felhom-controller/REPORT.md

REPORT — CI runs the gate entry point on every push (R-168, 2026-08-02)

Overwritten per the standing rule. The prior contents (session 1's gate enforcement, same day) have their durable record in CHANGELOG.md.

No version bump, no build, no deploy. This adds .gitea/workflows/gates.yml and a CHANGELOG entry. Nothing compiled changed.

What changed

.gitea/workflows/gates.yml — on every push, a Gitea Actions runner obtains this repo at the exact pushed SHA (shallow git fetch, no uses: step anywhere) and runs python3 scripts/controller_gates.py --fast and nothing else. The exit code is the job's result: no || true, no pipe that could swallow it.

It REPORTS, it cannot REFUSE, and the workflow header says so in the pre-push hook's voice: this repo pushes straight to main with no pull request, so there is no merge for a status check to stand at. The refusing half is .githooks/pre-push (per-clone, --no-verify-able); this half notices when that was skipped. Making CI blocking needs branch protection plus a PR workflow — an operator decision, tracked as felhom.eu OPEN-ITEMS.md R-169.

A failed run emails the operator. Probe P5 measured that Gitea itself sends nothing on a failed run — no mail, no notification row, no log line — so the workflow sends its own via Resend and prints the provider's accepted id, making "a message left the machine" an observable. Demonstrated on a real red run in felhom.eu: RESEND-ACCEPTED id=5ff34766-c5f8-4588-8104-08296aeb45ab.

CI reproduces the workspace's SIBLING LAYOUT on purpose. This repo's entry point invokes the shared reuse_refs_check.py that lives in the felhom.eu clone next door and is deliberately never copied here, and this repo's REUSE.md cites wgsync/reconciler.go, which lives in the hub. The workflow clones felhom.eu as a sibling; without it the gate fails closed with gate is MISSING — correctly, but for the wrong reason.

Verification

First run: run #1, id=8, conclusion success, sha dcc400e1.

CI and the local pre-push hook AGREE, which is the check that mattered: 133 cited paths — exact 126, suffix 6, ambiguous 0, cross-repo 1, FAILED 0 (siblings searched: felhom.eu) — identical to the local run.

The runner is unprivileged host-mode, shared with the other three repos on a single owner-scoped registration (measured: all four repos' tasks claimed by felhom-gates-runner). Full probe detail, the security posture and the teardown: felhom.eu/documentation/audits/SPIKE-ci-runner-2026-08-02.md and felhom.eu/REPORT.md.