[flow-research-agents]

Change

WS-GHPROOF-001-01 - Record the GitHub proof facts initiative

Goal

Open a multi-PR initiative so WorkStream can check a Harnessy agent's proof.json against facts read from GitHub, instead of trusting its shape only.

Intent And Planning Context

• Intent: before Flow pays its first task in naira, a faked proof must fail. Today harnessy_proof runs networkless and can only validate shape.
• Commitrail record or PR-only reason: .commitrail/initiatives/WS-GHPROOF-001/OVERVIEW.md and WS-GHPROOF-001-01.md.

What Changed

The initiative overview (intent, non-goals, six-chunk map, dependencies on #676 and #677, security notes, owner decisions dated 2026-10-24), its first change record and the INDEX.md row. No code.

Why It Changed

The work spans six PRs; the repository requires an initiative record for multi-PR work.

Design Chosen

Facts are fetched by a read-only GitHub App inside the existing post-submit evaluation path (chunk 04, after #677's evaluation context roles), named in the checker binding's locked configuration, passed to the checker in the hash-bound request input, and held in ART as service_identity checker-run material (chunk 05). The checker stays networkless.

Alternatives Rejected

• Checker calls GitHub directly: breaks the no-network guarantee and puts a token in the sandbox.
• A separate pre-evaluation fetch job and state: a parallel subsystem.
• A project-level repository setting: would sit outside the locked rules lineage.

Scope Control

Allowed Files Changed

• .commitrail/INDEX.md, .commitrail/initiatives/WS-GHPROOF-001/*

Files Outside Stated Scope

• None

Product Behavior

• No Workstream product behavior changed.

Evidence

Commands Run

Agent Gates scripts (Commitrail record checks) and their unit tests, run locally

Result Summary

All gate scripts pass; gate unit tests: 101 OK

Remaining Risks

Chunks 04 and 05 depend on #677 and #676; the plan may need adjusting as they land.

Follow-Up Work

Chunks 02 and 03 are open as stacked PRs on this branch.

Human Review Focus

Please inspect:

• Whether the chunk map and its use of [PILOT-06] Execute project POST checks with Smol model and trial capabilities #677's evaluation context fit the team's plans.

Update: integrity requirements (owner decision, 2026-10-24)

The owner set verification integrity as non-negotiable. OVERVIEW.md now has an "Integrity requirements" section (layers 1–8, the chunk owning each), a single fail-closed mode, and the rule that chunk 04 takes the PR number from the one strict parser parse_pull_request_url while the checker re-asserts equality. It also records the GitHub-side hardening the owner deferred (code-owner review for .github/, dismiss stale approvals, last-push approval).

CI And Gate Integrity

• No workflow weakening.
• No lint/test/docstring gate weakening.
• Tests protect meaningful behavior; removals identify retained proof or retired requirements. Coverage percentages are diagnostic only.
• No package script weakening.
• No unpinned new GitHub Action.
• Checkout credential persistence disabled where checkout is used.

Human Merge Ownership

The human completes the acceptance/merge checks; agents must not tick them on
the human's behalf or infer approval from a passing CI status.

• I can explain what changed.
• I can explain why it changed.
• I know what could break.
• I accept the remaining risks.
• The user explicitly approved this specific PR for merge.

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 8ea7fe9c-9acd-44e2-a4c3-0e67487c7c09

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}