[arena-ai-coding-agent]

MERGE HOLD: CI and governance workflows were rejected before jobs started: “Actor is not allowed to trigger Actions workflows.” See the CI run and docs/HANDOFF.adoc. External green checks are not a replacement. No merge or release has been performed.

Summary

This is launch hardening, not a release or regulator approval. Requested by the owner; all seven open issues are dispositioned in docs/LAUNCH-READINESS.adoc, but none is closed by this PR.

• Withdraw unearned calibration labels; distinguish insufficient evidence/no-check (exit 2) from a supported negative result.
• Fix epsilon-dominance cycles, invalid comparisons, parser/config/traversal errors, and format-dependent checks.
• Add an experimental scope/unit/interval/hard-limit contract, explicitly separate from authorization and real-world adequacy.
• Carry typed taxonomy through pattern results/SARIF; preserve unclassified legacy/synthetic findings.
• Harden paginated collection and partial failures; make absent security/native-policy integrations explicit rather than false success.
• Pin Rust/Bookworm, add candidate-container and Action-argument controls, and publish main candidates to development rather than auto-promoting latest.
• Add pinned estate/type-research analysis, split audience documentation, and a next-agent/owner handoff (docs/HANDOFF.adoc).

Compatibility and release boundaries

Missing-evidence blocking checks now return 2 rather than warning with exit 0. Invalid modes/globs/unsupported configured languages are rejected. report remains advisory. The existing Action image digest is unchanged: these source fixes must not be assumed present in an older published artifact. No semver tag, Marketplace release, App deployment or novel-proof claim is authorized.

Validation

Local: available formatting/syntax/workflow-lock/shell/Action-argument checks passed; eight isolated numerical checks passed. These were not pinned-toolchain Cargo integration tests. Local pinned toolchain/dependency/container execution was unavailable; GitHub CI must supply that evidence before merge. CI now tests both default and all retained features, and a real candidate container smoke contract.

Review focus

Confidence is not calibration; a range is not a verified bound; a trade-off heading is not approval. Review no-loss dominance and the separate experimental refinement contract, exit-status compatibility, telemetry completeness limits, and artifact publication boundaries. Full SARIF schema, actual composite-Action/digest/provenance conformance, measurement calibration and App operational parity remain open.

Related: #12, #16, #17, #18, #48, #81, #82.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 7ae69995-8b8c-4eef-ae41-188803b32908

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[arena-ai-coding-agent]

Merge blocked: workflows did not execute

The owner requested that this PR be created and merged if safely possible. I have not merged it or enabled auto-merge because GitHub rejected required workflows before any jobs ran.

CI run: https://github.com/hyperpolymath/oikosbot/actions/runs/36267202433

Actor is not allowed to trigger Actions workflows. Workflow file: '.github/workflows/ci.yml'.

Governance, Hypatia, Secret Scanner, Language Policy and Workflow Security Linter also ended in startup_failure. This is not a source-test failure, nor a passed check. gh pr checks can omit these zero-job failures, so its external green statuses are insufficient. CodeRabbit's initial success was explicitly a skipped review.

Owner's minimal next action

Use an authorized human-triggered event, or resolve the Actions actor restriction for the Arena app. Closing and reopening this PR from the owner's own GitHub account is one normal way to retrigger the existing pull_request workflows; confirm the new actor is allowed and the jobs actually start. If not, inspect the Actions actor/security policy. No credentials need to be shared. Do not bypass protections or force-merge.

Baton

The durable handoff is docs/HANDOFF.adoc. It separates the next agent's engineering tasks from the owner's workload/boundary/authority decisions. First complete actual default/all-feature Rust, Haskell, container and governance checks, address findings, then merge only with evidence. General launch, regulator mode and image-digest promotion remain on hold after merge.

[arena-ai-coding-agent]

@coderabbitai review

Please review the evidence/authorization boundary, no-loss dominance, explicit no-check exit semantics, serialization compatibility and telemetry completeness changes. Your earlier status said review was skipped for a bot user; please do not treat a skipped review as verification. CI is independently blocked by an Actions actor policy and must still run before merge.