Work completed 2026-10-12 · written up 2026-10-13.
The director's rule guard dropped whole rulings because they named the plan's own new file or a public repo read at a fixed commit, which sent three jobs to the COO [landed:1151]
A guard that drops a whole ruling over one path costs more than the path it blocks
The guard now accepts a ruling that names the plan's own files or a public repo read at a fixed commit
Checks refused the same E0599 build after build, though the method was defined ungated in the tree [refusal:1635]
A shared cargo target dir links stale crates across checkouts, so a correct diff can still fail checks
Checks build into a per-job CARGO_TARGET_DIR
The write-path gate refused, six times in a row, a file that the standing ruling required [refusal:1626]
A ruling that names a file does not open it to the builder unless the gate reads the ruling
seat.write_paths now widen to files a director or COO ruling names
The completion audit refused a handback that met every case, once as a list and once as a map with line pointers [refusal:1615]
When two valid shapes are both refused, the fault is in the gate, and another rewrite only repeats the refusal
None yet: the job is parked until the audit reads case IDs and pointers from the fence
The ready gate's call to list the fork's Greptile repositories got HTTP 403 twice [refusal:1632]
A gate that calls an API needs its token scopes checked before the gate runs, not after it refuses
None yet: the CEO has been asked to add read:user to the host gh login