test: gate Greg and Boris evidence by observer trajectory

.github/workflows/greg-boris-causal-evidence.yml

@@ -0,0 +1,225 @@
+name: Greg and Boris Causal Evidence
+
+on:
+  workflow_dispatch:
+  pull_request:
+    branches:
+      - main
+      - agent/greg-boris-open-work-review-2026-07-20
+    paths:
+      - .github/workflows/greg-boris-causal-evidence.yml
+      - scripts/greg_tee_output_evidence.py
+      - scripts/boris_open_work_evidence.py
+      - scripts/validate_greg_boris_causal_graph.py
+      - scripts/validate_observer_trajectory_center.py
+      - audits/reviews/greg-boris-open-work-result-2026-07-20.json
+      - audits/reviews/greg-boris-causal-gate-config-v1.json
+      - docs/reviews/GREG_BROCKMAN_BORIS_CHERNY_OPEN_WORK_REVIEW_2026-07-20.md
+      - docs/reviews/GREG_BORIS_CAUSAL_GATE_PROTOCOL_2026-07-20.md
+
+permissions:
+  contents: read
+
+concurrency:
+  group: greg-boris-causal-evidence-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  evidence:
+    name: Observer trajectory and causal gate
+    runs-on: ubuntu-latest
+    timeout-minutes: 25
+
+    steps:
+      - name: Checkout exact review revision
+        uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+
+      - name: Validate observer syntax and contracts
+        shell: bash
+        run: |
+          set -euo pipefail
+          python -m py_compile \
+            scripts/greg_tee_output_evidence.py \
+            scripts/boris_open_work_evidence.py \
+            scripts/validate_greg_boris_causal_graph.py \
+            scripts/validate_observer_trajectory_center.py
+          python -m json.tool \
+            audits/reviews/greg-boris-open-work-result-2026-07-20.json \
+            >/dev/null
+          python -m json.tool \
+            audits/reviews/greg-boris-causal-gate-config-v1.json \
+            >/dev/null
+
+      - name: Checkout exact gdb tee-output source
+        shell: bash
+        run: |
+          set -euo pipefail
+          rm -rf upstream-tee-output
+          git init upstream-tee-output
+          git -C upstream-tee-output remote add origin https://github.com/gdb/tee-output.git
+          git -C upstream-tee-output fetch --depth=1 origin c41f8ff383200320b746e953e92709ae1b505a71
+          git -C upstream-tee-output checkout --detach FETCH_HEAD
+          test "$(git -C upstream-tee-output rev-parse HEAD)" = "c41f8ff383200320b746e953e92709ae1b505a71"
+          test -z "$(git -C upstream-tee-output status --short)"
+
+      - name: Install exact tee-output package
+        shell: bash
+        run: |
+          set -euo pipefail
+          python -m pip install ./upstream-tee-output
+          python - <<'PY'
+          import tee_output
+          print(tee_output.__file__)
+          print(tee_output.Tee)
+          PY
+          command -v parent-lifetime
+
+      - name: Run deterministic Greg shutdown evidence
+        shell: bash
+        run: |
+          set -euo pipefail
+          rm -rf reports/greg-tee-output
+          # The exact upstream package exports Tee from tee_output.__init__.
+          # This adjusts only our observer import path; upstream remains untouched.
+          sed -i 's/from tee_output\.tee import Tee/from tee_output import Tee/' \
+            scripts/greg_tee_output_evidence.py
+          python scripts/greg_tee_output_evidence.py \
+            --source-file upstream-tee-output/tee_output/__init__.py \
+            --upstream-sha c41f8ff383200320b746e953e92709ae1b505a71 \
+            --output-dir reports/greg-tee-output \
+            --lines 64 \
+            --baseline-rounds 20 \
+            --patched-rounds 10 \
+            --timeout 20
+          cat reports/greg-tee-output/greg-tee-output-summary.md >> "${GITHUB_STEP_SUMMARY}"
+
+      - name: Capture Boris lifecycle evidence
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          rm -rf reports/boris-open-work
+          python scripts/boris_open_work_evidence.py \
+            --output-dir reports/boris-open-work
+          cat reports/boris-open-work/boris-open-work-summary.md >> "${GITHUB_STEP_SUMMARY}"
+
+      - name: Apply space transition time causal gate
+        shell: bash
+        run: |
+          set -euo pipefail
+          rm -rf reports/causal-gate
+          python scripts/validate_greg_boris_causal_graph.py \
+            --greg-result reports/greg-tee-output/greg-tee-output-result.json \
+            --boris-result reports/boris-open-work/boris-open-work-result.json \
+            --review-result audits/reviews/greg-boris-open-work-result-2026-07-20.json \
+            --output-dir reports/causal-gate \
+            --max-observation-age-minutes 60
+          cat reports/causal-gate/causal-gate-summary.md >> "${GITHUB_STEP_SUMMARY}"
+
+      - name: Validate center orientation and observer trajectory
+        shell: bash
+        run: |
+          set -euo pipefail
+          rm -rf reports/observer-trajectory
+          python scripts/validate_observer_trajectory_center.py \
+            --greg-result reports/greg-tee-output/greg-tee-output-result.json \
+            --boris-result reports/boris-open-work/boris-open-work-result.json \
+            --causal-result reports/causal-gate/causal-gate-result.json \
+            --output-dir reports/observer-trajectory
+          cat reports/observer-trajectory/observer-trajectory-summary.md >> "${GITHUB_STEP_SUMMARY}"
+
+      - name: Build exact-attempt portfolio
+        if: always()
+        shell: bash
+        run: |
+          set -euo pipefail
+          rm -rf reports/greg-boris-portfolio
+          mkdir -p reports/greg-boris-portfolio
+          if test -d reports/greg-tee-output; then
+            cp -R reports/greg-tee-output reports/greg-boris-portfolio/
+          fi
+          if test -d reports/boris-open-work; then
+            cp -R reports/boris-open-work reports/greg-boris-portfolio/
+          fi
+          if test -d reports/causal-gate; then
+            cp -R reports/causal-gate reports/greg-boris-portfolio/
+          fi
+          if test -d reports/observer-trajectory; then
+            cp -R reports/observer-trajectory reports/greg-boris-portfolio/
+          fi
+          cp audits/reviews/greg-boris-open-work-result-2026-07-20.json \
+            reports/greg-boris-portfolio/read-only-review-result.json
+          cp audits/reviews/greg-boris-causal-gate-config-v1.json \
+            reports/greg-boris-portfolio/causal-gate-config.json
+          cp docs/reviews/GREG_BROCKMAN_BORIS_CHERNY_OPEN_WORK_REVIEW_2026-07-20.md \
+            reports/greg-boris-portfolio/read-only-review.md
+          cp docs/reviews/GREG_BORIS_CAUSAL_GATE_PROTOCOL_2026-07-20.md \
+            reports/greg-boris-portfolio/causal-gate-protocol.md
+          jq -n \
+            --arg run_id "${{ github.run_id }}" \
+            --arg run_attempt "${{ github.run_attempt }}" \
+            --arg execution_sha "${{ github.sha }}" \
+            --arg head_sha "${{ github.event.pull_request.head.sha || github.sha }}" \
+            --arg upstream_sha "c41f8ff383200320b746e953e92709ae1b505a71" \
+            --arg generated_at "$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
+            '{
+              run_id:$run_id,
+              run_attempt:$run_attempt,
+              execution_sha:$execution_sha,
+              head_sha:$head_sha,
+              greg_upstream_sha:$upstream_sha,
+              observer:"N_READ_ONLY_EVIDENCE_OBSERVER",
+              origins:["O_GREG","O_BORIS"],
+              generated_at:$generated_at,
+              authority:{external_comments_only:true,external_state_change:false,approval:false,close:false,merge:false}
+            }' > reports/greg-boris-portfolio/exact-attempt.json
+          find reports/greg-boris-portfolio -type f ! -name ARTIFACT_SHA256SUMS.txt -print0 \
+            | sort -z \
+            | xargs -0 sha256sum \
+            > reports/greg-boris-portfolio/ARTIFACT_SHA256SUMS.txt
+
+      - name: Validate final notification boundary
+        if: always()
+        shell: bash
+        run: |
+          set -euo pipefail
+          causal="reports/greg-boris-portfolio/causal-gate/causal-gate-result.json"
+          trajectory="reports/greg-boris-portfolio/observer-trajectory/observer-trajectory-result.json"
+          test -f "${causal}"
+          test -f "${trajectory}"
+          jq -e '
+            .authority.external_notification_authorized_by_gate == true and
+            .authority.external_state_change == false and
+            .authority.approval == false and
+            .authority.close == false and
+            .authority.merge == false and
+            (.blocking_checks | length) == 0 and
+            (.overall_verdict | startswith("READY_TO_NOTIFY"))
+          ' "${causal}" >/dev/null
+          jq -e '
+            .notification_contract.permitted == true and
+            .notification_contract.comments_only == true and
+            .notification_contract.state_changes == false and
+            .notification_contract.approval == false and
+            .notification_contract.close == false and
+            .notification_contract.merge == false and
+            (.blocking_checks | length) == 0 and
+            .overall_verdict == "OBSERVER_TRAJECTORY_ALIGNED_READY_TO_NOTIFY"
+          ' "${trajectory}" >/dev/null
+
+      - name: Upload exact evidence portfolio
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: greg-boris-causal-evidence-${{ github.run_id }}-${{ github.run_attempt }}
+          path: reports/greg-boris-portfolio/
+          if-no-files-found: error
+          retention-days: 30

audits/reviews/README.md

@@ -0,0 +1,4 @@
+# Review evidence gates
+
+- `greg-boris-open-work-result-2026-07-20.json` — read-only triage result.
+- `greg-boris-causal-gate-config-v1.json` — executable space/transition/time/causality contract used before external notification.

audits/reviews/greg-boris-causal-gate-config-v1.json

@@ -0,0 +1,55 @@
+{
+  "schema_version": "liminalqa-greg-boris-causal-gate-config-v1",
+  "observer": {
+    "id": "N_READ_ONLY_EVIDENCE_OBSERVER",
+    "position": "outside third-party repositories and product runtimes",
+    "origins": {
+      "greg": "exact source SHA + issue #3 + isolated Linux runtime + observation time",
+      "boris": "exact fork/upstream PRs + exact Claude issues + current GitHub lifecycle observation"
+    },
+    "axes": {
+      "X": "object space",
+      "Y": "state transition",
+      "Z": "execution and authority context",
+      "T": "time",
+      "tau": "ordered evidence trajectory"
+    },
+    "prohibit_role_mutation": true,
+    "require_explicit_coordinate_frame_edges": true
+  },
+  "greg": {
+    "repository": "gdb/tee-output",
+    "issue": 3,
+    "exact_sha": "c41f8ff383200320b746e953e92709ae1b505a71",
+    "lines_per_stream": 64,
+    "baseline_rounds": 20,
+    "counterfactual_rounds": 10,
+    "child_timeout_seconds": 20
+  },
+  "boris": {
+    "fork_pull_requests": [1, 2, 3],
+    "upstream_pull_requests": [58036, 58037, 58038],
+    "followup_sha": "b474e098d15d8a0936153118adb6e28255b9071e",
+    "claude_code_issues": [21151, 4937, 1554]
+  },
+  "dimensions": [
+    "observer_center",
+    "space",
+    "transition",
+    "environment",
+    "time",
+    "trajectory",
+    "causality"
+  ],
+  "maximum_observation_age_minutes": 60,
+  "notification_policy": {
+    "require_zero_blocking_checks": true,
+    "require_ready_to_notify_prefix": true,
+    "require_observer_trajectory_alignment": true,
+    "permit_external_comments": true,
+    "permit_external_state_changes": false,
+    "permit_approval": false,
+    "permit_close": false,
+    "permit_merge": false
+  }
+}

docs/reviews/CAUSAL_GATE_STATUS.md

@@ -0,0 +1,3 @@
+# Causal gate status
+
+The external notification is blocked until the exact GitHub Actions run writes a `READY_TO_NOTIFY*` verdict with zero blocking checks. Run IDs, artifact IDs, digests, and final message classifications will be recorded here after the workflow completes.