InauguralSystems · InauguralPhysicist · Sep 23, 2026 · Sep 23, 2026 · Sep 23, 2026 · Sep 23, 2026
@@ -41,8 +41,7 @@ ENV DEBIAN_FRONTEND=noninteractive
 #                           GREEN on the merge-gating lane (critic r8 ledger
 #                           3, measured on CI job 106492225359).
 #   gdb              -> the JIT debugging workflow (see CLAUDE.md)
-#   curl             -> exercising the http extension by hand; ALSO how `gh`
-#                       is fetched below
+#   curl             -> exercising the http extension by hand
 # SDL2 is deliberately absent: `make gfx` dlopen's it at runtime and compiles
 # against typedefs only, so no -dev headers are needed to build it.
 RUN apt-get update \
@@ -60,48 +59,4 @@ RUN apt-get update \
         curl \
  && rm -rf /var/lib/apt/lists/*
 
-# `gh` — the GitHub CLI, the LIVE arm of suite section [99zd].
-#
-# BOUGHT 2026-09-21 (round-4 blind critic, Fable; #1207): arms (b) and (c) of
-# tools/roadmap_check.sh — the milestone-set mirror and the reference resolver,
-# the whole point of the issue — were executed against GitHub by NO automated
-# caller anywhere. This image had no `gh`, so the Linux legs SKIPPED BY NAME;
-# the macOS runner has `gh` with no credentials, so it skipped too; and the
-# daily audit ran only the labels gate. "CI 31/31 green" measured the
-# structural arm alone while the section reported `population lines 3/3`. A
-# mirror nobody checks is the failure #1207 was filed about.
-#
-# THE RELEASE TARBALL, not GitHub's apt repository: one pinned version with a
-# checksum this Dockerfile verifies, rather than a third-party apt source whose
-# key rotation is another thing that can silently change what CI runs. The
-# version and the per-architecture SHA-256s are a deliberate edit; `gh --version` is asserted at
-# build time so a bad extraction fails HERE and not as a mystery skip in the
-# suite.
-# ONE ARCHITECTURE WAS HARD-CODED, AND arm64 IS NOT HYPOTHETICAL. Bought
-# 2026-09-21 (third critic, `/code-review 1226 medium`, finding 9): the
-# tarball name, the checksum and the extracted directory all said
-# `linux_amd64`, so on an arm64 Docker host (an Apple-silicon dev machine, a
-# Graviton runner) the checksum fails and the WHOLE image build dies — not the
-# gh step, the image. The architecture is now asked of dpkg and each one
-# carries its own pinned checksum, both taken from the release's own
-# `gh_${GH_VERSION}_checksums.txt`; an architecture with no pin here fails by
-# name rather than by checksum mismatch.
-ARG GH_VERSION=2.101.0
-ARG GH_SHA256_AMD64=9bca2d1c16825f109907a23307628a2f0698fbf99662b73a5cf0b020293072b8
-ARG GH_SHA256_ARM64=b57e8063f18862647c9d22727c32e9da1b963f8bf9db648fe123a6975695640f
-RUN set -eu \
- && arch="$(dpkg --print-architecture)" \
- && case "$arch" in \
-        amd64) sha="${GH_SHA256_AMD64}" ;; \
-        arm64) sha="${GH_SHA256_ARM64}" ;; \
-        *) echo "gh ${GH_VERSION}: no pinned checksum for dpkg architecture '$arch' — add one from gh_${GH_VERSION}_checksums.txt rather than letting the build fail on a mismatch" >&2; exit 1 ;; \
-    esac \
- && curl -fsSL -o /tmp/gh.tar.gz \
-        "https://github.com/cli/cli/releases/download/v${GH_VERSION}/gh_${GH_VERSION}_linux_${arch}.tar.gz" \
- && echo "${sha}  /tmp/gh.tar.gz" | sha256sum -c - \
- && tar -xzf /tmp/gh.tar.gz -C /tmp \
- && install -m 0755 "/tmp/gh_${GH_VERSION}_linux_${arch}/bin/gh" /usr/local/bin/gh \
- && rm -rf /tmp/gh.tar.gz "/tmp/gh_${GH_VERSION}_linux_${arch}" \
- && gh --version
-
 WORKDIR /workspaces/EigenScript
@@ -417,16 +417,6 @@ jobs:
     permissions:
       contents: read
       packages: read
-      # THE LANE THAT HOLDS A TOKEN. Suite section [99zd] runs
-      # tools/roadmap_check.sh and tools/issue_labels_check.sh; their GitHub
-      # arms — the milestone-set mirror and the reference resolver, which are
-      # the whole point of #1207 — had no lane anywhere that could do anything
-      # but SKIP BY NAME (round-4 blind critic, Fable). `issues: read` is
-      # enough: milestones and issues of this repository are read through it,
-      # and the references arm resolves public repositories in the same
-      # organisation. The token is exported on the suite step below, and the
-      # section's own probe (tools/gh_probe.sh) makes a skip on this lane RED.
-      issues: read
     container:
       image: ${{ needs.dev-image.outputs.image }}
       credentials:
@@ -485,11 +475,6 @@ jobs:
         if: matrix.cc == 'gcc' || github.event_name != 'pull_request'
         env:
           EIGS_SKIP_WERROR_AUDIT: 1
-          # [99zd]'s live arms. Without this the roadmap gate's milestone and
-          # reference walks skip by name on every lane, which is exactly the
-          # round-3 hole. With it, [99zd] REQUIRES `milestones=gh-api:…
-          # refs=gh-api:… resolved=N skipped=0` and a `gh-api:` labels line.
-          GH_TOKEN: ${{ github.token }}
         run: cd tests && bash run_all_tests.sh
 
       # clang on a PR: the value of this leg is the BUILD (-Werror fires at
@@ -502,7 +487,6 @@ jobs:
         env:
           EIGS_SUITE_SECTIONS: core
           EIGS_SKIP_WERROR_AUDIT: 1
-          GH_TOKEN: ${{ github.token }}
         run: cd tests && bash run_all_tests.sh
 
       # Cross-repo observer corpus (#262): real observer-using programs
@@ -681,7 +665,7 @@ jobs:
           set -u
           python3 -m pip install --user --break-system-packages pyyaml \
             || python3 -m pip install --user pyyaml \
-            || echo "PyYAML install failed; [99zd] arm (b) will SKIP BY NAME"
+            || echo "PyYAML install failed; the workflow-YAML load arm will SKIP BY NAME"
           python3 -c 'import yaml; print("PyYAML", yaml.__version__)' \
             || echo "PyYAML is not importable on this runner"
 

@@ -40,6 +40,17 @@ on:
     # behind everyone else's midnight cron on the shared runner pool.
     - cron: '23 5 * * *'
   workflow_dispatch:
+  # These gates read LIVE repository state, so they are not in the test suite
+  # (#1275): an unrelated unlabelled issue failed every PR there and ejected
+  # queued merges (#1279, #1168). A PR that changes a gate or ROADMAP.md still
+  # runs them here, as an advisory check that is never required.
+  pull_request:
+    paths:
+      - ROADMAP.md
+      - tools/issue_labels_check.sh
+      - tools/roadmap_check.sh
+      - tools/gh_probe.sh
+      - .github/workflows/issue-triage.yml
 
 permissions:
   contents: read
@@ -212,13 +223,16 @@ jobs:
       # (c) of tools/roadmap_check.sh — the milestone-set mirror and the
       # reference resolver — were run against GitHub by NO automated caller
       # anywhere. This job was the ONLY lane holding a token, and it ran only
-      # the labels gate. The dev image now carries `gh` and ci.yml's
-      # `linux / gcc` exports a token, and this daily lane runs the roadmap
-      # gate as well, so the mirror is checked twice a day rather than never.
+      # the labels gate. It runs the roadmap gate as well now, and since #1275
+      # it is the gate's ONLY caller: the test suite no longer runs either
+      # GitHub-state gate.
       #
-      # THE PIN HERE ADMITS NO SKIP. Unlike the suite's caller — which runs on
-      # macOS and sanitizer lanes that genuinely have no credentials — this job
-      # exists to make the API call, so `skipped:` is a failure and so is a
+      # `!cancelled()`: the labels step above exits 1 whenever ANY open issue
+      # lacks a label, and without this guard that skipped the roadmap gate
+      # too, so a PR editing tools/roadmap_check.sh or ROADMAP.md ran nothing
+      # while an unrelated issue was unlabelled (/code-review on #1284).
+      #
+      # THE PIN HERE ADMITS NO SKIP. This job exists to make the API call, so `skipped:` is a failure and so is a
       # reference walk that resolved nothing (`resolved=0`) or had to skip a
       # reference (`skipped=N`). It also requires `repos=verified:N` — the
       # KNOWN_REPOS verification is what makes "does not exist" and "is
@@ -228,6 +242,7 @@ jobs:
       # separate check asserts the gate's --contract still equals the caller's
       # skip-admitting form, so a drift is red by name and never auto-adopted.
       - name: "ROADMAP.md is a milestone set (live arms, this lane holds the token)"
+        if: ${{ !cancelled() }}
         env:
           GH_TOKEN: ${{ github.token }}
           ROADMAP_CHECK_REPO: ${{ github.repository }}

@@ -1386,6 +1386,17 @@ All notable changes to EigenScript are documented here.
 
 ### Changed
 
+- **The GitHub-state gates left the test suite (#1275).**
+  `tools/issue_labels_check.sh` and `tools/roadmap_check.sh` read live
+  repository state, so as suite section `[99zd]` an unrelated issue filed
+  without labels turned every pull request red and ejected queued merges
+  (#1279, #1168). They now run only in `.github/workflows/issue-triage.yml`:
+  daily, on demand, and as an advisory, never-required check on pull requests
+  that change them, `tools/gh_probe.sh` or `ROADMAP.md`. `[99zd]` keeps the
+  one part that reads only the tree, `tools/workflow_yaml_check.sh`. The
+  Linux suite lanes no longer hold an `issues: read` token, and the dev image
+  no longer installs `gh`.
+
 - **Three front-door claims that only EXECUTION could refute (#1209, #1210,
   #1211).** Each was stated in `docs/llms.txt` — the file every agent primes
   on — and each is now stated correctly with an executed fence beside it.
@@ -1425,8 +1436,9 @@ All notable changes to EigenScript are documented here.
   first circulated is not reproducible from the API, and the figure of record
   is the gate's first real run after the sweep, `examined=35 missing=0`).
   `.github/workflows/issue-triage.yml` labels a new issue `needs-triage` when
-  it arrives without an `area:` and runs the audit daily. Both gates are suite
-  section `[99zd]` with pinned selftest case counts.
+  it arrives without an `area:` and runs the audit daily. Both gates ran as
+  suite section `[99zd]` with pinned selftest case counts until #1275 moved
+  them out of the suite (see the first entry under Changed).
 
   Round 2 closed what the blind critics found in round 1. A SUCCESSFUL EXIT IS
   NOT A MEASUREMENT: both callers accepted `tools/issue_labels_check.sh`
@@ -1512,8 +1524,8 @@ All notable changes to EigenScript are documented here.
   AND prints `[99zd] live arms: SKIPPED (no gh credentials on this lane)` so
   the log says which lane measured what. A lane that EXPORTS a token and
   cannot use it is red on an independent cross-check. `.devcontainer/Dockerfile`
-  installs `gh` from a pinned, checksummed release tarball, `ci.yml`'s
-  `linux / gcc` job exports `GH_TOKEN` with `issues: read`, and the daily
+  installed `gh` and `ci.yml`'s `linux / gcc` job exported `GH_TOKEN` with
+  `issues: read` (both removed again in #1275), and the daily
   `issue-triage.yml` audit runs the roadmap gate too, with a pin that admits no
   skip at all.