@cleocode/core 2026.10.4 → 2026.10.5-rc.ci.672

package/dist/release/ci-evidence.d.ts

@@ -187,6 +187,16 @@ export declare function readCiSatisfies(projectRoot: string): boolean;
  * @task T12634
  */
 export declare function readCiChecks(projectRoot: string): CiChecksConfig;
+/**
+ * One `evidence.ciChecks.covering` rule (T13175): changed paths matching
+ * `paths` are covered by the jobs matching `jobs`.
+ */
+export interface CoveringJobRule {
+    /** Repo-relative path globs (`**` any depth, `*` within one segment). */
+    paths: string[];
+    /** Job-name globs (`*` wildcard) that must each have run and succeeded. */
+    jobs: string[];
+}
 /** `evidence.ciChecks` as read from project context (T12634). */
 export interface CiChecksConfig {
     /** Required checks attesting testsPassed. */
@@ -203,6 +213,17 @@ export interface CiChecksConfig {
         tests?: string[];
         qa?: string[];
     };
+    /**
+     * T13175: jobs that cover changed paths a change-detection filter keeps out
+     * of the `jobs` globs (e.g. `scripts/**` → `Scripts Tests`). When every
+     * required job of a gate was SKIPPED (by its `if:` filter; a failure upstream
+     * already turns the required check red) and every changed path matches a
+     * rule whose jobs ran and succeeded, those jobs attest the gate instead.
+     */
+    covering?: {
+        tests?: CoveringJobRule[];
+        qa?: CoveringJobRule[];
+    };
 }
 /**
  * Stricter than `pr:`'s {@link isDocumentArtifact}: a documentation artifact
@@ -214,6 +235,42 @@ export interface CiChecksConfig {
  * @task T12634
  */
 export declare function isCiDocumentPath(path: string): boolean;
+/**
+ * Path glob to an anchored regular expression (T13175): `**` followed by `/` is
+ * any number of whole directories (including none), a trailing `/` followed by
+ * `**` is everything below, `*` any run of characters within one segment, `?`
+ * one character within a segment. Everything else is literal.
+ *
+ * @param glob - Repo-relative path glob.
+ * @returns The anchored expression.
+ */
+export declare function pathGlobToRegExp(glob: string): RegExp;
+/**
+ * Judge a gate's required jobs with the covering rules (T13175): accepted only
+ * when each required glob either succeeded or had every latest run completed
+ * `skipped` (never cancelled, failed, pending or missing), at least one was
+ * skipped, every changed path matches a rule, and every job glob of each rule
+ * used has run and succeeded on `sha`.
+ *
+ * @param globs - The gate's required job globs (`evidence.ciChecks.jobs`).
+ * @param rules - The gate's covering rules.
+ * @param changedPaths - The PR's changed paths.
+ * @param checks - Every check reported for the commit.
+ * @param sha - Commit being judged.
+ * @param scope - The app and workflow files the jobs must come from.
+ * @returns The covering job names, or why coverage does not apply.
+ * @task T13175
+ */
+export declare function evaluateCoveringJobs(globs: readonly string[], rules: readonly CoveringJobRule[], changedPaths: readonly string[], checks: readonly CommitCheck[], sha: string, scope: {
+    app?: string | number;
+    workflows: readonly string[];
+}): {
+    ok: true;
+    jobs: string[];
+} | {
+    ok: false;
+    reason: string;
+};
 /**
  * Judge job globs on one SHA: every glob must match at least one job (check
  * run) from the allowed workflows/app, and the latest run of each matched
@@ -298,6 +355,12 @@ export interface FindGreenDescendantInput {
      * PR that was not itself green.
      */
     prHeadSha?: string;
+    /**
+     * The PR edited a pinned workflow, so its own `pull_request` runs prove
+     * nothing (they ran the PR's edited workflow) and are not consulted: only
+     * default-branch `push` runs attest it (T13174).
+     */
+    mainOnly?: boolean;
     /** Default-branch ref (`origin/main`). */
     ref: string;
     /** Repository work tree. */
@@ -320,8 +383,11 @@ export type FindGreenDescendantResult = {
     checks: CommitCheck[];
     /** `<merge>..<sha>`, proven to leave the PR's files and CI definitions untouched. */
     range: string;
-    /** The PR head whose `pull_request` runs were green for every superseded check. */
-    prHeadSha: string;
+    /**
+     * The PR head whose `pull_request` runs were green for every superseded
+     * check; absent in `mainOnly` mode, where PR runs are not consulted.
+     */
+    prHeadSha?: string;
 } | {
     ok: false;
     reason: string;

package/dist/release/ci-evidence.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ci-evidence.d.ts","sourceRoot":"","sources":["../../src/release/ci-evidence.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAKH,OAAO,KAAK,EAAE,YAAY,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAEnF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAEL,KAAK,aAAa,EAGnB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAEL,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EAI1B,MAAM,kBAAkB,CAAC;AAE1B,wEAAwE;AACxE,MAAM,WAAW,WAAW;IAC1B,6CAA6C;IAC7C,IAAI,EAAE,MAAM,CAAC;IACb,uCAAuC;IACvC,MAAM,EAAE,WAAW,GAAG,cAAc,CAAC;IACrC,iDAAiD;IACjD,MAAM,EAAE,MAAM,CAAC;IACf,oEAAoE;IACpE,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,mCAAmC;IACnC,OAAO,EAAE,MAAM,CAAC;IAChB,uEAAuE;IACvE,EAAE,EAAE,MAAM,CAAC;IACX,iEAAiE;IACjE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,yCAAyC;IACzC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,uDAAuD;IACvD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gEAAgE;IAChE,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,2EAA2E;AAC3E,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,mDAAmD;AACnD,MAAM,MAAM,sBAAsB,GAC9B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,WAAW,EAAE,CAAA;CAAE,GACnC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAErC,qDAAqD;AACrD,MAAM,WAAW,gCAAgC;IAC/C;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,+EAA+E;IAC/E,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;IAC5C;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,mFAAmF;AACnF,MAAM,WAAW,UAAU;IACzB,kBAAkB;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,+CAA+C;IAC/C,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,oFAAoF;AACpF,eAAO,MAAM,4BAA4B,KAAK,CAAC;AAE/C,yFAAyF;AACzF,eAAO,MAAM,6BAA6B,QAAmB,CAAC;AAa9D,mEAAmE;AACnE,MAAM,MAAM,gBAAgB,GACxB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,OAAO,CAAC,YAAY,EAAE;QAAE,IAAI,EAAE,IAAI,CAAA;KAAE,CAAC,CAAA;CAAE,GACzD;IACE,EAAE,EAAE,KAAK,CAAC;IACV,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EACJ,yBAAyB,GACzB,yBAAyB,GACzB,wBAAwB,GACxB,oBAAoB,GACpB,qBAAqB,GACrB,6BAA6B,CAAC;CACnC,CAAC;AAEN,wDAAwD;AACxD,MAAM,WAAW,wBAAwB;IACvC,iFAAiF;IACjF,OAAO,CAAC,EAAE,yBAAyB,CAAC;IACpC,gEAAgE;IAChE,SAAS,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAClF,oFAAoF;IACpF,WAAW,CAAC,EAAE,CACZ,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,KACR,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,MAAM,EAAE,WAAW,EAAE,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAClF,iFAAiF;IACjF,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAChD,+FAA+F;IAC/F,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;IACrD,qGAAqG;IACrG,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;IAC5E,8EAA8E;IAC9E,aAAa,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;IAC5D;;;OAGG;IACH,eAAe,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK;QAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,MAAM,EAAE,OAAO,CAAA;KAAE,CAAC;IACxF;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,qDAAqD;IACrD,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,8FAA8F;IAC9F,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;;;;OAKG;IACH,eAAe,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,MAAM,EAAE,GAAG,IAAI,CAAC;IAClF;;;;;OAKG;IACH,eAAe,CAAC,EAAE,CAChB,IAAI,EAAE,MAAM,EACZ,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,GAAG,EAAE,MAAM,KACR,UAAU,EAAE,GAAG,IAAI,CAAC;CAC1B;AAgBD;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAK5D;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,WAAW,EAAE,MAAM,GAAG,cAAc,CAsBhE;AAED,iEAAiE;AACjE,MAAM,WAAW,cAAc;IAC7B,6CAA6C;IAC7C,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,0CAA0C;IAC1C,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC;IACd;;;;;OAKG;IACH,IAAI,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,EAAE,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;CAC5C;AAUD;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEtD;AAYD;;;;;;;;;;;;GAYG;AACH,wBAAgB,YAAY,CAC1B,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,MAAM,EAAE,SAAS,WAAW,EAAE,EAC9B,GAAG,EAAE,MAAM,EACX,KAAK,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,EAC9D,SAAS,CAAC,EAAE,MAAM,GACjB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,CAwCjE;AAgBD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,SAAS,MAAM,EAAE,EAC3B,MAAM,EAAE,SAAS,WAAW,EAAE,EAC9B,cAAc,EAAE,MAAM,EACtB,IAAI,GAAE,gCAAqC,GAC1C,sBAAsB,CAwDxB;AA0GD,2CAA2C;AAC3C,MAAM,MAAM,uBAAuB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEpG;;;;;;;;;;;;;GAaG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,SAAS,MAAM,EAAE,EAC3B,MAAM,EAAE,SAAS,WAAW,EAAE,EAC9B,cAAc,EAAE,MAAM,EACtB,IAAI,GAAE,gCAAqC,GAC1C,uBAAuB,CAiCzB;AAED,6CAA6C;AAC7C,MAAM,WAAW,wBAAwB;IACvC,4BAA4B;IAC5B,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B,mFAAmF;IACnF,MAAM,EAAE,SAAS,WAAW,EAAE,CAAC;IAC/B,wBAAwB;IACxB,cAAc,EAAE,MAAM,CAAC;IACvB,oDAAoD;IACpD,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,wCAAwC;IACxC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;IAC3C,gFAAgF;IAChF,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,0CAA0C;IAC1C,GAAG,EAAE,MAAM,CAAC;IACZ,4BAA4B;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,0BAA0B;IAC1B,WAAW,EAAE,WAAW,CAAC,wBAAwB,CAAC,aAAa,CAAC,CAAC,CAAC;IAClE,kEAAkE;IAClE,eAAe,EAAE,WAAW,CAAC,wBAAwB,CAAC,iBAAiB,CAAC,CAAC,CAAC;IAC1E,sDAAsD;IACtD,eAAe,EAAE,WAAW,CAAC,wBAAwB,CAAC,iBAAiB,CAAC,CAAC,CAAC;IAC1E,qBAAqB;IACrB,UAAU,EAAE,WAAW,CAAC,wBAAwB,CAAC,YAAY,CAAC,CAAC,CAAC;CACjE;AAED,6CAA6C;AAC7C,MAAM,MAAM,yBAAyB,GACjC;IACE,EAAE,EAAE,IAAI,CAAC;IACT,2BAA2B;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,2DAA2D;IAC3D,MAAM,EAAE,WAAW,EAAE,CAAC;IACtB,qFAAqF;IACrF,KAAK,EAAE,MAAM,CAAC;IACd,mFAAmF;IACnF,SAAS,EAAE,MAAM,CAAC;CACnB,GACD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAkBlC;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAsB,mBAAmB,CACvC,KAAK,EAAE,wBAAwB,GAC9B,OAAO,CAAC,yBAAyB,CAAC,CAgGpC;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,IAAI,CAuB/F;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,MAAM,EACZ,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,GAAG,EAAE,MAAM,GACV,UAAU,EAAE,GAAG,IAAI,CAiBrB;AAoCD;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAY1D;AAkGD;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,uBAAuB,CAC3C,IAAI,EAAE,OAAO,CAAC,YAAY,EAAE;IAAE,IAAI,EAAE,IAAI,CAAA;CAAE,CAAC,EAC3C,GAAG,EAAE,MAAM,EACX,WAAW,GAAE,WAAW,CAAC,wBAAwB,CAAC,aAAa,CAAC,CAAsB,GACrF,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAyCvD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,qBAAqB,CACzC,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,aAAa,EACpB,IAAI,GAAE,wBAA6B,GAClC,OAAO,CAAC,gBAAgB,CAAC,CA6U3B"}
+{"version":3,"file":"ci-evidence.d.ts","sourceRoot":"","sources":["../../src/release/ci-evidence.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAKH,OAAO,KAAK,EAAE,YAAY,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAEnF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAEL,KAAK,aAAa,EAGnB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAEL,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EAI1B,MAAM,kBAAkB,CAAC;AAE1B,wEAAwE;AACxE,MAAM,WAAW,WAAW;IAC1B,6CAA6C;IAC7C,IAAI,EAAE,MAAM,CAAC;IACb,uCAAuC;IACvC,MAAM,EAAE,WAAW,GAAG,cAAc,CAAC;IACrC,iDAAiD;IACjD,MAAM,EAAE,MAAM,CAAC;IACf,oEAAoE;IACpE,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,mCAAmC;IACnC,OAAO,EAAE,MAAM,CAAC;IAChB,uEAAuE;IACvE,EAAE,EAAE,MAAM,CAAC;IACX,iEAAiE;IACjE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,yCAAyC;IACzC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,uDAAuD;IACvD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gEAAgE;IAChE,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,2EAA2E;AAC3E,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,mDAAmD;AACnD,MAAM,MAAM,sBAAsB,GAC9B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,WAAW,EAAE,CAAA;CAAE,GACnC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAErC,qDAAqD;AACrD,MAAM,WAAW,gCAAgC;IAC/C;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,+EAA+E;IAC/E,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;IAC5C;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,mFAAmF;AACnF,MAAM,WAAW,UAAU;IACzB,kBAAkB;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,+CAA+C;IAC/C,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,oFAAoF;AACpF,eAAO,MAAM,4BAA4B,KAAK,CAAC;AAE/C,yFAAyF;AACzF,eAAO,MAAM,6BAA6B,QAAmB,CAAC;AAa9D,mEAAmE;AACnE,MAAM,MAAM,gBAAgB,GACxB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,OAAO,CAAC,YAAY,EAAE;QAAE,IAAI,EAAE,IAAI,CAAA;KAAE,CAAC,CAAA;CAAE,GACzD;IACE,EAAE,EAAE,KAAK,CAAC;IACV,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EACJ,yBAAyB,GACzB,yBAAyB,GACzB,wBAAwB,GACxB,oBAAoB,GACpB,qBAAqB,GACrB,6BAA6B,CAAC;CACnC,CAAC;AAEN,wDAAwD;AACxD,MAAM,WAAW,wBAAwB;IACvC,iFAAiF;IACjF,OAAO,CAAC,EAAE,yBAAyB,CAAC;IACpC,gEAAgE;IAChE,SAAS,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAClF,oFAAoF;IACpF,WAAW,CAAC,EAAE,CACZ,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,KACR,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,MAAM,EAAE,WAAW,EAAE,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAClF,iFAAiF;IACjF,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAChD,+FAA+F;IAC/F,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;IACrD,qGAAqG;IACrG,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;IAC5E,8EAA8E;IAC9E,aAAa,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;IAC5D;;;OAGG;IACH,eAAe,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK;QAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,MAAM,EAAE,OAAO,CAAA;KAAE,CAAC;IACxF;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,qDAAqD;IACrD,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,8FAA8F;IAC9F,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;;;;OAKG;IACH,eAAe,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,MAAM,EAAE,GAAG,IAAI,CAAC;IAClF;;;;;OAKG;IACH,eAAe,CAAC,EAAE,CAChB,IAAI,EAAE,MAAM,EACZ,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,GAAG,EAAE,MAAM,KACR,UAAU,EAAE,GAAG,IAAI,CAAC;CAC1B;AAgBD;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAK5D;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,WAAW,EAAE,MAAM,GAAG,cAAc,CAqDhE;AAED;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,yEAAyE;IACzE,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,2EAA2E;IAC3E,IAAI,EAAE,MAAM,EAAE,CAAC;CAChB;AAED,iEAAiE;AACjE,MAAM,WAAW,cAAc;IAC7B,6CAA6C;IAC7C,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,0CAA0C;IAC1C,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC;IACd;;;;;OAKG;IACH,IAAI,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,EAAE,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAC3C;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,eAAe,EAAE,CAAC;QAAC,EAAE,CAAC,EAAE,eAAe,EAAE,CAAA;KAAE,CAAC;CAClE;AAUD;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEtD;AAYD;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAiBrD;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,KAAK,EAAE,SAAS,eAAe,EAAE,EACjC,YAAY,EAAE,SAAS,MAAM,EAAE,EAC/B,MAAM,EAAE,SAAS,WAAW,EAAE,EAC9B,GAAG,EAAE,MAAM,EACX,KAAK,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GAC7D;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAkD9D;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,YAAY,CAC1B,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,MAAM,EAAE,SAAS,WAAW,EAAE,EAC9B,GAAG,EAAE,MAAM,EACX,KAAK,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,EAC9D,SAAS,CAAC,EAAE,MAAM,GACjB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,CAwCjE;AAgBD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,SAAS,MAAM,EAAE,EAC3B,MAAM,EAAE,SAAS,WAAW,EAAE,EAC9B,cAAc,EAAE,MAAM,EACtB,IAAI,GAAE,gCAAqC,GAC1C,sBAAsB,CAwDxB;AA0GD,2CAA2C;AAC3C,MAAM,MAAM,uBAAuB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEpG;;;;;;;;;;;;;GAaG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,SAAS,MAAM,EAAE,EAC3B,MAAM,EAAE,SAAS,WAAW,EAAE,EAC9B,cAAc,EAAE,MAAM,EACtB,IAAI,GAAE,gCAAqC,GAC1C,uBAAuB,CAiCzB;AAED,6CAA6C;AAC7C,MAAM,WAAW,wBAAwB;IACvC,4BAA4B;IAC5B,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B,mFAAmF;IACnF,MAAM,EAAE,SAAS,WAAW,EAAE,CAAC;IAC/B,wBAAwB;IACxB,cAAc,EAAE,MAAM,CAAC;IACvB,oDAAoD;IACpD,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,wCAAwC;IACxC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;IAC3C,gFAAgF;IAChF,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,0CAA0C;IAC1C,GAAG,EAAE,MAAM,CAAC;IACZ,4BAA4B;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,0BAA0B;IAC1B,WAAW,EAAE,WAAW,CAAC,wBAAwB,CAAC,aAAa,CAAC,CAAC,CAAC;IAClE,kEAAkE;IAClE,eAAe,EAAE,WAAW,CAAC,wBAAwB,CAAC,iBAAiB,CAAC,CAAC,CAAC;IAC1E,sDAAsD;IACtD,eAAe,EAAE,WAAW,CAAC,wBAAwB,CAAC,iBAAiB,CAAC,CAAC,CAAC;IAC1E,qBAAqB;IACrB,UAAU,EAAE,WAAW,CAAC,wBAAwB,CAAC,YAAY,CAAC,CAAC,CAAC;CACjE;AAED,6CAA6C;AAC7C,MAAM,MAAM,yBAAyB,GACjC;IACE,EAAE,EAAE,IAAI,CAAC;IACT,2BAA2B;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,2DAA2D;IAC3D,MAAM,EAAE,WAAW,EAAE,CAAC;IACtB,qFAAqF;IACrF,KAAK,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GACD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAkBlC;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAsB,mBAAmB,CACvC,KAAK,EAAE,wBAAwB,GAC9B,OAAO,CAAC,yBAAyB,CAAC,CAoGpC;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,IAAI,CAuB/F;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,MAAM,EACZ,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,GAAG,EAAE,MAAM,GACV,UAAU,EAAE,GAAG,IAAI,CAiBrB;AAoCD;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAY1D;AAkGD;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,uBAAuB,CAC3C,IAAI,EAAE,OAAO,CAAC,YAAY,EAAE;IAAE,IAAI,EAAE,IAAI,CAAA;CAAE,CAAC,EAC3C,GAAG,EAAE,MAAM,EACX,WAAW,GAAE,WAAW,CAAC,wBAAwB,CAAC,aAAa,CAAC,CAAsB,GACrF,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CA6CvD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,qBAAqB,CACzC,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,aAAa,EACpB,IAAI,GAAE,wBAA6B,GAClC,OAAO,CAAC,gBAAgB,CAAC,CA4W3B"}

package/dist/release/ci-evidence.js

@@ -91,18 +91,45 @@ export function readCiChecks(projectRoot) {
     const list = (v) => Array.isArray(v) && v.every((x) => typeof x === 'string' && x.trim() !== '')
         ? v.map((x) => x.trim())
         : undefined;
-    const { tests, qa, jobs } = raw;
+    const { tests, qa, jobs, covering } = raw;
     const jobLists = typeof jobs === 'object' && jobs !== null
         ? jobs
         : undefined;
     const jobTests = list(jobLists?.tests);
     const jobQa = list(jobLists?.qa);
+    const coverRules = (v) => {
+        if (!Array.isArray(v))
+            return undefined;
+        const rules = v.flatMap((r) => {
+            if (typeof r !== 'object' || r === null)
+                return [];
+            const { paths, jobs: ruleJobs } = r;
+            const p = list(paths);
+            const j = list(ruleJobs);
+            return p && j ? [{ paths: p, jobs: j }] : [];
+        });
+        // A malformed rule voids the whole list: a half-read mapping must not widen coverage.
+        return rules.length === v.length && rules.length > 0 ? rules : undefined;
+    };
+    const coverLists = typeof covering === 'object' && covering !== null
+        ? covering
+        : undefined;
+    const coverTests = coverRules(coverLists?.tests);
+    const coverQa = coverRules(coverLists?.qa);
     return {
         ...(list(tests) ? { tests: list(tests) } : {}),
         ...(list(qa) ? { qa: list(qa) } : {}),
         ...(jobTests || jobQa
             ? { jobs: { ...(jobTests ? { tests: jobTests } : {}), ...(jobQa ? { qa: jobQa } : {}) } }
             : {}),
+        ...(coverTests || coverQa
+            ? {
+                covering: {
+                    ...(coverTests ? { tests: coverTests } : {}),
+                    ...(coverQa ? { qa: coverQa } : {}),
+                },
+            }
+            : {}),
     };
 }
 /**
@@ -131,6 +158,106 @@ function globToRegExp(glob) {
         .map((part) => part.replace(/[.+?^${}()|[\]\\]/g, '\\$&'))
         .join('.*')}$`);
 }
+/**
+ * Path glob to an anchored regular expression (T13175): `**` followed by `/` is
+ * any number of whole directories (including none), a trailing `/` followed by
+ * `**` is everything below, `*` any run of characters within one segment, `?`
+ * one character within a segment. Everything else is literal.
+ *
+ * @param glob - Repo-relative path glob.
+ * @returns The anchored expression.
+ */
+export function pathGlobToRegExp(glob) {
+    let out = '';
+    for (let i = 0; i < glob.length; i++) {
+        const ch = glob[i];
+        if (ch === '*' && glob[i + 1] === '*') {
+            if (glob[i + 2] === '/') {
+                out += '(?:.*/)?';
+                i += 2;
+            }
+            else {
+                out += '.*';
+                i++;
+            }
+        }
+        else if (ch === '*')
+            out += '[^/]*';
+        else if (ch === '?')
+            out += '[^/]';
+        else
+            out += ch.replace(/[.+^${}()|[\]\\]/g, '\\$&');
+    }
+    return new RegExp(`^${out}$`);
+}
+/**
+ * Judge a gate's required jobs with the covering rules (T13175): accepted only
+ * when each required glob either succeeded or had every latest run completed
+ * `skipped` (never cancelled, failed, pending or missing), at least one was
+ * skipped, every changed path matches a rule, and every job glob of each rule
+ * used has run and succeeded on `sha`.
+ *
+ * @param globs - The gate's required job globs (`evidence.ciChecks.jobs`).
+ * @param rules - The gate's covering rules.
+ * @param changedPaths - The PR's changed paths.
+ * @param checks - Every check reported for the commit.
+ * @param sha - Commit being judged.
+ * @param scope - The app and workflow files the jobs must come from.
+ * @returns The covering job names, or why coverage does not apply.
+ * @task T13175
+ */
+export function evaluateCoveringJobs(globs, rules, changedPaths, checks, sha, scope) {
+    const inScope = checks.filter((c) => c.source === 'check-run' &&
+        c.headSha === sha &&
+        c.workflowPath !== undefined &&
+        scope.workflows.includes(c.workflowPath) &&
+        (scope.app === undefined ||
+            (typeof scope.app === 'number' ? c.appId === scope.app : c.appSlug === scope.app)));
+    // Each required glob either succeeded (kept) or was SKIPPED by its filter
+    // on every run (covered below); anything else refuses.
+    const ran = [];
+    let skipped = false;
+    for (const glob of globs) {
+        const re = globToRegExp(glob);
+        const latest = new Map();
+        for (const c of inScope.filter((c) => re.test(c.name))) {
+            const key = `${c.name}\u0000${c.event ?? ''}`;
+            const prev = latest.get(key);
+            if (!prev || c.id > prev.id)
+                latest.set(key, c);
+        }
+        if (latest.size === 0)
+            return { ok: false, reason: `job ${glob} is missing, not skipped` };
+        const runs = [...latest.values()];
+        if (runs.every((c) => c.status === 'completed' && c.conclusion === 'success')) {
+            ran.push(...new Set(runs.map((c) => c.name)));
+            continue;
+        }
+        const notSkipped = runs.find((c) => c.status !== 'completed' || c.conclusion !== 'skipped');
+        if (notSkipped) {
+            return {
+                ok: false,
+                reason: `job ${notSkipped.name} is ${notSkipped.status !== 'completed' ? notSkipped.status : notSkipped.conclusion}, not skipped by its filter`,
+            };
+        }
+        skipped = true;
+    }
+    if (!skipped)
+        return { ok: false, reason: 'no required job was skipped' };
+    if (changedPaths.length === 0)
+        return { ok: false, reason: 'the PR has no known changed paths' };
+    const used = new Set();
+    for (const path of changedPaths) {
+        const rule = rules.find((r) => r.paths.some((g) => pathGlobToRegExp(g).test(path)));
+        if (!rule)
+            return { ok: false, reason: `${path} is covered by no evidence.ciChecks.covering rule` };
+        used.add(rule);
+    }
+    const jobs = evaluateJobs([...new Set([...used].flatMap((r) => r.jobs))], checks, sha, scope);
+    return jobs.ok
+        ? { ok: true, jobs: [...new Set([...ran, ...jobs.jobs])] }
+        : { ok: false, reason: jobs.reasons.join('; ') };
+}
 /**
  * Judge job globs on one SHA: every glob must match at least one job (check
  * run) from the allowed workflows/app, and the latest run of each matched
@@ -435,18 +562,22 @@ export async function findGreenDescendant(input) {
     if (input.changedPaths.length === 0) {
         return { ok: false, reason: 'the PR has no known changed paths to follow onto a later commit' };
     }
-    const head = input.prHeadSha;
-    if (!head || !/^[0-9a-f]{40}$/.test(head)) {
-        return {
-            ok: false,
-            reason: "the PR's final head is unknown, so its own pull_request CI cannot be shown green",
-        };
+    const head = input.mainOnly ? undefined : input.prHeadSha;
+    let headChecks = [];
+    if (!input.mainOnly) {
+        if (!head || !/^[0-9a-f]{40}$/.test(head)) {
+            return {
+                ok: false,
+                reason: "the PR's final head is unknown, so its own pull_request CI cannot be shown green",
+            };
+        }
+        const onHead = await input.fetchChecks(head, cwd);
+        if (!onHead.ok)
+            return { ok: false, reason: onHead.reason };
+        headChecks = onHead.checks;
     }
-    const onHead = await input.fetchChecks(head, cwd);
-    if (!onHead.ok)
-        return { ok: false, reason: onHead.reason };
-    for (const name of superseded.names) {
-        const pinned = onHead.checks.filter((c) => c.name === name && pinMatches(c, pins[name]));
+    for (const name of head ? superseded.names : []) {
+        const pinned = headChecks.filter((c) => c.name === name && pinMatches(c, pins[name]));
         const verdict = judgeOnSha(pinned, head, 'pull_request');
         if (!verdict.ok) {
             return {
@@ -516,9 +647,9 @@ export async function findGreenDescendant(input) {
             return {
                 ok: true,
                 sha,
-                checks: [...fetched.checks, ...onHead.checks],
+                checks: [...fetched.checks, ...headChecks],
                 range: `${merge}..${sha}`,
-                prHeadSha: head,
+                ...(head ? { prHeadSha: head } : {}),
             };
         }
     }
@@ -752,7 +883,7 @@ export async function recheckCiDescendantAtom(atom, cwd, fetchChecks = defaultFe
     if (!descendant)
         return { ok: true };
     const head = atom.descendantPrHeadSha;
-    if (!head) {
+    if (!head && !atom.mainOnly) {
         return {
             ok: false,
             reason: `ci:${atom.prNumber} leans on ${descendant.slice(0, 12)} but records no PR head; verify again`,
@@ -762,10 +893,14 @@ export async function recheckCiDescendantAtom(atom, cwd, fetchChecks = defaultFe
     const sameSource = (run, c) => run.name === c.name &&
         (c.app === undefined || run.appSlug === c.app || String(run.appId) === c.app) &&
         (c.workflow === undefined || run.workflowPath === c.workflow);
-    for (const [sha, event] of [
-        [descendant, 'push'],
-        [head, 'pull_request'],
-    ]) {
+    // T13174: a main-only atom never consulted the PR's own runs.
+    const targets = head
+        ? [
+            [descendant, 'push'],
+            [head, 'pull_request'],
+        ]
+        : [[descendant, 'push']];
+    for (const [sha, event] of targets) {
         const fetched = await fetchChecks(sha, cwd);
         if (!fetched.ok) {
             return {
@@ -920,19 +1055,15 @@ export async function resolveCiEvidenceAtom(prNumber, roots, opts = {}) {
         };
     }
     // Round 2: a pull_request run executes the PR's OWN edited workflow, so a PR
-    // that touches a pinned workflow file cannot vouch for itself.
+    // that touches a pinned workflow file cannot vouch for itself. T13174: it is
+    // attested by default-branch `push` runs only — the merge commit's, or a
+    // later main commit's under the T12742 rule — which run the workflow as it
+    // stands on main after review. Its PR runs are never consulted.
     const pinnedWorkflows = [
         ...new Set(mapped.flatMap((name) => (pins[name]?.workflow ? [pins[name].workflow] : []))),
     ];
     const editedWorkflows = pinnedWorkflows.filter((w) => pr.changedPaths.includes(w));
-    if (editedWorkflows.length > 0) {
-        return {
-            ok: false,
-            codeName: 'E_EVIDENCE_INSUFFICIENT',
-            reason: `PR #${prNumber} edits the pinned workflow ${editedWorkflows.join(', ')}, so its own CI ` +
-                'cannot attest it. Record local results instead (tool:test, tool:lint, tool:typecheck).',
-        };
-    }
+    const mainOnly = editedWorkflows.length > 0;
     const fetchChecks = opts.fetchChecks ?? defaultFetchChecks;
     const fetched = await fetchChecks(pr.mergeCommitSha, roots.executionRoot);
     if (!fetched.ok)
@@ -949,7 +1080,8 @@ export async function resolveCiEvidenceAtom(prNumber, roots, opts = {}) {
     const head = pr.headRefOid;
     const headTree = head ? treeOf(head, cwd) : null;
     const parent = (opts.firstParentOf ?? defaultFirstParentOf)(pr.mergeCommitSha, cwd);
-    const treeEqualHead = head &&
+    const treeEqualHead = !mainOnly &&
+        head &&
         mergeTree !== null &&
         headTree !== null &&
         headTree === mergeTree &&
@@ -983,6 +1115,7 @@ export async function resolveCiEvidenceAtom(prNumber, roots, opts = {}) {
             pins,
             changedPaths: pr.changedPaths,
             ...(pr.headRefOid ? { prHeadSha: pr.headRefOid } : {}),
+            ...(mainOnly ? { mainOnly: true } : {}),
             ref: onDefault.ref,
             cwd,
             fetchChecks,
@@ -1000,7 +1133,11 @@ export async function resolveCiEvidenceAtom(prNumber, roots, opts = {}) {
             if (rejudged.ok) {
                 checks = withDescendant;
                 judgedChecks = rejudged;
-                descendant = { sha: found.sha, range: found.range, prHeadSha: found.prHeadSha };
+                descendant = {
+                    sha: found.sha,
+                    range: found.range,
+                    ...(found.prHeadSha ? { prHeadSha: found.prHeadSha } : {}),
+                };
             }
             else {
                 descendantReason = `later commit ${found.sha.slice(0, 12)} was green, but re-judging with it still fails: ${rejudged.reasons.join('; ')}`;
@@ -1011,12 +1148,19 @@ export async function resolveCiEvidenceAtom(prNumber, roots, opts = {}) {
         }
     }
     if (!judgedChecks.ok) {
+        const waiting = judgedChecks.reasons.some((r) => /pending|not found|missing/.test(r));
         return {
             ok: false,
             codeName: 'E_EVIDENCE_TESTS_FAILED',
             reason: `Required CI on PR #${prNumber}'s merge commit ${pr.mergeCommitSha.slice(0, 12)} is not green ` +
                 `(source: ${describeRequiredWorkflowsSource(required.source)}):\n  - ${judgedChecks.reasons.join('\n  - ')}` +
-                (descendantReason ? `\n  No later main run stands in: ${descendantReason}` : ''),
+                (descendantReason ? `\n  No later main run stands in: ${descendantReason}` : '') +
+                (mainOnly
+                    ? `\n  PR #${prNumber} edits the pinned workflow ${editedWorkflows.join(', ')}, so only main's push CI attests it (T13174)` +
+                        (waiting
+                            ? `: wait for the push run on ${pr.mergeCommitSha.slice(0, 12)} (or a later main commit) to finish, then verify again. No local run is needed.`
+                            : '.')
+                    : ''),
         };
     }
     // Round 2 (skipped tests): the aggregate counts skipped jobs as a pass. For a
@@ -1052,7 +1196,7 @@ export async function resolveCiEvidenceAtom(prNumber, roots, opts = {}) {
             }
             const scope = { ...(app !== undefined ? { app } : {}), workflows: scopeWorkflows };
             let judgedJobs = evaluateJobs(globs, checks, pr.mergeCommitSha, scope);
-            if (!judgedJobs.ok && treeEqualHead) {
+            if (!judgedJobs.ok && treeEqualHead && !mainOnly) {
                 const onHead = evaluateJobs(globs, checks, treeEqualHead, scope, 'pull_request');
                 if (onHead.ok)
                     judgedJobs = onHead;
@@ -1060,18 +1204,37 @@ export async function resolveCiEvidenceAtom(prNumber, roots, opts = {}) {
             if (!judgedJobs.ok && descendant) {
                 // T12742: the stand-in's jobs, and the PR head's own pull_request jobs.
                 const onDescendant = evaluateJobs(globs, checks, descendant.sha, scope, 'push');
-                const onPrHead = evaluateJobs(globs, checks, descendant.prHeadSha, scope, 'pull_request');
-                if (onDescendant.ok && onPrHead.ok)
-                    judgedJobs = onDescendant;
-                else if (!onPrHead.ok)
-                    judgedJobs = onPrHead;
+                if (!descendant.prHeadSha) {
+                    // T13174: main-only — the PR's own jobs are not consulted.
+                    if (onDescendant.ok)
+                        judgedJobs = onDescendant;
+                }
+                else {
+                    const onPrHead = evaluateJobs(globs, checks, descendant.prHeadSha, scope, 'pull_request');
+                    if (onDescendant.ok && onPrHead.ok)
+                        judgedJobs = onDescendant;
+                    else if (!onPrHead.ok)
+                        judgedJobs = onPrHead;
+                }
+            }
+            // T13175: required jobs skipped by their change filter, with every
+            // changed path covered by a declared job that ran and succeeded.
+            const rules = readCiChecks(roots.storeRoot).covering?.[g.key];
+            let coverNote = '';
+            if (!judgedJobs.ok && rules && rules.length > 0) {
+                const covered = evaluateCoveringJobs(globs, rules, pr.changedPaths, checks, descendant?.sha ?? pr.mergeCommitSha, scope);
+                if (covered.ok)
+                    judgedJobs = covered;
+                else
+                    coverNote = `\n  Covering jobs do not apply: ${covered.reason}`;
             }
             if (!judgedJobs.ok) {
                 return {
                     ok: false,
                     codeName: 'E_EVIDENCE_TESTS_FAILED',
                     reason: `${g.gate} for code task ${context.task.id} needs its jobs to have run on PR #${prNumber}:\n  - ` +
-                        judgedJobs.reasons.join('\n  - '),
+                        judgedJobs.reasons.join('\n  - ') +
+                        coverNote,
                 };
             }
             jobsByGate[g.gate] = judgedJobs.jobs;
@@ -1092,9 +1255,10 @@ export async function resolveCiEvidenceAtom(prNumber, roots, opts = {}) {
                 ? {
                     descendantSha: descendant.sha,
                     descendantRange: descendant.range,
-                    descendantPrHeadSha: descendant.prHeadSha,
+                    ...(descendant.prHeadSha ? { descendantPrHeadSha: descendant.prHeadSha } : {}),
                 }
                 : {}),
+            ...(mainOnly ? { mainOnly: true } : {}),
             requiredSource: required.source.tier,
             taskId: context.task.id,
             gateChecks,