Retire the last exemption: the required-context allow-list is now empty

.machine_readable/required-contexts-allow.txt

@@ -6,6 +6,14 @@
 #
 # Every line is a debt with a name and a reason: `context`
 #
+# THE LIST IS EMPTY, AND THAT IS THE POINT
+# ----------------------------------------
+# This file's preamble has always said that removing the last entry is the
+# goal and not an edge case. The one entry has now been removed, because the
+# defect it recorded was repaired at the decision layer rather than declared
+# here. Empty is the correct resting state; if an entry comes back, it is a
+# regression with a review trail, not a configuration.
+#
 # WHY THIS FILE EXISTS INSTEAD OF `continue-on-error: true`
 # ---------------------------------------------------------
 # The alternative was an always-green advisory job, and this repository has
@@ -15,33 +23,41 @@
 # was never wired, so it never disagreed with anything.)
 #
 # So the job FAILS on any unsatisfiable required context that is not listed
-# here, and passes only for the ones below, which are reported on every run.
-# A new entry cannot be added quietly: this file is the review surface.
-#
-# Removing the last entry is the point, not an edge case.
-#
-# The known entry is a branch RULE, not a missing workflow. The scan it names
-# does run on every pull request — as `Hypatia verdict grid / Hypatia
-# Neurosymbolic Analysis`, the fork-governance lane. The required context names
-# the OTHER call site of the same reusable workflow: hypatia-scan.yml, whose
-# `scan` job is deliberately push/schedule-only so the same findings are not
-# uploaded to code scanning twice per pull request. So the defect is a context
-# name pointing at the post-merge call site of a scan that is gated pre-merge
-# under a different name.
-#
-# Consequence, measured on #1336: 65 checks green, reviewDecision clear,
-# mergeable, and still BLOCKED — because the required check can never appear.
-# Every pull request in this repository is in that state, and the only way work
-# lands is the ruleset's `always` bypass, which discards the other nineteen
-# required checks in the same action. That is the whole failure mode this
-# repository keeps re-learning: the bypass is not an escape hatch used
-# occasionally, it is the actual merge path, and it makes the nineteen
-# decorative.
-#
-# Repair (decision layer, needs repository admin — the ruleset, not this file):
-# replace the context below with `Hypatia verdict grid / Hypatia Neurosymbolic
-# Analysis` in ruleset 23787415, leaving the other nineteen untouched.
+# here. A new entry cannot be added quietly: this file is the review surface,
+# and the gate also warns when a listed context stops being required, so this
+# file cannot quietly rot into a museum of old exemptions either.
+#
+# RECORD OF THE RETIRED ENTRY
+# ---------------------------
+# Context: `scan / Hypatia Neurosymbolic Analysis`
+# Retired: 2026-10-24
+#
+# It named the second call site of hypatia-scan-reusable.yml. `hypatia-scan.yml`
+# declares that job as push/schedule-only on purpose, so the same findings are
+# not uploaded to code scanning twice per pull request; the pull-request call
+# site is the fork-governance lane, which publishes
+# `Hypatia verdict grid / Hypatia Neurosymbolic Analysis`. A required check is
+# matched by name, and the names differ, so the required one could never be
+# produced while a pull request was open.
+#
+# Measured consequence: #1336 reached 65 passing checks, a cleared
+# reviewDecision and mergeable=MERGEABLE while mergeStateStatus stayed BLOCKED.
+# #1337, which carried the repair, merged 80 minutes BEFORE the ruleset was
+# corrected — so the fix provably did not enable its own merge. Both landed
+# through the ruleset's `always` bypass, which discards every required check in
+# the same action.
+#
+# Retired by the decision layer, as this file asked:
+#   ruleset 23787415, required_status_checks:
+#     scan / Hypatia Neurosymbolic Analysis
+#       -> Hypatia verdict grid / Hypatia Neurosymbolic Analysis
+#   bypass_actors: always on RepositoryRole:5 -> removed
+#   strict_required_status_checks_policy: false -> true
+#   + `Repo self-tests` required (21 contexts, all producible on a pull request)
+#
+# Doing it in this file instead would have required continuing to bypass, and a
+# list of declared exceptions is only safer than a bypass while it stays short.
 #
 # Format: one context per line; `#` starts a comment; blank lines ignored.
-
-scan / Hypatia Neurosymbolic Analysis
+# An empty file (or one holding only comments) asserts that every required
+# context is satisfiable on a pull request.

docs/audits/audit-ci-context-producibility-2026-09-20.adoc

@@ -535,3 +535,57 @@ does not do this: it derives contexts from checks that run and then has to pick
 a ruleset, and with six additive branch rulesets it cannot justify a choice, so
 it reports `AMBIGUOUS` and declines. A scripted single-field edit is the safe
 instrument; a general-purpose rewriter is not.
+
+=== Applied: the decision layer, verified
+
+The repair ran on 2026-10-24 and was verified by reading the ruleset back, not
+by trusting the script's success message.
+
+[cols="2,1,1",options="header"]
+|===
+| Field | Before | After
+
+| `required_status_checks` (Hypatia)
+| `scan / Hypatia Neurosymbolic Analysis`
+| `Hypatia verdict grid / Hypatia Neurosymbolic Analysis`
+
+| `bypass_actors`
+| `RepositoryRole:5`, `always`
+| none
+
+| `strict_required_status_checks_policy`
+| `false`
+| `true`
+
+| Required contexts
+| 20 (1 unproducible)
+| 21, all producible on a pull request
+|===
+
+`Repo self-tests` was added as the twenty-first. It is the check that caught both
+regressions in this audit — the `|| true` that swallowed the gate's exit, and
+inline Python that was banned repository-wide — and under the old ruleset it
+could not block either. A check that detects a defect and cannot stop it is a
+reporter, not a gate; it is now load-bearing.
+
+The gate re-run against the repaired ruleset reports `inspected: true`,
+`producible=23`, `app-owned=1`, and **zero findings**. `.machine_readable/
+required-contexts-allow.txt` is therefore header-only: the entry it carried is
+retired and recorded there, not silently deleted, because a declaration that
+disappears without a trace is indistinguishable from one that was never true.
+
+==== The timestamp that settles the argument
+
+#1337 carried the repair and merged at **21:38:20Z**. The ruleset was corrected
+at **22:57** — seventy-nine minutes later. The fix therefore provably did not
+enable its own merge, and that merge again went through the `always` bypass.
+
+That is the cleanest available proof of this document's thesis. The repository
+did not merge broken work because it lacked checks: it had twenty of them, and
+sixty-five green on the pull request in question. It merged broken work because
+every path to `main` ran through a bypass that discarded all twenty in one
+action, and the only reason the bypass was needed was a required context that
+nothing could produce. Both halves of that are now gone — the unproducible
+context by the ruleset edit, the bypass by deleting it — and the next pull
+request is the first in this repository's history that has no legal path to
+`main` which skips its own checks.