feat(source-control): wire promotion-evidence fail-closed gate into babysit-loop partition

[kyle-sexton]

Closes #1695

Minimal in-repo peel implementing the frontier-consensus ruling: trusted promotion-evidence resolution contract on the rung partition with fail-closed behavior when evidence is unavailable, untrusted, partial, or forgeable. Does not enable autonomous merge on unqualified evidence. Full three-arm resolver deferred; --merge human-only launch pin stays until the seam qualifies.

Summary

• Contract: skills/babysit-loop/reference/promotion-evidence-resolution.md — promotable cells (C2-auto-merge, C3-auto-merge), trusted seam requirement, fail-closed table, partition interaction
• Partition: cycle-shape step 3 resolves effective promotion state before work-class eligibility; unavailable seam → every cell effective-unpromoted → no C2/C3 autonomous merge
• Config: config-resolution.md notes the gate under merge dimension
• Gotcha: SKILL.md documents that tracked rung alone is not merge permission
• Version: source-control 0.53.24

Tests

• Eval 10: promotion-evidence fail-closed at c3-autonomous tracked rung
• Evals 2, 6–8 updated for promotion gate semantics
• test_skill_contract.py::test_babysit_loop_promotion_evidence_contract_is_wired

Related

• feat(autonomy): add C3 auto-merge cell with evidence predicate #1694 — C3 auto-merge cell (Codex review origin)
• fix(source-control): telemetry-ceiling mitigation, tier-flooring precedent, and harness-level meta-findings from a live audit #1682 — Finding 1 gotcha sequencing (tier-flooring vs invoke babysit-prs); no gotcha text added here per minimal peel scope
• Frontier consensus ruling on babysit-loop: wire effective promotion-state resolution into the merge rung partition #1695 (IMPLEMENT_NOW fail-closed contract; defer three-arm resolver)

[claude]

Claude encountered an error after 1s —— View job

---

I'll analyze this and get back to you.

[github-actions]

Warning

Automated security review did not complete — this is an infrastructure failure, not a review verdict.

Treat any Claude comment on this PR (including a placeholder like "I'll analyze this and get back to you") as incomplete, not "no findings."

• Run: https://github.com/melodic-software/claude-code-plugins/actions/runs/31673606592
• Failure class: rate-limit
• Last SDK result: {"subtype":"success","is_error":true,"num_turns":1,"duration_ms":601,"total_cost_usd":0,"api_error_status":429,"class":"rate-limit"}

The check is green on purpose, and it is not evidence. It certifies that a security pass ran, and this one did not complete — but the cause is outside this PR's control, so merging is deliberately left unblocked rather than locking every merge for the length of the outage. Nothing was reviewed at this head. Where this check is required, it is satisfied without that evidence; a human should review security-sensitive changes here before merging.

Re-run the job, or workflow_dispatch this workflow with the PR number, to retry the review (ci-workflows#227). A new push also retries it only if the caller's pull_request triggers include synchronize (the canonical security caller keeps it). An automatic retry may already have run — it is skipped when a partial review could duplicate comments, or when the failure class needs an operator.

Re-running does NOT help for every class:

• rate-limit that persists across re-runs, or auth — the credential or usage budget needs an operator; retrying will not clear it.
• a run that exhausted its turn budget ("subtype":"error_max_turns" above) will exhaust it again. As the PR author, split the change into smaller PRs; raising --max-turns is a change to the caller workflow, not something you can set on this PR.

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[claude]

Claude encountered an error after 0s —— View job

---

I'll analyze this and get back to you.

[github-actions]

Warning

Automated review did not complete — this is an infrastructure failure, not a review verdict.

Treat any Claude comment on this PR (including a placeholder like "I'll analyze this and get back to you") as incomplete, not "no findings."

• Run: https://github.com/melodic-software/claude-code-plugins/actions/runs/31674933594
• Failure class: rate-limit
• Last SDK result: {"subtype":"success","is_error":true,"num_turns":1,"duration_ms":459,"total_cost_usd":0,"api_error_status":429,"class":"rate-limit"}

Re-run the job, or workflow_dispatch this workflow with the PR number, to retry the review. A new push re-triggers this lane only if the caller's pull_request triggers include synchronize (the canonical caller omits it).
An automatic retry may already have run — it is skipped when a partial review could duplicate comments, or when the failure class needs an operator (auth).