[tzhouam]

Item 6 of the approved v8 plan: remove the GitHub-side machinery of v7. The publisher is now the only thing that merges knowledge PRs, and its local gate checks the exact merge result (#227). Provenance audit and revert catch anything that bypasses it (#230).

Removed

• The kb-gate workflow, the .github/kb-gate/ verifier bundle, tools/build_kb_gate_bundle.py and its CI check.
• .github/CODEOWNERS.
• The hold list:
  • publish_holds, verify_holds, holds_server, kb holds-server;
  • the kb-holds signing purpose.
• The human-approved path:
  • maintainer approvals, kb:human-approved, approval_withdrawn;
  • review_ids/reviewers in verdicts. Verdicts are always auto.
• v7 outbox items post_verdict, enqueue, pause and update_branch, with their publisher actions.
• Pause confirmation:
  • pause_open_prs, pause_unconfirmed, resume_paused_prs;
  • kb status → pause_unconfirmed.
• States verdict_posted, queued and paused. v7 never auto-merged in production, so no records need migrating.

Behaviour now

• A pause is the new generation alone.
  • The service signs no merge while a repository is paused.
  • The publisher refuses old-generation items both before running and right before merging.
  • While paused, the service still follows merges, closes and reverts.
  • After resume, the same head is signed again.
• External PRs. One that changes paths outside the governed pages is never merged. Its author is asked to split it in the findings comment.
• Publisher.
  • It refuses companion PRs before looking at the verdict.
  • It never readies or merges a draft PR (a transient refusal).

Tests

• test_kb_local_gate_verifier.py replaces test_kb_gate_verifier.py and runs the same adversarial cases through the local gate.
• New tests:
  • a pause stops merges without touching the PR;
  • a resumed PR is signed again and merged;
  • draft PRs are never merged;
  • a failed close is retried;
  • paths outside the governed pages are never merged, whatever the labels.
• Full suite passes locally, except 3 test_mcp.py tests that fail the same way on origin/main (missing mcp module in this environment).
• check_spec_freshness: clean.
• Commit hook review (codex gpt-6-astra-high): APPROVE at iteration 1.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-29T07:07:15.326213Z	0f41854	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.