Skip to content

ci(core): derive the Issue evidence universe from trusted config (#518) - #519

Merged
James3014 merged 2 commits into
mainfrom
ci/core-trusted-config-universe
Oct 14, 2026
Merged

James3014 merged 2 commits into
mainfrom
ci/core-trusted-config-universe

Conversation

@James3014

Copy link
Copy Markdown
Owner

Summary

  • Moves the Core issue-gate, the receipt-verify and both nexus-certify-ref pins to nexus-core 3f3dc38de7120b66f25eb246d22ef29d5d5971d9 (current nexus-core main; Nexus-new already runs this pin).
  • Adds evidence-universe: trusted-config to the issue-gate with:. The input exists in the action at that SHA, and the action already passes --require-trusted-config. This is the same change as Nexus-new#2033.
  • Issue template, AGENTS.md and HANDOFF.md no longer tell agents to add the marker.

After merge

Issues no longer need the NEXUS_CORE_EVIDENCE_UNIVERSE marker. An open Issue and exactly one NEXUS_CORE_ISSUE marker in the PR body are still required. NEXUS_CORE_MATERIAL_TRANSITION is unchanged.

Verification

  • nexus-certify markers at 3f3dc38 loads this repo's committed .nexus-core/config.toml without error.
  • This PR is checked by the base (old) workflow, so its Issue still carries the marker. The new mode takes effect only after merge (pull_request_target).
  • receipt-verify inputs artifact-id, gate-outcome and pull-request-number are optional at 3f3dc38, so they are left unchanged.

🤖 Generated with Claude Code

James3014 and others added 2 commits October 14, 2026 14:14
Move the Core issue-gate, receipt-verify and both nexus-certify-ref pins to
nexus-core 3f3dc38 and set issue-gate evidence-universe: trusted-config, as
Nexus-new did in #2033. Issues no longer need the NEXUS_CORE_EVIDENCE_UNIVERSE
marker; an open Issue and the PR-body NEXUS_CORE_ISSUE marker stay required.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
…mands (#518)

Review follow-up: forward the issue-gate outcome and artifact-id to
receipt-verify (with pull-requests: read for its live-PR check), as Nexus-new
does, so a run that starts after merge is neutral instead of red. Strip trailing
whitespace on the pin lines. AGENTS.md local issue-init/issue-check now use
--evidence-universe trusted-config, matching CI.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
@James3014

Copy link
Copy Markdown
Owner Author

Review follow-up commit (supersedes the body's line that receipt-verify inputs are left unchanged): the run job now exports artifact-id and outcome, receipt-verify receives artifact-id and gate-outcome, and verify gets pull-requests: read (same as Nexus-new), so a run that starts after merge is neutral instead of red. AGENTS.md local issue-init/issue-check now pass --evidence-universe trusted-config. Trailing whitespace on pin lines removed.

@James3014
James3014 merged commit 001d163 into main Oct 14, 2026
14 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant