admin
c6a567122e
gates / gates (push) Failing after 50s
An admission and its mechanism. Building 0.316.3 published another session's work: the shared DooPlex clone held 31 uncommitted files, and the build directory's build.sh is a symlink into that clone's WORKING COPY — which predated the FELHOM_REPO_DIR override, so the override was ignored and the build copied the shared tree. The banner printed 'Commit: 0225255' and no 'Repo:' line; the evidence was on screen and the image was already pushed. Nobody deployed it, which is luck, not a control. The clean-tree rule has been a sentence in a runbook all along. A rule without a mechanism is a wish, so it is now two questions the build asks and refuses on: is every tracked file committed, and is HEAD what origin/main has. A directory that is not a git checkout is refused too — a build whose source cannot be identified is not reproducible. Four new cases in the test (ten in total), each driving the real script; red-proved by deleting the gate, which fails all four. 0.316.3 must never be deployed. It is not re-pushed or deleted: a version number is pushed once, and that applies to a number I spoiled. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0117kRTSgs3rJWUFGxyoWN6Y