felhom-agent/REPORT.md

REPORT — CI runs the gate entry point on every push (R-168, 2026-08-02)

Overwritten per the standing rule. The prior contents (session 1's gate entry point, same day) have their durable record in CHANGELOG.md.

No version bump, no build, no deploy. This adds .gitea/workflows/gates.yml and a CHANGELOG entry. Nothing compiled changed.

What changed

.gitea/workflows/gates.yml — on every push, a Gitea Actions runner obtains this repo at the exact pushed SHA (shallow git fetch, no uses: step anywhere) and runs python3 scripts/agent_gates.py --fast and nothing else. The exit code is the job's result: no || true, no pipe that could swallow it.

It REPORTS, it cannot REFUSE, and the workflow header says so in the pre-push hook's voice: this repo pushes straight to main with no pull request, so there is no merge for a status check to stand at. The refusing half is .githooks/pre-push (per-clone, --no-verify-able); this half notices when that was skipped. Making CI blocking needs branch protection plus a PR workflow — an operator decision, tracked as felhom.eu OPEN-ITEMS.md R-169.

A failed run emails the operator. Probe P5 measured that Gitea itself sends nothing on a failed run — no mail, no notification row, no log line — so the workflow sends its own via Resend and prints the provider's accepted id, making "a message left the machine" an observable. Demonstrated on a real red run in felhom.eu: RESEND-ACCEPTED id=5ff34766-c5f8-4588-8104-08296aeb45ab.

CI reproduces the workspace's SIBLING LAYOUT on purpose. This repo's entry point invokes the shared reuse_refs_check.py that lives in the felhom.eu clone next door and is deliberately never copied here, and this repo's REUSE.md cites hub/internal/store/dr_recipe.go, which lives in the hub. The workflow clones felhom.eu as a sibling; without it the gate fails closed with gate is MISSING — correctly, but for the wrong reason.

Verification

First run: run #1, id=9, conclusion success, sha eb991445.

CI and the local pre-push hook AGREE, which is the check that mattered: 90 cited paths — exact 88, suffix 1, ambiguous 0, cross-repo 1, FAILED 0 (siblings searched: felhom.eu) — identical to the local run.

The runner is unprivileged host-mode, shared with the other three repos on a single owner-scoped registration (measured: all four repos' tasks claimed by felhom-gates-runner). Full probe detail, the security posture and the teardown: felhom.eu/documentation/audits/SPIKE-ci-runner-2026-08-02.md and felhom.eu/REPORT.md.