/orch-sync-mirror.sh && ls ~/.codex/orchestrator-mirror/*.py |
 
 Expect ~99, and then `cd ~/.codex/orchestrator-mirror && python3 verify.py` should be green — note
 that in the FLAT mirror the command keeps its old form, with no `src/` prefix.
+
+**What "green in the mirror" means, and why it was impossible until 2026-08-29.** The mirror is a
+flat copy, so it is not a git repository and has no `.github/`; 31 tests skip there for exactly
+those two named reasons, and the run reports `31/31 max [mirror_skipped_max]`. Those skips are
+agreed, not tolerated — `.verify-floor.json` now carries a `mirror_skipped_max` alongside
+`skipped_max`, because the latter was measured on a bare GitHub runner (a different deprivation:
+missing CLIs and ledger rows, but a real checkout) and one number cannot bound both populations.
+A mirror run was therefore RED on every input, correct trees included, which made the instrument
+this doc points you at worthless. The shape is detected by `env_prereq.exec_mirror_shape()`, never
+from `$CI`, and the summary's first line says which tree it decided it was in. If you ever teach
+the sync to copy `.github/`, 12 of those skips become real checks and `mirror_skipped_max` must
+come down to 19 in the same change.

src/env_prereq.py

@@ -277,6 +277,59 @@ def git_repo_absent() -> str | None:
     return None
 
 
+def exec_mirror_shape() -> str | None:
+    """Name what makes THIS tree the exec mirror rather than a checkout, or None for a checkout.
+
+    NOT a prerequisite detector, and it must never be handed to `require()`. Every other function
+    in this module answers "can this CHECK run here", and its reason SKIPS something. This one
+    answers "which TREE is this", and its reason selects which agreed skip ceiling `verify.py`
+    enforces. Nothing skips because of it.
+
+    WHY IT EXISTS. `.verify-floor.json`'s `skipped_max` was ONE number bounding TWO different
+    deprived environments, and the floor file's own note says which one it was measured in:
+    "exactly what a machine with none of this instance's local prerequisites skips (a GitHub
+    runner: no agent CLIs, no ~/.codex/skills, no /Applications/ChatGPT.app, no populated
+    capability ledger)". The exec mirror is a DIFFERENT shape with DIFFERENT absences. Every local
+    prerequisite is present there -- it exists only on the machine the system runs on -- but it is
+    a flat file copy, so it is not a git repository and has no `.github/`. Measured 2026-08-29 on
+    unmodified main: the mirror skips the two families below, 31 tests, against a ceiling of 26
+    measured on a runner that skips neither, and both control runs (live mirror and a scratch
+    mirror synced from the previous main) gave the same 31. So `python3 verify.py` from the mirror
+    was RED on every input INCLUDING a correct tree -- and CLAUDE.md 1 makes that run the verdict,
+    so the one instrument that catches cross-tree divergence had stopped protecting anything. A
+    gate red on every input is a gate that gets ignored.
+
+    Raising `skipped_max` to 31 would have been the wrong repair: CI runs on a runner where 26 is
+    the correct bound, so five more checks could have gone unchecked THERE in silence. Two shapes
+    need two agreements, each measured in the shape it bounds -- the measuring window equal to the
+    draining window, which is the latched-gate rule this file already follows everywhere else.
+
+    ONE POPULATION, CAUSED AND LICENSED BY THE SAME TWO DETECTORS. The marks below are the very
+    calls that PRODUCE the mirror-only skips: `repo_files_absent` from `test_ci_gate_config.py`
+    and `git_repo_absent` from `test_repo_artifact_hygiene.py`. The ceiling that licenses those
+    skips is therefore unlocked by exactly the facts that cause them, with no second literal to
+    drift. It selects WHICH agreed number applies -- never what the number is, which stays
+    hand-edited -- so this cannot become a gate that clears itself.
+
+    BOTH marks are required, and that AND is the conservative direction: the mirror ceiling is the
+    LOOSER of the two, so an ambiguous tree must fall back to the base agreement rather than help
+    itself to headroom. A checkout with `git` uninstalled still has `.github/`; a checkout whose
+    `.github/` was deleted is still a git repository. Neither reads as the mirror.
+    """
+    no_github = repo_files_absent(".github")
+    not_a_repo = git_repo_absent()
+    if not (no_github and not_a_repo):
+        return None
+    import paths
+
+    here = paths.checkout_root(Path(__file__).resolve().parent)
+    return (
+        f"{here} is the exec mirror, not a checkout: no .github/ directory, and git reports no "
+        f"repository here. orch-sync-mirror.sh copies files, not a checkout, so the tests that "
+        f"read repository configuration or ask git a question cannot run in this tree"
+    )
+
+
 def codex_profile_binary_absent() -> str | None:
     """Reason string when the version-capable Codex binary exact profiles require is absent.
 
@@ -505,6 +558,52 @@ def _selftest() -> None:
         "pyproject.toml", "definitely-not-a-file-here"
     ), "one missing entry is enough to skip"
 
+    # ---- exec_mirror_shape: WHICH TREE, not "can this check run" ------------------------------
+    # The composition rule is the whole function, so it is asserted directly in all four
+    # combinations. AND, never OR: the mirror ceiling is the LOOSER of the two agreements, so only
+    # an unambiguous flat copy may unlock it. Flipping the `and` to `or` turns three of these red.
+    _real_github, _real_git = repo_files_absent, git_repo_absent
+    try:
+        for _no_github, _no_git, _want_mirror in (
+            (True, True, True),
+            (True, False, False),
+            (False, True, False),
+            (False, False, False),
+        ):
+            globals()["repo_files_absent"] = lambda *a, _r=_no_github: (
+                "no .github here" if _r else None
+            )
+            globals()["git_repo_absent"] = lambda _r=_no_git: (
+                "not a git repository" if _r else None
+            )
+            got_shape = exec_mirror_shape()
+            assert bool(got_shape) is _want_mirror, (_no_github, _no_git, got_shape)
+            if _want_mirror:
+                # It must NAME the tree and both marks, or a reader cannot tell why the looser
+                # ceiling is in force -- and an unexplained looser ceiling is the thing to fear.
+                assert got_shape is not None
+                assert ".github" in got_shape and "git" in got_shape, got_shape
+    finally:
+        globals()["repo_files_absent"] = _real_github
+        globals()["git_repo_absent"] = _real_git
+
+    # THE REAL TREE, asserted in the direction that is layout-independent AND permissive-side:
+    # a genuine checkout must never be mistaken for the mirror, because that is the only error
+    # that hands a real repository the bigger skip ceiling. The mirror direction is asserted too,
+    # from the same two facts -- and this pair is what running verify FROM THE MIRROR exercises.
+    import paths
+
+    _root = paths.checkout_root(Path(__file__).resolve().parent)
+    if (_root / ".github").is_dir():
+        assert exec_mirror_shape() is None, (
+            f"{_root} has .github/ and must read as a checkout, not the exec mirror: "
+            f"{exec_mirror_shape()}"
+        )
+    elif git_repo_absent():
+        assert (
+            exec_mirror_shape()
+        ), f"{_root} is a flat non-repository copy and must read as the mirror"
+
     # A skipped selftest must SPEAK, and its line must carry the shared mark verify.py greps
     # for. A skip that prints nothing is a silent zero-exit by another name.
     import contextlib
@@ -557,7 +656,7 @@ def _selftest() -> None:
 
     print(
         "env_prereq.py selftest: OK (skip-is-a-skip, every detector names the missing thing, "
-        "marked selftest skip speaks, vibe readers)"
+        "marked selftest skip speaks, vibe readers, exec-mirror shape needs BOTH marks)"
     )
 
 
@@ -566,6 +665,14 @@ def main(argv: list[str]) -> int:
         _selftest()
         return 0
     # Default: report what this machine can and cannot check. Useful on a new box.
+    # WHICH TREE first, because it changes which skip ceiling verify.py enforces below. Printed
+    # in both shapes: "checkout" is the answer as much as the mirror reason is, and a shape line
+    # that only appears in one of them tells a reader nothing on a machine where it is silent.
+    shape = exec_mirror_shape()
+    print(
+        f"tree shape: {'EXEC MIRROR' if shape else 'checkout'}"
+        + (f"\n    {shape}" if shape else "")
+    )
     checks = {
         "reference skill resource": skill_resource_absent(),
         "exact-profile Codex binary": codex_profile_binary_absent(),