repo-standard-selftest proves the ceilings, not that the gates bite — a mutation lane for the org CI

[bdelanghe]

What "the org CI is good" means today, and what it does not

repo-standard-selftest.yml calls repo-standard.yml, repo-scorecard.yml and repo-release.yml at their declared permission ceilings on every push to main. Green means: the reusable workflows load and their permission union has not crept (#55). It is a real guard and it is the only one.

It does not say that any gate refuses what it claims to refuse. Nothing in this repo runs the standard against a known-bad input and asserts red. docs/agentic-code-hygiene.md rule 3 — a gate's own claim about itself is not evidence — applies to the standard exactly as it applies to the repos that call it. Today the evidence that osv reds on a vulnerable lockfile, that test reds on exit 1, that quality refuses pull_request_target, is the source text.

The obstacle, to verify before designing

A reusable-workflow call job (jobs.<id>.uses) does not accept continue-on-error (claim from the workflow syntax reference; not measured here — verify on a throwaway workflow first). If that holds, a "call the standard and expect red" job reds the selftest run itself, so the negative cases cannot live as sibling jobs behind a verdict.

Options, in order of how much they change:

1. Extract the deciding logic into scripts and test those. The osv triage (SARIF → pass/fail), the corpus builder, the lockfile discovery are inline run: bodies today. Moved to scripts/ under node --test, the mutation cases are ordinary unit tests: an empty SARIF from a failed scanner must red in every mode; a folded docs file must not crash the corpus. This is the .github-private "extract it" pattern (_auto-merge: gated means a CI context is required — the claim alone is not a gate #399) and needs no new GitHub primitive.
2. A fixture caller on a branch whose red is expected, read by a verdict job through the Actions API. Works, but it is a second lane whose red is normal, which trains readers to ignore red.
3. A mutant: input on repo-standard.yml that inverts the exit of the named job. Changes the callee's contract to serve a test; refused unless 1 turns out insufficient.

Recommendation: 1, then re-measure what 1 cannot reach (the if: guards, the continue-on-error on dependency-review), and only then decide on 2.

Also in scope

• The pins: every uses: in the three reusable workflows is a 40-hex SHA (a test in workflows.test.mjs shape).
• conformance-kit-ref is a SHA and resolves.

Consumer

The conformance projection (#381) carries a standard block with the selftest's latest conclusion; when this lane exists, that block carries its conclusion too, and "org CI: good" on the desk means both.

[bounded-systems-front-desk]

🎫 Claimed by claude/repo-health-dashboard-6n35lv — dispatched by bdelanghe — run

Authorization: human-authorized · assurance aal2
Authorized by bdelanghe with credential Si98d1nbmy2LL3nSc1--ROWWL8E (relying party keeper.bounded.tools).
Claim-request digest (the passkey's challenge, recomputed by this door): 51674e8130a51f87faabe61909749ddb4c688b40423183517be6e269f3b28c21 · base64url UWdOgTClH4f6q-YZCXSd20xoi0BCMYNRe-biafOyjCE

Release by removing the claimed label (and unassigning) if work stops without a merged PR.

[bdelanghe]

Worker report for .github-private#913 step 5, the .github half — PR #396 (draft, opened by the parent on this worker's commit 6abc042).

• repo-standard-selftest.yml triggers on merge_group beside pull_request. Its scorecard/release jobs were gated != 'pull_request' and would have RUN under merge_group (a queue run instantiating contents: write); both now exclude merge_group too.
• workflows.test.mjs ratchets both properties, comments stripped; both mutants fail it.
• Conformance: per-caller merge_group, finding merge-group-absent, totals.merge_group, summary row, reader line. Additive JSON. The three real-caller fixtures gained the key; one derived fixture lacks it.
• repo-standard.yml unchanged: workflow_call needs nothing. dependency-review skips under merge_group; a job skipped by if: reports Success (GitHub docs), so a coverage choice, not a hang. Widening it needs the action's merge_group support confirmed; github.com egress was blocked here.

Tests: .claude 334 pass · root 290 pass · conformance (bun) 34 pass. node --test scripts/* fails 20 on Bun.YAML on main too; CI runs it under bun. PR CI: schema and pr-claim green; selftest loads and runs with the bare key.

Unverified: the reusable workflow under a real merge_group event (reasoned from the file; the first queue entry measures it). Out of scope: org-defaults.yml (schema, this repo's required context) declares no merge_group, so this repo's own queue would hang; repo-scorecard.yml/repo-release.yml keep internal != 'pull_request' gates for callers that copied the old reference.

---

Generated by Claude Code

[github-actions]

🔓 Released by claim-sweep — open but untouched since 2026-09-10, past the 14-day window, with no linked open PR.

Re-claim through the same door if this work is live; releasing and re-claiming are both cheap, and a fresh claim spares it from the next sweep. A standing claim held by a machine lane should carry the standing-claim label, which this sweep never releases.

Recorded by the sweep, not by a guest. This does not assert who held the claim.