@edgehero/pi-dispatch-receiver 1.2.0 → 1.3.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@edgehero/pi-dispatch-receiver",
-  "version": "1.2.0",
+  "version": "1.3.0",
   "type": "module",
   "description": "Webhook receiver for pi-dispatch: the always-on edge that verifies GitHub, GitLab, Forgejo and Azure DevOps deliveries and enqueues (at most) one job per event for the worker.",
   "keywords": [
@@ -45,7 +45,7 @@
   },
   "dependencies": {
     "@octokit/webhooks": "14.2.0",
-    "@edgehero/pi-dispatch": "^1.3.0",
+    "@edgehero/pi-dispatch": "^1.4.0",
     "bullmq": "5.80.4",
     "ioredis": "5.11.1"
   }

package/src/azure-members.mjs

@@ -88,7 +88,10 @@ export function makeResolveAzureAuthority({ orgUrl, token, fetchFn = fetch }) {
 		try {
 			return { body: await res.json(), continuation: continuation || null };
 		} catch (err) {
-			return { indeterminate: `azure lookup returned unparseable JSON: ${err?.message ?? "unknown"}` };
+			// A FIXED reason, never err.message: V8's JSON.parse errors quote the offending input,
+			// so a failed res.json() here would carry response-body bytes into a log line -- the
+			// no-pii-in-logs rule the github resolver states, applied to its elders (issue #231).
+			return { indeterminate: "azure lookup returned unparseable JSON" };
 		}
 	}
 

package/src/close.mjs

@@ -0,0 +1,34 @@
+/**
+ * The ONE derivation of "which close rule matches this delivery" (issue #231), shared by every
+ * forge's close route and by the GitHub arm's wants-authority predicate. Two copies of a gate
+ * decision is the shape filter.mjs's prAuthorOk comment warns against, and here the two callers are
+ * a NETWORK CALL apart: the receiver asks "does any rule want this close" before spending a
+ * permission lookup, and the filter asks it again to route -- if those two answers could drift, a
+ * delivery could cost a lookup it then drops, or worse, route a close the lookup never gated.
+ *
+ * Total and throw-free like predicate.mjs: rules are loader-validated shapes, the inputs are
+ * adversarial payload fields, and the receiver's gates must never throw on data.
+ */
+
+/**
+ * Find the first rule (file order, firstMatchingRule's convention) whose action set has this close
+ * word and whose `number` narrowing (when present) names this item. Returns:
+ *   { rule }                                  -- matched; the caller gates and enqueues
+ *   { reason: "close-number-not-matched" }    -- a close rule is armed but names a different item
+ *   { reason: "no-matching-close-trigger" }   -- nothing armed wants this close
+ * The two refusal tokens are distinct because they call for different operator responses: "your
+ * one-shot exists and this was a different item closing" and "nothing is armed" read nothing alike
+ * from a panel.
+ */
+export function findCloseRule(rules, closeWord, number) {
+	let numberSkipped = false;
+	for (const rule of rules ?? []) {
+		if (!rule.actions?.has(closeWord)) continue;
+		if (rule.number !== undefined && rule.number !== number) {
+			numberSkipped = true;
+			continue;
+		}
+		return { rule };
+	}
+	return { reason: numberSkipped ? "close-number-not-matched" : "no-matching-close-trigger" };
+}

package/src/config.mjs

@@ -32,7 +32,7 @@
 
 import { existsSync, readFileSync } from "node:fs";
 import { configError, loadGitHubAuth, positiveInt } from "@edgehero/pi-dispatch/config";
-import { FORGE_KINDS, parseTriggers } from "@edgehero/pi-dispatch/triggers";
+import { FORGE_KINDS, PR_CLOSE_ACTIONS, parseTriggers } from "@edgehero/pi-dispatch/triggers";
 
 // Cwd-relative, matching what `pi-dispatch init` scaffolds (and the admin's default): the receiver's
 // default must be the file init just told the operator it created, not a demo buried in the repo.
@@ -102,7 +102,13 @@ export function loadReceiverConfig(env = process.env, { readFile = readFileSync,
  * credential lying around is not a statement that this receiver terminates GitHub webhooks.
  */
 function decideServesGithub(env, githubGroup) {
-	const hasGithubTriggers = githubGroup.label.length > 0 || githubGroup.comment !== null || githubGroup.pullRequest.length > 0;
+	// The close groups count too (issue #231): a deployment whose ONLY github rule is a close trigger
+	// must still mount `/`, require WEBHOOK_SECRET and build auth, or the one-shot the operator armed
+	// can never fire -- and the receiver would report nothing, the silent no-op this file's header
+	// calls the worst outcome. Conversely a deployment whose last github one-shot is SPENT stops
+	// counting here at its next boot (the sentinel groups nowhere), which is deliberate: nothing is
+	// left to serve, and INT-TRIGGERS-FILE-CONTRACT states it.
+	const hasGithubTriggers = githubGroup.label.length > 0 || githubGroup.comment !== null || githubGroup.pullRequest.length > 0 || githubGroup.issue.length > 0 || githubGroup.prClose.length > 0;
 	// `loadGitHubAuth` has already refused a garbled value by the time we get here, so anything non-empty
 	// here is one of pat|gh|app -- a real choice, not a typo we would be reading as consent.
 	const explicitAuthSource = env.GITHUB_AUTH_SOURCE !== undefined && env.GITHUB_AUTH_SOURCE !== "";
@@ -228,7 +234,11 @@ function loadAzureConfig(env) {
  * `{ github: <group>, gitlab: <group>, knownFlows }` where each group is:
  *   - `label`:       ordered `{ index, predicate, flow, command, packages, image }` rules (first match wins in the filter).
  *   - `comment`:     the single `{ index, phrase, defaultFlow, command, packages, image }` (or null when no comment trigger is configured).
- *   - `pullRequest`: ordered `{ index, actions:Set, predicate, flow, command, packages, image }` rules.
+ *   - `pullRequest`: ordered `{ index, actions:Set, predicate, flow, command, packages, image }` rules (never a close-only rule).
+ *   - `issue`:       ordered `{ index, actions:Set, number?, once?, ... }` close rules (issue #231).
+ *   - `prClose`:     ordered close-only pull_request rules, same shape as `issue` -- split from
+ *                    `pullRequest` so the closer-gated route and the author-gated route can never read
+ *                    each other's rules (the loader's no-mixing refusal makes the split total).
  * and `knownFlows` is every webhook `run.flow`, so a comment's `<phrase> <flow>` override cannot summon an
  * unlisted flow. A rule carries EITHER `flow` or `command` (issue #189; the shared parser enforces the
  * exclusivity): a command rule's match dispatches a registered pi extension command in the container, so
@@ -287,9 +297,24 @@ function loadTriggers(env, readFile, fileExists) {
 		} else if (on.type === "comment") {
 			group.comment = { index, phrase: on.phrase, defaultFlow: run.flow, command: run.command, packages: run.packages, image: run.image, skillsDir: run.skillsDir, instructions: run.instructions, resume: run.resume, secrets: run.secrets, secretsProfile: run.secretsProfile, replicas: run.replicas, repository: run.repository }; // parseTriggers guarantees at most one per forge
 		} else if (on.type === "pull_request") {
-			// `reviewStates` is null rather than an empty Set when unnarrowed: the filter tests it for
-			// presence, and an empty Set would read as "no verdict matches" and silently refuse everything.
-			group.pullRequest.push({ index, actions: new Set(on.action), reviewStates: on.reviewState ? new Set(on.reviewState) : null, predicate: { any: on.any, all: on.all, none: on.none }, flow: run.flow, command: run.command, packages: run.packages, image: run.image, skillsDir: run.skillsDir, instructions: run.instructions, resume: run.resume, secrets: run.secrets, secretsProfile: run.secretsProfile, replicas: run.replicas });
+			// The close-only split (issue #231): a close rule routes through the close gate (the CLOSER's
+			// resolved authority) and every other PR rule through the author gate, so they live in separate
+			// groups and neither route ever re-derives the distinction -- the loader already refused any
+			// list mixing the close word with another action, which is what makes this split total. The
+			// split reads the SHARED close-word table, never a re-typed word.
+			const closeWord = PR_CLOSE_ACTIONS[run.kind];
+			if (closeWord !== undefined && on.action.includes(closeWord)) {
+				group.prClose.push({ index, actions: new Set(on.action), number: on.number, once: on.once, flow: run.flow, command: run.command, packages: run.packages, image: run.image, skillsDir: run.skillsDir, instructions: run.instructions, resume: run.resume, secrets: run.secrets, secretsProfile: run.secretsProfile, replicas: run.replicas });
+			} else {
+				// `reviewStates` is null rather than an empty Set when unnarrowed: the filter tests it for
+				// presence, and an empty Set would read as "no verdict matches" and silently refuse everything.
+				group.pullRequest.push({ index, actions: new Set(on.action), reviewStates: on.reviewState ? new Set(on.reviewState) : null, predicate: { any: on.any, all: on.all, none: on.none }, flow: run.flow, command: run.command, packages: run.packages, image: run.image, skillsDir: run.skillsDir, instructions: run.instructions, resume: run.resume, secrets: run.secrets, secretsProfile: run.secretsProfile, replicas: run.replicas });
+			}
+		} else if (on.type === "issue") {
+			// The close-trigger kind (issue #231). No predicate and no reviewStates by construction (the
+			// loader refused both), and `number`/`once` ride conditionally-present exactly as the loader
+			// normalized them -- the filter's close route reads them, nothing else does.
+			group.issue.push({ index, actions: new Set(on.action), number: on.number, once: on.once, flow: run.flow, command: run.command, packages: run.packages, image: run.image, skillsDir: run.skillsDir, instructions: run.instructions, resume: run.resume, secrets: run.secrets, secretsProfile: run.secretsProfile, replicas: run.replicas });
 		}
 	}
 
@@ -297,7 +322,7 @@ function loadTriggers(env, readFile, fileExists) {
 }
 
 function emptyGroup() {
-	return { label: [], comment: null, pullRequest: [] };
+	return { label: [], comment: null, pullRequest: [], issue: [], prClose: [] };
 }
 
 /** The triggers file path the receiver reads (env override or the cwd default matching what `pi-dispatch init` scaffolds). */

package/src/filter-forgejo.mjs

@@ -34,6 +34,7 @@
  */
 
 import { escapeRegExp, firstMatchingRule, labelSet, matchedLabel, matchesRule } from "./predicate.mjs";
+import { findCloseRule } from "./close.mjs";
 import { isRecognizedAction, mapAction } from "./forgejo-subset.mjs";
 
 const LABEL_ACTIONS = new Set(["opened", "labeled", "reopened"]);
@@ -84,6 +85,17 @@ export function filterForgejo(eventName, subset, triggers, knownFlows, selfId, a
 		if (action === null) return unactionable();
 		if (eventName === "issues" && LABEL_ACTIONS.has(action)) {
 			resolved = routeIssueLabel(subset, group);
+		} else if (eventName === "issues" && action === "closed") {
+			// The close trigger (issue #231). `group.issue` holds ONLY close rules (the loader admits no
+			// other issue kind), and this arm can never contend with the label one: `closed` is not in
+			// LABEL_ACTIONS and must not become so -- a close is a statement about an item, not a label move.
+			resolved = routeIssueClose(subset, group, authorized);
+		} else if (eventName === "pull_request" && raw === "closed") {
+			// The RAW word, for routePullRequest's reason below: the close vocabulary is the forge's own
+			// (PR_CLOSE_ACTIONS, which the loader validated the rule against). Checked BEFORE the PR_ACTIONS
+			// arm, though today they cannot overlap; `group.prClose` was split from `group.pullRequest` at
+			// load, so a close rule is unreachable from routePullRequest and vice versa.
+			resolved = routePullRequestClose(subset, group, authorized);
 		} else if (eventName === "pull_request" && PR_ACTIONS.has(action)) {
 			// The RAW word, not the mapped one. A trigger file names actions in the forge's own vocabulary
 			// (`label_updated`, `synchronized`) because that is what an operator reads in Forgejo's docs and
@@ -250,3 +262,92 @@ function routePullRequest(subset, triggers, action) {
 	}
 	return { enqueue: false, reason: "no-matching-pr-trigger" };
 }
+
+/**
+ * Issue close path (issue #231). `findCloseRule` is the ONE derivation of "which close rule wants
+ * this delivery" (close.mjs), shared with the receiver's pre-lookup check -- two hand-rolled copies
+ * a network call apart is the drift that module's header warns against.
+ *
+ * The `closer-not-allowed` gate below is belt-and-braces and UNREACHABLE today: gate (2) in
+ * `filterForgejo` already refused every non-true verdict before routing, and on a webhook close
+ * delivery the SENDER is the closer, so the verdict that gate consumed is the closer's. It stays
+ * anyway, because this route's own contract is the closer's authority: if the global gate ever moves,
+ * or a resolver starts returning a shape it never has, a close must fail closed under its own token
+ * rather than route on a stale assumption about the caller.
+ */
+function routeIssueClose(subset, triggers, authorized) {
+	const number = subset.issue?.number;
+	// Integer or refuse, the github arms' rule: an UNNARROWED rule matches an undefined number, so a
+	// degenerate shape would otherwise enqueue a numberless target.
+	if (!Number.isInteger(number)) {
+		return { enqueue: false, reason: "missing-issue-number" };
+	}
+	// "closed" is PR_CLOSE_ACTIONS.forgejo -- the forge's own word, the one the loader validated the
+	// rule's action list against, exactly as routePullRequest matches raw vocabulary.
+	const found = findCloseRule(triggers.issue, "closed", number);
+	if (found.rule === undefined) {
+		return { enqueue: false, reason: found.reason };
+	}
+	if (authorized !== true) {
+		return { enqueue: false, reason: "closer-not-allowed" };
+	}
+	const rule = found.rule;
+	return {
+		enqueue: true,
+		...(rule.command !== undefined ? { command: rule.command } : { flow: rule.flow }),
+		packages: rule.packages, // the MATCHED rule's fields -- rules in one file may differ on them
+		image: rule.image,
+		skillsDir: rule.skillsDir,
+		secrets: rule.secrets,
+		secretsProfile: rule.secretsProfile,
+		instructions: rule.instructions,
+		resume: rule.resume,
+		replicas: rule.replicas,
+		// `once: true` rides `matched` ONLY when armed (spreading false is a no-op), so the enqueue path
+		// can see a disarm is owed without re-reading the rule table -- and a plain close rule's matched
+		// record stays byte-identical to the other routes' shape.
+		matched: { index: rule.index, type: "issue", action: "closed", number, ...(rule.once === true && { once: true }) },
+		target: { type: "issue", number, title: subset.issue?.title, body: subset.issue?.body },
+	};
+}
+
+/** PR close path (issue #231). Same shape and same belt-and-braces closer gate as routeIssueClose. */
+function routePullRequestClose(subset, triggers, authorized) {
+	const pr = subset.pull_request;
+	// Object AND integer number, the github arm's rule: a shape without a usable number must refuse
+	// before any rule is consulted.
+	if (!pr || !Number.isInteger(pr.number)) {
+		return { enqueue: false, reason: "missing-pull-request" };
+	}
+	const found = findCloseRule(triggers.prClose, "closed", pr.number);
+	if (found.rule === undefined) {
+		return { enqueue: false, reason: found.reason };
+	}
+	if (authorized !== true) {
+		return { enqueue: false, reason: "closer-not-allowed" }; // unreachable behind gate (2) -- see routeIssueClose
+	}
+	const rule = found.rule;
+	return {
+		enqueue: true,
+		...(rule.command !== undefined ? { command: rule.command } : { flow: rule.flow }),
+		packages: rule.packages,
+		image: rule.image,
+		skillsDir: rule.skillsDir,
+		secrets: rule.secrets,
+		secretsProfile: rule.secretsProfile,
+		instructions: rule.instructions,
+		resume: rule.resume,
+		replicas: rule.replicas,
+		// No `number` on a PR close's matched record -- parallel to routePullRequest's, where the item
+		// number is the target's business; the issue route carries it because the github design does.
+		matched: { index: rule.index, type: "pull_request", action: "closed", ...(rule.once === true && { once: true }) },
+		target: {
+			type: "pull_request",
+			number: pr.number,
+			title: pr.title,
+			body: pr.body,
+			head: pr.head,
+			base: pr.base,
+		},
+	};
+}

package/src/filter-gitlab.mjs

@@ -41,6 +41,7 @@
  */
 
 import { firstMatchingRule, labelSet, matchedLabel } from "./predicate.mjs";
+import { findCloseRule } from "./close.mjs";
 
 /**
 /** The merge-request actions a trigger may name, mirrored from the loader's gitlab vocabulary. */
@@ -75,9 +76,32 @@ export function filterGitLab(subset, triggers, knownFlows, selfId, authorized, d
 	const kind = subset.objectKind;
 	let resolved;
 	if (kind === "issue") {
-		resolved = routeLabel(subset, triggers, "issue");
+		if (subset.action === "close") {
+			// The close trigger (issue #231), tried FIRST -- and the label walk only as a FALLBACK -- because
+			// a real GitLab delivery can close and label in one call (a quick action comment, or the sidebar
+			// edited during close). One delivery, one job: when an armed close rule wants this close it fires
+			// and the label rule does NOT, so the two rule kinds cannot double-bill a single click.
+			resolved = routeIssueClose(subset, triggers, authorized);
+			if (!resolved.enqueue && resolved.reason !== "closer-not-allowed" && subset.labelChanges) {
+				// No close rule took it, and this close also MOVED labels (`changes.labels`, the exact field
+				// `addedLabels` reads for every non-open action). Label rules fired on such closes before close
+				// routing existed and must keep doing so byte-identically -- including on ANY close refusal, so
+				// a one-shot armed for a DIFFERENT item cannot eat a label trigger it was never about, and
+				// including the label walk's own refusal reasons when nothing matches. The `closer-not-allowed`
+				// exclusion is belt-and-braces with the route's own unreachable gate: a close a drifted
+				// resolver refused must stay refused, never demoted into a label job.
+				resolved = routeLabel(subset, triggers, "issue");
+			}
+		} else {
+			resolved = routeLabel(subset, triggers, "issue");
+		}
 	} else if (kind === "merge_request") {
-		resolved = routeMergeRequest(subset, triggers);
+		// An MR close routes over `group.prClose` ALONE (issue #231), with no label fallback: unlike the
+		// issue arm above, MR_ACTIONS never contained "close", so no MR rule ever fired on a close and
+		// there is nothing for a fallback to keep working. MR_ACTIONS stays untouched for the same reason
+		// in the other direction -- close rules can never reach routeMergeRequest, because the loader split
+		// them into `prClose` at group time, so the two rule kinds are mutually unreachable by construction.
+		resolved = subset.action === "close" ? routeMergeRequestClose(subset, triggers, authorized) : routeMergeRequest(subset, triggers);
 	} else if (kind === "note") {
 		resolved = routeNote(subset, triggers, knownFlows);
 	} else {
@@ -225,6 +249,86 @@ function mrResult(subset, rule, matched) {
 	};
 }
 
+/**
+ * Issue close path (issue #231). `findCloseRule` is the ONE derivation of "which close rule wants
+ * this delivery" (close.mjs), shared with the receiver's pre-lookup check -- two hand-rolled copies
+ * a network call apart is the drift that module's header warns against.
+ *
+ * The `closer-not-allowed` gate below is belt-and-braces and UNREACHABLE today: gate (2) in
+ * `filterGitLab` already refused every non-true verdict before routing, and on a webhook close
+ * delivery the ACTOR is the closer, so the verdict that gate consumed is the closer's. It stays
+ * anyway, because this route's own contract is the closer's authority: if the global gate ever
+ * moves, or a resolver starts returning a shape it never has, a close must fail closed under its own
+ * token rather than route on a stale assumption about the caller.
+ */
+function routeIssueClose(subset, triggers, authorized) {
+	const number = subset.target?.iid;
+	// Integer or refuse, the github arms' rule: an UNNARROWED rule matches an undefined number, so a
+	// degenerate shape would otherwise enqueue a numberless target. GitLab sends integer iids.
+	if (!Number.isInteger(number)) {
+		return { enqueue: false, reason: "missing-issue-number" };
+	}
+	// "close" is PR_CLOSE_ACTIONS.gitlab -- the forge's own word, the one the loader validated the
+	// rule's action list against. GitLab really does say "close", not "closed".
+	const found = findCloseRule(triggers?.issue, "close", number);
+	if (found.rule === undefined) {
+		return { enqueue: false, reason: found.reason };
+	}
+	if (authorized !== true) {
+		return { enqueue: false, reason: "closer-not-allowed" };
+	}
+	const rule = found.rule;
+	return {
+		enqueue: true,
+		...(rule.command !== undefined ? { command: rule.command } : { flow: rule.flow }),
+		packages: rule.packages, // the MATCHED rule's fields -- rules in one file may differ on them
+		image: rule.image,
+		skillsDir: rule.skillsDir,
+		secrets: rule.secrets,
+		secretsProfile: rule.secretsProfile,
+		instructions: rule.instructions,
+		resume: rule.resume,
+		replicas: rule.replicas,
+		// `once: true` rides `matched` ONLY when armed (spreading false is a no-op), so the enqueue path
+		// can see a disarm is owed without re-reading the rule table -- and a plain close rule's matched
+		// record stays byte-identical to the other routes' shape.
+		matched: { index: rule.index, type: "issue", action: "close", number, ...(rule.once === true && { once: true }) },
+		target: buildTarget(subset, "issue"),
+	};
+}
+
+/** MR close path (issue #231). Same shape and same belt-and-braces closer gate as routeIssueClose. */
+function routeMergeRequestClose(subset, triggers, authorized) {
+	// The issue arm's integer guard, same reason.
+	if (!Number.isInteger(subset.target?.iid)) {
+		return { enqueue: false, reason: "missing-pull-request" };
+	}
+	const found = findCloseRule(triggers?.prClose, "close", subset.target?.iid);
+	if (found.rule === undefined) {
+		return { enqueue: false, reason: found.reason };
+	}
+	if (authorized !== true) {
+		return { enqueue: false, reason: "closer-not-allowed" }; // unreachable behind gate (2) -- see routeIssueClose
+	}
+	const rule = found.rule;
+	return {
+		enqueue: true,
+		...(rule.command !== undefined ? { command: rule.command } : { flow: rule.flow }),
+		packages: rule.packages,
+		image: rule.image,
+		skillsDir: rule.skillsDir,
+		secrets: rule.secrets,
+		secretsProfile: rule.secretsProfile,
+		instructions: rule.instructions,
+		resume: rule.resume,
+		replicas: rule.replicas,
+		// No `number` on an MR close's matched record -- parallel to routeMergeRequest's, where the item
+		// number is the target's business; the issue route carries it because the github design does.
+		matched: { index: rule.index, type: "pull_request", action: "close", ...(rule.once === true && { once: true }) },
+		target: buildTarget(subset, "pull_request"),
+	};
+}
+
 /**
  * Note (comment) path. `noteable_type` states whether the comment is on an issue or a merge request --
  * GitHub infers the same thing from the presence of `issue.pull_request`. Routing it wrong would mint an

package/src/filter.mjs

@@ -33,9 +33,19 @@
  * All three are hard-coded here, never config-optional -- an ungated auto-trigger is an unbounded paid run
  * started by whoever opens a fork PR (CONST-TRIGGER-AUTHOR-GATE, job-budget rules).
  *
+ * CLOSE ROUTES (issue #231): `issues.closed` and `pull_request.closed` route over the close-trigger
+ * groups (`triggers.issue` / `triggers.prClose`) via the ONE shared derivation in ./close.mjs. Their
+ * gate is `closerAuthorized`, the OPTIONAL sixth parameter: the receiver's pre-resolved answer to
+ * "does the account that closed this item hold write access". It is a parameter because this module
+ * is pure and that answer needs a network lookup the receiver performs (only when
+ * `wantsCloserAuthority` below says a rule wants this close). Strict `=== true` -- anything else,
+ * absence included, fails closed -- so every existing five-argument call site behaves byte-identically:
+ * their routes never read the value.
+ *
  * `selfId` is the numeric id of whichever identity posts as the harness (the App's bot user, or the PAT
  * user); `deliveryId` is the `X-GitHub-Delivery` GUID, carried into the job for downstream dedup.
  */
+import { findCloseRule } from "./close.mjs";
 import { escapeRegExp, firstMatchingRule, labelSet, matchedLabel, matchesRule } from "./predicate.mjs";
 
 const AUTHOR_ALLOWLIST = new Set(["OWNER", "MEMBER", "COLLABORATOR"]);
@@ -48,8 +58,17 @@ const REVIEW_ACTION = "review_submitted";
 const REVIEW_EVENT_ACTION = "submitted";
 // PR_AUTO_ACTIONS is deliberately NOT extended with REVIEW_ACTION: it exists only to select the
 // `pr-author-not-allowed` drop reason, and the review path has reasons of its own.
+//
+// GitHub's close word (issue #231), byte-equal to PR_CLOSE_ACTIONS.github in the shared forge table
+// (worker/src/triggers.mjs). Spelled here rather than imported, deliberately: this file is the GITHUB
+// gate and already spells GitHub's action vocabulary in its own Sets above -- pulling the per-forge
+// table into it would suggest this gate routes other forges' words, which it never does (each forge
+// has a filter of its own, and the config grouping already consumed the table to build the groups this
+// file reads). The word cannot drift: it is what the wire sends, and the route arm below matches the
+// raw payload action against it.
+const CLOSE_ACTION = "closed";
 
-export function filter(eventName, subset, cfg, selfId, deliveryId) {
+export function filter(eventName, subset, cfg, selfId, deliveryId, closerAuthorized) {
 	// (0) Fail-closed on identity. MUST precede the self compare -- see header, ordering constraint.
 	if (typeof subset?.sender?.id !== "number") {
 		return { enqueue: false, reason: "missing-sender-id" };
@@ -85,6 +104,16 @@ export function filter(eventName, subset, cfg, selfId, deliveryId) {
 		// text the harness has already been paid to read, and a dismissal removes a verdict rather than
 		// stating one.
 		resolved = routePullRequest(subset, triggers, REVIEW_ACTION);
+	} else if (eventName === "issues" && action === CLOSE_ACTION) {
+		// The issue close-trigger route (issue #231). The closer-authority gate lives INSIDE the route,
+		// after the rule match -- see routeClose for why it cannot sit up here.
+		resolved = routeIssueClose(subset, triggers, closerAuthorized);
+	} else if (eventName === "pull_request" && action === CLOSE_ACTION) {
+		// `closed` is deliberately NOT in PR_ACTIONS: a close rule gates on the CLOSER's resolved write
+		// access while every other PR rule gates on the author's association or a collaborator's label,
+		// and one route cannot gate on two different actors -- the same line config.mjs's prClose split
+		// draws, which is what makes `triggers.prClose` the only list this arm ever reads.
+		resolved = routePrClose(subset, triggers, closerAuthorized);
 	} else {
 		return { enqueue: false, reason: "unhandled-event" };
 	}
@@ -358,3 +387,135 @@ function buildPrTarget(pr) {
 	if (pr.base) target.base = { ref: pr.base.ref };
 	return target;
 }
+
+/**
+ * Issue close path (issue #231). `matched.number` is the CLOSED ITEM's number, not the rule's
+ * narrowing -- an unnarrowed rule fires for any issue, and the decision record must still name which
+ * one spent it, or a once disarm is unexplainable back to an item.
+ */
+function routeIssueClose(subset, triggers, closerAuthorized) {
+	const number = subset.issue?.number;
+	// Integer or refuse, the PR arm's missing-object guard sharpened for BOTH arms: parseSubset always
+	// fabricates `subset.issue` as an object, so object presence proves nothing here, and an UNNARROWED
+	// rule matches on the action alone -- without this line a signed body replayed under a swapped
+	// event header enqueues a paid job whose target has no number at all (and a crafted string number
+	// would ride verbatim into event.json). GitHub only ever sends integers; anything else is a shape
+	// this route must not spend on.
+	if (!Number.isInteger(number)) {
+		return { enqueue: false, reason: "missing-issue-number" };
+	}
+	return routeClose(
+		triggers.issue,
+		number,
+		closerAuthorized,
+		(rule) => ({ index: rule.index, type: "issue", action: CLOSE_ACTION, number, ...(rule.once === true && { once: true }) }),
+		() => ({ type: "issue", number, title: subset.issue?.title, body: subset.issue?.body }),
+	);
+}
+
+/**
+ * PR close path (issue #231), the same guard shape routePullRequest opens with: no pull_request
+ * object is a malformed delivery, refused before any rule is consulted. `matched` carries no number
+ * here -- the target does, exactly as on every other pull_request match.
+ */
+function routePrClose(subset, triggers, closerAuthorized) {
+	const pr = subset.pull_request;
+	// Object AND integer number, the issue arm's rule: a pull_request object without an integer
+	// number is the same malformed delivery wearing a shape, and the dedup key would otherwise read
+	// `#undefined`. One reason for both cases -- to an operator they are one fact.
+	if (pr === null || typeof pr !== "object" || !Number.isInteger(pr.number)) {
+		return { enqueue: false, reason: "missing-pull-request" };
+	}
+	return routeClose(
+		triggers.prClose,
+		pr.number,
+		closerAuthorized,
+		(rule) => ({ index: rule.index, type: "pull_request", action: CLOSE_ACTION, ...(rule.once === true && { once: true }) }),
+		() => buildPrTarget(pr),
+	);
+}
+
+/**
+ * The shared close route: one body for both arms, driving the ONE rule derivation in ./close.mjs --
+ * the same findCloseRule call `wantsCloserAuthority` makes, so "which close does a rule want" can
+ * never drift between the receiver's pre-lookup question and this routing answer.
+ *
+ * `once` rides `matched` only when literally true, mirroring how every optional job field is absent
+ * rather than present-and-false: matched is the downstream disarm signal, and its consumers test
+ * presence, not truthiness.
+ */
+function routeClose(rules, number, closerAuthorized, matchedFor, targetFor) {
+	const found = findCloseRule(rules, CLOSE_ACTION, number);
+	if (found.rule === undefined) {
+		return { enqueue: false, reason: found.reason };
+	}
+	// The authority gate sits INSIDE the route and AFTER the match, deliberately. The receiver performs
+	// the closer's permission lookup only for a delivery some close rule actually wants (that is what
+	// `wantsCloserAuthority` exists for), so a gate BEFORE the rule loop would emit `closer-not-allowed`
+	// for closes no rule matches -- a security token no lookup ever backed, telling an operator an
+	// authority decision was made about a delivery nobody ever resolved. A close nothing wants is
+	// `no-matching-close-trigger`, whoever closed it.
+	//
+	// Strict `!== true`, never truthiness: the value is the receiver's RESOLVED answer, and anything
+	// else reaching here -- undefined from an unwired caller, an indeterminate lookup, a "true" string
+	// or a count from a parse bug -- is a wiring fault that must fail CLOSED, the direction every gate
+	// in this file already takes (CONST-TRIGGER-AUTHOR-GATE).
+	if (closerAuthorized !== true) {
+		return { enqueue: false, reason: "closer-not-allowed" };
+	}
+	const rule = found.rule;
+	return {
+		enqueue: true,
+		// A command rule (issue #189) skips flow resolution entirely: the rule match IS the dispatch.
+		...(rule.command !== undefined ? { command: rule.command } : { flow: rule.flow }),
+		packages: rule.packages, // the MATCHED rule's fields -- rules in one file may differ on them
+		image: rule.image,
+		skillsDir: rule.skillsDir,
+		secrets: rule.secrets,
+		secretsProfile: rule.secretsProfile,
+		instructions: rule.instructions,
+		resume: rule.resume,
+		replicas: rule.replicas,
+		matched: matchedFor(rule),
+		target: targetFor(),
+	};
+}
+
+/**
+ * Does this forge group arm any close trigger at all? Pure, for the receiver/poller arm: whether the
+ * closer-authority machinery is worth wiring up for a delivery stream is a per-group fact, and
+ * deriving it anywhere else would be a second spelling of "which groups are the close groups".
+ */
+export function hasCloseTriggers(group) {
+	return group?.issue?.length > 0 || group?.prClose?.length > 0;
+}
+
+/**
+ * Should the receiver spend a permission lookup on this delivery before calling `filter`? Pure, and
+ * the SINGLE derivation shared with the route above: it calls the same findCloseRule over the same
+ * groups, so the pre-lookup question and the routing answer cannot drift -- a delivery never costs a
+ * lookup the route then ignores, and never routes a close the lookup never gated (./close.mjs's
+ * header names exactly this hazard).
+ */
+export function wantsCloserAuthority(eventName, subset, group, selfId) {
+	// Filter's own step-0/1 guards, replicated FIRST and in the same order (fail-closed identity, then
+	// the unconditional bot-loop guard): the harness closing its own issue -- the natural last act of
+	// the very flow a close trigger arms -- must not cost a lookup, and an INDETERMINATE lookup on a
+	// self-delivery would 503 (so: redeliver, retry, loop) traffic the filter would only ever drop as
+	// `self`.
+	if (typeof subset?.sender?.id !== "number") return false;
+	if (subset.sender.id === selfId) return false;
+	if (eventName === "issues" && subset.action === CLOSE_ACTION) {
+		// The routes' own shape guards, replicated for the same one-derivation reason as the step-0/1
+		// guards above: an UNNARROWED rule matches an undefined number, so without these lines a
+		// degenerate payload costs a token mint and a lookup the route then drops -- the exact "lookup
+		// the route ignores" this function exists to make impossible.
+		if (!Number.isInteger(subset.issue?.number)) return false;
+		return findCloseRule(group?.issue, CLOSE_ACTION, subset.issue.number).rule !== undefined;
+	}
+	if (eventName === "pull_request" && subset.action === CLOSE_ACTION) {
+		if (subset.pull_request === null || typeof subset.pull_request !== "object" || !Number.isInteger(subset.pull_request.number)) return false;
+		return findCloseRule(group?.prClose, CLOSE_ACTION, subset.pull_request.number).rule !== undefined;
+	}
+	return false;
+}

package/src/forgejo-members.mjs

@@ -77,7 +77,10 @@ export function makeResolveForgejoAuthority({ apiUrl, token, fetchFn = fetch })
 		try {
 			body = await res.json();
 		} catch (err) {
-			return { indeterminate: `collaborator permission lookup returned unparseable JSON: ${err?.message ?? "unknown"}` };
+			// A FIXED reason, never err.message: V8's JSON.parse errors quote the offending input,
+			// so a failed res.json() here would carry response-body bytes into a log line -- the
+			// no-pii-in-logs rule the github resolver states, applied to its elders (issue #231).
+			return { indeterminate: "collaborator permission lookup returned unparseable JSON" };
 		}
 		const permission = body?.permission;
 		if (typeof permission !== "string" || permission === "") {

package/src/forgejo-subset.mjs

@@ -44,6 +44,11 @@ const ISSUE_ACTIONS = {
 	opened: "opened",
 	reopened: "reopened",
 	label_updated: "labeled",
+	// The close trigger (issue #231) made `closed` actionable, so it moved OUT of IGNORED_ACTIONS
+	// below. It sits in BOTH maps deliberately: the maps are selected by EVENT NAME, so `closed` on
+	// `issues` and `closed` on `pull_request` are two different routes sharing a spelling, not one
+	// word listed twice -- the never-in-two rule below is about a map versus the ignored set.
+	closed: "closed",
 };
 
 const PR_ACTIONS = {
@@ -51,12 +56,19 @@ const PR_ACTIONS = {
 	reopened: "reopened",
 	label_updated: "labeled",
 	synchronized: "synchronize",
+	closed: "closed", // issue #231 -- see the note on ISSUE_ACTIONS
 };
 
-/** Recognised, and deliberately not actionable. Named so the drop reason can say which it was. */
+/**
+ * Recognised, and deliberately not actionable. Named so the drop reason can say which it was.
+ *
+ * DISJOINT from both action maps, and that is an invariant rather than an accident: `mapAction`
+ * would happily route a word that also sat here, and this set's claim of "ignored" would then be a
+ * lie the drop reason repeats to an operator. `closed` lived here until issue #231 made closes
+ * routable; it MOVED into the maps rather than gaining a twin.
+ */
 const IGNORED_ACTIONS = new Set([
 	"label_cleared", // removing a label must never start a paid run
-	"closed",
 	"edited",
 	"assigned",
 	"unassigned",

package/src/github-members.mjs

@@ -0,0 +1,140 @@
+/**
+ * Resolve a GitHub CLOSER's repository permission -- the enforcement half of `CONST-TRIGGER-AUTHOR-GATE`'s
+ * close arm on the GitHub side.
+ *
+ * Every other GitHub route reads an association straight off the payload and pays no lookup. A close
+ * cannot: an issue's own author can close it with no write access whatsoever, and on a pull request
+ * `author_association` names the AUTHOR, a different person from the closer -- the review inversion a
+ * second time. The payload carries NO association for the closer at all, so the closer is resolved by
+ * login through `GET /repos/{owner}/{repo}/collaborators/{username}/permission`, whose legacy
+ * `permission` field answers `"admin"|"write"|"read"|"none"`. `admin` and `write` are exactly the levels
+ * that can push a branch, which is the property the constitution actually requires.
+ *
+ * The shape of this module is the Forgejo resolver's, for the same three reasons, restated rather than
+ * cross-referenced:
+ *   - it runs in the RECEIVER, between verification and the gate, so `filter` stays pure, total and
+ *     offline-testable -- a fetch inside the gate would make the security-critical decision untestable
+ *     without a server;
+ *   - it runs AFTER verification -- and, unlike every sibling resolver, only for a close delivery an
+ *     armed close rule actually matches (`wantsCloserAuthority`), so every other GitHub path stays
+ *     payload-only and lookup-free, and an unauthenticated flood cannot make this project call GitHub;
+ *   - it returns a two-armed verdict, because "not a collaborator" and "could not tell" are different
+ *     answers. A 404 is determinate and refuses; anything unrecognised is INDETERMINATE and the receiver
+ *     answers 503, so GitHub redelivers and the stable `X-GitHub-Delivery` GUID dedups the retry.
+ *     Collapsing indeterminate to "deny" would drop real work during an outage behind a 204 that looks
+ *     exactly like a stranger being correctly refused.
+ *
+ * One difference from every sibling: there is no operator token in config to close over. The GitHub arm
+ * holds the boot-time auth object instead, so the credential is MINTED per call. On the App source the
+ * caller asks the mint to scope it to the one repository AND narrow it to metadata:read, so what this
+ * function holds cannot write even if leaked; on pat/gh no narrowing exists (the operator's standing
+ * token is what it is, and it already lives in this process's env), so what the wiring buys there is
+ * one read with a credential the receiver held anyway. Never a job credential on any source, and no
+ * container ever receives it (`CONST-TOKEN-SCOPED-PER-JOB`, whose per-job wording start.mjs's header
+ * records). Closes are rare, so per-delivery minting is the recorded cost; the poller's token cache is
+ * the fallback if that changes.
+ *
+ * The username is required (the endpoint takes no numeric id) and is never logged or returned. One
+ * honest bound on that claim, shared with every sibling resolver: the network-throw arm returns
+ * `fetchFailureReason(err)`, and undici's error messages carry the HOST, never the request path --
+ * so the guarantee on that one arm rests on undici's phrasing rather than a fixed token, exactly as
+ * it does in the forgejo/gitlab/azure resolvers. Every arm this module authors itself is a fixed
+ * string.
+ */
+
+import { fetchFailureReason } from "@edgehero/pi-dispatch/gitlab-identity";
+
+/** GitHub's API root. Not configurable: this arm serves github.com, the forges with a host knob have their own resolvers. */
+const API_ROOT = "https://api.github.com";
+
+/**
+ * The permission levels that can push to the repository. `read` and `none` cannot, so a job started on
+ * their say-so would be doing work the actor could not do themselves -- the line CONST-TRIGGER-AUTHOR-GATE
+ * draws. Two members is the COMPLETE honest mapping, not a shortcut: GitHub folds `maintain` into `write`
+ * and `triage` into `read` in this legacy field, so every role that can push already reads as one of
+ * these. The response's richer `role_name` is deliberately not read -- it can name Ultimate custom roles
+ * this code has no table to rank, and ranking them wrongly fails OPEN.
+ */
+const WRITE_PERMISSIONS = new Set(["admin", "write"]);
+
+/**
+ * Build the resolver. `mintToken` is the boot auth object's own minter (it takes a job-shaped `{ repo }`
+ * and scopes the token to it); `fetchFn` is injected so the whole module is testable offline.
+ *
+ * Returns `resolveAuthority(repoFullName, login)` -> `{ authorized: boolean }` | `{ indeterminate: string }`
+ * -- the same shape every forge's resolver returns.
+ */
+export function makeResolveGitHubAuthority({ mintToken, fetchFn = fetch }) {
+	return async function resolveAuthority(repoFullName, login) {
+		// Both halves have to be present AND well-formed before they become path segments. A slash or a `..`
+		// in either would reach a different endpoint than the one this function believes it is asking, and
+		// the answer would be attributed to the wrong repository or the wrong person. Whitespace joins the
+		// refused set here because a GitHub login can never carry it, so its presence is a malformed payload,
+		// not a user. Determinate refusals, before the mint: nothing is asked about, so nothing is spent.
+		const repo = typeof repoFullName === "string" ? repoFullName.split("/") : [];
+		// The repo halves get the login's charset discipline PLUS the dot-segment refusal: a half of
+		// exactly "." or ".." would URL-normalize the request onto a different endpoint than the one
+		// this function believes it is asking (a repo NAME may contain dots -- "next.js" is real -- so
+		// only the two pure dot segments are refused, never dots inside a name).
+		const badHalf = (h) => !h || h === "." || h === ".." || /[/?#\s]/.test(h);
+		if (repo.length !== 2 || badHalf(repo[0]) || badHalf(repo[1]) || typeof login !== "string" || login === "" || /[/?#\s]/.test(login)) {
+			// Not a lookup failure -- the payload never named a repository and an actor we could ask about.
+			return { authorized: false };
+		}
+		// Minted per call, repo-scoped (the auth object's minter reads `job.repo`). A mint failure is
+		// INDETERMINATE -- the closer's standing was never established -- and the reason is a fixed token,
+		// never the thrown message: configError texts name auth sources and key paths, which have no
+		// business in a per-delivery log line.
+		let token;
+		try {
+			token = await mintToken({ repo: repoFullName });
+		} catch {
+			return { indeterminate: "token-mint-failed" };
+		}
+		const url = `${API_ROOT}/repos/${encodeURIComponent(repo[0])}/${encodeURIComponent(repo[1])}/collaborators/${encodeURIComponent(login)}/permission`;
+		let res;
+		try {
+			// `redirect: "error"` so a 30x on this path cannot silently send the token somewhere else -- the
+			// same rule the Forgejo and GitLab resolvers apply.
+			res = await fetchFn(url, {
+				headers: {
+					accept: "application/vnd.github+json",
+					"x-github-api-version": "2022-11-28",
+					authorization: `Bearer ${token}`,
+				},
+				redirect: "error",
+			});
+		} catch (err) {
+			return { indeterminate: fetchFailureReason(err) };
+		}
+		if (res.status === 404) {
+			// Unknown user or unknown repository -- determinate, and refused. NOT the usual non-collaborator
+			// answer: see the `permission: "none"` note below.
+			return { authorized: false };
+		}
+		if (!res.ok) {
+			// Status only. What is NOT here: the response body -- a GitHub error body can echo the request,
+			// and the request carried the token.
+			return { indeterminate: `status-${res.status}` };
+		}
+		let body;
+		try {
+			body = await res.json();
+		} catch {
+			// A fixed token, deliberately WITHOUT the parse error's message -- a divergence from the Forgejo
+			// resolver worth its own line: V8's JSON.parse errors quote the offending input, and the input
+			// here is the response body, which must never reach a returned string.
+			return { indeterminate: "collaborator permission lookup returned unparseable JSON" };
+		}
+		const permission = body?.permission;
+		if (typeof permission !== "string" || permission === "") {
+			// A 200 whose shape we do not recognise is not a refusal. Answering `false` here would turn an
+			// upstream schema change into a silent, permanent refusal of every close trigger.
+			return { indeterminate: "collaborator permission lookup returned no permission string" };
+		}
+		// The NORMAL answer for a non-collaborator is a 200 with `permission: "none"` -- GitHub answers the
+		// question for any visible user rather than 404ing strangers -- so this line, not the 404 arm above,
+		// is where most unauthorized closers are refused.
+		return { authorized: WRITE_PERMISSIONS.has(permission) };
+	};
+}

package/src/gitlab-members.mjs

@@ -78,7 +78,10 @@ export function makeResolveAuthority({ apiUrl, token, fetchFn = fetch }) {
 		try {
 			body = await res.json();
 		} catch (err) {
-			return { indeterminate: `members lookup returned unparseable JSON: ${err?.message ?? "unknown"}` };
+			// A FIXED reason, never err.message: V8's JSON.parse errors quote the offending input,
+			// so a failed res.json() here would carry response-body bytes into a log line -- the
+			// no-pii-in-logs rule the github resolver states, applied to its elders (issue #231).
+			return { indeterminate: "members lookup returned unparseable JSON" };
 		}
 		const level = body?.access_level;
 		if (!Number.isInteger(level)) {

package/src/poller.mjs

@@ -43,9 +43,18 @@
  *                   a closed PR has nothing left to act on, the same call `merge`/`close` get in the
  *                   action vocabulary. REST spells `state` in upper case where the webhook spells it
  *                   lower; `parseSubset` folds it, so both transports produce the same job.
+ *   - closed:       the SAME /issues/events feed as `label` -- `closed` entries carry the CLOSER as
+ *                   `actor` and cover issues AND PRs (`issue.pull_request` is the discriminator again,
+ *                   and a MERGED PR emits `closed` here too, which is what lets a close trigger release
+ *                   post-merge work). Consumed only when a close rule is armed (hasCloseTriggers), so an
+ *                   unarmed deployment's cycle stays byte-identical to a pre-#231 run: no PR fetch, no
+ *                   permission traffic. The closer's write access is resolved via the shared
+ *                   collaborator-permission lookup BEFORE the gate, mirroring the webhook arm
+ *                   (issue #231; see `gate` for the indeterminate-lookup retry bound).
  *
  * DEDUP IDS (REQ-DEDUP-BY-DELIVERY-GUID): polling has no delivery GUID, so each source mints a
- * deterministic stand-in that is stable across retried cycles -- `poll-e<eventId>` (label events),
+ * deterministic stand-in that is stable across retried cycles -- `poll-e<eventId>` (the /issues/events
+ * feed: label AND close entries, one feed so one id family),
  * `poll-c<commentId>` (comments), `poll-pr<number>-<headSha7>` (PR actions; sha-keyed so a retried
  * cycle cannot double-enqueue while a real new push mints a new id -- with the honest corollary that
  * a same-sha reopen inside the retention window coalesces with its own `opened` job), and
@@ -62,6 +71,10 @@
  *   poll:<owner/repo>:etag:reviews     hash: PR number -> that PR's reviews-endpoint validator. A HASH
  *                                      rather than a key per PR, so the family below stays enumerable
  *                                      and `touchRepo` can still refresh it as a unit.
+ *   poll:<owner/repo>:close-gate:<delivery>  consecutive INDETERMINATE closer-lookup attempts for ONE
+ *                                      close event (issue #231). Deliberately OUTSIDE the touched
+ *                                      family, with a short ~1-day TTL of its own: the counter must
+ *                                      decay with the outage it measures, not live with the repo.
  * All keys carry a ~35-day TTL and are refreshed TOGETHER after each successful repo poll. 35 days
  * deliberately exceeds the 31-day gh-* jobId retention (REQ-DEDUP-BY-DELIVERY-GUID): the cursor and
  * the jobId are the poller's two dedup layers, and refreshing/expiring the cursor family as a unit
@@ -98,7 +111,8 @@ import { configError } from "@edgehero/pi-dispatch/config";
 import { parseConnection } from "@edgehero/pi-dispatch/connection";
 import { makeGitHubAuth } from "@edgehero/pi-dispatch/get-token";
 import { enqueueGitHubJob, makeQueue } from "@edgehero/pi-dispatch/queue";
-import { filter } from "./filter.mjs";
+import { filter, hasCloseTriggers, wantsCloserAuthority } from "./filter.mjs";
+import { makeResolveGitHubAuthority } from "./github-members.mjs";
 import { parseSubset } from "./receiver.mjs";
 import { loadPollerConfig } from "./poller-config.mjs";
 
@@ -119,6 +133,13 @@ const MAX_PR_PAGES = 10;
 const MAX_REVIEW_PRS = 50;
 // The hash value marking a PR that left the open list. Cannot collide with a head sha (hex only).
 const CLOSED_MARKER = "closed";
+// The closer-authority retry bound (issue #231): how many consecutive cycles an INDETERMINATE
+// collaborator-permission lookup may hold the events cursor before the close is dropped loudly.
+// ~20 cycles at the default 60s interval is a real outage, not a blip; see `gate` for the tradeoff.
+const CLOSE_GATE_MAX_ATTEMPTS = 20;
+// The retry counter's own TTL: it measures ONE outage around ONE event, so it decays in a day rather
+// than riding the 35-day cursor family (touchRepo never refreshes it -- see the module header).
+const CLOSE_GATE_TTL_SECONDS = 24 * 3600;
 
 /** Thrown by the API helper when the credential's quota is exhausted; carries the reset time in ms. */
 class RateLimited extends Error {
@@ -151,6 +172,7 @@ export async function startPoller(env = process.env, deps = {}) {
 		fsDeps = {},
 		makeAuth = makeGitHubAuth,
 		makeQueueFn = makeQueue,
+		makeResolveGitHubAuthority: makeResolveGitHubAuthorityFn = makeResolveGitHubAuthority,
 	} = deps;
 
 	const cfg = loadPollerConfig(env, fsDeps);
@@ -173,6 +195,16 @@ export async function startPoller(env = process.env, deps = {}) {
 		? makeAppInstallationTokenFn(cfg.github, { fetchFn, readFile, now })
 		: async () => (await getAuth()).mintToken());
 
+	// The closer-authority resolver (issue #231), built over the poller's OWN mint above -- the injected
+	// factory default, start.mjs's convention. On the app source that mint hands back the CACHED,
+	// UNSCOPED installation token (makeAppInstallationTokenFn below), and the resolver's job-shaped
+	// `{ repo }` argument is simply ignored by it. That is fine for what this token does here: one
+	// read-only permission lookup that never leaves this process. The webhook arm's per-delivery
+	// metadata:read narrowing (start.mjs) is the stricter posture; the poller's cache is the deliberate
+	// cost tradeoff its own header already records (the credential must read every polled repo anyway),
+	// and github-members.mjs names this cache as the recorded fallback to per-delivery minting.
+	const resolveCloserAuthority = makeResolveGitHubAuthorityFn({ mintToken, fetchFn });
+
 	// Cursor store. ioredis is imported lazily so tests injecting a fake never load the driver. The
 	// client rides out disconnects (ioredis reconnects on its own) -- same posture as the receiver's
 	// queue connection: a long-running producer should survive a Valkey restart.
@@ -198,7 +230,7 @@ export async function startPoller(env = process.env, deps = {}) {
 		if (ownRedis) await redisClient.quit();
 	};
 
-	const ctx = { cfg, selfId, fetchFn, redis: redisClient, enqueue, out, now, random };
+	const ctx = { cfg, selfId, fetchFn, redis: redisClient, enqueue, out, now, random, resolveCloserAuthority };
 
 	// The repo set: explicit POLL_REPOS, or the App installation's list (cfg.repos === null only when
 	// the source is app -- poller-config enforces it). An empty discovery is a config error, not an
@@ -493,9 +525,29 @@ async function pollLabelEvents(ctx, api, repo, stats) {
 	for (const ev of fresh) {
 		if (ev.event === "labeled" && ev.issue) {
 			await handleLabeledEvent(ctx, api, repo, ev, stats);
+		} else if (ev.event === "closed" && ev.issue && hasCloseTriggers(ctx.cfg?.triggers?.github)) {
+			// The coarse hasCloseTriggers guard IS the byte-identity switch (issue #231): with no close
+			// rule armed, a `closed` entry takes the same do-nothing path every unhandled event always
+			// has -- no PR fetch, no permission traffic, a cycle indistinguishable from a pre-#231 run.
+			// An entry with no `issue` field is malformed and skipped the same way, never thrown on.
+			try {
+				await handleClosedEvent(ctx, api, repo, ev, stats);
+			} catch (err) {
+				// The scoped catch that keeps a close-gate spell from starving the WHOLE repo: a throw
+				// here (an indeterminate closer lookup below its bound, a PR fetch blip) must hold THIS
+				// feed's cursor before the failed event -- a monotone cursor cannot skip one entry and
+				// come back -- but the comment and pull feeds have their OWN cursors and their own real
+				// work, so ending only the events feed for this cycle lets pollRepo continue to them.
+				// RateLimited still propagates: the quota is credential-global and pollRepo's caller
+				// sleeps the whole roster out, which no per-feed catch may swallow.
+				if (err instanceof RateLimited) throw err;
+				ctx.out({ event: "poll_close_gate_retry", repo, delivery: `poll-e${ev.id}`, reason: err?.message });
+				return;
+			}
 		}
 		// Advance ONLY after the event is handled: an enqueue/fetch failure above leaves the cursor on
-		// the last success, so the retry next cycle resumes at the exact failed event.
+		// the last success, so the retry next cycle resumes at the exact failed event. Unmatched and
+		// unarmed closes advance past here exactly like every unhandled event always has.
 		await setWithTtl(ctx, k.events, String(ev.id));
 	}
 }
@@ -527,6 +579,42 @@ async function handleLabeledEvent(ctx, api, repo, ev, stats) {
 	}
 }
 
+/**
+ * One `closed` event -> the webhook payload it corresponds to -> the unchanged gate (issue #231).
+ * handleLabeledEvent's twin, split on the same discriminator: the events feed hands us the ISSUE
+ * view, and `issue.pull_request` marks a PR. An issue routes as `issues closed` with the issue object
+ * as-is; a PR must route as `pull_request closed`, and the issue view lacks the PR fields the job's
+ * target carries (title/body/head/base as the webhook subset shapes them), so the PR object is
+ * fetched once per event -- field-for-field parity again, paid only on NEW closed events under an
+ * ARMED close rule (the caller's hasCloseTriggers guard). A MERGED PR emits `closed` in this feed
+ * too, exactly as the webhook's `closed` action covers merged -- which is what lets a prClose
+ * trigger release post-merge work over polling.
+ *
+ * A failing PR fetch rides the labeled twin's own retry discipline: the throw holds the events
+ * cursor and retries next cycle (scoped to this feed since #231). Unbounded on purpose -- unlike an
+ * indeterminate LOOKUP, a fetch failure here has no counter, because the one input that could make
+ * it permanent (a deleted PR) is a GitHub-support-only operation the labeled path has carried
+ * unbounded since it shipped, and a bound would spend its complexity on a case nobody can produce.
+ *
+ * `sender` carries the closer's LOGIN as well as the id, alone among this module's synthesized
+ * payloads: the collaborator-permission lookup is by username because that is the only key GitHub's
+ * endpoint takes. Same justification and same obligation as the webhook subset's `sender.login`
+ * (parseSubset): it exists to have been asked about, it is never logged, and the job literal keeps
+ * `trigger.sender` at `{ id }` alone.
+ */
+async function handleClosedEvent(ctx, api, repo, ev, stats) {
+	const deliveryId = `poll-e${ev.id}`;
+	const sender = { id: ev.actor?.id, login: ev.actor?.login };
+	if (ev.issue.pull_request != null) {
+		const pr = (await api.get(`/repos/${repo}/pulls/${ev.issue.number}`)).json;
+		const payload = { action: "closed", sender, pull_request: pr, repository: { full_name: repo } };
+		await gate(ctx, "pull_request", payload, deliveryId, stats);
+	} else {
+		const payload = { action: "closed", sender, issue: ev.issue, repository: { full_name: repo } };
+		await gate(ctx, "issues", payload, deliveryId, stats);
+	}
+}
+
 /**
  * The comment feed: /issues/comments?since=<cursor>, cursor = newest processed updated_at.
  *
@@ -770,12 +858,59 @@ async function pollReviews(ctx, api, repo, open, stats) {
 
 /**
  * The single choke point every synthesized payload passes through, and deliberately the receiver's
- * exact pipeline: parseSubset -> filter (UNCHANGED, same cfg/selfId) -> replica fanout ->
- * enqueueGitHubJob, with the receiver's own log shapes. Partial replica failure is idempotent for the
- * same reason it is there: the failed cycle re-runs, replicas 1..k-1 dedup on their taken jobIds.
+ * exact pipeline: parseSubset -> (closer-authority resolution, close deliveries only) -> filter
+ * (UNCHANGED, same cfg/selfId) -> replica fanout -> enqueueGitHubJob, with the receiver's own log
+ * shapes. Partial replica failure is idempotent for the same reason it is there: the failed cycle
+ * re-runs, replicas 1..k-1 dedup on their taken jobIds.
+ *
+ * The authority step (issue #231) mirrors the webhook arm's placement exactly -- after the subset,
+ * before the gate -- and `wantsCloserAuthority` is the same shared derivation, so only a close
+ * delivery an armed close rule matches ever costs a lookup: it is false by construction for every
+ * other source this module synthesizes (label, comment, PR diff, review), for a self-close, and for
+ * a close nothing wants. A DETERMINATE answer rides into filter as the sixth argument, so a
+ * stranger's close is the filter's own `closer-not-allowed` drop and the events cursor advances
+ * past it -- an unauthorized close never wedges the feed.
+ *
+ * An INDETERMINATE lookup has no honest verdict, and the webhook arm's answer (503, forge
+ * redelivers) has no analogue here -- the poller IS its own redelivery. So: bounded retry, then a
+ * loud skip. Below the bound this THROWS, on purpose, into pollLabelEvents' scoped catch: the cycle
+ * logs `poll_close_gate_retry`, the events cursor is still sitting BEFORE this event (the caller
+ * advances it only after a handler returns), so the next cycle retries exactly this close -- and
+ * only the EVENTS feed ends for the cycle, because a monotone cursor cannot skip an entry and come
+ * back, while the comment and pull feeds run on their own cursors and must not starve behind a
+ * close-gate spell. The attempt counter lives in redis (INCR + its own short TTL), not in memory,
+ * so a restart mid-outage cannot reset the bound. AT the bound the close is dropped WITHOUT
+ * enqueueing and the cursor advances: one close dropped loudly (`poll_close_gate_gave_up`, with the
+ * delivery id an operator can act on) beats later label and close events wedged forever behind a
+ * lookup that may never come back -- after ~20 cycles this is an outage, not a blip. A crash
+ * between the give-up log and the cursor write re-logs the give-up once on restart (attempt 21):
+ * self-limiting, and preferable to advancing before the operator has a line to act on. The counter
+ * is not deleted on a determinate answer; its TTL decays it, and the cursor has moved past the
+ * delivery id for good.
  */
 async function gate(ctx, eventName, payload, deliveryId, stats) {
-	const result = filter(eventName, parseSubset(payload), ctx.cfg, ctx.selfId, deliveryId);
+	const subset = parseSubset(payload);
+
+	let closerAuthorized;
+	if (wantsCloserAuthority(eventName, subset, ctx.cfg?.triggers?.github, ctx.selfId)) {
+		const repo = subset.repository?.full_name;
+		const resolved = await ctx.resolveCloserAuthority(repo, subset.sender?.login);
+		if (resolved.indeterminate) {
+			const counterKey = `poll:${repo}:close-gate:${deliveryId}`;
+			const attempts = await ctx.redis.incr(counterKey);
+			await ctx.redis.expire(counterKey, CLOSE_GATE_TTL_SECONDS);
+			if (attempts < CLOSE_GATE_MAX_ATTEMPTS) {
+				// The reason names the lookup, never the actor (no-pii-in-logs): resolver reasons are
+				// fixed tokens, and this message becomes pollRepo's poll_repo_failed line.
+				throw new Error(`closer permission lookup indeterminate (${resolved.indeterminate})`);
+			}
+			ctx.out({ event: "poll_close_gate_gave_up", repo, delivery: deliveryId, reason: resolved.indeterminate });
+			return;
+		}
+		closerAuthorized = resolved.authorized;
+	}
+
+	const result = filter(eventName, subset, ctx.cfg, ctx.selfId, deliveryId, closerAuthorized);
 	if (!result.enqueue) {
 		ctx.out({ event: "dropped", delivery: deliveryId, reason: result.reason });
 		return;

package/src/receiver.mjs

@@ -20,7 +20,7 @@
  */
 
 import { makeVerifiedHandler } from "./verify.mjs";
-import { filter } from "./filter.mjs";
+import { filter, wantsCloserAuthority } from "./filter.mjs";
 import { enqueueForgeJob, enqueueGitHubJob, enqueueGitLabJob } from "@edgehero/pi-dispatch/queue";
 import { filterGitLab } from "./filter-gitlab.mjs";
 import { parseGitLabSubset } from "./gitlab-subset.mjs";
@@ -51,7 +51,14 @@ export function parseSubset(payload) {
 	const pr = payload.pull_request;
 	return {
 		action: payload.action,
-		sender: { id: payload.sender?.id },
+		// `login` is CARRIED since issue #231, where this subset deliberately excluded it before. It is
+		// personal data, and it is here for exactly one consumer -- the CLOSER's collaborator-permission
+		// lookup, which is by username because that is the only key GitHub's endpoint takes. Same
+		// justification, and same obligation, as `sender.login` in the Forgejo subset: it exists to have
+		// been asked about, it is never logged (no-pii-in-logs covers everything the resolution path
+		// writes down), and it is never enqueued -- the filter's job literal keeps `trigger.sender` at
+		// `{ id }` alone.
+		sender: { id: payload.sender?.id, login: payload.sender?.login },
 		issue: {
 			number: payload.issue?.number,
 			title: payload.issue?.title,
@@ -127,12 +134,16 @@ export function parseSubset(payload) {
  * undefined, i.e. never drops the harness's own comments. Absent property therefore means no route; the
  * failure of a forgotten property is a 404 an operator sees, never a paid recursion they get billed for.
  */
-export function makeReceiver({ queue, selfId, cfg, log, gitlab = null, forgejo = null, azure = null }) {
+export function makeReceiver({ queue, selfId, cfg, log, gitlab = null, forgejo = null, azure = null, resolveAuthority }) {
 	// Built only when the deployment serves GitHub. Construction is not free of the secret either: the
 	// `new Webhooks({ secret })` inside makeVerifiedHandler throws "options.secret required" on an absent
 	// one, so not building the arm is what lets a github-free deployment legitimately have no secret --
 	// no placeholder, nothing papered over, and no handler holding a secret nobody chose.
-	const github = cfg.servesGithub ? makeGitHubHandler({ queue, selfId, cfg, log }) : null;
+	//
+	// `resolveAuthority` is the GITHUB closer resolver (issue #231), riding top-level beside `selfId`
+	// because github's dependencies always have -- the other forges bundle theirs in per-forge objects.
+	// Optional, because only a close delivery an armed close rule matches ever consults it.
+	const github = cfg.servesGithub ? makeGitHubHandler({ queue, selfId, cfg, log, resolveAuthority }) : null;
 
 	// A TABLE, built once, rather than one `if` per forge. Two forges made that a single branch; four make
 	// it a chain, and a chain is where one arm quietly ends up checked after the fallthrough. A path present
@@ -204,8 +215,15 @@ async function fanout(job, enqueue) {
  * The GitHub arm. Returns `makeVerifiedHandler`'s handler directly, so it only ever sees an already-verified
  * request. `onVerified` owns parse, filter, enqueue, and response; a good signature is the sole
  * precondition D2 guarantees before it runs.
+ *
+ * One step the pre-#231 arm did not have, and the ONLY GitHub path that pays a network call before the
+ * gate: a close delivery an armed close rule matches has the CLOSER's authority resolved here, between
+ * verification and the gate, because the payload carries no association for the closer at all
+ * (github-members.mjs). `wantsCloserAuthority` is the same findCloseRule derivation the filter's route
+ * uses, so a lookup is never spent on a delivery the gate then ignores -- every label, comment, PR and
+ * review delivery, and every close nothing wants, stays payload-only and byte-identical to before.
  */
-function makeGitHubHandler({ queue, selfId, cfg, log }) {
+function makeGitHubHandler({ queue, selfId, cfg, log, resolveAuthority }) {
 	return makeVerifiedHandler({ secret: cfg.webhookSecret }, async ({ rawBody, event, delivery }, res) => {
 		let subset;
 		try {
@@ -214,7 +232,30 @@ function makeGitHubHandler({ queue, selfId, cfg, log }) {
 			return respond(res, 400, { error: "invalid-json" });
 		}
 
-		const result = filter(event, subset, cfg, selfId, delivery);
+		let closerAuthorized;
+		if (wantsCloserAuthority(event, subset, cfg?.triggers?.github, selfId)) {
+			if (!resolveAuthority) {
+				// Defensive only: unreachable in a wired receiver -- start.mjs hard-fails on github auth
+				// before `/` is ever mounted, and the resolver is built over that same auth object. Fail
+				// closed but RETRYABLE, because a wiring fault must not read on the wire as a stranger
+				// being correctly refused.
+				return respond(res, 503, { error: "permission-lookup-failed" });
+			}
+			const resolved = await resolveAuthority(subset.repository?.full_name, subset.sender?.login);
+			if (resolved.indeterminate) {
+				// The reason names the lookup, never the actor -- `sender.login` is personal data and exists
+				// here only to have been asked about (no-pii-in-logs).
+				log?.({ event: "github_permission_lookup_failed", delivery, reason: resolved.indeterminate });
+				// 503: GitHub redelivers, the GUID jobId coalesces the retry. GitHub's auto-redelivery is
+				// weaker than GitLab's, so a lookup outage outlasting the window can lose a webhook-only
+				// deployment's close -- the polling transport's closed source is the backstop where the
+				// poller runs, with its own bounded retry against the same lookup.
+				return respond(res, 503, { error: "permission-lookup-failed" });
+			}
+			closerAuthorized = resolved.authorized;
+		}
+
+		const result = filter(event, subset, cfg, selfId, delivery, closerAuthorized);
 		if (!result.enqueue) {
 			log?.({ event: "dropped", delivery, reason: result.reason });
 			return respond(res, 204);

package/src/start.mjs

@@ -15,8 +15,14 @@
  * issue #99) -- an arm whose endpoint does not exist has no guard to arm, and the invariant that matters is
  * that the two are decided by the SAME property, never separately.
  *
- * The receiver resolves identity ONLY. It holds no per-repo tokens: minting a scoped token is the
- * worker's job, per container, per job (CONST-TOKEN-SCOPED-PER-JOB).
+ * The receiver holds no JOB credentials. Minting a job's scoped token is the worker's business, per
+ * container, per job (CONST-TOKEN-SCOPED-PER-JOB), and that claim keeps its full force. What the
+ * receiver ALSO uses, since issue #231, is a per-close-delivery token for a permission QUESTION --
+ * does the account that closed this item hold write access (CONST-TRIGGER-AUTHOR-GATE's close arm).
+ * On the App source that token is minted repo-scoped AND narrowed to metadata:read (the mint passes
+ * the narrowing through, so a leak of it can write nothing); on pat/gh it is the operator's own
+ * standing token, already resident in this process's env, used for one read. Never a job credential
+ * on any source: no container ever receives it, and it exists only for the lookup it served.
  *
  * DES-ADMIN-VIA-PI-EXTENSION: this process exposes exactly one surface, the webhook handler. There is no
  * admin, dashboard, or admin-extension route here -- the admin surface is a pi extension in the
@@ -36,6 +42,7 @@ import { resolveAzureSelfId } from "@edgehero/pi-dispatch/azure-identity";
 import { makeResolveAuthority } from "./gitlab-members.mjs";
 import { makeResolveForgejoAuthority } from "./forgejo-members.mjs";
 import { makeResolveAzureAuthority } from "./azure-members.mjs";
+import { makeResolveGitHubAuthority } from "./github-members.mjs";
 import { makeQueue } from "@edgehero/pi-dispatch/queue";
 import { parseConnection } from "@edgehero/pi-dispatch/connection";
 
@@ -55,6 +62,7 @@ export async function startReceiver(
 		makeResolveForgejoAuthority: makeResolveForgejoAuthorityFn = makeResolveForgejoAuthority,
 		resolveAzureSelfId: resolveAzureSelfIdFn = resolveAzureSelfId,
 		makeResolveAzureAuthority: makeResolveAzureAuthorityFn = makeResolveAzureAuthority,
+		makeResolveGitHubAuthority: makeResolveGitHubAuthorityFn = makeResolveGitHubAuthority,
 	} = {},
 ) {
 	// Single-object log line: `makeReceiver` calls `log?.({ event, ... })`, so the sink takes ONE object.
@@ -74,12 +82,25 @@ export async function startReceiver(
 	// harness's own completion comments would re-trigger jobs forever. Read that as: never make one of these
 	// two conditions unconditional without the other.
 	let selfId;
+	let resolveAuthority;
 	if (cfg.servesGithub) {
 		// HARD-FAIL identity resolution -- NO try/catch. A throw here (absent/bad github auth, unresolvable
 		// id) propagates and the server below is never created: without selfId the bot-loop guard cannot
 		// run, so refusing to boot is the only safe outcome.
-		({ selfId } = await makeAuth(cfg.github));
+		//
+		// The WHOLE auth object is kept, not just selfId: the closer resolver below mints its per-delivery
+		// metadata-read token through this same object (issue #231), so identity and mint capability stay
+		// one credential decision -- an arm that resolved its identity is exactly the arm that can answer
+		// a permission question. This is also why the github handler's missing-resolver 503 is unreachable
+		// in a wired receiver: a boot that fails here mounts no `/` at all.
+		const auth = await makeAuth(cfg.github);
+		selfId = auth.selfId;
 		log({ event: "self_identity", id: selfId, source: cfg.github.source });
+		// The lookup token asks the mint to narrow to metadata:read -- the App path honors it GitHub-side,
+		// so the token this process holds for the permission question cannot write even if leaked; the
+		// pat/gh sources cannot narrow (the operator's standing token is what it is, and it already lives
+		// in this process's env), which is why the header above words the claim per source.
+		resolveAuthority = makeResolveGitHubAuthorityFn({ mintToken: (job) => auth.mintToken({ ...job, permissions: { metadata: "read" } }) });
 	} else {
 		// Said out loud, because the alternative is an operator staring at a label trigger that does nothing.
 		// The two ways out are the two signals `decideServesGithub` reads, so the line names both.
@@ -137,7 +158,7 @@ export async function startReceiver(
 		};
 	}
 
-	const handler = makeReceiver({ queue, selfId, cfg, log, gitlab, forgejo, azure });
+	const handler = makeReceiver({ queue, selfId, cfg, log, gitlab, forgejo, azure, resolveAuthority });
 	const server = createServer(handler);
 	server.listen(cfg.port, cfg.bind, () =>
 		log({ event: "receiver_started", port: cfg.port, bind: cfg.bind, valkey: cfg.valkeyUrl }),