@edgehero/pi-dispatch-receiver 1.2.0 → 1.4.0

package/src/filter.mjs

@@ -33,9 +33,19 @@
  * All three are hard-coded here, never config-optional -- an ungated auto-trigger is an unbounded paid run
  * started by whoever opens a fork PR (CONST-TRIGGER-AUTHOR-GATE, job-budget rules).
  *
+ * CLOSE ROUTES (issue #231): `issues.closed` and `pull_request.closed` route over the close-trigger
+ * groups (`triggers.issue` / `triggers.prClose`) via the ONE shared derivation in ./close.mjs. Their
+ * gate is `closerAuthorized`, the OPTIONAL sixth parameter: the receiver's pre-resolved answer to
+ * "does the account that closed this item hold write access". It is a parameter because this module
+ * is pure and that answer needs a network lookup the receiver performs (only when
+ * `wantsCloserAuthority` below says a rule wants this close). Strict `=== true` -- anything else,
+ * absence included, fails closed -- so every existing five-argument call site behaves byte-identically:
+ * their routes never read the value.
+ *
  * `selfId` is the numeric id of whichever identity posts as the harness (the App's bot user, or the PAT
  * user); `deliveryId` is the `X-GitHub-Delivery` GUID, carried into the job for downstream dedup.
  */
+import { findCloseRule } from "./close.mjs";
 import { escapeRegExp, firstMatchingRule, labelSet, matchedLabel, matchesRule } from "./predicate.mjs";
 
 const AUTHOR_ALLOWLIST = new Set(["OWNER", "MEMBER", "COLLABORATOR"]);
@@ -48,8 +58,17 @@ const REVIEW_ACTION = "review_submitted";
 const REVIEW_EVENT_ACTION = "submitted";
 // PR_AUTO_ACTIONS is deliberately NOT extended with REVIEW_ACTION: it exists only to select the
 // `pr-author-not-allowed` drop reason, and the review path has reasons of its own.
+//
+// GitHub's close word (issue #231), byte-equal to PR_CLOSE_ACTIONS.github in the shared forge table
+// (worker/src/triggers.mjs). Spelled here rather than imported, deliberately: this file is the GITHUB
+// gate and already spells GitHub's action vocabulary in its own Sets above -- pulling the per-forge
+// table into it would suggest this gate routes other forges' words, which it never does (each forge
+// has a filter of its own, and the config grouping already consumed the table to build the groups this
+// file reads). The word cannot drift: it is what the wire sends, and the route arm below matches the
+// raw payload action against it.
+const CLOSE_ACTION = "closed";
 
-export function filter(eventName, subset, cfg, selfId, deliveryId) {
+export function filter(eventName, subset, cfg, selfId, deliveryId, closerAuthorized) {
 	// (0) Fail-closed on identity. MUST precede the self compare -- see header, ordering constraint.
 	if (typeof subset?.sender?.id !== "number") {
 		return { enqueue: false, reason: "missing-sender-id" };
@@ -85,6 +104,16 @@ export function filter(eventName, subset, cfg, selfId, deliveryId) {
 		// text the harness has already been paid to read, and a dismissal removes a verdict rather than
 		// stating one.
 		resolved = routePullRequest(subset, triggers, REVIEW_ACTION);
+	} else if (eventName === "issues" && action === CLOSE_ACTION) {
+		// The issue close-trigger route (issue #231). The closer-authority gate lives INSIDE the route,
+		// after the rule match -- see routeClose for why it cannot sit up here.
+		resolved = routeIssueClose(subset, triggers, closerAuthorized);
+	} else if (eventName === "pull_request" && action === CLOSE_ACTION) {
+		// `closed` is deliberately NOT in PR_ACTIONS: a close rule gates on the CLOSER's resolved write
+		// access while every other PR rule gates on the author's association or a collaborator's label,
+		// and one route cannot gate on two different actors -- the same line config.mjs's prClose split
+		// draws, which is what makes `triggers.prClose` the only list this arm ever reads.
+		resolved = routePrClose(subset, triggers, closerAuthorized);
 	} else {
 		return { enqueue: false, reason: "unhandled-event" };
 	}
@@ -126,6 +155,7 @@ export function filter(eventName, subset, cfg, selfId, deliveryId) {
 		// receiver has no resolver and reaches no vault -- the worker resolves them pre-spend.
 		...(resolved.secrets !== undefined ? { secrets: resolved.secrets } : {}),
 		...(resolved.secretsProfile !== undefined ? { secretsProfile: resolved.secretsProfile } : {}),
+		...(resolved.waitFor !== undefined ? { waitFor: resolved.waitFor } : {}),
 		...(resolved.instructions !== undefined ? { instructions: resolved.instructions } : {}),
 		// Conditional like packages/image, and for the same reason: an unflagged job's data must stay
 		// byte-identical to today's, so the key is absent rather than present-and-undefined.
@@ -173,6 +203,7 @@ function routeIssueLabel(subset, triggers) {
 		skillsDir: rule.skillsDir,
 		secrets: rule.secrets,
 		secretsProfile: rule.secretsProfile,
+		waitFor: rule.waitFor,
 		instructions: rule.instructions,
 		resume: rule.resume,
 		replicas: rule.replicas,
@@ -232,6 +263,7 @@ function routeComment(subset, triggers, knownFlows) {
 		skillsDir: triggers.comment.skillsDir,
 		secrets: triggers.comment.secrets,
 		secretsProfile: triggers.comment.secretsProfile,
+		waitFor: triggers.comment.waitFor,
 		instructions: triggers.comment.instructions,
 		resume: triggers.comment.resume,
 		replicas: triggers.comment.replicas,
@@ -329,6 +361,7 @@ function routePullRequest(subset, triggers, action) {
 			skillsDir: rule.skillsDir,
 			secrets: rule.secrets,
 			secretsProfile: rule.secretsProfile,
+			waitFor: rule.waitFor,
 			instructions: rule.instructions,
 			resume: rule.resume,
 			replicas: rule.replicas,
@@ -358,3 +391,136 @@ function buildPrTarget(pr) {
 	if (pr.base) target.base = { ref: pr.base.ref };
 	return target;
 }
+
+/**
+ * Issue close path (issue #231). `matched.number` is the CLOSED ITEM's number, not the rule's
+ * narrowing -- an unnarrowed rule fires for any issue, and the decision record must still name which
+ * one spent it, or a once disarm is unexplainable back to an item.
+ */
+function routeIssueClose(subset, triggers, closerAuthorized) {
+	const number = subset.issue?.number;
+	// Integer or refuse, the PR arm's missing-object guard sharpened for BOTH arms: parseSubset always
+	// fabricates `subset.issue` as an object, so object presence proves nothing here, and an UNNARROWED
+	// rule matches on the action alone -- without this line a signed body replayed under a swapped
+	// event header enqueues a paid job whose target has no number at all (and a crafted string number
+	// would ride verbatim into event.json). GitHub only ever sends integers; anything else is a shape
+	// this route must not spend on.
+	if (!Number.isInteger(number)) {
+		return { enqueue: false, reason: "missing-issue-number" };
+	}
+	return routeClose(
+		triggers.issue,
+		number,
+		closerAuthorized,
+		(rule) => ({ index: rule.index, type: "issue", action: CLOSE_ACTION, number, ...(rule.once === true && { once: true }) }),
+		() => ({ type: "issue", number, title: subset.issue?.title, body: subset.issue?.body }),
+	);
+}
+
+/**
+ * PR close path (issue #231), the same guard shape routePullRequest opens with: no pull_request
+ * object is a malformed delivery, refused before any rule is consulted. `matched` carries no number
+ * here -- the target does, exactly as on every other pull_request match.
+ */
+function routePrClose(subset, triggers, closerAuthorized) {
+	const pr = subset.pull_request;
+	// Object AND integer number, the issue arm's rule: a pull_request object without an integer
+	// number is the same malformed delivery wearing a shape, and the dedup key would otherwise read
+	// `#undefined`. One reason for both cases -- to an operator they are one fact.
+	if (pr === null || typeof pr !== "object" || !Number.isInteger(pr.number)) {
+		return { enqueue: false, reason: "missing-pull-request" };
+	}
+	return routeClose(
+		triggers.prClose,
+		pr.number,
+		closerAuthorized,
+		(rule) => ({ index: rule.index, type: "pull_request", action: CLOSE_ACTION, ...(rule.once === true && { once: true }) }),
+		() => buildPrTarget(pr),
+	);
+}
+
+/**
+ * The shared close route: one body for both arms, driving the ONE rule derivation in ./close.mjs --
+ * the same findCloseRule call `wantsCloserAuthority` makes, so "which close does a rule want" can
+ * never drift between the receiver's pre-lookup question and this routing answer.
+ *
+ * `once` rides `matched` only when literally true, mirroring how every optional job field is absent
+ * rather than present-and-false: matched is the downstream disarm signal, and its consumers test
+ * presence, not truthiness.
+ */
+function routeClose(rules, number, closerAuthorized, matchedFor, targetFor) {
+	const found = findCloseRule(rules, CLOSE_ACTION, number);
+	if (found.rule === undefined) {
+		return { enqueue: false, reason: found.reason };
+	}
+	// The authority gate sits INSIDE the route and AFTER the match, deliberately. The receiver performs
+	// the closer's permission lookup only for a delivery some close rule actually wants (that is what
+	// `wantsCloserAuthority` exists for), so a gate BEFORE the rule loop would emit `closer-not-allowed`
+	// for closes no rule matches -- a security token no lookup ever backed, telling an operator an
+	// authority decision was made about a delivery nobody ever resolved. A close nothing wants is
+	// `no-matching-close-trigger`, whoever closed it.
+	//
+	// Strict `!== true`, never truthiness: the value is the receiver's RESOLVED answer, and anything
+	// else reaching here -- undefined from an unwired caller, an indeterminate lookup, a "true" string
+	// or a count from a parse bug -- is a wiring fault that must fail CLOSED, the direction every gate
+	// in this file already takes (CONST-TRIGGER-AUTHOR-GATE).
+	if (closerAuthorized !== true) {
+		return { enqueue: false, reason: "closer-not-allowed" };
+	}
+	const rule = found.rule;
+	return {
+		enqueue: true,
+		// A command rule (issue #189) skips flow resolution entirely: the rule match IS the dispatch.
+		...(rule.command !== undefined ? { command: rule.command } : { flow: rule.flow }),
+		packages: rule.packages, // the MATCHED rule's fields -- rules in one file may differ on them
+		image: rule.image,
+		skillsDir: rule.skillsDir,
+		secrets: rule.secrets,
+		secretsProfile: rule.secretsProfile,
+		waitFor: rule.waitFor,
+		instructions: rule.instructions,
+		resume: rule.resume,
+		replicas: rule.replicas,
+		matched: matchedFor(rule),
+		target: targetFor(),
+	};
+}
+
+/**
+ * Does this forge group arm any close trigger at all? Pure, for the receiver/poller arm: whether the
+ * closer-authority machinery is worth wiring up for a delivery stream is a per-group fact, and
+ * deriving it anywhere else would be a second spelling of "which groups are the close groups".
+ */
+export function hasCloseTriggers(group) {
+	return group?.issue?.length > 0 || group?.prClose?.length > 0;
+}
+
+/**
+ * Should the receiver spend a permission lookup on this delivery before calling `filter`? Pure, and
+ * the SINGLE derivation shared with the route above: it calls the same findCloseRule over the same
+ * groups, so the pre-lookup question and the routing answer cannot drift -- a delivery never costs a
+ * lookup the route then ignores, and never routes a close the lookup never gated (./close.mjs's
+ * header names exactly this hazard).
+ */
+export function wantsCloserAuthority(eventName, subset, group, selfId) {
+	// Filter's own step-0/1 guards, replicated FIRST and in the same order (fail-closed identity, then
+	// the unconditional bot-loop guard): the harness closing its own issue -- the natural last act of
+	// the very flow a close trigger arms -- must not cost a lookup, and an INDETERMINATE lookup on a
+	// self-delivery would 503 (so: redeliver, retry, loop) traffic the filter would only ever drop as
+	// `self`.
+	if (typeof subset?.sender?.id !== "number") return false;
+	if (subset.sender.id === selfId) return false;
+	if (eventName === "issues" && subset.action === CLOSE_ACTION) {
+		// The routes' own shape guards, replicated for the same one-derivation reason as the step-0/1
+		// guards above: an UNNARROWED rule matches an undefined number, so without these lines a
+		// degenerate payload costs a token mint and a lookup the route then drops -- the exact "lookup
+		// the route ignores" this function exists to make impossible.
+		if (!Number.isInteger(subset.issue?.number)) return false;
+		return findCloseRule(group?.issue, CLOSE_ACTION, subset.issue.number).rule !== undefined;
+	}
+	if (eventName === "pull_request" && subset.action === CLOSE_ACTION) {
+		if (subset.pull_request === null || typeof subset.pull_request !== "object" || !Number.isInteger(subset.pull_request.number)) return false;
+		return findCloseRule(group?.prClose, CLOSE_ACTION, subset.pull_request.number).rule !== undefined;
+	}
+	return false;
+}

package/src/forgejo-members.mjs

@@ -77,7 +77,10 @@ export function makeResolveForgejoAuthority({ apiUrl, token, fetchFn = fetch })
 		try {
 			body = await res.json();
 		} catch (err) {
-			return { indeterminate: `collaborator permission lookup returned unparseable JSON: ${err?.message ?? "unknown"}` };
+			// A FIXED reason, never err.message: V8's JSON.parse errors quote the offending input,
+			// so a failed res.json() here would carry response-body bytes into a log line -- the
+			// no-pii-in-logs rule the github resolver states, applied to its elders (issue #231).
+			return { indeterminate: "collaborator permission lookup returned unparseable JSON" };
 		}
 		const permission = body?.permission;
 		if (typeof permission !== "string" || permission === "") {

package/src/forgejo-subset.mjs

@@ -44,6 +44,11 @@ const ISSUE_ACTIONS = {
 	opened: "opened",
 	reopened: "reopened",
 	label_updated: "labeled",
+	// The close trigger (issue #231) made `closed` actionable, so it moved OUT of IGNORED_ACTIONS
+	// below. It sits in BOTH maps deliberately: the maps are selected by EVENT NAME, so `closed` on
+	// `issues` and `closed` on `pull_request` are two different routes sharing a spelling, not one
+	// word listed twice -- the never-in-two rule below is about a map versus the ignored set.
+	closed: "closed",
 };
 
 const PR_ACTIONS = {
@@ -51,12 +56,19 @@ const PR_ACTIONS = {
 	reopened: "reopened",
 	label_updated: "labeled",
 	synchronized: "synchronize",
+	closed: "closed", // issue #231 -- see the note on ISSUE_ACTIONS
 };
 
-/** Recognised, and deliberately not actionable. Named so the drop reason can say which it was. */
+/**
+ * Recognised, and deliberately not actionable. Named so the drop reason can say which it was.
+ *
+ * DISJOINT from both action maps, and that is an invariant rather than an accident: `mapAction`
+ * would happily route a word that also sat here, and this set's claim of "ignored" would then be a
+ * lie the drop reason repeats to an operator. `closed` lived here until issue #231 made closes
+ * routable; it MOVED into the maps rather than gaining a twin.
+ */
 const IGNORED_ACTIONS = new Set([
 	"label_cleared", // removing a label must never start a paid run
-	"closed",
 	"edited",
 	"assigned",
 	"unassigned",

package/src/github-members.mjs

@@ -0,0 +1,140 @@
+/**
+ * Resolve a GitHub CLOSER's repository permission -- the enforcement half of `CONST-TRIGGER-AUTHOR-GATE`'s
+ * close arm on the GitHub side.
+ *
+ * Every other GitHub route reads an association straight off the payload and pays no lookup. A close
+ * cannot: an issue's own author can close it with no write access whatsoever, and on a pull request
+ * `author_association` names the AUTHOR, a different person from the closer -- the review inversion a
+ * second time. The payload carries NO association for the closer at all, so the closer is resolved by
+ * login through `GET /repos/{owner}/{repo}/collaborators/{username}/permission`, whose legacy
+ * `permission` field answers `"admin"|"write"|"read"|"none"`. `admin` and `write` are exactly the levels
+ * that can push a branch, which is the property the constitution actually requires.
+ *
+ * The shape of this module is the Forgejo resolver's, for the same three reasons, restated rather than
+ * cross-referenced:
+ *   - it runs in the RECEIVER, between verification and the gate, so `filter` stays pure, total and
+ *     offline-testable -- a fetch inside the gate would make the security-critical decision untestable
+ *     without a server;
+ *   - it runs AFTER verification -- and, unlike every sibling resolver, only for a close delivery an
+ *     armed close rule actually matches (`wantsCloserAuthority`), so every other GitHub path stays
+ *     payload-only and lookup-free, and an unauthenticated flood cannot make this project call GitHub;
+ *   - it returns a two-armed verdict, because "not a collaborator" and "could not tell" are different
+ *     answers. A 404 is determinate and refuses; anything unrecognised is INDETERMINATE and the receiver
+ *     answers 503, so GitHub redelivers and the stable `X-GitHub-Delivery` GUID dedups the retry.
+ *     Collapsing indeterminate to "deny" would drop real work during an outage behind a 204 that looks
+ *     exactly like a stranger being correctly refused.
+ *
+ * One difference from every sibling: there is no operator token in config to close over. The GitHub arm
+ * holds the boot-time auth object instead, so the credential is MINTED per call. On the App source the
+ * caller asks the mint to scope it to the one repository AND narrow it to metadata:read, so what this
+ * function holds cannot write even if leaked; on pat/gh no narrowing exists (the operator's standing
+ * token is what it is, and it already lives in this process's env), so what the wiring buys there is
+ * one read with a credential the receiver held anyway. Never a job credential on any source, and no
+ * container ever receives it (`CONST-TOKEN-SCOPED-PER-JOB`, whose per-job wording start.mjs's header
+ * records). Closes are rare, so per-delivery minting is the recorded cost; the poller's token cache is
+ * the fallback if that changes.
+ *
+ * The username is required (the endpoint takes no numeric id) and is never logged or returned. One
+ * honest bound on that claim, shared with every sibling resolver: the network-throw arm returns
+ * `fetchFailureReason(err)`, and undici's error messages carry the HOST, never the request path --
+ * so the guarantee on that one arm rests on undici's phrasing rather than a fixed token, exactly as
+ * it does in the forgejo/gitlab/azure resolvers. Every arm this module authors itself is a fixed
+ * string.
+ */
+
+import { fetchFailureReason } from "@edgehero/pi-dispatch/gitlab-identity";
+
+/** GitHub's API root. Not configurable: this arm serves github.com, the forges with a host knob have their own resolvers. */
+const API_ROOT = "https://api.github.com";
+
+/**
+ * The permission levels that can push to the repository. `read` and `none` cannot, so a job started on
+ * their say-so would be doing work the actor could not do themselves -- the line CONST-TRIGGER-AUTHOR-GATE
+ * draws. Two members is the COMPLETE honest mapping, not a shortcut: GitHub folds `maintain` into `write`
+ * and `triage` into `read` in this legacy field, so every role that can push already reads as one of
+ * these. The response's richer `role_name` is deliberately not read -- it can name Ultimate custom roles
+ * this code has no table to rank, and ranking them wrongly fails OPEN.
+ */
+const WRITE_PERMISSIONS = new Set(["admin", "write"]);
+
+/**
+ * Build the resolver. `mintToken` is the boot auth object's own minter (it takes a job-shaped `{ repo }`
+ * and scopes the token to it); `fetchFn` is injected so the whole module is testable offline.
+ *
+ * Returns `resolveAuthority(repoFullName, login)` -> `{ authorized: boolean }` | `{ indeterminate: string }`
+ * -- the same shape every forge's resolver returns.
+ */
+export function makeResolveGitHubAuthority({ mintToken, fetchFn = fetch }) {
+	return async function resolveAuthority(repoFullName, login) {
+		// Both halves have to be present AND well-formed before they become path segments. A slash or a `..`
+		// in either would reach a different endpoint than the one this function believes it is asking, and
+		// the answer would be attributed to the wrong repository or the wrong person. Whitespace joins the
+		// refused set here because a GitHub login can never carry it, so its presence is a malformed payload,
+		// not a user. Determinate refusals, before the mint: nothing is asked about, so nothing is spent.
+		const repo = typeof repoFullName === "string" ? repoFullName.split("/") : [];
+		// The repo halves get the login's charset discipline PLUS the dot-segment refusal: a half of
+		// exactly "." or ".." would URL-normalize the request onto a different endpoint than the one
+		// this function believes it is asking (a repo NAME may contain dots -- "next.js" is real -- so
+		// only the two pure dot segments are refused, never dots inside a name).
+		const badHalf = (h) => !h || h === "." || h === ".." || /[/?#\s]/.test(h);
+		if (repo.length !== 2 || badHalf(repo[0]) || badHalf(repo[1]) || typeof login !== "string" || login === "" || /[/?#\s]/.test(login)) {
+			// Not a lookup failure -- the payload never named a repository and an actor we could ask about.
+			return { authorized: false };
+		}
+		// Minted per call, repo-scoped (the auth object's minter reads `job.repo`). A mint failure is
+		// INDETERMINATE -- the closer's standing was never established -- and the reason is a fixed token,
+		// never the thrown message: configError texts name auth sources and key paths, which have no
+		// business in a per-delivery log line.
+		let token;
+		try {
+			token = await mintToken({ repo: repoFullName });
+		} catch {
+			return { indeterminate: "token-mint-failed" };
+		}
+		const url = `${API_ROOT}/repos/${encodeURIComponent(repo[0])}/${encodeURIComponent(repo[1])}/collaborators/${encodeURIComponent(login)}/permission`;
+		let res;
+		try {
+			// `redirect: "error"` so a 30x on this path cannot silently send the token somewhere else -- the
+			// same rule the Forgejo and GitLab resolvers apply.
+			res = await fetchFn(url, {
+				headers: {
+					accept: "application/vnd.github+json",
+					"x-github-api-version": "2022-11-28",
+					authorization: `Bearer ${token}`,
+				},
+				redirect: "error",
+			});
+		} catch (err) {
+			return { indeterminate: fetchFailureReason(err) };
+		}
+		if (res.status === 404) {
+			// Unknown user or unknown repository -- determinate, and refused. NOT the usual non-collaborator
+			// answer: see the `permission: "none"` note below.
+			return { authorized: false };
+		}
+		if (!res.ok) {
+			// Status only. What is NOT here: the response body -- a GitHub error body can echo the request,
+			// and the request carried the token.
+			return { indeterminate: `status-${res.status}` };
+		}
+		let body;
+		try {
+			body = await res.json();
+		} catch {
+			// A fixed token, deliberately WITHOUT the parse error's message -- a divergence from the Forgejo
+			// resolver worth its own line: V8's JSON.parse errors quote the offending input, and the input
+			// here is the response body, which must never reach a returned string.
+			return { indeterminate: "collaborator permission lookup returned unparseable JSON" };
+		}
+		const permission = body?.permission;
+		if (typeof permission !== "string" || permission === "") {
+			// A 200 whose shape we do not recognise is not a refusal. Answering `false` here would turn an
+			// upstream schema change into a silent, permanent refusal of every close trigger.
+			return { indeterminate: "collaborator permission lookup returned no permission string" };
+		}
+		// The NORMAL answer for a non-collaborator is a 200 with `permission: "none"` -- GitHub answers the
+		// question for any visible user rather than 404ing strangers -- so this line, not the 404 arm above,
+		// is where most unauthorized closers are refused.
+		return { authorized: WRITE_PERMISSIONS.has(permission) };
+	};
+}

package/src/gitlab-members.mjs

@@ -78,7 +78,10 @@ export function makeResolveAuthority({ apiUrl, token, fetchFn = fetch }) {
 		try {
 			body = await res.json();
 		} catch (err) {
-			return { indeterminate: `members lookup returned unparseable JSON: ${err?.message ?? "unknown"}` };
+			// A FIXED reason, never err.message: V8's JSON.parse errors quote the offending input,
+			// so a failed res.json() here would carry response-body bytes into a log line -- the
+			// no-pii-in-logs rule the github resolver states, applied to its elders (issue #231).
+			return { indeterminate: "members lookup returned unparseable JSON" };
 		}
 		const level = body?.access_level;
 		if (!Number.isInteger(level)) {

package/src/poller.mjs

@@ -43,9 +43,18 @@
  *                   a closed PR has nothing left to act on, the same call `merge`/`close` get in the
  *                   action vocabulary. REST spells `state` in upper case where the webhook spells it
  *                   lower; `parseSubset` folds it, so both transports produce the same job.
+ *   - closed:       the SAME /issues/events feed as `label` -- `closed` entries carry the CLOSER as
+ *                   `actor` and cover issues AND PRs (`issue.pull_request` is the discriminator again,
+ *                   and a MERGED PR emits `closed` here too, which is what lets a close trigger release
+ *                   post-merge work). Consumed only when a close rule is armed (hasCloseTriggers), so an
+ *                   unarmed deployment's cycle stays byte-identical to a pre-#231 run: no PR fetch, no
+ *                   permission traffic. The closer's write access is resolved via the shared
+ *                   collaborator-permission lookup BEFORE the gate, mirroring the webhook arm
+ *                   (issue #231; see `gate` for the indeterminate-lookup retry bound).
  *
  * DEDUP IDS (REQ-DEDUP-BY-DELIVERY-GUID): polling has no delivery GUID, so each source mints a
- * deterministic stand-in that is stable across retried cycles -- `poll-e<eventId>` (label events),
+ * deterministic stand-in that is stable across retried cycles -- `poll-e<eventId>` (the /issues/events
+ * feed: label AND close entries, one feed so one id family),
  * `poll-c<commentId>` (comments), `poll-pr<number>-<headSha7>` (PR actions; sha-keyed so a retried
  * cycle cannot double-enqueue while a real new push mints a new id -- with the honest corollary that
  * a same-sha reopen inside the retention window coalesces with its own `opened` job), and
@@ -62,6 +71,10 @@
  *   poll:<owner/repo>:etag:reviews     hash: PR number -> that PR's reviews-endpoint validator. A HASH
  *                                      rather than a key per PR, so the family below stays enumerable
  *                                      and `touchRepo` can still refresh it as a unit.
+ *   poll:<owner/repo>:close-gate:<delivery>  consecutive INDETERMINATE closer-lookup attempts for ONE
+ *                                      close event (issue #231). Deliberately OUTSIDE the touched
+ *                                      family, with a short ~1-day TTL of its own: the counter must
+ *                                      decay with the outage it measures, not live with the repo.
  * All keys carry a ~35-day TTL and are refreshed TOGETHER after each successful repo poll. 35 days
  * deliberately exceeds the 31-day gh-* jobId retention (REQ-DEDUP-BY-DELIVERY-GUID): the cursor and
  * the jobId are the poller's two dedup layers, and refreshing/expiring the cursor family as a unit
@@ -98,7 +111,8 @@ import { configError } from "@edgehero/pi-dispatch/config";
 import { parseConnection } from "@edgehero/pi-dispatch/connection";
 import { makeGitHubAuth } from "@edgehero/pi-dispatch/get-token";
 import { enqueueGitHubJob, makeQueue } from "@edgehero/pi-dispatch/queue";
-import { filter } from "./filter.mjs";
+import { filter, hasCloseTriggers, wantsCloserAuthority } from "./filter.mjs";
+import { makeResolveGitHubAuthority } from "./github-members.mjs";
 import { parseSubset } from "./receiver.mjs";
 import { loadPollerConfig } from "./poller-config.mjs";
 
@@ -119,6 +133,13 @@ const MAX_PR_PAGES = 10;
 const MAX_REVIEW_PRS = 50;
 // The hash value marking a PR that left the open list. Cannot collide with a head sha (hex only).
 const CLOSED_MARKER = "closed";
+// The closer-authority retry bound (issue #231): how many consecutive cycles an INDETERMINATE
+// collaborator-permission lookup may hold the events cursor before the close is dropped loudly.
+// ~20 cycles at the default 60s interval is a real outage, not a blip; see `gate` for the tradeoff.
+const CLOSE_GATE_MAX_ATTEMPTS = 20;
+// The retry counter's own TTL: it measures ONE outage around ONE event, so it decays in a day rather
+// than riding the 35-day cursor family (touchRepo never refreshes it -- see the module header).
+const CLOSE_GATE_TTL_SECONDS = 24 * 3600;
 
 /** Thrown by the API helper when the credential's quota is exhausted; carries the reset time in ms. */
 class RateLimited extends Error {
@@ -151,6 +172,7 @@ export async function startPoller(env = process.env, deps = {}) {
 		fsDeps = {},
 		makeAuth = makeGitHubAuth,
 		makeQueueFn = makeQueue,
+		makeResolveGitHubAuthority: makeResolveGitHubAuthorityFn = makeResolveGitHubAuthority,
 	} = deps;
 
 	const cfg = loadPollerConfig(env, fsDeps);
@@ -173,6 +195,16 @@ export async function startPoller(env = process.env, deps = {}) {
 		? makeAppInstallationTokenFn(cfg.github, { fetchFn, readFile, now })
 		: async () => (await getAuth()).mintToken());
 
+	// The closer-authority resolver (issue #231), built over the poller's OWN mint above -- the injected
+	// factory default, start.mjs's convention. On the app source that mint hands back the CACHED,
+	// UNSCOPED installation token (makeAppInstallationTokenFn below), and the resolver's job-shaped
+	// `{ repo }` argument is simply ignored by it. That is fine for what this token does here: one
+	// read-only permission lookup that never leaves this process. The webhook arm's per-delivery
+	// metadata:read narrowing (start.mjs) is the stricter posture; the poller's cache is the deliberate
+	// cost tradeoff its own header already records (the credential must read every polled repo anyway),
+	// and github-members.mjs names this cache as the recorded fallback to per-delivery minting.
+	const resolveCloserAuthority = makeResolveGitHubAuthorityFn({ mintToken, fetchFn });
+
 	// Cursor store. ioredis is imported lazily so tests injecting a fake never load the driver. The
 	// client rides out disconnects (ioredis reconnects on its own) -- same posture as the receiver's
 	// queue connection: a long-running producer should survive a Valkey restart.
@@ -198,7 +230,7 @@ export async function startPoller(env = process.env, deps = {}) {
 		if (ownRedis) await redisClient.quit();
 	};
 
-	const ctx = { cfg, selfId, fetchFn, redis: redisClient, enqueue, out, now, random };
+	const ctx = { cfg, selfId, fetchFn, redis: redisClient, enqueue, out, now, random, resolveCloserAuthority };
 
 	// The repo set: explicit POLL_REPOS, or the App installation's list (cfg.repos === null only when
 	// the source is app -- poller-config enforces it). An empty discovery is a config error, not an
@@ -493,9 +525,29 @@ async function pollLabelEvents(ctx, api, repo, stats) {
 	for (const ev of fresh) {
 		if (ev.event === "labeled" && ev.issue) {
 			await handleLabeledEvent(ctx, api, repo, ev, stats);
+		} else if (ev.event === "closed" && ev.issue && hasCloseTriggers(ctx.cfg?.triggers?.github)) {
+			// The coarse hasCloseTriggers guard IS the byte-identity switch (issue #231): with no close
+			// rule armed, a `closed` entry takes the same do-nothing path every unhandled event always
+			// has -- no PR fetch, no permission traffic, a cycle indistinguishable from a pre-#231 run.
+			// An entry with no `issue` field is malformed and skipped the same way, never thrown on.
+			try {
+				await handleClosedEvent(ctx, api, repo, ev, stats);
+			} catch (err) {
+				// The scoped catch that keeps a close-gate spell from starving the WHOLE repo: a throw
+				// here (an indeterminate closer lookup below its bound, a PR fetch blip) must hold THIS
+				// feed's cursor before the failed event -- a monotone cursor cannot skip one entry and
+				// come back -- but the comment and pull feeds have their OWN cursors and their own real
+				// work, so ending only the events feed for this cycle lets pollRepo continue to them.
+				// RateLimited still propagates: the quota is credential-global and pollRepo's caller
+				// sleeps the whole roster out, which no per-feed catch may swallow.
+				if (err instanceof RateLimited) throw err;
+				ctx.out({ event: "poll_close_gate_retry", repo, delivery: `poll-e${ev.id}`, reason: err?.message });
+				return;
+			}
 		}
 		// Advance ONLY after the event is handled: an enqueue/fetch failure above leaves the cursor on
-		// the last success, so the retry next cycle resumes at the exact failed event.
+		// the last success, so the retry next cycle resumes at the exact failed event. Unmatched and
+		// unarmed closes advance past here exactly like every unhandled event always has.
 		await setWithTtl(ctx, k.events, String(ev.id));
 	}
 }
@@ -527,6 +579,42 @@ async function handleLabeledEvent(ctx, api, repo, ev, stats) {
 	}
 }
 
+/**
+ * One `closed` event -> the webhook payload it corresponds to -> the unchanged gate (issue #231).
+ * handleLabeledEvent's twin, split on the same discriminator: the events feed hands us the ISSUE
+ * view, and `issue.pull_request` marks a PR. An issue routes as `issues closed` with the issue object
+ * as-is; a PR must route as `pull_request closed`, and the issue view lacks the PR fields the job's
+ * target carries (title/body/head/base as the webhook subset shapes them), so the PR object is
+ * fetched once per event -- field-for-field parity again, paid only on NEW closed events under an
+ * ARMED close rule (the caller's hasCloseTriggers guard). A MERGED PR emits `closed` in this feed
+ * too, exactly as the webhook's `closed` action covers merged -- which is what lets a prClose
+ * trigger release post-merge work over polling.
+ *
+ * A failing PR fetch rides the labeled twin's own retry discipline: the throw holds the events
+ * cursor and retries next cycle (scoped to this feed since #231). Unbounded on purpose -- unlike an
+ * indeterminate LOOKUP, a fetch failure here has no counter, because the one input that could make
+ * it permanent (a deleted PR) is a GitHub-support-only operation the labeled path has carried
+ * unbounded since it shipped, and a bound would spend its complexity on a case nobody can produce.
+ *
+ * `sender` carries the closer's LOGIN as well as the id, alone among this module's synthesized
+ * payloads: the collaborator-permission lookup is by username because that is the only key GitHub's
+ * endpoint takes. Same justification and same obligation as the webhook subset's `sender.login`
+ * (parseSubset): it exists to have been asked about, it is never logged, and the job literal keeps
+ * `trigger.sender` at `{ id }` alone.
+ */
+async function handleClosedEvent(ctx, api, repo, ev, stats) {
+	const deliveryId = `poll-e${ev.id}`;
+	const sender = { id: ev.actor?.id, login: ev.actor?.login };
+	if (ev.issue.pull_request != null) {
+		const pr = (await api.get(`/repos/${repo}/pulls/${ev.issue.number}`)).json;
+		const payload = { action: "closed", sender, pull_request: pr, repository: { full_name: repo } };
+		await gate(ctx, "pull_request", payload, deliveryId, stats);
+	} else {
+		const payload = { action: "closed", sender, issue: ev.issue, repository: { full_name: repo } };
+		await gate(ctx, "issues", payload, deliveryId, stats);
+	}
+}
+
 /**
  * The comment feed: /issues/comments?since=<cursor>, cursor = newest processed updated_at.
  *
@@ -770,12 +858,59 @@ async function pollReviews(ctx, api, repo, open, stats) {
 
 /**
  * The single choke point every synthesized payload passes through, and deliberately the receiver's
- * exact pipeline: parseSubset -> filter (UNCHANGED, same cfg/selfId) -> replica fanout ->
- * enqueueGitHubJob, with the receiver's own log shapes. Partial replica failure is idempotent for the
- * same reason it is there: the failed cycle re-runs, replicas 1..k-1 dedup on their taken jobIds.
+ * exact pipeline: parseSubset -> (closer-authority resolution, close deliveries only) -> filter
+ * (UNCHANGED, same cfg/selfId) -> replica fanout -> enqueueGitHubJob, with the receiver's own log
+ * shapes. Partial replica failure is idempotent for the same reason it is there: the failed cycle
+ * re-runs, replicas 1..k-1 dedup on their taken jobIds.
+ *
+ * The authority step (issue #231) mirrors the webhook arm's placement exactly -- after the subset,
+ * before the gate -- and `wantsCloserAuthority` is the same shared derivation, so only a close
+ * delivery an armed close rule matches ever costs a lookup: it is false by construction for every
+ * other source this module synthesizes (label, comment, PR diff, review), for a self-close, and for
+ * a close nothing wants. A DETERMINATE answer rides into filter as the sixth argument, so a
+ * stranger's close is the filter's own `closer-not-allowed` drop and the events cursor advances
+ * past it -- an unauthorized close never wedges the feed.
+ *
+ * An INDETERMINATE lookup has no honest verdict, and the webhook arm's answer (503, forge
+ * redelivers) has no analogue here -- the poller IS its own redelivery. So: bounded retry, then a
+ * loud skip. Below the bound this THROWS, on purpose, into pollLabelEvents' scoped catch: the cycle
+ * logs `poll_close_gate_retry`, the events cursor is still sitting BEFORE this event (the caller
+ * advances it only after a handler returns), so the next cycle retries exactly this close -- and
+ * only the EVENTS feed ends for the cycle, because a monotone cursor cannot skip an entry and come
+ * back, while the comment and pull feeds run on their own cursors and must not starve behind a
+ * close-gate spell. The attempt counter lives in redis (INCR + its own short TTL), not in memory,
+ * so a restart mid-outage cannot reset the bound. AT the bound the close is dropped WITHOUT
+ * enqueueing and the cursor advances: one close dropped loudly (`poll_close_gate_gave_up`, with the
+ * delivery id an operator can act on) beats later label and close events wedged forever behind a
+ * lookup that may never come back -- after ~20 cycles this is an outage, not a blip. A crash
+ * between the give-up log and the cursor write re-logs the give-up once on restart (attempt 21):
+ * self-limiting, and preferable to advancing before the operator has a line to act on. The counter
+ * is not deleted on a determinate answer; its TTL decays it, and the cursor has moved past the
+ * delivery id for good.
  */
 async function gate(ctx, eventName, payload, deliveryId, stats) {
-	const result = filter(eventName, parseSubset(payload), ctx.cfg, ctx.selfId, deliveryId);
+	const subset = parseSubset(payload);
+
+	let closerAuthorized;
+	if (wantsCloserAuthority(eventName, subset, ctx.cfg?.triggers?.github, ctx.selfId)) {
+		const repo = subset.repository?.full_name;
+		const resolved = await ctx.resolveCloserAuthority(repo, subset.sender?.login);
+		if (resolved.indeterminate) {
+			const counterKey = `poll:${repo}:close-gate:${deliveryId}`;
+			const attempts = await ctx.redis.incr(counterKey);
+			await ctx.redis.expire(counterKey, CLOSE_GATE_TTL_SECONDS);
+			if (attempts < CLOSE_GATE_MAX_ATTEMPTS) {
+				// The reason names the lookup, never the actor (no-pii-in-logs): resolver reasons are
+				// fixed tokens, and this message becomes pollRepo's poll_repo_failed line.
+				throw new Error(`closer permission lookup indeterminate (${resolved.indeterminate})`);
+			}
+			ctx.out({ event: "poll_close_gate_gave_up", repo, delivery: deliveryId, reason: resolved.indeterminate });
+			return;
+		}
+		closerAuthorized = resolved.authorized;
+	}
+
+	const result = filter(eventName, subset, ctx.cfg, ctx.selfId, deliveryId, closerAuthorized);
 	if (!result.enqueue) {
 		ctx.out({ event: "dropped", delivery: deliveryId, reason: result.reason });
 		return;