@codyswann/lisa 4.87.10 → 4.87.12

package/plugins/lisa-wiki-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.87.10",
+  "version": "4.87.12",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.87.10",
+  "version": "4.87.12",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.87.10",
+  "version": "4.87.12",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-devin/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.87.10",
+  "version": "4.87.12",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-wiki-devin/.devin-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-wiki",
-  "version": "4.87.10",
+  "version": "4.87.12",
   "description": "LLM Wiki — a distributable, git-native markdown knowledge base for Claude Code and Codex",
   "author": {
     "name": "Cody Swann"

package/scripts/two-channel-couplings.json

@@ -122,7 +122,7 @@
     "workflows": 26,
     "steps": 823,
     "couplings": 40,
-    "inventory": 207
+    "inventory": 208
   },
   "counts": {
     "package-backed": 11,

package/typescript/copy-overwrite/.prettierignore

@@ -75,6 +75,7 @@ scripts/check-skipped-required-checks.mjs
 scripts/check-state-classification.mjs
 scripts/check-third-party-action-pins.mjs
 scripts/check-third-party-review-evidence.mjs
+scripts/review-evidence-event.mjs
 scripts/check-threshold-ratchet.mjs
 scripts/check-verification-coverage.mjs
 scripts/check-workflow-load-failures.mjs

package/typescript/copy-overwrite/scripts/check-skipped-required-checks.mjs

@@ -1033,9 +1033,48 @@ export function loadDeclaration(rootDir) {
   assertEnforcementMode(declaration);
   assertSkipJobDeclarations(declaration.skip_job_declarations);
   assertEvidenceBearingChecks(declaration.evidence_bearing_checks ?? {});
+  registrationContexts(declaration, {
+    contexts: declaration.required_contexts,
+  });
   return declaration;
 }
 
+/**
+ * Validate reasoned registration deferrals against the set actually judged.
+ * This only removes absence/registration observations. GitHub still requires
+ * each deferred check to pass; evidence-bearing checks can never be deferred.
+ * @param {object} declaration - Reviewed repository declaration.
+ * @param {{contexts: string[]}} requiredSet - Selected base branch or union.
+ * @returns {string[]} Contexts whose registration must still be observed.
+ */
+export function registrationContexts(declaration, requiredSet) {
+  const deferred = declaration.registration_deferred;
+  if (deferred === undefined) return requiredSet.contexts;
+  if (
+    deferred === null ||
+    typeof deferred !== "object" ||
+    Array.isArray(deferred)
+  )
+    throw new Error(
+      "check-skipped-required-checks: `registration_deferred` must be an object mapping required check names to non-empty reasons."
+    );
+  for (const [name, reason] of Object.entries(deferred)) {
+    if (typeof reason !== "string" || reason.trim() === "")
+      throw new Error(
+        `check-skipped-required-checks: registration_deferred entry ${JSON.stringify(name)} needs a non-empty reason.`
+      );
+    if (!requiredSet.contexts.includes(name))
+      throw new Error(
+        `check-skipped-required-checks: registration_deferred entry ${JSON.stringify(name)} is not in the selected required set. Refusing to judge this declaration.`
+      );
+    if (Object.hasOwn(declaration.evidence_bearing_checks ?? {}, name))
+      throw new Error(
+        `check-skipped-required-checks: registration_deferred entry ${JSON.stringify(name)} is evidence-bearing. Review evidence must still be waited for and judged.`
+      );
+  }
+  return requiredSet.contexts.filter(name => !Object.hasOwn(deferred, name));
+}
+
 /**
  * Refuses a declaration that omits one of the guard's load-bearing snapshots.
  *
@@ -1781,7 +1820,7 @@ export function evaluateAbsentRequiredChecks(
       declaration,
       options.base ?? { base: null, source: null }
     );
-  const required = requiredSet.contexts;
+  const required = registrationContexts(declaration, requiredSet);
   const judgedFor =
     requiredSet.source === "branch"
       ? ` Judged against the contexts required on base \`${requiredSet.base}\`.`
@@ -1848,12 +1887,12 @@ function normaliseBaseRef(ref) {
  * Resolves the branch the pull request under inspection merges INTO.
  *
  * Most-explicit-first, the same order {@link resolvePullRequestNumber} uses:
- * an operator's `--base`, then `GITHUB_BASE_REF` (set by Actions on every
- * `pull_request` and `pull_request_target` run), then the event payload's
- * `pull_request.base.ref`. Offline on purpose — every source is a fact this run
- * already holds, so selecting a set costs no API call, no token scope and no
- * rate limit, and works the same on a fork pull request. Returning null is a
- * real answer: the caller falls back to the union and SAYS so.
+ * an operator's `--base`, then current metadata for the inspected PR, then
+ * `GITHUB_BASE_REF` and the event payload's `pull_request.base.ref`. A rerun
+ * replays its old event even after retargeting. The caller supplies metadata
+ * from its existing head observation, so this pure selection adds no API call.
+ * When current metadata is unavailable, the identity-checked event remains a
+ * fallback. Returning null selects the reported union fallback.
  *
  * The run's own base describes the run's own pull request, and nothing else.
  * When `options.pr` names the pull request being inspected, GITHUB_BASE_REF
@@ -1867,13 +1906,21 @@ function normaliseBaseRef(ref) {
  *
  * @param {ReadonlyArray<string>} argv - CLI arguments
  * @param {NodeJS.ProcessEnv} [env] - Environment, injectable for tests
- * @param {{pr?: string, repo?: string}} [options] - The pull request and repository being inspected, when known
+ * @param {{pr?: string, repo?: string, currentPullRequest?: object}} [options] - Inspected identity and its current metadata, when available
  * @returns {{base: string|null, source: string|null, ignoredEventBase?: string}} The base and where it came from
  */
 export function resolveBaseRef(argv, env = process.env, options = {}) {
   const explicit = normaliseBaseRef(readFlagValue(argv, "--base"));
   if (explicit !== null) return { base: explicit, source: "--base" };
 
+  if (
+    isInspectedPullRequest(options.currentPullRequest, options.pr, options.repo)
+  ) {
+    const current = normaliseBaseRef(options.currentPullRequest.baseRefName);
+    if (current !== null)
+      return { base: current, source: "current PR metadata" };
+  }
+
   const eventPath = env.GITHUB_EVENT_PATH;
   const payload =
     eventPath !== undefined && eventPath !== "" && existsSync(eventPath)
@@ -1897,6 +1944,34 @@ export function resolveBaseRef(argv, env = process.env, options = {}) {
     : { base: null, source: null, ignoredEventBase: found.base };
 }
 
+/**
+ * Match both native metadata identities before trusting its current base.
+ * @param {object|undefined} current - Native PR metadata
+ * @param {string|number|undefined} pr - Inspected PR
+ * @param {string|undefined} repo - Inspected repository
+ * @returns {boolean} Whether this is the requested PR in the requested repo
+ */
+function isInspectedPullRequest(current, pr, repo) {
+  if (
+    !current ||
+    pr === undefined ||
+    repo === undefined ||
+    String(current.number) !== String(pr) ||
+    typeof current.url !== "string"
+  )
+    return false;
+  try {
+    const url = new URL(current.url);
+    return (
+      ["https:", "http:"].includes(url.protocol) &&
+      url.pathname.replace(/\/$/u, "").toLowerCase() ===
+        `/${repo}/pull/${pr}`.toLowerCase()
+    );
+  } catch {
+    return false;
+  }
+}
+
 /**
  * True when the inspected repository is the one this run's event belongs to.
  *
@@ -4051,6 +4126,45 @@ export function resolveHeadSha(pr, repo) {
   }
 }
 
+/**
+ * Observe head and current base together using the existing PR metadata read.
+ * A failed metadata read retains the old head probe, so an independently
+ * readable head can still use the declared event/union base fallbacks.
+ * @param {string|number} pr - Inspected PR
+ * @param {string|undefined} repo - Inspected repository
+ * @returns {{headSha: string|undefined, repo?: string, pullRequest?: object}} One observation
+ */
+function observePullRequest(pr, repo) {
+  const slug = resolveRepoSlug(repo);
+  if (slug === undefined) return { headSha: undefined };
+  try {
+    const current = JSON.parse(
+      boundedExecFileSync(
+        "gh",
+        [
+          "pr",
+          "view",
+          String(pr),
+          "--repo",
+          slug,
+          "--json",
+          "number,url,headRefOid,baseRefName",
+        ],
+        { encoding: "utf8" }
+      )
+    );
+    if (
+      isInspectedPullRequest(current, pr, slug) &&
+      typeof current.headRefOid === "string" &&
+      /^[a-f0-9]{40}$/iu.test(current.headRefOid)
+    )
+      return { headSha: current.headRefOid, repo: slug, pullRequest: current };
+  } catch {
+    // Current metadata is unavailable; preserve the existing head-only probe.
+  }
+  return { headSha: resolveHeadSha(pr, slug), repo: slug };
+}
+
 /**
  * How a finding cites the commit its evidence was read at.
  *
@@ -4386,7 +4500,7 @@ function sleepSync(ms) {
  * @param {object} declaration - The per-repo declaration
  * @param {string|number} pr - Pull request number
  * @param {string|undefined} repo - `OWNER/NAME`, or undefined
- * @param {{timeoutSeconds?: number, intervalSeconds?: number, fetch?: Function, now?: Function, sleep?: Function, headSha?: Function, requiredSet?: object, substitutes?: Set<string>, substituteHead?: string}} [options] -
+ * @param {{timeoutSeconds?: number, intervalSeconds?: number, fetch?: Function, now?: Function, sleep?: Function, headSha?: Function, observe?: Function, initialObservation?: object, requiredSet?: object, requiredSetFor?: Function, substitutes?: Set<string>, substituteHead?: string}} [options] -
  *   Injection seams; the suite drives the whole loop through them so nothing
  *   here has to sleep in real time
  * @returns {{checks: object[], settled: boolean, headSha: string|undefined, registration: object}} Rows, reviewer completion, head and required-registration observations
@@ -4411,16 +4525,20 @@ export function fetchSettledChecks(declaration, pr, repo, options = {}) {
       );
     });
   const resolveHead = options.headSha ?? resolveHeadSha;
+  const observe =
+    options.observe ??
+    ((request, slug) => ({ headSha: resolveHead(request, slug) }));
   const clock = options.now ?? Date.now;
   const sleep = options.sleep ?? sleepSync;
   const started = clock();
   const deadline = started + timeoutMs;
-  const requiredSet =
+  const defaultRequiredSet =
     options.requiredSet ??
     selectRequiredContexts(declaration, { base: null, source: null });
-  const missing = checks =>
-    requiredSet.contexts.filter(
-      name => !checks.some(check => check.name === name)
+  const selectSet = options.requiredSetFor ?? (() => defaultRequiredSet);
+  const missing = observed =>
+    registrationContexts(declaration, observed.requiredSet).filter(
+      name => !observed.checks.some(check => check.name === name)
     );
   // A substitute is useful only at the head it was actually read for. Pending
   // rows still wait, and a missing required reviewer still needs a real row.
@@ -4435,29 +4553,41 @@ export function fetchSettledChecks(declaration, pr, repo, options = {}) {
       );
     });
 
-  // Bracket every roster read with head reads. `gh pr checks` targets the PR's
-  // current head but does not return the SHA it used, and the permission-light
-  // fallback resolves the head internally. A push between either route and a
-  // later provenance lookup used to make findings cite a commit whose checks
-  // were never evaluated. Matching observations on both sides bind the roster
-  // to that head; a mismatch is discarded and re-read, never reported.
+  // Bracket checks with coherent head/base observations. The early substitute
+  // read can supply the first observation without another metadata request.
+  // A push or retarget during the read is discarded within this same deadline.
+  let initial = options.initialObservation;
   const snapshot = () => {
-    const before = resolveHead(pr, repo);
-    if (before === undefined) {
+    const before = initial?.headSha === undefined ? observe(pr, repo) : initial;
+    initial = undefined;
+    const beforeSet = selectSet(before);
+    registrationContexts(declaration, beforeSet);
+    if (before.headSha === undefined) {
       return {
         checks: [],
         headSha: undefined,
         stable: false,
         after: undefined,
+        requiredSet: beforeSet,
+        baseBefore: beforeSet.base,
+        baseAfter: undefined,
       };
     }
-    const checks = read(pr, repo, before);
-    const after = resolveHead(pr, repo);
+    const checks = read(pr, repo, before.headSha);
+    const after = observe(pr, repo);
+    const afterSet = selectSet(after);
+    registrationContexts(declaration, afterSet);
     return {
       checks,
-      headSha: before,
-      stable: after !== undefined && before === after,
-      after,
+      headSha: before.headSha,
+      stable:
+        after.headSha !== undefined &&
+        before.headSha === after.headSha &&
+        beforeSet.base === afterSet.base,
+      after: after.headSha,
+      requiredSet: afterSet,
+      baseBefore: beforeSet.base,
+      baseAfter: afterSet.base,
     };
   };
 
@@ -4465,20 +4595,29 @@ export function fetchSettledChecks(declaration, pr, repo, options = {}) {
   while (
     (!observed.stable ||
       !evidenceReady(observed) ||
-      missing(observed.checks).length > 0) &&
+      missing(observed).length > 0) &&
     clock() < deadline
   ) {
     sleep(Math.min(intervalMs, deadline - clock()));
     observed = snapshot();
   }
   if (!observed.stable) {
+    if (observed.headSha !== undefined && observed.headSha === observed.after)
+      throw new Error(
+        `check-skipped-required-checks: the selected pull request base changed while its checks were being read (${observed.baseBefore ?? "unresolved"} -> ${observed.baseAfter ?? "unresolved"}). Refusing to judge checks against another base; re-read the pull request after retargeting settles.`
+      );
     throw new Error(
       `check-skipped-required-checks: the pull request head changed while its checks were being read (${observed.headSha ?? "unresolved"} -> ${observed.after ?? "unresolved"}). Refusing to attach one commit's review evidence to another; re-read the pull request after the push settles.`
     );
   }
   const elapsedSeconds = Math.max(0, clock() - started) / 1000;
-  const unregistered = missing(observed.checks);
-  const total = requiredSet.contexts.length;
+  const unregistered = missing(observed);
+  const total = registrationContexts(declaration, observed.requiredSet).length;
+  const deferred = Object.keys(declaration.registration_deferred ?? {});
+  const deferralNote =
+    deferred.length === 0
+      ? ""
+      : ` (${deferred.length} deferred by declaration: ${deferred.join(", ")})`;
   const present = total - unregistered.length;
   const expired = unregistered.length > 0;
   const settled = checksSettled(declaration, observed.checks);
@@ -4496,9 +4635,10 @@ export function fetchSettledChecks(declaration, pr, repo, options = {}) {
     total,
     missing: unregistered,
     expired,
+    ...(deferred.length === 0 ? {} : { deferred }),
     line: expired
-      ? `Required registration wait EXPIRED: the gate stopped waiting after ${elapsedSeconds}s; ${present} of ${total} required contexts observed; missing: ${unregistered.join(", ")}. RE-RUN this job before treating this as a finding about the change.`
-      : `Required registration settled after ${elapsedSeconds}s; ${present} of ${total} required contexts observed.`,
+      ? `Required registration wait EXPIRED: the gate stopped waiting after ${elapsedSeconds}s; ${present} of ${total} required contexts observed${deferralNote}; missing: ${unregistered.join(", ")}. RE-RUN this job before treating this as a finding about the change.`
+      : `Required registration settled after ${elapsedSeconds}s; ${present} of ${total} required contexts observed${deferralNote}.`,
   };
   return {
     checks: observed.checks,
@@ -4506,6 +4646,7 @@ export function fetchSettledChecks(declaration, pr, repo, options = {}) {
     headSha: observed.headSha,
     registration,
     evidence,
+    requiredSet: observed.requiredSet,
   };
 }
 
@@ -4701,7 +4842,7 @@ function readSecondsFlag(argv, name, fallback) {
  *
  * @param {ReadonlyArray<string>} argv - CLI arguments
  * @param {object} declaration - The per-repo declaration
- * @param {{trustRequiredContexts?: boolean, env?: NodeJS.ProcessEnv, fetch?: Function, probeBranch?: Function, now?: Function, sleep?: Function, headSha?: Function, reviewActivity?: Function}} [options] -
+ * @param {{trustRequiredContexts?: boolean, env?: NodeJS.ProcessEnv, fetch?: Function, probeBranch?: Function, now?: Function, sleep?: Function, headSha?: Function, observe?: Function, reviewActivity?: Function}} [options] -
  *   Injection seams for the suite
  * @returns {{pr: string|undefined, prSource: string|null, headSha: string|undefined, checked: number, violations: object[], settled: boolean, refusal: {kind: string, reason: string}|null}|undefined} The inspection
  */
@@ -4755,19 +4896,30 @@ export function inspectVacuity(argv, declaration, options = {}) {
   const declaredReviewers = Object.keys(
     declaration.evidence_bearing_checks ?? {}
   );
-  const earlyHead = requireReviewEvidence
-    ? (options.headSha ?? resolveHeadSha)(pr, repo)
+  const injectedHead = options.headSha;
+  const observe =
+    options.observe ??
+    (injectedHead
+      ? (request, slug) => ({ headSha: injectedHead(request, slug) })
+      : observePullRequest);
+  const earlyObservation = requireReviewEvidence
+    ? observe(pr, repo)
     : undefined;
+  const earlyHead = earlyObservation?.headSha;
   const earlySubstitutes = readSubstitutes(earlyHead);
   const allStoodIn =
     declaredReviewers.length > 0 &&
     declaredReviewers.every(name => earlySubstitutes.has(name));
-  // Select once: polling and the absence verdict must judge the same base.
-  // resolveBaseRef retains its existing contract; live retargeting is #4487.
-  const requiredSet = selectRequiredContexts(
-    declaration,
-    resolveBaseRef(argv, options.env ?? process.env, { pr, repo })
-  );
+  // Registration and absence share the selection returned with stable checks.
+  const requiredSetFor = observed =>
+    selectRequiredContexts(
+      declaration,
+      resolveBaseRef(argv, options.env ?? process.env, {
+        pr,
+        repo: repo ?? observed.repo,
+        currentPullRequest: observed.pullRequest,
+      })
+    );
   let read;
   try {
     read = fetchSettledChecks(declaration, pr, repo, {
@@ -4785,13 +4937,16 @@ export function inspectVacuity(argv, declaration, options = {}) {
       now: options.now,
       sleep: options.sleep,
       headSha: options.headSha,
-      requiredSet,
+      observe,
+      initialObservation: earlyObservation,
+      requiredSetFor,
       substitutes: allStoodIn ? earlySubstitutes : undefined,
       substituteHead: earlyHead,
     });
   } catch (error) {
     return refused(vacuityRefusal({ declaration, pr, error }));
   }
+  const requiredSet = read.requiredSet;
 
   const refusal = vacuityRefusal({ declaration, pr, checks: read.checks });
   if (refusal !== null) {

package/typescript/create-only/.github/required-checks.json

@@ -1,5 +1,6 @@
 {
   "_readme": [
+    "Optional `registration_deferred` (#4622) maps exact required context names to non-empty reasons when those jobs register after the bounded five-minute wait introduced by #4527. The registration/absence probe excludes only these names; GitHub still requires them to pass before merge. Entries outside the selected base branch's required set, malformed reasons, and evidence-bearing checks are refused. Omit the key for unchanged behavior. A slow reviewer is never deferred: the review-evidence workflow re-evaluates on its terminal check_run or status event, using default-branch code and a fresh current-head read. This workflow is create-only; existing hosts must adopt the event job explicitly to receive the wake-up behavior.",
     "Two REVIEWED SNAPSHOTS that scripts/check-skipped-required-checks.mjs makes police each other.",
     "Neither is derivable from this repository: `required_contexts` lives in a GitHub ruleset that humans edit in an admin console, and the skip_jobs token -> job name map lives in Lisa's quality.yml, which is not vendored here.",
     "Why it matters: GitHub counts a SKIPPED required status check as SATISFIED. A job named in `skip_jobs` still reports green against its required context having run zero steps, so the merge gate can never be red and therefore can never block anything.",
@@ -18,7 +19,7 @@
     "IT REFUSES RATHER THAN REPORTING AN EMPTY INSPECTION. An unresolvable pull request, a `gh` it could not read, a roster with no checks in it, or an empty `evidence_bearing_checks` all print the same \"nothing vacuous here\" that a genuinely clean run prints — so the guard fails instead and names which of the four it hit (`vacuity_pr_unresolved`, `vacuity_checks_unreadable`, `vacuity_no_checks_reported`, `vacuity_none_declared`). A refusal is NOT a finding: NOBODY LOOKED and THE REVIEW WAS FAKE are opposite facts, and a single red job would otherwise report them identically.",
     "`evidence_bearing_checks` names the checks whose GREEN is supposed to mean something reviewed the code. Use `{}` to accept the shipped description vocabulary, or add `proof` / `no_work` arrays to extend it — extensions ADD to the defaults, they do not replace them. Undeclared checks are never examined, because most CI jobs ship an empty description and flagging them all would bury the one finding that matters.",
     "This arm REPORTS AND NEVER BLOCKS, in every enforcement mode. A review bot can go hollow because an org-wide SPENDING CAP was hit, and a gate that reddens every PR on a billing state is worse than the one it criticises. What it changes is what you may CLAIM: a PR carrying a `vacuous_required_check` finding has not been shown to be reviewed, so do not record it as reviewed. Once you have made the governance call, `--fail-on-vacuous` is the supported way to ask for an exit code — add it to the command in `review-evidence.yml`, instead of writing a wrapper that reads `--json`.",
-    "PER-BRANCH SETS (CodySwannGT/lisa#4484). `required_contexts` is the UNION across every protected branch, which is the wrong set for judging which required contexts did NOT REPORT on one pull request: a context only `dev` requires was reported absent on every staging-base pull request. Optionally add `required_contexts_by_branch: { \"<branch>\": [ ...contexts ] }`, each set transcribed byte for byte from `gh api repos/OWNER/NAME/rules/branches/<branch> --jq '.[] | select(.type==\"required_status_checks\") | .parameters.required_status_checks[].context'` (read access only). The absent arm then judges a pull request against its BASE branch's set (`--base`, else `GITHUB_BASE_REF`, else the event payload's `pull_request.base.ref`). Without a set for that base it falls back to the union — same findings as before — and says so as `required_contexts_branch_fallback`; every run prints which set it used. Every per-branch context must also appear in `required_contexts`, and the one `baseline_fetched_at` stamp covers both."
+    "PER-BRANCH SETS (CodySwannGT/lisa#4484). `required_contexts` is the UNION across every protected branch, which is the wrong set for judging which required contexts did NOT REPORT on one pull request: a context only `dev` requires was reported absent on every staging-base pull request. Optionally add `required_contexts_by_branch: { \"<branch>\": [ ...contexts ] }`, each set transcribed byte for byte from `gh api repos/OWNER/NAME/rules/branches/<branch> --jq '.[] | select(.type==\"required_status_checks\") | .parameters.required_status_checks[].context'` (read access only). The absent arm judges the PR against its current base (`--base`, else current metadata from the existing PR head read). If current metadata is unreadable it uses only a matching PR/repository event (`GITHUB_BASE_REF`, else `pull_request.base.ref`). A rerun replays the old event, so matching identity alone does not establish the current base. Head/base observations bracket each check read; a retarget retries within the same settlement deadline, and registration and absence share the resulting selection. Without a set for that base it falls back to the union — same findings as before — and says so as `required_contexts_branch_fallback`; every run prints which set it used. Every per-branch context must also appear in `required_contexts`, and the one `baseline_fetched_at` stamp covers both."
   ],
   "enforcement": "warn",
   "ruleset": {

package/typescript/create-only/.github/workflows/review-evidence.yml

@@ -122,6 +122,9 @@ name: 🕵️ Review Evidence
 on:
   pull_request:
     types: [opened, synchronize, reopened, ready_for_review]
+  check_run:
+    types: [completed]
+  status:
   workflow_dispatch:
     inputs:
       pr:
@@ -147,11 +150,50 @@ permissions:
   pull-requests: read
 
 concurrency:
-  group: review-evidence-${{ github.event.pull_request.number || inputs.pr || github.ref }}
+  group: review-evidence-${{ github.event_name }}-${{ github.event.pull_request.number || inputs.pr || github.event.check_run.head_sha || github.event.sha || github.ref }}-${{ github.event.check_run.name || github.event.context }}-${{ github.event.check_run.app.id || github.event.creator.id }}
   cancel-in-progress: true
 
 jobs:
+  # Reviewer completion can outlast the bounded pull_request run. Dispatch the
+  # normal gate; the event is a wake-up and never proof that a review occurred.
+  # check_run requires this file on the default branch and GitHub suppresses
+  # Actions-created suites/heads; status supports legacy reviewer statuses.
+  recheck:
+    name: 🕵️ Re-evaluate a completed reviewer
+    if: github.event_name == 'check_run' || (github.event_name == 'status' && github.event.state != 'pending')
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      contents: read
+      checks: read
+      statuses: read
+      pull-requests: read
+      actions: write
+    steps:
+      # No head ref: never execute PR files with the dispatch token.
+      - name: 📥 Checkout default branch
+        uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+      - name: 🔧 Setup Node.js
+        uses: actions/setup-node@v6
+        with:
+          package-manager-cache: false
+          node-version: ${{ vars.NODE_VERSION || '24.21.0' }}
+      - name: 🕵️ Dispatch the gate for current declared reviewer heads
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -eu
+          script=scripts/review-evidence-event.mjs
+          if [ ! -f "$script" ]; then
+            echo "::error::Reviewer event resolver missing; no gate was dispatched."
+            exit 1
+          fi
+          node "$script" --dispatch
+
   vacuity:
+    if: github.event_name != 'check_run' && github.event_name != 'status'
     # DECLARATIVE, NOT A QUESTION (#3917). This was `🕵️ Did the required review
     # checks do any work?`, and an unsatisfied verdict exits non-zero, so the
     # row rendered `Did the required review checks do any work?  fail`. A yes/no