feat: squabble verify-satisfied — the definition of done for a PR (exit 5 if not)

[hyperpolymath]

Adds squabble verify-satisfied <owner>/<repo> <pr>, one implementation of "is this PR actually done?" for the D2 Stop hook and for humans. JSON goes to stdout and a readable list to stderr. Exit 5 means agent work remains; 0/2/3/4 keep their existing meanings.

⚠ Stacked on #114 (base fix/rollup-neutral-skipped-pass). When #114 merges, retarget this PR to main before merging. Otherwise GitHub closes it when the base branch is deleted.

What counts as done

#	Condition	Agent item when unmet
1	Not CONFLICTING; mergeability computed; not draft; not BEHIND	resolve in-file / re-run / mark ready / update
2	No required context Failed or Missing. Pending is fine; skipped/neutral satisfy but are listed as evidence-free	fix the check or the ruleset
2b	No red non-required check, unless a PR-body line names it with an issue link (the 2026-09-15 ruling: a finding becomes an issue, not a blocker, but someone must have looked). An acknowledged red moves to notes and is still shown	fix it, or file an issue and name it in the body
3	Zero unresolved review threads (outdated ones count); no review-bot CHANGES_REQUESTED; no review bot still pending	act on or resolve; wait for the bot
4	Code-scanning alerts the PR introduces	not evaluated yet and said so in notes → #117
5+6	Automerge armed with SQUASH wherever GitHub allows arming	arm / re-arm with squash
7	Every [.rules[].type] on the base, not just required checks. merge_queue refuses rather than passing vacuously; unknown types go to notes	—

Held by a human (listed, not agent work): human approval, a required deployment, and a CLEAN PR, which GitHub refuses to arm automerge on, so it waits for a human merge. Change requests made only by review bots are agent work, not human-held.

Shared rules, so fetch and verify-satisfied can't disagree

• CheckRun::from_github maps rollup vocabulary. An unknown completed conclusion is Failed.
• CheckRun::for_context decides a required context from all same-named runs, and the worst run wins. Both readers used first-match before, so a passing twin could mask a failing one depending on rollup order.

Evidence

• Tests: core 103, cli 44, forge 16, plus the rest, all green. Mutants killed: first-match ordering (2 red), the non-required loop disabled (1), the link requirement dropped (1), the context match dropped (1), digit-after-# dropped (1), ctx_done = true in pagination (2).
• Live control 1, both arms (fix(gate): SKIPPED/NEUTRAL required checks satisfy, as Skipped #114): with no acknowledgement it exits 5 naming rust-ci / Cargo check + clippy + fmt. After a body line citing style: make rust-ci green on main (fmt, needless lifetime, dead fn) #116 it exits 0, and the acknowledged red is still shown in notes.
• Live control 3 (standards#1076): exit 5, correctly (Debt ratchet red on main; SonarCloud Code Analysis required but never emitted → standards#1081).
• Live control 4 (hypatia#883, another session's PR, read only): exit 5 with the same 5 unresolved threads an independent GraphQL count finds.
• The "armed + required pending ⇒ exit 0" arm is unit-tested only; I found no live PR in that state to exercise it.

Not in this PR

• No SPARK mirror for D1. done.rs is a policy table over forge facts with no state machine or invariant; the proof obligations live in gate_machine, which fix(gate): SKIPPED/NEUTRAL required checks satisfy, as Skipped #114 mirrors. (ci: prove spark/gate_machine in CI (no workflow runs gnatprove) #115 tracks getting gnatprove into CI at all.)
• Check 4 and inherited-vs-new red checks → verify-satisfied: PR-minus-base — check 4 (introduced alerts) + inherited vs new red checks #117. The positive control is launch-scaffolder#46's hardcoded_tmp alert.
• ~/.claude/hooks/apps-ack-gate.sh is a second implementation of this question → apps-ack-gate.sh is a second implementation of verify-satisfied — make it a caller #118.

Inherited red

• rust-ci / Cargo check + clippy + fmt is red on main (b12657f): unformatted squabble-fight, a needless_lifetimes in workflows.rs:628, and a dead run_with_greens. Cured by style: make rust-ci green on main (fmt, needless lifetime, dead fn) #116; merge order style: make rust-ci green on main (fmt, needless lifetime, dead fn) #116 → fix(gate): SKIPPED/NEUTRAL required checks satisfy, as Skipped #114 → this. Checked locally with style: make rust-ci green on main (fmt, needless lifetime, dead fn) #116's fix applied temporarily: this branch's own code passes clippy -D warnings and rustfmt --check.

🤖 Generated with Claude Code

https://claude.ai/code/session_0136eszqrQ53Kj7aBH1D4rXK

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 1af77fe2-bda5-43a0-9ac5-6660921808c7

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[hyperpolymath]

Pushed 0870d63 (signed): verify-satisfied skips the base-gate REST read for a merged or closed PR. The base gate feeds only the evidence-free listing there, never an agent item — pinned by the new core test the_base_gate_never_decides_a_closed_or_merged_verdict, killed by a mutant that routes every state through the open-PR path. Motivation, measured live: landed hyperpolymath/hypatia#880 failed closed on a REST secondary 403 (core quota 5000) at exactly that call. Workspace tests green (core 104, cli 44, forge 16+64).

This binary now backs two hooks in the owner's ~/.claude/settings.json (Stop: a result: line naming a not-done PR blocks; PreToolUse: non-squash merges denied on Bash and both MCP merge tools; 48-check mutant harness).

[hyperpolymath]

58d1af6: a MERGE automerge is no longer agent work; only REBASE is.

The owner ruled on 2026-09-30: allow merge commits, never rebase. A merge commit is GitHub-signed and is kept for proof PRs. Rebase replays commits unsigned (119 of 286 unsigned default-branch commits).

• done.rs: WrongMergeMethod fires only on REBASE, and its description now reads "re-arm with SQUASH (or MERGE for a proof PR)".
• Test renamed to a_rebase_automerge_is_agent_work_but_a_merge_commit_is_not. It asserts REBASE → wrong_merge_method and MERGE → no agent items. A mutant that drops MERGE from the accepted set turns it red.
• Workspace tests are green. The clippy/fmt failures are pre-existing in squabble-fight on main and are not from this change.

The matching changes are the merge-gate hook (local, 54/54 mutant harness) and hypatia#884 (strategist never picks :rebase; merged).

🤖 Generated with Claude Code

https://claude.ai/code/session_0136eszqrQ53Kj7aBH1D4rXK

[coderabbitai]

Autopilot could not be updated. Open Coding to check access and billing.