[truealpha-bt] Decouple Gate candidate validation from merge authorization

[wangzitian0]

Summary

• derive the work prefix from the actual repository-root directory and define project-level mergeability
• validate blocked Gate 0 candidates structurally without treating draft state as authorization
• preserve fail-closed live attestation checks for candidates that explicitly claim acceptance
• serialize final issue parity after batch synchronization, skip bot-generated intermediate issue events, and paginate Vision issue export
• bind all GitHub controls and AGENTS.md into the Gate 0 candidate tree

Root cause

Delivery Governance mapped pull-request draft state to --allow-blocked-gate-candidate. The same head SHA therefore passed as a draft and failed when marked ready. The validator also conflated a structurally valid blocked candidate with an accepted Gate candidate. Separately, issue synchronization emitted intermediate issue events that parity validation treated as durable drift.

Evidence and ceiling

This PR proves deterministic governance authorization for a structurally valid but externally blocked Gate 0 candidate. It does not accept Gate 0, satisfy any missing external attestation, activate a capability, or make a release-readiness claim.

Passed:

• uv run pytest libs/runtime/tests/test_delivery_governance.py libs/runtime/tests/test_gate0_candidate.py -q (99 passed)
• uv run ruff check tools/check_delivery_governance.py tools/check_gate0_candidate.py libs/runtime/tests/test_delivery_governance.py libs/runtime/tests/test_gate0_candidate.py
• make gate0-candidate-check
• make issue-graph-check
• actionlint .github/workflows/ci-governance.yml
• exact-head offline graph, live GitHub parity, and pull-request authorization validation

Local make check reached 705 passed and 6 skipped but failed 28 data-engine tests against an existing non-fresh local Postgres schema. The failures report stale database state such as missing staging.filing_documents.normalized_record_id, an unclaimed issuer_category column, and absent append-only enforcement. This PR changes no database or data-engine files; GitHub CI provisions a fresh Postgres service.

Manifest: governance/gate0/manifest-v4.json

Manifest SHA-256: b8235893c885f6635985c514d9c5dbfc3153bb3de6429d15a236e9b780762fb1

Closes #197

[Copilot]

Pull request overview

This PR refactors TrueAlpha’s governance enforcement so Gate 0 candidate structural validity is evaluated independently from merge authorization and Gate acceptance, eliminating draft/ready PR metadata as an input to blocked-candidate validation. It also tightens determinism of GitHub parity checks by serializing issue synchronization/parity and expanding Vision issue export beyond a fixed limit.

Changes:

• Make blocked Gate 0 candidates pass structural validation without using PR draft state as an authorization bypass, while keeping fail-closed live attestation checks for candidates that claim accepted.
• Expand Gate 0 control coverage to include .github/** and AGENTS.md, and rename the Gate 0 merge policy field to partial_gate_acceptance_allowed across code + schema + manifest.
• Update CI governance workflow to paginate Vision issue export and skip bot-generated intermediate issue events during parity validation; update tests accordingly.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
tools/check_gate0_candidate.py	Expands candidate-controlled paths (includes .github/**, AGENTS.md) and updates merge policy field validation.
tools/check_delivery_governance.py	Removes draft-based blocked-candidate bypass; gates live attestation checks on whether the manifest claims acceptance; expands governance control paths.
libs/runtime/tests/test_delivery_governance.py	Updates/extends regression tests to assert deterministic blocked-candidate behavior and accepted-candidate fail-closed behavior.
governance/schemas/gate0-candidate-manifest.schema.json	Renames merge policy field to partial_gate_acceptance_allowed.
governance/gate0/manifest-v4.json	Updates controlled paths to include .github/** + AGENTS.md and renames merge policy field; refreshes base/tree hashes.
AGENTS.md	Documents directory-derived work prefix and a project-level definition of “mergeable”.
.github/workflows/ci-governance.yml	Removes draft-state flagging, paginates Vision issue export via gh api --paginate, and skips bot-driven intermediate issue events.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.