redlinegate 0.0.1

package/workflows/redline-gate.yml

@@ -0,0 +1,301 @@
+# Reusable readiness gate. Host in the org `.github` repo at
+# .github/workflows/redline-gate.yml; repos call it from .github/workflows/redline.yml
+# (see templates/redline.yml).
+#
+# IMPORTANT — required-status-check naming. A reusable workflow reports its check runs
+# as "<caller job id> / <called job id>". templates/redline.yml names the caller job
+# `redline-gate`, and the aggregate job below is `gate`, so the context a branch ruleset
+# must require is exactly:
+#
+#     redline-gate / gate
+#
+# Changing either job id changes the required context and will silently block every PR
+# in every onboarded repo. `npx redlinegate verify` checks the
+# real name after onboarding.
+name: Redline Gate
+
+on:
+  workflow_call:
+    inputs:
+      adr-diff-threshold:
+        description: Changed lines above which an ADR link (or the no-adr label) is required
+        type: number
+        default: 300
+      fail-on-dependency-severity:
+        description: Minimum dependency-review severity that fails the gate
+        type: string
+        default: high
+      soft-fail-labels:
+        description: >-
+          Comma-separated labels that downgrade the process checks (checklist, ADR) to
+          warnings. Security checks are never downgraded.
+        type: string
+        default: redline-exempt,redline-sync
+      rung:
+        description: >-
+          The enforcement rung this repository sits at: observe, warn, block-blocker or
+          block-high. `observe` and `warn` report and never block; the block-* rungs stop a
+          merge on a finding at or above their severity. Written by `redline init --rung`,
+          which refuses a promotion the repository's recorded evidence does not support.
+        type: string
+        default: observe
+      exemption-enforcement:
+        description: >-
+          What a soft-fail label without a valid "## Redline exemption" block does.
+          `warn` accepts it and says what is missing; `require` refuses it. Repos move
+          from warn to require one standards version after the block was introduced, so
+          nobody's open pull request is failed by a rule that did not exist when they
+          opened it.
+        type: string
+        default: warn
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  checklist:
+    name: PR checklist
+    runs-on: ubuntu-latest
+    steps:
+      - name: Verify the launch-readiness checklist is complete
+        env:
+          GH_TOKEN: ${{ github.token }}
+          PR: ${{ github.event.pull_request.number }}
+          REPO: ${{ github.repository }}
+        run: |
+          set -euo pipefail
+          body=$(gh pr view "$PR" --repo "$REPO" --json body --jq '.body // ""')
+
+          # Only the Launch readiness section is enforced. "Change type" is a pick-one
+          # list, so requiring every box there would make the gate unpassable.
+          section=$(printf '%s\n' "$body" | awk '
+            /^##[[:space:]]+Launch readiness/ { inside = 1; next }
+            /^##[[:space:]]/                  { inside = 0 }
+            inside                            { print }
+          ')
+
+          if [[ -z "${section//[[:space:]]/}" ]]; then
+            echo "::error::No '## Launch readiness' section in the PR description. Restore .github/pull_request_template.md and complete the checklist."
+            exit 1
+          fi
+
+          unchecked=$(printf '%s\n' "$section" | grep -c '^[[:space:]]*- \[ \]' || true)
+          if [[ "$unchecked" -gt 0 ]]; then
+            printf '%s\n' "$section" | grep '^[[:space:]]*- \[ \]' || true
+            echo "::error::$unchecked unchecked launch-readiness item(s). Tick each one, or delete the line and say why in the PR description."
+            exit 1
+          fi
+          echo "Launch readiness complete."
+
+  adr:
+    name: ADR required for significant changes
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check diff size against ADR link
+        env:
+          GH_TOKEN: ${{ github.token }}
+          PR: ${{ github.event.pull_request.number }}
+          REPO: ${{ github.repository }}
+          THRESHOLD: ${{ inputs.adr-diff-threshold }}
+        run: |
+          set -euo pipefail
+          pr=$(gh pr view "$PR" --repo "$REPO" --json additions,deletions,body,labels)
+          changed=$(jq '.additions + .deletions' <<<"$pr")
+          has_adr=$(jq -r '.body // ""' <<<"$pr" | grep -c 'docs/adr/' || true)
+          exempt=$(jq -r '.labels[].name' <<<"$pr" | grep -cx 'no-adr' || true)
+          echo "changed=$changed threshold=$THRESHOLD adr-links=$has_adr no-adr-label=$exempt"
+          if [[ "$changed" -gt "$THRESHOLD" && "$has_adr" -eq 0 && "$exempt" -eq 0 ]]; then
+            echo "::error::${changed} changed lines with no ADR link. Add docs/adr/NNNN-*.md and link it in the PR body, or apply the 'no-adr' label with a justification comment."
+            exit 1
+          fi
+
+  policy:
+    # The deterministic tier: the rules a checker can decide, evaluated with no
+    # model call. They cost nothing to run and they cannot hallucinate, which is
+    # the point — an author cannot argue with a model about whether the word TODO
+    # appears on a line.
+    #
+    # Soft-fail, like the other process checks. The never-exemptible set is
+    # exactly dependency-review and secrets and this does not join it: these are
+    # code-standard findings, not a security boundary.
+    name: Deterministic policy
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+      - name: Evaluate the deterministic rules
+        env:
+          BASE: ${{ github.event.pull_request.base.sha }}
+          HEAD: ${{ github.event.pull_request.head.sha }}
+          RUNG: ${{ inputs.rung }}
+          REDLINE_CLI_VERSION: '0.0.1'
+        run: |
+          set -euo pipefail
+          # Three dots: the diff against the merge base, not against the tip of
+          # the base branch. Two dots would attribute every commit that landed on
+          # main since this branch started to this pull request's author.
+          git diff "${BASE}...${HEAD}" > /tmp/redline.diff
+          # The rung decides the floor. Without passing it, block-high behaved
+          # exactly like block-blocker — the strictest rung on the ladder did
+          # nothing the one below it did not already do.
+          case "$RUNG" in
+            block-high) fail_on=HIGH ;;
+            *) fail_on=BLOCKER ;;
+          esac
+          npx --yes "redlinegate@${REDLINE_CLI_VERSION}" policy \
+            --diff-file /tmp/redline.diff --fail-on "$fail_on"
+
+  dependency-review:
+    name: Dependency review
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/dependency-review-action@v4
+        with:
+          fail-on-severity: ${{ inputs.fail-on-dependency-severity }}
+          comment-summary-in-pr: on-failure
+
+  secrets:
+    name: Secret scan (diff)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: Scan the PR range
+        # Pinned to the commit behind tag v3.97.1 (2026-08-24). This action runs with
+        # access to the PR diff, so the ref must be immutable — a tag can be moved.
+        # GitHub Actions does not allow expressions in a step `uses:`, so the pin is
+        # reviewed here, in the org `.github` repo, which is the right place for it.
+        # scripts/check-pins.mjs re-resolves it against the upstream tag in CI.
+        uses: trufflesecurity/trufflehog@20652fbbdefffcdaa493a5bf57ab2ac6b1db715b # v3.97.1
+        with:
+          base: ${{ github.event.pull_request.base.sha }}
+          head: ${{ github.event.pull_request.head.sha }}
+          # verified only: `unknown` produces false positives, and this is a blocking
+          # check. Unverified candidates are caught by GHAS secret scanning instead.
+          extra_args: --results=verified --fail
+
+  gate:
+    # Aggregate. The branch ruleset requires the check "redline-gate / gate".
+    name: gate
+    needs: [checklist, adr, policy, dependency-review, secrets]
+    if: always()
+    runs-on: ubuntu-latest
+    steps:
+      - name: Aggregate results
+        env:
+          RESULTS: ${{ toJSON(needs) }}
+          LABELS: ${{ toJSON(github.event.pull_request.labels.*.name) }}
+          SOFT_FAIL_LABELS: ${{ inputs.soft-fail-labels }}
+          EXEMPTION_ENFORCEMENT: ${{ inputs.exemption-enforcement }}
+          RUNG: ${{ inputs.rung }}
+          # Through the environment, never interpolated into the script body:
+          # `${{ github.event.pull_request.body }}` inline is a script injection
+          # anyone who can open a pull request can use.
+          PR_BODY: ${{ github.event.pull_request.body }}
+          # Pinned, not @latest: the gate's behaviour must not change under a
+          # repository because a release happened overnight.
+          REDLINE_CLI_VERSION: '0.0.1'
+        run: |
+          set -euo pipefail
+
+          # Security checks can never be downgraded by a label.
+          HARD_JOBS='["dependency-review","secrets"]'
+
+          hard_failed=$(jq -r --argjson hard "$HARD_JOBS" \
+            'to_entries[] | select(.value.result != "success") | select(.key as $k | $hard | index($k)) | .key' <<<"$RESULTS")
+          soft_failed=$(jq -r --argjson hard "$HARD_JOBS" \
+            'to_entries[] | select(.value.result != "success") | select(.key as $k | $hard | index($k) | not) | .key' <<<"$RESULTS")
+
+          labelled=false
+          for label in ${SOFT_FAIL_LABELS//,/ }; do
+            if jq -e --arg l "$label" 'index($l)' <<<"$LABELS" >/dev/null; then
+              labelled=true
+              echo "Soft-fail label present: $label"
+            fi
+          done
+
+          # A label alone records nothing: not who accepted the failing check, not
+          # why, not until when. The pull request must also carry a
+          # "## Redline exemption" block with a reason and an expiry, and the CLI
+          # is what reads it — re-implementing that parse here would eventually
+          # disagree with the audit that reads the same block later.
+          #
+          # The body is written to a file rather than passed as an argument: a
+          # pull request body is attacker-controlled text full of backticks and
+          # $(...), and interpolating it into a command is how one becomes a
+          # command.
+          exempt=false
+          if [[ "$labelled" == true ]]; then
+            printf '%s' "$PR_BODY" > /tmp/redline-pr-body.md
+            # Every failing soft check must be covered, one at a time. Calling
+            # exempt without --scope never evaluated the scope at all, so an
+            # exemption written for `checklist` silently waived `adr` and the
+            # deterministic `policy` job too — the field was recorded and ignored.
+            exempt=true
+            for check in $soft_failed; do
+              if ! npx --yes "redlinegate@${REDLINE_CLI_VERSION}" exempt \
+                   --body-file /tmp/redline-pr-body.md --scope "$check"; then
+                exempt=false
+                break
+              fi
+            done
+            if [[ "$exempt" == true ]]; then
+              :
+            elif [[ "$EXEMPTION_ENFORCEMENT" != "require" ]]; then
+              echo "::warning::This exemption has no valid \`## Redline exemption\` block. It is being accepted this time; once this repository moves to require, it will not be."
+              exempt=true
+            else
+              echo "::error::A soft-fail label was applied without a valid \`## Redline exemption\` block (reason and expiry required)."
+            fi
+          fi
+
+          {
+            echo "### Redline gate"
+            echo
+            jq -r 'to_entries[] | "- \(.key): \(.value.result)"' <<<"$RESULTS"
+          } >> "$GITHUB_STEP_SUMMARY"
+
+          # The security floor is not on the ladder. Dependency review and the
+          # secret scan block at every rung including observe: the ladder governs
+          # how strictly a repository's own standards are enforced, not whether
+          # the organisation's security minimum applies to it.
+          if [[ -n "$hard_failed" ]]; then
+            echo "::error::Redline gate failed on security checks (not label-exemptible, and not on the enforcement ladder): $hard_failed"
+            exit 1
+          fi
+
+          # Below block-blocker the process checks report and do not block. The
+          # findings are still produced, still commented, and still collected —
+          # observe is not "off", it is "measured and not yet enforced", which is
+          # the whole point of having a rung below blocking at all.
+          # A rung this gate does not recognise is NOT enforcing. cli/config
+          # reads an unrecognised value back as `observe` for the same reason: a
+          # typo must never be able to make a repository stricter than anyone
+          # chose, and the two halves disagreeing meant a typo blocked every pull
+          # request here while the CLI reported the repository as observing.
+          case "$RUNG" in
+            block-blocker|block-high) enforcing=true ;;
+            *) enforcing=false ;;
+          esac
+
+          if [[ -n "$soft_failed" ]]; then
+            if [[ "$enforcing" != true ]]; then
+              echo "::warning::Process checks failed: $soft_failed. This repository is at rung '$RUNG', which reports and does not block. The findings are recorded either way."
+              echo "- **not enforced (rung: $RUNG):** $soft_failed" >> "$GITHUB_STEP_SUMMARY"
+            elif [[ "$exempt" == true ]]; then
+              echo "::warning::Process checks failed but a valid exemption is recorded: $soft_failed. A reviewer is accepting this deliberately, with a reason and an expiry."
+              echo "- **exempted:** $soft_failed" >> "$GITHUB_STEP_SUMMARY"
+            else
+              echo "::error::Redline gate failed: $soft_failed"
+              exit 1
+            fi
+          fi
+
+          echo "Redline gate passed."

package/workflows/redline-sync.yml

@@ -0,0 +1,79 @@
+# Lives in the Redline source repo. Distributes the rendered standards to onboarded
+# repos as pull requests — never as direct pushes, and never as a merge.
+#
+# Targets come from registry.json, the derived register the Redline Registry workflow
+# refreshes nightly from the .redline.json each onboarded repo carries. Nothing here is
+# hand-maintained: a repository that removes Redline leaves the register, and stops being
+# a target, without anyone editing a list.
+#
+# What a repository does with its sync pull request is the repository's decision. Sync
+# makes the change available; the estate dashboard's coverage figure is what makes an
+# ignored one visible.
+name: Redline Sync
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - 'standards/**'
+      - 'cli/render/**'
+      - 'templates/**'
+      - '.github/pull_request_template.md'
+  workflow_dispatch:
+    inputs:
+      dry-run:
+        description: Print the plan without opening pull requests
+        type: boolean
+        default: false
+      only:
+        description: Sync a single repo, as owner/name
+        type: string
+        required: false
+
+permissions:
+  contents: read
+
+concurrency:
+  group: redline-sync
+  cancel-in-progress: false
+
+jobs:
+  sync:
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+
+      - name: Install
+        run: npm ci
+
+      # A sync that distributed stale artifacts would propagate the staleness to
+      # every onboarded repository at once, as a pull request each team is being
+      # asked to trust. This runs first for that reason.
+      - name: Verify rendered artifacts in this repo are current
+        run: node scripts/render-self.mjs --check
+
+      - name: Build CLI
+        run: npm run build
+
+      - name: Open sync pull requests
+        env:
+          # Fine-grained PAT or GitHub App installation token. Required permissions on
+          # every target repo: contents:write, pull_requests:write, workflows:write.
+          # Without `workflows` the push of .github/workflows/redline.yml is rejected.
+          GH_TOKEN: ${{ secrets.REDLINE_SYNC_TOKEN }}
+          DRY: ${{ inputs.dry-run && '--dry-run' || '' }}
+          ONLY: ${{ inputs.only }}
+        run: |
+          set -euo pipefail
+          args=()
+          [[ -n "$DRY" ]] && args+=("$DRY")
+          [[ -n "$ONLY" ]] && args+=(--repo "$ONLY")
+          node dist/bin/redline.js sync ${args[@]+"${args[@]}"}
+
+      - name: Summarise
+        if: always()
+        run: echo "Sync finished with status ${{ job.status }}" >> "$GITHUB_STEP_SUMMARY"

package/workflows/seed-canary.yml

@@ -0,0 +1,231 @@
+# Lives in the redline-metrics repo. Opens a throwaway PR of known-bad code against a
+# canary repo, waits for the automated reviewer, scores it, records the result, and
+# closes the PR.
+#
+# This is the regression test for the review layer itself. Standards drift, models change
+# underneath you, and a repo can silently lose its Copilot review entitlement — none of
+# which shows up in ordinary telemetry, because "no findings" and "nothing to find" look
+# identical. Only a corpus with known answers tells them apart.
+#
+# Configuration (repo variables / secrets on redline-metrics):
+#   vars.CANARY_TARGETS   JSON array, e.g.
+#                         [{"repo":"acme/pilot-web","stack":"react"},
+#                          {"repo":"acme/pilot-api","stack":"nodejs"}]
+#   vars.REDLINE_SOURCE   owner/repo of the Redline source bundle (default <owner>/redline)
+#   secrets.REDLINE_CANARY_TOKEN   contents:write + pull_requests:write on the canary
+#                                  repos ONLY. Never an org-wide token.
+#   secrets.REDLINE_ORG_READ_TOKEN read access, used to check out the source bundle.
+name: Redline Seed Canary
+
+on:
+  schedule:
+    - cron: '0 3 * * 1'
+  workflow_dispatch:
+    inputs:
+      targets:
+        description: Override CANARY_TARGETS with a JSON array for this run
+        type: string
+        required: false
+
+permissions:
+  contents: write
+
+concurrency:
+  group: seed-canary
+  cancel-in-progress: false
+
+jobs:
+  plan:
+    runs-on: ubuntu-latest
+    outputs:
+      targets: ${{ steps.plan.outputs.targets }}
+      any: ${{ steps.plan.outputs.any }}
+    steps:
+      - id: plan
+        env:
+          OVERRIDE: ${{ inputs.targets }}
+          CONFIGURED: ${{ vars.CANARY_TARGETS }}
+        run: |
+          set -euo pipefail
+          raw="${OVERRIDE:-${CONFIGURED:-[]}}"
+          if ! jq -e 'type == "array"' <<<"$raw" >/dev/null 2>&1; then
+            echo "::error::CANARY_TARGETS must be a JSON array of {repo, stack} objects."
+            exit 1
+          fi
+          count=$(jq 'length' <<<"$raw")
+          echo "targets=$(jq -c . <<<"$raw")" >> "$GITHUB_OUTPUT"
+          echo "any=$([[ "$count" -gt 0 ]] && echo true || echo false)" >> "$GITHUB_OUTPUT"
+          echo "$count canary target(s)" >> "$GITHUB_STEP_SUMMARY"
+
+  score:
+    needs: plan
+    if: needs.plan.outputs.any == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 75
+    strategy:
+      fail-fast: false
+      max-parallel: 2
+      matrix:
+        target: ${{ fromJSON(needs.plan.outputs.targets) }}
+    steps:
+      - name: Check out the Redline source bundle
+        uses: actions/checkout@v4
+        with:
+          repository: ${{ vars.REDLINE_SOURCE || format('{0}/redline', github.repository_owner) }}
+          token: ${{ secrets.REDLINE_ORG_READ_TOKEN }}
+          path: redline
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+
+      - name: Open the seed pull request
+        id: open
+        env:
+          GH_TOKEN: ${{ secrets.REDLINE_CANARY_TOKEN }}
+          TARGET_REPO: ${{ matrix.target.repo }}
+          STACK: ${{ matrix.target.stack }}
+        run: |
+          set -euo pipefail
+          branch="redline/seed-canary-$(date -u +%Y%m%d%H%M%S)"
+          work=$(mktemp -d)
+          gh repo clone "$TARGET_REPO" "$work" -- --depth 1 --quiet
+          cd "$work"
+          git checkout -q -b "$branch"
+
+          mkdir -p seeded
+          cp -r "$GITHUB_WORKSPACE/redline/seeded/$STACK"  seeded/
+          cp -r "$GITHUB_WORKSPACE/redline/seeded/clean"   seeded/
+
+          git -c user.name="redline-bot" -c user.email="redline-bot@users.noreply.github.com" \
+            add seeded
+          git -c user.name="redline-bot" -c user.email="redline-bot@users.noreply.github.com" \
+            commit -q -m "test(redline): seed canary for $STACK — DO NOT MERGE"
+          git push -q origin "$branch"
+
+          # redline-exempt keeps the readiness gate from blocking a PR nobody will merge.
+          pr=$(gh pr create --repo "$TARGET_REPO" --head "$branch" \
+            --title "DO NOT MERGE — Redline seed canary ($STACK)" \
+            --body "Automated validation run. This branch contains deliberately broken code and fake credentials. It is scored and closed automatically; never merge it." \
+            --label redline-exempt 2>/dev/null || \
+            gh pr create --repo "$TARGET_REPO" --head "$branch" \
+              --title "DO NOT MERGE — Redline seed canary ($STACK)" \
+              --body "Automated validation run. Scored and closed automatically; never merge it.")
+
+          number="${pr##*/}"
+          echo "branch=$branch" >> "$GITHUB_OUTPUT"
+          echo "pr=$number"     >> "$GITHUB_OUTPUT"
+          echo "Opened $TARGET_REPO#$number on $branch"
+
+      - name: Wait for the automated review to settle
+        env:
+          GH_TOKEN: ${{ secrets.REDLINE_CANARY_TOKEN }}
+          TARGET_REPO: ${{ matrix.target.repo }}
+          PR: ${{ steps.open.outputs.pr }}
+        run: |
+          set -euo pipefail
+          # Reviewers stream comments in over several minutes. Poll until the count stops
+          # moving for two consecutive checks, so a slow reviewer is not scored half-done.
+          deadline=$(( SECONDS + 2400 ))
+          previous=-1
+          stable=0
+          while (( SECONDS < deadline )); do
+            sleep 60
+            count=$(gh api "repos/$TARGET_REPO/pulls/$PR/comments" --paginate --jq 'length' | paste -sd+ - | bc)
+            echo "  comments: $count (previous $previous, stable $stable)"
+            if [[ "$count" -eq "$previous" && "$count" -gt 0 ]]; then
+              stable=$(( stable + 1 ))
+              [[ "$stable" -ge 2 ]] && break
+            else
+              stable=0
+            fi
+            previous="$count"
+          done
+          if [[ "${previous:-0}" -le 0 ]]; then
+            echo "::warning::No review comments appeared within the wait window. Scoring will report zero recall, which is itself the finding."
+          fi
+
+      - name: Score against the corpus
+        id: score
+        env:
+          GH_TOKEN: ${{ secrets.REDLINE_CANARY_TOKEN }}
+          TARGET_REPO: ${{ matrix.target.repo }}
+          PR: ${{ steps.open.outputs.pr }}
+        working-directory: redline
+        run: |
+          set -euo pipefail
+          mkdir -p "$GITHUB_WORKSPACE/scores"
+          npx --yes "redlinegate@0.0.1" metrics score-seeds --repo "$TARGET_REPO" --pr "$PR" --json \
+            > "$GITHUB_WORKSPACE/scores/$(echo "$TARGET_REPO" | tr / -).json" || echo "score-seeds exited non-zero"
+          npx --yes "redlinegate@0.0.1" metrics score-seeds --repo "$TARGET_REPO" --pr "$PR" \
+            | tee -a "$GITHUB_STEP_SUMMARY" || true
+
+      - name: Close the canary pull request
+        if: always()
+        env:
+          GH_TOKEN: ${{ secrets.REDLINE_CANARY_TOKEN }}
+          TARGET_REPO: ${{ matrix.target.repo }}
+          PR: ${{ steps.open.outputs.pr }}
+          BRANCH: ${{ steps.open.outputs.branch }}
+        run: |
+          set -euo pipefail
+          # Cleanup must not be skippable: the branch contains fake credentials and code
+          # that exists only to fail review.
+          if [[ -n "${PR:-}" ]]; then
+            gh pr close "$PR" --repo "$TARGET_REPO" --delete-branch --comment "Scored automatically by the Redline seed canary. Closing." || true
+          fi
+          if [[ -n "${BRANCH:-}" ]]; then
+            gh api -X DELETE "repos/$TARGET_REPO/git/refs/heads/$BRANCH" >/dev/null 2>&1 || true
+          fi
+          echo "cleanup done"
+
+      - uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: seed-score-${{ strategy.job-index }}
+          path: scores/
+          if-no-files-found: ignore
+
+  record:
+    needs: score
+    if: always() && needs.score.result != 'skipped'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/download-artifact@v4
+        with:
+          path: scores
+          merge-multiple: true
+
+      - name: Append scores and fail on regression
+        run: |
+          set -euo pipefail
+          mkdir -p data
+          touch data/seed-scores.jsonl
+          shopt -s nullglob
+          files=(scores/*.json)
+          if [[ ${#files[@]} -eq 0 ]]; then
+            echo "::error::No score artifacts were produced — every canary run failed before scoring."
+            exit 1
+          fi
+
+          regressed=0
+          for file in "${files[@]}"; do
+            jq -c . "$file" >> data/seed-scores.jsonl
+            repo=$(jq -r .repo "$file")
+            recall=$(jq -r .totals.blocker_recall "$file")
+            fps=$(jq -r .totals.false_positives_on_clean "$file")
+            attribution=$(jq -r .totals.rule_attribution "$file")
+            echo "- $repo: BLOCKER recall $recall, rule attribution $attribution, false positives $fps" >> "$GITHUB_STEP_SUMMARY"
+            awk -v r="$recall" 'BEGIN { exit (r >= 1 ? 0 : 1) }' || { echo "::error::$repo BLOCKER recall $recall is below 1.0"; regressed=1; }
+            [[ "$fps" -gt 0 ]] && { echo "::error::$repo produced $fps false positive(s) on the clean corpus"; regressed=1; }
+          done
+
+          git config user.name  "redline-bot"
+          git config user.email "redline-bot@users.noreply.github.com"
+          git add data/seed-scores.jsonl
+          git commit -q -m "data: seed canary scores $(date -u +%Y-%m-%d)" || echo "nothing to commit"
+          git pull --rebase origin "${GITHUB_REF_NAME}"
+          git push origin "HEAD:${GITHUB_REF_NAME}"
+
+          exit "$regressed"